"use strict";
const fs = require("node:fs");
const path = require("node:path");
const crypto = require("node:crypto");
const { DiagnosticError } = require("./common");
function runtimePaths({ resourcesPath = process.resourcesPath && fs.existsSync(path.join(process.resourcesPath, "app.asar")) ? process.resourcesPath : null, platform = process.platform, arch = process.arch } = {}) {
  const root = resourcesPath ? path.join(resourcesPath, "native-runtime", `${platform}-${arch}`) : path.resolve(__dirname, "../../../build/native-runtime", `${platform}-${arch}`);
  return { root, executable: path.join(root, platform === "win32" ? "curl.exe" : "curl"), caPath: path.join(root, "ca-bundle.pem"), platform, arch };
}
function validateRuntime(options) {
  const runtime = runtimePaths(options);
  try {
    const manifest = JSON.parse(fs.readFileSync(path.join(runtime.root, "manifest.json"), "utf8"));
    if (manifest.platform !== runtime.platform || manifest.arch !== runtime.arch) throw new Error("architecture");
    const executableName = path.basename(runtime.executable);
    for (const name of [executableName, "ca-bundle.pem"]) {
      const content = fs.readFileSync(path.join(runtime.root, name));
      if (!/^[a-f0-9]{64}$/.test(manifest.files?.[name]) || crypto.createHash("sha256").update(content).digest("hex") !== manifest.files[name]) throw new Error("checksum");
    }
    if (runtime.platform !== "win32") fs.accessSync(runtime.executable, fs.constants.X_OK);
    return { ...runtime, manifest };
  } catch (error) { throw new DiagnosticError(error.code === "ENOENT" ? "HTTP_RUNTIME_MISSING" : "HTTP_RUNTIME_INVALID"); }
}
function runtimeEnvironment() {
  // Explicit allowlist: no curl config, proxy, trust override, TLS key logging,
  // injected dynamic libraries or inherited credentials in this subprocess.
  const result = { LANG: "C", LC_ALL: "C" };
  for (const name of ["SystemRoot", "SYSTEMROOT", "WINDIR", "TEMP", "TMP", "TMPDIR"]) if (process.env[name]) result[name] = process.env[name];
  return result;
}
module.exports = { runtimePaths, validateRuntime, runtimeEnvironment };