import { defineExecutorConfig } from "@executor-js/sdk";
import { openApiHttpPlugin } from "@executor-js/plugin-openapi/api";
import {
  googleCatalog,
  googleDiscoveryAdapter,
} from "@executor-js/plugin-openapi/providers/google";
import {
  microsoftCatalog,
  microsoftGraphAdapter,
} from "@executor-js/plugin-openapi/providers/microsoft";
import { mcpHttpPlugin } from "@executor-js/plugin-mcp/api";
import { graphqlHttpPlugin } from "@executor-js/plugin-graphql/api";
import {
  makeDynamicWorkerAppToolExecutor,
  makeDynamicWorkerBundlerBackend,
} from "@executor-js/plugin-apps/cloud";
import { appsHttpPlugin } from "@executor-js/plugin-apps/api";
import { workosVaultPlugin, type WorkOSVaultClient } from "@executor-js/plugin-workos-vault";
import { toolkitsPlugin } from "@executor-js/plugin-toolkits/server";

// ---------------------------------------------------------------------------
// Single source of truth for the cloud app's plugin list.
//
// Consumed by:
//   - the host runtime (calls `plugins({ workosCredentials })` per request)
//   - the build/UI tooling (the vite plugin calls `plugins()` no-arg, reads
//     `plugin.packageName` only)
//   - the test harness (calls `plugins({ workosVaultClient })` per test)
// (NOT by schema generation — the executor table set is fixed and
// plugin-independent, see `collectTables()`.)
//
// `TDeps` is inferred directly from the factory parameter annotation —
// no global `declare module "@executor-js/sdk"` augmentation. Each
// caller (runtime / build tooling / tests) passes whatever subset of the deps
// it has; all fields are optional so `plugins({})` keeps working.
//
// Cloud only ships plugins safe to run in a multi-tenant setting — no
// stdio MCP, no keychain/file-secrets/1password.
// ---------------------------------------------------------------------------

interface CloudPluginDeps {
  /** WorkOS vault credentials. Provided per-request from `env.WORKOS_*`
   *  in production; the test harness leaves this undefined and uses
   *  `workosVaultClient` to inject an in-memory fake instead. */
  readonly workosCredentials?: {
    readonly apiKey: string;
    readonly clientId: string;
    /** Optional WorkOS API base-URL override (WorkOS emulator in tests/dev). */
    readonly apiUrl?: string;
  };
  /** Pluggable WorkOS Vault HTTP client — set by the test harness to
   *  bypass the real WorkOS API. Production leaves this undefined and
   *  falls back to the credential-driven default. */
  readonly workosVaultClient?: WorkOSVaultClient;
  readonly activeToolkitSlug?: string;
  /** Mirrors `HostConfig.allowLocalNetwork` (`ALLOW_LOCAL_NETWORK`). Off by
   *  default; production leaves it unset. */
  readonly allowLocalNetwork?: boolean;
  readonly workerLoader?: {
    readonly get: (
      name: string | null,
      factory: () => {
        readonly compatibilityDate: string;
        readonly compatibilityFlags?: readonly string[];
        readonly mainModule: string;
        readonly modules: Readonly<Record<string, string | { readonly wasm: ArrayBuffer }>>;
        readonly globalOutbound?: null;
      },
    ) => { readonly getEntrypoint: () => unknown };
    readonly load?: (code: {
      readonly compatibilityDate: string;
      readonly compatibilityFlags?: readonly string[];
      readonly mainModule: string;
      readonly modules: Readonly<Record<string, string | { readonly wasm: ArrayBuffer }>>;
      readonly globalOutbound?: null;
    }) => { readonly getEntrypoint: () => unknown };
  };
  readonly workerAssets?: {
    readonly fetch: (request: Request) => Promise<Response>;
  };
}

const base64ToArrayBuffer = (value: string): ArrayBuffer => {
  const bytes = Uint8Array.from(atob(value), (char) => char.charCodeAt(0));
  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
};

const assetRequest = (path: string): Request => new Request(new URL(path, "https://assets.local"));

const fetchAsset = async (
  assets: { readonly fetch: (request: Request) => Promise<Response> },
  path: string,
): Promise<Response> => {
  const response = await assets.fetch(assetRequest(path));
  if (!response.ok) {
    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: worker artifact asset fetch must reject the dynamic bundler setup
    throw new Error(`failed to fetch worker-bundler asset ${path}: ${response.status}`);
  }
  return response;
};

export default defineExecutorConfig({
  plugins: ({
    workosCredentials,
    workosVaultClient,
    activeToolkitSlug,
    allowLocalNetwork,
    workerLoader,
    workerAssets,
  }: CloudPluginDeps = {}) =>
    [
      openApiHttpPlugin({
        presets: [...googleCatalog, ...microsoftCatalog],
        specFormats: [googleDiscoveryAdapter, microsoftGraphAdapter],
      }),
      mcpHttpPlugin({
        dangerouslyAllowStdioMCP: false,
      }),
      graphqlHttpPlugin(),
      appsHttpPlugin({
        ...(workerLoader
          ? {
              executor: makeDynamicWorkerAppToolExecutor({ loader: workerLoader }),
              bundler: makeDynamicWorkerBundlerBackend({
                loader: workerLoader,
                artifact: async () => {
                  const artifact = await import("virtual:executor/worker-bundler-artifact");
                  if (artifact.source !== undefined && artifact.wasmBase64 !== undefined) {
                    return {
                      source: artifact.source,
                      wasm: base64ToArrayBuffer(artifact.wasmBase64),
                    };
                  }
                  if (workerAssets === undefined) {
                    // oxlint-disable-next-line executor/no-try-catch-or-throw, executor/no-error-constructor -- boundary: worker artifact asset binding is required for production bundler setup
                    throw new Error("worker-bundler artifact assets binding is unavailable");
                  }
                  const [source, wasm] = await Promise.all([
                    fetchAsset(workerAssets, artifact.sourcePath).then((response) =>
                      response.text(),
                    ),
                    fetchAsset(workerAssets, artifact.wasmPath).then((response) =>
                      response.arrayBuffer(),
                    ),
                  ]);
                  return {
                    source,
                    wasm,
                  };
                },
              }),
            }
          : {}),
        sourceKinds: ["git"],
        allowPrivateGitHosts: allowLocalNetwork === true,
      }),
      toolkitsPlugin({ activeToolkitSlug }),
      // Neither credentials nor an injected client is a misconfiguration, not a
      // mode: passing empty ones would build a vault client that 401s on the
      // first credential read. Omitting both lets the plugin fail at startup,
      // which is where a missing WORKOS_* binding belongs.
      workosVaultPlugin({
        ...(workosCredentials ? { credentials: workosCredentials } : {}),
        ...(workosVaultClient ? { client: workosVaultClient } : {}),
      }),
    ] as const,
});