/* Kas bridge v3-bootstrap. Requires Advanced Google Sheets service (Sheets v4).
 * Never log request bodies, passwords, signatures, or integration keys.
 * All modifications use ONE atomic Sheets batchUpdate, under ScriptLock.
 * Existing rows/formulas are read only; new cash rows are appended.
 */
var KAS_BOOK='1BFsa9bVkxo2WDuJyHGjxW1lnwWLKQei7PgEeLqfmqec';
var KAS_LEDGER='_KAS_RECEIPTS';
var KAS_REJECT_SAFE=false;
var KAS_ACCOUNTS={kecil:[1,2,3],brankas:[9,10,11],laci:[13,14,15]};
function centsValue(value){
  if(typeof value!=='number'||!Number.isFinite(value)||Math.abs(value*100-Math.round(value*100))>0.000001||!Number.isSafeInteger(Math.round(value*100)))throw Error('Saldo / nominal bukan angka USD dua desimal.');
  return Math.round(value*100);
}
function cashRegions(rows){
  var ends={kecil:rows.length,brankas:rows.length,laci:rows.length},totals=[],stocks=[];
  rows.forEach(function(row,i){
    if(i<3)return;
    if(String(row[0]||'').trim().toUpperCase()==='TOTAL')totals.push(i);
    if(String(row[8]||'').trim().toUpperCase()==='STOCK VOUCHER KANTOR')stocks.push(i);
  });
  if(totals.length||stocks.length){
    // Recognize only the verified split template, never guess a boundary from zeros.
    if(totals.length!==1||stocks.length!==1||stocks[0]<5||totals[0]<=stocks[0])throw Error('Batas tabel kas ambigu; admin perlu menetapkan layout.');
    var separator=stocks[0]-1;
    for(var col=8;col<16;col++)if(rows[separator][col]!==''&&rows[separator][col]!==undefined)throw Error('Pemisah kas/voucher tidak kosong; admin perlu menetapkan layout.');
    ends.kecil=totals[0];ends.brankas=ends.laci=separator;
    for(var i=separator;i<rows.length;i++)for(var c=11;c<16;c++)if(rows[i][c]!==''&&rows[i][c]!==undefined)throw Error('Ada data kas di luar batas brankas/laci; hanya baca sampai layout ditetapkan.');
    for(var i=totals[0]+1;i<rows.length;i++)for(var c=0;c<5;c++)if(rows[i][c]!==''&&rows[i][c]!==undefined)throw Error('Ada data kas di luar batas Total; hanya baca sampai layout ditetapkan.');
  }
  return ends;
}
function cashSnapshot(rows){
  if(rows.length<3)throw Error('Tab bukan format kas.');
  var header=rows[1].map(function(x){return String(x).trim().replace(/\s+/g,' ').toUpperCase();});
  // Exact, column-specific aliases. Titles must never compensate for a wrong header.
  var expected={0:/^(TANGGAL|DATE)$/,1:/^(KELUAR|OUT|SALDO KELUAR \$)$/,2:/^(MASUK|INCOME|SALDO MASUK \$)$/,3:/^(SALDO|BALANCE|SISA SALDO \$)$/,4:/^(KETERANGAN|DESCRIPTION)$/,8:/^(TANGGAL|DATE)$/,9:/^(KELUAR|OUT|SALDO KELUAR \$)$/,10:/^(MASUK|INCOME|SALDO MASUK \$)$/,11:/^(SALDO|BALANCE|SISA \$ BRANKAS)$/,12:/^(KETERANGAN|DESCRIPTION)$/,13:/^(KELUAR|OUT|SALDO KELUAR \$)$/,14:/^(MASUK|INCOME|SALDO MASUK \$)$/,15:/^(SALDO|BALANCE|SISA \$ LACI)$/};
  Object.keys(expected).forEach(function(col){if(!expected[col].test(header[col]||''))throw Error('Header kas belum cocok pada kolom '+(Number(col)+1)+'; hanya baca.');});
  var balances={},ends=cashRegions(rows);
  Object.keys(KAS_ACCOUNTS).forEach(function(key){
    var cols=KAS_ACCOUNTS[key],balance=centsValue(rows[2][cols[2]]);
    for(var i=3;i<ends[key];i++){
      var row=rows[i],out=row[cols[0]],inc=row[cols[1]],shown=row[cols[2]];
      var outgoing=out===''||out===undefined?0:centsValue(out),incoming=inc===''||inc===undefined?0:centsValue(inc);
      if(outgoing<0||incoming<0)throw Error('Arus kas negatif tidak didukung.');
      balance=balance-outgoing+incoming;
      if(!Number.isSafeInteger(balance))throw Error('Saldo melampaui batas.');
      if(shown!==''&&shown!==undefined){if(centsValue(shown)!==balance)throw Error('Saldo/formula tidak cocok dengan arus kas; tidak diperbaiki otomatis.');}
      else if(outgoing||incoming)throw Error('Saldo transaksi tidak tersedia.');
    }
    balances[key]=balance;
  });
  return balances;
}
function requireAppendLayout(rows){
  var ends=cashRegions(rows);
  if(rows[0][5]!=='KAS_APPEND_V2'||Object.keys(ends).some(function(k){return ends[k]!==rows.length;}))throw Error('Layout kas terpetakan, tetapi layout penulisan belum disetujui. Hanya baca: tentukan baris input per kas dan kebijakan formula/Total/voucher, atau ledger khusus baru; tidak menambah baris otomatis.');
}
// Narrow, approved onboarding contract; never grant append rights to the source.
function bootstrapSource(rows){
  var balances=cashSnapshot(rows),ends=cashRegions(rows);
  if(rows[0][5]==='KAS_APPEND_V2'||ends.kecil!==114||ends.brankas!==56||ends.laci!==56)throw Error('Batas NOVEMBER berubah; onboarding diblokir.');
  return {source:'NOVEMBER',name:'NOVEMBER APP',sourceHash:hash(JSON.stringify(rows)),balances:balances};
}
function validName(name){if(typeof name!=='string'||!name.trim()||name.length>80||/[\[\]:*?/\\\x00-\x1f]/.test(name)||name.indexOf('_KAS_')===0)throw Error('Nama tab tidak valid.');return name;}
function validateId(p){if(!p||!/^[a-f0-9]{32}$/.test(p.id)||typeof p.actor!=='string'||p.actor.length>150)throw Error('Identitas transaksi tidak valid.');}
function planTransaction(balances,p){
  validateId(p);validName(p.tab);
  if(!Object.prototype.hasOwnProperty.call(KAS_ACCOUNTS,p.source)||['in','out','transfer'].indexOf(p.kind)<0||!Number.isSafeInteger(p.cents)||p.cents<1||p.cents>100000000||typeof p.note!=='string'||!p.note.trim()||p.note.length>200)throw Error('Transaksi tidak valid.');
  if(p.kind==='transfer'&&(!Object.prototype.hasOwnProperty.call(KAS_ACCOUNTS,p.target)||p.target===p.source))throw Error('Tujuan transfer tidak valid.');
  var next=Object.assign({},balances),row=Array(16).fill(''),cols=KAS_ACCOUNTS[p.source];
  if(p.kind==='in'){next[p.source]+=p.cents;row[cols[1]]=p.cents/100;}
  else{if(next[p.source]<p.cents)throw Error('Saldo kas tidak cukup.');next[p.source]-=p.cents;row[cols[0]]=p.cents/100;}
  if(p.kind==='transfer'){next[p.target]+=p.cents;row[KAS_ACCOUNTS[p.target][1]]=p.cents/100;}
  Object.keys(KAS_ACCOUNTS).forEach(function(k){if(!Number.isSafeInteger(next[k]))throw Error('Saldo melampaui batas.');row[KAS_ACCOUNTS[k][2]]=next[k]/100;});
  row[0]=row[8]=new Date().toISOString();row[4]=row[12]='['+p.id+'] '+p.actor+' · '+p.kind+' '+p.source+(p.target?' → '+p.target:'')+' · '+p.note;
  return {balances:next,row:row};
}
function cell(value){return {userEnteredValue:typeof value==='number'?{numberValue:value}:{stringValue:String(value)}};}
function appendRequest(sheetId,row){return {appendCells:{sheetId:sheetId,rows:[{values:row.map(cell)}],fields:'userEnteredValue'}};}
function rowsOf(sheet){if(sheet.getLastRow()>10000||sheet.getLastColumn()>100)throw Error('Tab terlalu besar; perlu pemeriksaan admin.');return sheet.getRange(1,1,Math.max(sheet.getLastRow(),3),Math.max(sheet.getLastColumn(),16)).getValues();}
function receipt(sheet,id){var rows=sheet.getDataRange().getValues();for(var i=1;i<rows.length;i++){if(rows[i][0]===id)return {hash:rows[i][1],result:JSON.parse(rows[i][2])};}return null;}
function hex(bytes){return bytes.map(function(b){return ('0'+((b+256)%256).toString(16)).slice(-2);}).join('');}
function hash(text){return hex(Utilities.computeDigest(Utilities.DigestAlgorithm.SHA_256,text,Utilities.Charset.UTF_8));}
function same(a,b){if(typeof a!=='string'||typeof b!=='string'||a.length!==b.length)return false;var diff=0;for(var i=0;i<a.length;i++)diff|=a.charCodeAt(i)^b.charCodeAt(i);return diff===0;}
function authenticate(e,props){
  if(!e||!e.postData||e.postData.contents.length>20000)throw Error('Tidak sah.');
  var env=JSON.parse(e.postData.contents),secret=props.getProperty('KAS_SECRET');
  if(!secret||secret.length<43||!/^\d{10}$/.test(env.timestamp)||Math.abs(Date.now()/1000-Number(env.timestamp))>180||!/^[a-f0-9]{32}$/.test(env.nonce)||typeof env.body!=='string')throw Error('Tidak sah.');
  var expected=hex(Utilities.computeHmacSha256Signature(env.timestamp+'\n'+env.nonce+'\n'+env.body,secret));
  if(!same(expected,env.signature))throw Error('Tidak sah.');
  var key='NONCE_'+env.nonce;
  if(props.getProperty(key))throw Error('Permintaan sudah digunakan.');
  var all=props.getProperties();Object.keys(all).forEach(function(k){if(k.indexOf('NONCE_')===0&&Number(all[k])<Date.now()-360000)props.deleteProperty(k);});
  props.setProperty(key,String(Date.now()));
  return JSON.parse(env.body);
}
function stateOf(book,p){
  if(!p.tab&&book.getSheetByName('NOVEMBER APP'))p=Object.assign({},p,{tab:'NOVEMBER APP'});
  var tabs=[],selected=null,selectedRows=null,selectedBalances=null,selectedWritable=false,warning='';
  book.getSheets().forEach(function(s){
    if(s.getName().indexOf('_KAS_')===0)return;
    var rows=null,balances=null,writable=false,issue='';
    try{rows=rowsOf(s);balances=cashSnapshot(rows);requireAppendLayout(rows);writable=true;}catch(err){issue='Hanya baca: '+err.message;}
    if(p.admin||balances)tabs.push({name:s.getName(),cash:writable});
    if(s.getName()===p.tab&&(p.admin||balances)){selected=s;selectedRows=rows;selectedBalances=balances;selectedWritable=writable;warning=issue;}
  });
  if(!selected&&tabs.length){return stateOf(book,{admin:p.admin,tab:tabs[0].name});}
  var bootstrap=null;
  if(p.admin===true&&selected&&selected.getName()==='NOVEMBER'&&!book.getSheetByName('NOVEMBER APP')){
    try{bootstrap=bootstrapSource(selectedRows);}catch(err){}
  }
  return {ok:true,version:'v3-bootstrap',bootstrap:bootstrap,tabs:tabs,tab:selected?selected.getName():'',cash:selectedWritable,mapped:!!selectedBalances,balances:selectedBalances,warning:warning,rows:selectedRows?selectedRows.slice(0,200).map(function(r){return r.map(function(v){return v instanceof Date?v.toISOString():String(v);});}):[],readAt:new Date().toISOString(),truncated:!!selectedRows&&selectedRows.length>200};
}
function executeOperation(book,action,p){
  validateId(p);
  var ledger=book.getSheetByName(KAS_LEDGER);if(!ledger)throw Error('Jalankan installKas sekali.');
  var digest=hash(JSON.stringify({action:action,payload:p})),old=receipt(ledger,p.id);
  if(old){if(old.hash!==digest)throw Error('ID bentrok.');return old.result;}
  // Only a confirmed absent receipt permits a definite pre-write rejection.
  KAS_REJECT_SAFE=true;
  var requests=[],result={ok:true,id:p.id};
  if(action==='transaction'){
    var sheet=book.getSheetByName(validName(p.tab));if(!sheet)throw Error('Tab tidak ditemukan.');
    var rows=rowsOf(sheet),balances=cashSnapshot(rows);requireAppendLayout(rows);
    var planned=planTransaction(balances,p);
    requests.push(appendRequest(sheet.getSheetId(),planned.row));result.balances=planned.balances;
  }else if(action==='period'||action==='bootstrap'){
    validName(p.name);validName(p.source);if(book.getSheetByName(p.name))throw Error('Nama tab sudah ada.');
    var source=book.getSheetByName(p.source);if(!source)throw Error('Sumber tidak ditemukan.');
    var sourceRows=rowsOf(source),balances=cashSnapshot(sourceRows);
    if(action==='bootstrap'){
      if(p.admin!==true||p.confirm!==true||p.source!=='NOVEMBER'||p.name!=='NOVEMBER APP')throw Error('Konfirmasi onboarding admin diperlukan.');
      var approved=bootstrapSource(sourceRows);
      if(!same(p.sourceHash,approved.sourceHash))throw Error('Snapshot berubah; muat ulang dan konfirmasi kembali.');
      result.sourceHash=approved.sourceHash;
    }else requireAppendLayout(sourceRows);
    var sheetId=Math.floor(Math.random()*2000000000)+1;
    while(book.getSheets().some(function(s){return s.getSheetId()===sheetId;}))sheetId=Math.floor(Math.random()*2000000000)+1;
    var title=Array(16).fill(''),headers=Array(16).fill(''),opening=Array(16).fill('');
    title[0]='KAS KECIL';title[8]='BRANKAS LEADER';title[13]='LACI LEADER';title[5]='KAS_APPEND_V2';
    headers[0]=headers[8]='TANGGAL';headers[4]=headers[12]='KETERANGAN';
    Object.keys(KAS_ACCOUNTS).forEach(function(k){var c=KAS_ACCOUNTS[k];headers[c[0]]='KELUAR';headers[c[1]]='MASUK';headers[c[2]]='SALDO';opening[c[2]]=balances[k]/100;});
    opening[4]=opening[12]='Saldo awal snapshot '+p.source+' · '+p.actor;
    requests.push({addSheet:{properties:{sheetId:sheetId,title:p.name,gridProperties:{rowCount:1000,columnCount:16,frozenRowCount:3}}}});
    requests.push({updateCells:{start:{sheetId:sheetId,rowIndex:0,columnIndex:0},rows:[title,headers,opening].map(function(r){return {values:r.map(cell)};}),fields:'userEnteredValue'}});
    result.tab=p.name;result.opening=balances;
  }else throw Error('Aksi tidak dikenal.');
  requests.push(appendRequest(ledger.getSheetId(),[p.id,digest,JSON.stringify(result),new Date().toISOString(),p.actor,action]));
  KAS_REJECT_SAFE=false;
  Sheets.Spreadsheets.batchUpdate({requests:requests},KAS_BOOK);
  SpreadsheetApp.flush();
  var saved=receipt(book.getSheetByName(KAS_LEDGER),p.id);
  if(!saved||saved.hash!==digest)throw Error('Konfirmasi belum terbaca. Ulangi ID yang sama.');
  return saved.result;
}
function doPost(e){
  KAS_REJECT_SAFE=false;
  var lock=LockService.getScriptLock();
  try{
    if(!lock.tryLock(25000))throw Error('Sibuk. Ulangi ID yang sama.');
    var command=authenticate(e,PropertiesService.getScriptProperties());
    var book=SpreadsheetApp.openById(KAS_BOOK),result;
    if(command.action==='state')result=stateOf(book,command.payload||{});
    else result=executeOperation(book,command.action,command.payload);
    return jsonResponse(result);
  }catch(err){return jsonResponse({ok:false,rejected:KAS_REJECT_SAFE,error:'Permintaan ditolak. Periksa konfigurasi/header/saldo atau ulangi ID yang sama.'});}
  finally{if(lock.hasLock())lock.releaseLock();}
}
function doGet(){return jsonResponse({ok:false,error:'Akses hanya melalui server Kas bertanda tangan.'});}
function jsonResponse(data){return ContentService.createTextOutput(JSON.stringify(data)).setMimeType(ContentService.MimeType.JSON);}
function installKas(){
  var lock=LockService.getScriptLock();lock.waitLock(25000);
  try{
    var props=PropertiesService.getScriptProperties();if(!props.getProperty('KAS_SECRET')||props.getProperty('KAS_SECRET').length<43)throw Error('Isi KAS_SECRET di Script Properties terlebih dahulu.');
    var book=SpreadsheetApp.openById(KAS_BOOK);if(book.getSheetByName(KAS_LEDGER))return 'Ledger sudah tersedia; tidak diubah.';
    var sheetId=Math.floor(Math.random()*2000000000)+1;
    Sheets.Spreadsheets.batchUpdate({requests:[{addSheet:{properties:{sheetId:sheetId,title:KAS_LEDGER,hidden:true,gridProperties:{rowCount:1000,columnCount:6}}}},{updateCells:{start:{sheetId:sheetId,rowIndex:0,columnIndex:0},rows:[{values:['ID','SHA256','RESULT','TIME','ACTOR','ACTION'].map(cell)}],fields:'userEnteredValue'}}]},KAS_BOOK);
    return 'Kas siap. Tidak ada baris/formula lama yang diubah.';
  }finally{lock.releaseLock();}
}