import * as plugins from '../../plugins.js';

// Importing required components
import { ConnectionManager } from './connection-manager.js';
import { SecurityManager } from './security-manager.js';
import { DomainConfigManager } from './domain-config-manager.js';
import { TlsManager } from './tls-manager.js';
import { NetworkProxyBridge } from './network-proxy-bridge.js';
import { TimeoutManager } from './timeout-manager.js';
import { PortRangeManager } from './port-range-manager.js';
import { RouteManager } from './route-manager.js';
import { RouteConnectionHandler } from './route-connection-handler.js';

// External dependencies
import { Port80Handler } from '../../http/port80/port80-handler.js';
import { CertProvisioner } from '../../certificate/providers/cert-provisioner.js';
import type { ICertificateData } from '../../certificate/models/certificate-types.js';
import { buildPort80Handler } from '../../certificate/acme/acme-factory.js';
import { createPort80HandlerOptions } from '../../common/port80-adapter.js';

// Import types and utilities
import type { 
  ISmartProxyOptions, 
  IRoutedSmartProxyOptions,
  IDomainConfig
} from './models/interfaces.js';
import { isRoutedOptions, isLegacyOptions } from './models/interfaces.js';
import type { IRouteConfig } from './models/route-types.js';

/**
 * SmartProxy - Unified route-based API
 */
export class SmartProxy extends plugins.EventEmitter {
  private netServers: plugins.net.Server[] = [];
  private connectionLogger: NodeJS.Timeout | null = null;
  private isShuttingDown: boolean = false;
  
  // Component managers
  private connectionManager: ConnectionManager;
  private securityManager: SecurityManager;
  private domainConfigManager: DomainConfigManager;
  private tlsManager: TlsManager;
  private networkProxyBridge: NetworkProxyBridge;
  private timeoutManager: TimeoutManager;
  private portRangeManager: PortRangeManager;
  private routeManager: RouteManager;
  private routeConnectionHandler: RouteConnectionHandler;
  
  // Port80Handler for ACME certificate management
  private port80Handler: Port80Handler | null = null;
  // CertProvisioner for unified certificate workflows
  private certProvisioner?: CertProvisioner;
  
  /**
   * Constructor that supports both legacy and route-based configuration
   */
  constructor(settingsArg: ISmartProxyOptions) {
    super();
    
    // Set reasonable defaults for all settings
    this.settings = {
      ...settingsArg,
      initialDataTimeout: settingsArg.initialDataTimeout || 120000,
      socketTimeout: settingsArg.socketTimeout || 3600000,
      inactivityCheckInterval: settingsArg.inactivityCheckInterval || 60000,
      maxConnectionLifetime: settingsArg.maxConnectionLifetime || 86400000,
      inactivityTimeout: settingsArg.inactivityTimeout || 14400000,
      gracefulShutdownTimeout: settingsArg.gracefulShutdownTimeout || 30000,
      noDelay: settingsArg.noDelay !== undefined ? settingsArg.noDelay : true,
      keepAlive: settingsArg.keepAlive !== undefined ? settingsArg.keepAlive : true,
      keepAliveInitialDelay: settingsArg.keepAliveInitialDelay || 10000,
      maxPendingDataSize: settingsArg.maxPendingDataSize || 10 * 1024 * 1024,
      disableInactivityCheck: settingsArg.disableInactivityCheck || false,
      enableKeepAliveProbes:
        settingsArg.enableKeepAliveProbes !== undefined ? settingsArg.enableKeepAliveProbes : true,
      enableDetailedLogging: settingsArg.enableDetailedLogging || false,
      enableTlsDebugLogging: settingsArg.enableTlsDebugLogging || false,
      enableRandomizedTimeouts: settingsArg.enableRandomizedTimeouts || false,
      allowSessionTicket:
        settingsArg.allowSessionTicket !== undefined ? settingsArg.allowSessionTicket : true,
      maxConnectionsPerIP: settingsArg.maxConnectionsPerIP || 100,
      connectionRateLimitPerMinute: settingsArg.connectionRateLimitPerMinute || 300,
      keepAliveTreatment: settingsArg.keepAliveTreatment || 'extended',
      keepAliveInactivityMultiplier: settingsArg.keepAliveInactivityMultiplier || 6,
      extendedKeepAliveLifetime: settingsArg.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000,
      networkProxyPort: settingsArg.networkProxyPort || 8443,
    };
    
    // Set default ACME options if not provided
    this.settings.acme = this.settings.acme || {};
    if (Object.keys(this.settings.acme).length === 0) {
      this.settings.acme = {
        enabled: false,
        port: 80,
        accountEmail: 'admin@example.com',
        useProduction: false,
        renewThresholdDays: 30,
        autoRenew: true,
        certificateStore: './certs',
        skipConfiguredCerts: false,
        httpsRedirectPort: this.settings.fromPort || 443,
        renewCheckIntervalHours: 24,
        domainForwards: []
      };
    }
    
    // Initialize component managers
    this.timeoutManager = new TimeoutManager(this.settings);
    this.securityManager = new SecurityManager(this.settings);
    this.connectionManager = new ConnectionManager(
      this.settings, 
      this.securityManager, 
      this.timeoutManager
    );
    
    // Create the new route manager first
    this.routeManager = new RouteManager(this.settings);

    // Create domain config manager and port range manager
    this.domainConfigManager = new DomainConfigManager(this.settings);

    // Share the route manager with the domain config manager
    if (typeof this.domainConfigManager.setRouteManager === 'function') {
      this.domainConfigManager.setRouteManager(this.routeManager);
    }

    this.portRangeManager = new PortRangeManager(this.settings);
    
    // Create other required components
    this.tlsManager = new TlsManager(this.settings);
    this.networkProxyBridge = new NetworkProxyBridge(this.settings);
    
    // Initialize connection handler with route support
    this.routeConnectionHandler = new RouteConnectionHandler(
      this.settings,
      this.connectionManager,
      this.securityManager,
      this.domainConfigManager,
      this.tlsManager,
      this.networkProxyBridge,
      this.timeoutManager,
      this.routeManager
    );
  }
  
  /**
   * The settings for the SmartProxy
   */
  public settings: ISmartProxyOptions;
  
  /**
   * Initialize the Port80Handler for ACME certificate management
   */
  private async initializePort80Handler(): Promise<void> {
    const config = this.settings.acme!;
    if (!config.enabled) {
      console.log('ACME is disabled in configuration');
      return;
    }
    
    try {
      // Build and start the Port80Handler
      this.port80Handler = buildPort80Handler({
        ...config,
        httpsRedirectPort: config.httpsRedirectPort || (isLegacyOptions(this.settings) ? this.settings.fromPort : 443)
      });
      
      // Share Port80Handler with NetworkProxyBridge before start
      this.networkProxyBridge.setPort80Handler(this.port80Handler);
      await this.port80Handler.start();
      console.log(`Port80Handler started on port ${config.port}`);
    } catch (err) {
      console.log(`Error initializing Port80Handler: ${err}`);
    }
  }
  
  /**
   * Start the proxy server with support for both configuration types
   */
  public async start() {
    // Don't start if already shutting down
    if (this.isShuttingDown) {
      console.log("Cannot start SmartProxy while it's shutting down");
      return;
    }

    // Initialize domain config based on configuration type
    if (isLegacyOptions(this.settings)) {
      // Initialize domain config manager with the legacy domain configs
      this.domainConfigManager.updateDomainConfigs(this.settings.domainConfigs || []);
    } else if (isRoutedOptions(this.settings)) {
      // For pure route-based configuration, the domain config is already initialized
      // in the constructor, but we might need to regenerate it
      if (typeof this.domainConfigManager.generateDomainConfigsFromRoutes === 'function') {
        this.domainConfigManager.generateDomainConfigsFromRoutes();
      }
    }

    // Initialize Port80Handler if enabled
    await this.initializePort80Handler();

    // Initialize CertProvisioner for unified certificate workflows
    if (this.port80Handler) {
      const acme = this.settings.acme!;

      // Setup domain forwards based on configuration type
      const domainForwards = acme.domainForwards?.map(f => {
        if (isLegacyOptions(this.settings)) {
          // If using legacy mode, check if domain config exists
          const domainConfig = this.settings.domainConfigs.find(
            dc => dc.domains.some(d => d === f.domain)
          );

          if (domainConfig?.forwarding) {
            return {
              domain: f.domain,
              forwardConfig: f.forwardConfig,
              acmeForwardConfig: f.acmeForwardConfig,
              sslRedirect: f.sslRedirect || domainConfig.forwarding.http?.redirectToHttps || false
            };
          }
        } else {
          // In route mode, look for matching route
          const route = this.routeManager.findMatchingRoute({
            port: 443,
            domain: f.domain,
            clientIp: '127.0.0.1' // Dummy IP for finding routes
          })?.route;

          if (route && route.action.type === 'forward' && route.action.tls) {
            // If we found a matching route with TLS settings
            return {
              domain: f.domain,
              forwardConfig: f.forwardConfig,
              acmeForwardConfig: f.acmeForwardConfig,
              sslRedirect: f.sslRedirect || false
            };
          }
        }

        // Otherwise use the existing configuration
        return {
          domain: f.domain,
          forwardConfig: f.forwardConfig,
          acmeForwardConfig: f.acmeForwardConfig,
          sslRedirect: f.sslRedirect || false
        };
      }) || [];

      // Create CertProvisioner with appropriate parameters
      if (isLegacyOptions(this.settings)) {
        this.certProvisioner = new CertProvisioner(
          this.settings.domainConfigs,
          this.port80Handler,
          this.networkProxyBridge,
          this.settings.certProvisionFunction,
          acme.renewThresholdDays!,
          acme.renewCheckIntervalHours!,
          acme.autoRenew!,
          domainForwards
        );
      } else {
        // For route-based configuration, we need to adapt the interface
        // Convert routes to domain configs for CertProvisioner
        const domainConfigs: IDomainConfig[] = this.extractDomainConfigsFromRoutes(
          (this.settings as IRoutedSmartProxyOptions).routes
        );

        this.certProvisioner = new CertProvisioner(
          domainConfigs,
          this.port80Handler,
          this.networkProxyBridge,
          this.settings.certProvisionFunction,
          acme.renewThresholdDays!,
          acme.renewCheckIntervalHours!,
          acme.autoRenew!,
          domainForwards
        );
      }

      // Register certificate event handler
      this.certProvisioner.on('certificate', (certData) => {
        this.emit('certificate', {
          domain: certData.domain,
          publicKey: certData.certificate,
          privateKey: certData.privateKey,
          expiryDate: certData.expiryDate,
          source: certData.source,
          isRenewal: certData.isRenewal
        });
      });

      await this.certProvisioner.start();
      console.log('CertProvisioner started');
    }

    // Initialize and start NetworkProxy if needed
    if (this.settings.useNetworkProxy && this.settings.useNetworkProxy.length > 0) {
      await this.networkProxyBridge.initialize();
      await this.networkProxyBridge.start();
    }

    // Validate the route configuration
    const configWarnings = this.routeManager.validateConfiguration();
    if (configWarnings.length > 0) {
      console.log("Route configuration warnings:");
      for (const warning of configWarnings) {
        console.log(` - ${warning}`);
      }
    }

    // Get listening ports from RouteManager
    const listeningPorts = this.routeManager.getListeningPorts();

    // Create servers for each port
    for (const port of listeningPorts) {
      const server = plugins.net.createServer((socket) => {
        // Check if shutting down
        if (this.isShuttingDown) {
          socket.end();
          socket.destroy();
          return;
        }
        
        // Delegate to route connection handler
        this.routeConnectionHandler.handleConnection(socket);
      }).on('error', (err: Error) => {
        console.log(`Server Error on port ${port}: ${err.message}`);
      });
      
      server.listen(port, () => {
        const isNetworkProxyPort = this.settings.useNetworkProxy?.includes(port);
        console.log(
          `SmartProxy -> OK: Now listening on port ${port}${
            isLegacyOptions(this.settings) && this.settings.sniEnabled && !isNetworkProxyPort ? 
              ' (SNI passthrough enabled)' : 
              ''
          }${isNetworkProxyPort ? ' (NetworkProxy forwarding enabled)' : ''}`
        );
      });
      
      this.netServers.push(server);
    }

    // Set up periodic connection logging and inactivity checks
    this.connectionLogger = setInterval(() => {
      // Immediately return if shutting down
      if (this.isShuttingDown) return;

      // Perform inactivity check
      this.connectionManager.performInactivityCheck();

      // Log connection statistics
      const now = Date.now();
      let maxIncoming = 0;
      let maxOutgoing = 0;
      let tlsConnections = 0;
      let nonTlsConnections = 0;
      let completedTlsHandshakes = 0;
      let pendingTlsHandshakes = 0;
      let keepAliveConnections = 0;
      let networkProxyConnections = 0;
      
      // Get connection records for analysis
      const connectionRecords = this.connectionManager.getConnections();
      
      // Analyze active connections
      for (const record of connectionRecords.values()) {
        // Track connection stats
        if (record.isTLS) {
          tlsConnections++;
          if (record.tlsHandshakeComplete) {
            completedTlsHandshakes++;
          } else {
            pendingTlsHandshakes++;
          }
        } else {
          nonTlsConnections++;
        }

        if (record.hasKeepAlive) {
          keepAliveConnections++;
        }

        if (record.usingNetworkProxy) {
          networkProxyConnections++;
        }

        maxIncoming = Math.max(maxIncoming, now - record.incomingStartTime);
        if (record.outgoingStartTime) {
          maxOutgoing = Math.max(maxOutgoing, now - record.outgoingStartTime);
        }
      }

      // Get termination stats
      const terminationStats = this.connectionManager.getTerminationStats();

      // Log detailed stats
      console.log(
        `Active connections: ${connectionRecords.size}. ` +
        `Types: TLS=${tlsConnections} (Completed=${completedTlsHandshakes}, Pending=${pendingTlsHandshakes}), ` +
        `Non-TLS=${nonTlsConnections}, KeepAlive=${keepAliveConnections}, NetworkProxy=${networkProxyConnections}. ` +
        `Longest running: IN=${plugins.prettyMs(maxIncoming)}, OUT=${plugins.prettyMs(maxOutgoing)}. ` +
        `Termination stats: ${JSON.stringify({
          IN: terminationStats.incoming,
          OUT: terminationStats.outgoing,
        })}`
      );
    }, this.settings.inactivityCheckInterval || 60000);

    // Make sure the interval doesn't keep the process alive
    if (this.connectionLogger.unref) {
      this.connectionLogger.unref();
    }
  }
  
  /**
   * Extract domain configurations from routes for certificate provisioning
   */
  private extractDomainConfigsFromRoutes(routes: IRouteConfig[]): IDomainConfig[] {
    const domainConfigs: IDomainConfig[] = [];
    
    for (const route of routes) {
      // Skip routes without domain specs
      if (!route.match.domains) continue;
      
      // Skip non-forward routes
      if (route.action.type !== 'forward') continue;
      
      // Only process routes that need TLS termination (those with certificates)
      if (!route.action.tls || 
          route.action.tls.mode === 'passthrough' || 
          !route.action.target) continue;
      
      const domains = Array.isArray(route.match.domains) 
        ? route.match.domains 
        : [route.match.domains];
      
      // Determine forwarding type based on TLS mode
      const forwardingType = route.action.tls.mode === 'terminate' 
        ? 'https-terminate-to-http' 
        : 'https-terminate-to-https';
      
      // Create a forwarding config
      const forwarding = {
        type: forwardingType as any,
        target: {
          host: Array.isArray(route.action.target.host) 
            ? route.action.target.host[0] 
            : route.action.target.host,
          port: route.action.target.port
        },
        // Add TLS settings
        https: {
          customCert: route.action.tls.certificate !== 'auto' 
            ? route.action.tls.certificate 
            : undefined
        },
        // Add security settings if present
        security: route.action.security,
        // Add advanced settings if present
        advanced: route.action.advanced
      };
      
      domainConfigs.push({
        domains,
        forwarding
      });
    }
    
    return domainConfigs;
  }
  
  /**
   * Stop the proxy server
   */
  public async stop() {
    console.log('SmartProxy shutting down...');
    this.isShuttingDown = true;
    
    // Stop CertProvisioner if active
    if (this.certProvisioner) {
      await this.certProvisioner.stop();
      console.log('CertProvisioner stopped');
    }

    // Stop the Port80Handler if running
    if (this.port80Handler) {
      try {
        await this.port80Handler.stop();
        console.log('Port80Handler stopped');
        this.port80Handler = null;
      } catch (err) {
        console.log(`Error stopping Port80Handler: ${err}`);
      }
    }

    // Stop accepting new connections
    const closeServerPromises: Promise<void>[] = this.netServers.map(
      (server) =>
        new Promise<void>((resolve) => {
          if (!server.listening) {
            resolve();
            return;
          }
          server.close((err) => {
            if (err) {
              console.log(`Error closing server: ${err.message}`);
            }
            resolve();
          });
        })
    );

    // Stop the connection logger
    if (this.connectionLogger) {
      clearInterval(this.connectionLogger);
      this.connectionLogger = null;
    }

    // Wait for servers to close
    await Promise.all(closeServerPromises);
    console.log('All servers closed. Cleaning up active connections...');

    // Clean up all active connections
    this.connectionManager.clearConnections();

    // Stop NetworkProxy
    await this.networkProxyBridge.stop();

    // Clear all servers
    this.netServers = [];

    console.log('SmartProxy shutdown complete.');
  }
  
  /**
   * Updates the domain configurations for the proxy (legacy support)
   */
  public async updateDomainConfigs(newDomainConfigs: IDomainConfig[]): Promise<void> {
    console.log(`Updating domain configurations (${newDomainConfigs.length} configs)`);

    // Update domain configs in DomainConfigManager (legacy)
    this.domainConfigManager.updateDomainConfigs(newDomainConfigs);

    // Also update the RouteManager with these domain configs
    this.routeManager.updateFromDomainConfigs(newDomainConfigs);

    // If NetworkProxy is initialized, resync the configurations
    if (this.networkProxyBridge.getNetworkProxy()) {
      await this.networkProxyBridge.syncDomainConfigsToNetworkProxy();
    }

    // If Port80Handler is running, provision certificates based on forwarding type
    if (this.port80Handler && this.settings.acme?.enabled) {
      for (const domainConfig of newDomainConfigs) {
        // Skip certificate provisioning for http-only or passthrough configs that don't need certs
        const forwardingType = this.domainConfigManager.getForwardingType(domainConfig);
        const needsCertificate =
          forwardingType === 'https-terminate-to-http' ||
          forwardingType === 'https-terminate-to-https';

        // Skip certificate provisioning if ACME is explicitly disabled for this domain
        const acmeDisabled = domainConfig.forwarding.acme?.enabled === false;

        if (!needsCertificate || acmeDisabled) {
          if (this.settings.enableDetailedLogging) {
            console.log(`Skipping certificate provisioning for ${domainConfig.domains.join(', ')} (${forwardingType})`);
          }
          continue;
        }

        for (const domain of domainConfig.domains) {
          const isWildcard = domain.includes('*');
          let provision: string | plugins.tsclass.network.ICert = 'http01';

          // Check for ACME forwarding configuration in the domain
          const forwardAcmeChallenges = domainConfig.forwarding.acme?.forwardChallenges;

          if (this.settings.certProvisionFunction) {
            try {
              provision = await this.settings.certProvisionFunction(domain);
            } catch (err) {
              console.log(`certProvider error for ${domain}: ${err}`);
            }
          } else if (isWildcard) {
            console.warn(`Skipping wildcard domain without certProvisionFunction: ${domain}`);
            continue;
          }

          if (provision === 'http01') {
            if (isWildcard) {
              console.warn(`Skipping HTTP-01 for wildcard domain: ${domain}`);
              continue;
            }

            // Create Port80Handler options from the forwarding configuration
            const port80Config = createPort80HandlerOptions(domain, domainConfig.forwarding);

            this.port80Handler.addDomain(port80Config);
            console.log(`Registered domain ${domain} with Port80Handler for HTTP-01`);
          } else {
            // Static certificate (e.g., DNS-01 provisioned) supports wildcards
            const certObj = provision as plugins.tsclass.network.ICert;
            const certData: ICertificateData = {
              domain: certObj.domainName,
              certificate: certObj.publicKey,
              privateKey: certObj.privateKey,
              expiryDate: new Date(certObj.validUntil)
            };
            this.networkProxyBridge.applyExternalCertificate(certData);
            console.log(`Applied static certificate for ${domain} from certProvider`);
          }
        }
      }
      console.log('Provisioned certificates for new domains');
    }
  }
  
  /**
   * Update routes with new configuration (new API)
   */
  public async updateRoutes(newRoutes: IRouteConfig[]): Promise<void> {
    console.log(`Updating routes (${newRoutes.length} routes)`);
    
    // Update routes in RouteManager
    this.routeManager.updateRoutes(newRoutes);
    
    // If NetworkProxy is initialized, resync the configurations
    if (this.networkProxyBridge.getNetworkProxy()) {
      // Create equivalent domain configs for NetworkProxy
      const domainConfigs = this.extractDomainConfigsFromRoutes(newRoutes);
      
      // Update domain configs in DomainConfigManager for sync
      this.domainConfigManager.updateDomainConfigs(domainConfigs);
      
      // Sync with NetworkProxy
      await this.networkProxyBridge.syncDomainConfigsToNetworkProxy();
    }
    
    // If Port80Handler is running, provision certificates based on routes
    if (this.port80Handler && this.settings.acme?.enabled) {
      for (const route of newRoutes) {
        // Skip routes without domains
        if (!route.match.domains) continue;
        
        // Skip non-forward routes
        if (route.action.type !== 'forward') continue;
        
        // Skip routes without TLS termination
        if (!route.action.tls || 
            route.action.tls.mode === 'passthrough' || 
            !route.action.target) continue;
        
        // Skip certificate provisioning if certificate is not auto
        if (route.action.tls.certificate !== 'auto') continue;
        
        const domains = Array.isArray(route.match.domains) 
          ? route.match.domains 
          : [route.match.domains];
        
        for (const domain of domains) {
          const isWildcard = domain.includes('*');
          let provision: string | plugins.tsclass.network.ICert = 'http01';
          
          if (this.settings.certProvisionFunction) {
            try {
              provision = await this.settings.certProvisionFunction(domain);
            } catch (err) {
              console.log(`certProvider error for ${domain}: ${err}`);
            }
          } else if (isWildcard) {
            console.warn(`Skipping wildcard domain without certProvisionFunction: ${domain}`);
            continue;
          }
          
          if (provision === 'http01') {
            if (isWildcard) {
              console.warn(`Skipping HTTP-01 for wildcard domain: ${domain}`);
              continue;
            }
            
            // Register domain with Port80Handler
            this.port80Handler.addDomain({
              domainName: domain,
              sslRedirect: true,
              acmeMaintenance: true
            });
            
            console.log(`Registered domain ${domain} with Port80Handler for HTTP-01`);
          } else {
            // Handle static certificate (e.g., DNS-01 provisioned)
            const certObj = provision as plugins.tsclass.network.ICert;
            const certData: ICertificateData = {
              domain: certObj.domainName,
              certificate: certObj.publicKey,
              privateKey: certObj.privateKey,
              expiryDate: new Date(certObj.validUntil)
            };
            this.networkProxyBridge.applyExternalCertificate(certData);
            console.log(`Applied static certificate for ${domain} from certProvider`);
          }
        }
      }
      
      console.log('Provisioned certificates for new routes');
    }
  }
  
  /**
   * Request a certificate for a specific domain
   */
  public async requestCertificate(domain: string): Promise<boolean> {
    // Validate domain format
    if (!this.isValidDomain(domain)) {
      console.log(`Invalid domain format: ${domain}`);
      return false;
    }
    
    // Use Port80Handler if available
    if (this.port80Handler) {
      try {
        // Check if we already have a certificate
        const cert = this.port80Handler.getCertificate(domain);
        if (cert) {
          console.log(`Certificate already exists for ${domain}, valid until ${cert.expiryDate.toISOString()}`);
          return true;
        }
        
        // Register domain for certificate issuance
        this.port80Handler.addDomain({
          domainName: domain,
          sslRedirect: true,
          acmeMaintenance: true
        });
        
        console.log(`Domain ${domain} registered for certificate issuance`);
        return true;
      } catch (err) {
        console.log(`Error registering domain with Port80Handler: ${err}`);
        return false;
      }
    }
    
    // Fall back to NetworkProxyBridge
    return this.networkProxyBridge.requestCertificate(domain);
  }
  
  /**
   * Validates if a domain name is valid for certificate issuance
   */
  private isValidDomain(domain: string): boolean {
    // Very basic domain validation
    if (!domain || domain.length === 0) {
      return false;
    }
    
    // Check for wildcard domains (they can't get ACME certs)
    if (domain.includes('*')) {
      console.log(`Wildcard domains like "${domain}" are not supported for ACME certificates`);
      return false;
    }
    
    // Check if domain has at least one dot and no invalid characters
    const validDomainRegex = /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
    if (!validDomainRegex.test(domain)) {
      console.log(`Domain "${domain}" has invalid format`);
      return false;
    }
    
    return true;
  }
  
  /**
   * Get statistics about current connections
   */
  public getStatistics(): any {
    const connectionRecords = this.connectionManager.getConnections();
    const terminationStats = this.connectionManager.getTerminationStats();
    
    let tlsConnections = 0;
    let nonTlsConnections = 0;
    let keepAliveConnections = 0;
    let networkProxyConnections = 0;
    
    // Analyze active connections
    for (const record of connectionRecords.values()) {
      if (record.isTLS) tlsConnections++;
      else nonTlsConnections++;
      if (record.hasKeepAlive) keepAliveConnections++;
      if (record.usingNetworkProxy) networkProxyConnections++;
    }
    
    return {
      activeConnections: connectionRecords.size,
      tlsConnections,
      nonTlsConnections,
      keepAliveConnections,
      networkProxyConnections,
      terminationStats,
      acmeEnabled: !!this.port80Handler,
      port80HandlerPort: this.port80Handler ? this.settings.acme?.port : null,
      routes: this.routeManager.getListeningPorts().length
    };
  }
  
  /**
   * Get a list of eligible domains for ACME certificates
   */
  public getEligibleDomainsForCertificates(): string[] {
    const domains: string[] = [];
    
    // Get domains from routes
    const routes = isRoutedOptions(this.settings) ? this.settings.routes : [];
    
    for (const route of routes) {
      if (!route.match.domains) continue;
      
      // Skip routes without TLS termination or auto certificates
      if (route.action.type !== 'forward' || 
          !route.action.tls || 
          route.action.tls.mode === 'passthrough' || 
          route.action.tls.certificate !== 'auto') continue;
      
      const routeDomains = Array.isArray(route.match.domains) 
        ? route.match.domains 
        : [route.match.domains];
      
      // Skip domains that can't be used with ACME
      const eligibleDomains = routeDomains.filter(domain => 
        !domain.includes('*') && this.isValidDomain(domain)
      );
      
      domains.push(...eligibleDomains);
    }
    
    // For legacy mode, also get domains from domain configs
    if (isLegacyOptions(this.settings)) {
      for (const config of this.settings.domainConfigs) {
        // Skip domains that can't be used with ACME
        const eligibleDomains = config.domains.filter(domain => 
          !domain.includes('*') && this.isValidDomain(domain)
        );
        
        domains.push(...eligibleDomains);
      }
    }
    
    return domains;
  }
  
  /**
   * Get status of certificates managed by Port80Handler
   */
  public getCertificateStatus(): any {
    if (!this.port80Handler) {
      return {
        enabled: false,
        message: 'Port80Handler is not enabled'
      };
    }
    
    // Get eligible domains
    const eligibleDomains = this.getEligibleDomainsForCertificates();
    const certificateStatus: Record<string, any> = {};
    
    // Check each domain
    for (const domain of eligibleDomains) {
      const cert = this.port80Handler.getCertificate(domain);
      
      if (cert) {
        const now = new Date();
        const expiryDate = cert.expiryDate;
        const daysRemaining = Math.floor((expiryDate.getTime() - now.getTime()) / (24 * 60 * 60 * 1000));
        
        certificateStatus[domain] = {
          status: 'valid',
          expiryDate: expiryDate.toISOString(),
          daysRemaining,
          renewalNeeded: daysRemaining <= (this.settings.acme?.renewThresholdDays ?? 0)
        };
      } else {
        certificateStatus[domain] = {
          status: 'missing',
          message: 'No certificate found'
        };
      }
    }
    
    const acme = this.settings.acme!;
    return {
      enabled: true,
      port: acme.port!,
      useProduction: acme.useProduction!,
      autoRenew: acme.autoRenew!,
      certificates: certificateStatus
    };
  }
}