#!/usr/bin/env node

const TRUSTED_KEY_PATTERN = /^[a-f0-9]{64}$/i;

export function verifyPluginRuntimeLiveEnv(env = process.env) {
  const passes = [];
  const failures = [];
  const group = (env.WORKER_QUEUE_GROUP || "").trim();

  const requireValue = (key, expected) => {
    if (env[key] === expected) {
      passes.push(`${key}=${expected}`);
    } else {
      failures.push(`${key} must be ${expected}`);
    }
  };

  const requirePresent = (key) => {
    if (typeof env[key] === "string" && env[key].trim()) {
      passes.push(`${key} is configured`);
    } else {
      failures.push(`${key} must be configured`);
    }
  };

  requireValue("PLUGIN_RUNTIME_PRODUCTION_ENABLED", "true");
  requireValue("WORKER_ENABLED", "true");
  requirePresent("DATABASE_URL");
  requirePresent("BULLMQ_REDIS_URL");

  if (group === "general" || group === "plugin") {
    passes.push(`WORKER_QUEUE_GROUP=${group}`);
  } else {
    failures.push("WORKER_QUEUE_GROUP must be general or plugin for plugin runtime live verification");
  }

  const keys = (env.PLUGIN_TRUSTED_PUBLIC_KEYS || "")
    .split(",")
    .map((key) => key.trim())
    .filter(Boolean);
  if (keys.length > 0 && keys.every((key) => TRUSTED_KEY_PATTERN.test(key))) {
    passes.push("PLUGIN_TRUSTED_PUBLIC_KEYS has valid hex trust roots");
  } else {
    failures.push("PLUGIN_TRUSTED_PUBLIC_KEYS must contain at least one 64-char hex Ed25519 public key");
  }

  if (group === "general") {
    requireValue("OUTBOX_DISPATCHER_ENABLED", "true");
    requireValue("PLUGIN_HOOK_FANOUT_REQUIRED", "true");
    if (env.PLUGIN_HOOK_FANOUT_ENABLED === "false") {
      failures.push("PLUGIN_HOOK_FANOUT_ENABLED must be unset or true");
    } else {
      passes.push("PLUGIN_HOOK_FANOUT_ENABLED is not disabled");
    }
    if (env.PLUGIN_CAPABILITY_USE_ENABLED === "false") {
      failures.push("PLUGIN_CAPABILITY_USE_ENABLED must be unset or true");
    } else {
      passes.push("PLUGIN_CAPABILITY_USE_ENABLED is not disabled");
    }
  }

  if (group === "plugin") {
    passes.push("worker-plugin live gate checks the isolated invocation worker configuration");
  }

  return { passes, failures };
}

export function formatPluginRuntimeLiveResult(result) {
  const status = result.failures.length > 0 ? "FAIL" : "PASS";
  return [
    `${status} plugin runtime live verification`,
    ...result.passes.map((pass) => `PASS ${pass}`),
    ...result.failures.map((failure) => `FAIL ${failure}`),
    `Summary: ${result.passes.length} passed, ${result.failures.length} failed`,
    "",
  ].join("\n");
}

if (import.meta.url === `file://${process.argv[1]}`) {
  const result = verifyPluginRuntimeLiveEnv(process.env);
  const output = formatPluginRuntimeLiveResult(result);
  if (result.failures.length > 0) {
    process.stderr.write(output);
    process.exitCode = 1;
  } else {
    process.stdout.write(output);
  }
}