package dev.privacyllc.period.core.data

import android.content.Context
import androidx.room.Room
import dev.privacyllc.period.core.database.PeriodDatabase
import dev.privacyllc.period.domain.prediction.BaselinePredictionEngine
import dev.privacyllc.period.domain.prediction.PredictionEngine
import java.time.Clock

/**
 * The only way in.
 *
 * Everything above this module gets a [CycleRepository] and never learns that
 * Room exists — no `PeriodDatabase` in a signature, no `androidx.room` on a
 * compile classpath, no DAO reachable from a ViewModel. That is what makes the
 * boundary in docs/architecture/README.md a fact rather than an intention, and
 * it is checkable: `grep -rn "androidx.room" app/src domain` returns nothing.
 *
 * The database file lives in app-private storage and is excluded from platform
 * backup — see docs/security/SECURITY.md and the manifest's
 * `data_extraction_rules.xml`.
 */
object CycleData {

    fun repository(
        context: Context,
        engine: PredictionEngine = BaselinePredictionEngine(),
        clock: Clock = Clock.systemDefaultZone(),
    ): CycleRepository = CycleRepository(database(context), engine, clock)

    private fun database(context: Context): PeriodDatabase =
        Room.databaseBuilder(
            context.applicationContext,
            PeriodDatabase::class.java,
            PeriodDatabase.NAME,
        )
            // No fallbackToDestructiveMigration, deliberately. It turns a
            // forgotten migration into silent data loss on update — for this
            // product, a user's entire cycle history gone with no error and no
            // way back. A missing migration must be a crash in testing, not a
            // wipe in production.
            .build()
}
