/**
 * HTTP headers attached to every server-to-coordinator request.
 *
 * The coordinator is a Cloudflare Worker (`deepline-play-coordinator-*`) that
 * we publish through Cloudflare's Versions + Deployments primitives. Whenever
 * a deployment is split across two versions (e.g. 10% canary), Cloudflare
 * uses the `Cloudflare-Workers-Version-Key` header to pick a stable version
 * per request. Sending the runId as the key keeps every request for one play
 * run pinned to whichever version started the run, so a partial rollout
 * cannot strand a Workflow's `/submit` and `/result` calls on different
 * code versions.
 *
 * The header is harmless when there is only one active version (the default).
 */
export const COORDINATOR_VERSION_KEY_HEADER = 'Cloudflare-Workers-Version-Key';
export const COORDINATOR_VERSION_OVERRIDES_HEADER =
  'Cloudflare-Workers-Version-Overrides';
/**
 * Shared secret the coordinator uses to authenticate dispatcher (Vercel app)
 * traffic. The coordinator also sanity-checks `x-deepline-run-scope` matches
 * the run id encoded in the URL path on cancel/signal so a leaked token
 * cannot be retargeted to arbitrary runs.
 */
export const COORDINATOR_INTERNAL_TOKEN_HEADER = 'x-deepline-internal-token';
export const COORDINATOR_RUN_SCOPE_HEADER = 'x-deepline-run-scope';
export const COORDINATOR_URL_OVERRIDE_HEADER = 'x-deepline-coordinator-url';
export const WORKER_CALLBACK_URL_OVERRIDE_HEADER =
  'x-deepline-worker-callback-url';
export const RUNTIME_SCHEDULER_SCHEMA_OVERRIDE_HEADER =
  'x-deepline-runtime-scheduler-schema';
/**
 * CLI-to-app credential used only to authorize a typed runtime-environment
 * selection. It is deliberately separate from the coordinator credential:
 * selecting an approved environment must not grant access to runtime callbacks.
 */
export const RUNTIME_ENVIRONMENT_TOKEN_HEADER =
  'x-deepline-runtime-environment-token';
/**
 * Internal top-level `profile=absurd` launches, including deploy canaries, use
 * this header to pin an exact candidate release before activation. Public API
 * keys cannot use it. When absent, the resolver chooses the registered lane.
 */
export const ABSURD_RELEASE_OVERRIDE_HEADER = 'x-deepline-absurd-release';
/**
 * CLI→app marker (NOT a coordinator header — it lives here only because both
 * the SDK HTTP client and the run route already import this module). Set by
 * automated test harnesses (e.g. `tests/v2-plays`) so their intentionally
 * failing plays — depth-guard probes, error-path scenarios — do not page the
 * SDK CLI error channel as if a real customer run had failed. The run route
 * honors it ONLY in non-prod (see run/route.ts); a forged header from a real
 * prod customer can never suppress their own failure alerts.
 */
export const SYNTHETIC_RUN_HEADER = 'x-deepline-synthetic-run';

let warnedAboutMissingInternalToken = false;

function resolveInternalCoordinatorToken(): string | null {
  // Read lazily so the helper is safe to import in environments without
  // env access (e.g. workerd build-time bundling).
  const fromEnv =
    (typeof process !== 'undefined' &&
      process?.env?.DEEPLINE_INTERNAL_TOKEN?.trim()) ||
    null;
  if (fromEnv) return fromEnv;
  if (!warnedAboutMissingInternalToken) {
    warnedAboutMissingInternalToken = true;
    // Dev convenience: log once. The coordinator may be running without the
    // token enforced too, so this is not fatal — let the call proceed and
    // surface any 401/403 from the coordinator instead of failing closed.
    if (typeof console !== 'undefined') {
      console.warn(
        '[plays] DEEPLINE_INTERNAL_TOKEN unset; coordinator calls will fail if the coordinator is enforcing it.',
      );
    }
  }
  return null;
}

export function coordinatorRequestHeaders(input: {
  runId: string;
  contentType?: string | null;
  internalToken?: string | null;
  runtimeDeployVersion?: string | null;
  coordinatorWorkerName?: string | null;
  /**
   * When set, the coordinator validates this matches the runId in the URL.
   * Pass the runId on `/cancel` / `/signal` calls so a leaked dispatcher
   * token cannot be retargeted to a different run.
   */
  runScope?: string | null;
}): Record<string, string> {
  const headers: Record<string, string> = {};
  if (input.contentType) {
    headers['content-type'] = input.contentType;
  }
  const trimmed = input.runId.trim();
  if (trimmed) {
    headers[COORDINATOR_VERSION_KEY_HEADER] = trimmed;
  }
  const runtimeDeployVersion = input.runtimeDeployVersion?.trim();
  const coordinatorWorkerName = input.coordinatorWorkerName?.trim();
  if (
    runtimeDeployVersion &&
    coordinatorWorkerName &&
    /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(
      runtimeDeployVersion,
    ) &&
    /^[A-Za-z0-9_-]+$/.test(coordinatorWorkerName)
  ) {
    headers[COORDINATOR_VERSION_OVERRIDES_HEADER] =
      `${coordinatorWorkerName}="${runtimeDeployVersion}"`;
  }
  const internalToken =
    input.internalToken?.trim() || resolveInternalCoordinatorToken();
  if (internalToken) {
    headers[COORDINATOR_INTERNAL_TOKEN_HEADER] = internalToken;
  }
  const scope = input.runScope?.trim() || trimmed;
  if (scope) {
    headers[COORDINATOR_RUN_SCOPE_HEADER] = scope;
  }
  return headers;
}