/**
 * Multideal safe seed script — idempotent, non-destructive.
 * Run: pnpm db:seed
 *
 * Does only:
 *   1. CREATE EXTENSION IF NOT EXISTS pgcrypto
 *   2. Upsert admin user (email+password, isAdmin=true)
 *   3. seedSupportSystemConfig (idempotent)
 *   4. seedSupportKb (idempotent)
 *
 * NO TRUNCATE. NO demo user/vendor generation.
 * For destructive demo reset: use pnpm db:reset-demo (guarded).
 *
 * Requires env vars: DATABASE_URL, PII_KEY
 */

import { scriptOutput } from '../lib/script-output.js';
import { drizzle } from 'drizzle-orm/neon-serverless';
import { Pool, neonConfig } from '@neondatabase/serverless';
import ws from 'ws';
import { sql } from 'drizzle-orm';
import { composedSchema } from './schema-composed.js';
import { setUserEmail } from './pii-write.js';
import { seedSupportSystemConfig } from './seeds/support-system-config.js';
import { seedSupportKb } from './seeds/support-kb.js';
import { seedVatSchedule } from './seeds/seed-vat-schedule.js';
import { createUserRecord, updatePasswordHashAndAdmin } from './queries/users.js';
import { readSeedDemoRuntimeEnv } from './seed-cli-env.js';

async function main() {
  const { DATABASE_URL, PII_KEY, PASSWORD_PEPPER_V1 } = readSeedDemoRuntimeEnv();

  neonConfig.webSocketConstructor = ws;
  const pool = new Pool({ connectionString: DATABASE_URL });
  const schema = composedSchema;
  const db = drizzle(pool, { schema });

  // ── 1. Enable pgcrypto ───────────────────────────────────────────────────────
  await db.execute(sql`CREATE EXTENSION IF NOT EXISTS pgcrypto`);

  // ── 2. Upsert admin user ─────────────────────────────────────────────────────
  const { hashPassword } = await import('../auth/credentials.js');
  const adminEmail = 'admin@example.dev';
  const adminPassword = 'OQPDnd9QCK6K-2DB@Multideal1';
  const adminPasswordHash = await hashPassword(adminPassword, PASSWORD_PEPPER_V1);

  const adminEmailPatch = await setUserEmail(adminEmail, PII_KEY);
  const adminEmailIndex = adminEmailPatch.emailIndex;
  if (!adminEmailIndex) throw new Error('admin email patch missing email index');

  const adminExists = await db.query.users.findFirst({
    where: (users, { eq }) => eq(users.emailIndex, adminEmailIndex),
    columns: { id: true },
  });
  if (adminExists) {
    await updatePasswordHashAndAdmin(db, adminExists.id, adminPasswordHash);
  } else {
    await createUserRecord(db, {
      ...adminEmailPatch,
      passwordHash: adminPasswordHash,
      isAdmin: true,
      avatarType: 'ICON',
      avatarValue: 'icon_1',
      purchaseCount: 0,
      accountState: 'ACTIVE',
    });
  }

  // ── 3. Support system config (idempotent) ────────────────────────────────────
  await seedSupportSystemConfig(db);

  // ── 4. Support KB (idempotent) ───────────────────────────────────────────────
  await seedSupportKb(db);

  // ── 5. IL VAT schedule baseline (idempotent) ─────────────────────────────────
  await seedVatSchedule(db);

  scriptOutput('seed: ok (admin + support + vat)');
  process.exit(0);
}

main().catch((err) => {
  console.error('Seed failed:', err);
  process.exit(1);
});