#!/bin/sh
set -u
umask 077

AMNEZIAWG="/usr/bin/amneziawg"

REFRESH="/root/hmn/hmn-refresh-pool-safe.sh"
DOWNLOAD="/root/hmn/hmn-download-all-awg.sh"
PLANNER="/usr/local/sbin/router-egress-hmn-plan-top5.sh"
RUNNER="/usr/local/sbin/router-egress-emergency-refresh.sh"

SCHEDULED_LOG="/root/hmn/logs/refresh-pool-safe-20260712-042000-16148.log"
SCHEDULED_BACKUP="/root/hmn/backups/refresh-safe-before-20260712-042000-16148"

fact() {
  printf '__FACT__ %s=%s\n' "$1" "$2"
}

block() {
  name="$1"
  shift

  echo "__BLOCK_BEGIN__ $name"
  "$@" 2>&1 || true
  echo "__BLOCK_END__ $name"
}

strict_iface() {
  interface="$1"
  attempt=1

  while [ "$attempt" -le 3 ]; do
    if ping -I "$interface" -c 1 -W 3 1.1.1.1 \
      >/dev/null 2>&1
    then
      return 0
    fi

    attempt=$((attempt + 1))
    sleep 1
  done

  return 1
}

for required in \
  "$AMNEZIAWG" \
  "$REFRESH" \
  "$DOWNLOAD" \
  "$PLANNER" \
  "$RUNNER"
do
  [ -f "$required" ] || {
    echo "__ERROR__ source_missing=$required"
    exit 21
  }
done

fact read_only true
fact snapshot_epoch "$(date +%s)"
fact vm101_utc "$(date -u '+%Y-%m-%dT%H:%M:%SZ')"

echo "__TRACE__ stage=disk"

block filesystem_usage df -Pk

block hmn_directory_sizes sh -c '
  du -sk \
    /root/hmn \
    /root/hmn/backups \
    /root/hmn/configs \
    /root/hmn/cache \
    /root/hmn/logs \
    /root/hmn/runs \
    /var/lib/router-egress-recovery \
    /tmp \
    2>/dev/null |
  sort -n
'

block largest_hmn_objects sh -c '
  find /root/hmn /var/lib/router-egress-recovery \
    -xdev \
    -type f \
    -exec du -k {} \; \
    2>/dev/null |
  sort -n |
  tail -n 120
'

block backup_directories sh -c '
  find /root/hmn/backups \
    -mindepth 1 \
    -maxdepth 1 \
    -type d \
    -exec du -sk {} \; \
    2>/dev/null |
  sort -n
'

echo "__TRACE__ stage=scheduled_failure"

block scheduled_cron_log sh -c '
  grep -A300 -B20 \
    "2026-07-12T04:20:00+00:00 === hmn-refresh-pool-safe start ===" \
    /root/hmn/logs/hmn-refresh-pool-cron.log \
    2>/dev/null ||
  true
'

block scheduled_detail_log cat "$SCHEDULED_LOG"

block scheduled_backup_listing sh -c "
  echo 'path=$SCHEDULED_BACKUP'

  if [ -d '$SCHEDULED_BACKUP' ]; then
    find '$SCHEDULED_BACKUP' \
      -maxdepth 3 \
      -printf '%y %s %p\n' \
      2>/dev/null |
    sort
  else
    echo BACKUP_DIRECTORY_NOT_PRESENT
  fi
"

echo "__TRACE__ stage=runtime"

HEALTHY=0

for interface in vpn1 vpn2 vpn3 vpn4 vpn5; do
  if strict_iface "$interface"; then
    strict=true
    HEALTHY=$((HEALTHY + 1))
  else
    strict=false
  fi

  fact "strict.${interface}" "$strict"

  line="$(
    "$AMNEZIAWG" show "$interface" dump 2>/dev/null |
      sed -n '2p'
  )"

  endpoint="$(
    printf '%s\n' "$line" |
      cut -f3
  )"

  handshake="$(
    printf '%s\n' "$line" |
      cut -f5
  )"

  fact "runtime_endpoint.${interface}" "${endpoint:-UNRESOLVED}"
  fact "runtime_handshake.${interface}" "${handshake:-0}"
done

fact healthy_slots "$HEALTHY"

block amneziawg_all_dump "$AMNEZIAWG" show all dump

block planner "$PLANNER"

block runner_dry_run "$RUNNER" --dry-run

block uci_endpoint_state sh -c '
  uci -q show network 2>/dev/null |
    grep -E \
      "^network\.vpn[1-5]=|wireguard_vpn[1-5].*endpoint_(host|port)=" |
    grep -vE \
      "private_key|preshared_key" ||
  true
'

block network_config_relevant sh -c '
  grep -nE \
    "config interface .vpn[1-5].|config wireguard_.vpn[1-5].|option endpoint_(host|port)" \
    /etc/config/network \
    2>/dev/null ||
  true
'

echo "__TRACE__ stage=source_contract"

block active_interface_detection sh -c '
  grep -RniE \
    "active VPN interface|active_iface|table 200|ip route.*200|default.*vpn|vpn[1-5].*active" \
    /root/hmn/*.sh \
    /usr/local/sbin/router-egress-*.sh \
    2>/dev/null ||
  true
'

block refresh_source_numbered sh -c '
  nl -ba /root/hmn/hmn-refresh-pool-safe.sh 2>/dev/null |
    sed -n "100,260p"
'

block download_source_numbered sh -c '
  nl -ba /root/hmn/hmn-download-all-awg.sh 2>/dev/null |
    sed -n "1,280p"
'

block planner_source_contract sh -c '
  grep -nE \
    "current|endpoint|uci|amneziawg|wg show|network|dump" \
    /usr/local/sbin/router-egress-hmn-plan-top5.sh \
    2>/dev/null ||
  true
'

block apply_source_contract sh -c '
  grep -nE \
    "slot_apply_failed|commit_failed|apply_ok|adapter|current|endpoint|exit|return" \
    /usr/local/sbin/router-egress-hmn-rebalance-top5-apply.sh \
    2>/dev/null ||
  true
'

echo "__TRACE__ stage=repair_history"

block emergency_log_recent sh -c '
  tail -n 1500 \
    /var/log/router-egress-emergency-refresh.log \
    2>/dev/null ||
  true
'

block repair_log_recent sh -c '
  logread 2>/dev/null |
    grep -Ei \
      "vpn[1-5]|health-repair|endpoint|repair|quarantine|rebalance" |
    tail -n 1500 ||
  true
'

block recent_recovery_artifacts sh -c '
  find /var/lib/router-egress-recovery \
    -maxdepth 5 \
    -type f \
    -mmin -1440 \
    -exec ls -l {} \; \
    2>/dev/null |
  sort
'

fact refresh_ran false
fact rebalance_ran false
fact network_changed false
fact state_changed false
fact services_changed false
fact plan_changed false
fact direct_failopen_changed false

echo "__TRACE__ stage=complete"
exit 0