import { constants as fsConstants } from "node:fs";
import { readFileSync } from "node:fs";
import { access, mkdir, stat } from "node:fs/promises";
import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
import { dirname, resolve } from "node:path";
import { FileDataStore } from "./db/fileStore";
import { loadEnv } from "./env";
import { discoverBuiltInExtensions } from "./extensions/builtins";
import { discoverExternalExtensions } from "./extensions/external";
import { ExtensionAuditLog } from "./extensions/auditLog";
import { ExtensionLoader } from "./extensions/loader";
import { ExtensionManifestStore } from "./extensions/manifestStore";
import { QuickActionRegistry } from "./extensions/quickActions";
import { attachAdminCommandBridge } from "./hub/adminCommandBridge";
import { resolveToken } from "./hub/auth";
import { attachChatIngestFanout } from "./hub/chatIngestFanout";
import { attachChatCommandParser } from "./hub/chatCommandParser";
import { attachExtensionAdminController } from "./hub/extensionAdminController";
import { InMemoryEventBus } from "./hub/eventBus";
import { createEvent } from "./hub/events";
import { LIMITS } from "./hub/limits";
import { OpsMetrics } from "./hub/opsMetrics";
import { attachQuickActionController } from "./hub/quickActionController";
import { RuntimeManager } from "./hub/runtimeManager";
import { SetupWizardService } from "./hub/setupWizard";
import { attachYouTubeAdminController } from "./hub/youtubeAdminController";
import { HubStateRegistry } from "./hub/stateRegistry";
import { log } from "./log";
import { startTwitchAdapter } from "./platform/twitch";
import { startYouTubeAdapter, type YouTubeAdapterHandle } from "./platform/youtube";
import { WsTransport } from "./web/wsTransport";

const env = loadEnv();
const pkg = JSON.parse(
    readFileSync(resolve(process.cwd(), "package.json"), "utf8")
) as { version?: string };
const SHUTDOWN_SERVER_CLOSE_TIMEOUT_MS = 5000;
const appVersion = pkg.version ?? "0.0.0";
const adminPageHtml = readFileSync(resolve(process.cwd(), "src/web/static/admin.html"), "utf8");
const setupPageHtml = readFileSync(resolve(process.cwd(), "src/web/static/setup.html"), "utf8");
const overlayPageHtml = readFileSync(
    resolve(process.cwd(), "src/web/static/overlay.html"),
    "utf8"
);
const dataStore = new FileDataStore(resolve(process.cwd(), env.DATA_FILE), {
    chatLogDir: resolve(process.cwd(), env.CHAT_LOG_DIR),
    chatRetentionDays: env.CHAT_RETENTION_DAYS
});
const runtimeManager = new RuntimeManager();
const opsMetrics = new OpsMetrics();
const eventBus = new InMemoryEventBus({
    handlerTimeoutMs: env.EVENT_HANDLER_TIMEOUT_MS,
    failureDegradeThreshold: env.EVENT_HANDLER_FAILURE_DEGRADE_THRESHOLD,
    log: (level, message, fields = {}) => log(level, message, fields),
    onHandlerFailure: (failure) => {
        opsMetrics.recordHandlerFailure(failure.reason);
        if (!failure.streamId) {
            return;
        }
        runtimeManager.setComponentStatus(failure.streamId, {
            id: failure.componentId,
            kind:
                failure.componentKind === "adapter"
                    ? "adapter"
                    : failure.componentKind === "extension"
                      ? "extension"
                      : "transport",
            level: "warn",
            message: `handler_${failure.reason}`,
            updatedAt: new Date().toISOString(),
            details: {
                eventName: failure.eventName,
                error: failure.error,
                consecutiveFailures: failure.consecutiveFailures
            }
        });
        runtimeManager.setStreamState(failure.streamId, "degraded", "handler failures detected");
    }
});
const stateRegistry = new HubStateRegistry();
const quickActionRegistry = new QuickActionRegistry();

eventBus.on("platform_status", async (event) => {
    if (event.payload.platform !== "twitch") {
        return;
    }
    const state = event.payload.state;
    const level =
        state === "connected" || state === "active"
            ? "ok"
            : state === "error"
              ? "error"
              : "warn";
    runtimeManager.setComponentStatus("default", {
        id: "twitch",
        kind: "adapter",
        level,
        message: event.payload.message,
        updatedAt: new Date().toISOString(),
        details: event.payload.details ?? {}
    });
}, { componentId: "twitch-runtime-status", componentKind: "core" });

const extensionLoader = new ExtensionLoader(
    eventBus,
    stateRegistry,
    dataStore,
    (message, fields = {}) => log("info", message, fields),
    quickActionRegistry,
    {
        cleanupTimeoutMs: env.EXTENSION_CLEANUP_TIMEOUT_MS
    }
);
const extensionManifestStore = new ExtensionManifestStore(
    resolve(process.cwd(), env.EXTENSIONS_MANIFEST_FILE)
);
const extensionAuditLog = new ExtensionAuditLog(env.EXTENSIONS_AUDIT_FILE);
const setupWizard = new SetupWizardService(dataStore, env.SETUP_KEYS, env.TOKEN_PEPPER);

function sendJson(
    res: ServerResponse,
    statusCode: number,
    payload: Record<string, unknown>
): void {
    res.writeHead(
        statusCode,
        responseHeaders({ "content-type": "application/json; charset=utf-8" }, { noStore: true })
    );
    res.end(JSON.stringify(payload));
}

function sendHtml(res: ServerResponse, statusCode: number, html: string): void {
    res.writeHead(
        statusCode,
        responseHeaders({ "content-type": "text/html; charset=utf-8" }, { noStore: true })
    );
    res.end(html);
}

function sendText(res: ServerResponse, statusCode: number, text: string): void {
    res.writeHead(statusCode, responseHeaders({ "content-type": "text/plain; charset=utf-8" }));
    res.end(text);
}

function responseHeaders(
    headers: Record<string, string>,
    options: { noStore?: boolean } = {}
): Record<string, string> {
    return {
        ...headers,
        ...(options.noStore ? { "cache-control": "no-store" } : {}),
        "x-robots-tag": "noindex, nofollow, noarchive",
        "x-content-type-options": "nosniff",
        "referrer-policy": "no-referrer",
        "permissions-policy":
            "camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), bluetooth=(), display-capture=()",
        "content-security-policy": [
            "default-src 'none'",
            "base-uri 'none'",
            "connect-src 'self' ws: wss:",
            "font-src 'self'",
            "form-action 'self'",
            "frame-ancestors 'self'",
            "img-src 'self' data:",
            "object-src 'none'",
            "script-src 'self' 'unsafe-inline'",
            "style-src 'self' 'unsafe-inline'"
        ].join("; ")
    };
}

function aggregateRuntimeStatus(): "ok" | "degraded" | "error" {
    const streams = runtimeManager.listRuntime();
    if (streams.some((stream) => stream.components.some((component) => component.level === "error"))) {
        return "error";
    }
    if (streams.some((stream) => stream.state === "degraded")) {
        return "degraded";
    }
    return "ok";
}

let wsTransport: WsTransport | null = null;
let youtubeAdapter: YouTubeAdapterHandle | null = null;
const activeAdminCountsByStream = new Map<string, number>();

function splitModuleStatuses(): {
    allModules: ReturnType<ExtensionLoader["listStatuses"]>;
    coreModules: ReturnType<ExtensionLoader["listStatuses"]>;
    extensions: ReturnType<ExtensionLoader["listStatuses"]>;
} {
    const allModules = extensionLoader.listStatuses();
    return {
        allModules,
        coreModules: allModules.filter((item) => item.kind === "builtin"),
        extensions: allModules.filter((item) => item.kind === "external")
    };
}

async function diagnosticsPayload(): Promise<Record<string, unknown>> {
    const moduleStatuses = splitModuleStatuses();
    const setupStatus = await setupWizard.getStatus();
    const hasAdminToken = await dataStore.hasActiveAdminToken();
    return {
        status: aggregateRuntimeStatus(),
        timestamp: new Date().toISOString(),
        process: {
            pid: process.pid,
            uptimeSec: Math.trunc(process.uptime()),
            nodeVersion: process.version
        },
        runtime: {
            streams: runtimeManager.listRuntime(),
            connectedClients: wsTransport?.getConnectedClientStats() ?? {
                total: 0,
                admin: 0,
                viewer: 0
            },
            adminSessions: wsTransport?.listAdminSessions() ?? [],
            adminCommandQueue: wsTransport?.getQueueStats() ?? {
                depth: 0,
                maxDepth: LIMITS.ADMIN_COMMAND_QUEUE_MAX,
                dropped: 0
            },
            modules: {
                coreModules: moduleStatuses.coreModules,
                extensions: moduleStatuses.extensions
            },
            extensions: moduleStatuses.allModules,
            setup: {
                setupLocked: setupStatus.setupLocked,
                hasAdminToken,
                usedKeyCount: setupStatus.usedKeyCount
            },
            metrics: opsMetrics.snapshot()
        },
        config: {
            env: env.NODE_ENV,
            host: env.HOST,
            port: env.PORT,
            dataFile: env.DATA_FILE,
            chatLogDir: env.CHAT_LOG_DIR,
            chatRetentionDays: env.CHAT_RETENTION_DAYS,
            extensionPaths: env.EXTENSIONS_PATHS,
            extensionManifestFile: env.EXTENSIONS_MANIFEST_FILE,
            extensionAuditFile: env.EXTENSIONS_AUDIT_FILE,
            extensionCleanupTimeoutMs: env.EXTENSION_CLEANUP_TIMEOUT_MS,
            diagnosticsAccess: env.DIAGNOSTICS_ACCESS,
            setupKeysConfiguredCount: env.SETUP_KEYS.length,
            youtubeEnabled: env.YOUTUBE_ENABLED,
            youtubePollMs: env.YOUTUBE_POLL_MS,
            youtubeApiKeyConfigured: Boolean(env.YOUTUBE_API_KEY),
            youtubeOauthConfigured: Boolean(
                env.YOUTUBE_OAUTH_CLIENT_ID &&
                    env.YOUTUBE_OAUTH_CLIENT_SECRET &&
                    env.YOUTUBE_OAUTH_REFRESH_TOKEN
            ),
            youtubeDiscoveryPollMs: env.YOUTUBE_DISCOVERY_POLL_MS,
            youtubeErrorLogCooldownMs: env.YOUTUBE_ERROR_LOG_COOLDOWN_MS,
            twitchEnabled: env.TWITCH_ENABLED,
            twitchChannel: env.TWITCH_CHANNEL,
            limits: {
                ...LIMITS,
                EVENT_HANDLER_TIMEOUT_MS: env.EVENT_HANDLER_TIMEOUT_MS,
                EVENT_HANDLER_FAILURE_DEGRADE_THRESHOLD: env.EVENT_HANDLER_FAILURE_DEGRADE_THRESHOLD
            }
        }
    };
}

function isLoopbackAddress(remoteAddress: string | undefined): boolean {
    if (!remoteAddress) {
        return false;
    }
    return (
        remoteAddress === "127.0.0.1" ||
        remoteAddress === "::1" ||
        remoteAddress === "::ffff:127.0.0.1"
    );
}

async function authorizeDiagnostics(req: IncomingMessage, url: URL): Promise<{
    allowed: boolean;
    statusCode?: number;
    error?: string;
}> {
    if (env.DIAGNOSTICS_ACCESS === "open") {
        return { allowed: true };
    }

    if (env.DIAGNOSTICS_ACCESS === "local") {
        if (isLoopbackAddress(req.socket.remoteAddress)) {
            return { allowed: true };
        }
        return {
            allowed: false,
            statusCode: 403,
            error: "Diagnostics endpoint is local-only."
        };
    }

    const token = url.searchParams.get("token");
    const auth = await resolveToken(dataStore, token, env.TOKEN_PEPPER);
    if (!auth || auth.role !== "admin") {
        return {
            allowed: false,
            statusCode: 401,
            error: "Unauthorized diagnostics access."
        };
    }

    return { allowed: true };
}

function readRequestBody(req: IncomingMessage): Promise<string> {
    return new Promise((resolveBody, rejectBody) => {
        const chunks: Buffer[] = [];
        req.on("data", (chunk: Buffer | string) => {
            chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
        });
        req.on("end", () => resolveBody(Buffer.concat(chunks).toString("utf8")));
        req.on("error", rejectBody);
    });
}

async function readJsonBody(req: IncomingMessage): Promise<Record<string, unknown> | null> {
    const body = await readRequestBody(req);
    if (!body.trim()) {
        return {};
    }
    try {
        const parsed = JSON.parse(body) as unknown;
        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
            return null;
        }
        return parsed as Record<string, unknown>;
    } catch {
        return null;
    }
}

function requestOrigin(req: IncomingMessage, url: URL): string {
    const forwardedProto = req.headers["x-forwarded-proto"];
    const forwardedHost = req.headers["x-forwarded-host"];
    const proto =
        typeof forwardedProto === "string" && forwardedProto.trim()
            ? forwardedProto.split(",")[0].trim()
            : url.protocol.replace(":", "");
    const host =
        typeof forwardedHost === "string" && forwardedHost.trim()
            ? forwardedHost.split(",")[0].trim()
            : req.headers.host ?? url.host;
    return `${proto}://${host}`;
}

async function handleHttpRequest(req: IncomingMessage, res: ServerResponse): Promise<void> {
    const startedAt = Date.now();
    const method = req.method ?? "GET";
    const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
    let statusCode = 404;

    if (isShuttingDown) {
        statusCode = 503;
        sendJson(res, statusCode, { error: "Server is shutting down." });
    } else if (method === "GET" && url.pathname === "/robots.txt") {
        statusCode = 200;
        sendText(res, statusCode, "User-agent: *\nDisallow: /\n");
    } else if (method === "GET" && url.pathname === "/setup") {
        const setupStatus = await setupWizard.getStatus();
        if (!setupStatus.setupAvailable) {
            statusCode = 404;
            sendHtml(
                res,
                statusCode,
                "<!doctype html><title>Conduit Setup</title><p>Setup is not available.</p>"
            );
        } else {
            statusCode = 200;
            sendHtml(res, statusCode, setupPageHtml);
        }
    } else if (method === "GET" && url.pathname === "/health") {
        const runtimeStatus = aggregateRuntimeStatus();
        statusCode = runtimeStatus === "ok" ? 200 : 503;
        sendJson(res, statusCode, { status: runtimeStatus, timestamp: new Date().toISOString() });
    } else if (method === "GET" && url.pathname === "/setup/status") {
        statusCode = 200;
        sendJson(res, statusCode, await setupWizard.getStatus());
    } else if (method === "POST" && url.pathname === "/setup/auth") {
        const setupStatus = await setupWizard.getStatus();
        if (setupStatus.setupLocked) {
            statusCode = 423;
            sendJson(res, statusCode, { error: "Setup is locked." });
        } else if (!setupStatus.hasSetupKeys) {
            statusCode = 503;
            sendJson(res, statusCode, { error: "Setup is not configured." });
        } else {
            const payload = await readJsonBody(req);
            if (!payload) {
                statusCode = 400;
                sendJson(res, statusCode, { error: "Invalid JSON body." });
            } else {
                const setupKeyRaw = payload.setupKey;
                const setupKey = typeof setupKeyRaw === "string" ? setupKeyRaw : "";
                const setupSessionToken = await setupWizard.authenticateSetupKey(setupKey);
                if (!setupSessionToken) {
                    statusCode = 401;
                    sendJson(res, statusCode, { error: "Invalid setup key." });
                } else {
                    statusCode = 200;
                    sendJson(res, statusCode, { ok: true, setupSessionToken });
                }
            }
        }
    } else if (method === "POST" && url.pathname === "/setup/complete") {
        const setupStatus = await setupWizard.getStatus();
        if (setupStatus.setupLocked) {
            statusCode = 423;
            sendJson(res, statusCode, { error: "Setup is locked." });
        } else {
            const payload = await readJsonBody(req);
            if (!payload) {
                statusCode = 400;
                sendJson(res, statusCode, { error: "Invalid JSON body." });
            } else {
                const setupSessionTokenRaw = payload.setupSessionToken;
                const streamNameRaw = payload.streamName;
                const setupSessionToken =
                    typeof setupSessionTokenRaw === "string" ? setupSessionTokenRaw : "";
                const streamName = typeof streamNameRaw === "string" ? streamNameRaw : "";
                const completion = await setupWizard.completeSetup(
                    setupSessionToken,
                    streamName,
                    requestOrigin(req, url),
                    env.NODE_ENV !== "production"
                );
                if (!completion) {
                    statusCode = 401;
                    sendJson(res, statusCode, {
                        error: "Setup session is invalid, expired, key already used, or setup keys are exhausted."
                    });
                } else {
                    statusCode = 200;
                    sendJson(res, statusCode, {
                        ok: true,
                        ...completion
                    });
                }
            }
        }
    } else if (method === "GET" && url.pathname === "/diagnostics") {
        const diagnosticsAuth = await authorizeDiagnostics(req, url);
        if (!diagnosticsAuth.allowed) {
            statusCode = diagnosticsAuth.statusCode ?? 403;
            sendJson(res, statusCode, { error: diagnosticsAuth.error ?? "Forbidden" });
        } else {
            statusCode = 200;
            sendJson(res, statusCode, await diagnosticsPayload());
        }
    } else if (method === "GET" && url.pathname === "/version") {
        statusCode = 200;
        sendJson(res, statusCode, { version: appVersion });
    } else if (method === "GET" && url.pathname === "/admin") {
        statusCode = 200;
        sendHtml(res, statusCode, adminPageHtml);
    } else if (method === "GET" && url.pathname === "/overlay" && env.NODE_ENV !== "production") {
        statusCode = 200;
        sendHtml(res, statusCode, overlayPageHtml);
    } else if (url.pathname === "/overlay" && env.NODE_ENV === "production") {
        statusCode = 404;
        sendJson(res, statusCode, { error: "Not Found" });
    } else if (url.pathname === "/admin" || url.pathname === "/overlay") {
        statusCode = 405;
        sendJson(res, statusCode, { error: "Method Not Allowed" });
    } else if (
        url.pathname === "/health" ||
        url.pathname === "/robots.txt" ||
        url.pathname === "/setup" ||
        url.pathname === "/version" ||
        url.pathname === "/diagnostics" ||
        url.pathname === "/setup/status" ||
        url.pathname === "/setup/auth" ||
        url.pathname === "/setup/complete"
    ) {
        statusCode = 405;
        sendJson(res, statusCode, { error: "Method Not Allowed" });
    } else {
        sendJson(res, statusCode, { error: "Not Found" });
    }

    log("info", "http_request", {
        method,
        path: url.pathname,
        statusCode,
        durationMs: Date.now() - startedAt
    });
}

const server = createServer((req, res) => {
    void handleHttpRequest(req, res).catch((error: unknown) => {
        log("error", "http_handler_error", {
            error: error instanceof Error ? error.message : String(error)
        });
        if (!res.headersSent) {
            sendJson(res, 500, { error: "Internal Server Error" });
        } else {
            res.end();
        }
    });
});

wsTransport = new WsTransport(
    server,
    eventBus,
    (token) => resolveToken(dataStore, token, env.TOKEN_PEPPER),
    (fields) => log("info", "ws_transport", fields),
    runtimeManager,
    opsMetrics,
    (streamId, count) => {
        activeAdminCountsByStream.set(streamId, count);
        if (youtubeAdapter) {
            const totalActiveAdmins = Array.from(activeAdminCountsByStream.values()).reduce(
                (acc, item) => acc + item,
                0
            );
            youtubeAdapter.setAdminPresenceActive(totalActiveAdmins > 0);
        }
    }
);

let isShuttingDown = false;
let stopYouTubeAdapter: (() => void) | null = null;
let stopTwitchAdapter: (() => void) | null = null;

async function validateReadableDirectory(pathValue: string, label: string): Promise<void> {
    const stats = await stat(pathValue).catch(() => null);
    if (!stats || !stats.isDirectory()) {
        throw new Error(`${label} is not a readable directory: ${pathValue}`);
    }
    await access(pathValue, fsConstants.R_OK);
}

async function validateWritableFileTarget(filePath: string, label: string): Promise<void> {
    const targetDir = dirname(filePath);
    await mkdir(targetDir, { recursive: true });
    await access(targetDir, fsConstants.W_OK);

    const targetStats = await stat(filePath).catch(() => null);
    if (targetStats) {
        if (!targetStats.isFile()) {
            throw new Error(`${label} must point to a file path: ${filePath}`);
        }
        await access(filePath, fsConstants.W_OK);
    }
}

async function validateWritableDirectoryTarget(pathValue: string, label: string): Promise<void> {
    await mkdir(pathValue, { recursive: true });
    const targetStats = await stat(pathValue).catch(() => null);
    if (!targetStats || !targetStats.isDirectory()) {
        throw new Error(`${label} must point to a directory path: ${pathValue}`);
    }
    await access(pathValue, fsConstants.W_OK);
}

async function runStartupChecks(): Promise<void> {
    const resolvedExtensionPaths = env.EXTENSIONS_PATHS.map((pathValue) =>
        resolve(process.cwd(), pathValue)
    );
    const resolvedDataFile = resolve(process.cwd(), env.DATA_FILE);
    const resolvedChatLogDir = resolve(process.cwd(), env.CHAT_LOG_DIR);
    const resolvedManifestFile = resolve(process.cwd(), env.EXTENSIONS_MANIFEST_FILE);
    const resolvedAuditFile = resolve(process.cwd(), env.EXTENSIONS_AUDIT_FILE);

    log("info", "startup_config", {
        nodeVersion: process.version,
        platform: process.platform,
        pid: process.pid,
        env: env.NODE_ENV,
        host: env.HOST,
        port: env.PORT,
        dataFile: env.DATA_FILE,
        dataFileResolved: resolvedDataFile,
        chatLogDir: env.CHAT_LOG_DIR,
        chatLogDirResolved: resolvedChatLogDir,
        chatRetentionDays: env.CHAT_RETENTION_DAYS,
        extensionPaths: env.EXTENSIONS_PATHS,
        extensionResolvedPaths: resolvedExtensionPaths,
        extensionManifestFile: env.EXTENSIONS_MANIFEST_FILE,
        extensionManifestFileResolved: resolvedManifestFile,
        extensionAuditFile: env.EXTENSIONS_AUDIT_FILE,
        extensionAuditFileResolved: resolvedAuditFile,
        extensionCleanupTimeoutMs: env.EXTENSION_CLEANUP_TIMEOUT_MS,
        diagnosticsAccess: env.DIAGNOSTICS_ACCESS,
        setupKeysConfiguredCount: env.SETUP_KEYS.length,
        limits: {
            maxCommandLength: LIMITS.MAX_COMMAND_LENGTH,
            maxArgsCount: LIMITS.MAX_ARGS_COUNT,
            maxWsFramePayloadBytes: LIMITS.MAX_WS_FRAME_PAYLOAD_BYTES,
            adminRateLimitCount: LIMITS.ADMIN_COMMAND_RATE_LIMIT_COUNT,
            adminRateLimitWindowMs: LIMITS.ADMIN_COMMAND_RATE_LIMIT_WINDOW_MS,
            adminCommandQueueMax: LIMITS.ADMIN_COMMAND_QUEUE_MAX,
            eventHandlerTimeoutMs: env.EVENT_HANDLER_TIMEOUT_MS,
            eventHandlerFailureDegradeThreshold: env.EVENT_HANDLER_FAILURE_DEGRADE_THRESHOLD
        },
        adapters: {
            youtubeEnabled: env.YOUTUBE_ENABLED,
            youtubePollMs: env.YOUTUBE_POLL_MS,
            youtubeApiKeyConfigured: Boolean(env.YOUTUBE_API_KEY),
            twitchEnabled: env.TWITCH_ENABLED,
            twitchChannel: env.TWITCH_CHANNEL,
            twitchIrcHost: env.TWITCH_IRC_HOST,
            twitchIrcPort: env.TWITCH_IRC_PORT,
            twitchReconnectMs: env.TWITCH_RECONNECT_MS
        }
    });

    if (env.NODE_ENV === "production" && env.TOKEN_PEPPER === "change-me") {
        throw new Error("Unsafe configuration: TOKEN_PEPPER must be changed in production.");
    }

    if (env.NODE_ENV === "production" && env.HOST === "127.0.0.1") {
        log("info", "startup_warning", {
            message: "HOST is 127.0.0.1 in production; remote access may not work."
        });
    }

    const uniqueResolvedExtensionPaths = new Set(resolvedExtensionPaths);
    if (uniqueResolvedExtensionPaths.size !== resolvedExtensionPaths.length) {
        throw new Error("EXTENSIONS_PATHS contains duplicate resolved directories.");
    }
    for (const extensionPath of resolvedExtensionPaths) {
        await validateReadableDirectory(extensionPath, "Extension path");
    }

    await validateWritableFileTarget(resolvedDataFile, "DATA_FILE");
    await validateWritableDirectoryTarget(resolvedChatLogDir, "CHAT_LOG_DIR");
    await validateWritableFileTarget(resolvedManifestFile, "EXTENSIONS_MANIFEST_FILE");
    await validateWritableFileTarget(resolvedAuditFile, "EXTENSIONS_AUDIT_FILE");

    const uniqueSetupKeys = new Set(env.SETUP_KEYS);
    if (uniqueSetupKeys.size !== env.SETUP_KEYS.length) {
        log("info", "startup_warning", {
            message: "SETUP_KEYS contains duplicate values after parsing."
        });
    }

    if (env.YOUTUBE_ENABLED) {
        if (!env.YOUTUBE_API_KEY) {
            throw new Error("YOUTUBE_ENABLED is true but YOUTUBE_API_KEY is missing.");
        }
        if (!env.YOUTUBE_OAUTH_CLIENT_ID) {
            throw new Error("YOUTUBE_ENABLED is true but YOUTUBE_OAUTH_CLIENT_ID is missing.");
        }
        if (!env.YOUTUBE_OAUTH_CLIENT_SECRET) {
            throw new Error("YOUTUBE_ENABLED is true but YOUTUBE_OAUTH_CLIENT_SECRET is missing.");
        }
        if (!env.YOUTUBE_OAUTH_REFRESH_TOKEN) {
            throw new Error("YOUTUBE_ENABLED is true but YOUTUBE_OAUTH_REFRESH_TOKEN is missing.");
        }
    }

    if (env.TWITCH_ENABLED) {
        if (!env.TWITCH_OAUTH_TOKEN) {
            throw new Error("TWITCH_ENABLED is true but TWITCH_OAUTH_TOKEN is missing.");
        }
        if (!env.TWITCH_BOT_NICK) {
            throw new Error("TWITCH_ENABLED is true but TWITCH_BOT_NICK is missing.");
        }
        if (!env.TWITCH_CHANNEL) {
            throw new Error("TWITCH_ENABLED is true but TWITCH_CHANNEL is missing.");
        }
    }
}

async function runPostInitStartupChecks(): Promise<void> {
    const setupStatus = await setupWizard.getStatus();
    const hasAdminToken = await dataStore.hasActiveAdminToken();
    if (!setupStatus.setupLocked && hasAdminToken) {
        log("info", "startup_warning", {
            message: "Setup is unlocked while active admin tokens exist."
        });
    }
}

function waitForServerClose(signal: string): Promise<void> {
    if (!server.listening) {
        return Promise.resolve();
    }
    return new Promise((resolveClose) => {
        let resolved = false;
        const resolveOnce = (): void => {
            if (resolved) {
                return;
            }
            resolved = true;
            clearTimeout(timeout);
            resolveClose();
        };
        const timeout = setTimeout(() => {
            log("info", "shutdown_server_close_timeout", {
                signal,
                timeoutMs: SHUTDOWN_SERVER_CLOSE_TIMEOUT_MS
            });
            server.closeAllConnections();
            resolveOnce();
        }, SHUTDOWN_SERVER_CLOSE_TIMEOUT_MS);

        server.close((error?: Error) => {
            if (error) {
                log("error", "shutdown_server_close_error", {
                    signal,
                    error: error.message
                });
            }
            resolveOnce();
        });
        server.closeIdleConnections();
    });
}

async function shutdown(signal: string): Promise<void> {
    if (isShuttingDown) {
        return;
    }
    isShuttingDown = true;

    runtimeManager.setStreamState("default", "stopped", `shutdown:${signal}`);
    log("info", "shutdown_started", { signal });
    const serverClose = waitForServerClose(signal);
    wsTransport?.shutdown();
    stopYouTubeAdapter?.();
    stopYouTubeAdapter = null;
    youtubeAdapter = null;
    stopTwitchAdapter?.();
    stopTwitchAdapter = null;
    await extensionLoader.shutdown();
    await serverClose;
    log("info", "shutdown_complete", { signal });
}

async function start(): Promise<void> {
    runtimeManager.setStreamState("default", "starting", "bootstrapping");
    await runStartupChecks();
    await dataStore.init();
    await runPostInitStartupChecks();
    await extensionManifestStore.load();
    attachAdminCommandBridge(eventBus, (message, fields = {}) => log("info", message, fields));
    attachChatIngestFanout(eventBus, dataStore, (message, fields = {}) => log("info", message, fields));
    attachChatCommandParser(eventBus, (message, fields = {}) => log("info", message, fields));
    attachExtensionAdminController(
        eventBus,
        extensionLoader,
        extensionManifestStore,
        extensionAuditLog,
        (message, fields = {}) => log("info", message, fields),
        opsMetrics
    );
    attachQuickActionController(eventBus, quickActionRegistry, (message, fields = {}) =>
        log("info", message, fields)
    );
    attachYouTubeAdminController(
        eventBus,
        () => youtubeAdapter,
        (message, fields = {}) => log("info", message, fields)
    );
    const builtInExtensions = await discoverBuiltInExtensions();
    const externalExtensions = await discoverExternalExtensions(env.EXTENSIONS_PATHS);
    extensionLoader.register(builtInExtensions, "builtin");
    extensionLoader.register(externalExtensions, "external");
    for (const extension of builtInExtensions) {
        await extensionLoader.enable(extension.id);
    }
    for (const extension of externalExtensions) {
        if (!extensionManifestStore.isEnabled(extension.id, true)) {
            continue;
        }
        await extensionLoader.enable(extension.id);
    }
    const moduleStatuses = splitModuleStatuses();
    runtimeManager.setComponentStatus("default", {
        id: "modules",
        kind: "extension",
        level: "ok",
        message: "modules loaded",
        updatedAt: new Date().toISOString(),
        details: {
            count: builtInExtensions.length + externalExtensions.length,
            coreModuleCount: builtInExtensions.length,
            extensionCount: externalExtensions.length,
            activeModuleCount: moduleStatuses.allModules.filter((entry) => entry.loaded).length
        }
    });

    if (env.YOUTUBE_ENABLED) {
        youtubeAdapter = startYouTubeAdapter({
            eventBus,
            apiKey: env.YOUTUBE_API_KEY!,
            oauthClientId: env.YOUTUBE_OAUTH_CLIENT_ID!,
            oauthClientSecret: env.YOUTUBE_OAUTH_CLIENT_SECRET!,
            oauthRefreshToken: env.YOUTUBE_OAUTH_REFRESH_TOKEN!,
            oauthTokenUrl: env.YOUTUBE_OAUTH_TOKEN_URL,
            pollMs: env.YOUTUBE_POLL_MS,
            discoveryPollMs: env.YOUTUBE_DISCOVERY_POLL_MS,
            errorLogCooldownMs: env.YOUTUBE_ERROR_LOG_COOLDOWN_MS,
            onStatusChanged: (status) => {
                void (async () => {
                    const streams = await dataStore.listStreams();
                    for (const stream of streams) {
                        await eventBus.emit(
                            createEvent("ws_out", {
                                streamId: stream.id,
                                target: "admin",
                                event: "youtube_ops_status",
                                data: status
                            })
                        );
                    }
                })();
            },
            log: (message, fields = {}) => log("info", message, fields)
        });
        stopYouTubeAdapter = youtubeAdapter.stop;
        const totalActiveAdmins = Array.from(activeAdminCountsByStream.values()).reduce(
            (acc, item) => acc + item,
            0
        );
        youtubeAdapter.setAdminPresenceActive(totalActiveAdmins > 0);
        quickActionRegistry.register("core-youtube", {
            id: "youtube.arm",
            label: "Arm YouTube Discovery",
            description: "Start scheduled YouTube live chat discovery.",
            run: async (context) => {
                const adapter = youtubeAdapter;
                if (!adapter) {
                    throw new Error("YouTube adapter is not active for this stream.");
                }
                adapter.armDiscovery();
                await eventBus.emit(
                    createEvent("ws_out", {
                        streamId: context.streamId,
                        target: "admin",
                        event: "youtube_ops_result",
                        data: {
                            ok: true,
                            operation: "arm",
                            status: adapter.status()
                        }
                    })
                );
            }
        });
        log("info", "youtube_adapter_started", {
            authMode: "oauth",
            pollMs: env.YOUTUBE_POLL_MS
        });
        runtimeManager.setComponentStatus("default", {
            id: "youtube",
            kind: "adapter",
            level: "ok",
            message: "adapter started",
            updatedAt: new Date().toISOString(),
            details: {
                pollMs: env.YOUTUBE_POLL_MS
            }
        });
    }

    if (
        env.TWITCH_ENABLED &&
        env.TWITCH_OAUTH_TOKEN &&
        env.TWITCH_BOT_NICK &&
        env.TWITCH_CHANNEL
    ) {
        stopTwitchAdapter = startTwitchAdapter({
            eventBus,
            oauthToken: env.TWITCH_OAUTH_TOKEN,
            botNick: env.TWITCH_BOT_NICK,
            channel: env.TWITCH_CHANNEL,
            host: env.TWITCH_IRC_HOST,
            port: env.TWITCH_IRC_PORT,
            reconnectMs: env.TWITCH_RECONNECT_MS,
            log: (message, fields = {}) => log("info", message, fields)
        });
        log("info", "twitch_adapter_started", {
            channel: env.TWITCH_CHANNEL
        });
        runtimeManager.setComponentStatus("default", {
            id: "twitch",
            kind: "adapter",
            level: "ok",
            message: "adapter started",
            updatedAt: new Date().toISOString(),
            details: {
                channel: env.TWITCH_CHANNEL,
                reconnectMs: env.TWITCH_RECONNECT_MS
            }
        });
    }

    wsTransport?.attach();
    runtimeManager.setComponentStatus("default", {
        id: "ws-transport",
        kind: "transport",
        level: "ok",
        message: "websocket transport attached",
        updatedAt: new Date().toISOString()
    });
    runtimeManager.setStreamState("default", "ready", "runtime ready");

    server.listen(env.PORT, env.HOST, () => {
        log("info", "Conduit booted", {
            host: env.HOST,
            port: env.PORT,
            env: env.NODE_ENV,
            version: appVersion,
            dataFile: env.DATA_FILE
        });
    });

    await eventBus.emit(
        createEvent("system_started", {
            host: env.HOST,
            port: env.PORT,
            version: appVersion,
            env: env.NODE_ENV
        })
    );
}

process.on("SIGINT", () => {
    void shutdown("SIGINT").finally(() => process.exit(0));
});

process.on("SIGTERM", () => {
    void shutdown("SIGTERM").finally(() => process.exit(0));
});

process.on("unhandledRejection", (reason) => {
    log("error", "unhandled_rejection", {
        reason: reason instanceof Error ? reason.message : String(reason)
    });
});

process.on("uncaughtException", (error) => {
    log("error", "uncaught_exception", {
        error: error.message,
        stack: error.stack ?? null
    });
    void shutdown("uncaughtException").finally(() => process.exit(1));
});

start().catch((error: unknown) => {
    log("error", "Startup failure", {
        error: error instanceof Error ? error.message : String(error)
    });
    process.exit(1);
});