// Production sync runner — composes the live vault adapter, WebSocket
// transport, and coordinator into the function the dispatcher injects via
// `setSyncRunner`. The runner is responsible for opening one Noise KK
// session against a single paired device, driving the sync protocol, and
// surfacing a `SyncRunResult` (or throwing on failure). The dispatcher in
// sync-trigger.ts iterates over hosts and aggregates results.
//
// Connection strategy:
//   1. Try `getLastKnownIp(deviceLongTermPubkey)` if cached — fast path.
//   2. Fall back to `probeSubnetForPeer` over the local /24. The subnet
//      probe is itself rate-limited (60s per-pubkey cooldown) inside the
//      transport, so we don't add another layer here.
//   3. On a successful session, persist the IP we connected on so the next
//      sync round skips the probe.
//
// We do NOT verify vault_id here — the coordinator's SYNC_HELLO exchange
// does that (returns `status: "vault_mismatch"` if the peer holds a
// different vault). The runner just translates the coordinator's outcome
// into the throw-or-return contract the dispatcher expects.

import { runSyncInitiator, type SyncVaultAdapter } from "./sync-coordinator";
import { createSyncVaultAdapter } from "./sync-vault-adapter";
import {
  getLastKnownIp,
  setLastKnownIp,
} from "./paired-devices";
import {
  openSyncSession,
  probeSubnetForPeer,
  type ProbedSyncEndpoint,
  type SyncSession,
  type SyncEndpoint,
  type SyncPeerIdentity,
} from "../shared/sync-transport";
import { hexToPubkey } from "../shared/sync-identity";
import { getLocalSubnet } from "../shared/local-network";
import { buildLocalIdentity, deriveLocalSyncKeypair } from "./device-identity";
import { PAIRING_PORT } from "../shared/pairing-dial";
import { getRootKeyHex, isUnlocked } from "./vault";
import type { PairedDevice } from "../shared/sync-types";
import type { SyncRunResult } from "./sync-trigger";
import {
  dialingRendezvousIds,
  rendezvousSecretFromHex,
} from "../shared/rendezvous";

/** Same fixed port pairing dials — SyncReconnectListener.SYNC_PORT on Android. */
const DEFAULT_PORT = PAIRING_PORT;

/**
 * Test/injection seam. Production wires in the real `openSyncSession`;
 * unit tests inject a fake to avoid real WebSocket + Noise KK.
 */
export interface SyncRunnerDeps {
  openSession: (
    endpoint: SyncEndpoint,
    ourIdentity: SyncPeerIdentity,
    expectedRemoteHex: string,
    rendezvousId: string,
  ) => Promise<SyncSession>;
  probeSubnet: (
    subnet: string,
    port: number,
    ourIdentity: SyncPeerIdentity,
    expectedRemoteHex: string,
    rendezvousIds: readonly string[],
  ) => Promise<ProbedSyncEndpoint | null>;
  getSubnet: () => Promise<string | null>;
  createAdapter: (context?: { deviceName?: string }) => SyncVaultAdapter;
}

const productionDeps: SyncRunnerDeps = {
  openSession: (endpoint, identity, expected, rendezvousId) =>
    openSyncSession(endpoint, identity, expected, rendezvousId),
  probeSubnet: (subnet, port, identity, expected, rendezvousIds) =>
    probeSubnetForPeer(subnet, port, identity, expected, rendezvousIds),
  getSubnet: getLocalSubnet,
  createAdapter: (context) => createSyncVaultAdapter(context),
};

export async function productionSyncRunner(device: PairedDevice): Promise<SyncRunResult> {
  return runWithDeps(device, productionDeps);
}

/**
 * Inner runner with explicit deps — exported so tests can inject fakes.
 */
export async function runWithDeps(
  device: PairedDevice,
  deps: SyncRunnerDeps,
): Promise<SyncRunResult> {
  if (!isUnlocked()) return { ok: false, error: "VAULT_LOCKED" };
  if (!device.longTermPublicKeyHex) {
    throw new Error("paired_device_missing_pubkey");
  }
  if (!device.rendezvousSecretHex) {
    throw new Error("paired_device_missing_rendezvous_secret");
  }
  const expectedRemoteHex = device.longTermPublicKeyHex;
  const reconnectIds = dialingRendezvousIds(
    rendezvousSecretFromHex(device.rendezvousSecretHex),
    Date.now() / 1000,
  );
  const port = device.wsPort ?? DEFAULT_PORT;

  // Sync identity derives from the stable root key, not the password-derived
  // key. Reconnect uses both halves directly in standard Noise KK.
  const masterKeyHex = getRootKeyHex();
  if (!masterKeyHex) return { ok: false, error: "VAULT_LOCKED" };
  const masterKey = hexToBytesLocal(masterKeyHex);
  const publicIdentity = await buildLocalIdentity(masterKey);
  const localKeys = deriveLocalSyncKeypair(masterKey, publicIdentity.deviceId);
  if (publicIdentity.longTermPublicKeyHex !== bytesToHex(localKeys.publicKey)) {
    masterKey.fill(0);
    localKeys.secretKey.fill(0);
    throw new Error("derived reconnect identity mismatch");
  }
  const ourIdentity: SyncPeerIdentity = {
    ...publicIdentity,
    longTermPrivateKey: localKeys.secretKey,
  };

  // Sanity — the remote pubkey must be 32-byte hex so noise can compare it.
  void hexToPubkey(expectedRemoteHex);

  // HV-1b: pass the peer being synced so remote-mutation alerts can name it.
  const adapter = deps.createAdapter({ deviceName: device.deviceName });
  let session: SyncSession;
  try {
    session = await connect(expectedRemoteHex, port, ourIdentity, reconnectIds, deps);
  } finally {
    masterKey.fill(0);
    localKeys.secretKey.fill(0);
  }

  try {
    const outcome = await runSyncInitiator(session, adapter);
    if (outcome.status === "completed") {
      return {
        ok: true,
        entriesReceived: outcome.entriesReceived,
        entriesSent: outcome.entriesSent,
      };
    }
    if (outcome.status === "vault_mismatch") {
      throw new Error("vault_id_mismatch");
    }
    if (outcome.status === "timeout") {
      throw new Error("sync_timeout");
    }
    throw new Error(outcome.error ?? "sync_errored");
  } finally {
    // The coordinator does NOT close the session (it returns and leaves the
    // session open). This runner is the sole owner of session lifetime.
    await session.close().catch(() => undefined);
  }
}

async function connect(
  expectedRemoteHex: string,
  port: number,
  ourIdentity: SyncPeerIdentity,
  rendezvousIds: string[],
  deps: SyncRunnerDeps,
): Promise<SyncSession> {
  const cached = await getLastKnownIp(expectedRemoteHex);
  if (cached) {
    for (const rendezvousId of rendezvousIds) {
      try {
        const session = await deps.openSession(
          { ip: cached, port },
          ourIdentity,
          expectedRemoteHex,
          rendezvousId,
        );
        return session;
      } catch {
        // Try the next clock-skew window before treating the IP as stale.
      }
    }
  }

  const subnet = await deps.getSubnet();
  if (!subnet) {
    throw new Error(cached ? "host_unreachable" : "subnet_unknown");
  }

  const found = await deps.probeSubnet(
    subnet,
    port,
    ourIdentity,
    expectedRemoteHex,
    rendezvousIds,
  );
  if (!found) throw new Error("host_unreachable");
  const session = await deps.openSession(
    { ip: found.ip, port: found.port },
    ourIdentity,
    expectedRemoteHex,
    found.rendezvousId,
  );
  await setLastKnownIp(expectedRemoteHex, found.ip).catch(() => undefined);
  return session;
}

function hexToBytesLocal(hex: string): Uint8Array {
  const out = new Uint8Array(hex.length / 2);
  for (let i = 0; i < out.length; i++) {
    out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
  }
  return out;
}

function bytesToHex(bytes: Uint8Array): string {
  return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
}