// This computer's connections, moved once with the rest of the person's things to their own Cloud: MCP servers with
// their secrets and sign-ins, the AI keys bots run on, connected apps and mailboxes. Secrets reach main only over the
// server's private port (cloud-logins.mjs) and go only to the move's owner session on My Cloud. A sign-in that
// refreshes itself moves: once My Cloud has it, this computer forgets its own copy, so only My Cloud uses it.
//
//   const collected = await collectConnections(local);
//   const result = await sendConnections(collected, target, { local });
//
// `local`: this computer's server, `{ json(route), handoff(what) }`: a loopback read, and the private port's answer.
// `target`: the owner session on My Cloud, `{ call(method, route, body?) }` answering `{ ok, status, body }`.

import nativeText from "./native-text.cjs";

const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
const sentence = (value) => (typeof value === "string" && value.trim() ? value.trim().slice(0, 300) : null);
const pick = (source, names) => Object.fromEntries(names.filter((name) => source[name] !== undefined && source[name] !== null).map((name) => [name, source[name]]));
const ID = /^(?:mcp:[a-z][a-z0-9_-]{0,31}|key:\w{1,40}|composio|email)$/u;
const INSTALLATION = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u;
const ENVIRONMENT = /^[\w-]{1,128}$/u;
const SLUG = /^[a-z0-9_][a-z0-9_-]{0,80}$/u;
const ENGINE = /^[\w.:-]{1,128}$/u;
const LAUNCHER = /^[a-z0-9._+-]{1,40}$/u;
const DIGEST = /^[0-9a-f]{64}$/u;
const KINDS = new Set(["mcp", "key", "composio", "email"]);
/** Keys first, so the engines they run are ready before anything that follows them; connected apps last. */
const ORDER = { key: 0, mcp: 1, email: 2, composio: 3 };
const MCP_FIELDS = ["command", "args", "env", "type", "url", "headers", "oauth", "resultBudget", "enabled", "runsOn"];
/** How long a move waits for My Cloud to run the engines whose keys just went. */
const ENGINE_WAIT_MS = 10_000;

export class ConnectionMoveError extends Error {
  /** `final`: trying again can't fix it (My Cloud's policy or limits refused it). */
  constructor(code, message, final = false) {
    super(message);
    this.name = "ConnectionMoveError";
    this.code = code;
    this.final = final;
  }
}

/** A server's answer to GET /api/cloud-connections, kept to its known shape; null when it is not one. */
export function parseConnections(value) {
  if (!record(value) || !Array.isArray(value.connections) || !record(value.computer)) return null;
  const { environmentId, label } = value.computer;
  if (typeof environmentId !== "string" || !ENVIRONMENT.test(environmentId) || typeof label !== "string" || !label.trim()) return null;
  const strings = (list, pattern, max) => (Array.isArray(list) ? [...new Set(list.filter((entry) => typeof entry === "string" && pattern.test(entry)))].slice(0, max) : []);
  const connections = value.connections.filter((item) => record(item) && typeof item.id === "string" && ID.test(item.id) && KINDS.has(item.kind)
    && item.id.split(":")[0] === item.kind && typeof item.label === "string" && item.label.trim())
    .slice(0, 200).map((item) => ({
      id: item.id, kind: item.kind, label: item.label.trim().slice(0, 120),
      ...(item.runsHere === true ? { runsHere: true } : {}),
      ...(typeof item.launcher === "string" && LAUNCHER.test(item.launcher) ? { launcher: item.launcher } : {}),
      ...(Array.isArray(item.for) ? { for: strings(item.for, ENGINE, 20) } : {}),
      ...(item.signIn === true ? { signIn: true } : {}),
      ...(item.mode === "managed" || item.mode === "own" ? { mode: item.mode } : {}),
      ...(typeof item.account === "string" && item.account.length <= 120 ? { account: item.account } : {}),
      ...(typeof item.installationId === "string" && INSTALLATION.test(item.installationId) ? { installationId: item.installationId } : {}),
    }));
  return { computer: { environmentId, label: label.trim().slice(0, 120) }, connections, engines: strings(value.engines, ENGINE, 200), commands: strings(value.commands, LAUNCHER, 40),
    ...(value.managedApps === false ? { managedApps: false } : {}), ...(value.vaultKeys === true ? { vaultKeys: true } : {}) };
}

/** This computer's connections, by name only, and the computer they are on. */
export async function collectConnections(local) {
  const listed = parseConnections(await local.json("/api/cloud-connections").catch(() => null));
  if (!listed) throw new ConnectionMoveError("local", "OpenMausBot on this computer did not list its apps and keys. Try again in a moment.");
  return { computer: listed.computer, connections: listed.connections };
}

function refused(answer, fallback) {
  if (answer.status === 401) return new ConnectionMoveError("refused", "My Cloud did not let this app make the change. Open My Cloud in this app once, then try again.");
  const said = sentence(answer.body?.error);
  return new ConnectionMoveError("refused", said ? `My Cloud said: ${said}` : fallback, answer.status === 400 || answer.status === 403);
}

async function secrets(local, item) {
  const answer = await local.handoff({ kind: "connection", id: item.id }).catch(() => null);
  if (!record(answer?.connection)) throw new ConnectionMoveError("local", `${item.label} could not be read on this computer.`);
  return { connection: answer.connection, ...(typeof answer.digest === "string" && DIGEST.test(answer.digest) ? { digest: answer.digest } : {}) };
}

/** My Cloud's connections once it runs every one of these engines, asked every half second; the last ones read when it
 * does not get there in time. */
async function runningEngines(target, engines, waitMs, cloud) {
  for (const started = Date.now(); ; await new Promise((resolve) => setTimeout(resolve, 500))) {
    const answer = await target.call("GET", "/api/cloud-connections").catch(() => null);
    const read = answer?.ok ? parseConnections(answer.body) : null;
    if (read) cloud = read;
    if ([...engines].every((engine) => cloud.engines.includes(engine)) || Date.now() - started >= waitMs) return cloud;
  }
}

const signInRoute = (item) => `/api/cloud-connections/mcp/${item.id.slice("mcp:".length)}/sign-in`;

/** This computer's newer copy of a sign-in, in place of the one My Cloud took from it (`onCloud`); its digest, or null. */
async function sendAgain(local, target, item, onCloud) {
  const fresh = await secrets(local, item).catch(() => null);
  const signIn = fresh?.connection.mcp?.signIn;
  if (!record(signIn) || !fresh.digest) return null;
  const answer = await target.call("PUT", `${signInRoute(item)}?replaces=${onCloud}`, signIn).catch(() => null);
  return answer?.ok && answer.body?.adopted === true ? fresh.digest : null;
}

/** This computer lets go of a sign-in My Cloud took (`digest`: what My Cloud has); one that refreshed here meanwhile
 * goes again first. True once let go of. */
async function letGo(local, target, item, digest) {
  let onCloud = digest;
  for (let tries = 0; tries < 3 && onCloud; tries++) {
    const answer = await local.handoff({ kind: "connection-release", id: item.id, digest: onCloud }).catch(() => null);
    if (answer?.release?.released === true) return { released: true };
    if (answer?.release?.changed !== true) break;
    onCloud = await sendAgain(local, target, item, onCloud);
  }
  return { released: false, digest: onCloud ?? digest };
}

/**
 * Makes My Cloud act as this computer's connected-apps account: with OpenMausBot's service, a one-time code minted for
 * My Cloud's own installation; with the person's own Composio project, the same key and user. A Cloud whose own apps
 * are connected keeps them, and says which apps connected here it lacks (`missing`).
 * `here` and `there`: the "composio" connection of this computer and of My Cloud (null when My Cloud has none yet).
 */
export async function adoptComposioId(target, { local, here, there, managedApps = true, t = nativeText.englishText.t }) {
  if (here.account && there?.account === here.account) return { shared: true };
  if (here.mode === "managed" && !managedApps) {
    throw new ConnectionMoveError("no_service", t("native.cloud.connectedAppsStay"), true);
  }
  const listed = await local.json("/api/connectors/connected").catch(() => null);
  const apps = Object.entries(record(listed?.services) ? listed.services : {}).filter(([slug, state]) => SLUG.test(slug) && record(state) && state.connected === true)
    .map(([slug]) => slug).slice(0, 200);
  let body;
  if (here.mode === "managed") {
    if (!there?.installationId) throw new ConnectionMoveError("not_ready", "My Cloud's connected apps are not ready yet. Try again in a moment.");
    const code = (await local.handoff({ kind: "composio-share", for: there.installationId }).catch(() => null))?.share?.code;
    if (typeof code !== "string") throw new ConnectionMoveError("local", "This computer's connected apps could not be shared.");
    body = { share: code, apps };
  } else {
    const own = (await secrets(local, here)).connection.composio;
    if (!record(own) || typeof own.apiKey !== "string" || typeof own.userId !== "string") throw new ConnectionMoveError("local", "This computer's connected apps could not be read.");
    body = { apiKey: own.apiKey, userId: own.userId, apps };
  }
  const answer = await target.call("POST", "/api/cloud-connections/connected-apps", body);
  if (!answer.ok) throw refused(answer, "My Cloud did not take this computer's connected apps.");
  if (answer.body?.shared === true) return { shared: true };
  return { kept: true, missing: Array.isArray(answer.body?.missing) ? answer.body.missing.filter((slug) => typeof slug === "string" && SLUG.test(slug)) : [] };
}

/**
 * Moves each of this computer's connections to My Cloud, keys first: each over My Cloud's own routes, with its secrets.
 * An MCP server that needs this computer (its program, files or address are here, or My Cloud lacks its program) goes
 * marked as running on this computer, which My Cloud never starts. A sign-in that refreshes itself goes too, and this
 * computer lets go of its copy once My Cloud has it (with `release: false`, the result lists it instead, for
 * releaseConnections). One connection failing never stops the others.
 *
 * With `signIns: false`, a sign-in that refreshes itself stays here for a later pass (`later`), and the rest goes.
 *
 * Returns { moved, runsHere, kept, missing, failed, release, later, held }: what My Cloud has now; what went marked as
 * running here (`needs`: a program My Cloud lacks; `off`: it was switched off here too); what My Cloud kept of its own (its own sign-in, its own connected
 * apps); the connected apps of this computer's that My Cloud then lacks; what failed (`final`: trying again can't fix
 * it); the sign-ins My Cloud took that this computer still holds; the sign-ins left for a later pass; and the keys a
 * trial's Cloud keeps unused while its Claude credit lasts.
 */
export async function sendConnections(collected, target, { local, release = true, signIns = true, waitMs = ENGINE_WAIT_MS, onProgress = () => {}, t = nativeText.englishText.t } = {}) {
  const answer = await target.call("GET", "/api/cloud-connections").catch(() => null);
  if (answer?.status === 404) throw new ConnectionMoveError("outdated", "My Cloud needs an update before it can take this computer's apps and keys. It updates by itself.");
  let cloud = answer?.ok ? parseConnections(answer.body) : null;
  if (!cloud) throw new ConnectionMoveError("unreachable", "My Cloud did not answer. Try again in a moment.");
  const result = { moved: [], runsHere: [], kept: [], missing: [], failed: [], release: [], later: [], held: [] };
  const done = (item) => result.moved.push({ id: item.id, label: item.label });

  /** A sign-in to My Cloud; one that refreshes itself (`digest`) is then let go of here. My Cloud keeps one of its own. */
  async function moveSignIn(item, signIn, digest) {
    const put = await target.call("PUT", signInRoute(item), signIn);
    if (!put.ok) throw refused(put, `My Cloud did not take ${item.label}'s sign-in.`);
    if (put.body?.kept === true) return void result.kept.push({ id: item.id, label: item.label });
    if (!digest) return;
    const outcome = release ? await letGo(local, target, item, digest) : { released: false, digest };
    if (!outcome.released) result.release.push({ id: item.id, label: item.label, digest: outcome.digest });
  }

  const steps = {
    async key(item) {
      const { connection } = await secrets(local, item);
      if (!record(connection.config)) throw new ConnectionMoveError("local", `${item.label} could not be read on this computer.`);
      const holding = await target.call("PUT", "/api/cloud-connections/held-keys", { for: item.for ?? [] }).catch(() => null);
      const saved = await target.call("PATCH", "/api/config", connection.config);
      if (!saved.ok) throw refused(saved, `My Cloud did not take the ${item.label} key.`);
      if (holding?.ok && holding.body?.held === true) result.held.push({ id: item.id, label: item.label });
      done(item);
      return holding?.ok && holding.body?.held === true;
    },
    async mcp(item) {
      const { connection, digest } = await secrets(local, item);
      const { name, server, signIn, keys } = record(connection.mcp) ? connection.mcp : {};
      if (typeof name !== "string" || !record(server)) throw new ConnectionMoveError("local", `${item.label} could not be read on this computer.`);
      // A Cloud too old to read a `vault:<id>` key would save the pointer as the key itself: it goes once the Cloud has updated.
      if (Array.isArray(keys) && keys.length && !cloud.vaultKeys) throw new ConnectionMoveError("outdated", "My Cloud needs an update before it can take this computer's apps and keys. It updates by itself.");
      const { enabled, runsOn: marked, ...definition } = pick(server, MCP_FIELDS);
      const missing = item.launcher && !cloud.commands.includes(item.launcher) ? item.launcher : null;
      const runsOn = record(marked) ? marked : item.runsHere || missing ? collected.computer : null;
      const keysField = Array.isArray(keys) && keys.length ? { vaultKeys: keys } : {};
      let saved;
      if (cloud.connections.some((theirs) => theirs.id === item.id)) {
        saved = await target.call("PUT", `/api/mcp/servers/${name}`, { ...definition, enabled: enabled === true, runsOn, ...keysField });
      } else {
        saved = await target.call("POST", "/api/mcp/servers", { name, ...definition, ...(runsOn ? { runsOn } : {}), ...keysField });
        if (saved.ok && enabled === true) saved = await target.call("PATCH", `/api/mcp/servers/${name}`, { enabled: true });
      }
      if (!saved.ok) throw refused(saved, `My Cloud did not take ${item.label}.`);
      if (runsOn) return void result.runsHere.push({ id: item.id, label: item.label, ...(missing && !item.runsHere && !record(marked) ? { needs: missing } : {}), ...(enabled === true ? {} : { off: true }) });
      done(item);
      if (record(signIn)) {
        if (!digest) throw new ConnectionMoveError("local", `${item.label}'s sign-in could not be read on this computer.`);
        if (!signIns) return void result.later.push({ id: item.id, label: item.label });
        await moveSignIn(item, signIn, digest);
      }
    },
    async email(item) {
      const accounts = (await secrets(local, item)).connection.email;
      if (!Array.isArray(accounts)) throw new ConnectionMoveError("local", t("native.cloud.mailRead"));
      const answer = await target.call("PUT", "/api/cloud-connections/email", { accounts });
      if (answer.status === 404) throw new ConnectionMoveError("outdated", t("native.cloud.mailOutdated"), true);
      if (!answer.ok) throw refused(answer, t("native.cloud.mailRefused"));
      done(item);
    },
    async composio(item) {
      const outcome = await adoptComposioId(target, { local, here: item, there: cloud.connections.find((theirs) => theirs.id === "composio") ?? null, managedApps: cloud.managedApps !== false, t });
      if (outcome.kept) {
        result.kept.push({ id: item.id, label: item.label });
        result.missing.push(...outcome.missing.map((slug) => ({ slug })));
      } else done(item);
    },
  };

  const items = [...collected.connections].sort((a, b) => ORDER[a.kind] - ORDER[b.kind]);
  const engines = new Set();
  let count = 0;
  for (const item of items) {
    if (item.kind !== "key" && engines.size) {
      cloud = await runningEngines(target, engines, waitMs, cloud);
      engines.clear();
    }
    try {
      const held = await steps[item.kind](item);
      if (item.kind === "key" && !held) for (const engine of item.for ?? []) if (!cloud.engines.includes(engine)) engines.add(engine);
    } catch (error) {
      result.failed.push({ id: item.id, label: item.label, message: sentence(error?.message) ?? `${item.label} did not move.`, final: error?.final === true });
    }
    onProgress({ done: ++count, total: items.length, label: item.label });
  }
  if (engines.size) await runningEngines(target, engines, waitMs, cloud);
  return result;
}

/** Lets go of sign-ins My Cloud took that this computer still holds (`release` of a move's result); the ones it could
 * not let go of yet. */
export async function releaseConnections(pending, { local, target }) {
  const held = [];
  for (const entry of pending) {
    if (!record(entry) || typeof entry.id !== "string" || !ID.test(entry.id) || typeof entry.digest !== "string" || !DIGEST.test(entry.digest)) continue;
    const item = { id: entry.id, kind: entry.id.startsWith("mcp:") ? "mcp" : entry.id, label: typeof entry.label === "string" ? entry.label : entry.id };
    const outcome = await letGo(local, target, item, entry.digest);
    if (!outcome.released) held.push({ id: item.id, label: item.label, digest: outcome.digest });
  }
  return held;
}