#!/usr/bin/env node
/**
 * openai-tailor.mjs — OpenAI-compatible CV Tailoring for career-ops
 *
 * Tailor your CV (HTML) with ANY OpenAI-compatible chat endpoint instead of Claude.
 * This is the headless companion to openai-eval.mjs. It takes an evaluation report
 * and the job description, applies anti-fabrication rules, and outputs a filled
 * cv-template.html ready to be turned into a PDF.
 *
 * Usage:
 *   node openai-tailor.mjs --jd ./jds/my-job.txt --report reports/001-company-2026.md
 *
 * Requires (for hosted endpoints):
 *   OPENAI_API_KEY (or --key)   — your provider key
 *   OPENAI_BASE_URL (or --url)  — the provider's OpenAI-compatible base
 *   OPENAI_MODEL (or --model)   — the model id
 */

import { randomUUID } from 'crypto';
import { readFileSync, existsSync, writeFileSync, mkdirSync } from 'fs';
import { join, dirname, basename } from 'path';
import { fileURLToPath } from 'url';
import { getCareerOpsRoot, getProfilePath } from './path-resolver.mjs';
import { loadYaml } from './lib/yaml-document.mjs';
import { validateLockedSections, sectionKey } from './generate-pdf.mjs';
import { readLockedSections } from './theme-style.mjs';
import { redactIfEnabled, restoreIfEnabled } from './utils/privacy-filter.mjs';
import { assertLlmRequestAllowed } from './lib/llm-outbound.mjs';
import { installPiiInterceptor } from './lib/pii-interceptor.mjs';
import { endpointHeaders } from './lib/endpoint-headers.mjs';

// Ambient guard over global fetch (idempotent); the explicit gate below is the
// primary layer.
installPiiInterceptor();

try {
  const { config } = await import('dotenv');
  // The data root's .env first: doctor.mjs, remember-cli.mjs, scan.mjs and the
  // plugin engine all read it there. The working directory's .env, the only one
  // read before, still supplies what the data root's leaves unset.
  config({ path: [join(getCareerOpsRoot(), '.env'), join(process.cwd(), '.env')] });
} catch { /* dotenv optional */ }

const ROOT = dirname(fileURLToPath(import.meta.url));
const DATA_ROOT = getCareerOpsRoot();

// ---------------------------------------------------------------------------
// Paths
// ---------------------------------------------------------------------------
const PATHS = {
  shared:   join(ROOT, 'modes', '_shared.md'),
  writing:  join(ROOT, 'modes', '_writing.md'),
  pdfMode:  join(ROOT, 'modes', 'pdf.md'),
  cv:       join(DATA_ROOT, 'cv.md'),
  profile:  getProfilePath(),
  template: join(ROOT, 'templates', 'cv-template.html'),
  output:   join(DATA_ROOT, 'output'),
};

// ---------------------------------------------------------------------------
// CLI argument parsing
// ---------------------------------------------------------------------------
const args = process.argv.slice(2);

if (args.length === 0 || args[0] === '--help' || args[0] === '-h') {
  console.log(`
╔══════════════════════════════════════════════════════════════════╗
║      career-ops — OpenAI-compatible CV Tailoring (Headless)      ║
╚══════════════════════════════════════════════════════════════════╝

  Tailor your CV with any OpenAI-compatible API to output a filled HTML file.

  USAGE
    node openai-tailor.mjs --jd <path> --report <path>
    node openai-tailor.mjs --url <base> --model <id> --jd <path> --report <path>

  OPTIONS
    --jd <path>      Path to the Job Description text file
    --report <path>  Path to the evaluation report generated by openai-eval.mjs
    --model <id>     Model id            (env OPENAI_MODEL, default gpt-4o)
    --url <base>     OpenAI-compatible base URL, including any /v1
                     (env OPENAI_BASE_URL, default https://api.openai.com/v1)
    --key <key>      API key             (env OPENAI_API_KEY)
    --help           Show this help

  ENV
    OPENAI_API_KEY, OPENAI_BASE_URL, OPENAI_MODEL, OPENAI_TIMEOUT_MS
    CAREER_OPS_MAX_TOKENS  Output cap per tailored CV (default 32768). Keeps a
                     gateway like OpenRouter from reserving credit for the
                     model's whole output window (HTTP 402 on a low balance).

  EXAMPLES
    OPENAI_API_KEY=sk-... node openai-tailor.mjs --jd ./jds/job.txt --report reports/001-company-2026-01-01.md
`);
  process.exit(0);
}

// Parse flags
let jdPath     = '';
let reportPath = '';
let modelName  = process.env.OPENAI_MODEL || 'gpt-4o'; // Tailoring needs a smarter model default than eval
let baseUrl    = (process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1').replace(/\/$/, '');
let apiKey     = process.env.OPENAI_API_KEY || '';

for (let i = 0; i < args.length; i++) {
  if (args[i] === '--jd' && args[i + 1]) {
    jdPath = args[++i];
  } else if (args[i] === '--report' && args[i + 1]) {
    reportPath = args[++i];
  } else if (args[i] === '--model' && args[i + 1]) {
    modelName = args[++i];
  } else if (args[i] === '--url' && args[i + 1]) {
    baseUrl = args[++i].replace(/\/$/, '');
  } else if (args[i] === '--key' && args[i + 1]) {
    apiKey = args[++i];
  }
}

if (!jdPath || !reportPath) {
  console.error('❌  Both --jd and --report are required. Run with --help for usage.');
  process.exit(1);
}

if (!existsSync(jdPath)) {
  console.error(`❌  JD file not found: ${jdPath}`);
  process.exit(1);
}
if (!existsSync(reportPath)) {
  console.error(`❌  Report file not found: ${reportPath}`);
  process.exit(1);
}

const jdText = readFileSync(jdPath, 'utf-8').trim();
const reportText = readFileSync(reportPath, 'utf-8').trim();

// The report filename identifies the application being tailored.
const reportFilename = basename(reportPath);

// ---------------------------------------------------------------------------
// Endpoint + security guard.
// ---------------------------------------------------------------------------
let endpointHost;
{
  let parsed;
  try {
    parsed = new URL(baseUrl);
  } catch {
    console.error(`❌  Invalid OPENAI_BASE_URL: "${baseUrl}"`);
    process.exit(1);
  }
  endpointHost = parsed.hostname;
  const isLoopback = endpointHost === 'localhost' || endpointHost === '127.0.0.1' || endpointHost === '::1';

  if (!isLoopback && parsed.protocol !== 'https:') {
    console.error(`
❌  Refusing to use a non-HTTPS remote endpoint: ${baseUrl}
   Your data and API key would be sent in cleartext.
   Use an https:// endpoint, or http://localhost:... for a local server.
`);
    process.exit(1);
  }

  if (!isLoopback && !apiKey) {
    console.error(`
❌  No API key for ${endpointHost}.
   Set one and re-run: OPENAI_API_KEY=your_key node openai-tailor.mjs ...
`);
    process.exit(1);
  }
}

const endpoint = `${baseUrl}/chat/completions`;

// ---------------------------------------------------------------------------
// File helpers
// ---------------------------------------------------------------------------
function readFile(path, label, required = false) {
  if (!existsSync(path)) {
    if (required) {
      console.error(`❌  Required context file not found: ${label} at ${path}`);
      process.exit(1);
    }
    console.warn(`⚠️   ${label} not found at: ${path}`);
    return `[${label} not found — skipping]`;
  }
  return readFileSync(path, 'utf-8').trim();
}

// ---------------------------------------------------------------------------
// Load context files
// ---------------------------------------------------------------------------
console.log('\\n📂  Loading context files...');

const sharedContext  = readFile(PATHS.shared, 'modes/_shared.md', false);
// Writing guardrails (Voice DNA / Writing Style / Professional Writing) live in
// _writing.md since #1710 — a CV-tailoring script needs them, unlike the eval
// engines that read the eval-core _shared.md alone.
const writingContext = readFile(PATHS.writing, 'modes/_writing.md', false);
const pdfModeLogic   = readFile(PATHS.pdfMode, 'modes/pdf.md', false);
// Opt-in privacy filter (privacy.redact_contact_info in config/profile.yml):
// keep name/contact details out of the prompt sent to the model.
const profileYmlRaw  = readFile(PATHS.profile, 'config/profile.yml', true);
const cvContent      = redactIfEnabled(readFile(PATHS.cv, 'cv.md', true), profileYmlRaw);
const profileContent = redactIfEnabled(profileYmlRaw, profileYmlRaw);
const templateHtml   = readFile(PATHS.template, 'templates/cv-template.html', true);

// ---------------------------------------------------------------------------
// Build system prompt
// ---------------------------------------------------------------------------
const systemPrompt = `You are career-ops, an AI-powered CV tailoring engine.
You read a candidate's base CV, profile, an evaluation report, and a Job Description.
Your job is to apply strict anti-fabrication tailoring rules to fill in an HTML template.

═══════════════════════════════════════════════════════
SYSTEM CONTEXT (_shared.md)
═══════════════════════════════════════════════════════
${sharedContext}

═══════════════════════════════════════════════════════
WRITING GUARDRAILS (_writing.md)
═══════════════════════════════════════════════════════
${writingContext}

═══════════════════════════════════════════════════════
PDF TAILORING MODE (pdf.md)
═══════════════════════════════════════════════════════
${pdfModeLogic}

═══════════════════════════════════════════════════════
HTML TEMPLATE (cv-template.html)
═══════════════════════════════════════════════════════
${templateHtml}

═══════════════════════════════════════════════════════
CANDIDATE BASE CV & PROFILE
═══════════════════════════════════════════════════════
[cv.md]
${cvContent}

[config/profile.yml]
${profileContent}

═══════════════════════════════════════════════════════
IMPORTANT OPERATING RULES FOR THIS SESSION
═══════════════════════════════════════════════════════
1. NEVER invent skills, metrics, or experience the candidate does not have.
2. Inject keywords naturally by reformulating the real experience using JD vocabulary.
3. Apply the 6-second clarity gate: strongest matching evidence first.
4. Replace all {{PLACEHOLDERS}} in the HTML Template exactly as instructed.
5. Your final output MUST be the complete, raw, tailored HTML document.
6. Do NOT include markdown formatting like \`\`\`html or conversational filler. Output the raw HTML starting with <!DOCTYPE html> and ending with </html>.`;

// ---------------------------------------------------------------------------
// Prompt caching (#1709, closing the gap in #2432) — same shape as
// openai-eval.mjs. This system prompt (shared + writing + pdf mode + HTML
// template + cv + profile, ~15K+ tokens) is byte-identical across every
// offer, yet was re-sent and re-billed each call.
//
// Host-gated on purpose: OpenAI-compatible gateways (OpenRouter, DeepSeek, …)
// honor an ephemeral `cache_control` breakpoint on the prefix and reuse it
// across back-to-back calls within the cache TTL. api.openai.com instead caches
// long prefixes automatically and may reject the non-standard field, so it gets
// a plain-string system message. Either way the prompt TEXT is unchanged.
export function buildSystemMessage(prompt, host) {
  if (host === 'api.openai.com') return { role: 'system', content: prompt };
  return {
    role: 'system',
    content: [{ type: 'text', text: prompt, cache_control: { type: 'ephemeral' } }],
  };
}

// ---------------------------------------------------------------------------
// Output cap, as in openai-eval.mjs. With no limit in the request, a gateway
// budgets the call for the model's whole output window: OpenRouter reserves
// prompt + max output at the model's price before generating anything, and
// answers HTTP 402 when the balance cannot cover that reservation, even when
// the tailored CV costs cents. The variable and its default are openai-eval's,
// so one setting covers both steps of the budget workflow.
const DEFAULT_MAX_TOKENS = 32768;

// Same host gate as buildSystemMessage: api.openai.com's reasoning models
// reject `max_tokens` and take `max_completion_tokens`, which its other chat
// models accept as well; gateways and local servers read `max_tokens`.
function buildTokenLimit(limit, host) {
  return host === 'api.openai.com' ? { max_completion_tokens: limit } : { max_tokens: limit };
}

// ---------------------------------------------------------------------------
// Call the OpenAI-compatible endpoint
// ---------------------------------------------------------------------------
// Digits only (parseInt read "300s" as a 300 ms timeout) and at most 2^31-1 ms:
// AbortSignal.timeout() fires a longer delay after 1 ms, and throws past 2^32-1.
const timeoutRaw = (process.env.OPENAI_TIMEOUT_MS || '300000').trim();
const timeoutMs = /^\d+$/.test(timeoutRaw) ? Number(timeoutRaw) : NaN;
if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > 2_147_483_647) {
  console.error(`❌  Invalid OPENAI_TIMEOUT_MS: "${process.env.OPENAI_TIMEOUT_MS}" — must be a positive integer of at most 2147483647 (milliseconds).`);
  process.exit(1);
}

// Empty means unset, as for every other variable here. Digits only, so "8k"
// is refused instead of being read as 8.
const maxTokensEnv = process.env.CAREER_OPS_MAX_TOKENS?.trim();
const maxTokens = maxTokensEnv ? (/^\d+$/.test(maxTokensEnv) ? Number(maxTokensEnv) : NaN) : DEFAULT_MAX_TOKENS;
if (!(maxTokens > 0)) {
  console.error(`❌  Invalid CAREER_OPS_MAX_TOKENS: "${process.env.CAREER_OPS_MAX_TOKENS}" — must be a positive integer (output tokens).`);
  process.exit(1);
}

console.log(`\n🔒  Privacy: your cv.md + JD will be sent to ${endpointHost}.`);
console.log(`🤖  Calling ${modelName} via ${endpointHost} (output cap ${maxTokens} tokens)... this may take a minute.\n`);

const headers = { 'Content-Type': 'application/json' };
if (apiKey) headers['Authorization'] = `Bearer ${apiKey}`;
// OpenCode Go answers HTTP 400 MissingSessionID to a request with no session
// id, and its docs ask for an own user agent: the same headers openai-eval.mjs
// sends (#5825), for opencode.ai only. One tailoring run is one conversation.
// https://opencode.ai/v2/docs/console/go/#where-can-i-use-it
let careerOpsVersion;
// VERSION may carry a release-please marker ("1.38.0 # x-release-please-version").
try { careerOpsVersion = readFileSync(join(ROOT, 'VERSION'), 'utf-8').trim().split(/\s+/)[0] || undefined; } catch { /* default User-Agent version */ }
Object.assign(headers, endpointHeaders(endpointHost, randomUUID(), careerOpsVersion));

let tailoredHtml;
try {
  // Privacy gate: the full serialized tailoring request is inspected before the
  // network call. Nothing is sent when a protected value is present.
  const requestBody = JSON.stringify({
    model:    modelName,
    messages: [
      buildSystemMessage(systemPrompt, endpointHost),
      { role: 'user',   content: `EVALUATION REPORT:\n\n${reportText}\n\nJOB DESCRIPTION:\n\n${jdText}\n\nNow, generate and output the fully filled HTML CV matching the rules above. Output ONLY raw HTML.` },
    ],
    stream:      false,
    temperature: 0.2,
    ...buildTokenLimit(maxTokens, endpointHost),
  });
  assertLlmRequestAllowed(endpoint, requestBody);
  const res = await fetch(endpoint, {
    method: 'POST',
    headers,
    body: requestBody,
    signal: AbortSignal.timeout(timeoutMs),
  });

  if (!res.ok) {
    const body = await res.text();
    console.error(`❌  API error: HTTP ${res.status}`);
    console.error(`    ${body.slice(0, 300)}`);
    if (res.status === 402) {
      console.error(`    → Not enough credit at ${endpointHost} for the prompt plus the ${maxTokens}-token output cap.`);
      console.error(`      Top up, or lower CAREER_OPS_MAX_TOKENS.`);
    }
    process.exit(1);
  }

  const data = await res.json();
  tailoredHtml = data.choices?.[0]?.message?.content?.trim();
  // Before the empty check: a thinking model can spend the whole cap on
  // reasoning, and then this is the only explanation the user gets. A reply
  // cut off at the cap is a CV without its last sections, and saving it would
  // hand that to generate-pdf as the tailored CV, so nothing is saved.
  if (data.choices?.[0]?.finish_reason === 'length') {
    console.error(`❌  The reply stopped at the ${maxTokens}-token output cap, so the tailored CV is cut short. Nothing was saved.`);
    console.error(`    Raise CAREER_OPS_MAX_TOKENS to allow a longer reply.`);
    process.exit(1);
  }
  if (!tailoredHtml) {
    console.error('❌  The endpoint returned an empty response.');
    process.exit(1);
  }
} catch (err) {
  console.error(`❌  API call failed: ${err.message}`);
  process.exit(1);
}

// Clean up markdown block wrapping if the LLM adds it despite instructions
tailoredHtml = tailoredHtml.replace(/^\s*```(html)?\s*/i, '').replace(/\s*```\s*$/, '');

// The model only saw placeholders when redaction is on; put the real name and
// contact details back so the tailored CV never ships with "Candidate Name".
tailoredHtml = restoreIfEnabled(tailoredHtml, profileYmlRaw);

// ---------------------------------------------------------------------------
// Save tailored HTML
// ---------------------------------------------------------------------------
try {
  if (!existsSync(PATHS.output)) {
    mkdirSync(PATHS.output, { recursive: true });
  }

  let candidateName = 'candidate';
  try {
    const profile = loadYaml(profileYmlRaw);
    if (profile && profile.name) {
      candidateName = profile.name;
    }
  } catch (err) {
    console.warn(`⚠️   Failed to parse profile.yml: ${err.message}`);
  }
  candidateName = candidateName
    .toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');

  // Reports identify applications; one employer can have several requisitions
  // with the same title. Re-tailoring one report may replace its own artifact.
  const artifactStem = `cv-${candidateName}-${reportFilename.replace(/\.md$/i, '')}`;
  const filename = `${artifactStem}.html`;
  const htmlPath = join(PATHS.output, filename);

  const lockedKeys = readLockedSections(PATHS.profile, sectionKey);
  const cvMarkdown = readFileSync(PATHS.cv, 'utf-8');
  validateLockedSections(tailoredHtml, cvMarkdown, lockedKeys);

  writeFileSync(htmlPath, tailoredHtml, 'utf-8');
  console.log(`\n✅  Tailored HTML saved: ${htmlPath}`);

  // Print next steps
  const pdfFilename = `${artifactStem}.pdf`;
  const reportNumMatch = reportFilename.match(/^(\d+)-/);
  const reportNum = reportNumMatch ? reportNumMatch[1] : '001';
  const pdfPaths = [`output/${filename}`, `output/${pdfFilename}`]
    .map(path => /^[A-Za-z0-9._@+/-]+$/.test(path) ? path : `'${path.replace(/'/g, "'\\''")}'`)
    .join(' ');

  console.log(`\n📄  Next step (generate PDF):\n    node generate-pdf.mjs ${pdfPaths} --format=letter --report=${reportNum}\n`);

} catch (err) {
  console.warn(`⚠️   Could not save HTML: ${err.message}`);
  process.exit(1);
}