import json


def collect_tokens(cfg):
    vlans = cfg.get('vlans', [])
    wg_vlans_list = sorted(
        [v for v in vlans if v.get('is_vpn')],
        key=lambda v: (v.get('vlan_id') is None, v.get('vlan_id') or 0)
    )
    wg_vlan = wg_vlans_list[0] if wg_vlans_list else {}
    vpn = wg_vlan.get('vpn_information', {})
    overrides = vpn.get('explicit_overrides', {})

    try:
        import ipaddress
        ident_ips = [s['ip'] for s in wg_vlan.get('server_identities', []) if s.get('ip')]
        if ident_ips:
            default_gw = str(min((ipaddress.IPv4Address(ip) for ip in ident_ips), key=lambda x: x.packed[-1]))
        else:
            wg_net = ipaddress.IPv4Network(f"{wg_vlan['subnet']}/{wg_vlan['subnet_mask']}", strict=False)
            default_gw = str(next(wg_net.hosts()))
        vpn_gateway = overrides.get('gateway') or default_gw
    except Exception:
        vpn_gateway = ''

    return {
        'VPN_VLAN_OPTIONS': json.dumps([
            {'value': v.get('name', ''), 'label': f'wg{i} (VLAN {v.get("vlan_id") or "?"})'}
            for i, v in enumerate(wg_vlans_list)
        ]),
        'VPN_LISTEN_PORT':     str(vpn.get('listen_port', '')),
        'VPN_SERVER_ENDPOINT': str(vpn.get('server_endpoint', '')),
        'VPN_DOMAIN':          str(vpn.get('domain', '')),
        'VPN_DNS_SERVER':      str(overrides.get('dns_servers', '')),
        'VPN_MTU':             str(overrides.get('mtu', '')),
        'VPN_GATEWAY':         vpn_gateway,
    }