/** Surge Mac 6.8+ quoted value escaping; logical-rule expressions stay structural. */
export function surgeValue(value: string): string {
  if (/[\x00-\x1f\x7f\u2028\u2029]/.test(value)) throw new Error('Surge value contains a control character');
  return /[\s,"'\\#;]/.test(value)
    ? `"${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`
    : value;
}

export function surgeDeclaration(name: string): string {
  if (!name || name !== name.trim() || /[=,"'\\#;\[\]\x00-\x1f\x7f\u2028\u2029]/.test(name)) {
    throw new Error('Unsafe Surge policy declaration name');
  }
  return name;
}

export function surgeParam(param: string): string {
  const index = param.indexOf('=');
  const key = index < 0 ? param : param.slice(0, index);
  if (!/^[a-z][a-z0-9-]*$/i.test(key)) throw new Error('Unsafe Surge parameter name');
  return index < 0 ? key : `${key}=${surgeValue(param.slice(index + 1))}`;
}