/**
 * Best-effort control-plane (P3) boot for `main.ts`: in-memory stores + the dev in-process CA
 * signer, listening for admin/enroll HTTP. Wrapped so a failure degrades gracefully (the data-plane
 * is the security-critical surface and boots independently).
 *
 * KNOWN SEAM (reported, not hacked): P3's injected `CapabilityVerifier.verify` is SYNCHRONOUS, but
 * relay-auth's real `verifyCapabilityToken` is ASYNC (WebCrypto). The real P5 verifier therefore
 * cannot be injected without an additive change to control-plane, so the admin routes run on the
 * default fail-closed verifier here (deny-by-default, never bypassed). Programmatic account/pairing
 * seeding through those routes is consequently BLOCKED in Phase 0 — see the report.
 */
import { buildControlPlane } from 'control-plane'
import { loadEnv } from 'control-plane/src/env.js'
import { createMemoryStores } from 'control-plane/src/store/memory.js'

export interface ControlPlaneBootOptions {
  readonly publicRaw: Uint8Array
  readonly baseDomain: string
  readonly caCertPath: string
  readonly bindHost: string
  readonly bindPort: number
}

export interface ControlPlaneHandle {
  close(): Promise<void>
}

export async function bootControlPlane(opts: ControlPlaneBootOptions): Promise<ControlPlaneHandle> {
  const env = loadEnv({
    PG_URL: 'postgres://localhost:5432/relay_run_dev',
    REDIS_URL: 'redis://localhost:6379',
    CAPABILITY_SIGN_PUBKEY_B64: Buffer.from(opts.publicRaw).toString('base64'),
    CA_INTERMEDIATE_KMS_KEY_REF: 'dev-inprocess-signer',
    CA_INTERMEDIATE_CERT_PATH: opts.caCertPath,
    NODE_MTLS_TRUST_BUNDLE_PATH: opts.caCertPath,
    BASE_DOMAIN: opts.baseDomain,
  })
  const { app } = await buildControlPlane(env, { stores: createMemoryStores() })
  await app.listen({ port: opts.bindPort, host: opts.bindHost })
  return { close: () => app.close() }
}