import type { IDcRouterRouteConfig } from '../../ts_interfaces/data/remoteingress.js';
import { REMOTE_INGRESS_DNS_TAG } from '../../ts_interfaces/data/remoteingress.js';

/**
 * Synthetic routes that exist ONLY for RemoteIngress edge port derivation and
 * must never reach SmartProxy (smartdns owns host-side 53; a SmartProxy listener
 * on 53 would collide). Forwards public TCP+UDP 53 on dns-tagged edges to the
 * hub's authoritative DNS server.
 */
export function buildEdgeOnlyDerivationRoutes(options: { dnsNsDomains?: string[] }): IDcRouterRouteConfig[] {
  if (!options.dnsNsDomains?.length) {
    return [];
  }
  return [{
    name: 'dns-53-edge-forwarding',
    match: {
      ports: [53],
      transport: 'all',
    },
    action: {
      type: 'forward',
      targets: [{ host: '127.0.0.1', port: 53 }],
    },
    ingress: {
      directHub: false,
      smartVpn: false,
    },
    remoteIngress: {
      enabled: true,
      edgeFilter: [REMOTE_INGRESS_DNS_TAG],
    },
  } as IDcRouterRouteConfig];
}