/**
 * SMS delivery helper. Uses Twilio when credentials are present; otherwise
 * logs the message (dev/test). Never blocks ballot casting.
 */
export async function sendSms(options: {
  to: string;
  body: string;
}): Promise<{ ok: boolean; error?: string; logged?: boolean }> {
  const accountSid = process.env.TWILIO_ACCOUNT_SID;
  const authToken = process.env.TWILIO_AUTH_TOKEN;
  const from = process.env.TWILIO_FROM_NUMBER;

  if (!accountSid || !authToken || !from) {
    console.info(
      `[sms:dev] to=${options.to} body=${options.body.slice(0, 120)}`
    );
    return { ok: true, logged: true };
  }

  try {
    const auth = Buffer.from(`${accountSid}:${authToken}`).toString("base64");
    const response = await fetch(
      `https://api.twilio.com/2010-04-01/Accounts/${accountSid}/Messages.json`,
      {
        method: "POST",
        headers: {
          Authorization: `Basic ${auth}`,
          "Content-Type": "application/x-www-form-urlencoded",
        },
        body: new URLSearchParams({
          To: options.to,
          From: from,
          Body: options.body,
        }),
      }
    );

    if (!response.ok) {
      const text = await response.text();
      return { ok: false, error: text.slice(0, 200) || "SMS send failed" };
    }
    return { ok: true };
  } catch (err) {
    return {
      ok: false,
      error: err instanceof Error ? err.message : "SMS send failed",
    };
  }
}