// POST `/login/start` / `/login/code` / `/login/cancel` — same-origin
// (this agent's own backend, `hive-agent/src/web_ui/auth.rs`), so a
// plain `fetch` is safe (unlike `pauseAction.ts`'s dashboard-origin
// actions). Same `{ ok, detail }` shape and `redirect: 'manual'` /
// broad-2xx-4xx-treated-as-ok contract as `modelEffort.ts` — none of
// these three routes actually redirect today, but the same tolerant
// check costs nothing and keeps every same-origin POST in this package
// behaving identically.
async function post(path: string, body?: URLSearchParams): Promise<{ ok: boolean; detail?: string }> {
  try {
    const resp = await fetch(path, {
      method: 'POST',
      headers: body ? { 'Content-Type': 'application/x-www-form-urlencoded' } : undefined,
      body,
      redirect: 'manual',
    });
    const ok = resp.ok || resp.type === 'opaqueredirect' || (resp.status >= 200 && resp.status < 400);
    if (ok) return { ok: true };
    const detail = await resp.text().catch(() => '');
    return { ok: false, detail: `http ${resp.status}${detail ? ' — ' + detail : ''}` };
  } catch (err) {
    return { ok: false, detail: err instanceof Error ? err.message : String(err) };
  }
}

export const postLoginStart = () => post('login/start');
export const postLoginCode = (code: string) => post('login/code', new URLSearchParams({ code }));
export const postLoginCancel = () => post('login/cancel');