/**
 * Wire types for the /v1/tenants/{id}/telegram/bots/* endpoints.
 * Mirrors the Go authd.TelegramBot struct in
 * internal/authd/telegrambots.go.
 *
 * Notes on the bot_token contract:
 *   - The wire shape NEVER includes the plaintext bot_token.
 *     It only carries the boolean `bot_token_set` that tells
 *     the UI whether the operator has configured a token.
 *   - The plaintext is set via POST .../telegram/bots (create)
 *     or POST .../telegram/bots/{bid}/rotate-token (rotate).
 *     The server stores it (so telegramd can use it) and
 *     bcrypt-hashes it for the `bot_token_hash` column. The
 *     server does NOT echo the plaintext back; the operator
 *     already typed it.
 *   - The M11 security milestone will replace the plaintext
 *     column entirely with AES-256-GCM encryption and add a
 *     sidecar so telegramd can decrypt.
 */

export type TelegramBotStatus = 'active' | 'paused';

export interface TelegramBot {
  id: string;
  company_id: string;
  name: string;
  welcome_message?: string;
  default_source_id?: string;
  description?: string;
  status: TelegramBotStatus;
  bot_token_set: boolean;
  last_seen_at?: string; // RFC3339
  last_rotated_at?: string; // RFC3339
  created_at: string; // RFC3339
  updated_at: string; // RFC3339
}

export interface ListTelegramBotsResponse {
  items: TelegramBot[];
  total: number;
  limit: number;
  offset: number;
}

export interface CreateTelegramBotInput {
  id: string;
  name: string;
  /** Plaintext. Server stores + hashes; never echoed back. */
  bot_token: string;
  welcome_message?: string;
  default_source_id?: string;
  description?: string;
}

export interface UpdateTelegramBotInput {
  name?: string;
  welcome_message?: string;
  default_source_id?: string;
  description?: string;
}

export interface RotateTelegramBotTokenInput {
  /** Plaintext. Server stores + hashes; never echoed back. */
  bot_token: string;
}
