/* ============================================================================
   BOOT LOADER
   ----------------------------------------------------------------------------
   Decides which copy of the game to run: the one packaged in this build, or a
   patch the updater has downloaded since.

   It has to be tiny and it has to be safe, because it is the one piece of code
   that cannot itself be patched. Two rules keep it safe:

     1. A patched bundle is only used if it is COMPLETE — every file named in
        its own load order is present. A partial bundle is discarded on sight.
     2. Before running a patch it writes a probation record, and the game clears
        that record once it has actually reached its first frame. If the record
        is still there on the next launch, the patch failed to boot and is
        thrown away automatically. The packaged build never leaves the device,
        so falling back costs nothing.

   Scripts are appended in manifest order and run as classic scripts sharing one
   scope, exactly as the static tags did — the load order is the contract, and
   it does not change just because the source came from storage.
   ============================================================================ */
(function(){
  var MANIFEST=[
    './assets/data/unitrows.js','./assets/data/unitsheet.js','./assets/data/itemart.js','./src/engine/gl.js','./src/engine/terragen.js','./src/terralab.js','./src/engine/mesh.js','./src/engine/billboard.js','./src/engine/tacticons.js','./src/engine/gpufx.js','./src/engine/organicfx.js','./src/engine/materials.js','./src/engine/materials-v2.js','./src/engine/terrain.js','./src/engine/models-world-data.js','./src/engine/models-world-loader.js','./src/engine/models.js','./assets/data/worldkit.js','./assets/data/sitetemplates.js','./src/engine/worldsites.js','./assets/data/meshes.js','./src/engine/models-legion.js','./src/engine/models-machine.js','./src/engine/models-infestation.js','./src/engine/models-civic.js','./src/engine/models-skyline.js','./src/engine/materials-world-v2.js','./src/engine/models-units-nova.js','./src/engine/models-units-legion.js','./src/engine/models-units-syndicate.js','./src/engine/models-units-brood.js','./src/engine/modkit.js','./src/game/sim.js','./src/game/economy.js','./src/game/commander.js','./src/game/meta.js','./src/game/ai.js','./src/ui/input.js','./src/ui/facticons.js','./src/ui/hud.js','./src/ui/render3d.js','./src/ui/orderfx.js','./src/airlift.js','./src/airlift-factions.js','./src/rumble.js','./src/factions.js','./src/factext.js','./src/offline.js','./src/audio.js','./src/assetpack.js','./src/hazards.js','./src/authportal.js','./src/tutorial.js','./src/adboards.js','./src/storeui.js','./src/restree3d.js','./src/develop.js','./src/factiondoctrine.js','./src/endgame.js','./src/story.js','./src/daily.js','./src/account.js','./src/economy-net.js','./src/updater.js','./src/intro.js','./src/session.js','./src/faction-id.js','./src/glrecover.js','./src/main.js','./src/intel.js','./src/repairbay.js','./src/galaxyui.js','./src/warprimer.js','./src/uistack.js','./src/ui/hudflow.js','./src/ui/hotslots.js'
  ];
  /* Packaged scripts need a release key. WebViews and development browsers can
     otherwise reuse a stale source even after the installer or local preview
     has changed, which made new settings appear to be missing until cache was
     cleared manually. Patch bundles keep their content-addressed Blob URLs. */
   var PACKAGED_REV='1.33.33';
  var DB='massfront-updates', STORE='bundles';
  var bootShield=null, bootShieldTimer=0, bootShieldWatchdog=0;
  var bootShieldEvents=['pointerdown','pointerup','touchstart','touchend','click'];
  /* Absolute ceiling on how long the shield/guard may live. The guard is only
     ever lowered by __bootOk()->releaseBootShield() on the first frame; if that
     never runs (a WebGL failure, a throw before the render loop, or an OTA
     shell whose release hook is absent) an unbounded sentinel would strand
     every guard-reading control forever — a real Android device saw exactly
     that on the Account button. Cap it and back it with a watchdog so it can
     never persist; the install gesture cannot still be in flight seconds on. */
  var BOOT_SHIELD_MAX_MS=6000;

  /* The install gesture began in the previous document. Block every pointer
     until this document has rendered a real frame, plus the short interval in
     which Android can synthesize a click from that old gesture. This lives in
     the immutable boot loader rather than an OTA bundle, so an old or broken
     patch cannot omit the protection it needs in order to restart safely. */
  function blockBootInput(e){
    e.preventDefault();
    e.stopImmediatePropagation();
  }
  function installBootShield(){
    /* Bounded deadline, never Number.MAX_SAFE_INTEGER: apBindTap-style controls
       suppress taps while Date.now() is below this, so an infinite sentinel the
       release path failed to lower would kill them permanently. */
    window.__MASSFRONT_INPUT_GUARD_UNTIL=Date.now()+BOOT_SHIELD_MAX_MS;
    bootShield=document.createElement('div');
    bootShield.setAttribute('aria-hidden','true');
    bootShield.setAttribute('data-mf-boot-input-shield','');
    bootShield.style.cssText='position:fixed;inset:0;z-index:2147483647;background:transparent;pointer-events:auto;touch-action:none';
    /* The OTA shell replaces body.innerHTML. A child of <html> survives that
       replacement and continues intercepting the release of the install tap. */
    document.documentElement.appendChild(bootShield);
    for(var i=0;i<bootShieldEvents.length;i++)
      document.addEventListener(bootShieldEvents[i],blockBootInput,true);
    /* Watchdog backstop: drop the shield even if a frame is never confirmed, so
       a failed boot degrades to a usable menu rather than a permanently dead
       screen. releaseBootShield()/clearBootShield() cancel it on the happy path. */
    bootShieldWatchdog=setTimeout(clearBootShield,BOOT_SHIELD_MAX_MS);
  }
  function clearBootShield(){
    if(bootShieldWatchdog){ clearTimeout(bootShieldWatchdog); bootShieldWatchdog=0; }
    if(bootShieldTimer){ clearTimeout(bootShieldTimer); bootShieldTimer=0; }
    for(var i=0;i<bootShieldEvents.length;i++)
      document.removeEventListener(bootShieldEvents[i],blockBootInput,true);
    if(bootShield&&bootShield.parentNode) bootShield.parentNode.removeChild(bootShield);
    bootShield=null;
    window.__MASSFRONT_INPUT_GUARD_UNTIL=0;
  }
  function releaseBootShield(){
    if(bootShieldTimer) return;
    window.__MASSFRONT_INPUT_GUARD_UNTIL=Date.now()+450;
    bootShieldTimer=setTimeout(clearBootShield,450);
  }
  installBootShield();

  function idb(){
    return new Promise(function(res,rej){
      var r=indexedDB.open(DB,1);
      r.onupgradeneeded=function(){ var d=r.result;
        if(!d.objectStoreNames.contains(STORE)) d.createObjectStore(STORE); };
      r.onsuccess=function(){ res(r.result); };
      r.onerror=function(){ rej(r.error); };
    });
  }
  function get(db,key){
    return new Promise(function(res){
      try{
        var tx=db.transaction(STORE,'readonly'), q=tx.objectStore(STORE).get(key);
        q.onsuccess=function(){ res(q.result); }; q.onerror=function(){ res(null); };
      }catch(e){ res(null); }
    });
  }
  function del(db,key){
    return new Promise(function(res){
      try{
        var tx=db.transaction(STORE,'readwrite');
        tx.objectStore(STORE).delete(key);
        tx.oncomplete=function(){ res(); }; tx.onerror=function(){ res(); };
      }catch(e){ res(); }
    });
  }
  function put(db,key,val){
    return new Promise(function(res){
      try{
        var tx=db.transaction(STORE,'readwrite');
        tx.objectStore(STORE).put(val,key);
        tx.oncomplete=function(){ res(); }; tx.onerror=function(){ res(); };
      }catch(e){ res(); }
    });
  }
  function verNewer(a,b){
    var pa=String(a||'').split('.').map(Number);
    var pb=String(b||'').split('.').map(Number);
    for(var i=0;i<Math.max(pa.length,pb.length);i++){
      var x=pa[i]||0, y=pb[i]||0;
      if(x!==y) return x>y;
    }
    return false;
  }
  function failed(db,version,reason){
    version=version||'?';
    return get(db,'applyFailure').then(function(prev){
      var count=prev&&prev.version===version?(prev.count|0)+1:1;
      var rec={version:version,at:Date.now(),reason:reason,count:count,
               quarantined:count>=2};
      return put(db,'applyFailure',rec).then(function(){ return rec; });
    });
  }
  function dropPendingVersion(db,version){
    return get(db,'pending').then(function(p){
      return p&&p.version===version?del(db,'pending'):null;
    });
  }
  function validBundle(b){
    if(!b||!b.files||!verNewer(b.version,PACKAGED_REV)) return false;
    var order=b.order&&b.order.length?b.order:MANIFEST;
    for(var i=0;i<order.length;i++) if(typeof b.files[order[i]]!=='string') return false;
    return true;
  }
  function restorePreviousOrPackaged(db,failedVersion){
    return get(db,'previous').then(function(prev){
      if(!validBundle(prev)||String(prev.version)===String(failedVersion)){
        return del(db,'previous').then(function(){ runPackaged(); });
      }
      /* This record was captured only while its exact version was running after
         probation. Consume it once: a broken update must never bounce between
         two patches. Keep the failed pending payload so the Update screen can
         offer one controlled retry and explain what happened. */
      return put(db,'active',prev).then(function(){ return del(db,'previous'); })
        .then(function(){
          window.__MASSFRONT_PATCHED=prev.version||'?';
          window.__MASSFRONT_RECOVERED_PATCH=failedVersion||'?';
          console.warn('boot: restored validated patch '+prev.version+
                       ' after '+failedVersion+' failed');
          runBundle(prev);
        });
    });
  }
  function rejectPatch(db,version,reason){
    return failed(db,version,reason).then(function(rec){
      if(rec.quarantined)
        console.warn('boot: patch '+version+' failed twice and was quarantined');
      return del(db,'active')
        .then(function(){ return del(db,'probation'); })
        .then(function(){ return rec.quarantined?dropPendingVersion(db,version):null; })
        .then(function(){ return restorePreviousOrPackaged(db,version); });
    });
  }
  function evictSuperseded(db){
    var keys=['active','pending','probation','previous'];
    return Promise.all(keys.map(function(key){ return get(db,key); }))
      .then(function(records){
        var work=[];
        for(var i=0;i<keys.length;i++){
          var rec=records[i];
          if(rec&&!verNewer(rec.version,PACKAGED_REV)){
            console.info('boot: discarding '+keys[i]+' patch '+(rec.version||'?')+
                         '; packaged build is '+PACKAGED_REV);
            work.push(del(db,keys[i]));
          }
        }
        return Promise.all(work);
      });
  }

  function runPackaged(){
    var i=0;
    (function next(){
      if(i>=MANIFEST.length) return;
      var s=document.createElement('script');
      s.src=MANIFEST[i++]+'?v='+PACKAGED_REV; s.async=false;
      s.onload=next;
      s.onerror=function(){ console.error('boot: failed',s.src); next(); };
      document.body.appendChild(s);
    })();
  }
  function runBundle(b){
    /* Blob URLs rather than inline text: the browser keeps a real filename for
       each source, so a stack trace from a patched build is still readable. */
    var order=b.order&&b.order.length? b.order : MANIFEST;
    var i=0;
    (function next(){
      if(i>=order.length) return;
      var path=order[i++], src=b.files[path];
      var s=document.createElement('script');
      s.async=false;
      if(src==null){ s.src=path; }
      else s.src=URL.createObjectURL(new Blob([src+'\n//# sourceURL='+path],{type:'text/javascript'}));
      s.onload=next;
      s.onerror=function(){ console.error('boot: failed',path); next(); };
      document.body.appendChild(s);
    })();
  }

  idb().then(function(db){
    /* Native app upgrades preserve WebView IndexedDB. Never let an old OTA
       remain above a newer packaged APK merely because it was active before
       the installer ran. Pending and probation records follow the same rule. */
    return evictSuperseded(db).then(function(){
      return get(db,'probation').then(function(prob){
      /* Probation counts ATTEMPTS, not intent. The updater writes it at zero
         before reloading; this loader claims it by incrementing. Seeing a
         record that has already been claimed means the previous launch ran the
         patch and never reached a frame — so it is bad, and out it goes.
         Counting rather than merely existing is the difference between "we are
         about to try" and "we tried and it died". */
      if(prob && (prob.tries|0)>=1){
        console.warn('boot: rolling back a patch that failed to start');
        return rejectPatch(db,prob.version,'The downloaded update did not finish starting.');
      }
      return get(db,'active').then(function(b){
        if(!b||!b.files){
          if(!prob) return runPackaged();
          return rejectPatch(db,prob.version,'The downloaded update was not available at restart.');
        }
        if(!validBundle(b)){
          console.warn('boot: patched bundle incomplete or superseded, using a validated fallback');
          return rejectPatch(db,b.version,'The downloaded update was incomplete at restart.');
        }
        window.__MASSFRONT_PATCHED=b.version||'?';
        if(prob){
          var tx=db.transaction(STORE,'readwrite');
          tx.objectStore(STORE).put({version:prob.version,at:prob.at,tries:(prob.tries|0)+1},'probation');
        }
        runBundle(b);
      });
      });
    });
  }).catch(runPackaged);

  /* Called by the game once it is genuinely running. Clearing probation is what
     marks a patch as good. Only now may the retryable download be deleted. */
  window.__bootOk=function(){
    releaseBootShield();
    idb().then(function(db){
      return del(db,'probation')
        /* A packaged fallback also reaches a frame. It must not erase the
           failure that explains why the patch did not start; only a confirmed
           patched frame has earned the right to clear recovery state. */
        .then(function(){ return window.__MASSFRONT_PATCHED&&!window.__MASSFRONT_RECOVERED_PATCH?del(db,'applyFailure'):null; })
        .then(function(){ return window.__MASSFRONT_PATCHED&&!window.__MASSFRONT_RECOVERED_PATCH?del(db,'pending'):null; });
    }).catch(function(){});
  };
})();