Made of little things.

import {
    APP_DATA_KIND,
    APP_DATA_PROFILE,
    APP_DATA_MAX_BYTES,
    dataIdentifier,
    dataTags,
    decodeDataRecord,
    validateDataJson,
    type DataBody,
    type DataEvent,
    type DataPolicy,
    type DataTemplate,
} from './app-data-contract.js';

/** Works through the injected NAP APIs; contains no transport or signing key. */
export type AppDataHost = {
    shell: {
        onReady(callback: (environment: { capabilities?: { appData?: DataPolicy } }) => void): {
            close(): void;
        };
    };
    identity: { getPublicKey(): Promise<string> };
    outbox: {
        query(
            filters: Record<string, unknown>[],
            options?: { relays?: string[]; timeoutMs?: number },
        ): Promise<{
            events: { event: DataEvent }[];
            incomplete?: boolean;
            error?: string;
        }>;
        publish(
            template: DataTemplate,
            options?: { relays?: string[]; toOutbox?: boolean },
        ): Promise<{
            ok: boolean;
            event?: DataEvent;
            error?: string;
            relays?: Record<string, boolean>;
        }>;
    };
};
export type AppRecord<T> = {
    id: string;
    author: string;
    scope: string;
    collection: string;
    title: string;
    revision: string;
    createdAt: number;
    deleted: boolean;
    data: T | null;
    event: DataEvent;
};

/** Default public collection. validate must reject malformed application payloads. */
export async function appDataCollection<T>(options: {
    collection: string;
    schema: string;
    version: number;
    validate(data: unknown): T;
    host?: AppDataHost;
    relays?: string[];
}) {
    const host = options.host ?? (globalThis as unknown as { napplet: AppDataHost }).napplet;
    if (!host?.shell?.onReady || !host.outbox || !host.identity)
        throw new Error(
            'app-data-unavailable: this host needs shell, outbox and identity support.',
        );
    // Observe the host's existing initialization; never initiate an app-owned handshake.
    const policy = await new Promise<DataPolicy | undefined>((resolve, reject) => {
        let subscription: { close(): void } | undefined,
            settled = false;
        const timeout = setTimeout(() => {
            subscription?.close();
            reject(
                new Error(
                    'app-data-unavailable: host initialization did not finish. Keep drafts locally and retry.',
                ),
            );
        }, 5000);
        subscription = host.shell.onReady((environment) => {
            settled = true;
            clearTimeout(timeout);
            subscription?.close();
            resolve(environment.capabilities?.appData);
        });
        if (settled) subscription.close();
    });
    if (policy?.profile !== APP_DATA_PROFILE)
        throw new Error(
            'app-data-unavailable: update soyLI or use a host supporting soy.app-data/1. Keep drafts locally.',
        );
    const relays = options.relays ?? policy.defaultRelays;
    if (!Array.isArray(relays) || !relays.length || relays.length > 8)
        throw new Error('app-data-no-relays: choose a storage relay in host Network settings.');
    dataIdentifier(policy.scope, options.collection, 'check');
    // Validate the declaration through the same wire contract used by readers/hosts.
    decodeDataRecord({
        kind: APP_DATA_KIND,
        tags: dataTags(policy.scope, options.collection, 'check', options.schema, options.version),
        content: JSON.stringify({
            schema: options.schema,
            version: options.version,
            title: 'Check',
            previous: null,
            deleted: false,
            data: null,
        }),
    });

    const decode = (event: DataEvent): AppRecord<T> => {
        const { scope, collection, id, body } = decodeDataRecord(event);
        if (
            body.schema !== options.schema ||
            body.version !== options.version ||
            collection !== options.collection
        )
            throw new Error(
                'app-data-incompatible: this record uses another collection or schema version.',
            );
        return {
            id,
            author: event.pubkey,
            scope,
            collection,
            title: body.title,
            revision: event.id,
            createdAt: event.created_at,
            deleted: body.deleted,
            data: body.deleted ? null : options.validate(body.data),
            event,
        };
    };
    const query = async (filters: Record<string, unknown>[]) => {
        const result = await host.outbox.query(filters, { relays, timeoutMs: 8000 });
        if (result.error) throw new Error(result.error);
        return result;
    };
    const newest = (events: DataEvent[]) =>
        events.sort((a, b) => b.created_at - a.created_at || a.id.localeCompare(b.id));

    return {
        policy,
        relays,
        /** At most 100 records/page. until is inclusive; deduplicate revisions between pages. */
        async list(input: { limit?: number; until?: number; scope?: string } = {}) {
            const scope = input.scope ?? policy.scope;
            dataIdentifier(scope, options.collection, 'check');
            const limit = input.limit ?? 40;
            if (
                !Number.isSafeInteger(limit) ||
                limit < 1 ||
                limit > 100 ||
                (input.until !== undefined &&
                    (!Number.isSafeInteger(input.until) || input.until < 0))
            )
                throw new Error(
                    'app-data-invalid-query: limit must be 1–100 and until a Unix timestamp.',
                );
            // Do not filter version/title/deleted: an incompatible replacement must hide its older value.
            const result = await query([
                {
                    kinds: [APP_DATA_KIND],
                    '#s': [scope],
                    '#c': [options.collection],
                    '#L': [APP_DATA_PROFILE],
                    limit,
                    ...(input.until === undefined ? {} : { until: input.until }),
                },
            ]);
            const heads = new Map<string, DataEvent>();
            for (const { event } of result.events) {
                const d = event.tags.find((t) => t[0] === 'd')?.[1];
                if (
                    event.kind !== APP_DATA_KIND ||
                    !d?.startsWith(`${APP_DATA_PROFILE}:${scope}:${options.collection}:`)
                )
                    continue;
                const key = `${event.pubkey}:${d}`;
                const old = heads.get(key);
                if (!old || newest([old, event])[0] === event) heads.set(key, event);
            }
            const events = newest([...heads.values()]).slice(0, limit);
            const records: AppRecord<T>[] = [];
            let invalid = 0;
            for (const event of events) {
                try {
                    const record = decode(event);
                    if (!record.deleted) records.push(record);
                } catch {
                    invalid++;
                }
            }
            return {
                records,
                incomplete: !!result.incomplete,
                invalid,
                // Not a guaranteed global cursor. Same-second collisions require narrower queries.
                nextUntil: events.length >= limit ? events.at(-1)!.created_at : null,
            };
        },
        async get(author: string, id: string, scope = policy.scope) {
            if (!/^[a-f0-9]{64}$/.test(author))
                throw new Error('app-data-invalid-author: expected a public key.');
            const d = dataIdentifier(scope, options.collection, id);
            const result = await query([
                { kinds: [APP_DATA_KIND], authors: [author], '#d': [d], limit: 1 },
            ]);
            const event = newest(
                result.events
                    .map((r) => r.event)
                    .filter(
                        (e) =>
                            e.kind === APP_DATA_KIND &&
                            e.pubkey === author &&
                            e.tags.some((t) => t[0] === 'd' && t[1] === d),
                    ),
            )[0];
            return { record: event ? decode(event) : null, incomplete: !!result.incomplete };
        },
        /** Keep this change object for Retry: it always sends the same event template. */
        async prepare(input: {
            id: string;
            title: string;
            data?: T;
            base: AppRecord<T> | null;
            deleted?: boolean;
        }) {
            const author = await host.identity.getPublicKey();
            if (!/^[a-f0-9]{64}$/.test(author))
                throw new Error('not-signed-in: connect a viewer identity to publish.');
            const { base } = input;
            if (
                base &&
                (base.author !== author ||
                    base.scope !== policy.scope ||
                    base.collection !== options.collection ||
                    base.id !== input.id)
            )
                throw new Error(
                    'app-data-owner-mismatch: copy this creation to a new ID to make it your own.',
                );
            const body: DataBody = {
                schema: options.schema,
                version: options.version,
                title: input.title,
                previous: base?.revision ?? null,
                deleted: input.deleted ?? false,
                data: null,
            };
            if (!body.deleted) {
                const data = options.validate(input.data);
                validateDataJson(data);
                body.data = data;
            }
            const template: DataTemplate = {
                kind: APP_DATA_KIND,
                created_at: Math.max(Math.floor(Date.now() / 1000), (base?.createdAt ?? 0) + 1),
                tags: dataTags(
                    policy.scope,
                    options.collection,
                    input.id,
                    options.schema,
                    options.version,
                ),
                content: JSON.stringify(body),
            };
            decodeDataRecord(template);
            if (
                new TextEncoder().encode(template.content).length >
                Math.min(policy.maxContentBytes, APP_DATA_MAX_BYTES)
            )
                throw new Error(
                    'app-data-too-large: store the large payload on Blossom and publish its URL/hash.',
                );
            return {
                template: structuredClone(template),
                async publish() {
                    if ((await host.identity.getPublicKey()) !== author)
                        throw new Error(
                            'app-data-identity-changed: prepare the change again with the selected identity.',
                        );
                    const result = await host.outbox.publish(structuredClone(template), {
                        relays,
                        toOutbox: false,
                    });
                    if (!result.ok || !result.event)
                        throw new Error(
                            result.error ?? 'app-data-publish-failed: no signed record returned.',
                        );
                    if (
                        result.event.pubkey !== author ||
                        result.event.kind !== template.kind ||
                        result.event.created_at !== template.created_at ||
                        result.event.content !== template.content ||
                        JSON.stringify(result.event.tags) !== JSON.stringify(template.tags)
                    )
                        throw new Error(
                            'app-data-invalid-result: host returned a different record.',
                        );
                    return decode(result.event);
                },
            };
        },
    };
}