# The full dock / undock / enable display-transition primitive
# (nomarchy-display-transition) — the one safety-critical copy. Extracted
# from hyprland.nix (#150) so hyprland.nix and idle.nix share it instead of
# idle.nix carrying a lossy mini that lacked logging, the lid-inhibitor
# gate, restore_keyboards, and the failure dump.
#
# One transition primitive for the interactive Dock mode, abrupt undock,
# and named profiles that disable the internal panel.  Dock is one Hyprland
# batch: enable the target, move every internal workspace, focus it, then
# disable the panel.  Undock deliberately enables the panel FIRST, waits
# for it to become an active target, then restores every workspace.
#
#   sync            — nomarchy-state-sync exe (dock-intent writes)
#   keyboardTool    — nomarchy-keyboard-layout (restore after reload)
#   displayDumpTool — nomarchy-display-dump (evidence on enable failure)
{ pkgs, sync, keyboardTool, displayDumpTool }:
pkgs.writeShellScriptBin "nomarchy-display-transition" ''
    set -u
    LOGGER=${pkgs.util-linux}/bin/logger
    log() { "$LOGGER" -t nomarchy-display-transition -- "$*"; }
    valid_output() {
      case "$1" in *[!A-Za-z0-9_.:-]*|"") return 1 ;; *) return 0 ;; esac
    }
    workspaces_on() {
      hyprctl workspaces -j 2>/dev/null \
        | jq -r --arg m "$1" '.[] | select(.monitor == $m and .id > 0) | .id'
    }
    all_workspaces() {
      hyprctl workspaces -j 2>/dev/null | jq -r '.[] | select(.id > 0) | .id'
    }
    lid_inhibitor_held() {
      ${pkgs.systemd}/bin/systemd-inhibit --list --json=short 2>/dev/null \
        | ${pkgs.jq}/bin/jq -e 'any(.[]; .what == "handle-lid-switch" and .why == "Safe dock/undock display transition" and .mode == "block")' \
            >/dev/null
    }
    batch_moves() { # stdin workspace ids, $1 target
      target="$1"; commands=
      while IFS= read -r ws; do
        case "$ws" in *[!0-9]*|"") continue ;; esac
        commands="$commands dispatch moveworkspacetomonitor $ws $target;"
      done
      printf '%s' "$commands"
    }
    # `monitors` (enabled-only) listing the output is the ONLY proof it is
    # really on: every path here issues keywords hyprctl answers "ok" to
    # without acting.  $1 = output, $2 = polls of 0.2s.
    output_enabled() {
      tries=0
      while [ "$tries" -lt "$2" ]; do
        hyprctl monitors -j 2>/dev/null \
          | jq -e --arg m "$1" 'any(.[]; .name == $m)' >/dev/null && return 0
        tries=$((tries+1)); sleep 0.2
      done
      return 1
    }
    # `hyprctl reload` re-reads the config, and every runtime keyword dies
    # with it — including the `device[<name>]:kb_layout` the keyboard watcher
    # applies to an external board.  Measured on hardware 2026-07-14: a bare
    # reload took a keyboard remembered as `us` straight back to the session's
    # `gb`, so without this the undock's escalation would silently break the
    # layout of any keyboard that stays behind when the dock leaves (a
    # wireless receiver in the laptop; only boards on the dock's own hub are
    # unaffected, and only because they leave with it).  The remembered
    # choices live in the in-flake state, so `restore` is authoritative.
    restore_keyboards() {
      hyprctl devices -j 2>/dev/null | jq -r '.keyboards[].name' 2>/dev/null \
        | while IFS= read -r kb; do
            [ -n "$kb" ] || continue
            ${keyboardTool}/bin/nomarchy-keyboard-layout restore "$kb" \
              >/dev/null 2>&1 || true
          done
    }

    # Dock mode is an *intent*, and until #142 it lived only in the compositor:
    # `keyword monitor <internal>, disable` and nothing written down. Any config
    # reload re-applies the catch-all `monitor=,preferred,auto,1` and re-lights
    # the panel — which is exactly why `undock` below uses `hyprctl reload` as
    # its hammer — so every `nomarchy-home` silently performed an undock and the
    # user re-picked Dock mode by hand.
    #
    # So record the intent where every other setting lives (the in-flake state,
    # menu-writable), and let the watcher re-assert it. `--no-switch`: the
    # watcher reads this at run time; a rebuild here would be both pointless and
    # recursive. Failure to write is never fatal — a session that cannot reach
    # the state file must still dock.
    set_dock_intent() { # $1 = true|false
      ${sync} --quiet set settings.display.dockMode "$1" --no-switch \
        >/dev/null 2>&1 || log "dock-intent=$1 result=state-write-failed"
    }

    case "''${1:-}" in
      dock)
        internal="''${2:-}"; external="''${3:-}"
        rule="''${4:-$external, preferred, auto, 1}"
        valid_output "$internal" && valid_output "$external" \
          || { echo "invalid monitor name" >&2; exit 64; }
        # Fail closed: disabling the panel without this lock recreates the
        # exact cable-removal → logind suspend race #100 is fixing.
        lid_inhibitor_held \
          || { log "transition=dock internal=$internal external=$external result=no-lid-inhibitor"; exit 1; }
        moves=$(workspaces_on "$internal" | batch_moves "$external")
        if hyprctl --batch \
            "keyword monitor $rule; $moves dispatch focusmonitor $external; keyword monitor $internal, disable" \
            >/dev/null 2>&1; then
          set_dock_intent true
          log "transition=dock internal=$internal external=$external result=ok"
        else
          log "transition=dock internal=$internal external=$external result=failed"
          exit 1
        fi ;;
      undock)
        internal="''${2:-}"
        valid_output "$internal" || { echo "invalid monitor name" >&2; exit 64; }
        # Clear the intent *first*: this path runs when the external is already
        # gone, and if anything below fails the last thing the session needs is
        # a watcher that keeps trying to dock to a monitor that left.
        set_dock_intent false
        # Safety-critical ordering: never remove/move away from an external
        # before the internal panel is active and can receive workspaces.
        #
        # With ZERO enabled outputs — an abrupt undock, the panel already
        # disabled by the dock — Hyprland 0.55.4 accepts `keyword monitor`
        # (prints "ok", exits 0) and then never flushes it: the rule is held
        # until some DRM event arrives, and the panel stays dark.  This is
        # deterministic, not a race.  Probed on hardware 2026-07-14: the
        # keyword was inert across 4s and 5s windows in two separate runs,
        # `dispatch forcerendererreload` did not flush it either, and only
        # `hyprctl reload` did — in 99ms and 289ms, with the cable out.
        #
        # Round 6 read the same symptom as a teardown race and re-issued the
        # keyword 25 times a poll.  Retrying an inert command cannot work: it
        # bought 30s of black screen and every `result=ok` in that journal was
        # really the user plugging the cable back in, whose hotplug flushed
        # the queued rule and let the next poll take the credit.
        #
        # So issue the keyword once — enough whenever another output is still
        # enabled, e.g. the menu's Dock mode toggle — and escalate to the
        # reload hammer only when it proves inert.
        hyprctl keyword monitor "$internal,preferred,auto,1" >/dev/null 2>&1
        if ! output_enabled "$internal" 5; then
          log "transition=undock internal=$internal keyword=inert escalate=reload"
          hyprctl reload >/dev/null 2>&1
          if ! output_enabled "$internal" 25; then
            log "transition=undock internal=$internal result=enable-failed"
            # #127: leave evidence on disk without SSH (TTY or next login).
            ${displayDumpTool}/bin/nomarchy-display-dump undock-enable-failed \
              >/dev/null 2>&1 || true
            exit 1
          fi
          # The config's monitor rules own the panel now.  Re-assert the
          # runtime rule — which flushes normally, an output being enabled
          # again — so a config that parks the panel off cannot undo the
          # undock, and give the keyboards back what the reload took.
          hyprctl keyword monitor "$internal,preferred,auto,1" >/dev/null 2>&1
          restore_keyboards
          log "transition=undock internal=$internal enable=via-reload"
        fi
        moves=$(all_workspaces | batch_moves "$internal")
        hyprctl --batch "$moves dispatch focusmonitor $internal" >/dev/null 2>&1 \
          || { log "transition=undock internal=$internal result=move-failed"; exit 1; }
        # #127: undock after idle DPMS left the seat black even when the
        # panel was re-enabled — always light the chain after enable.
        hyprctl dispatch dpms on >/dev/null 2>&1 || true
        log "transition=undock internal=$internal result=ok" ;;
      enable)
        internal="''${2:-}"
        valid_output "$internal" || exit 64
        # Menu ▸ Display ▸ "Screen on". Turning the laptop panel back on *is*
        # leaving dock mode, and saying so is what stops the watcher from
        # re-docking the panel out from under the user a second later (#142).
        # Only the internal clears the intent: lighting some third monitor is
        # not a statement about the lid.
        case "$internal" in
          eDP*|LVDS*|DSI*) set_dock_intent false ;;
        esac
        # Reachable only from the menu, i.e. with a screen already on, so the
        # keyword flushes and no reload escalation is needed — but still make
        # `monitors` the proof, or the menu's "back on" notification cheers
        # for a keyword hyprctl merely said "ok" to.
        hyprctl keyword monitor "$internal,preferred,auto,1" >/dev/null 2>&1
        if output_enabled "$internal" 10; then
          hyprctl dispatch dpms on >/dev/null 2>&1 || true
          true
        else
          false
        fi ;;
      *)
        echo "usage: nomarchy-display-transition [dock <internal> <external> [external-rule]|undock <internal>|enable <internal>]" >&2
        exit 64 ;;
    esac
  ''