# Starts cloudflared tunnel run --token for portable USB / LAUNCH.bat.
param(
    [Parameter(Mandatory = $true)][string]$DeckRoot
)

$ErrorActionPreference = 'Stop'
$token = $env:AF_TUNNEL_TOKEN
if (-not $token) {
    $sidecar = Join-Path $DeckRoot 'data\cloudflared-token.txt'
    if (Test-Path -LiteralPath $sidecar) {
        $token = (Get-Content -LiteralPath $sidecar -Raw).Trim()
    }
}
if (-not $token) {
    $cfgPath = Join-Path $DeckRoot 'data\config.json'
    if (Test-Path -LiteralPath $cfgPath) {
        try {
            $cfg = Get-Content -LiteralPath $cfgPath -Raw | ConvertFrom-Json
            $token = [string]$cfg.tunnel_defaults.cloudflare_tunnel_token
            $token = $token.Trim().Trim('"')
        } catch { }
    }
}
if (-not $token) {
    # Builtin fallback (matches server/config.go builtinCloudflareTunnelToken)
    $token = 'eyJhIjoiODk1NDc5YWIzNTQwZGFhNmQ2MWFlNzAyYTUxNjQ0NzUiLCJ0IjoiYWYzNzY5NGYtNDA4Yy00ZWI3LWE2M2MtMzM5MzQ1MjI3NWIwIiwicyI6IlpEa3lPVE5pWWpjdE9USXlZeTAwTlRjNExUaGlZVGN0WWpGaFlUWmtOR05rTXpjMyJ9'
}

$bin = Join-Path $DeckRoot 'tools\cloudflared.exe'
if (-not (Test-Path -LiteralPath $bin)) {
    New-Item -ItemType Directory -Force -Path (Split-Path -LiteralPath $bin) | Out-Null
    Write-Host '[Tunnel] Downloading cloudflared.exe...'
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    Invoke-WebRequest -Uri 'https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.exe' -OutFile $bin
}

$pidFile = Join-Path $DeckRoot 'data\cloudflared.pid'
$existing = Get-Process -Name 'cloudflared' -ErrorAction SilentlyContinue
if ($existing) {
    Write-Host "[Tunnel] cloudflared already running (pid $($existing.Id))"
    exit 0
}

Write-Host '[Tunnel] Starting Cloudflare connector...'
$p = Start-Process -FilePath $bin -ArgumentList @('tunnel', '--no-autoupdate', 'run', '--token', $token) -WindowStyle Hidden -PassThru
Set-Content -LiteralPath $pidFile -Value $p.Id -Encoding ascii
Start-Sleep -Seconds 2
if ($p.HasExited) {
    Write-Host '[Tunnel] WARNING: cloudflared exited immediately — check token and Cloudflare tunnel service URL (http://localhost:8989)'
    exit 1
}
Write-Host "[Tunnel] Connector running (pid $($p.Id))"