// Production sync runner — composes the live vault adapter, WebSocket
// transport, and coordinator into the function the dispatcher injects via
// `setSyncRunner`. The runner is responsible for opening one Noise NK
// session against a single paired device, driving the sync protocol, and
// surfacing a `SyncRunResult` (or throwing on failure). The dispatcher in
// sync-trigger.ts iterates over hosts and aggregates results.
//
// Connection strategy:
//   1. Try `getLastKnownIp(deviceLongTermPubkey)` if cached — fast path.
//   2. Fall back to `probeSubnetForPeer` over the local /24. The subnet
//      probe is itself rate-limited (60s per-pubkey cooldown) inside the
//      transport, so we don't add another layer here.
//   3. On a successful session, persist the IP we connected on so the next
//      sync round skips the probe.
//
// We do NOT verify vault_id here — the coordinator's SYNC_HELLO exchange
// does that (returns `status: "vault_mismatch"` if the peer holds a
// different vault). The runner just translates the coordinator's outcome
// into the throw-or-return contract the dispatcher expects.

import { runSyncInitiator, type SyncVaultAdapter } from "./sync-coordinator";
import { createSyncVaultAdapter } from "./sync-vault-adapter";
import {
  getLastKnownIp,
  setLastKnownIp,
} from "./paired-devices";
import {
  openSyncSession,
  probeSubnetForPeer,
  type SyncSession,
  type SyncEndpoint,
  type SyncPeerIdentity,
} from "../shared/sync-transport";
import { hexToPubkey } from "../shared/sync-identity";
import { getLocalSubnet } from "../shared/local-network";
import { buildLocalIdentity } from "./device-identity";
import { PAIRING_PORT } from "../shared/pairing-dial";
import { getRootKeyHex, isUnlocked } from "./vault";
import type { PairedDevice } from "../shared/sync-types";
import type { SyncRunResult } from "./sync-trigger";

/** Same fixed port pairing dials — SyncReconnectListener.SYNC_PORT on Android. */
const DEFAULT_PORT = PAIRING_PORT;

/**
 * Test/injection seam. Production wires in the real `openSyncSession`;
 * unit tests inject a fake to avoid real WebSocket + Noise NK.
 */
export interface SyncRunnerDeps {
  openSession: (
    endpoint: SyncEndpoint,
    ourIdentity: SyncPeerIdentity,
    expectedRemoteHex: string,
  ) => Promise<SyncSession>;
  probeSubnet: (
    subnet: string,
    port: number,
    ourIdentity: SyncPeerIdentity,
    expectedRemoteHex: string,
  ) => Promise<SyncEndpoint | null>;
  getSubnet: () => Promise<string | null>;
  createAdapter: (context?: { deviceName?: string }) => SyncVaultAdapter;
}

const productionDeps: SyncRunnerDeps = {
  openSession: (endpoint, identity, expected) =>
    openSyncSession(endpoint, identity, expected),
  probeSubnet: (subnet, port, identity, expected) =>
    probeSubnetForPeer(subnet, port, identity, expected),
  getSubnet: getLocalSubnet,
  createAdapter: (context) => createSyncVaultAdapter(context),
};

export async function productionSyncRunner(device: PairedDevice): Promise<SyncRunResult> {
  return runWithDeps(device, productionDeps);
}

/**
 * Inner runner with explicit deps — exported so tests can inject fakes.
 */
export async function runWithDeps(
  device: PairedDevice,
  deps: SyncRunnerDeps,
): Promise<SyncRunResult> {
  if (!isUnlocked()) return { ok: false, error: "VAULT_LOCKED" };
  if (!device.longTermPublicKeyHex) {
    throw new Error("paired_device_missing_pubkey");
  }
  const expectedRemoteHex = device.longTermPublicKeyHex;
  const port = device.wsPort ?? DEFAULT_PORT;

  // Sync identity derives from the stable root key, not the password-derived
  // key — keeps the long-term static key constant across password changes
  // (SEV-2-B). NK's initiator side has no static keypair in the handshake
  // itself; `ourIdentity` is only what we assert in the PAIR_IDENTITY frame.
  const masterKeyHex = getRootKeyHex();
  if (!masterKeyHex) return { ok: false, error: "VAULT_LOCKED" };
  const masterKey = hexToBytesLocal(masterKeyHex);
  const ourIdentity = await buildLocalIdentity(masterKey);

  // Sanity — the remote pubkey must be 32-byte hex so noise can compare it.
  void hexToPubkey(expectedRemoteHex);

  // HV-1b: pass the peer being synced so remote-mutation alerts can name it.
  const adapter = deps.createAdapter({ deviceName: device.deviceName });
  const session = await connect(expectedRemoteHex, port, ourIdentity, deps);

  try {
    const outcome = await runSyncInitiator(session, adapter);
    if (outcome.status === "completed") {
      return {
        ok: true,
        entriesReceived: outcome.entriesReceived,
        entriesSent: outcome.entriesSent,
      };
    }
    if (outcome.status === "vault_mismatch") {
      throw new Error("vault_id_mismatch");
    }
    if (outcome.status === "timeout") {
      throw new Error("sync_timeout");
    }
    throw new Error(outcome.error ?? "sync_errored");
  } finally {
    // The coordinator does NOT close the session (it returns and leaves the
    // session open). This runner is the sole owner of session lifetime.
    await session.close().catch(() => undefined);
  }
}

async function connect(
  expectedRemoteHex: string,
  port: number,
  ourIdentity: SyncPeerIdentity,
  deps: SyncRunnerDeps,
): Promise<SyncSession> {
  const cached = await getLastKnownIp(expectedRemoteHex);
  if (cached) {
    try {
      const session = await deps.openSession(
        { ip: cached, port },
        ourIdentity,
        expectedRemoteHex,
      );
      return session;
    } catch {
      // Cached IP stale — fall through to the subnet probe.
    }
  }

  const subnet = await deps.getSubnet();
  if (!subnet) {
    throw new Error(cached ? "host_unreachable" : "subnet_unknown");
  }

  const found = await deps.probeSubnet(subnet, port, ourIdentity, expectedRemoteHex);
  if (!found) throw new Error("host_unreachable");

  const session = await deps.openSession(found, ourIdentity, expectedRemoteHex);
  await setLastKnownIp(expectedRemoteHex, found.ip).catch(() => undefined);
  return session;
}

function hexToBytesLocal(hex: string): Uint8Array {
  const out = new Uint8Array(hex.length / 2);
  for (let i = 0; i < out.length; i++) {
    out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
  }
  return out;
}