package com.peachpasswords.vault

import kotlinx.coroutines.flow.MutableStateFlow
import kotlinx.coroutines.flow.StateFlow
import kotlinx.coroutines.flow.asStateFlow
import kotlinx.coroutines.sync.Mutex
import kotlinx.coroutines.sync.withLock
import java.security.SecureRandom
import java.util.Base64
import java.util.UUID
import javax.inject.Inject
import javax.inject.Singleton

private fun b64(bytes: ByteArray): String = Base64.getEncoder().withoutPadding().encodeToString(bytes)
private fun unb64(s: String): ByteArray = Base64.getDecoder().decode(s)

/** Cap on retained past passwords per entry. Mirrors the browser PASSWORD_HISTORY_MAX. */
private const val PASSWORD_HISTORY_MAX = 50

/** Fixed in-app key material for the decoy vault — holds nothing secret by design. */
private const val DECOY_SENTINEL = "peach_decoy_v1"

sealed interface UnlockResult {
    data object Success : UnlockResult
    data object WrongPassword : UnlockResult
    data class Error(val reason: String) : UnlockResult
}

sealed interface CreateVaultResult {
    data object Success : CreateVaultResult
    data class Error(val reason: String) : CreateVaultResult
}

/**
 * In-memory vault session backed by [VaultStore]. Faithful port of the browser
 * `vault.ts` semantics that matter for correctness:
 *
 *  - Two-slot at rest: slot A is the real (encrypted) vault, slot B a size-matched
 *    noise blob so a fresh install shows two similarly-shaped records.
 *  - Every modifiedAt/deletedAt uses [VaultCrypto.monotonicEntryTimestamp] so a
 *    deletion always wins last-write-wins against an in-flight edit.
 *  - Local writes bump the version counter; sync-applied writes do NOT (so a
 *    sync round never cascades into another outbound sync).
 *  - add/update/delete roll back in-memory state if the disk write fails.
 *  - destroyVault never touches the Pro license (separate store).
 */
@Singleton
class VaultRepository @Inject constructor(
    private val store: VaultStorage,
) {
    private val mutex = Mutex()
    private val rng = SecureRandom()

    private var derivedKey: ByteArray? = null
    private var rootKey: ByteArray? = null
    private var entryList: MutableList<VaultEntry> = mutableListOf()
    private var duressConfigured: Boolean = false
    private var recoveryWordHash: String? = null
    private var recoveryWordsSet: Boolean = false
    /** True while a decoy (duress) session is active — persistence targets the decoy slot. */
    private var decoyMode: Boolean = false

    private val _isUnlocked = MutableStateFlow(false)
    val isUnlocked: StateFlow<Boolean> = _isUnlocked.asStateFlow()

    private val _entries = MutableStateFlow<List<VaultEntry>>(emptyList())
    /** Active (non-deleted) entryList. */
    val entries: StateFlow<List<VaultEntry>> = _entries.asStateFlow()

    private val _settings = MutableStateFlow(VaultSettings())
    val settings: StateFlow<VaultSettings> = _settings.asStateFlow()

    fun hasVault(): Boolean = store.hasVault()

    // ---- Codex (printed paper backup) -------------------------------------

    /**
     * The at-rest slot-A envelope as base64 JSON `{"a": <StoredVault>}` — the
     * Codex payload's vaultBlob. Slot B is noise, so it is omitted. Restorable
     * on any device that has the master password. Null when no vault exists.
     */
    fun codexVaultBlobBase64(): String? {
        val slotA = store.loadSlotA() ?: return null
        val wrapper = """{"a":${VaultCodec.encodeSlot(slotA)}}"""
        return Base64.getUrlEncoder().withoutPadding().encodeToString(wrapper.toByteArray(Charsets.UTF_8))
    }

    /**
     * Replace the local vault from a Codex blob, then unlock with [password].
     * Writes slot A (and a size-matched noise slot B) before unlocking so the
     * restored vault is at rest exactly as a freshly-created one would be.
     */
    suspend fun restoreFromCodex(vaultBlobBase64: String, password: String): UnlockResult = mutex.withLock {
        return try {
            val wrapperJson = String(Base64.getUrlDecoder().decode(vaultBlobBase64), Charsets.UTF_8)
            val slotJson = Regex("\"a\"\\s*:\\s*(\\{.*\\})\\s*}\\s*$").find(wrapperJson)?.groupValues?.get(1)
                ?: return UnlockResult.Error("invalid_codex_blob")
            val slotA = VaultCodec.decodeSlot(slotJson) ?: return UnlockResult.Error("invalid_codex_blob")
            if (!store.writeSlotA(slotA)) return UnlockResult.Error("storage_write_failed")
            writeMatchingNoiseSlotB(slotA)
            store.stampLocalMutation()
            unlockLocked(password)
        } catch (e: Exception) {
            UnlockResult.Error(e.message ?: "restore_failed")
        }
    }

    suspend fun createVault(password: String): CreateVaultResult = mutex.withLock {
        return try {
            val salt = VaultCrypto.generateSalt()
            val key = VaultCrypto.deriveKey(password, salt)
            entryList = mutableListOf()
            duressConfigured = false
            recoveryWordHash = null
            recoveryWordsSet = false
            decoyMode = false
            rootKey = generateRecoverableRootKey()
            val slotA = sealSlotA(key, salt)
            if (!store.writeSlotA(slotA)) return CreateVaultResult.Error("storage_write_failed")
            writeMatchingNoiseSlotB(slotA)
            store.stampLocalMutation()
            store.writeSettings(_settings.value)
            derivedKey = key
            publish()
            _isUnlocked.value = true
            CreateVaultResult.Success
        } catch (e: Exception) {
            CreateVaultResult.Error(e.message ?: "create_failed")
        }
    }

    suspend fun unlock(password: String): UnlockResult = mutex.withLock { unlockLocked(password) }

    /** Unlock body without acquiring the mutex — callers must already hold it. */
    private fun unlockLocked(password: String): UnlockResult {
        val slotA = store.loadSlotA() ?: return UnlockResult.Error("no_vault")
        return try {
            val key = VaultCrypto.deriveKey(password, unb64(slotA.salt))
            val payload = try {
                VaultCodec.decode(VaultCrypto.decrypt(unb64(slotA.blob), key, VaultCrypto.AAD_SLOT_A))
            } catch (_: Exception) {
                VaultCrypto.zero(key)
                return UnlockResult.WrongPassword
            }
            derivedKey = key
            decoyMode = false
            entryList = payload.entries.toMutableList()
            duressConfigured = payload.duressConfigured
            recoveryWordHash = payload.recoveryWordHash
            recoveryWordsSet = payload.recoveryWordsSet
            _settings.value = store.loadSettings()
            ensureRootKey(payload)
            autoPurgeExpiredTrash()
            publish()
            _isUnlocked.value = true
            UnlockResult.Success
        } catch (e: Exception) {
            UnlockResult.Error(e.message ?: "unlock_failed")
        }
    }

    /**
     * Unlock into the decoy (duress) vault. Creates an empty decoy on first use,
     * sealed under a fixed in-app sentinel key with its own salt. The real slot A
     * is never read, so the real vault stays hidden. Edits during a decoy session
     * persist to the decoy slot only (see [persistSlotA]).
     */
    suspend fun unlockDecoy(): UnlockResult = mutex.withLock {
        return try {
            val existing = store.loadDecoySlot()
            if (existing == null) {
                val salt = VaultCrypto.generateSalt()
                val key = VaultCrypto.deriveKey(DECOY_SENTINEL, salt)
                entryList = mutableListOf()
                duressConfigured = false
                recoveryWordHash = null
                recoveryWordsSet = false
                rootKey = VaultCrypto.generateRootKey()
                derivedKey = key
                decoyMode = true
                val plaintext = VaultCodec.encode(currentPayload())
                val blob = b64(VaultCrypto.encrypt(plaintext, key, VaultCrypto.AAD_SLOT_A))
                if (!store.writeDecoySlot(StoredVault(version = 1, salt = b64(salt), blob = blob)))
                    return UnlockResult.Error("storage_write_failed")
            } else {
                val key = VaultCrypto.deriveKey(DECOY_SENTINEL, unb64(existing.salt))
                val payload = VaultCodec.decode(
                    VaultCrypto.decrypt(unb64(existing.blob), key, VaultCrypto.AAD_SLOT_A),
                )
                derivedKey = key
                decoyMode = true
                entryList = payload.entries.toMutableList()
                duressConfigured = false
                recoveryWordHash = payload.recoveryWordHash
                recoveryWordsSet = payload.recoveryWordsSet
                rootKey = if (payload.rootKeyB64.isNotBlank()) unb64(payload.rootKeyB64)
                          else VaultCrypto.generateRootKey()
            }
            _settings.value = store.loadSettings()
            publish()
            _isUnlocked.value = true
            UnlockResult.Success
        } catch (e: Exception) {
            UnlockResult.Error(e.message ?: "decoy_unlock_failed")
        }
    }

    /** Unlock with an already-derived AES-256 key (biometric path). */
    suspend fun unlockWithKey(key: ByteArray): UnlockResult = mutex.withLock {
        val slotA = store.loadSlotA() ?: return UnlockResult.Error("no_vault")
        return try {
            val payload = VaultCodec.decode(
                VaultCrypto.decrypt(unb64(slotA.blob), key, VaultCrypto.AAD_SLOT_A),
            )
            derivedKey = key.copyOf()
            decoyMode = false
            entryList = payload.entries.toMutableList()
            duressConfigured = payload.duressConfigured
            recoveryWordHash = payload.recoveryWordHash
            recoveryWordsSet = payload.recoveryWordsSet
            _settings.value = store.loadSettings()
            ensureRootKey(payload)
            autoPurgeExpiredTrash()
            publish()
            _isUnlocked.value = true
            UnlockResult.Success
        } catch (_: Exception) {
            UnlockResult.WrongPassword
        }
    }

    fun lock() {
        derivedKey?.let(VaultCrypto::zero)
        rootKey?.let(VaultCrypto::zero)
        derivedKey = null
        rootKey = null
        entryList = mutableListOf()
        duressConfigured = false
        recoveryWordHash = null
        recoveryWordsSet = false
        decoyMode = false
        _entries.value = emptyList()
        _isUnlocked.value = false
    }

    // ---- Sync identity ----------------------------------------------------

    /**
     * The vault's stable sync master key (a copy). Caller must zero it. Backs
     * vault_id, the Noise static key, the Ed25519 manifest key, and per-entry
     * envelope keys. Null when locked. See [VaultPayload.rootKeyB64].
     */
    fun syncMasterKey(): ByteArray? = rootKey?.copyOf()

    /** Stable per-vault id two paired devices must share to sync. Null when locked. */
    fun syncVaultId(): String? = rootKey?.let { com.peachpasswords.sync.computeVaultId(it) }

    /**
     * A copy of the live Argon2id-derived vault key, for biometric escrow only
     * (wrapped under a hardware KeyStore key on biometric enable). Null when
     * locked. Caller must [VaultCrypto.zero] it after use.
     */
    fun currentVaultKey(): ByteArray? = derivedKey?.copyOf()

    suspend fun changePassword(oldPassword: String, newPassword: String): Boolean = mutex.withLock {
        val slotA = store.loadSlotA() ?: return false
        return try {
            val oldKey = VaultCrypto.deriveKey(oldPassword, unb64(slotA.salt))
            val payload = VaultCodec.decode(
                VaultCrypto.decrypt(unb64(slotA.blob), oldKey, VaultCrypto.AAD_SLOT_A),
            )
            val newSalt = VaultCrypto.generateSalt()
            val newKey = VaultCrypto.deriveKey(newPassword, newSalt)
            // Re-seal the existing payload under the new key/salt.
            val plaintext = VaultCodec.encode(payload)
            val blob = b64(VaultCrypto.encrypt(plaintext, newKey, VaultCrypto.AAD_SLOT_A))
            // The escrow seals the slot-A PLAINTEXT, which a password change does not
            // alter — only the wrapping changes — so carry it forward; rebuilding the
            // StoredVault from scratch would silently drop it.
            // Carry BOTH escrows forward unchanged: each seals plaintext/root-key
            // content that a password change does not alter — only the slot-A
            // wrapping rotates. The root-key escrow staying stable across password
            // changes matches the browser (`vault.ts:363-364`).
            val next = StoredVault(
                version = slotA.version,
                salt = b64(newSalt),
                blob = blob,
                recoveryEscrow = slotA.recoveryEscrow,
                rootKeyEscrow = slotA.rootKeyEscrow,
            )
            if (!store.writeSlotA(next)) return false
            writeMatchingNoiseSlotB(next)
            store.stampLocalMutation()
            VaultCrypto.zero(oldKey)
            derivedKey?.let(VaultCrypto::zero)
            derivedKey = newKey
            true
        } catch (_: Exception) {
            false
        }
    }

    /**
     * Irreversible wipe. Locks the session and clears every vault key. The Pro
     * license is in a separate store and is preserved by construction.
     */
    suspend fun destroyVault() = mutex.withLock {
        lock()
        store.clearVault()
        store.clearDecoySlot()
    }

    // ---- Entry CRUD -------------------------------------------------------

    suspend fun addEntry(draft: VaultEntry): VaultEntry = mutex.withLock {
        requireUnlocked()
        val stamp = VaultCrypto.monotonicEntryTimestamp()
        val now = System.currentTimeMillis()
        val entry = draft.copy(
            id = draft.id.ifBlank { UUID.randomUUID().toString() },
            createdAt = if (draft.createdAt > 0) draft.createdAt else now,
            modifiedAt = stamp,
            passwordChangedAt = if (!draft.password.isNullOrEmpty()) stamp else draft.passwordChangedAt,
        )
        val rollback = entryList.toMutableList()
        entryList.add(entry)
        persistOrRollback(rollback)
        entry
    }

    suspend fun updateEntry(patch: VaultEntry): VaultEntry = mutex.withLock {
        requireUnlocked()
        val idx = entryList.indexOfFirst { it.id == patch.id }
        if (idx == -1 || entryList[idx].deletedAt != null) throw IllegalStateException("entry_not_found")
        val current = entryList[idx]
        val stamp = VaultCrypto.monotonicEntryTimestamp(current.modifiedAt)
        // Only refresh passwordChangedAt when the password value actually changes.
        val passwordChanged = patch.password != null && patch.password != current.password
        // Capture the outgoing password (newest first) so the user can reveal/copy/
        // restore it later. History is computed authoritatively from `current`, not
        // the patch — updateEntry is a full-entry replace, so trusting patch's value
        // would let a stale form clobber the real history. Record the age the old
        // password carried, skip an empty prior, and skip an immediate exact dupe
        // (e.g. restore-then-restore). Capped at PASSWORD_HISTORY_MAX.
        val priorPassword = current.password
        val shouldCapture = passwordChanged &&
            !priorPassword.isNullOrEmpty() &&
            current.passwordHistory?.firstOrNull()?.password != priorPassword
        val nextHistory = if (shouldCapture) {
            (listOf(PasswordHistoryItem(priorPassword!!, current.passwordChangedAt ?: current.createdAt)) +
                (current.passwordHistory ?: emptyList())).take(PASSWORD_HISTORY_MAX)
        } else {
            current.passwordHistory
        }
        val updated = patch.copy(
            createdAt = current.createdAt,
            modifiedAt = stamp,
            passwordChangedAt = if (passwordChanged) stamp else current.passwordChangedAt,
            passwordHistory = nextHistory,
        )
        val rollback = entryList.toMutableList()
        entryList[idx] = updated
        persistOrRollback(rollback)
        updated
    }

    /** Soft-delete: writes a tombstone whose timestamp beats any in-flight edit. */
    suspend fun deleteEntry(id: String) = mutex.withLock {
        requireUnlocked()
        val idx = entryList.indexOfFirst { it.id == id }
        if (idx == -1 || entryList[idx].deletedAt != null) throw IllegalStateException("entry_not_found")
        val current = entryList[idx]
        val stamp = VaultCrypto.monotonicEntryTimestamp(current.modifiedAt)
        val rollback = entryList.toMutableList()
        entryList[idx] = current.copy(deletedAt = stamp, modifiedAt = stamp)
        persistOrRollback(rollback)
    }

    suspend fun restoreEntry(id: String) = mutex.withLock {
        requireUnlocked()
        val idx = entryList.indexOfFirst { it.id == id && it.deletedAt != null }
        if (idx == -1) throw IllegalStateException("deleted entry not found")
        val current = entryList[idx]
        val rollback = entryList.toMutableList()
        entryList[idx] = current.copy(deletedAt = null, modifiedAt = VaultCrypto.monotonicEntryTimestamp(current.modifiedAt))
        persistOrRollback(rollback)
    }

    /** Permanent delete — no tombstone, no recovery. */
    suspend fun purgeEntry(id: String) = mutex.withLock {
        requireUnlocked()
        val idx = entryList.indexOfFirst { it.id == id && it.deletedAt != null }
        if (idx == -1) throw IllegalStateException("deleted entry not found")
        val rollback = entryList.toMutableList()
        entryList.removeAt(idx)
        persistOrRollback(rollback)
    }

    /** Permanently empty the trash — hard-deletes every soft-deleted entry. */
    suspend fun purgeDeletedEntries(): Int = mutex.withLock {
        requireUnlocked()
        val rollback = entryList.toMutableList()
        val before = entryList.size
        entryList.removeAll { it.deletedAt != null }
        val removed = before - entryList.size
        if (removed > 0) persistOrRollback(rollback)
        removed
    }

    fun getEntries(): List<VaultEntry> = entryList.filter { it.deletedAt == null }
    fun getEntry(id: String): VaultEntry? = entryList.firstOrNull { it.id == id && it.deletedAt == null }
    fun getDeletedEntries(): List<VaultEntry> =
        entryList.filter { it.deletedAt != null }.sortedByDescending { it.deletedAt }

    /** Active entries, optionally narrowed to those carrying [tagFilter]. */
    fun getActiveEntries(tagFilter: String? = null): List<VaultEntry> {
        val active = entryList.filter { it.deletedAt == null }
        if (tagFilter == null) return active
        val needle = tagFilter.trim().lowercase()
        return active.filter { e -> e.tags?.any { it.equals(needle, ignoreCase = true) } == true }
    }

    /** Sorted, de-duplicated tags across all active entries. */
    fun getDistinctTags(): List<String> =
        entryList.asSequence()
            .filter { it.deletedAt == null }
            .flatMap { it.tags?.asSequence() ?: emptySequence() }
            .map { it.trim().lowercase() }
            .filter { it.isNotEmpty() }
            .distinct()
            .sorted()
            .toList()

    /**
     * Distinct non-blank values for an identity field across active entries,
     * most-frequently-used first. Supports "username" and "email"; unknown field
     * names return an empty list. Values keep original casing (deduped
     * case-insensitively) so a suggestion matches what the user typed.
     */
    fun getDistinctFieldValues(field: String): List<String> {
        val select: (VaultEntry) -> String? = when (field) {
            "username" -> { e -> e.username }
            "email" -> { e -> e.email }
            else -> return emptyList()
        }
        return entryList.asSequence()
            .filter { it.deletedAt == null }
            .mapNotNull { select(it)?.trim() }
            .filter { it.isNotEmpty() }
            .groupingBy { it.lowercase() }
            .aggregate { _, acc: Pair<String, Int>?, value, _ ->
                Pair(acc?.first ?: value, (acc?.second ?: 0) + 1)
            }
            .values
            .sortedWith(compareByDescending<Pair<String, Int>> { it.second }.thenBy { it.first.lowercase() })
            .map { it.first }
    }

    fun getTombstones(): List<Tombstone> =
        entryList.filter { it.deletedAt != null }.map { Tombstone(it.id, it.deletedAt!!) }
    fun getVaultVersion(): Long = store.version()

    // ---- Sync apply (does NOT advance the version) ------------------------

    /**
     * Apply remote entryList + tombstones with per-entry last-write-wins. Persists
     * WITHOUT bumping the version counter, so a sync round cannot cascade into
     * another outbound sync. Returns the number of locally-applied changes.
     */
    suspend fun applyMergedRemoteEntries(
        remoteEntries: List<VaultEntry>,
        remoteTombstones: List<Tombstone>,
    ): Int = mutex.withLock {
        requireUnlocked()
        val tombMap = remoteTombstones.associate { it.id to it.deletedAt }
        var applied = 0
        val byId = entryList.associateBy { it.id }.toMutableMap()

        for (remote in remoteEntries) {
            val tomb = tombMap[remote.id]
            if (tomb != null && tomb >= remote.modifiedAt) continue
            val local = byId[remote.id]
            if (local == null) {
                entryList.add(remote); byId[remote.id] = remote; applied++
            } else if (remote.modifiedAt > local.modifiedAt) {
                val i = entryList.indexOfFirst { it.id == local.id }
                if (i != -1) { entryList[i] = remote; byId[remote.id] = remote; applied++ }
            }
        }

        for ((id, deletedAt) in tombMap) {
            val local = byId[id] ?: continue
            if (local.deletedAt != null && local.deletedAt >= deletedAt) continue
            if (deletedAt < local.modifiedAt) continue
            val i = entryList.indexOfFirst { it.id == id }
            if (i != -1) { entryList[i] = local.copy(deletedAt = deletedAt, modifiedAt = deletedAt); applied++ }
        }

        if (applied > 0) {
            persistSlotA(bumpVersion = false)
            publish()
        }
        applied
    }

    suspend fun updateSettings(settings: VaultSettings) = mutex.withLock {
        _settings.value = settings
        store.writeSettings(settings)
    }

    // ---- Recovery words (vault metadata) ----------------------------------

    /** True once the user has confirmed their recovery words for this vault. */
    fun isRecoveryWordsSet(): Boolean = recoveryWordsSet

    /**
     * Record the BLAKE3 hash of the confirmed recovery words and mark them set.
     * Persisted without bumping the version — recovery metadata is local-only and
     * is not an entry mutation paired devices should sync against.
     */
    suspend fun setRecoveryWords(words: List<String>): Boolean = mutex.withLock {
        requireUnlocked()
        recoveryWordHash = recoveryWordsHash(words)
        recoveryWordsSet = true
        // Seal TWO escrows (MF-1): the browser-byte-compatible root-key escrow
        // (cross-platform recovery of the sync root key) and Android's whole-payload
        // escrow (offline forgot-password restore of entries). Both derive their key
        // from the same `wordsToRootKeyMaterial` IKM but use distinct AADs.
        runCatching {
            persistSlotAWithEscrows(buildRecoveryEscrow(words), buildRootKeyEscrow(words))
        }.getOrDefault(false)
    }

    /** Verify entered words against the stored recovery hash. */
    fun verifyRecoveryWords(words: List<String>): Boolean {
        val stored = recoveryWordHash ?: return false
        return stored == recoveryWordsHash(words)
    }

    // ---- Recovery escrow (forgot-password) --------------------------------

    /** True at rest if this vault has any recovery escrow the recovery flow can use. */
    fun hasRecoveryEscrow(): Boolean =
        store.loadSlotA()?.let { it.recoveryEscrow != null || it.rootKeyEscrow != null } ?: false

    /**
     * Attempt to unlock the vault using the 12 BIP39 recovery [words] instead of
     * the master password. On success the slot-A plaintext sealed in the escrow is
     * adopted as the live session (entries, rootKey, settings), but no Argon2id
     * password key exists yet — call [resetPasswordWithRecoveryWords] next to set a
     * new password and finish unlocking. Returns false when there is no escrow, the
     * words fail the BIP39 checksum, or the words are wrong (GCM tag mismatch).
     *
     * Unlike the brief's `unlockWithRecoveryWords(): ByteArray?`, there is no
     * detached vault key to return here — slot A is wrapped under the rotating
     * Argon2id key — so this opens the escrowed payload directly.
     */
    suspend fun unlockWithRecoveryWords(words: List<String>): Boolean = mutex.withLock {
        val slotA = store.loadSlotA() ?: return false
        if (words.size != 12 || findInvalidWords(words).isNotEmpty()) return false

        // Prefer Android's whole-payload escrow: a full offline restore of entries,
        // root key, and settings. Present for Android-created vaults.
        slotA.recoveryEscrow?.let { escrow ->
            val material = runCatching { wordsToRootKeyMaterial(words) }.getOrNull() ?: return@let
            val recoveryKey = deriveRecoveryKey(material, unb64(escrow.salt))
            val keyBytes = recoveryKey.encoded
            try {
                val plaintext = VaultCrypto.decrypt(unb64(escrow.blob), keyBytes, VaultCrypto.AAD_RECOVERY)
                val payload = VaultCodec.decode(plaintext)
                decoyMode = false
                entryList = payload.entries.toMutableList()
                duressConfigured = payload.duressConfigured
                recoveryWordHash = payload.recoveryWordHash
                recoveryWordsSet = payload.recoveryWordsSet
                rootKey = if (payload.rootKeyB64.isNotBlank()) unb64(payload.rootKeyB64)
                          else generateRecoverableRootKey()
                _settings.value = store.loadSettings()
                VaultCrypto.zero(plaintext)
                return true
            } catch (_: Exception) {
                // Wrong words against this escrow — fall through to the root-key escrow.
            } finally {
                VaultCrypto.zero(material)
                VaultCrypto.zero(keyBytes)
            }
        }

        // Browser-format vault (only the root-key escrow): recover the 32-byte root
        // key (sync identity) and reset the password; entries return via sync. This
        // is exactly the browser's recovery semantics (`messages.ts:312-347`).
        slotA.rootKeyEscrow?.let { escrow ->
            val rk = unsealRootKeyEscrow(words, escrow) ?: return false
            decoyMode = false
            entryList = mutableListOf()
            duressConfigured = false
            recoveryWordHash = recoveryWordsHash(words)
            recoveryWordsSet = true
            rootKey = rk
            _settings.value = store.loadSettings()
            return true
        }
        return false
    }

    /**
     * After [unlockWithRecoveryWords] succeeds, set a brand-new master password:
     * re-seal slot A under a fresh Argon2id key, rotate the escrow under the same
     * words, mark the session fully unlocked, and publish. Returns false if called
     * without a prior successful recovery unlock (no in-memory root key).
     *
     * Folds the brief's `resetPasswordWithRecoveryKey(vaultKey, …)` + `unlock(…)`
     * into one step, since there is no detached vault key here.
     */
    suspend fun resetPasswordWithRecoveryWords(
        words: List<String>,
        newPassword: String,
    ): Boolean = mutex.withLock {
        if (rootKey == null) return false // must have recovered first
        return try {
            val newSalt = VaultCrypto.generateSalt()
            val newKey = VaultCrypto.deriveKey(newPassword, newSalt)
            val plaintext = VaultCodec.encode(currentPayload())
            val blob = b64(VaultCrypto.encrypt(plaintext, newKey, VaultCrypto.AAD_SLOT_A))
            val prior = store.loadSlotA()
            // Rebuild both escrows against the recovered session so their salts rotate
            // with the password reset; fall back to the prior escrows if rebuild fails
            // (e.g. a checksum-invalid phrase). The same 12 words keep working.
            val valid = words.size == 12 && findInvalidWords(words).isEmpty()
            val freshRecovery = if (valid) buildRecoveryEscrow(words) ?: prior?.recoveryEscrow else prior?.recoveryEscrow
            val freshRootKey = if (valid) buildRootKeyEscrow(words) ?: prior?.rootKeyEscrow else prior?.rootKeyEscrow
            val next = StoredVault(
                version = prior?.version ?: 1,
                salt = b64(newSalt),
                blob = blob,
                recoveryEscrow = freshRecovery,
                rootKeyEscrow = freshRootKey,
            )
            if (!store.writeSlotA(next)) return false
            writeMatchingNoiseSlotB(next)
            store.stampLocalMutation()
            derivedKey?.let(VaultCrypto::zero)
            derivedKey = newKey
            VaultCrypto.zero(plaintext)
            publish()
            _isUnlocked.value = true
            true
        } catch (_: Exception) {
            false
        }
    }

    /**
     * Seal the current slot-A plaintext under a key derived from the 12 BIP39
     * recovery [words] (Android offline-restore escrow). IKM is the browser's
     * `wordsToRootKeyMaterial` (MF-1), AAD is the string [VaultCrypto.AAD_RECOVERY].
     * Returns null for a checksum-invalid phrase.
     */
    private fun buildRecoveryEscrow(words: List<String>): RecoveryEscrow? {
        if (words.size != 12 || findInvalidWords(words).isNotEmpty()) return null
        val material = runCatching { wordsToRootKeyMaterial(words) }.getOrNull() ?: return null
        val salt = VaultCrypto.generateSalt()
        val recoveryKey = deriveRecoveryKey(material, salt)
        val keyBytes = recoveryKey.encoded
        val plaintext = VaultCodec.encode(currentPayload())
        return try {
            val sealed = VaultCrypto.encrypt(plaintext, keyBytes, VaultCrypto.AAD_RECOVERY)
            RecoveryEscrow(salt = b64(salt), blob = b64(sealed))
        } finally {
            VaultCrypto.zero(material)
            VaultCrypto.zero(keyBytes)
            VaultCrypto.zero(plaintext)
        }
    }

    /**
     * Seal ONLY the 32-byte root key under a key the recovery [words] derive,
     * byte-for-byte the browser algorithm (MF-1): plaintext = lowercase ASCII hex
     * of the root key, IKM = `wordsToRootKeyMaterial`, HKDF salt random-16,
     * info `peach-recovery-v1`, AES-256-GCM AAD = 0x01. The same 12 words unwrap
     * the same root key on the browser. Returns null with no in-memory root key or
     * a checksum-invalid phrase.
     */
    private fun buildRootKeyEscrow(words: List<String>): RootKeyEscrow? {
        if (words.size != 12 || findInvalidWords(words).isNotEmpty()) return null
        val rk = rootKey ?: return null
        val material = runCatching { wordsToRootKeyMaterial(words) }.getOrNull() ?: return null
        val salt = VaultCrypto.generateSalt()
        val recoveryKey = deriveRecoveryKey(material, salt)
        val keyBytes = recoveryKey.encoded
        val plaintext = rootKeyToHex(rk).toByteArray(Charsets.US_ASCII)
        return try {
            // combined = nonce(12) || ciphertext || tag(16)
            val combined = VaultCrypto.encrypt(plaintext, keyBytes, VaultCrypto.AAD_RECOVERY_ROOTKEY)
            val nonce = combined.copyOfRange(0, VaultCrypto.NONCE_SIZE)
            val ctTag = combined.copyOfRange(VaultCrypto.NONCE_SIZE, combined.size)
            val tag = ctTag.copyOfRange(ctTag.size - 16, ctTag.size)
            val ct = ctTag.copyOfRange(0, ctTag.size - 16)
            RootKeyEscrow(salt = b64(salt), wrappedRootKey = b64(ct), nonce = b64(nonce), tag = b64(tag))
        } finally {
            VaultCrypto.zero(material)
            VaultCrypto.zero(keyBytes)
            VaultCrypto.zero(plaintext)
        }
    }

    /** Unwrap the 32-byte root key from a browser-compatible [escrow]; null on wrong words. */
    private fun unsealRootKeyEscrow(words: List<String>, escrow: RootKeyEscrow): ByteArray? {
        val material = runCatching { wordsToRootKeyMaterial(words) }.getOrNull() ?: return null
        val recoveryKey = deriveRecoveryKey(material, unb64(escrow.salt))
        val keyBytes = recoveryKey.encoded
        return try {
            val combined = unb64(escrow.nonce) + unb64(escrow.wrappedRootKey) + unb64(escrow.tag)
            val pt = VaultCrypto.decrypt(combined, keyBytes, VaultCrypto.AAD_RECOVERY_ROOTKEY)
            hexToRootKey(String(pt, Charsets.US_ASCII))
        } catch (_: Exception) {
            null
        } finally {
            VaultCrypto.zero(material)
            VaultCrypto.zero(keyBytes)
        }
    }

    /**
     * Re-seal slot A from the current in-memory state under the live key, carrying
     * both [recoveryEscrow] and [rootKeyEscrow] onto the written record. Never runs
     * in decoy mode (recovery is never offered for the decoy) and persists without
     * a version bump, like the recovery-words metadata write it replaces.
     */
    private fun persistSlotAWithEscrows(
        recoveryEscrow: RecoveryEscrow?,
        rootKeyEscrow: RootKeyEscrow?,
    ): Boolean {
        val key = derivedKey ?: throw IllegalStateException("vault_locked")
        if (decoyMode) return false
        val prior = store.loadSlotA() ?: throw IllegalStateException("missing slot A")
        val plaintext = VaultCodec.encode(currentPayload())
        val blob = b64(VaultCrypto.encrypt(plaintext, key, VaultCrypto.AAD_SLOT_A))
        val next = prior.copy(
            blob = blob,
            recoveryEscrow = recoveryEscrow ?: prior.recoveryEscrow,
            rootKeyEscrow = rootKeyEscrow ?: prior.rootKeyEscrow,
        )
        if (!store.writeSlotA(next)) return false
        try {
            writeMatchingNoiseSlotB(next)
        } catch (e: Exception) {
            store.writeSlotA(prior)
            throw e
        }
        return true
    }

    // ---- Internals --------------------------------------------------------

    private fun requireUnlocked() {
        if (derivedKey == null) throw IllegalStateException("vault_locked")
    }

    /**
     * On unlock, hard-delete trashed entries older than the retention window.
     * A null or non-positive [VaultSettings.trashRetentionDays] means "never"
     * (the app's "Never" option), so nothing is purged. Persists without a
     * version bump and without touching the publish state (caller publishes).
     */
    private fun autoPurgeExpiredTrash() {
        val days = _settings.value.trashRetentionDays ?: return
        if (days <= 0) return
        val cutoff = System.currentTimeMillis() - days.toLong() * 24L * 60L * 60L * 1000L
        val before = entryList.size
        entryList.removeAll { it.deletedAt != null && it.deletedAt < cutoff }
        if (entryList.size != before) runCatching { persistSlotA(bumpVersion = false) }
    }

    /** The slot-A plaintext envelope for the current in-memory session. */
    private fun currentPayload(): VaultPayload =
        VaultPayload(
            entries = entryList.toList(),
            duressConfigured = duressConfigured,
            rootKeyB64 = rootKey?.let(::b64) ?: "",
            recoveryWordHash = recoveryWordHash,
            recoveryWordsSet = recoveryWordsSet,
        )

    /**
     * Adopt the payload's root key, lazily minting one for legacy payloads.
     * A freshly-minted key is persisted WITHOUT bumping the version — adopting
     * a root key is not a mutation paired devices should sync against.
     */
    private fun ensureRootKey(payload: VaultPayload) {
        if (payload.rootKeyB64.isNotBlank()) {
            rootKey = unb64(payload.rootKeyB64)
            return
        }
        rootKey = generateRecoverableRootKey()
        runCatching { persistSlotA(bumpVersion = false) }
    }

    private fun publish() {
        _entries.value = entryList.filter { it.deletedAt == null }
    }

    private fun sealSlotA(key: ByteArray, salt: ByteArray): StoredVault {
        val plaintext = VaultCodec.encode(currentPayload())
        val blob = b64(VaultCrypto.encrypt(plaintext, key, VaultCrypto.AAD_SLOT_A))
        return StoredVault(version = 1, salt = b64(salt), blob = blob)
    }

    private fun writeMatchingNoiseSlotB(slotA: StoredVault) {
        val approxBytes = (slotA.blob.length / 2).coerceAtLeast(VaultCrypto.NONCE_SIZE + 16)
        val noise = ByteArray(approxBytes).also(rng::nextBytes)
        store.writeSlotB(b64(noise))
    }

    /** Re-seal slot A from the current in-memory state under the live key. */
    private fun persistSlotA(bumpVersion: Boolean): Boolean {
        val key = derivedKey ?: throw IllegalStateException("vault_locked")
        // Decoy sessions persist to the decoy slot only — never touch the real slot A.
        if (decoyMode) {
            val prior = store.loadDecoySlot() ?: throw IllegalStateException("missing decoy slot")
            val plaintext = VaultCodec.encode(currentPayload())
            val blob = b64(VaultCrypto.encrypt(plaintext, key, VaultCrypto.AAD_SLOT_A))
            return store.writeDecoySlot(prior.copy(blob = blob))
        }
        val prior = store.loadSlotA() ?: throw IllegalStateException("missing slot A")
        val plaintext = VaultCodec.encode(currentPayload())
        val blob = b64(VaultCrypto.encrypt(plaintext, key, VaultCrypto.AAD_SLOT_A))
        val next = prior.copy(blob = blob)
        if (!store.writeSlotA(next)) return false
        // Slot A committed — keep slot B size-matched, then advance the version
        // for local writes only. Restore slot A if a later step fails.
        try {
            writeMatchingNoiseSlotB(next)
            if (bumpVersion) store.stampLocalMutation()
        } catch (e: Exception) {
            store.writeSlotA(prior)
            throw e
        }
        return true
    }

    /** Persist a local mutation, rolling the in-memory list back on failure. */
    private fun persistOrRollback(rollback: MutableList<VaultEntry>) {
        try {
            if (!persistSlotA(bumpVersion = true)) {
                entryList = rollback
                throw IllegalStateException("storage_write_failed")
            }
        } catch (e: Exception) {
            entryList = rollback
            throw e
        }
        publish()
    }
}