import type { NetworkPolicy } from "./policy/types.js";
import type { ViolationAction } from "./violation-action.js";

/** Inclusive port range in TCP/UDP terms. */
export interface PublishedPort {
  readonly hostPort: number;
  readonly guestPort: number;
  readonly protocol: "tcp" | "udp";
  readonly hostBind: string;
}

/** DNS interception configuration. */
export interface DnsConfig {
  readonly nameservers: readonly string[];
  readonly rebindProtection: boolean | null;
  readonly queryTimeoutMs: number | null;
}

/** Host-scoped upstream CA certificate path. */
export interface ScopedUpstreamCaCert {
  readonly pattern: string;
  readonly path: string;
}

/** Host-scoped upstream certificate verification override. */
export interface ScopedVerifyUpstream {
  readonly pattern: string;
  readonly verify: boolean;
}

/** TLS interception configuration. */
export interface TlsConfig {
  readonly bypass: readonly string[];
  readonly verifyUpstream: boolean | null;
  readonly interceptedPorts: readonly number[];
  readonly blockQuic: boolean | null;
  readonly upstreamCaCertPaths: readonly string[];
  readonly scopedUpstreamCaCerts: readonly ScopedUpstreamCaCert[];
  readonly scopedVerifyUpstream: readonly ScopedVerifyUpstream[];
  readonly interceptCaCertPath: string | null;
  readonly interceptCaKeyPath: string | null;
}

/** One token bucket of a rate limiter: starts full, refills continuously. */
export interface TokenBucketConfig {
  readonly size: number;
  readonly refillTimeMs: number;
  readonly oneTimeBurst: number;
}

/** Rate limiter for one direction. A missing bucket means unlimited. */
export interface RateLimiterConfig {
  readonly bandwidth?: TokenBucketConfig;
  readonly ops?: TokenBucketConfig;
}

/** Local network rate limits grouped by traffic direction. */
export interface NetworkRateLimiterConfig {
  readonly egress?: RateLimiterConfig;
  readonly ingress?: RateLimiterConfig;
}

/** Where in the HTTP request the secret value can be substituted. */
export interface SecretSubstitution {
  readonly headers?: boolean;
  readonly query?: boolean;
  readonly body?: boolean;
}

/** Host-side source for secret material. */
export interface SecretSource {
  readonly kind: "env";
  readonly var: string;
}

/** Constructors for host-side secret sources. */
export const SecretSource = {
  /** Resolve the secret from this host environment variable at sandbox start. */
  env(variable: string): SecretSource {
    return { kind: "env", var: variable };
  },
} as const;

/** A single secret entry — built via `SecretBuilder`. */
export interface SecretEntry {
  readonly envVar: string;
  readonly value: string;
  readonly placeholder: string | null;
  readonly allowedHosts: readonly string[];
  readonly allowedHostPatterns: readonly string[];
  readonly allowAnyHost: boolean;
  readonly passthroughHosts: readonly string[];
  readonly requireTlsIdentity: boolean;
  readonly substitution: SecretSubstitution;
}

/** Proxy used for outbound sandbox connections. */
export type OutboundProxy =
  | {
      readonly protocol: "http_connect";
      readonly address: string;
    }
  | {
      readonly protocol: "socks4";
      readonly address: string;
      readonly userId?: string;
    }
  | {
      readonly protocol: "socks5";
      readonly address: string;
      readonly credentials?: {
        readonly username: string;
        readonly password: SecretSource;
      };
    };

/** Built network configuration produced by `NetworkBuilder.build()`. */
export interface NetworkConfig {
  readonly enabled: boolean;
  readonly ports: readonly PublishedPort[];
  readonly policy: NetworkPolicy | null;
  readonly dns: DnsConfig | null;
  readonly tls: TlsConfig | null;
  readonly secrets: readonly SecretEntry[];
  readonly secretViolationAction: ViolationAction | null;
  /** @deprecated Use maxTcpConnections instead. */
  readonly maxConnections: number | null;
  readonly maxTcpConnections: number | null;
  readonly maxUdpConnections?: number | null;
  /** Accept-queue depth for published TCP port listeners. Absent means the default, 1024. */
  readonly tcpAcceptQueueSize?: number | null;
  readonly strict: boolean;
  readonly rateLimiter: NetworkRateLimiterConfig | null;
  readonly interface?: {
    readonly ipv4Pool?: string | null;
    readonly ipv6Pool?: string | null;
    readonly ipv4Address?: string | null;
    readonly ipv6Address?: string | null;
    readonly mac?: readonly number[] | null;
    readonly mtu?: number | null;
  };
  readonly nat64Prefixes: readonly string[];
  readonly trustHostCAs: boolean;
  /** Canonical proxy configuration for outbound connections. */
  readonly outboundProxy: OutboundProxy | null;
  /**
   * HTTP denial responses are disabled by default. When enabled, denyMessage
   * overrides the built-in body; `{host}` names the blocked hostname.
   */
  readonly http: { readonly denyResponse: boolean; readonly denyMessage?: string | null };
}