import { NextResponse } from 'next/server'
import { requireDesktop } from '@/lib/desktop-client/service'
import { DesktopClientError } from '@/lib/desktop-client/contract.mjs'
import { desktopAgentRules } from '@/lib/desktop-client/agent-rules'
import { createHash } from 'node:crypto'

export const runtime = 'nodejs'
export const dynamic = 'force-dynamic'
const headers = { 'Cache-Control': 'private, no-store', 'X-Content-Type-Options': 'nosniff' }
export async function GET(request: Request) {
  try {
    await requireDesktop(request)
    const value = desktopAgentRules(new URL(request.url).searchParams.get('binding'))
    const etag = `"${createHash('sha256').update(JSON.stringify(value)).digest('hex')}"`
    // Authorization is always evaluated before a conditional response. Browser
    // caching stays disabled; the native client maintains its own scoped cache.
    if (request.headers.get('if-none-match') === etag) return new NextResponse(null, { status: 304, headers: { ...headers, ETag: etag } })
    return NextResponse.json(value, { headers: { ...headers, ETag: etag } })
  } catch (error) {
    const known = error instanceof DesktopClientError
    return NextResponse.json({ error: known ? error.message : '规则暂时无法读取', code: known ? error.code : 'internal_error' }, { status: known ? error.status : 500, headers })
  }
}