import { f as FsSafeError } from "./path-DDpzSMRm.js";
import { a as root } from "./filename-DlXiVc0m.js";
import { b as resolveAbsolutePathForRead } from "./fs-safe-DiVKX-F2.js";
import "./security-runtime-DqfwAqot.js";
import { t as EXTENSION_MIME } from "./mime-Cpa5sAB5.js";
import path from "node:path";
import { spawnSync } from "node:child_process";
import crypto from "node:crypto";
//#region extensions/file-transfer/src/node-host/file-fetch.ts
const FILE_FETCH_HARD_MAX_BYTES = 16 * 1024 * 1024;
const FILE_FETCH_DEFAULT_MAX_BYTES = 8 * 1024 * 1024;
function detectMimeType(filePath) {
	if (process.platform !== "win32") try {
		const result = spawnSync("file", [
			"-b",
			"--mime-type",
			filePath
		], {
			encoding: "utf-8",
			timeout: 2e3
		});
		const stdout = result.stdout?.trim();
		if (result.status === 0 && stdout) return stdout;
	} catch {}
	return EXTENSION_MIME[path.extname(filePath).toLowerCase()] ?? "application/octet-stream";
}
function clampMaxBytes(input) {
	if (typeof input !== "number" || !Number.isFinite(input) || input <= 0) return FILE_FETCH_DEFAULT_MAX_BYTES;
	return Math.min(Math.floor(input), FILE_FETCH_HARD_MAX_BYTES);
}
function classifyFsError(err) {
	if (err instanceof FsSafeError) {
		if (err.code === "not-found") return "NOT_FOUND";
		if (err.code === "symlink") return "SYMLINK_REDIRECT";
		if (err.code === "invalid-path") return "INVALID_PATH";
		if (err.code === "not-file") return "IS_DIRECTORY";
	}
	const code = err?.code;
	if (code === "ENOENT") return "NOT_FOUND";
	if (code === "EACCES" || code === "EPERM") return "PERMISSION_DENIED";
	if (code === "EISDIR") return "IS_DIRECTORY";
	return "READ_ERROR";
}
async function handleFileFetch(params) {
	const requestedPath = params.path;
	if (typeof requestedPath !== "string" || requestedPath.length === 0) return {
		ok: false,
		code: "INVALID_PATH",
		message: "path required"
	};
	if (requestedPath.includes("\0")) return {
		ok: false,
		code: "INVALID_PATH",
		message: "path contains NUL byte"
	};
	if (!path.isAbsolute(requestedPath)) return {
		ok: false,
		code: "INVALID_PATH",
		message: "path must be absolute"
	};
	const maxBytes = clampMaxBytes(params.maxBytes);
	const followSymlinks = params.followSymlinks === true;
	const preflightOnly = params.preflightOnly === true;
	let canonical;
	try {
		canonical = (await resolveAbsolutePathForRead(requestedPath, { symlinks: followSymlinks ? "follow" : "reject" })).canonicalPath;
	} catch (err) {
		const code = classifyFsError(err);
		const canonicalPath = err instanceof FsSafeError && err.cause && typeof err.cause === "object" && "canonicalPath" in err.cause && typeof err.cause.canonicalPath === "string" ? err.cause.canonicalPath : void 0;
		return {
			ok: false,
			code,
			message: code === "NOT_FOUND" ? "file not found" : code === "SYMLINK_REDIRECT" ? "path traverses a symlink; refusing because followSymlinks=false (set plugins.entries.file-transfer.config.nodes.<node>.followSymlinks=true to allow, or update allowReadPaths to the canonical path)" : `realpath failed: ${String(err)}`,
			...canonicalPath ? { canonicalPath } : {}
		};
	}
	let opened;
	try {
		opened = await (await root(path.dirname(canonical))).open(path.basename(canonical));
	} catch (err) {
		const code = classifyFsError(err);
		return {
			ok: false,
			code,
			message: code === "IS_DIRECTORY" ? "path is a directory" : `open failed: ${String(err)}`,
			canonicalPath: canonical
		};
	}
	try {
		const stats = opened.stat;
		if (stats.size > maxBytes) return {
			ok: false,
			code: "FILE_TOO_LARGE",
			message: `file size ${stats.size} exceeds limit ${maxBytes}`,
			canonicalPath: opened.realPath
		};
		if (preflightOnly) return {
			ok: true,
			path: opened.realPath,
			size: stats.size,
			mimeType: "",
			base64: "",
			sha256: "",
			preflightOnly: true
		};
		const buffer = await opened.handle.readFile();
		if (buffer.byteLength > maxBytes) return {
			ok: false,
			code: "FILE_TOO_LARGE",
			message: `read ${buffer.byteLength} bytes exceeds limit ${maxBytes}`,
			canonicalPath: opened.realPath
		};
		const sha256 = crypto.createHash("sha256").update(buffer).digest("hex");
		const base64 = buffer.toString("base64");
		const mimeType = detectMimeType(opened.realPath);
		return {
			ok: true,
			path: opened.realPath,
			size: buffer.byteLength,
			mimeType,
			base64,
			sha256
		};
	} catch (err) {
		return {
			ok: false,
			code: classifyFsError(err),
			message: `read failed: ${String(err)}`,
			canonicalPath: opened.realPath
		};
	} finally {
		await opened.handle.close().catch(() => void 0);
	}
}
//#endregion
export { handleFileFetch };
