import { parse } from "@babel/parser";
import { builtinModules } from "node:module";
import { ExecutionPlanError, hexDigest, type ExecutionPlan } from "./plan.js";
import type { ExecutionInstallation } from "./installation.js";
import type { ArtifactImplementation, ArtifactReader } from "./artifacts.js";

export interface PlacementBlocker {
  readonly code: string;
  readonly path: readonly string[];
  readonly detail: string;
}
export interface PlacementEntry {
  readonly operation: string;
  readonly effect: string;
  readonly availableTargets: readonly string[];
  readonly requiresVM: boolean;
  readonly nativeBindings: readonly string[];
  readonly cycles: readonly (readonly string[])[];
  readonly blockers: readonly PlacementBlocker[];
}
export interface ImportFinding {
  readonly code: string;
  readonly detail: string;
  readonly line: number | null;
}
const nativeImports = new Set(builtinModules.flatMap((name) => [name, name.replace(/^node:/, "")]));
const ambient = new Set([
  "process",
  "global",
  "globalThis",
  "fetch",
  "WebSocket",
  "XMLHttpRequest",
  "Deno",
  "Bun",
  "eval",
  "Function",
  "SharedArrayBuffer",
  "Atomics",
]);

/** Diagnostic scan of compiled JavaScript, never a certificate of purity. A
 * shadowed name can conservatively produce a finding; computed access/aliases
 * cannot be proven safe here. No findings still require a qualified loader and
 * runtime before this artifact can enter restricted execution. */
export function inspectJavaScriptSurface(source: string, checkedSDKImports: readonly string[] = []): ImportFinding[] {
  if (Buffer.byteLength(source) > 1024 * 1024)
    return [{ code: "ANALYSIS_LIMIT", detail: "JavaScript exceeds the 1 MiB inspection budget", line: null }];
  let ast;
  try {
    ast = parse(source, { sourceType: "module", createImportExpressions: true });
  } catch {
    return [
      {
        code: "UNCLASSIFIED_SYNTAX",
        detail: "Compiled source cannot be classified by the selected parser",
        line: null,
      },
    ];
  }
  const findings: ImportFinding[] = [],
    seen = new Set<string>(),
    sdk = new Set(checkedSDKImports);
  const add = (code: string, detail: string, node: any) => {
    const key = JSON.stringify([code, detail]);
    if (seen.has(key)) return;
    seen.add(key);
    if (findings.length < 63) findings.push({ code, detail, line: node?.loc?.start.line ?? null });
  };
  const imported = (node: any, at: any) => {
    if (node?.type !== "StringLiteral") {
      add("COMPUTED_MODULE_LOADING", "Module name is computed", at);
      return;
    }
    const name: string = node.value;
    if (sdk.has(name)) return;
    add(
      name.startsWith("node:") || nativeImports.has(name) ? "NATIVE_IMPORT" : "UNCLASSIFIED_IMPORT",
      name.slice(0, 256),
      at,
    );
  };
  const pending: { node: any; parent?: any; key?: string }[] = [{ node: ast }];
  let visited = 0;
  while (pending.length) {
    if (++visited > 100000) {
      add("ANALYSIS_LIMIT", "JavaScript exceeds the syntax-node inspection budget", null);
      break;
    }
    const { node, parent, key } = pending.pop()!;
    if (!node || typeof node !== "object") continue;
    if (["ImportDeclaration", "ExportAllDeclaration", "ExportNamedDeclaration"].includes(node.type) && node.source)
      imported(node.source, node);
    if (node.type === "ImportExpression") imported(node.source, node);
    if (node.type === "CallExpression" && node.callee?.type === "Identifier" && node.callee.name === "require")
      imported(node.arguments[0], node);
    const propertyName = key === "property" && parent?.type === "MemberExpression" && !parent.computed;
    const recordKey =
      key === "key" &&
      ["ObjectProperty", "ObjectMethod"].includes(parent?.type) &&
      !parent.computed &&
      !parent.shorthand;
    if (node.type === "Identifier" && ambient.has(node.name) && !propertyName && !recordKey)
      add("AMBIENT_HOST_ACCESS", node.name, node);
    if (
      node.type === "MemberExpression" &&
      node.object?.type === "Identifier" &&
      node.object.name === "Math" &&
      (node.computed || node.property?.name === "random")
    )
      add("AMBIENT_RANDOMNESS", "Use captured input or a frame-scoped seed", node);
    if (
      (node.type === "CallExpression" || node.type === "NewExpression") &&
      node.callee?.type === "Identifier" &&
      node.callee.name === "Date" &&
      node.arguments.length === 0
    )
      add("AMBIENT_CLOCK", "Use captured time; date parsing is allowed", node);
    if (
      node.type === "MemberExpression" &&
      node.object?.type === "Identifier" &&
      node.object.name === "Date" &&
      (node.computed || node.property?.name === "now")
    )
      add("AMBIENT_CLOCK", "Use captured time; date parsing is allowed", node);
    for (const [childKey, child] of Object.entries(node)) {
      if (["loc", "start", "end", "extra", "comments", "tokens"].includes(childKey)) continue;
      if (Array.isArray(child)) {
        for (const value of child)
          if (value && typeof value === "object") pending.push({ node: value, parent: node, key: childKey });
      } else if (child && typeof child === "object") pending.push({ node: child, parent: node, key: childKey });
    }
  }
  if (seen.size > findings.length)
    findings.push({ code: "ANALYSIS_LIMIT", detail: "Additional findings omitted", line: null });
  return findings;
}

/** Derived metadata only. Browser/server portability and available targets say
 * nothing about sandbox eligibility. No existing package artifact has a
 * qualified restricted runtime, so it conservatively requires its VM. */
export async function reportExecutionPlacement(
  plan: ExecutionPlan,
  installation: ExecutionInstallation,
  read: ArtifactReader,
) {
  if (installation.plan !== plan.digest || hexDigest(plan.definition) !== plan.digest)
    throw new ExecutionPlanError(
      "PLACEMENT_PLAN_MISMATCH",
      plan.digest,
      "Expected the selected checked plan and installation",
    );
  const operations = new Map(plan.definition.operations.map((entry) => [entry.key, entry]));
  const queries = new Map(plan.definition.queries.map((entry) => [entry.id, entry]));
  const packages = await Promise.all(
    installation.packages.map(async (pkg) => {
      const implementations: { id: string; digest: string; compatibility: string; findings: ImportFinding[] }[] = [];
      for (const implementation of [pkg.service, pkg.module].filter(
        (entry): entry is ArtifactImplementation => !!entry,
      )) {
        let findings: ImportFinding[];
        if (implementation.compatibility === "quixos-js-module-v1") {
          const file = implementation.files.find((file) => file.path === implementation.path)!;
          if (!file || file.bytes > 1024 * 1024)
            findings = [
              { code: "ANALYSIS_LIMIT", detail: "Entry source unavailable within the inspection budget", line: null },
            ];
          else {
            const sdk = implementation.files.filter((file) => file.path.endsWith("/core.mjs"));
            const allowed = sdk.flatMap((file) => [
              `${pkg.root}/${file.path}`,
              `/__quixos/artifacts/content/${file.digest}/core.mjs`,
            ]);
            findings = inspectJavaScriptSurface(
              Buffer.from(await read(pkg.revision, file.path, file.bytes)).toString("utf8"),
              allowed,
            );
          }
        } else
          findings = [
            { code: "NATIVE_SERVICE", detail: "Native/persistent service stays in VM execution", line: null },
          ];
        implementations.push({
          id: implementation.id,
          digest: implementation.contentDigest,
          compatibility: implementation.compatibility,
          findings,
        });
      }
      return {
        revision: pkg.revision,
        requiresVM: implementations.length > 0,
        restrictedEligible: false as const,
        reason: "NO_QUALIFIED_RESTRICTED_RUNTIME",
        implementations,
      };
    }),
  );
  const entries: PlacementEntry[] = plan.definition.operations.map((root) => {
    const native = new Set<string>(),
      visited = new Set<string>(),
      cycles: string[][] = [],
      blockers: PlacementBlocker[] = [];
    const pending = [{ key: root.key, path: [root.key] }];
    let limited = false;
    const block = (code: string, path: string[], detail: string) => {
      if (blockers.length < 63) blockers.push({ code, path, detail });
      else limited = true;
    };
    while (pending.length) {
      if (visited.size >= 512) {
        limited = true;
        break;
      }
      const { key, path } = pending.pop()!;
      const repeated = path.slice(0, -1).indexOf(key);
      if (repeated >= 0) {
        if (cycles.length < 16) cycles.push(path.slice(repeated));
        else limited = true;
        continue;
      }
      if (visited.has(key)) continue;
      if (path.length > 128) {
        limited = true;
        continue;
      }
      visited.add(key);
      const node = operations.get(key);
      if (!node) {
        block("UNCLASSIFIED_DEPENDENCY", path, "Operation is absent from the checked closure");
        continue;
      }
      if (node.execution.kind === "remote")
        block("REMOTE_EFFECT", path, "Remote effects require VM or separately approved effect authority");
      if (node.binding.kind === "package")
        block(
          "UNQUALIFIED_PACKAGE",
          path,
          `${node.binding.packageRevisionId}/${node.binding.exportId}: no qualified restricted implementation`,
        );
      else if (["state", "edge", "journal", "subscription", "lifecycle"].includes(node.binding.kind))
        native.add(node.binding.kind);
      else block("UNCLASSIFIED_NATIVE", path, node.binding.kind);
      for (const dependency of node.dependencies) {
        if (dependency.kind === "operation")
          pending.push({ key: dependency.operation, path: [...path, dependency.port, dependency.operation] });
        if (dependency.kind === "query") {
          const query = queries.get(dependency.query);
          if (!query) block("UNCLASSIFIED_QUERY", [...path, dependency.port], dependency.query);
          else
            for (const operation of new Set([...query.operations, ...query.admittedOperations]))
              pending.push({ key: operation, path: [...path, dependency.port, dependency.query, operation] });
        }
      }
    }
    if (limited)
      blockers.push({
        code: "ANALYSIS_LIMIT",
        path: [root.key],
        detail: "Dependency closure exceeds the bounded report; keep VM placement",
      });
    return {
      operation: root.key,
      effect: root.execution.kind,
      availableTargets: [...root.availableTargets],
      requiresVM: blockers.length > 0,
      nativeBindings: [...native].sort(),
      cycles,
      blockers,
    };
  });
  const background = plan.definition.packages.flatMap((pkg) =>
    (pkg.controllers ?? []).map((controller) => ({
      package: pkg.revision,
      id: controller.id,
      requiresVM: true,
      reason: "PERSISTENT_CONTROLLER_EXECUTION",
    })),
  );
  return {
    codec: "quixos-execution-placement-v1" as const,
    workspace: plan.definition.workspace.workspaceId,
    plan: plan.digest,
    requiresVM:
      packages.some((pkg) => pkg.requiresVM) || entries.some((entry) => entry.requiresVM) || background.length > 0,
    operations: entries,
    packages,
    background,
  };
}