/**
 * Inlined Mac DNS-Filter mobileconfig template.
 *
 * Single source of truth lives at ops/mdm/rebreak-mac-dns-filter.mobileconfig.
 * Bundled here as a TS string so it survives the Nitro build without
 * relying on serverAssets/process.cwd() path resolution (both proved
 * brittle on the staging deploy layout). If you change the canonical
 * file under ops/mdm, copy the contents here verbatim.
 */
export const MAGIC_PROFILE_TEMPLATE = `<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadDisplayName</key>
            <string>ReBreak DNS-Filter</string>
            <key>PayloadDescription</key>
            <string>Leitet DNS-Anfragen über dns.rebreak.org. Glücksspiel-Domains werden blockiert.</string>
            <key>PayloadIdentifier</key>
            <string>org.rebreak.protection.dns.filter</string>
            <key>PayloadType</key>
            <string>com.apple.dnsSettings.managed</string>
            <key>PayloadUUID</key>
            <string>7D2E8B1A-C3D4-4E76-8B23-A4B5C6D7E8F0</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>ProhibitDisablement</key>
            <true/>
            <key>DNSSettings</key>
            <dict>
                <key>DNSProtocol</key>
                <string>HTTPS</string>
                <key>ServerURL</key>
                <string>https://dns.rebreak.org/dns-query</string>
            </dict>
        </dict>
    </array>
    <key>PayloadDisplayName</key>
    <string>ReBreak Schutz</string>
    <key>PayloadDescription</key>
    <string>Aktiviert den ReBreak-DNS-Filter auf diesem Mac. Glücksspiel-Domains werden auf System-Ebene blockiert — gilt für alle Browser, alle Apps. Kann via Systemeinstellungen → Allgemein → Geräteverwaltung entfernt werden (Admin-Passwort erforderlich).</string>
    <key>PayloadIdentifier</key>
    <string>org.rebreak.protection.profile</string>
    <key>PayloadOrganization</key>
    <string>ReBreak</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>8C3F9A2B-D4E5-4F87-9A12-B5C6D7E8F901</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadRemovalDisallowed</key>
    <true/>
</dict>
</plist>
`;