/**
 * Discover an existing OpenClaw installation and emit a structured summary.
 *
 * Usage: pnpm exec tsx .claude/skills/migrate-from-openclaw/scripts/discover-openclaw.ts [--state-dir <path>]
 *
 * Checks (in order): --state-dir arg, $OPENCLAW_STATE_DIR, ~/.openclaw, ~/.clawdbot
 * Parses openclaw.json (JSON5-tolerant), scans workspace for identity/memory files,
 * checks cron jobs, MCP servers, and channel credentials.
 *
 * Emits a status block on stdout:
 *   === NANOCLAW MIGRATE: DISCOVERY ===
 *   ...
 *   === END ===
 */

import fs from 'fs';
import os from 'os';
import path from 'path';

// ---------------------------------------------------------------------------
// JSON5-tolerant parser (no dependency)
// ---------------------------------------------------------------------------

function parseJson5(text: string): unknown {
  // Strip single-line comments (// ...) that aren't inside strings
  let cleaned = text.replace(
    /("(?:[^"\\]|\\.)*")|\/\/[^\n]*/g,
    (match, str) => (str ? str : ''),
  );
  // Strip block comments (/* ... */)
  cleaned = cleaned.replace(
    /("(?:[^"\\]|\\.)*")|\/\*[\s\S]*?\*\//g,
    (match, str) => (str ? str : ''),
  );
  // Strip trailing commas before } or ]
  cleaned = cleaned.replace(/,\s*([}\]])/g, '$1');
  return JSON.parse(cleaned);
}

// ---------------------------------------------------------------------------
// Status block emitter (mirrors setup/status.ts convention)
// ---------------------------------------------------------------------------

function emitStatus(fields: Record<string, string | number | boolean>): void {
  const lines = ['=== NANOCLAW MIGRATE: DISCOVERY ==='];
  for (const [key, value] of Object.entries(fields)) {
    lines.push(`${key}: ${value}`);
  }
  lines.push('=== END ===');
  console.log(lines.join('\n'));
}

// ---------------------------------------------------------------------------
// CLI arg parsing
// ---------------------------------------------------------------------------

function parseArgs(): { stateDir?: string } {
  const args = process.argv.slice(2);
  for (let i = 0; i < args.length; i++) {
    if (args[i] === '--state-dir' && args[i + 1]) {
      return { stateDir: args[i + 1] };
    }
  }
  return {};
}

// ---------------------------------------------------------------------------
// Path resolution
// ---------------------------------------------------------------------------

function resolveStateDir(explicit?: string): string | null {
  const home = os.homedir();
  const candidates: string[] = [];

  if (explicit) {
    // Expand ~ prefix
    const expanded = explicit.startsWith('~')
      ? path.join(home, explicit.slice(1))
      : explicit;
    candidates.push(expanded);
  }

  if (process.env.OPENCLAW_STATE_DIR) {
    candidates.push(process.env.OPENCLAW_STATE_DIR);
  }

  candidates.push(path.join(home, '.openclaw'));
  candidates.push(path.join(home, '.clawdbot'));

  for (const dir of candidates) {
    if (fs.existsSync(dir) && fs.statSync(dir).isDirectory()) {
      return dir;
    }
  }
  return null;
}

// ---------------------------------------------------------------------------
// Config loading
// ---------------------------------------------------------------------------

function loadConfig(
  stateDir: string,
): Record<string, unknown> | null {
  for (const name of ['openclaw.json', 'clawdbot.json']) {
    const configPath = path.join(stateDir, name);
    if (fs.existsSync(configPath)) {
      try {
        const raw = fs.readFileSync(configPath, 'utf-8');
        return parseJson5(raw) as Record<string, unknown>;
      } catch {
        // Try next name
      }
    }
  }
  return null;
}

// ---------------------------------------------------------------------------
// Channel detection
// ---------------------------------------------------------------------------

interface ChannelInfo {
  name: string;
  hasCreds: boolean;
}

const SUPPORTED_CHANNELS = new Set([
  'whatsapp',
  'telegram',
  'slack',
  'discord',
]);

// Fields that indicate a credential is present for each channel
const CREDENTIAL_FIELDS: Record<string, string[]> = {
  telegram: ['botToken'],
  discord: ['token'],
  slack: ['botToken', 'appToken'],
  whatsapp: [], // Auth-state based, no token
  signal: ['account'],
  imessage: [],
  matrix: ['homeserverUrl', 'accessToken'],
  irc: ['server'],
  msteams: ['appId'],
  feishu: ['appId'],
  googlechat: [],
  mattermost: ['token', 'url'],
  zalo: [],
  bluebubbles: ['url'],
};

const ALL_KNOWN_CHANNELS = new Set([
  'whatsapp', 'telegram', 'slack', 'discord', 'signal',
  'imessage', 'matrix', 'irc', 'msteams', 'feishu',
  'googlechat', 'mattermost', 'zalo', 'bluebubbles',
]);

function detectChannels(
  config: Record<string, unknown>,
): ChannelInfo[] {
  // Check both config.channels.* (newer) and top-level config.* (older/legacy)
  const channelsSections: Record<string, unknown> = {};

  // Source 1: channels.* (standard location)
  const nested = config.channels as Record<string, unknown> | undefined;
  if (nested) {
    for (const [k, v] of Object.entries(nested)) {
      if (v && typeof v === 'object') channelsSections[k] = v;
    }
  }

  // Source 2: top-level keys matching known channel names (legacy format)
  for (const key of Object.keys(config)) {
    if (ALL_KNOWN_CHANNELS.has(key) && !channelsSections[key]) {
      const v = config[key];
      if (v && typeof v === 'object') channelsSections[key] = v;
    }
  }

  const results: ChannelInfo[] = [];

  for (const [name, section] of Object.entries(channelsSections)) {
    if (!section || typeof section !== 'object') continue;
    const ch = section as Record<string, unknown>;

    // Check if any credential field is present and non-empty
    const credFields = CREDENTIAL_FIELDS[name] ?? [];
    let hasCreds = false;

    for (const field of credFields) {
      const val = ch[field];
      if (val && (typeof val === 'string' || typeof val === 'object')) {
        hasCreds = true;
        break;
      }
    }

    // Also check accounts for multi-account setups
    if (!hasCreds && ch.accounts && typeof ch.accounts === 'object') {
      for (const acct of Object.values(
        ch.accounts as Record<string, unknown>,
      )) {
        if (!acct || typeof acct !== 'object') continue;
        const a = acct as Record<string, unknown>;
        for (const field of credFields) {
          if (
            a[field] &&
            (typeof a[field] === 'string' || typeof a[field] === 'object')
          ) {
            hasCreds = true;
            break;
          }
        }
        if (hasCreds) break;
      }
    }

    // WhatsApp: check for auth state directory instead of token
    if (name === 'whatsapp' && !hasCreds) {
      // Will be checked separately via agents directory
      hasCreds = false;
    }

    results.push({ name, hasCreds });
  }

  return results;
}

// ---------------------------------------------------------------------------
// Workspace scanning
// ---------------------------------------------------------------------------

const WORKSPACE_FILES = [
  'SOUL.md',
  'USER.md',
  'MEMORY.md',
  'IDENTITY.md',
  'TOOLS.md',
  'HEARTBEAT.md',
  'BOOTSTRAP.md',
  'AGENTS.md',
];

function findWorkspace(stateDir: string, config: Record<string, unknown> | null): {
  dir: string | null;
  files: string[];
} {
  // Check config-specified workspace path first (agent.workspace or agents.defaults.workspace)
  const configPaths: string[] = [];
  if (config) {
    const agentWs = (config.agent as Record<string, unknown> | undefined)?.workspace as string | undefined;
    if (agentWs) configPaths.push(agentWs.startsWith('~') ? path.join(os.homedir(), agentWs.slice(1)) : agentWs);
    const defaultsWs = ((config.agents as Record<string, unknown> | undefined)?.defaults as Record<string, unknown> | undefined)?.workspace as string | undefined;
    if (defaultsWs) configPaths.push(defaultsWs.startsWith('~') ? path.join(os.homedir(), defaultsWs.slice(1)) : defaultsWs);
  }

  // Check config-specified paths, then default locations
  const candidates = [
    ...configPaths,
    ...['workspace', 'workspace.default'].map((n) => path.join(stateDir, n)),
  ];

  for (const ws of candidates) {
    if (fs.existsSync(ws) && fs.statSync(ws).isDirectory()) {
      const found = WORKSPACE_FILES.filter((f) =>
        fs.existsSync(path.join(ws, f)),
      );
      if (found.length > 0) {
        return { dir: ws, files: found };
      }
    }
  }

  // Check agent-specific workspaces
  const agentsDir = path.join(stateDir, 'agents');
  if (fs.existsSync(agentsDir)) {
    for (const agentId of fs.readdirSync(agentsDir)) {
      for (const wsName of ['workspace', 'workspace.default']) {
        const ws = path.join(agentsDir, agentId, wsName);
        if (fs.existsSync(ws) && fs.statSync(ws).isDirectory()) {
          const found = WORKSPACE_FILES.filter((f) =>
            fs.existsSync(path.join(ws, f)),
          );
          if (found.length > 0) {
            return { dir: ws, files: found };
          }
        }
      }
    }
  }

  return { dir: null, files: [] };
}

// ---------------------------------------------------------------------------
// Daily memory file detection
// ---------------------------------------------------------------------------

function countDailyMemoryFiles(workspaceDir: string | null): number {
  if (!workspaceDir) return 0;
  const memoryDir = path.join(workspaceDir, 'memory');
  if (!fs.existsSync(memoryDir) || !fs.statSync(memoryDir).isDirectory()) {
    return 0;
  }
  try {
    return fs
      .readdirSync(memoryDir)
      .filter((f) => f.endsWith('.md'))
      .length;
  } catch {
    return 0;
  }
}

// ---------------------------------------------------------------------------
// Skills detection
// ---------------------------------------------------------------------------

interface SkillInfo {
  name: string;
  source: string; // 'workspace' | 'shared' | 'personal' | 'project'
  path: string;
}

function detectSkills(
  stateDir: string,
  workspaceDir: string | null,
): SkillInfo[] {
  const skills: SkillInfo[] = [];
  const seen = new Set<string>();

  const scanDir = (dir: string, source: string) => {
    if (!fs.existsSync(dir) || !fs.statSync(dir).isDirectory()) return;
    try {
      for (const entry of fs.readdirSync(dir)) {
        const skillDir = path.join(dir, entry);
        if (!fs.statSync(skillDir).isDirectory()) continue;
        // A directory is a skill if it contains SKILL.md
        if (fs.existsSync(path.join(skillDir, 'SKILL.md'))) {
          if (seen.has(entry)) continue;
          seen.add(entry);
          skills.push({ name: entry, source, path: skillDir });
        }
      }
    } catch {
      // ignore read errors
    }
  };

  // 1. Workspace skills
  if (workspaceDir) {
    scanDir(path.join(workspaceDir, 'skills'), 'workspace');
    // 4. Project-level shared skills
    scanDir(path.join(workspaceDir, '.agents', 'skills'), 'project');
  }

  // 2. Managed/shared skills
  scanDir(path.join(stateDir, 'skills'), 'shared');

  // 3. Personal cross-project skills
  const personalSkills = path.join(os.homedir(), '.agents', 'skills');
  scanDir(personalSkills, 'personal');

  return skills;
}

// ---------------------------------------------------------------------------
// Identity extraction
// ---------------------------------------------------------------------------

function extractIdentityName(stateDir: string, workspaceDir: string | null): string {
  if (!workspaceDir) return '';

  const identityPath = path.join(workspaceDir, 'IDENTITY.md');
  if (!fs.existsSync(identityPath)) return '';

  try {
    const content = fs.readFileSync(identityPath, 'utf-8');
    // IDENTITY.md uses key:value format, e.g. "name: Claw"
    const match = content.match(/^name:\s*(.+)/im);
    return match ? match[1].trim() : '';
  } catch {
    return '';
  }
}

// ---------------------------------------------------------------------------
// Agent detection
// ---------------------------------------------------------------------------

function detectAgents(stateDir: string): string[] {
  const agentsDir = path.join(stateDir, 'agents');
  if (!fs.existsSync(agentsDir)) return [];

  try {
    return fs
      .readdirSync(agentsDir)
      .filter((f) => {
        const p = path.join(agentsDir, f);
        return fs.statSync(p).isDirectory() && !f.startsWith('.');
      });
  } catch {
    return [];
  }
}

// ---------------------------------------------------------------------------
// Group detection — from session store and channel config
// ---------------------------------------------------------------------------

interface GroupInfo {
  channel: string;
  id: string; // Platform-specific ID (WhatsApp JID, Telegram chat ID, etc.)
  name: string;
  source: 'session' | 'config';
}

/**
 * Map an OpenClaw session key (channel:kind:id) to the v2 platform_id the
 * router stores. Mirrors src/platform-id.ts:namespacedPlatformId — Chat SDK
 * channels prefix with "<channel>:"; native channels (WhatsApp/iMessage with
 * an "@", Signal "+"/"group:") pass through unprefixed. setup/register.ts
 * applies the same normalization to whatever you pass as --platform-id, so the
 * value emitted here is what to feed register.
 *
 *   OpenClaw keys: "whatsapp:group:120...@g.us", "telegram:group:-10012345"
 *   v2 platform_id: "120...@g.us", "telegram:-10012345", "discord:12345"
 */
function toV2PlatformId(channel: string, id: string): string {
  if (id.startsWith(`${channel}:`)) return id;
  if (id.includes('@')) return id; // WhatsApp / iMessage JIDs and emails
  if (id.startsWith('+') || id.startsWith('group:')) return id; // Signal
  if (channel === 'deltachat') return id;
  return `${channel}:${id}`;
}

function detectGroups(
  stateDir: string,
  config: Record<string, unknown> | null,
  agents: string[],
): GroupInfo[] {
  const groups: GroupInfo[] = [];
  const seen = new Set<string>();

  // Source 1: Session store — scan for group session keys
  for (const agentId of agents) {
    const sessionsPath = path.join(
      stateDir,
      'agents',
      agentId,
      'sessions',
      'sessions.json',
    );
    if (!fs.existsSync(sessionsPath)) continue;

    try {
      const raw = fs.readFileSync(sessionsPath, 'utf-8');
      const data = JSON.parse(raw) as Record<string, unknown>;

      // Sessions can be stored as an object with session keys, or as
      // { sessions: { key: entry } } or { entries: [...] }
      const entries =
        (data.sessions as Record<string, unknown>) ??
        (data.entries as Record<string, unknown>) ??
        data;

      for (const [key, value] of Object.entries(entries)) {
        // Match session keys like "whatsapp:group:120...@g.us"
        // or prefixed "agent:main:whatsapp:group:120...@g.us"
        // Also match DM sessions: "whatsapp:dm:number@s.whatsapp.net"
        const match = key.match(/(\w+):(group|dm|channel):(.+)$/i);
        if (!match) continue;

        const [, channel, kind, id] = match;
        // Skip DM sessions for group detection — they're individual chats
        if (kind === 'dm') continue;
        const dedupKey = `${channel}:${id}`;
        if (seen.has(dedupKey)) continue;
        seen.add(dedupKey);

        // Try to extract display name from session entry
        let name = '';
        if (value && typeof value === 'object') {
          const entry = value as Record<string, unknown>;
          name =
            (entry.displayName as string) ??
            (entry.label as string) ??
            (entry.subject as string) ??
            '';
        }

        groups.push({
          channel,
          id,
          name: name || id,
          source: 'session',
        });
      }
    } catch {
      // Ignore parse errors
    }
  }

  // Source 2: Channel config — groups explicitly configured
  if (config) {
    const channels =
      (config.channels as Record<string, unknown> | undefined) ?? {};
    for (const [channelName, channelSection] of Object.entries(channels)) {
      if (!channelSection || typeof channelSection !== 'object') continue;
      const ch = channelSection as Record<string, unknown>;

      // WhatsApp/Telegram: channels.<channel>.groups.<groupId>
      const configGroups = ch.groups as Record<string, unknown> | undefined;
      if (configGroups) {
        for (const groupId of Object.keys(configGroups)) {
          const dedupKey = `${channelName}:${groupId}`;
          if (seen.has(dedupKey)) continue;
          seen.add(dedupKey);
          groups.push({
            channel: channelName,
            id: groupId,
            name: groupId,
            source: 'config',
          });
        }
      }

      // Discord: channels.discord.guilds.<guildId>
      if (channelName === 'discord') {
        const guilds = ch.guilds as Record<string, unknown> | undefined;
        if (guilds) {
          for (const guildId of Object.keys(guilds)) {
            const dedupKey = `discord:${guildId}`;
            if (seen.has(dedupKey)) continue;
            seen.add(dedupKey);
            groups.push({
              channel: 'discord',
              id: guildId,
              name: guildId,
              source: 'config',
            });
          }
        }
      }
    }
  }

  return groups;
}

// ---------------------------------------------------------------------------
// Cron job counting
// ---------------------------------------------------------------------------

function countCronJobs(stateDir: string): {
  count: number;
  summaries: string[];
} {
  const jobsPath = path.join(stateDir, 'cron', 'jobs.json');
  if (!fs.existsSync(jobsPath)) return { count: 0, summaries: [] };

  try {
    const raw = fs.readFileSync(jobsPath, 'utf-8');
    const data = JSON.parse(raw) as {
      jobs?: Array<{ name?: string; enabled?: boolean }>;
    };
    const jobs = data.jobs ?? [];
    const summaries = jobs
      .filter((j) => j.enabled !== false)
      .map((j) => j.name || 'unnamed')
      .slice(0, 10);
    return { count: jobs.length, summaries };
  } catch {
    return { count: 0, summaries: [] };
  }
}

// ---------------------------------------------------------------------------
// Config-registered plugins and skills (with API keys)
// ---------------------------------------------------------------------------

interface ConfigPlugin {
  name: string;
  source: 'skills.entries' | 'plugins.entries';
  hasApiKey: boolean;
}

function detectConfigPlugins(
  config: Record<string, unknown>,
): ConfigPlugin[] {
  const results: ConfigPlugin[] = [];

  // Check skills.entries (e.g. openai-whisper-api with apiKey)
  const skills = config.skills as Record<string, unknown> | undefined;
  const skillEntries = skills?.entries as Record<string, unknown> | undefined;
  if (skillEntries) {
    for (const [name, entry] of Object.entries(skillEntries)) {
      if (!entry || typeof entry !== 'object') continue;
      const e = entry as Record<string, unknown>;
      const hasKey = !!(e.apiKey || e.token || e.key);
      results.push({ name, source: 'skills.entries', hasApiKey: hasKey });
    }
  }

  // Check plugins.entries (e.g. brave with config.webSearch.apiKey)
  const plugins = config.plugins as Record<string, unknown> | undefined;
  const pluginEntries = plugins?.entries as Record<string, unknown> | undefined;
  if (pluginEntries) {
    for (const [name, entry] of Object.entries(pluginEntries)) {
      if (!entry || typeof entry !== 'object') continue;
      // Deep-search for apiKey in nested config
      const hasKey = JSON.stringify(entry).includes('apiKey');
      results.push({ name, source: 'plugins.entries', hasApiKey: hasKey });
    }
  }

  return results;
}

// ---------------------------------------------------------------------------
// MCP server detection
// ---------------------------------------------------------------------------

function detectMcpServers(
  config: Record<string, unknown>,
): string[] {
  const mcp = config.mcp as Record<string, unknown> | undefined;
  if (!mcp) return [];
  const servers = mcp.servers as Record<string, unknown> | undefined;
  if (!servers) return [];
  return Object.keys(servers);
}

// ---------------------------------------------------------------------------
// Main
// ---------------------------------------------------------------------------

function main(): void {
  const { stateDir: explicitDir } = parseArgs();
  const stateDir = resolveStateDir(explicitDir);

  if (!stateDir) {
    emitStatus({ STATUS: 'not_found' });
    return;
  }

  const config = loadConfig(stateDir);
  const channels = config ? detectChannels(config) : [];
  const { dir: workspaceDir, files: workspaceFiles } =
    findWorkspace(stateDir, config);
  const identityName = extractIdentityName(stateDir, workspaceDir);
  const agents = detectAgents(stateDir);
  const groups = detectGroups(stateDir, config, agents);
  const { count: cronCount, summaries: cronSummaries } =
    countCronJobs(stateDir);
  const mcpServers = config ? detectMcpServers(config) : [];
  const dailyMemoryFiles = countDailyMemoryFiles(workspaceDir);
  const skills = detectSkills(stateDir, workspaceDir);
  const configPlugins = config ? detectConfigPlugins(config) : [];

  // Format channels as "name(has_creds)" or "name(no_creds)"
  const channelList = channels
    .map((c) => `${c.name}(${c.hasCreds ? 'has_creds' : 'no_creds'})`)
    .join(',');

  // Separate supported vs unsupported
  const unsupported = channels
    .filter((c) => !SUPPORTED_CHANNELS.has(c.name))
    .map((c) => c.name)
    .join(',');

  // Format groups as "channel:id(name)=>v2_platform_id". The right-hand value
  // is what to pass as --platform-id to setup/register.ts.
  const groupList = groups
    .map(
      (g) =>
        `${g.channel}:${g.id}(${g.name})=>${toV2PlatformId(g.channel, g.id)}`,
    )
    .join('|');

  // Format skills as "name(source)" list
  const skillList = skills
    .map((s) => `${s.name}(${s.source})`)
    .join(',');

  // Dump raw top-level config keys so Claude can see what exists
  // beyond what this script specifically detects
  const configTopKeys = config ? Object.keys(config).sort().join(',') : 'none';
  const configChannelKeys = config?.channels
    ? Object.keys(config.channels as Record<string, unknown>).sort().join(',')
    : 'none';

  // List files/dirs at the state dir root for manual inspection
  let stateDirContents = 'unknown';
  try {
    stateDirContents = fs
      .readdirSync(stateDir)
      .filter((f) => !f.startsWith('.'))
      .sort()
      .join(',');
  } catch {
    // ignore
  }

  emitStatus({
    STATUS: 'found',
    STATE_DIR: stateDir,
    CONFIG_FOUND: config !== null,
    CONFIG_TOP_KEYS: configTopKeys,
    CONFIG_CHANNEL_KEYS: configChannelKeys,
    STATE_DIR_CONTENTS: stateDirContents,
    CHANNELS: channelList || 'none',
    UNSUPPORTED_CHANNELS: unsupported || 'none',
    WORKSPACE_DIR: workspaceDir || 'not_found',
    WORKSPACE_FILES: workspaceFiles.join(',') || 'none',
    IDENTITY_NAME: identityName || 'unknown',
    AGENT_COUNT: agents.length,
    AGENT_IDS: agents.join(',') || 'none',
    GROUPS: groupList || 'none',
    GROUP_COUNT: groups.length,
    DAILY_MEMORY_FILES: dailyMemoryFiles,
    SKILL_COUNT: skills.length,
    SKILLS: skillList || 'none',
    CONFIG_PLUGINS: configPlugins.map((p) => `${p.name}(${p.source}${p.hasApiKey ? ',has_key' : ''})`).join(',') || 'none',
    CONFIG_PLUGIN_COUNT: configPlugins.length,
    CRON_JOBS: cronCount,
    CRON_SUMMARIES: cronSummaries.join('|') || 'none',
    MCP_SERVERS: mcpServers.join(',') || 'none',
  });
}

main();

/**
 * Extract a channel credential from an OpenClaw configuration and route it to
 * its correct NanoClaw v2 destination.
 *
 * Two destinations, decided per credential by transform.ts:
 *   - Host-side channel tokens (Telegram/Discord/Slack bot tokens) → written
 *     to NanoClaw's `.env`. The NanoClaw *host* process reads these to connect
 *     to the messaging platform; they never enter a container.
 *   - Container-facing API credentials (Anthropic, OpenAI, …) → NOT written
 *     anywhere by this script. The script prints the `onecli secrets create`
 *     command the operator runs so the credential lands in the OneCLI Agent
 *     Vault, which injects it per-request. Raw credentials are never threaded
 *     into a container env var.
 *
 * Usage:
 *   pnpm exec tsx .claude/skills/migrate-from-openclaw/scripts/extract-channel-credentials.ts \
 *     --channel telegram --state-dir ~/.openclaw [--write-env .env]
 *
 * Credential VALUES are never emitted to stdout — only masked versions. For
 * channel tokens, `--write-env` writes the real value directly to `.env` so
 * the agent never sees it. For vault credentials the script emits the plan
 * (name/type/host-pattern) but not the value; the operator runs the printed
 * command, keeping the secret off the chat transcript.
 *
 * Emits a status block on stdout:
 *   === NANOCLAW MIGRATE: CREDENTIAL ===
 *   ...
 *   === END ===
 */

import fs from 'fs';
import os from 'os';
import path from 'path';

import {
  channelEnvVars,
  classifyCredential,
  maskCredential,
  resolveSecretInput,
} from './transform.js';

// ---------------------------------------------------------------------------
// JSON5-tolerant parser (OpenClaw config may use comments / trailing commas)
// ---------------------------------------------------------------------------

function parseJson5(text: string): unknown {
  let cleaned = text.replace(
    /("(?:[^"\\]|\\.)*")|\/\/[^\n]*/g,
    (_match, str) => (str ? str : ''),
  );
  cleaned = cleaned.replace(
    /("(?:[^"\\]|\\.)*")|\/\*[\s\S]*?\*\//g,
    (_match, str) => (str ? str : ''),
  );
  cleaned = cleaned.replace(/,\s*([}\]])/g, '$1');
  return JSON.parse(cleaned);
}

// ---------------------------------------------------------------------------
// Inline dotenv parser (reads key=value, skips comments)
// ---------------------------------------------------------------------------

function parseDotenv(filePath: string): Record<string, string> {
  const env: Record<string, string> = {};
  if (!fs.existsSync(filePath)) return env;

  const lines = fs.readFileSync(filePath, 'utf-8').split('\n');
  for (const line of lines) {
    const trimmed = line.trim();
    if (!trimmed || trimmed.startsWith('#')) continue;
    const eqIdx = trimmed.indexOf('=');
    if (eqIdx === -1) continue;
    const key = trimmed.slice(0, eqIdx).trim();
    let value = trimmed.slice(eqIdx + 1).trim();
    if (
      (value.startsWith('"') && value.endsWith('"')) ||
      (value.startsWith("'") && value.endsWith("'"))
    ) {
      value = value.slice(1, -1);
    }
    env[key] = value;
  }
  return env;
}

// ---------------------------------------------------------------------------
// Status block emitter
// ---------------------------------------------------------------------------

function emitStatus(fields: Record<string, string | number | boolean>): void {
  const lines = ['=== NANOCLAW MIGRATE: CREDENTIAL ==='];
  for (const [key, value] of Object.entries(fields)) {
    lines.push(`${key}: ${value}`);
  }
  lines.push('=== END ===');
  console.log(lines.join('\n'));
}

// ---------------------------------------------------------------------------
// Channel → OpenClaw config field mapping
// ---------------------------------------------------------------------------

// The OpenClaw config field(s) that hold each channel's token. The matching
// NanoClaw .env destination is decided by classifyCredential() in transform.ts.
const CHANNEL_FIELDS: Record<string, string[]> = {
  telegram: ['botToken'],
  discord: ['token'],
  slack: ['botToken', 'appToken'],
  whatsapp: [], // QR/pairing-code auth — no token to migrate
};

// ---------------------------------------------------------------------------
// CLI arg parsing
// ---------------------------------------------------------------------------

function parseArgs(): { channel: string; stateDir: string; writeEnv: string } {
  const args = process.argv.slice(2);
  let channel = '';
  let stateDir = '';
  let writeEnv = '';

  for (let i = 0; i < args.length; i++) {
    if (args[i] === '--channel' && args[i + 1]) channel = args[++i].toLowerCase();
    if (args[i] === '--state-dir' && args[i + 1]) stateDir = args[++i];
    if (args[i] === '--write-env' && args[i + 1]) writeEnv = args[++i];
  }

  if (!channel) {
    console.error('Usage: --channel <name> --state-dir <path> [--write-env <path>]');
    process.exit(1);
  }

  if (stateDir.startsWith('~')) {
    stateDir = path.join(os.homedir(), stateDir.slice(1));
  }

  if (!stateDir) {
    const home = os.homedir();
    if (fs.existsSync(path.join(home, '.openclaw'))) {
      stateDir = path.join(home, '.openclaw');
    } else if (fs.existsSync(path.join(home, '.clawdbot'))) {
      stateDir = path.join(home, '.clawdbot');
    } else {
      console.error('No OpenClaw directory found. Use --state-dir to specify.');
      process.exit(1);
    }
  }

  return { channel, stateDir, writeEnv };
}

// ---------------------------------------------------------------------------
// .env writer — appends or replaces a KEY=VALUE line (host-side tokens only)
// ---------------------------------------------------------------------------

function writeEnvVar(envPath: string, key: string, value: string): void {
  let content = '';
  if (fs.existsSync(envPath)) content = fs.readFileSync(envPath, 'utf-8');

  const pattern = new RegExp(`^${key}=.*$`, 'm');
  const line = `${key}="${value}"`;

  if (pattern.test(content)) {
    content = content.replace(pattern, line);
  } else {
    content = content.trimEnd() + (content ? '\n' : '') + line + '\n';
  }

  fs.writeFileSync(envPath, content);
}

// ---------------------------------------------------------------------------
// Main
// ---------------------------------------------------------------------------

function main(): void {
  const { channel, stateDir, writeEnv } = parseArgs();

  // WhatsApp uses QR / pairing-code auth — there is no token to migrate.
  // Copying Baileys auth state across installs leaves stale encryption
  // sessions, so re-authenticate during setup instead.
  if (channel === 'whatsapp') {
    emitStatus({
      CHANNEL: 'whatsapp',
      HAS_CREDENTIAL: false,
      DESTINATION: 'none',
      NOTE: 'WhatsApp authenticates via QR / pairing code — no token to migrate. Authenticate during /setup with /add-whatsapp.',
    });
    return;
  }

  const fields = CHANNEL_FIELDS[channel];
  if (!fields) {
    emitStatus({
      CHANNEL: channel,
      HAS_CREDENTIAL: false,
      DESTINATION: 'none',
      NOTE: `Channel "${channel}" has no direct token mapping. Supported: telegram, discord, slack, whatsapp.`,
    });
    return;
  }

  const dotenvVars = parseDotenv(path.join(stateDir, '.env'));

  let config: Record<string, unknown> | null = null;
  for (const name of ['openclaw.json', 'clawdbot.json']) {
    const configPath = path.join(stateDir, name);
    if (fs.existsSync(configPath)) {
      try {
        config = parseJson5(fs.readFileSync(configPath, 'utf-8')) as Record<string, unknown>;
        break;
      } catch {
        // try next
      }
    }
  }

  if (!config) {
    emitStatus({ CHANNEL: channel, HAS_CREDENTIAL: false, NOTE: 'Could not load openclaw.json' });
    return;
  }

  const channels = (config.channels as Record<string, unknown> | undefined) ?? {};
  const channelConfig = (channels[channel] as Record<string, unknown> | undefined) ?? {};

  // Resolve every token field for this channel.
  const results: Array<{
    resolved: string | null;
    masked: string;
    source: string;
    note?: string;
    envVar: string;
  }> = [];

  const envVars = channelEnvVars(channel);

  for (let i = 0; i < fields.length; i++) {
    const field = fields[i];

    let rawValue = channelConfig[field];
    if (!rawValue && channelConfig.accounts) {
      const accounts = channelConfig.accounts as Record<string, unknown>;
      const firstAccount = Object.values(accounts)[0] as Record<string, unknown> | undefined;
      if (firstAccount) rawValue = firstAccount[field];
    }

    const { resolved, source, note } = resolveSecretInput(rawValue, dotenvVars, process.env);
    const dest = classifyCredential(channel, i);
    results.push({
      resolved,
      masked: resolved ? maskCredential(resolved) : '',
      source,
      note,
      envVar: dest?.envVar ?? envVars[i] ?? '',
    });
  }

  // Channel tokens are host-side: write them to .env when --write-env is set.
  let written = 0;
  if (writeEnv) {
    for (const r of results) {
      if (r.resolved && r.envVar) {
        writeEnvVar(writeEnv, r.envVar, r.resolved);
        written++;
      }
    }
  }

  const primary = results[0];
  const out: Record<string, string | number | boolean> = {
    CHANNEL: channel,
    DESTINATION: 'env',
    HAS_CREDENTIAL: !!primary.resolved,
    CREDENTIAL_SOURCE: primary.source,
    CREDENTIAL_MASKED: primary.masked || 'none',
    NANOCLAW_ENV_VAR: primary.envVar,
  };
  if (writeEnv && written > 0) {
    out.WRITTEN_TO = writeEnv;
    out.WRITTEN_COUNT = written;
  }
  if (primary.note) out.NOTE = primary.note;

  // Additional tokens (Slack carries bot + app).
  for (let i = 1; i < results.length; i++) {
    const extra = results[i];
    const suffix = `_${i + 1}`;
    out[`HAS_CREDENTIAL${suffix}`] = !!extra.resolved;
    out[`CREDENTIAL_SOURCE${suffix}`] = extra.source;
    out[`CREDENTIAL_MASKED${suffix}`] = extra.masked || 'none';
    out[`NANOCLAW_ENV_VAR${suffix}`] = extra.envVar;
    if (extra.note) out[`NOTE${suffix}`] = extra.note;
  }

  emitStatus(out);
}

main();

/**
 * Tests for the OpenClaw → NanoClaw v2 transforms.
 *
 * These are the skill's riskiest shipped code: the credential-routing decision
 * (vault vs .env) and the cron → v2 recurrence mapping. They guard the skill's
 * two real integration assumptions about NanoClaw v2:
 *
 *   1. Container-facing credentials go to the OneCLI vault — never threaded
 *      into a container env var. Channel tokens stay in `.env` for the host.
 *   2. Recurring tasks are `messages_in` rows carrying a cron `recurrence`
 *      plus a `process_after` first-run timestamp — the exact shape the host
 *      recurrence sweep consumes (src/modules/scheduling/recurrence.ts).
 *
 * The cron test imports the real `cron-parser` (the same `CronExpressionParser`
 * the recurrence sweep uses) unmocked, so a missing/renamed dependency turns
 * the test red — that's the dependency integration guard.
 */
import { describe, expect, it } from 'vitest';
import { CronExpressionParser } from 'cron-parser';

import {
  approximateIntervalAsCron,
  channelEnvVars,
  classifyCredential,
  mapCronToRecurrence,
  maskCredential,
  resolveSecretInput,
  vaultCreateCommand,
  type OpenClawSchedule,
} from './transform.js';

// The same cron-parser call the host recurrence sweep makes, used as the
// injected `computeNextCron` so the mapping test mirrors production behavior.
function computeNextCron(expr: string, tz?: string): string {
  return CronExpressionParser.parse(expr, { tz: tz ?? 'UTC' }).next().toISOString();
}

describe('resolveSecretInput', () => {
  it('returns a plain literal value', () => {
    const r = resolveSecretInput('123:ABC-token', {});
    expect(r).toEqual({ resolved: '123:ABC-token', source: 'plain' });
  });

  it('resolves a "${ENV}" template from the state-dir .env', () => {
    const r = resolveSecretInput('${TELEGRAM_BOT_TOKEN}', { TELEGRAM_BOT_TOKEN: 'tok-1' });
    expect(r.resolved).toBe('tok-1');
    expect(r.source).toBe('env_template');
  });

  it('resolves a SecretRef {source:"env"} from the process env fallback', () => {
    const r = resolveSecretInput({ source: 'env', id: 'X_KEY' }, {}, { X_KEY: 'from-proc' });
    expect(r.resolved).toBe('from-proc');
    expect(r.source).toBe('env_ref');
  });

  it('cannot auto-extract file/exec SecretRefs and explains why', () => {
    const file = resolveSecretInput({ source: 'file', id: '/secrets/tok' }, {});
    expect(file.resolved).toBeNull();
    expect(file.source).toBe('file_ref');
    expect(file.note).toContain('cannot auto-extract');

    const exec = resolveSecretInput({ source: 'exec', id: 'op read ...' }, {});
    expect(exec.resolved).toBeNull();
    expect(exec.source).toBe('exec_ref');
  });

  it('reports missing for empty/absent values', () => {
    expect(resolveSecretInput(undefined, {}).source).toBe('missing');
    expect(resolveSecretInput('', {}).source).toBe('missing');
  });
});

describe('maskCredential', () => {
  it('shows first 4 + ... + last 4 for long values', () => {
    expect(maskCredential('sk-ant-abcdefgh1234')).toBe('sk-a...1234');
  });
  it('fully masks short values', () => {
    expect(maskCredential('short')).toBe('****');
  });
});

describe('classifyCredential — vault vs .env routing', () => {
  it('routes container-facing Anthropic credentials to the OneCLI vault', () => {
    const d = classifyCredential('anthropic');
    expect(d).toEqual({
      destination: 'vault',
      plan: { name: 'Anthropic', type: 'anthropic', hostPattern: 'api.anthropic.com' },
    });
  });

  it('routes container-facing OpenAI credentials to the vault as api_key', () => {
    const d = classifyCredential('openai');
    expect(d?.destination).toBe('vault');
    expect(d?.plan?.type).toBe('api_key');
    expect(d?.plan?.hostPattern).toBe('api.openai.com');
  });

  it('keeps host-side channel tokens in .env, never the vault', () => {
    expect(classifyCredential('telegram')).toEqual({
      destination: 'env',
      envVar: 'TELEGRAM_BOT_TOKEN',
    });
    expect(classifyCredential('discord')).toEqual({
      destination: 'env',
      envVar: 'DISCORD_BOT_TOKEN',
    });
  });

  it('selects the right env var for multi-token channels (Slack bot + app)', () => {
    expect(classifyCredential('slack', 0)?.envVar).toBe('SLACK_BOT_TOKEN');
    expect(classifyCredential('slack', 1)?.envVar).toBe('SLACK_APP_TOKEN');
  });

  it('exposes the full channel env-var list', () => {
    expect(channelEnvVars('slack')).toEqual(['SLACK_BOT_TOKEN', 'SLACK_APP_TOKEN']);
    expect(channelEnvVars('telegram')).toEqual(['TELEGRAM_BOT_TOKEN']);
    expect(channelEnvVars('whatsapp')).toEqual([]);
  });

  it('returns null for unknown credential kinds', () => {
    expect(classifyCredential('nonexistent')).toBeNull();
  });
});

describe('vaultCreateCommand', () => {
  it('renders the onecli secrets create command for a vault plan', () => {
    const plan = { name: 'Anthropic', type: 'anthropic' as const, hostPattern: 'api.anthropic.com' };
    expect(vaultCreateCommand(plan, 'sk-ant-xyz')).toBe(
      'onecli secrets create --name Anthropic --type anthropic --value sk-ant-xyz --host-pattern api.anthropic.com',
    );
  });
});

describe('mapCronToRecurrence — v2 task shape', () => {
  it('maps a cron schedule to recurrence=expr + next-fire processAfter', () => {
    const schedule: OpenClawSchedule = { kind: 'cron', expr: '0 9 * * 1-5', tz: 'UTC' };
    const r = mapCronToRecurrence(schedule, { computeNextCron });
    expect(r.recurrence).toBe('0 9 * * 1-5');
    // processAfter must be the next 09:00 UTC the real cron-parser computes.
    expect(r.processAfter).toBe(computeNextCron('0 9 * * 1-5', 'UTC'));
    expect(r.notes).toEqual([]);
  });

  it('maps an "at" schedule to a one-shot task (null recurrence)', () => {
    const at = '2030-01-01T12:00:00.000Z';
    const r = mapCronToRecurrence({ kind: 'at', at }, { computeNextCron });
    expect(r.processAfter).toBe(at);
    expect(r.recurrence).toBeNull();
  });

  it('approximates a clean fixed interval as cron and flags it', () => {
    const now = Date.parse('2026-01-01T00:00:00.000Z');
    const r = mapCronToRecurrence({ kind: 'every', everyMs: 15 * 60 * 1000 }, { computeNextCron, now });
    expect(r.recurrence).toBe('*/15 * * * *');
    expect(r.processAfter).toBe('2026-01-01T00:15:00.000Z');
    expect(r.notes[0]).toContain('approximated as cron');
  });

  it('leaves a non-divisible interval one-shot and flags it for the user', () => {
    const r = mapCronToRecurrence({ kind: 'every', everyMs: 90 * 1000 }, { computeNextCron });
    expect(r.recurrence).toBeNull();
    expect(r.notes[0]).toContain('no clean cron equivalent');
  });
});

describe('approximateIntervalAsCron', () => {
  it('maps minute intervals that divide 60', () => {
    expect(approximateIntervalAsCron(5 * 60000)).toBe('*/5 * * * *');
    expect(approximateIntervalAsCron(30 * 60000)).toBe('*/30 * * * *');
  });
  it('maps hour intervals that divide 24', () => {
    expect(approximateIntervalAsCron(60 * 60000)).toBe('0 */1 * * *');
    expect(approximateIntervalAsCron(6 * 60 * 60000)).toBe('0 */6 * * *');
  });
  it('maps daily to midnight', () => {
    expect(approximateIntervalAsCron(24 * 60 * 60000)).toBe('0 0 * * *');
  });
  it('returns null for intervals with no clean cron form', () => {
    expect(approximateIntervalAsCron(90 * 1000)).toBeNull(); // 90s
    expect(approximateIntervalAsCron(7 * 60 * 60000)).toBeNull(); // 7h
    expect(approximateIntervalAsCron(0)).toBeNull();
  });
});

/**
 * Pure transforms that map OpenClaw config into NanoClaw v2 shapes.
 *
 * Two transforms, both deterministic and side-effect free so they can be
 * unit-tested in isolation (see transform.test.ts):
 *
 *   1. resolveSecretInput + classifyCredential — turn an OpenClaw config
 *      credential (plain string, "${ENV}" template, or SecretRef object) into
 *      a resolved value plus a routing decision: container-facing credentials
 *      go to the OneCLI vault (a `secrets create` plan); host-side channel
 *      tokens stay in `.env` (the NanoClaw host process reads them to connect
 *      to the messaging platform). Credentials are never threaded into a
 *      container via env vars.
 *
 *   2. mapCronToRecurrence — turn an OpenClaw cron job's `schedule` into the
 *      v2 task representation: a `messages_in` row with `kind='task'`, a
 *      `process_after` ISO timestamp (first run), and a `recurrence` cron
 *      expression for repeating jobs. There is no `scheduled_tasks` table in
 *      v2 — tasks live in the per-session `inbound.db`.
 */

// ---------------------------------------------------------------------------
// Credential resolution
// ---------------------------------------------------------------------------

/** OpenClaw SecretRef — a credential stored indirectly. */
export interface SecretRef {
  source: string; // "env" | "file" | "exec" | ...
  provider?: string;
  id: string;
}

export interface ResolvedSecret {
  /** The credential value, or null when it can't be auto-extracted. */
  resolved: string | null;
  /** How the value was sourced — for the status block / explanation. */
  source:
    | 'missing'
    | 'plain'
    | 'env_template'
    | 'env_ref'
    | 'file_ref'
    | 'exec_ref'
    | 'unknown';
  /** Human-readable note when a value couldn't be resolved. */
  note?: string;
}

/**
 * Resolve an OpenClaw credential input to a concrete string when possible.
 *
 * Accepts:
 *   - a plain literal:            "123:ABC-token"
 *   - an env template:            "${TELEGRAM_BOT_TOKEN}"
 *   - a SecretRef object:         { source: "env", id: "TELEGRAM_BOT_TOKEN" }
 *
 * `dotenvVars` is the parsed `<state-dir>/.env`; `processEnv` is consulted as
 * a fallback. `file`/`exec` SecretRefs can't be auto-extracted — they return
 * `resolved: null` with an explanatory note so the caller prompts the user.
 */
export function resolveSecretInput(
  value: unknown,
  dotenvVars: Record<string, string>,
  processEnv: Record<string, string | undefined> = {},
): ResolvedSecret {
  if (value === undefined || value === null || value === '') {
    return { resolved: null, source: 'missing' };
  }

  if (typeof value === 'string') {
    const envMatch = value.match(/^\$\{([^}]+)\}$/);
    if (envMatch) {
      const envKey = envMatch[1];
      const envVal = dotenvVars[envKey] ?? processEnv[envKey] ?? null;
      if (envVal) return { resolved: envVal, source: 'env_template' };
      return {
        resolved: null,
        source: 'env_template',
        note: `Environment variable ${envKey} not found in <state-dir>/.env or the environment`,
      };
    }
    return { resolved: value, source: 'plain' };
  }

  if (typeof value === 'object') {
    const ref = value as SecretRef;
    if (ref.source === 'env') {
      const envVal = dotenvVars[ref.id] ?? processEnv[ref.id] ?? null;
      if (envVal) return { resolved: envVal, source: 'env_ref' };
      return {
        resolved: null,
        source: 'env_ref',
        note: `Environment variable ${ref.id} not found in <state-dir>/.env or the environment`,
      };
    }
    if (ref.source === 'file') {
      return {
        resolved: null,
        source: 'file_ref',
        note: `File-based secret (${ref.id}) — cannot auto-extract, enter it manually`,
      };
    }
    if (ref.source === 'exec') {
      return {
        resolved: null,
        source: 'exec_ref',
        note: `Exec-based secret (${ref.id}) — cannot auto-extract, enter it manually`,
      };
    }
  }

  return { resolved: null, source: 'unknown' };
}

/** Mask a credential for display: first 4 + "..." + last 4. */
export function maskCredential(value: string): string {
  if (value.length < 10) return '****';
  return `${value.slice(0, 4)}...${value.slice(-4)}`;
}

/**
 * Where a resolved credential belongs in NanoClaw v2.
 *
 *   - 'vault'   → a container-facing credential the agent uses for outbound
 *                 HTTPS (Anthropic, OpenAI, etc.). It goes to the OneCLI Agent
 *                 Vault, which injects it per-request — never into the
 *                 container env. The plan field carries the `onecli secrets
 *                 create` argument set.
 *   - 'env'     → a host-side channel token (Telegram/Discord/Slack bot
 *                 tokens). The NanoClaw *host* process reads it from `.env` to
 *                 connect to the messaging platform; it never enters a
 *                 container, so the vault is not involved.
 */
export interface VaultPlan {
  /** `onecli secrets create --name` */
  name: string;
  /** `onecli secrets create --type` — 'anthropic' or 'api_key'. */
  type: 'anthropic' | 'api_key';
  /** `onecli secrets create --host-pattern` — the API host the agent calls. */
  hostPattern: string;
}

export interface CredentialDestination {
  destination: 'vault' | 'env';
  /** For 'env' destinations: the NanoClaw .env variable name. */
  envVar?: string;
  /** For 'vault' destinations: the `onecli secrets create` plan. */
  plan?: VaultPlan;
}

/**
 * Container-facing credentials → OneCLI vault. Keyed by a stable credential
 * kind the caller derives from the OpenClaw provider/profile (e.g. an
 * Anthropic auth profile, an OpenAI plugin key).
 */
const VAULT_CREDENTIALS: Record<string, VaultPlan> = {
  anthropic: { name: 'Anthropic', type: 'anthropic', hostPattern: 'api.anthropic.com' },
  openai: { name: 'OpenAI', type: 'api_key', hostPattern: 'api.openai.com' },
};

/**
 * Host-side channel tokens → NanoClaw `.env`. The host process (not the
 * container) reads these to connect to the messaging platform.
 */
const CHANNEL_ENV_VARS: Record<string, string[]> = {
  telegram: ['TELEGRAM_BOT_TOKEN'],
  discord: ['DISCORD_BOT_TOKEN'],
  slack: ['SLACK_BOT_TOKEN', 'SLACK_APP_TOKEN'],
};

/**
 * Classify a credential by kind and decide its NanoClaw destination.
 *
 * `kind` is either a channel name (telegram/discord/slack) for a host-side
 * channel token, or a vault credential key (anthropic/openai) for a
 * container-facing API credential. `index` selects which env var for channels
 * that carry more than one token (Slack: bot + app).
 */
export function classifyCredential(
  kind: string,
  index = 0,
): CredentialDestination | null {
  const vault = VAULT_CREDENTIALS[kind];
  if (vault) {
    return { destination: 'vault', plan: vault };
  }
  const envVars = CHANNEL_ENV_VARS[kind];
  if (envVars && envVars[index]) {
    return { destination: 'env', envVar: envVars[index] };
  }
  return null;
}

/** Channel names whose host token is read from `.env` by the host process. */
export function channelEnvVars(channel: string): string[] {
  return CHANNEL_ENV_VARS[channel] ?? [];
}

/**
 * Render a OneCLI vault plan into the exact command the operator runs.
 * The credential value is passed through unmasked here because the caller
 * runs the command directly — it must never be echoed to a chat transcript.
 */
export function vaultCreateCommand(plan: VaultPlan, value: string): string {
  return [
    'onecli secrets create',
    `--name ${plan.name}`,
    `--type ${plan.type}`,
    `--value ${value}`,
    `--host-pattern ${plan.hostPattern}`,
  ].join(' ');
}

// ---------------------------------------------------------------------------
// Cron → v2 recurrence mapping
// ---------------------------------------------------------------------------

/** OpenClaw cron schedule shapes (from its `src/cron/types.ts`). */
export type OpenClawSchedule =
  | { kind: 'cron'; expr: string; tz?: string }
  | { kind: 'every'; everyMs: number }
  | { kind: 'at'; at: string };

/**
 * The v2 task shape. A task is a `messages_in` row with `kind='task'`:
 *
 *   - processAfter  → ISO 8601 timestamp for the first/next run.
 *   - recurrence    → cron expression for repeating tasks; null for one-shot.
 *
 * The host's recurrence sweep (src/modules/scheduling/recurrence.ts) reads the
 * cron in `recurrence`, computes the next run via cron-parser in the user's
 * timezone, and clones a fresh pending row forward. One-shot tasks have a null
 * recurrence and are marked completed after running.
 */
export interface V2TaskSchedule {
  processAfter: string;
  recurrence: string | null;
  /** Notes about anything that didn't map cleanly. */
  notes: string[];
}

/**
 * Map an OpenClaw schedule to the v2 task representation.
 *
 *   - kind:"cron"  → recurrence = expr; processAfter = next fire of expr.
 *                    Needs `computeNextCron` (cron-parser) injected so this
 *                    function stays pure / synchronously testable.
 *   - kind:"every" → recurrence = null; v2 has no fixed-interval recurrence,
 *                    so an interval is approximated as the nearest cron when
 *                    it divides evenly into minutes/hours, else flagged for
 *                    the user. processAfter = now + everyMs.
 *   - kind:"at"    → one-shot; recurrence = null; processAfter = the ISO `at`.
 *
 * `now` is injected (defaults to current time) for deterministic tests.
 */
export function mapCronToRecurrence(
  schedule: OpenClawSchedule,
  opts: {
    computeNextCron: (expr: string, tz?: string) => string;
    now?: number;
  },
): V2TaskSchedule {
  const now = opts.now ?? Date.now();
  const notes: string[] = [];

  if (schedule.kind === 'cron') {
    const processAfter = opts.computeNextCron(schedule.expr, schedule.tz);
    return { processAfter, recurrence: schedule.expr, notes };
  }

  if (schedule.kind === 'at') {
    return { processAfter: schedule.at, recurrence: null, notes };
  }

  // kind === 'every' — approximate a fixed interval as a cron expression.
  const everyMs = schedule.everyMs;
  const processAfter = new Date(now + everyMs).toISOString();
  const approx = approximateIntervalAsCron(everyMs);
  if (approx) {
    notes.push(
      `OpenClaw fixed interval (every ${everyMs}ms) approximated as cron "${approx}". v2 recurrence is cron-based; confirm this matches intent.`,
    );
    return { processAfter, recurrence: approx, notes };
  }
  notes.push(
    `OpenClaw fixed interval (every ${everyMs}ms) has no clean cron equivalent. Set a cron expression manually, or keep it one-shot.`,
  );
  return { processAfter, recurrence: null, notes };
}

/**
 * Approximate a millisecond interval as a cron expression when it lands on a
 * whole number of minutes or hours that divides evenly. Returns null when
 * there's no clean cron form (e.g. every 90 seconds).
 */
export function approximateIntervalAsCron(everyMs: number): string | null {
  if (everyMs <= 0) return null;
  const minutes = everyMs / 60000;
  if (!Number.isInteger(minutes) || minutes < 1) return null;

  if (minutes < 60) {
    // Every N minutes — only clean when N divides 60.
    if (60 % minutes === 0) return `*/${minutes} * * * *`;
    return null;
  }

  const hours = minutes / 60;
  if (Number.isInteger(hours)) {
    if (hours === 24) return '0 0 * * *';
    if (24 % hours === 0) return `0 */${hours} * * *`;
    return null;
  }

  return null;
}