/* oxlint-disable executor/no-try-catch-or-throw, executor/no-error-constructor, executor/no-instanceof-tagged-error -- boundary: filesystem path validation and fs errors normalize to AppSourceError */
import { createHash } from "node:crypto";
import { constants } from "node:fs";
import { lstat, open, readdir, realpath } from "node:fs/promises";
import { isAbsolute, resolve, sep } from "node:path";

import { Effect, Schema } from "effect";

import { PublishError, enforcePublishLimits, type PublishFile } from "../pipeline/publish";
import { AppSourceError, type AppSourceSnapshot } from "./app-source";
import {
  classifyAppSourcePath,
  isRelevantAppSourcePath,
  type SourceSkippedFile,
} from "./relevant-files";

export interface LocalDirectoryAppSourceInput {
  readonly path: string;
}

export interface LocalDirectoryAppSourceSnapshot extends AppSourceSnapshot {
  readonly root: string;
  readonly skipped: readonly SourceSkippedFile[];
}

const sha256 = (bytes: Uint8Array | string): string =>
  createHash("sha256").update(bytes).digest("hex");

const validateRoot = (path: string): Effect.Effect<string, AppSourceError> =>
  Effect.try({
    try: () => {
      if (!isAbsolute(path)) {
        throw new AppSourceError({ message: "local-directory source path must be absolute", path });
      }
      const parts = path.split(/[\\/]+/);
      if (parts.includes("..")) {
        throw new AppSourceError({
          message: "local-directory source path must not contain ..",
          path,
        });
      }
      return resolve(path);
    },
    catch: (cause) =>
      cause instanceof AppSourceError
        ? cause
        : new AppSourceError({ message: "invalid local-directory source path", path, cause }),
  });

const isUnderRoot = (root: string, candidate: string): boolean =>
  candidate === root || candidate.startsWith(`${root}${sep}`);

const readRegularFileNoFollow = (
  root: string,
  rootReal: string,
  child: string,
): Effect.Effect<Uint8Array, AppSourceError> =>
  Effect.tryPromise({
    try: async () => {
      const fullPath = `${root}${sep}${child}`;
      const before = await lstat(fullPath);
      if (!before.isFile()) throw new Error("not a regular file");
      const resolved = await realpath(fullPath);
      if (!isUnderRoot(rootReal, resolved)) throw new Error("file resolves outside source root");
      const handle = await open(fullPath, constants.O_RDONLY | constants.O_NOFOLLOW);
      try {
        const after = await handle.stat();
        if (!after.isFile()) throw new Error("not a regular file");
        if (before.dev !== after.dev || before.ino !== after.ino) {
          throw new Error("file changed while being read");
        }
        return await handle.readFile();
      } finally {
        await handle.close();
      }
    },
    catch: (cause) =>
      new AppSourceError({
        message: `failed to read local-directory file: ${child}`,
        path: child,
        cause,
      }),
  });

const walk = (
  root: string,
  rootReal: string,
  relative = "",
): Effect.Effect<
  { readonly files: readonly PublishFile[]; readonly skipped: readonly SourceSkippedFile[] },
  AppSourceError | PublishError
> =>
  Effect.gen(function* () {
    const dir = relative ? `${root}${sep}${relative}` : root;
    const entries = yield* Effect.tryPromise({
      try: () => readdir(dir, { withFileTypes: true }),
      catch: (cause) =>
        new AppSourceError({
          message: `failed to read local-directory source: ${relative || root}`,
          path: relative || root,
          cause,
        }),
    });
    const files: PublishFile[] = [];
    const skipped: SourceSkippedFile[] = [];
    for (const entry of entries) {
      const child = relative ? `${relative}/${entry.name}` : entry.name;
      if (entry.isSymbolicLink()) {
        skipped.push({ path: child, reason: "unsupported file type" });
        continue;
      }
      if (entry.isDirectory()) {
        if (
          child === "tools" ||
          child === "workflows" ||
          child === "ui" ||
          child === "skills" ||
          child.startsWith("tools/") ||
          child.startsWith("workflows/") ||
          child.startsWith("ui/") ||
          child.startsWith("skills/")
        ) {
          const nested = yield* walk(root, rootReal, child);
          files.push(...nested.files);
          skipped.push(...nested.skipped);
        }
        continue;
      }
      if (!entry.isFile()) {
        skipped.push({ path: child, reason: "unsupported file type" });
        continue;
      }
      const classified = classifyAppSourcePath(child);
      if (classified !== "fetch") {
        skipped.push(classified);
        continue;
      }
      if (!isRelevantAppSourcePath(child)) continue;
      const bytes = yield* readRegularFileNoFollow(root, rootReal, child);
      files.push({ path: child, bytes });
    }
    const limitError = enforcePublishLimits(files);
    if (limitError) return yield* limitError;
    return { files, skipped };
  });

const sourceRefFor = (files: readonly PublishFile[]): string => {
  const manifest = files
    .map((file) => `${file.path}:${sha256(file.bytes)}`)
    .sort()
    .join("\n");
  return sha256(manifest);
};

const decodeExecutorJson = Schema.decodeUnknownEffect(Schema.UnknownFromJsonString);

const descriptionFor = (
  files: readonly PublishFile[],
): Effect.Effect<string | undefined, AppSourceError> =>
  Effect.gen(function* () {
    const file = files.find((item) => item.path === "executor.json");
    if (!file) return undefined;
    const parsed = yield* decodeExecutorJson(new TextDecoder().decode(file.bytes)).pipe(
      Effect.mapError(
        (cause) =>
          new AppSourceError({
            message: "executor.json is not valid JSON",
            path: "executor.json",
            cause,
          }),
      ),
    );
    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return undefined;
    const description = (parsed as { readonly description?: unknown }).description;
    return typeof description === "string" ? description : undefined;
  });

export const fetchLocalDirectoryAppSource = (
  input: LocalDirectoryAppSourceInput,
): Effect.Effect<LocalDirectoryAppSourceSnapshot, AppSourceError | PublishError> =>
  Effect.gen(function* () {
    const root = yield* validateRoot(input.path);
    const rootReal = yield* Effect.tryPromise({
      try: () => realpath(root),
      catch: (cause) =>
        new AppSourceError({
          message: "failed to resolve local-directory source root",
          path: root,
          cause,
        }),
    });
    const collected = yield* walk(root, rootReal);
    return {
      root,
      files: collected.files,
      sourceRef: sourceRefFor(collected.files),
      description: yield* descriptionFor(collected.files),
      skipped: collected.skipped,
    };
  });

export const makeLocalDirectoryAppSource = (input: LocalDirectoryAppSourceInput) => ({
  fetch: () => fetchLocalDirectoryAppSource(input),
});