// ---------------------------------------------------------------------------
// The per-isolate MCP auth runtime memo, keyed on the bindings it captures.
//
// Cloudflare reuses warm isolates across binding-only deployments, and its
// docs call out exactly the `client ??= new Client(env.SECRET)` pattern as
// retaining stale credentials: a plain `runtime ??= ManagedRuntime.make(...)`
// would keep authenticating with the OLD WorkOS credentials after a
// WORKOS_API_KEY rotation until the isolate happened to be evicted — an auth
// outage once the old key is revoked. So the memo is keyed on a fingerprint
// of exactly the binding values the layer captures at build: same
// fingerprint -> reuse (one string compare per request), changed fingerprint
// -> build fresh. The rebuild also resets the ApiKeyService validation cache
// living inside the layer, which is required — a rotated key must not serve
// cached validations.
//
// The superseded runtime is DROPPED, not disposed. `ManagedRuntime.dispose`
// tears down the runtime's scope, and requests already in flight may still be
// running programs against the old runtime's services — pulling the scope out
// from under them is not safe. Nothing is leaked by dropping: the MCP auth
// layer registers no finalizers (the WorkOS client is plain config; the
// org-auth postgres socket is built and closed per `authorize` call), so an
// unreferenced runtime is simply GC'd once the last in-flight request
// finishes. Rotations only happen on deploys, and at most one previous
// runtime is ever still referenced by in-flight work.
//
// This lives in its own `cloudflare:workers`-free leaf so the node-pool unit
// tests can exercise the rebuild semantics; agent-handler.ts is the one
// production consumer.
// ---------------------------------------------------------------------------

import type { ManagedRuntime } from "effect";

/** The env subset the MCP auth layer reads at build time. */
export type McpAuthBindings = Pick<
  Env,
  "WORKOS_API_KEY" | "WORKOS_CLIENT_ID" | "WORKOS_COOKIE_PASSWORD" | "WORKOS_API_URL"
>;

/**
 * The exact binding values `cloudMcpAuth` captures when its runtime is built —
 * `WorkOSClient`'s `make` (auth/workos.ts) reads precisely these four. A
 * joined string is enough to answer "did any of them change"; it CONTAINS the
 * live WORKOS_API_KEY, so it must never reach a log, span, or error message.
 * `WORKOS_API_URL` is genuinely optional (unset in production), so absence is
 * encoded as the empty string — the same "no override" the client resolves it
 * to (see `workosApiUrlOptions`).
 *
 * JSON-encoded rather than delimiter-joined: bindings may contain any byte
 * (workerd Text permits embedded NUL), so a raw join is not injective — a
 * delimiter byte inside one value could make two different binding sets
 * collide and suppress the rebuild a rotation requires. JSON escapes every
 * byte, so distinct value tuples always produce distinct fingerprints.
 *
 * Not included: the module-scope env reads in mcp/auth.ts (AUTHKIT_DOMAIN,
 * RESOURCE_ORIGIN, the JWKS cache, the JWT audience). Those are frozen at the
 * isolate's first module evaluation, so rebuilding the runtime cannot refresh
 * them — keying on them would force rebuilds that change nothing.
 */
export const mcpAuthBindingsFingerprint = (env: McpAuthBindings): string =>
  JSON.stringify([
    env.WORKOS_API_KEY,
    env.WORKOS_CLIENT_ID,
    env.WORKOS_COOKIE_PASSWORD,
    env.WORKOS_API_URL ?? "",
  ]);

/**
 * Memoize one built runtime per fingerprint value (holding only the latest):
 * an unchanged fingerprint returns the existing runtime, a changed one drops
 * it (see the header for why dropping, not disposing, is correct) and builds
 * a fresh runtime via `build`.
 */
export const makeBindingKeyedRuntime = <R, E>(
  build: () => ManagedRuntime.ManagedRuntime<R, E>,
): ((fingerprint: string) => ManagedRuntime.ManagedRuntime<R, E>) => {
  let runtime: ManagedRuntime.ManagedRuntime<R, E> | undefined;
  let fingerprint: string | undefined;
  return (next) => {
    if (runtime === undefined || fingerprint !== next) {
      runtime = build();
      fingerprint = next;
    }
    return runtime;
  };
};