// ---------------------------------------------------------------------------
// Stable Sentry grouping across deploys.
//
// Every bundle we ship names its chunks `<name>-<contentHash>.js`, and the
// hash rotates on every build. When a stack frame is not resolved back to
// source (no uploaded sourcemap for that release), Sentry groups on those
// minified names, so the SAME error opens a brand-new issue after each
// deploy — one bug spread over N issues, no counts, no regression history.
//
// The fix is a `beforeSend` that computes an explicit `fingerprint` from the
// event's grouping inputs with the volatile hash segment removed. The event
// itself is left untouched: filenames still carry their hashes so server-side
// sourcemap resolution keeps working — only the grouping key is normalized.
//
// Deliberately narrow: a fingerprint is returned ONLY for events that actually
// carry a content hash. Everything else keeps Sentry's default grouping.
// ---------------------------------------------------------------------------

/** The shape of a Sentry stack frame this module reads. Structural on purpose:
 * the same helper serves @sentry/cloudflare, /electron and /browser events. */
export type GroupingFrame = {
  readonly filename?: string | undefined;
  readonly abs_path?: string | undefined;
  readonly module?: string | undefined;
  readonly function?: string | undefined;
  readonly in_app?: boolean | undefined;
};

export type GroupingExceptionValue = {
  readonly type?: string | undefined;
  readonly value?: string | undefined;
  readonly stacktrace?: { readonly frames?: readonly GroupingFrame[] | undefined } | undefined;
  readonly mechanism?: { readonly type?: string | undefined } | undefined;
};

export type GroupingEvent = {
  readonly culprit?: string | undefined;
  readonly exception?: { readonly values?: readonly GroupingExceptionValue[] | undefined };
};

/**
 * A `-XXXXXXXX` tail that ends a path segment — i.e. is followed by nothing,
 * by file extensions, or by a delimiter such as the `)` in a Sentry culprit
 * (`orElse(execution-rate-limit-BAuwphPA)`). Eight characters is the Vite and
 * Rollup default; the hash alphabet includes `-` and `_`, so a hash can itself
 * contain a dash (`BCr-oWx4`) and the whole 8-char tail must go at once.
 */
const HASH_TAIL = /-([A-Za-z0-9_-]{8})(?=(?:\.[A-Za-z0-9]+)*(?:$|[)\]}'"\s,:;?#]))/g;

/**
 * Whether an 8-character segment reads like a content hash rather than a word.
 * Build hashes are random base64url, so they mix cases and digits; real name
 * segments (`callback`, `grouping`, `provider`) are all lowercase. Requiring
 * that mix is what keeps `oauth-callback` from collapsing to `oauth`. The cost
 * is that the occasional word-shaped hash (one capital, no digits) is left
 * alone and keeps re-grouping — 1 of 147 chunks in a sample desktop build. A
 * missed normalization is recoverable; a wrongly merged issue is not.
 */
const looksLikeContentHash = (segment: string): boolean => {
  let upper = 0;
  let digits = 0;
  for (const char of segment) {
    if (char >= "A" && char <= "Z") upper += 1;
    else if (char >= "0" && char <= "9") digits += 1;
  }
  return upper >= 2 || (upper >= 1 && digits >= 1) || digits >= 2;
};

/**
 * Remove build content hashes from a path, module name or culprit string,
 * leaving every other character in place.
 */
export const stripContentHashes = (value: string): string =>
  value.replace(HASH_TAIL, (match, segment: string) =>
    looksLikeContentHash(segment) ? "" : match,
  );

/** True when the value carries at least one build content hash. */
export const containsContentHash = (value: string): boolean => stripContentHashes(value) !== value;

/**
 * Minified identifiers rotate with every build exactly like chunk hashes, so a
 * fingerprint containing one is no more stable than the hash it replaced. Names
 * of three characters or fewer are treated as minified and dropped; the frame
 * still contributes its module.
 */
const MINIFIED_FUNCTION = /^[A-Za-z_$][A-Za-z0-9_$]{0,2}$/;

const usableFunction = (name: string | undefined): string | undefined => {
  if (!name || name === "<anonymous>" || name === "?") return undefined;
  return MINIFIED_FUNCTION.test(name) ? undefined : name;
};

/** Last path segment, without query or fragment. Chunk paths are served from
 * host- and port-specific origins (`http://127.0.0.1:4789/assets/…`), which are
 * volatile in their own right. */
const basename = (path: string): string => {
  const clean = path.split(/[?#]/)[0] ?? path;
  const segments = clean.split(/[/\\]/);
  return segments[segments.length - 1] || clean;
};

const frameLocation = (frame: GroupingFrame): string | undefined => {
  if (frame.module) return stripContentHashes(frame.module);
  const path = frame.filename ?? frame.abs_path;
  return path ? stripContentHashes(basename(path)) : undefined;
};

const frameKey = (frame: GroupingFrame): string | undefined => {
  const location = frameLocation(frame);
  if (!location) return undefined;
  const fn = usableFunction(frame.function);
  return fn ? `${fn}@${location}` : location;
};

const frameHasContentHash = (frame: GroupingFrame): boolean =>
  containsContentHash(frame.module ?? "") ||
  containsContentHash(frame.filename ?? "") ||
  containsContentHash(frame.abs_path ?? "");

/**
 * How many frames from the top of the stack enter the fingerprint. Bundlers
 * emit several unrelated chunks under the same name (nine different
 * `dist-<hash>.js` in one desktop build), so the top frame alone would merge
 * unrelated vendor code; the caller chain is what keeps them apart. The
 * resulting key is still strictly coarser than Sentry's default input — same
 * frames, minus the volatile hash and minified identifiers — so this can only
 * merge issues, never split one further.
 */
const FINGERPRINT_FRAMES = 8;

/**
 * A deploy-stable fingerprint for an event whose grouping input carries a build
 * content hash, or `undefined` to leave Sentry's default grouping in place.
 */
export const stableGroupingFingerprint = (event: GroupingEvent): readonly string[] | undefined => {
  const values = event.exception?.values ?? [];
  // Sentry orders chained exceptions innermost-first; the last entry is the one
  // the issue is titled with.
  const primary = values[values.length - 1];
  if (!primary) return undefined;

  const frames = primary.stacktrace?.frames ?? [];
  const culprit = event.culprit ?? "";
  if (!frames.some(frameHasContentHash) && !containsContentHash(culprit)) return undefined;

  const inApp = frames.filter((frame) => frame.in_app !== false);
  const considered = (inApp.length > 0 ? inApp : frames).slice(-FINGERPRINT_FRAMES).reverse();
  const keys = considered.flatMap((frame) => {
    const key = frameKey(frame);
    return key ? [key] : [];
  });

  const type = primary.type ?? "Error";
  if (keys.length > 0) return [type, ...keys];
  return culprit ? [type, stripContentHashes(culprit)] : undefined;
};

/**
 * The whole `beforeSend` contract: pin the deploy-stable fingerprint when the
 * event has a volatile grouping input, and forward the event untouched when it
 * does not. Every call site (cloud worker/DO, desktop main, desktop renderer)
 * installs this one symbol rather than its own copy, so the wiring is covered
 * by the tests below instead of being retyped per process.
 */
export const withStableGroupingFingerprint = <T extends GroupingEvent>(event: T): T => {
  const fingerprint = stableGroupingFingerprint(event);
  return fingerprint ? { ...event, fingerprint: [...fingerprint] } : event;
};