//#region src/maintenance.ts
/** The operator floor — always part of the effective allow-set, never removable by config. */
const OPERATOR_ROLES = ["admin", "owner"];
const DEFAULT_RETRY_AFTER_SEC = 3600;
function maintenanceGuard(cfg, principalRoles) {
	if (!cfg.enabled) return { blocked: false };
	const allowRoles = Array.isArray(cfg.allowRoles) ? cfg.allowRoles : [];
	const allow = /* @__PURE__ */ new Set([...allowRoles, ...OPERATOR_ROLES]);
	if ((Array.isArray(principalRoles) ? principalRoles : []).some((r) => allow.has(r))) return { blocked: false };
	const retryAfter = cfg.retryAfterSec ?? DEFAULT_RETRY_AFTER_SEC;
	return {
		blocked: true,
		status: 503,
		headers: { "Retry-After": String(retryAfter) },
		message: cfg.message
	};
}
//#endregion
export { maintenanceGuard };
