/**
 * Resolve a safe `tunnelHostname` for a named Cloudflare tunnel.
 *
 * Why this exists:
 *   The onboarding service (`services/onboarding/src/lib/db.ts`) historically
 *   assembled the tunnel hostname from the agent's email TLD — so `.dev`
 *   agents got `*.visionclawobs.dev`, a domain we never registered on
 *   Cloudflare. The spec still flows through older agents and older template
 *   snapshots, so this module acts as a last line of defence: any hostname
 *   not inside our obs zone is rejected at onboarding time (with a warning)
 *   rather than silently persisted to profile config, where it would lead to
 *   `ERR_CONNECTION_CLOSED` failures in the browser later.
 *
 * The intended flow is:
 *   1. Spec provides `tunnelHostname` → verify it ends in `.${OBS_TUNNEL_DOMAIN}`.
 *   2. If that check fails (or the spec didn't provide one), fall back to
 *      `${tunnelName}.${OBS_TUNNEL_DOMAIN}`.
 */
import { OBS_TUNNEL_DOMAIN } from "../config/types.js";
/**
 * Returns a hostname that is guaranteed to live inside `OBS_TUNNEL_DOMAIN`.
 * The suffix check is exact: we accept `sub.visionclawobs.com` but not
 * `sub.visionclawobs.com.evil.com` (endsWith with the leading dot handles
 * that already).
 */
export function resolveSafeTunnelHostname(
// Accept `null` in addition to `undefined` so callers can pass the raw
// Zod-parsed optional field (`string | null | undefined`) without extra
// normalisation at each call site.
specHostname, tunnelName) {
    const fallback = `${tunnelName}.${OBS_TUNNEL_DOMAIN}`;
    const trimmed = specHostname?.trim();
    if (!trimmed) {
        return { hostname: fallback, fellBack: true };
    }
    const suffix = `.${OBS_TUNNEL_DOMAIN}`;
    // Reject same-string too — a bare "visionclawobs.com" has no subdomain and
    // can't be used for a per-agent tunnel. endsWith(suffix) below implicitly
    // requires at least one character before the dot, which catches this.
    if (trimmed.toLowerCase().endsWith(suffix)) {
        return { hostname: trimmed, fellBack: false };
    }
    return { hostname: fallback, fellBack: true, rejectedHostname: trimmed };
}
//# sourceMappingURL=tunnel-hostname.js.map