import { Effect } from "effect";

import type { ArtifactStore } from "../seams/artifact-store";
import type { ScopeDb } from "../seams/scope-db";
import type { ToolSandbox } from "../seams/tool-sandbox";
import type { LiveChannel } from "../seams/live-channel";
import type { DurableSteps, WorkflowRunner, RunView, StepView } from "../seams/workflow-runner";
import { publish as runPublish, type PublishOutput } from "../pipeline/publish";
import { PublishError } from "../pipeline/discover";
import type { AppDescriptor, ToolDescriptor, WorkflowDescriptor } from "../pipeline/descriptor";
import { bundleEntry } from "../pipeline/bundle";
import {
  buildBridge,
  rootsFor,
  type Bindings,
  type ClientResolver,
  BindingError,
} from "./bindings";
import type { AppsStore } from "./store";

// ---------------------------------------------------------------------------
// AppsRuntime — the substrate-neutral core of the apps subsystem. It owns the
// five seams + the store, and exposes the operations every surface (HTTP, MCP,
// the plugin) drives: publish, resolveTools (descriptor projection), invokeTool
// (bundle -> sandbox invoke with bound clients), and the workflow lifecycle
// (start/signal/status/history) with real journal replay + scheduling.
//
// Nothing here knows about HTTP or MCP; those are thin adapters over this.
// ---------------------------------------------------------------------------

export interface AppsRuntimeDeps {
  readonly artifactStore: ArtifactStore;
  readonly scopeDb: ScopeDb;
  readonly sandbox: ToolSandbox;
  readonly workflows: WorkflowRunner;
  readonly liveChannel: LiveChannel;
  readonly store: AppsStore;
  /** Routes a bound integration method call to the real API (policy/audit). */
  readonly resolver: ClientResolver;
}

export interface AppsRuntime {
  readonly publish: (input: {
    readonly scope: string;
    readonly files: ReadonlyMap<string, string>;
    readonly message?: string;
  }) => Effect.Effect<PublishOutput, PublishError>;
  readonly getDescriptor: (scope: string) => Effect.Effect<AppDescriptor | null>;
  readonly invokeTool: (input: {
    readonly scope: string;
    readonly tool: string;
    readonly args: unknown;
    readonly bindings: Bindings;
  }) => Effect.Effect<unknown, PublishError | BindingError>;
  readonly startWorkflow: (input: {
    readonly scope: string;
    readonly workflow: string;
    readonly input?: unknown;
    readonly bindings?: Bindings;
    readonly runId?: string;
  }) => Effect.Effect<RunView, PublishError | BindingError>;
  readonly signalWorkflow: (input: {
    readonly scope: string;
    readonly runId: string;
    readonly event: string;
    readonly payload: unknown;
  }) => Effect.Effect<RunView, PublishError | BindingError>;
  readonly getRun: (runId: string) => Effect.Effect<RunView | null>;
  readonly listRuns: (scope: string) => Effect.Effect<readonly RunView[]>;
  readonly listSteps: (runId: string) => Effect.Effect<readonly StepView[]>;
  /** Serve a ui bundle by name (raw endpoint / MCP resource). */
  readonly getUiBundle: (
    scope: string,
    name: string,
  ) => Effect.Effect<{ code: string; title?: string; maxHeight?: number } | null>;
  /** Subscribe to a scope's live invalidations (SSE adapter drives this). */
  readonly subscribeLive: (
    scope: string,
    listener: (event: { table: string; version: number }) => void,
  ) => () => void;
  readonly deps: AppsRuntimeDeps;
}

const failNoDescriptor = (scope: string): PublishError =>
  new PublishError({
    message: `scope "${scope}" has no published app`,
    stage: "project",
    diagnostics: [],
  });

export const makeAppsRuntime = (deps: AppsRuntimeDeps): AppsRuntime => {
  // Bundle cache keyed by (snapshot, sourcePath): a published snapshot is
  // immutable, so its bundles never change.
  const bundleCache = new Map<string, string>();

  const bundleFor = (
    descriptor: AppDescriptor,
    sourcePath: string,
  ): Effect.Effect<string, PublishError> =>
    Effect.gen(function* () {
      const cacheKey = `${descriptor.snapshotId}:${sourcePath}`;
      const cached = bundleCache.get(cacheKey);
      if (cached) return cached;
      const scopeStore = yield* deps.artifactStore
        .forScope(descriptor.scope)
        .pipe(
          Effect.mapError(
            (c) => new PublishError({ message: c.message, stage: "project", diagnostics: [] }),
          ),
        );
      const files = yield* scopeStore
        .read(descriptor.snapshotId as never)
        .pipe(
          Effect.mapError(
            (c) => new PublishError({ message: c.message, stage: "project", diagnostics: [] }),
          ),
        );
      const bundle = yield* bundleEntry({ files, entry: sourcePath }).pipe(
        Effect.mapError(
          (c) =>
            new PublishError({
              message: c.message,
              stage: "bundle",
              diagnostics: [{ path: sourcePath, message: c.message }],
            }),
        ),
      );
      bundleCache.set(cacheKey, bundle.code);
      return bundle.code;
    });

  const requireDescriptor = (scope: string): Effect.Effect<AppDescriptor, PublishError> =>
    deps.store.getDescriptor(scope).pipe(
      Effect.mapError(
        (c) => new PublishError({ message: String(c), stage: "project", diagnostics: [] }),
      ),
      Effect.flatMap((d) => (d ? Effect.succeed(d) : Effect.fail(failNoDescriptor(scope)))),
    );

  const invokeToolInternal = (
    scope: string,
    descriptor: AppDescriptor,
    toolDesc: ToolDescriptor,
    args: unknown,
    bindings: Bindings,
  ): Effect.Effect<unknown, PublishError | BindingError> =>
    Effect.gen(function* () {
      const roots = yield* rootsFor(toolDesc.connections, bindings);
      const code = yield* bundleFor(descriptor, toolDesc.sourcePath);
      const db = yield* deps.scopeDb
        .forScope(scope)
        .pipe(
          Effect.mapError(
            (c) => new PublishError({ message: c.message, stage: "project", diagnostics: [] }),
          ),
        );
      const bridge = buildBridge({
        declared: toolDesc.connections,
        bindings,
        db,
        resolver: deps.resolver,
      });
      const result = yield* deps.sandbox
        .invoke(code, { artifact: toolDesc.name, kind: "tool", input: args, roots }, bridge)
        .pipe(
          Effect.mapError(
            (c) =>
              new PublishError({
                message: c.message,
                stage: "project",
                diagnostics: [{ path: toolDesc.sourcePath, message: c.message }],
              }),
          ),
        );
      return result.output;
    });

  // Build the workflow body closure for one run: replay the workflow's compiled
  // bundle over the DurableSteps. Our sandbox runs a tool handler, not a
  // long-lived stepful body, so we drive the workflow with a thin interpreter:
  // the workflow's `run(step, {db})` is executed in-process against the
  // DurableSteps facade, with `step.tool` -> the runner bindings and
  // `db.sql` -> the scope db. This keeps CF semantics while the durable journal
  // lives in the WorkflowRunner seam.
  const workflowBody = (
    scope: string,
    descriptor: AppDescriptor,
    wfDesc: WorkflowDescriptor,
  ): ((steps: DurableSteps) => Promise<unknown>) => {
    return async (steps: DurableSteps) => {
      const code = await Effect.runPromise(
        bundleFor(descriptor, wfDesc.sourcePath).pipe(Effect.orDie),
      );
      const db = await Effect.runPromise(deps.scopeDb.forScope(scope).pipe(Effect.orDie));
      // Interpret the workflow: run its bundle in the sandbox is not how durable
      // steps work (the body must call back into our journaled `steps`). Instead
      // we evaluate the workflow module here and invoke its `run(step, {db})`.
      // The compiled bundle sets globalThis.__artifact = the workflow def.
      const def = extractWorkflowDef(code);
      const scopeDbClient = {
        sql: (strings: TemplateStringsArray, ...values: unknown[]) =>
          Effect.runPromise(db.sql(strings, ...values).pipe(Effect.orDie)),
      };
      return def.run(steps, { db: scopeDbClient });
    };
  };

  const bindingsForRunTool = (
    scope: string,
    descriptor: AppDescriptor,
    recordedBindings: Bindings,
  ) => ({
    runTool: async (address: string, toolArgs: unknown) => {
      const toolDesc = descriptor.tools.find((t) => t.name === address);
      if (!toolDesc) throw new Error(`workflow step.tool: unknown tool "${address}"`);
      return Effect.runPromise(
        invokeToolInternal(scope, descriptor, toolDesc, toolArgs, recordedBindings).pipe(
          Effect.orDie,
        ),
      );
    },
    notify: async (_msg: { title: string; body?: string; link?: string }) => {
      // Self-host delivery sink: recorded as a journaled step; a real host wires
      // this to notifications. No-op body here keeps the workflow durable.
    },
  });

  return {
    deps,
    publish: (input) =>
      Effect.gen(function* () {
        const out = yield* runPublish(
          {
            artifactStore: deps.artifactStore,
            sandbox: deps.sandbox,
            putBlob: (hash, value) =>
              deps.store
                .putBlob(hash, value)
                .pipe(
                  Effect.mapError(
                    (c) =>
                      new PublishError({ message: String(c), stage: "project", diagnostics: [] }),
                  ),
                ),
          },
          { scope: input.scope, files: input.files, commitMessage: input.message },
        );
        yield* deps.store
          .putDescriptor("org", out.descriptor)
          .pipe(
            Effect.mapError(
              (c) => new PublishError({ message: String(c), stage: "project", diagnostics: [] }),
            ),
          );
        return out;
      }),

    getDescriptor: (scope) =>
      deps.store.getDescriptor(scope).pipe(Effect.orElseSucceed(() => null)),

    invokeTool: (input) =>
      Effect.gen(function* () {
        const descriptor = yield* requireDescriptor(input.scope);
        const toolDesc = descriptor.tools.find((t) => t.name === input.tool);
        if (!toolDesc) {
          return yield* Effect.fail(
            new PublishError({
              message: `tool "${input.tool}" is not published in scope "${input.scope}"`,
              stage: "project",
              diagnostics: [],
            }),
          );
        }
        return yield* invokeToolInternal(
          input.scope,
          descriptor,
          toolDesc,
          input.args,
          input.bindings,
        );
      }),

    startWorkflow: (input) =>
      Effect.gen(function* () {
        const descriptor = yield* requireDescriptor(input.scope);
        const wfDesc = descriptor.workflows.find((w) => w.name === input.workflow);
        if (!wfDesc) {
          return yield* Effect.fail(
            new PublishError({
              message: `workflow "${input.workflow}" is not published in scope "${input.scope}"`,
              stage: "project",
              diagnostics: [],
            }),
          );
        }
        const bindings = input.bindings ?? {};
        const body = workflowBody(input.scope, descriptor, wfDesc);
        return yield* deps.workflows
          .start(
            {
              scope: input.scope,
              workflow: input.workflow,
              snapshotId: descriptor.snapshotId,
              input: input.input ?? {},
              runId: input.runId,
            },
            body,
            bindingsForRunTool(input.scope, descriptor, bindings),
          )
          .pipe(
            Effect.mapError(
              (c) => new PublishError({ message: c.message, stage: "project", diagnostics: [] }),
            ),
          );
      }),

    signalWorkflow: (input) =>
      Effect.gen(function* () {
        const run = yield* deps.workflows
          .get(input.runId)
          .pipe(
            Effect.mapError(
              (c) => new PublishError({ message: c.message, stage: "project", diagnostics: [] }),
            ),
          );
        if (!run) {
          return yield* Effect.fail(
            new PublishError({
              message: `no run ${input.runId}`,
              stage: "project",
              diagnostics: [],
            }),
          );
        }
        const descriptor = yield* requireDescriptor(run.scope);
        const wfDesc = descriptor.workflows.find((w) => w.name === run.workflow);
        if (!wfDesc) {
          return yield* Effect.fail(
            new PublishError({
              message: `workflow ${run.workflow} gone`,
              stage: "project",
              diagnostics: [],
            }),
          );
        }
        const body = workflowBody(run.scope, descriptor, wfDesc);
        return yield* deps.workflows
          .signal(
            input.runId,
            input.event,
            input.payload,
            body,
            bindingsForRunTool(run.scope, descriptor, {}),
          )
          .pipe(
            Effect.mapError(
              (c) => new PublishError({ message: c.message, stage: "project", diagnostics: [] }),
            ),
          );
      }),

    getRun: (runId) => deps.workflows.get(runId).pipe(Effect.orElseSucceed(() => null)),
    listRuns: (scope) =>
      deps.workflows.list({ scope }).pipe(Effect.orElseSucceed(() => [] as readonly RunView[])),
    listSteps: (runId) =>
      deps.workflows.listSteps(runId).pipe(Effect.orElseSucceed(() => [] as readonly StepView[])),

    getUiBundle: (scope, name) =>
      Effect.gen(function* () {
        const descriptor = yield* deps.store
          .getDescriptor(scope)
          .pipe(Effect.orElseSucceed(() => null));
        if (!descriptor) return null;
        const uiDesc = descriptor.ui.find((u) => u.name === name);
        if (!uiDesc) return null;
        const code = yield* deps.store
          .getBlob(`ui/${uiDesc.bundleHash}`)
          .pipe(Effect.orElseSucceed(() => null));
        if (!code) return null;
        return { code, title: uiDesc.title, maxHeight: uiDesc.maxHeight };
      }),

    subscribeLive: (scope, listener) =>
      deps.liveChannel.subscribe(scope, (event) =>
        listener({ table: event.table, version: event.version }),
      ),
  };
};

// Extract the workflow def from a compiled bundle by running it in a tiny
// module shim (Node-side, trusted: this is our own runtime, not user isolation
// for the durable interpreter — the tool HANDLERS still run in the sandbox).
// The bundle set globalThis.__artifact to the workflow def object.
const extractWorkflowDef = (
  code: string,
): { run: (steps: DurableSteps, deps: { db: unknown }) => Promise<unknown> } => {
  const g: Record<string, unknown> = {};
  const shim = {
    connection: (integration: string, opts?: { description?: string }) => ({
      __decl: "single",
      integration,
      description: opts?.description,
    }),
    connections: (integration: string) => ({ __decl: "array", integration }),
    catalog: () => ({ __decl: "catalog" }),
    defineTool: (def: unknown) => {
      g.__artifact = def;
      return def;
    },
    defineWorkflow: (def: unknown) => {
      g.__artifact = def;
      return def;
    },
  };
  const req = (id: string) => {
    if (id === "executor:app") return shim;
    if (id === "executor:ui") return {};
    if (id === "executor:ui/components") return {};
    throw new Error(`module not available: ${id}`);
  };
  const moduleObj = { exports: {} as Record<string, unknown> };
  const globalThisShim = g as unknown as typeof globalThis;
  // eslint-disable-next-line @typescript-eslint/no-implied-eval, no-new-func
  const factory = new Function("module", "exports", "require", "globalThis", code);
  factory(moduleObj, moduleObj.exports, req, globalThisShim);
  const def = (g.__artifact ?? moduleObj.exports.default ?? moduleObj.exports) as {
    run: (steps: DurableSteps, deps: { db: unknown }) => Promise<unknown>;
  };
  if (!def || typeof def.run !== "function") {
    throw new Error("workflow bundle did not produce a run() function");
  }
  return def;
};