/**
 * Seed a brand-new repository so it arrives working rather than empty.
 *
 * `POST /new` already calls bootstrapRepository(), which creates the DB side —
 * gate settings, branch protection, labels, a welcome issue. But it creates no
 * git content, so a new user landed on an empty repository: no commit, no
 * README, no workflow, and therefore no CI run to be green. Everything the
 * product does on push had nothing to act on, and the first thing a new user
 * saw was an empty-state page telling them to go and configure something.
 *
 * This writes an initial commit containing:
 *
 *   README.md                     what the repo is, and what the platform
 *                                 already did to it
 *   .gluecron/workflows/ci.yml    a workflow that runs on push and passes
 *
 * ...then calls the same syncAndEnqueuePushWorkflows() the git post-receive
 * hook calls. That matters: these files are written through the git plumbing
 * API rather than an actual push, so the post-receive hook never fires and
 * the workflow would otherwise sit undiscovered on disk. Calling the shared
 * seam means scaffolded repos take exactly the same path as pushed ones.
 *
 * Best-effort throughout. A repository that exists but has no README is a
 * cosmetic disappointment; a failed repo creation is a broken product. So
 * every step is caught and reported, never thrown.
 */

export interface ScaffoldResult {
  readmeCommitted: boolean;
  workflowCommitted: boolean;
  /** Workflows discovered and upserted by the shared sync seam. */
  workflowsSynced: number;
  /** CI runs enqueued — this is what makes the repo show a green check. */
  runsEnqueued: number;
  /** Code files embedded, so semantic search works from the first minute. */
  filesIndexed: number;
  errors: string[];
}

/** The CI workflow every new repo starts with. Deliberately trivial and
 *  dependency-free so it passes on a bare runner: the point is to prove the
 *  pipeline works end to end, not to guess the user's stack. */
function ciWorkflow(repoName: string): string {
  return `name: CI

on:
  - push

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - name: Say hello
        run: echo "CI is running for ${repoName}"
      - name: Check the workspace exists
        run: ls -a
`;
}

function readme(owner: string, repoName: string): string {
  return `# ${repoName}

Created on Gluecron. This repository was set up for you — nothing here needed
configuring.

## What is already switched on

- **Branch protection** on the default branch
- **Secret + security scanning** on every push
- **AI review** on every pull request
- **CI** — see \`.gluecron/workflows/ci.yml\`, which ran when this commit landed

## Next

Push some code:

\`\`\`bash
git clone https://gluecron.com/${owner}/${repoName}.git
cd ${repoName}
# ...
git push
\`\`\`

Every push is scanned, reviewed and gated automatically.
`;
}

/**
 * Injectable dependencies.
 *
 * Deliberately mirrors the pattern in push-workflow-sync.ts. Both of these
 * modules are imported by dozens of unrelated test files, so a
 * `mock.module()` on either leaks a global mock across the entire test run —
 * mocking them from this file's tests broke six tests in
 * push-workflow-sync.test.ts, which is precisely what that file's header
 * comment warns about.
 */
export interface ScaffoldDeps {
  createOrUpdateFileOnBranch: (input: {
    owner: string;
    name: string;
    branch: string;
    filePath: string;
    bytes: Uint8Array;
    message: string;
    authorName: string;
    authorEmail: string;
  }) => Promise<
    { commitSha: string; blobSha: string; parentSha: string | null } | { error: string }
  >;
  syncAndEnqueuePushWorkflows: (opts: {
    owner: string;
    repo: string;
    repositoryId: string;
    branch: string;
    commitSha: string;
    triggeredBy?: string | null;
  }) => Promise<{ synced: number; enqueued: number; errors: string[] }>;
}

async function realDeps(): Promise<ScaffoldDeps> {
  const { createOrUpdateFileOnBranch } = await import("../git/repository");
  const { syncAndEnqueuePushWorkflows } = await import("./push-workflow-sync");
  return {
    createOrUpdateFileOnBranch: createOrUpdateFileOnBranch as ScaffoldDeps["createOrUpdateFileOnBranch"],
    syncAndEnqueuePushWorkflows,
  };
}

export async function scaffoldFirstRepo(
  opts: {
    owner: string;
    repoName: string;
    repositoryId: string;
    defaultBranch: string;
    authorName: string;
    authorEmail: string;
    userId: string;
  },
  injected?: ScaffoldDeps
): Promise<ScaffoldResult> {
  const result: ScaffoldResult = {
    readmeCommitted: false,
    workflowCommitted: false,
    workflowsSynced: 0,
    runsEnqueued: 0,
    filesIndexed: 0,
    errors: [],
  };

  const deps = injected ?? (await realDeps());
  const { createOrUpdateFileOnBranch } = deps;
  const enc = new TextEncoder();
  let headSha: string | null = null;

  const write = async (filePath: string, body: string, message: string) => {
    const res = await createOrUpdateFileOnBranch({
      owner: opts.owner,
      name: opts.repoName,
      branch: opts.defaultBranch,
      filePath,
      bytes: enc.encode(body),
      message,
      authorName: opts.authorName,
      authorEmail: opts.authorEmail,
    });
    if ("error" in res) throw new Error(`${filePath}: ${res.error}`);
    return res.commitSha;
  };

  try {
    headSha = await write(
      "README.md",
      readme(opts.owner, opts.repoName),
      "Add README"
    );
    result.readmeCommitted = true;
  } catch (err) {
    result.errors.push(
      `readme: ${err instanceof Error ? err.message : String(err)}`
    );
  }

  try {
    headSha = await write(
      ".gluecron/workflows/ci.yml",
      ciWorkflow(opts.repoName),
      "Add CI workflow"
    );
    result.workflowCommitted = true;
  } catch (err) {
    result.errors.push(
      `workflow: ${err instanceof Error ? err.message : String(err)}`
    );
  }

  // Discover + enqueue via the SAME seam post-receive uses. Without this the
  // workflow file exists on disk but no `workflows` row and no run are ever
  // created, because writing through the plumbing API does not fire the git
  // hook — the repo would look configured and do nothing.
  if (result.workflowCommitted && headSha) {
    try {
      const sync = await deps.syncAndEnqueuePushWorkflows({
        owner: opts.owner,
        repo: opts.repoName,
        repositoryId: opts.repositoryId,
        branch: opts.defaultBranch,
        commitSha: headSha,
        triggeredBy: opts.userId,
      });
      result.workflowsSynced = sync.synced ?? 0;
      result.runsEnqueued = sync.enqueued ?? 0;
    } catch (err) {
      result.errors.push(
        `sync: ${err instanceof Error ? err.message : String(err)}`
      );
    }
  }

  // Semantic index. Same reason the workflow sync is here: indexChangedFiles()
  // runs only from the git post-receive hook, and these files were written
  // through the plumbing API. Without this the repo's semantic search, repo
  // chat and "ask this repo" return nothing — and an empty index is
  // indistinguishable from "no matches", so nobody notices.
  if (headSha) {
    try {
      const { indexExistingRepo } = await import("./index-existing-repo");
      const idx = await indexExistingRepo({
        repositoryId: opts.repositoryId,
        owner: opts.owner,
        repoName: opts.repoName,
        ref: opts.defaultBranch,
        commitSha: headSha,
      });
      result.filesIndexed = idx.indexed;
      if (idx.error) result.errors.push(`index: ${idx.error}`);
    } catch (err) {
      result.errors.push(
        `index: ${err instanceof Error ? err.message : String(err)}`
      );
    }
  }

  return result;
}