#!/usr/bin/env node

const { execFile, spawn } = require("node:child_process");
const dns = require("node:dns");
const fs = require("node:fs");
const net = require("node:net");
const os = require("node:os");
const path = require("node:path");
const https = require("node:https");

const MAC_WG_INTERFACE = "nordvpnctl";
const STATE_DIR = path.join(os.homedir(), ".nordvpn-client");
const WG_STATE_DIR = path.join(STATE_DIR, "wireguard");
const WG_CONFIG_PATH = path.join(WG_STATE_DIR, `${MAC_WG_INTERFACE}.conf`);
const AUTH_CACHE_PATH = path.join(STATE_DIR, "auth.json");
const LAST_CONNECTION_PATH = path.join(STATE_DIR, "last-connection.json");
const MAC_DNS_STATE_PATH = path.join(STATE_DIR, "dns.json");
const MAC_TAILSCALE_STATE_PATH = path.join(STATE_DIR, "tailscale.json");
const MAC_TAILSCALE_SUPPRESS_PATH = path.join(STATE_DIR, "tailscale-suppressed");
const OPERATION_LOCK_PATH = path.join(STATE_DIR, "operation.lock");
const OPENCLAW_NORDVPN_CREDENTIALS_DIR = path.join(
  os.homedir(),
  ".openclaw",
  "workspace",
  ".clawdbot",
  "credentials",
  "nordvpn"
);
const DEFAULT_TOKEN_FILE = path.join(OPENCLAW_NORDVPN_CREDENTIALS_DIR, "token.txt");
const DEFAULT_PASSWORD_FILE = path.join(OPENCLAW_NORDVPN_CREDENTIALS_DIR, "password.txt");
const MAC_WG_HELPER_PATH = path.join(
  os.homedir(),
  ".openclaw",
  "workspace",
  "skills",
  "nordvpn-client",
  "scripts",
  "nordvpn-wireguard-helper.sh"
);
const CLIENT_IPV4 = "10.5.0.2";
const DNS_FALLBACK_RESOLVERS = ["1.1.1.1", "8.8.8.8"];
const NORDVPN_MAC_DNS_SERVERS = ["103.86.96.100", "103.86.99.100"];
const CONNECT_PERSISTENCE_ATTEMPTS = 6;
const CONNECT_PERSISTENCE_DELAY_MS = 2000;
const CONNECT_TOTAL_TIMEOUT_MS = 90000;
const POST_DNS_RESOLUTION_HOSTNAMES = ["www.google.com", "api.openai.com", "docs.openclaw.ai"];
const POST_DNS_RESOLUTION_TIMEOUT_MS = 4000;
const POST_DNS_SETTLE_DELAY_MS = 1500;
const REDACTED_PATH_KEYS = new Set(["cliPath", "appPath", "configPath", "helperPath", "tokenSource", "helperSecurity"]);

function sanitizeOutputPayload(payload) {
  if (Array.isArray(payload)) {
    return payload.map((value) => sanitizeOutputPayload(value));
  }
  if (!payload || typeof payload !== "object") {
    return payload;
  }

  const sanitized = {};
  for (const [key, value] of Object.entries(payload)) {
    if (REDACTED_PATH_KEYS.has(key)) {
      sanitized[key] = null;
      continue;
    }
    sanitized[key] = sanitizeOutputPayload(value);
  }
  return sanitized;
}

function printJson(payload, exitCode = 0, errorStream = false, debugOutput = false) {
  const body = `${JSON.stringify(debugOutput ? payload : sanitizeOutputPayload(payload), null, 2)}\n`;
  (errorStream ? process.stderr : process.stdout).write(body);
  process.exit(exitCode);
}

function usage() {
  return {
    usage: [
      "node scripts/nordvpn-client.js status",
      "node scripts/nordvpn-client.js install",
      "node scripts/nordvpn-client.js login",
      "node scripts/nordvpn-client.js verify",
      'node scripts/nordvpn-client.js verify --country "Italy"',
      'node scripts/nordvpn-client.js verify --country "Italy" --city "Milan"',
      'node scripts/nordvpn-client.js connect --country "Italy"',
      'node scripts/nordvpn-client.js connect --city "Milan"',
      'node scripts/nordvpn-client.js connect --country "Italy" --city "Milan"',
      "node scripts/nordvpn-client.js disconnect",
    ],
    env: [
      "NORDVPN_TOKEN",
      "NORDVPN_TOKEN_FILE",
      `default token file: ${DEFAULT_TOKEN_FILE}`,
      "NORDVPN_USERNAME",
      "NORDVPN_PASSWORD",
      "NORDVPN_PASSWORD_FILE",
      `default password file: ${DEFAULT_PASSWORD_FILE}`,
    ],
  };
}

function parseArgs(argv) {
  const args = { _: [] };
  for (let i = 0; i < argv.length; i += 1) {
    const token = argv[i];
    if (token.startsWith("--")) {
      const key = token.slice(2);
      const next = argv[i + 1];
      if (!next || next.startsWith("--")) {
        args[key] = true;
      } else {
        args[key] = next;
        i += 1;
      }
    } else {
      args._.push(token);
    }
  }
  return args;
}

function detectPlatform() {
  const raw = os.platform();
  if (raw === "darwin") return "darwin";
  if (raw === "linux") return "linux";
  return raw;
}

function readSecret(envName, fileEnvName) {
  if (process.env[envName]) return process.env[envName];

  const candidates = [];
  if (process.env[fileEnvName]) candidates.push(process.env[fileEnvName]);
  if (envName === "NORDVPN_TOKEN") candidates.push(DEFAULT_TOKEN_FILE);
  if (envName === "NORDVPN_PASSWORD") candidates.push(DEFAULT_PASSWORD_FILE);

  for (const candidate of candidates) {
    try {
      const value = fs.readFileSync(candidate, "utf8").trim();
      if (value) return value;
    } catch {
      // Continue.
    }
  }

  return "";
}

function normalizeLocation(value) {
  return `${value || ""}`.trim();
}

function normalizeForMatch(value) {
  return `${value || ""}`
    .normalize("NFKD")
    .replace(/[^\p{L}\p{N}\s-]/gu, " ")
    .replace(/\s+/g, " ")
    .trim()
    .toLowerCase();
}

function commandExists(name) {
  const pathEntries = `${process.env.PATH || ""}`.split(path.delimiter).filter(Boolean);
  for (const entry of pathEntries) {
    const full = path.join(entry, name);
    try {
      fs.accessSync(full, fs.constants.X_OK);
      return full;
    } catch {
      // Continue.
    }
  }

  const fallbackDirs = ["/usr/sbin", "/usr/bin", "/bin", "/usr/local/bin", "/opt/homebrew/bin"];
  for (const entry of fallbackDirs) {
    const full = path.join(entry, name);
    try {
      fs.accessSync(full, fs.constants.X_OK);
      return full;
    } catch {
      // Continue.
    }
  }

  return "";
}

function fileExists(target) {
  try {
    fs.accessSync(target);
    return true;
  } catch {
    return false;
  }
}

function ensureDir(target, mode = 0o700) {
  fs.mkdirSync(target, { recursive: true, mode });
  try {
    fs.chmodSync(target, mode);
  } catch {
    // Ignore chmod errors on existing directories.
  }
}

function readJsonFile(target) {
  try {
    return JSON.parse(fs.readFileSync(target, "utf8"));
  } catch {
    return null;
  }
}

function writeJsonFile(target, payload, mode = 0o600) {
  ensureDir(path.dirname(target));
  fs.writeFileSync(target, `${JSON.stringify(payload, null, 2)}\n`, { mode });
  try {
    fs.chmodSync(target, mode);
  } catch {
    // Ignore chmod errors.
  }
}

function writeTextFile(target, contents, mode = 0o600) {
  ensureDir(path.dirname(target));
  fs.writeFileSync(target, contents, { mode });
  try {
    fs.chmodSync(target, mode);
  } catch {
    // Ignore chmod errors.
  }
}

function runExec(command, args = [], options = {}) {
  return new Promise((resolve) => {
    execFile(command, args, { ...options, encoding: "utf8" }, (error, stdout, stderr) => {
      resolve({
        ok: !error,
        code: error && typeof error.code === "number" ? error.code : 0,
        stdout: stdout || "",
        stderr: stderr || "",
        error: error ? error.message : "",
      });
    });
  });
}

function runInteractive(command, args = [], options = {}) {
  return new Promise((resolve, reject) => {
    const child = spawn(command, args, { stdio: "inherit", ...options });
    child.on("error", reject);
    child.on("exit", (code) => resolve(code === 0));
  });
}

function runShell(command) {
  return runInteractive("bash", ["-lc", command]);
}

function sleep(ms) {
  return new Promise((resolve) => setTimeout(resolve, ms));
}

function processExists(pid) {
  if (!Number.isInteger(pid) || pid <= 0) return false;
  try {
    process.kill(pid, 0);
    return true;
  } catch (error) {
    return error && error.code === "EPERM";
  }
}

function isOperationLockStale(lockRecord, options = {}) {
  if (!lockRecord || typeof lockRecord !== "object") return true;
  const now = Number.isFinite(options.nowMs) ? options.nowMs : Date.now();
  const maxAgeMs = Number.isFinite(options.maxAgeMs) ? options.maxAgeMs : CONNECT_TOTAL_TIMEOUT_MS;
  const startedAtMs = Number.isFinite(lockRecord.startedAtMs)
    ? lockRecord.startedAtMs
    : Date.parse(lockRecord.startedAt || "");

  if (!processExists(lockRecord.pid)) {
    return true;
  }
  if (!Number.isFinite(startedAtMs)) {
    return true;
  }
  return now - startedAtMs > maxAgeMs;
}

function cleanupOperationLock(lockPath = OPERATION_LOCK_PATH) {
  try {
    if (lockPath && fs.existsSync(lockPath)) {
      fs.unlinkSync(lockPath);
    }
  } catch {
    // Ignore cleanup errors.
  }
}

function acquireOperationLock(action, options = {}) {
  const lockPath = options.lockPath || OPERATION_LOCK_PATH;
  const nowMs = Number.isFinite(options.nowMs) ? options.nowMs : Date.now();
  const maxAgeMs = Number.isFinite(options.maxAgeMs) ? options.maxAgeMs : CONNECT_TOTAL_TIMEOUT_MS;
  const existing = readJsonFile(lockPath);

  if (existing) {
    if (isOperationLockStale(existing, { nowMs, maxAgeMs })) {
      cleanupOperationLock(lockPath);
    } else {
      const activeAction = existing.action || "unknown";
      throw new Error(`Another nordvpn-client ${activeAction} operation is already running.`);
    }
  }

  const record = {
    action,
    pid: process.pid,
    startedAt: new Date(nowMs).toISOString(),
    startedAtMs: nowMs,
  };
  writeJsonFile(lockPath, record);

  return {
    lockPath,
    record,
    release() {
      const current = readJsonFile(lockPath);
      if (current && current.pid === record.pid && current.startedAtMs === record.startedAtMs) {
        cleanupOperationLock(lockPath);
      }
    },
  };
}

function detectMacWireguardActiveFromIfconfig(ifconfigOutput) {
  let inUtunBlock = false;
  const lines = `${ifconfigOutput || ""}`.split("\n");

  for (const line of lines) {
    if (/^utun\d+:/.test(line)) {
      inUtunBlock = true;
      continue;
    }
    if (/^\S/.test(line)) {
      inUtunBlock = false;
    }
    if (inUtunBlock && line.includes(`inet ${CLIENT_IPV4}`)) {
      return true;
    }
  }

  return false;
}

function buildMacTailscaleState(tailscaleWasActive) {
  return { tailscaleWasActive: Boolean(tailscaleWasActive) };
}

function markMacTailscaleRecoverySuppressed() {
  ensureDir(STATE_DIR);
  writeTextFile(MAC_TAILSCALE_SUPPRESS_PATH, `${new Date().toISOString()}\n`, 0o600);
}

function clearMacTailscaleRecoverySuppressed() {
  try {
    fs.unlinkSync(MAC_TAILSCALE_SUPPRESS_PATH);
  } catch {
    // Ignore cleanup errors.
  }
}

function inspectMacWireguardHelperSecurity(helperPath, deps = {}) {
  const fileExistsFn = deps.fileExists || fileExists;
  const statSyncFn = deps.statSync || fs.statSync;
  if (!helperPath || !fileExistsFn(helperPath)) {
    return {
      exists: false,
      hardened: false,
      ownerUid: null,
      groupGid: null,
      mode: null,
      reason: "Helper is missing.",
    };
  }

  let stat;
  try {
    stat = statSyncFn(helperPath);
  } catch (error) {
    return {
      exists: true,
      hardened: false,
      ownerUid: null,
      groupGid: null,
      mode: null,
      reason: error.message || "Unable to inspect helper security.",
    };
  }

  const mode = stat.mode & 0o777;
  if (stat.uid !== 0) {
    return {
      exists: true,
      hardened: false,
      ownerUid: stat.uid,
      groupGid: stat.gid,
      mode,
      reason: "Helper must be root-owned before privileged actions are trusted.",
    };
  }
  if ((mode & 0o022) !== 0) {
    return {
      exists: true,
      hardened: false,
      ownerUid: stat.uid,
      groupGid: stat.gid,
      mode,
      reason: "Helper must not be group- or world-writable.",
    };
  }

  return {
    exists: true,
    hardened: true,
    ownerUid: stat.uid,
    groupGid: stat.gid,
    mode,
    reason: "",
  };
}

function trimDiagnosticOutput(value, maxChars = 4000) {
  const text = `${value || ""}`.trim();
  if (!text) return "";
  if (text.length <= maxChars) return text;
  return `${text.slice(0, maxChars)}\n...[truncated]`;
}

function summarizeMacWireguardDiagnostics(diagnostics) {
  if (!diagnostics) return null;
  return {
    interfaceName: diagnostics.interfaceName || MAC_WG_INTERFACE,
    wgShowCaptured: Boolean(diagnostics.wgShow),
    ifconfigCaptured: Boolean(diagnostics.ifconfig),
    routesCaptured: Boolean(diagnostics.routes),
    processesCaptured: Boolean(diagnostics.processes),
    helperSecurity:
      diagnostics.helperSecurity && typeof diagnostics.helperSecurity === "object"
        ? {
            hardened: Boolean(diagnostics.helperSecurity.hardened),
            reason: diagnostics.helperSecurity.reason || "",
          }
        : null,
  };
}

async function collectMacWireguardDiagnostics(options = {}) {
  const runExecFn = options.runExec || runExec;
  const interfaceName = options.interfaceName || MAC_WG_INTERFACE;
  const wgPath = options.wgPath || commandExists("wg") || "/opt/homebrew/bin/wg";
  const helperSecurity =
    options.helperSecurity ||
    inspectMacWireguardHelperSecurity(options.helperPath || MAC_WG_HELPER_PATH, options.securityDeps || {});

  const [wgShow, ifconfig, routes, processes] = await Promise.all([
    runExecFn(wgPath, ["show", interfaceName]),
    runExecFn("ifconfig", [interfaceName]),
    runExecFn("route", ["-n", "get", "default"]),
    runExecFn("pgrep", ["-fl", "wireguard-go|wg-quick|nordvpnctl"]),
  ]);

  return {
    interfaceName,
    helperSecurity,
    wgShow: trimDiagnosticOutput(wgShow.stdout || wgShow.stderr || wgShow.error),
    ifconfig: trimDiagnosticOutput(ifconfig.stdout || ifconfig.stderr || ifconfig.error),
    routes: trimDiagnosticOutput(routes.stdout || routes.stderr || routes.error),
    processes: trimDiagnosticOutput(processes.stdout || processes.stderr || processes.error),
  };
}

function shouldResumeMacTailscale(state, currentlyActive) {
  return Boolean(state && state.tailscaleWasActive && !currentlyActive);
}

function buildMacDnsState(services) {
  return {
    services: (services || []).map((service) => ({
      name: service.name,
      dnsServers: Array.isArray(service.dnsServers) ? service.dnsServers : [],
      searchDomains: Array.isArray(service.searchDomains) ? service.searchDomains : [],
    })),
  };
}

function shouldManageMacDnsService(serviceName) {
  const normalized = `${serviceName || ""}`.trim().toLowerCase();
  if (!normalized) return false;
  return !["tailscale", "bridge", "thunderbolt bridge", "loopback", "vpn", "utun"].some((token) => normalized.includes(token));
}

function normalizeMacNetworksetupList(output) {
  return `${output || ""}`
    .split("\n")
    .map((line) => line.trim())
    .filter(Boolean)
    .filter((line) => !line.startsWith("An asterisk"))
    .map((line) => (line.startsWith("*") ? line.slice(1).trim() : line))
    .filter((line) => shouldManageMacDnsService(line));
}

function normalizeMacDnsCommandOutput(output) {
  const text = `${output || ""}`.trim();
  if (!text || text.includes("aren't any") || text.includes("There aren't any")) {
    return [];
  }
  return text
    .split("\n")
    .map((line) => line.trim())
    .filter(Boolean);
}

function isNordDnsServerList(dnsServers) {
  if (!Array.isArray(dnsServers) || !dnsServers.length) return false;
  const normalized = dnsServers.map((value) => `${value}`.trim()).filter(Boolean);
  if (!normalized.length) return false;
  return normalized.every((value) => NORDVPN_MAC_DNS_SERVERS.includes(value));
}

function buildAutomaticMacDnsState(serviceNames) {
  return {
    services: (serviceNames || []).map((name) => ({
      name,
      dnsServers: [],
      searchDomains: [],
    })),
  };
}

function shouldRejectMacDnsBaseline(state) {
  if (!state || !Array.isArray(state.services) || !state.services.length) return false;
  return state.services.every((service) => isNordDnsServerList(service.dnsServers || []));
}

async function listMacDnsServices() {
  const result = await runExec("networksetup", ["-listallnetworkservices"]);
  if (!result.ok) {
    throw new Error((result.stderr || result.stdout || result.error).trim() || "networksetup -listallnetworkservices failed");
  }
  return normalizeMacNetworksetupList(result.stdout);
}

async function readMacDnsStateForService(serviceName) {
  const dnsResult = await runExec("networksetup", ["-getdnsservers", serviceName]);
  if (!dnsResult.ok) {
    throw new Error((dnsResult.stderr || dnsResult.stdout || dnsResult.error).trim() || `networksetup -getdnsservers failed for ${serviceName}`);
  }
  const searchResult = await runExec("networksetup", ["-getsearchdomains", serviceName]);
  if (!searchResult.ok) {
    throw new Error((searchResult.stderr || searchResult.stdout || searchResult.error).trim() || `networksetup -getsearchdomains failed for ${serviceName}`);
  }
  return {
    name: serviceName,
    dnsServers: normalizeMacDnsCommandOutput(dnsResult.stdout),
    searchDomains: normalizeMacDnsCommandOutput(searchResult.stdout),
  };
}

async function snapshotMacDnsState() {
  const services = await listMacDnsServices();
  const snapshot = [];
  for (const serviceName of services) {
    snapshot.push(await readMacDnsStateForService(serviceName));
  }
  const state = buildMacDnsState(snapshot);
  writeJsonFile(MAC_DNS_STATE_PATH, state);
  return state;
}

async function setMacDnsServers(serviceName, dnsServers) {
  const args = ["-setdnsservers", serviceName];
  args.push(...(dnsServers && dnsServers.length ? dnsServers : ["Empty"]));
  const result = await runExec("networksetup", args);
  if (!result.ok) {
    throw new Error((result.stderr || result.stdout || result.error).trim() || `networksetup -setdnsservers failed for ${serviceName}`);
  }
}

async function setMacSearchDomains(serviceName, searchDomains) {
  const args = ["-setsearchdomains", serviceName];
  args.push(...(searchDomains && searchDomains.length ? searchDomains : ["Empty"]));
  const result = await runExec("networksetup", args);
  if (!result.ok) {
    throw new Error((result.stderr || result.stdout || result.error).trim() || `networksetup -setsearchdomains failed for ${serviceName}`);
  }
}

async function applyMacNordDns() {
  let snapshot = readJsonFile(MAC_DNS_STATE_PATH);
  if (!snapshot || !Array.isArray(snapshot.services) || !snapshot.services.length) {
    snapshot = await snapshotMacDnsState();
  } else if (shouldRejectMacDnsBaseline(snapshot)) {
    const services = await listMacDnsServices();
    snapshot = buildAutomaticMacDnsState(services);
    writeJsonFile(MAC_DNS_STATE_PATH, snapshot);
  }
  for (const service of snapshot.services || []) {
    await setMacDnsServers(service.name, NORDVPN_MAC_DNS_SERVERS);
    await setMacSearchDomains(service.name, []);
  }
  return snapshot;
}

async function restoreMacDnsIfNeeded() {
  const snapshot = readJsonFile(MAC_DNS_STATE_PATH);
  if (!snapshot || !Array.isArray(snapshot.services) || !snapshot.services.length) {
    return { restored: false };
  }
  const servicesToRestore = shouldRejectMacDnsBaseline(snapshot)
    ? buildAutomaticMacDnsState(snapshot.services.map((service) => service.name)).services
    : snapshot.services;
  for (const service of servicesToRestore) {
    await setMacDnsServers(service.name, service.dnsServers || []);
    await setMacSearchDomains(service.name, service.searchDomains || []);
  }
  try {
    fs.unlinkSync(MAC_DNS_STATE_PATH);
  } catch {
    // Ignore unlink errors.
  }
  return { restored: true };
}

function getMacTailscalePath(deps = {}) {
  const commandExistsFn = deps.commandExists || commandExists;
  const fileExistsFn = deps.fileExists || fileExists;
  const discovered = commandExistsFn("tailscale");
  if (discovered) return discovered;
  const fallbacks = ["/opt/homebrew/bin/tailscale", "/Applications/Tailscale.app/Contents/MacOS/Tailscale"];
  for (const fallback of fallbacks) {
    if (fileExistsFn(fallback)) return fallback;
  }
  return "tailscale";
}

function isMacTailscaleActive(status) {
  return Boolean(status && status.BackendState === "Running");
}

async function getMacTailscaleStatus() {
  const tailscale = getMacTailscalePath();
  const result = await runExec(tailscale, ["status", "--json"]);
  if (!result.ok) {
    throw new Error((result.stderr || result.stdout || result.error).trim() || "tailscale status --json failed");
  }
  const json = JSON.parse(result.stdout || "{}");
  return {
    active: isMacTailscaleActive(json),
    raw: json,
  };
}

async function stopMacTailscaleIfActive() {
  const status = await getMacTailscaleStatus();
  if (!status.active) {
    clearMacTailscaleRecoverySuppressed();
    writeJsonFile(MAC_TAILSCALE_STATE_PATH, buildMacTailscaleState(false));
    return { tailscaleWasActive: false };
  }
  markMacTailscaleRecoverySuppressed();
  const tailscale = getMacTailscalePath();
  const result = await runExec(tailscale, ["down"]);
  if (!result.ok) {
    clearMacTailscaleRecoverySuppressed();
    throw new Error((result.stderr || result.stdout || result.error).trim() || "tailscale down failed");
  }
  writeJsonFile(MAC_TAILSCALE_STATE_PATH, buildMacTailscaleState(true));
  return { tailscaleWasActive: true };
}

async function resumeMacTailscaleIfNeeded() {
  const state = readJsonFile(MAC_TAILSCALE_STATE_PATH);
  let currentStatus = null;
  try {
    currentStatus = await getMacTailscaleStatus();
  } catch {
    currentStatus = null;
  }
  if (!shouldResumeMacTailscale(state, currentStatus && currentStatus.active)) {
    clearMacTailscaleRecoverySuppressed();
    try {
      fs.unlinkSync(MAC_TAILSCALE_STATE_PATH);
    } catch {
      // Ignore unlink errors.
    }
    return { restored: false };
  }
  const tailscale = getMacTailscalePath();
  const result = await runExec(tailscale, ["up"]);
  if (!result.ok) {
    throw new Error((result.stderr || result.stdout || result.error).trim() || "tailscale up failed");
  }
  clearMacTailscaleRecoverySuppressed();
  try {
    fs.unlinkSync(MAC_TAILSCALE_STATE_PATH);
  } catch {
    // Ignore cleanup errors.
  }
  return { restored: true };
}

async function resolveHostnameWithFallback(hostname, options = {}) {
  const resolvers = options.resolvers || DNS_FALLBACK_RESOLVERS;
  const resolveWithResolver =
    options.resolveWithResolver ||
    (async (targetHostname, resolverIp) => {
      const resolver = new dns.promises.Resolver();
      resolver.setServers([resolverIp]);
      return resolver.resolve4(targetHostname);
    });

  for (const resolverIp of resolvers) {
    try {
      const addresses = await resolveWithResolver(hostname, resolverIp);
      if (Array.isArray(addresses) && addresses.length) {
        return addresses[0];
      }
    } catch {
      // Try the next resolver.
    }
  }

  return "";
}

async function verifySystemHostnameResolution(hostnames = POST_DNS_RESOLUTION_HOSTNAMES, options = {}) {
  const lookup =
    options.lookup ||
    ((hostname) =>
      dns.promises.lookup(hostname, {
        family: 4,
      }));
  const timeoutMs = Number.isFinite(options.timeoutMs) && options.timeoutMs > 0 ? options.timeoutMs : POST_DNS_RESOLUTION_TIMEOUT_MS;
  const settleDelayMs =
    Number.isFinite(options.settleDelayMs) && options.settleDelayMs >= 0 ? options.settleDelayMs : POST_DNS_SETTLE_DELAY_MS;
  const errors = [];

  if (settleDelayMs > 0) {
    await sleep(settleDelayMs);
  }

  for (const hostname of hostnames) {
    try {
      const result = await Promise.race([
        Promise.resolve().then(() => lookup(hostname)),
        sleep(timeoutMs).then(() => {
          throw new Error(`timeout after ${timeoutMs}ms`);
        }),
      ]);
      const address = Array.isArray(result) ? result[0] && result[0].address : result && result.address;
      if (address) {
        return {
          ok: true,
          hostname,
          address,
        };
      }
      errors.push(`${hostname}: no address returned`);
    } catch (error) {
      errors.push(`${hostname}: ${error.message || String(error)}`);
    }
  }

  return {
    ok: false,
    hostname: "",
    address: "",
    error: errors.join("; "),
  };
}

function buildLookupResult(address, options = {}) {
  if (options && options.all) {
    return [{ address, family: 4 }];
  }
  return [address, 4];
}

function cleanupMacWireguardState(paths = {}) {
  const targets = [paths.configPath || WG_CONFIG_PATH, paths.lastConnectionPath || LAST_CONNECTION_PATH];
  let cleaned = false;
  for (const target of targets) {
    try {
      if (target && fs.existsSync(target)) {
        fs.unlinkSync(target);
        cleaned = true;
      }
    } catch {
      // Ignore cleanup errors; caller will rely on current runtime state.
    }
  }
  return { cleaned };
}

function cleanupMacWireguardAndDnsState(paths = {}) {
  const cleaned = cleanupMacWireguardState(paths).cleaned;
  const dnsStatePath = paths.dnsStatePath || MAC_DNS_STATE_PATH;
  let dnsCleaned = false;
  try {
    if (dnsStatePath && fs.existsSync(dnsStatePath)) {
      fs.unlinkSync(dnsStatePath);
      dnsCleaned = true;
    }
  } catch {
    // Ignore cleanup errors; caller will rely on current runtime state.
  }
  return { cleaned: cleaned || dnsCleaned };
}

function shouldAttemptMacWireguardDisconnect(wireguardState) {
  if (!wireguardState) return false;
  if (wireguardState.active) return true;
  return Boolean(wireguardState.configPath || wireguardState.endpoint || wireguardState.lastConnection);
}

function isBenignMacWireguardAbsentError(message) {
  const normalized = `${message || ""}`.trim().toLowerCase();
  return (
    normalized.includes("is not a wireguard interface") ||
    normalized.includes("is not a known interface") ||
    normalized.includes("unable to access interface") ||
    normalized.includes("not found")
  );
}

function parseMacWireguardHelperStatus(output) {
  const parsed = {};
  for (const line of `${output || ""}`.split("\n")) {
    const trimmed = line.trim();
    if (!trimmed) continue;
    const separator = trimmed.indexOf("=");
    if (separator <= 0) continue;
    const key = trimmed.slice(0, separator).trim();
    const value = trimmed.slice(separator + 1).trim();
    parsed[key] = value;
  }

  return {
    active: ["1", "true", "yes", "on"].includes(`${parsed.active || ""}`.toLowerCase()),
    interfaceName: parsed.interfaceName || MAC_WG_INTERFACE,
    wireguardInterface: parsed.wireguardInterface || null,
    configPath: parsed.configPath || null,
    raw: `${output || ""}`.trim(),
  };
}

async function getMacWireguardHelperStatus(installProbe, options = {}) {
  const runSudoWireguardFn = options.runSudoWireguard || runSudoWireguard;
  const result = await runSudoWireguardFn(installProbe, "probe");
  const parsed = parseMacWireguardHelperStatus(result.stdout || result.stderr || "");
  return {
    ...parsed,
    ok: result.ok,
    error: result.ok ? "" : (result.stderr || result.stdout || result.error).trim(),
  };
}

async function checkMacWireguardPersistence(target, options = {}) {
  const attempts = Math.max(1, Number(options.attempts || CONNECT_PERSISTENCE_ATTEMPTS));
  const delayMs = Math.max(0, Number(options.delayMs || CONNECT_PERSISTENCE_DELAY_MS));
  const getHelperStatus = options.getHelperStatus || (async () => ({ active: false, interfaceName: MAC_WG_INTERFACE }));
  const verifyConnectionFn = options.verifyConnection || verifyConnection;
  const sleepFn = options.sleep || sleep;
  let lastHelperStatus = { active: false, interfaceName: MAC_WG_INTERFACE };
  let lastVerified = { ok: false, ipInfo: null };

  for (let attempt = 1; attempt <= attempts; attempt += 1) {
    try {
      lastHelperStatus = await getHelperStatus();
    } catch (error) {
      lastHelperStatus = {
        active: false,
        interfaceName: MAC_WG_INTERFACE,
        error: error.message || String(error),
      };
    }

    try {
      lastVerified = await verifyConnectionFn(target);
    } catch (error) {
      lastVerified = {
        ok: false,
        ipInfo: {
          ok: false,
          error: error.message || String(error),
        },
      };
    }

    if (lastHelperStatus.active && lastVerified.ok) {
      return {
        stable: true,
        attempts: attempt,
        helperStatus: lastHelperStatus,
        verified: lastVerified,
      };
    }

    if (attempt < attempts) {
      await sleepFn(delayMs);
    }
  }

  return {
    stable: false,
    attempts,
    helperStatus: lastHelperStatus,
    verified: lastVerified,
  };
}

function shouldFinalizeMacWireguardConnect(connectResult, verified, persistence) {
  return Boolean(
    connectResult &&
      connectResult.backend === "wireguard" &&
      verified &&
      verified.ok &&
      persistence &&
      persistence.stable
  );
}

function normalizeSuccessfulConnectState(state, connectResult, verified) {
  if (
    !state ||
    state.platform !== "darwin" ||
    state.controlMode !== "wireguard" ||
    !connectResult ||
    connectResult.backend !== "wireguard" ||
    !verified ||
    !verified.ok
  ) {
    return state;
  }

  return {
    ...state,
    connected: true,
    wireguard: state.wireguard
      ? {
          ...state.wireguard,
          active: true,
          endpoint: connectResult.server && connectResult.server.hostname ? `${connectResult.server.hostname}:51820` : state.wireguard.endpoint,
        }
      : state.wireguard,
  };
}

function normalizeStatusState(state) {
  if (
    !state ||
    state.platform !== "darwin" ||
    state.controlMode !== "wireguard" ||
    state.connected ||
    !state.wireguard ||
    state.wireguard.active ||
    !state.wireguard.endpoint ||
    !state.wireguard.lastConnection ||
    !state.publicIp ||
    !state.publicIp.ok
  ) {
    return state;
  }

  const target =
    state.wireguard.lastConnection.resolvedTarget ||
    state.wireguard.lastConnection.requestedTarget;
  if (!target || !locationMatches(state.publicIp, target)) {
    return state;
  }

  return {
    ...state,
    connected: true,
    wireguard: {
      ...state.wireguard,
      active: true,
    },
  };
}

function fetchJson(url, headers = {}) {
  return new Promise((resolve) => {
    const targetUrl = new URL(url);
    const req = https.get(
      targetUrl,
      {
        headers: {
          "User-Agent": "nordvpn-client-skill/1.0",
          Accept: "application/json",
          ...headers,
        },
        lookup: (hostname, options, callback) => {
          const ipVersion = net.isIP(hostname);
          if (ipVersion) {
            callback(null, hostname, ipVersion);
            return;
          }
          resolveHostnameWithFallback(hostname)
            .then((address) => {
              if (address) {
                const result = buildLookupResult(address, options);
                if (options && options.all) {
                  callback(null, result);
                } else {
                  callback(null, result[0], result[1]);
                }
                return;
              }
              dns.lookup(hostname, options, callback);
            })
            .catch(() => dns.lookup(hostname, options, callback));
        },
      },
      (res) => {
        let data = "";
        res.on("data", (chunk) => {
          data += chunk;
        });
        res.on("end", () => {
          try {
            resolve({ ok: true, statusCode: res.statusCode || 0, json: JSON.parse(data) });
          } catch (error) {
            resolve({
              ok: false,
              statusCode: res.statusCode || 0,
              error: error.message,
              raw: data,
            });
          }
        });
      }
    );
    req.on("error", (error) => resolve({ ok: false, error: error.message }));
    req.setTimeout(15000, () => {
      req.destroy(new Error("timeout"));
    });
  });
}

async function getPublicIpInfo() {
  const lookup = await fetchJson("https://ipapi.co/json/");
  if (!lookup.ok) return { ok: false, error: lookup.error || "lookup failed" };

  const json = lookup.json || {};
  return {
    ok: true,
    ip: json.ip || "",
    city: json.city || "",
    region: json.region || "",
    country: json.country_name || json.country || "",
    countryCode: json.country_code || "",
    org: json.org || "",
    latitude: Number.isFinite(Number(json.latitude)) ? Number(json.latitude) : null,
    longitude: Number.isFinite(Number(json.longitude)) ? Number(json.longitude) : null,
  };
}

async function probeCliStatus(cliPath) {
  const status = await runExec(cliPath, ["status"]);
  const account = await runExec(cliPath, ["account"]);
  const countries = await runExec(cliPath, ["countries"]);
  return { status, account, countries };
}

async function probeMacWireguard() {
  const wgPath = commandExists("wg");
  const wgQuickPath = commandExists("wg-quick");
  const wireguardGoPath = commandExists("wireguard-go");
  const helperPath = fileExists(MAC_WG_HELPER_PATH) ? MAC_WG_HELPER_PATH : null;
  const helperSecurity = inspectMacWireguardHelperSecurity(helperPath);
  const sudoProbe = helperPath ? await runExec("sudo", ["-n", helperPath, "probe"]) : { ok: false };
  const helperStatus = helperPath && sudoProbe.ok ? parseMacWireguardHelperStatus(sudoProbe.stdout || sudoProbe.stderr || "") : null;
  let active = false;
  let showRaw = "";
  let endpoint = "";
  let ifconfigRaw = "";

  if (helperStatus) {
    active = helperStatus.active;
  }

  if (wgPath) {
    const show = await runExec(wgPath, ["show", MAC_WG_INTERFACE]);
    active = active || show.ok;
    showRaw = (show.stdout || show.stderr).trim();
    if (show.ok) {
      const endpointResult = await runExec(wgPath, ["show", MAC_WG_INTERFACE, "endpoints"]);
      endpoint = (endpointResult.stdout || "").trim();
    }
  }

  const ifconfig = await runExec("ifconfig");
  ifconfigRaw = (ifconfig.stdout || ifconfig.stderr).trim();
  if (!active) {
    active = detectMacWireguardActiveFromIfconfig(ifconfigRaw);
  }
  if (!endpoint && fileExists(WG_CONFIG_PATH)) {
    const configText = fs.readFileSync(WG_CONFIG_PATH, "utf8");
    const match = configText.match(/^Endpoint\s*=\s*(.+)$/m);
    if (match) endpoint = match[1].trim();
  }

  return {
    wgPath: wgPath || null,
    wgQuickPath: wgQuickPath || null,
    wireguardGoPath: wireguardGoPath || null,
    helperPath,
    helperSecurity,
    dependenciesReady: Boolean(wgPath && wgQuickPath && wireguardGoPath),
    sudoReady: sudoProbe.ok,
    interfaceName: helperStatus && helperStatus.interfaceName ? helperStatus.interfaceName : MAC_WG_INTERFACE,
    configPath: (helperStatus && helperStatus.configPath) || (fileExists(WG_CONFIG_PATH) ? WG_CONFIG_PATH : null),
    active,
    endpoint: endpoint || null,
    showRaw,
    ifconfigRaw,
    authCache: readJsonFile(AUTH_CACHE_PATH),
    lastConnection: readJsonFile(LAST_CONNECTION_PATH),
  };
}

async function probeInstallation(platform) {
  const cliPath = commandExists("nordvpn");
  const appPath = platform === "darwin" ? "/Applications/NordVPN.app" : "";
  const brewPath = platform === "darwin" ? commandExists("brew") : "";
  const tokenAvailable = Boolean(readSecret("NORDVPN_TOKEN", "NORDVPN_TOKEN_FILE"));

  let cliProbe = null;
  if (cliPath) {
    cliProbe = await probeCliStatus(cliPath);
  }

  let wireguard = null;
  if (platform === "darwin") {
    wireguard = await probeMacWireguard();
  }

  return {
    platform,
    cliPath,
    appPath,
    appInstalled: Boolean(appPath && fileExists(appPath)),
    brewPath,
    tokenAvailable,
    installed:
      platform === "darwin"
        ? Boolean(cliPath) || Boolean(appPath && fileExists(appPath)) || Boolean(wireguard && wireguard.dependenciesReady)
        : Boolean(cliPath),
    cliProbe,
    wireguard,
  };
}

function inferAuthState(probe, installProbe) {
  if (probe && probe.account) {
    const blob = `${probe.account.stdout}\n${probe.account.stderr}`.toLowerCase();
    if (!blob.trim()) return null;
    if (probe.account.ok && !blob.includes("not logged")) return true;
    if (blob.includes("not logged") || blob.includes("login")) return false;
  }

  if (installProbe.platform === "darwin" && installProbe.wireguard) {
    if (installProbe.wireguard.authCache) return true;
    if (installProbe.tokenAvailable) return null;
  }

  return null;
}

function inferConnectionState(probe, installProbe) {
  if (probe && probe.status) {
    const blob = `${probe.status.stdout}\n${probe.status.stderr}`.toLowerCase();
    if (!blob.trim()) return null;
    if (blob.includes("connected")) return true;
    if (blob.includes("disconnected") || blob.includes("not connected")) return false;
  }

  if (installProbe.platform === "darwin" && installProbe.wireguard) {
    return installProbe.wireguard.active;
  }

  return null;
}

function buildStateSummary(installProbe, ipInfo) {
  const cliProbe = installProbe.cliProbe;
  let controlMode = "unavailable";
  let automaticControl = false;
  let loginMode = "unsupported";
  let connectMode = "unsupported";
  let recommendedAction = "Install NordVPN first.";

  if (installProbe.cliPath) {
    controlMode = "cli";
    automaticControl = true;
    loginMode = "cli";
    connectMode = "cli";
    recommendedAction = "Use login/connect/disconnect through the nordvpn CLI.";
  } else if (installProbe.platform === "darwin" && installProbe.wireguard && installProbe.wireguard.dependenciesReady) {
    controlMode = "wireguard";
    automaticControl = true;
    loginMode = "wireguard-token";
    connectMode = "wireguard";
    recommendedAction = installProbe.tokenAvailable
      ? installProbe.wireguard.sudoReady
        ? "Use token-based WireGuard automation on macOS."
        : `WireGuard tooling and token are available, but connect/disconnect require non-interactive sudo for ${MAC_WG_HELPER_PATH}. Allow that helper in sudoers, then rerun login/connect.`
      : `Set NORDVPN_TOKEN, NORDVPN_TOKEN_FILE, or place the token at ${DEFAULT_TOKEN_FILE} for automated macOS NordLynx/WireGuard connects.`;
  } else if (installProbe.platform === "darwin" && installProbe.appInstalled) {
    controlMode = "app-manual";
    automaticControl = false;
    loginMode = "app-manual";
    connectMode = "app-manual";
    recommendedAction = installProbe.tokenAvailable
      ? "NordVPN.app is installed, but automated macOS connects also require wireguard-go and wireguard-tools. Run 'node scripts/nordvpn-client.js install' to install them with Homebrew."
      : `NordVPN.app is installed. For automated macOS connects, run 'node scripts/nordvpn-client.js install' to install wireguard-go and wireguard-tools with Homebrew, then set NORDVPN_TOKEN, NORDVPN_TOKEN_FILE, or place the token at ${DEFAULT_TOKEN_FILE} and run login.`;
  } else if (installProbe.platform === "darwin" && installProbe.brewPath) {
    controlMode = "wireguard-bootstrap";
    automaticControl = false;
    loginMode = "wireguard-token";
    connectMode = "wireguard";
    recommendedAction = "Run 'node scripts/nordvpn-client.js install' to install wireguard-go and wireguard-tools with Homebrew for automated macOS NordLynx connects.";
  }

  return {
    platform: installProbe.platform,
    installed: installProbe.installed,
    cliAvailable: Boolean(installProbe.cliPath),
    cliPath: installProbe.cliPath || null,
    appInstalled: installProbe.appInstalled,
    appPath: installProbe.appInstalled ? installProbe.appPath : null,
    brewAvailable: Boolean(installProbe.brewPath),
    tokenAvailable: installProbe.tokenAvailable,
    controlMode,
    automaticControl,
    loginMode,
    connectMode,
    recommendedAction,
    authenticated: inferAuthState(cliProbe, installProbe),
    connected: inferConnectionState(cliProbe, installProbe),
    localStatusRaw: cliProbe && cliProbe.status ? (cliProbe.status.stdout || cliProbe.status.stderr).trim() : "",
    wireguard: installProbe.wireguard
      ? {
          dependenciesReady: installProbe.wireguard.dependenciesReady,
          sudoReady: installProbe.wireguard.sudoReady,
          interfaceName: installProbe.wireguard.interfaceName,
          active: installProbe.wireguard.active,
          configPath: installProbe.wireguard.configPath,
          endpoint: installProbe.wireguard.endpoint,
          wgPath: installProbe.wireguard.wgPath,
          wgQuickPath: installProbe.wireguard.wgQuickPath,
          wireguardGoPath: installProbe.wireguard.wireguardGoPath,
          helperPath: installProbe.wireguard.helperPath,
          helperSecurity: installProbe.wireguard.helperSecurity,
          authCache: installProbe.wireguard.authCache,
          lastConnection: installProbe.wireguard.lastConnection,
        }
      : null,
    publicIp: ipInfo && ipInfo.ok ? ipInfo : null,
  };
}

async function installNordvpn(installProbe) {
  if (installProbe.platform === "darwin") {
    if (!installProbe.brewPath) {
      throw new Error("Homebrew is required on macOS to bootstrap wireguard-go and wireguard-tools.");
    }

    const toInstall = [];
    if (!installProbe.wireguard || !installProbe.wireguard.wireguardGoPath) toInstall.push("wireguard-go");
    if (!installProbe.wireguard || !installProbe.wireguard.wgPath || !installProbe.wireguard.wgQuickPath) {
      toInstall.push("wireguard-tools");
    }

    if (!toInstall.length) {
      return { changed: false, message: "macOS WireGuard tooling is already installed." };
    }

    const ok = await runInteractive(installProbe.brewPath, ["install", ...toInstall]);
    if (!ok) {
      throw new Error(`brew install ${toInstall.join(" ")} failed`);
    }
    return {
      changed: true,
      message: `Installed ${toInstall.join(", ")} for the macOS WireGuard/NordLynx backend.`,
    };
  }

  if (installProbe.installed) {
    return { changed: false, message: "NordVPN is already installed." };
  }

  if (installProbe.platform === "linux") {
    const command = [
      'TMPFILE="$(mktemp)"',
      'if command -v curl >/dev/null 2>&1; then curl -fsSL https://downloads.nordcdn.com/apps/linux/install.sh -o "${TMPFILE}"; ' +
        'elif command -v wget >/dev/null 2>&1; then wget -qO "${TMPFILE}" https://downloads.nordcdn.com/apps/linux/install.sh; ' +
        "else echo 'curl or wget required' >&2; exit 1; fi",
      'sh "${TMPFILE}"',
      'rm -f "${TMPFILE}"',
    ].join(" && ");
    const ok = await runShell(command);
    if (!ok) {
      throw new Error("NordVPN Linux installer failed");
    }
    return { changed: true, message: "Installed NordVPN via the official Linux installer." };
  }

  throw new Error(`Unsupported platform: ${installProbe.platform}`);
}

async function openMacApp() {
  const ok = await runInteractive("open", ["-a", "NordVPN"]);
  if (!ok) throw new Error("Failed to open NordVPN.app");
}

async function fetchNordCredentials(token) {
  const result = await fetchJson("https://api.nordvpn.com/v1/users/services/credentials", {
    Authorization: `Bearer token:${token}`,
  });
  if (!result.ok) {
    throw new Error(result.error || `NordVPN credentials request failed (${result.statusCode || "unknown"})`);
  }
  if (result.statusCode >= 400) {
    const apiMessage = result.json && result.json.errors && result.json.errors.message;
    throw new Error(apiMessage || `NordVPN credentials request failed (${result.statusCode})`);
  }
  if (!result.json || !result.json.nordlynx_private_key) {
    throw new Error("NordVPN credentials response did not include nordlynx_private_key.");
  }
  return result.json;
}

async function fetchNordCountries() {
  const result = await fetchJson("https://api.nordvpn.com/v1/servers/countries");
  if (!result.ok || result.statusCode >= 400 || !Array.isArray(result.json)) {
    throw new Error(result.error || `NordVPN countries request failed (${result.statusCode || "unknown"})`);
  }
  return result.json;
}

function matchByName(candidates, nameAccessor, input, label) {
  const needle = normalizeForMatch(input);
  if (!needle) return [];
  const exact = candidates.filter((item) => normalizeForMatch(nameAccessor(item)) === needle);
  if (exact.length) return exact;
  const prefix = candidates.filter((item) => normalizeForMatch(nameAccessor(item)).startsWith(needle));
  if (prefix.length) return prefix;
  return candidates.filter((item) => normalizeForMatch(nameAccessor(item)).includes(needle));
}

function resolveTargetMetadata(countries, target) {
  let country = null;

  if (target.country) {
    const countryMatches = matchByName(countries, (item) => item.name, target.country, "country");
    if (!countryMatches.length) {
      throw new Error(`Could not find NordVPN country match for \"${target.country}\".`);
    }
    if (countryMatches.length > 1) {
      throw new Error(
        `Country \"${target.country}\" is ambiguous: ${countryMatches.slice(0, 5).map((item) => item.name).join(", ")}.`
      );
    }
    country = countryMatches[0];
  }

  let city = null;
  if (target.city) {
    if (country) {
      const cities = Array.isArray(country.cities) ? country.cities : [];
      const cityMatches = matchByName(cities, (item) => item.name, target.city, "city");
      if (!cityMatches.length) {
        throw new Error(`Could not find city \"${target.city}\" in ${country.name}.`);
      }
      if (cityMatches.length > 1) {
        throw new Error(
          `City \"${target.city}\" is ambiguous in ${country.name}: ${cityMatches.slice(0, 5).map((item) => item.name).join(", ")}.`
        );
      }
      city = cityMatches[0];
    } else {
      const globalMatches = [];
      for (const candidateCountry of countries) {
        for (const candidateCity of candidateCountry.cities || []) {
          if (matchByName([candidateCity], (item) => item.name, target.city, "city").length) {
            globalMatches.push({ country: candidateCountry, city: candidateCity });
          }
        }
      }
      if (!globalMatches.length) {
        throw new Error(`Could not find NordVPN city match for \"${target.city}\".`);
      }
      if (globalMatches.length > 1) {
        const suggestions = globalMatches
          .slice(0, 5)
          .map((item) => `${item.city.name}, ${item.country.name}`)
          .join(", ");
        throw new Error(`City \"${target.city}\" is ambiguous. Specify --country. Matches: ${suggestions}.`);
      }
      country = globalMatches[0].country;
      city = globalMatches[0].city;
    }
  }

  return {
    country: country
      ? {
          id: country.id,
          code: country.code,
          name: country.name,
        }
      : null,
    city: city
      ? {
          id: city.id,
          name: city.name,
          latitude: city.latitude,
          longitude: city.longitude,
          dnsName: city.dns_name || null,
        }
      : null,
  };
}

async function fetchNordRecommendations(targetMeta, ipInfo) {
  const url = new URL("https://api.nordvpn.com/v1/servers/recommendations");
  const params = url.searchParams;
  params.append("limit", targetMeta.city ? "100" : "25");
  params.append("filters[servers.status]", "online");
  params.append("filters[servers_technologies]", "35");
  params.append("filters[servers_technologies][pivot][status]", "online");
  params.append("fields[servers.hostname]", "1");
  params.append("fields[servers.load]", "1");
  params.append("fields[servers.station]", "1");
  params.append("fields[servers.ips]", "1");
  params.append("fields[servers.technologies.identifier]", "1");
  params.append("fields[servers.technologies.metadata]", "1");
  params.append("fields[servers.locations.country.name]", "1");
  params.append("fields[servers.locations.country.city.name]", "1");

  if (targetMeta.country) {
    params.append("filters[country_id]", String(targetMeta.country.id));
  }

  const latitude = targetMeta.city ? targetMeta.city.latitude : ipInfo && ipInfo.latitude;
  const longitude = targetMeta.city ? targetMeta.city.longitude : ipInfo && ipInfo.longitude;
  if (Number.isFinite(Number(latitude)) && Number.isFinite(Number(longitude))) {
    params.append("coordinates[latitude]", String(latitude));
    params.append("coordinates[longitude]", String(longitude));
  }

  const result = await fetchJson(url.toString());
  if (!result.ok || result.statusCode >= 400 || !Array.isArray(result.json)) {
    throw new Error(result.error || `NordVPN server recommendation request failed (${result.statusCode || "unknown"})`);
  }
  return result.json;
}

function getServerCityName(server) {
  return (
    server &&
    Array.isArray(server.locations) &&
    server.locations[0] &&
    server.locations[0].country &&
    server.locations[0].country.city &&
    server.locations[0].country.city.name
  ) || "";
}

function getServerCountryName(server) {
  return (
    server &&
    Array.isArray(server.locations) &&
    server.locations[0] &&
    server.locations[0].country &&
    server.locations[0].country.name
  ) || "";
}

function getServerWireguardPublicKey(server) {
  const tech = (server.technologies || []).find((item) => item.identifier === "wireguard_udp");
  if (!tech) return "";
  const metadata = (tech.metadata || []).find((item) => item.name === "public_key");
  return metadata ? metadata.value : "";
}

function getServerIpAddresses(server) {
  return (server.ips || []).map((item) => item && item.ip && item.ip.ip).filter(Boolean);
}

function deriveClientIpv6(serverIpv6) {
  const parts = `${serverIpv6}`.split(":");
  if (parts.length < 4) return "";
  const expanded = [];
  let skipped = false;
  for (const part of parts) {
    if (!part && !skipped) {
      const missing = 8 - (parts.filter(Boolean).length);
      for (let i = 0; i < missing; i += 1) expanded.push("0000");
      skipped = true;
    } else if (part) {
      expanded.push(part.padStart(4, "0"));
    }
  }
  while (expanded.length < 8) expanded.push("0000");
  expanded[4] = "0000";
  expanded[5] = "0011";
  expanded[6] = "0005";
  expanded[7] = "0002";
  return expanded.map((item) => item.replace(/^0+(?=[0-9a-f])/i, "") || "0").join(":");
}

function buildWireguardConfig(server, privateKey) {
  const ipAddresses = getServerIpAddresses(server);
  const ipv6 = ipAddresses.find((value) => `${value}`.includes(":"));
  const addresses = [CLIENT_IPV4];
  const allowedIps = ["0.0.0.0/0"];

  if (ipv6) {
    const clientIpv6 = deriveClientIpv6(ipv6);
    if (clientIpv6) addresses.push(clientIpv6);
    allowedIps.push("::/0");
  }

  const publicKey = getServerWireguardPublicKey(server);
  if (!publicKey) {
    throw new Error(`Server ${server.hostname} does not expose a WireGuard public key.`);
  }

  return [
    "[Interface]",
    `PrivateKey = ${privateKey}`,
    `Address = ${addresses.join(", ")}`,
    "",
    "[Peer]",
    `PublicKey = ${publicKey}`,
    `AllowedIPs = ${allowedIps.join(", ")}`,
    `Endpoint = ${server.hostname}:51820`,
    "PersistentKeepalive = 25",
    "",
  ].join("\n");
}

function buildConnectTarget(args) {
  const country = normalizeLocation(args.country);
  const city = normalizeLocation(args.city);
  if (!country && !city) {
    throw new Error("connect requires --country, --city, or both.");
  }
  return { country, city };
}

function locationMatches(ipInfo, target) {
  if (!ipInfo || !ipInfo.ok) return false;
  const countryMatch = !target.country || normalizeForMatch(ipInfo.country).includes(normalizeForMatch(target.country));
  const cityMatch = !target.city || normalizeForMatch(ipInfo.city).includes(normalizeForMatch(target.city));
  return countryMatch && cityMatch;
}

async function verifyConnection(target) {
  const ipInfo = await getPublicIpInfo();
  return {
    ok: target ? locationMatches(ipInfo, target) : Boolean(ipInfo && ipInfo.ok),
    ipInfo,
  };
}

async function verifyConnectionWithRetry(target, options = {}) {
  const attempts = Math.max(1, Number(options.attempts || 4));
  const delayMs = Math.max(0, Number(options.delayMs || 1500));
  const getIpInfo = options.getPublicIpInfo || getPublicIpInfo;
  let lastIpInfo = null;

  for (let attempt = 1; attempt <= attempts; attempt += 1) {
    const ipInfo = await getIpInfo();
    lastIpInfo = ipInfo;
    const ok = target ? locationMatches(ipInfo, target) : Boolean(ipInfo && ipInfo.ok);
    if (ok) {
      return { ok: true, ipInfo };
    }
    if (attempt < attempts) {
      await sleep(delayMs);
    }
  }

  return { ok: false, ipInfo: lastIpInfo };
}

async function connectViaCli(cliPath, target) {
  const attempts = [];
  if (target.city) attempts.push([target.city]);
  if (target.country) attempts.push([target.country]);
  if (target.country && target.city) attempts.push([`${target.country} ${target.city}`]);

  let lastFailure = "";
  for (const attemptArgs of attempts) {
    const result = await runExec(cliPath, ["connect", ...attemptArgs]);
    if (result.ok) {
      return { backend: "cli", cliTarget: attemptArgs.join(" "), raw: result.stdout.trim() || result.stderr.trim() };
    }
    lastFailure = (result.stderr || result.stdout || result.error).trim();
  }

  throw new Error(lastFailure || "NordVPN connect failed");
}

async function runSudoWireguard(installProbe, action) {
  const helperPath = installProbe.wireguard && installProbe.wireguard.helperPath;
  if (!helperPath) throw new Error(`WireGuard helper is missing at ${MAC_WG_HELPER_PATH}.`);
  if (!installProbe.wireguard.sudoReady) {
    throw new Error(`Non-interactive sudo is required for macOS WireGuard connect/disconnect. Allow sudo for ${MAC_WG_HELPER_PATH}, then rerun login/connect.`);
  }
  return runExec("sudo", ["-n", helperPath, action]);
}

async function connectViaMacWireguard(installProbe, target) {
  const token = readSecret("NORDVPN_TOKEN", "NORDVPN_TOKEN_FILE");
  if (!token) {
    throw new Error(`macOS NordLynx/WireGuard automation requires NORDVPN_TOKEN, NORDVPN_TOKEN_FILE, or a token at ${DEFAULT_TOKEN_FILE}.`);
  }
  if (!installProbe.wireguard || !installProbe.wireguard.dependenciesReady) {
    throw new Error("wireguard-go and wireguard-tools are required on macOS. Run install first.");
  }

  const ipInfo = await getPublicIpInfo();
  const countries = await fetchNordCountries();
  const targetMeta = resolveTargetMetadata(countries, target);
  if (!targetMeta.country) {
    throw new Error("A country is required to select a NordVPN WireGuard server.");
  }

  const credentials = await fetchNordCredentials(token);
  const recommendations = await fetchNordRecommendations(targetMeta, ipInfo);
  let candidates = recommendations.filter((server) => Boolean(getServerWireguardPublicKey(server)));
  if (targetMeta.city) {
    candidates = candidates.filter(
      (server) => normalizeForMatch(getServerCityName(server)) === normalizeForMatch(targetMeta.city.name)
    );
  }
  if (!candidates.length) {
    throw new Error(
      targetMeta.city
        ? `No WireGuard-capable NordVPN server found for ${targetMeta.city.name}, ${targetMeta.country.name}.`
        : `No WireGuard-capable NordVPN server found for ${targetMeta.country.name}.`
    );
  }

  candidates.sort((a, b) => (a.load || 999) - (b.load || 999));
  const selectedServer = candidates[0];
  const config = buildWireguardConfig(selectedServer, credentials.nordlynx_private_key);
  ensureDir(WG_STATE_DIR);
  writeTextFile(WG_CONFIG_PATH, config, 0o600);
  let tailscaleStopped = false;

  const tailscaleState = await stopMacTailscaleIfActive();
  tailscaleStopped = tailscaleState.tailscaleWasActive;

  const down = await runSudoWireguard(installProbe, "down");
  if (!down.ok) {
    // Ignore the common no-active-interface case before reconnecting.
  }

  const up = await runSudoWireguard(installProbe, "up");
  if (!up.ok) {
    if (tailscaleStopped) {
      await resumeMacTailscaleIfNeeded();
    }
    throw new Error((up.stderr || up.stdout || up.error).trim() || "wg-quick up failed");
  }

  return {
    backend: "wireguard",
    server: {
      hostname: selectedServer.hostname,
      city: getServerCityName(selectedServer),
      country: getServerCountryName(selectedServer),
      load: selectedServer.load,
    },
    requestedTarget: target,
    resolvedTarget: {
      country: targetMeta.country.name,
      city: targetMeta.city ? targetMeta.city.name : getServerCityName(selectedServer),
    },
    interfaceName: MAC_WG_INTERFACE,
    tailscaleStopped,
    raw: up.stdout.trim() || up.stderr.trim(),
  };
}

async function connectViaMacApp(target) {
  await openMacApp();
  return {
    backend: "app-manual",
    manualActionRequired: true,
    message: `Opened NordVPN.app. Connect manually to ${target.city ? `${target.city}, ` : ""}${target.country || "the requested location"} and rerun status/verify before the follow-up task.`,
  };
}

async function disconnectNordvpn(installProbe) {
  if (installProbe.cliPath) {
    const result = await runExec(installProbe.cliPath, ["disconnect"]);
    if (!result.ok) {
      throw new Error((result.stderr || result.stdout || result.error).trim() || "nordvpn disconnect failed");
    }
    return { backend: "cli", message: "Disconnected from NordVPN." };
  }

  if (installProbe.platform === "darwin" && installProbe.wireguard && installProbe.wireguard.dependenciesReady) {
    if (!shouldAttemptMacWireguardDisconnect(installProbe.wireguard)) {
      const dnsState = await restoreMacDnsIfNeeded();
      const tailscale = await resumeMacTailscaleIfNeeded();
      return {
        backend: "wireguard",
        changed: false,
        dnsRestored: dnsState.restored,
        tailscaleRestored: tailscale.restored,
        message: "No active macOS WireGuard NordVPN connection found.",
      };
    }
    const down = await runSudoWireguard(installProbe, "down");
    if (!down.ok) {
      const message = (down.stderr || down.stdout || down.error).trim();
      if (isBenignMacWireguardAbsentError(message)) {
        const dnsState = await restoreMacDnsIfNeeded();
        const cleaned = cleanupMacWireguardAndDnsState();
        const tailscale = await resumeMacTailscaleIfNeeded();
        return {
          backend: "wireguard",
          changed: false,
          stateCleaned: cleaned.cleaned,
          dnsRestored: dnsState.restored,
          tailscaleRestored: tailscale.restored,
          message: "No active macOS WireGuard NordVPN connection found.",
        };
      }
      throw new Error(message || "wg-quick down failed");
    }
    const dnsState = await restoreMacDnsIfNeeded();
    const cleaned = cleanupMacWireguardAndDnsState();
    const tailscale = await resumeMacTailscaleIfNeeded();
    return {
      backend: "wireguard",
      changed: true,
      stateCleaned: cleaned.cleaned,
      dnsRestored: dnsState.restored,
      tailscaleRestored: tailscale.restored,
      message: "Disconnected the macOS NordLynx/WireGuard session.",
    };
  }

  if (installProbe.platform === "darwin" && installProbe.appInstalled) {
    await openMacApp();
    return {
      backend: "app-manual",
      manualActionRequired: true,
      message: "Opened NordVPN.app. Disconnect manually because no automated control backend is available.",
    };
  }

  throw new Error("NordVPN is not installed.");
}

async function loginNordvpn(installProbe) {
  const token = readSecret("NORDVPN_TOKEN", "NORDVPN_TOKEN_FILE");
  const username = process.env.NORDVPN_USERNAME || "";
  const password = readSecret("NORDVPN_PASSWORD", "NORDVPN_PASSWORD_FILE");

  if (installProbe.cliPath) {
    if (token) {
      const result = await runExec(installProbe.cliPath, ["login", "--token", token]);
      if (!result.ok) {
        throw new Error((result.stderr || result.stdout || result.error).trim() || "nordvpn login --token failed");
      }
      return { mode: "cli-token", backend: "cli", message: "Logged in using token." };
    }

    if (username && password && installProbe.platform === "darwin") {
      // macOS CLI login support is not documented. Fall back to interactive CLI login.
    }

    const ok = await runInteractive(installProbe.cliPath, ["login"]);
    if (!ok) throw new Error("nordvpn login failed");
    return { mode: "cli-interactive", backend: "cli", message: "Interactive NordVPN login completed." };
  }

  if (installProbe.platform === "darwin" && token) {
    const credentials = await fetchNordCredentials(token);
    const cache = {
      backend: "wireguard",
      validatedAt: new Date().toISOString(),
      hasNordlynxPrivateKey: Boolean(credentials.nordlynx_private_key),
      tokenSource: process.env.NORDVPN_TOKEN
        ? "env:NORDVPN_TOKEN"
        : process.env.NORDVPN_TOKEN_FILE
          ? "file:NORDVPN_TOKEN_FILE"
          : fileExists(DEFAULT_TOKEN_FILE)
            ? `default:${DEFAULT_TOKEN_FILE}`
            : "unknown",
    };
    writeJsonFile(AUTH_CACHE_PATH, cache);
    return {
      mode: "wireguard-token",
      backend: "wireguard",
      message: installProbe.wireguard && installProbe.wireguard.dependenciesReady
        ? "Validated NordVPN token for the macOS NordLynx/WireGuard backend."
        : "Validated NordVPN token. Run install to bootstrap wireguard-go and wireguard-tools before connecting.",
      auth: cache,
    };
  }

  if (installProbe.platform === "darwin" && installProbe.appInstalled) {
    await openMacApp();
    return {
      mode: "app-manual",
      backend: "app-manual",
      manualActionRequired: true,
      message:
        `Opened NordVPN.app. Complete login in the app/browser flow, or set NORDVPN_TOKEN, NORDVPN_TOKEN_FILE, or place the token at ${DEFAULT_TOKEN_FILE} to use the automated macOS WireGuard backend.`,
    };
  }

  throw new Error("NordVPN is not installed.");
}

async function main() {
  const args = parseArgs(process.argv.slice(2));
  const debugOutput = Boolean(args.debug);
  const emitJson = (payload, exitCode = 0, errorStream = false) => printJson(payload, exitCode, errorStream, debugOutput);
  const action = args._[0];
  if (!action || args.help) {
    emitJson(usage(), action ? 0 : 1, !action);
  }

  const platform = detectPlatform();
  if (!["darwin", "linux"].includes(platform)) {
    emitJson({ error: `Unsupported platform: ${platform}` }, 1, true);
  }

  const installProbe = await probeInstallation(platform);

  try {
    if (action === "status") {
      const ipInfo = await getPublicIpInfo();
      emitJson(normalizeStatusState(buildStateSummary(installProbe, ipInfo)));
    }

    if (action === "install") {
      const result = await installNordvpn(installProbe);
      const refreshed = await probeInstallation(platform);
      emitJson({
        action,
        ...result,
        state: buildStateSummary(refreshed, await getPublicIpInfo()),
      });
    }

    if (action === "login") {
      const result = await loginNordvpn(installProbe);
      const refreshed = await probeInstallation(platform);
      emitJson({
        action,
        ...result,
        state: buildStateSummary(refreshed, await getPublicIpInfo()),
      });
    }

    if (action === "verify") {
      const target = args.country || args.city ? buildConnectTarget(args) : null;
      const verified = await verifyConnectionWithRetry(target);
      const refreshed = await probeInstallation(platform);
      emitJson(
        {
          action,
          requestedTarget: target,
          verified: verified.ok,
          verification: verified.ipInfo,
          state: buildStateSummary(refreshed, verified.ipInfo),
        },
        verified.ok ? 0 : 1,
        !verified.ok
      );
    }

    if (action === "connect") {
      const lock = acquireOperationLock(action);
      try {
        const target = buildConnectTarget(args);
        let connectResult;
        let verified;
        let persistence = null;

        if (installProbe.cliPath) {
          connectResult = await connectViaCli(installProbe.cliPath, target);
        } else if (platform === "darwin" && installProbe.wireguard && installProbe.wireguard.dependenciesReady && installProbe.tokenAvailable) {
          connectResult = await connectViaMacWireguard(installProbe, target);
        } else if (platform === "darwin" && installProbe.appInstalled) {
          connectResult = await connectViaMacApp(target);
        } else if (platform === "darwin" && !installProbe.tokenAvailable) {
          throw new Error(`macOS automated NordLynx/WireGuard connects require NORDVPN_TOKEN, NORDVPN_TOKEN_FILE, or a token at ${DEFAULT_TOKEN_FILE}.`);
        } else if (platform === "darwin") {
          throw new Error("No usable macOS NordVPN backend is ready. Run install to bootstrap WireGuard tooling.");
        } else if (!installProbe.installed) {
          throw new Error("NordVPN is not installed.");
        } else {
          throw new Error("No usable NordVPN control path found.");
        }

        if (connectResult.manualActionRequired) {
          lock.release();
          emitJson({ action, requestedTarget: target, ...connectResult });
        }

        if (connectResult && connectResult.backend === "wireguard" && platform === "darwin") {
          persistence = await checkMacWireguardPersistence(target, {
            attempts: CONNECT_PERSISTENCE_ATTEMPTS,
            delayMs: CONNECT_PERSISTENCE_DELAY_MS,
            getHelperStatus: async () => getMacWireguardHelperStatus(installProbe),
            verifyConnection: verifyConnection,
          });
          verified = persistence.verified;

          if (!persistence.stable) {
            const refreshed = await probeInstallation(platform);
            const diagnostics = await collectMacWireguardDiagnostics({
              interfaceName: connectResult.interfaceName || MAC_WG_INTERFACE,
              wgPath: refreshed.wireguard && refreshed.wireguard.wgPath,
              helperPath: refreshed.wireguard && refreshed.wireguard.helperPath,
              helperSecurity: refreshed.wireguard && refreshed.wireguard.helperSecurity,
            });
            const rollback = await disconnectNordvpn(refreshed);
            lock.release();
            emitJson(
              {
                action,
                requestedTarget: target,
                connectResult,
                persistence,
                verified: false,
                verification: verified && verified.ipInfo ? verified.ipInfo : null,
                diagnostics: debugOutput ? diagnostics : undefined,
                diagnosticsSummary: summarizeMacWireguardDiagnostics(diagnostics),
                rollback,
                state: buildStateSummary(await probeInstallation(platform), await getPublicIpInfo()),
              },
              1,
              true
            );
          }

          verified = await verifyConnection(target);
        } else {
          verified = await verifyConnectionWithRetry(target, {
            attempts: CONNECT_PERSISTENCE_ATTEMPTS,
            delayMs: CONNECT_PERSISTENCE_DELAY_MS,
          });
        }

        const refreshed = await probeInstallation(platform);
        if (!verified.ok && connectResult && connectResult.backend === "wireguard" && platform === "darwin") {
          const diagnostics = await collectMacWireguardDiagnostics({
            interfaceName: connectResult.interfaceName || MAC_WG_INTERFACE,
            wgPath: refreshed.wireguard && refreshed.wireguard.wgPath,
            helperPath: refreshed.wireguard && refreshed.wireguard.helperPath,
            helperSecurity: refreshed.wireguard && refreshed.wireguard.helperSecurity,
          });
          const rollback = await disconnectNordvpn(refreshed);
          lock.release();
          emitJson(
            {
              action,
              requestedTarget: target,
              connectResult,
              persistence,
              verified: false,
              verification: verified.ipInfo,
              diagnostics: debugOutput ? diagnostics : undefined,
              diagnosticsSummary: summarizeMacWireguardDiagnostics(diagnostics),
              rollback,
              state: buildStateSummary(await probeInstallation(platform), await getPublicIpInfo()),
            },
            1,
            true
          );
        }

        if (platform === "darwin" && shouldFinalizeMacWireguardConnect(connectResult, verified, persistence)) {
          try {
            await snapshotMacDnsState();
            const liveness = await verifyConnection(target);
            if (!liveness.ok) {
              const rollback = await disconnectNordvpn(await probeInstallation(platform));
              lock.release();
              emitJson(
                {
                  action,
                  requestedTarget: target,
                  connectResult,
                  persistence,
                  verified: false,
                  verification: liveness.ipInfo,
                  rollback,
                  error: "Connected but failed the final liveness check before DNS finalization.",
                  state: buildStateSummary(await probeInstallation(platform), await getPublicIpInfo()),
                },
                1,
                true
              );
            }
            verified = liveness;
            await applyMacNordDns();
            const dnsResolution = await verifySystemHostnameResolution();
            if (!dnsResolution.ok) {
              const rollback = await disconnectNordvpn(await probeInstallation(platform));
              lock.release();
              emitJson(
                {
                  action,
                  requestedTarget: target,
                  connectResult,
                  persistence,
                  verified: false,
                  verification: verified.ipInfo,
                  dnsResolution,
                  rollback,
                  error: `Connected but system DNS resolution failed after DNS finalization: ${dnsResolution.error}`,
                  state: buildStateSummary(await probeInstallation(platform), await getPublicIpInfo()),
                },
                1,
                true
              );
            }
            writeJsonFile(LAST_CONNECTION_PATH, {
              backend: "wireguard",
              interfaceName: MAC_WG_INTERFACE,
              requestedTarget: connectResult.requestedTarget,
              resolvedTarget: connectResult.resolvedTarget,
              server: {
                hostname: connectResult.server.hostname,
                city: connectResult.server.city,
                country: connectResult.server.country,
                load: connectResult.server.load,
              },
              connectedAt: new Date().toISOString(),
            });
          } catch (error) {
            const rollback = await disconnectNordvpn(await probeInstallation(platform));
            lock.release();
            emitJson(
              {
                action,
                requestedTarget: target,
                connectResult,
                persistence,
                verified: true,
                verification: verified.ipInfo,
                rollback,
                error: `Connected but failed to finalize macOS DNS/state: ${error.message || String(error)}`,
                state: buildStateSummary(await probeInstallation(platform), await getPublicIpInfo()),
              },
              1,
              true
            );
          }
        }

        const connectState = normalizeSuccessfulConnectState(
          buildStateSummary(await probeInstallation(platform), verified.ipInfo),
          connectResult,
          verified
        );
        lock.release();
        emitJson(
          {
            action,
            requestedTarget: target,
            connectResult,
            persistence,
            verified: verified.ok,
            verification: verified.ipInfo,
            state: connectState,
          },
          verified.ok ? 0 : 1,
          !verified.ok
        );
      } finally {
        lock.release();
      }
    }

    if (action === "disconnect") {
      const lock = acquireOperationLock(action);
      try {
        const result = await disconnectNordvpn(installProbe);
        const refreshed = await probeInstallation(platform);
        lock.release();
        emitJson({
          action,
          ...result,
          state: buildStateSummary(refreshed, await getPublicIpInfo()),
        });
      } finally {
        lock.release();
      }
    }

    emitJson({ error: `Unknown action: ${action}`, ...usage() }, 1, true);
  } catch (error) {
    const payload = { error: error.message || String(error), action };
    if (action === "connect" && platform === "darwin" && installProbe && installProbe.wireguard) {
      try {
        const refreshed = await probeInstallation(platform);
        const diagnostics = await collectMacWireguardDiagnostics({
          interfaceName: MAC_WG_INTERFACE,
          wgPath: refreshed.wireguard && refreshed.wireguard.wgPath,
          helperPath: refreshed.wireguard && refreshed.wireguard.helperPath,
          helperSecurity: refreshed.wireguard && refreshed.wireguard.helperSecurity,
        });
        payload.state = buildStateSummary(refreshed, await getPublicIpInfo());
        payload.diagnostics = debugOutput ? diagnostics : undefined;
        payload.diagnosticsSummary = summarizeMacWireguardDiagnostics(diagnostics);
      } catch {
        // Fall back to the base error payload if diagnostic capture also fails.
      }
    }
    emitJson(payload, 1, true);
  }
}

main();