import { createHash, randomUUID } from "node:crypto";
import { spawn } from "node:child_process";
import { AgentRunError } from "../common/errors.js";
import { backendCapabilities, backendProfileSpec, backendProfileSpecs, compareBackendProfiles, isBackendProfileSlug } from "../common/backend-profiles.js";
import { dsflashGoModelCatalogFile, dsflashGoModelCatalogJson, dsflashGoModelSlug, dsflashGoRuntimeModelCatalogPath } from "../common/model-catalogs.js";
import type { AgentRunStore } from "./store.js";
import type { BackendProfile, ExecutionPolicy, JsonRecord, JsonValue } from "../common/types.js";
import { asRecord, validateBackendProfile } from "../common/validation.js";
import { redactJson, redactText } from "../common/redaction.js";
import { createKubernetesRunnerJob, type RunnerJobDefaults } from "./kubernetes-runner-job.js";
import { buildRunResult } from "./result.js";
import { runnerJobStatusSummary } from "./runner-job-status.js";

const defaultNamespace = "agentrun-v01";
const credentialAnnotationPrefix = "agentrun.pikastech.local/provider-profile";
const kubectlLastAppliedAnnotation = "kubectl.kubernetes.io/last-applied-configuration";
const providerSecretNamePrefix = "agentrun-v01-provider-";

export interface ProviderProfileOptions {
  namespace?: string;
  kubectlCommand?: string;
}

export interface ProviderProfileValidationOptions extends ProviderProfileOptions {
  store: AgentRunStore;
  sourceCommit: string;
  runnerJobDefaults?: Partial<RunnerJobDefaults>;
}

interface ProfileConfig {
  model: string;
  providerName: string;
  baseUrl: string;
  envKey: string;
  wireApi: "responses";
  displayName: string;
  modelCatalogPath?: string;
}

interface RenderedConfig {
  configToml: string;
  configSummary: JsonRecord;
}

export async function listProviderProfiles(options: ProviderProfileOptions = {}): Promise<JsonRecord> {
  const profiles = await listProviderProfileIds(options);
  const items = await Promise.all(profiles.map((profile) => providerProfileStatus(profile, options)));
  return { items, count: items.length, valuesPrinted: false };
}

export async function listBackendCapabilities(options: ProviderProfileOptions = {}): Promise<JsonRecord> {
  const profiles = new Set<BackendProfile>(backendProfileSpecs.map((spec) => spec.profile));
  try {
    for (const profile of await listProviderProfileIds(options)) profiles.add(profile);
    const dynamicProfiles = [...profiles].filter((profile) => !isBuiltinProviderProfile(profile)).sort(compareBackendProfiles);
    return {
      items: backendCapabilities([...profiles]),
      dynamicProfileDiscovery: {
        status: "succeeded",
        dynamicProfiles,
        dynamicProfileCount: dynamicProfiles.length,
        valuesPrinted: false,
      },
    };
  } catch (error) {
    return {
      items: backendCapabilities([...profiles]),
      dynamicProfileDiscovery: {
        status: "failed",
        failureKind: error instanceof AgentRunError ? error.failureKind : "infra-failed",
        message: redactText(error instanceof Error ? error.message : String(error)),
        valuesPrinted: false,
      },
    };
  }
}

export async function showProviderProfile(profile: string, options: ProviderProfileOptions = {}): Promise<JsonRecord> {
  return providerProfileStatus(validateBackendProfile(profile), options);
}

export async function getProviderProfileConfig(profileValue: string, options: ProviderProfileOptions = {}): Promise<JsonRecord> {
  const profile = validateBackendProfile(profileValue);
  const spec = requiredSpec(profile);
  const namespace = profileNamespace(options);
  const secret = await kubectlGetSecret(spec.defaultSecretName, namespace, options.kubectlCommand ?? "kubectl");
  if (!secret) throw new AgentRunError("secret-unavailable", `provider profile ${profile} Secret is not configured`, { httpStatus: 404, details: { profile, secretRef: secretRefSummary(profile, namespace) } });
  const data = asOptionalRecord(secret.data);
  const annotations = asOptionalRecord(asOptionalRecord(secret.metadata)?.annotations);
  const configToml = configTomlFromData(data, profile);
  return {
    action: "provider-profile-config-read",
    profile,
    configured: hasRequiredKeys(data, spec.requiredSecretKeys),
    secretRef: secretRefSummary(profile, namespace),
    resourceVersion: stringPath(secret, ["metadata", "resourceVersion"]),
    credentialHashSuffix: hashDataKey(data, "auth.json") ?? stringPath(annotations, [`${credentialAnnotationPrefix}-credential-hash-suffix`]),
    configHashSuffix: shortHash(configToml),
    updatedAt: stringPath(annotations, [`${credentialAnnotationPrefix}-updated-at`]) ?? stringPath(secret, ["metadata", "creationTimestamp"]),
    configToml,
    configTomlPrinted: true,
    credentialValuesPrinted: false,
    valuesPrinted: false,
  };
}

export async function removeProviderProfile(profileValue: string, options: ProviderProfileOptions = {}): Promise<JsonRecord> {
  const profile = validateBackendProfile(profileValue);
  const spec = requiredSpec(profile);
  const namespace = profileNamespace(options);
  const secret = await kubectlGetSecret(spec.defaultSecretName, namespace, options.kubectlCommand ?? "kubectl");
  const data = asOptionalRecord(secret?.data);
  const annotations = asOptionalRecord(asOptionalRecord(secret?.metadata)?.annotations);
  if (secret) await kubectlDeleteSecret(spec.defaultSecretName, namespace, options.kubectlCommand ?? "kubectl");
  return {
    action: "provider-profile-removed",
    mutation: true,
    profile,
    configured: false,
    removed: Boolean(secret),
    ...(secret ? {} : { alreadyAbsent: true }),
    ...(isBuiltinProviderProfile(profile) ? { builtinCapabilityRetained: true } : {}),
    secretRef: secretRefSummary(profile, namespace),
    deletedResourceVersion: stringPath(secret, ["metadata", "resourceVersion"]),
    credentialHashSuffix: hashDataKey(data, "auth.json") ?? stringPath(annotations, [`${credentialAnnotationPrefix}-credential-hash-suffix`]),
    configHashSuffix: hashDataKey(data, "config.toml") ?? stringPath(annotations, [`${credentialAnnotationPrefix}-config-hash-suffix`]),
    updatedAt: new Date().toISOString(),
    valuesPrinted: false,
    pollActions: [
      providerActionDescriptor({ action: "list-provider-profiles", operation: "list", resourceKind: "provider-profile", resourceName: "*" }),
      providerActionDescriptor({ action: "inspect-provider-profile", operation: "describe", resourceKind: "provider-profile", resourceName: profile, profile }),
      providerActionDescriptor({ action: "set-provider-key", operation: "set-key", resourceKind: "provider-profile", resourceName: profile, profile, inputKind: "credential" }),
      providerActionDescriptor({ action: "set-provider-config", operation: "set-config", resourceKind: "provider-profile", resourceName: profile, profile, inputKind: "config" }),
    ],
  };
}

export async function setProviderProfileConfig(profileValue: string, body: unknown, options: ProviderProfileOptions = {}): Promise<JsonRecord> {
  const profile = validateBackendProfile(profileValue);
  const spec = requiredSpec(profile);
  const record = asRecord(body ?? {}, "providerProfileConfig");
  const configToml = configTomlField(record, profile);
  const delegatedBy = delegatedBySummary(record.delegatedBy);
  const namespace = profileNamespace(options);
  const existingSecret = await kubectlGetSecret(spec.defaultSecretName, namespace, options.kubectlCommand ?? "kubectl");
  const existingData = asOptionalRecord(existingSecret?.data);
  const authJsonData = dataKey(existingData, "auth.json");
  const credentialHashSuffix = hashDataKey(existingData, "auth.json");
  const secretData = providerProfileSecretData({ profile, authJsonData, configToml, existingData });
  const secretManifest: JsonRecord = {
    apiVersion: "v1",
    kind: "Secret",
    metadata: {
      name: spec.defaultSecretName,
      namespace,
      labels: {
        "app.kubernetes.io/part-of": "agentrun",
        "agentrun.pikastech.local/profile": profile,
      },
      annotations: {
        [`${credentialAnnotationPrefix}-profile`]: profile,
        ...(credentialHashSuffix ? { [`${credentialAnnotationPrefix}-credential-hash-suffix`]: credentialHashSuffix } : {}),
        [`${credentialAnnotationPrefix}-config-hash-suffix`]: shortHash(configToml),
        [`${credentialAnnotationPrefix}-updated-at`]: new Date().toISOString(),
        ...(delegatedBy ? { [`${credentialAnnotationPrefix}-delegated-system`]: delegatedBy.system, [`${credentialAnnotationPrefix}-delegated-request-id`]: delegatedBy.requestId ?? "" } : {}),
      },
    },
    type: "Opaque",
    data: secretData,
  };
  const applied = await kubectlUpsertSecret(secretManifest, options.kubectlCommand ?? "kubectl");
  return {
    action: "provider-profile-config-updated",
    mutation: true,
    profile,
    configured: hasRequiredKeys(secretData, spec.requiredSecretKeys),
    secretRef: secretRefSummary(profile, namespace),
    resourceVersion: objectPath(applied, ["metadata", "resourceVersion"]),
    credentialHashSuffix: credentialHashSuffix ?? null,
    configHashSuffix: shortHash(configToml),
    updatedAt: objectPath(applied, ["metadata", "annotations", `${credentialAnnotationPrefix}-updated-at`]) ?? new Date().toISOString(),
    delegatedBy,
    requiresExternalBridgeUpdate: profileUsesMoonBridge(profile, configToml),
    configTomlPrinted: false,
    credentialValuesPrinted: false,
    valuesPrinted: false,
    pollActions: [
      providerActionDescriptor({ action: "inspect-provider-config", operation: "config", resourceKind: "provider-profile", resourceName: profile, profile }),
      providerActionDescriptor({ action: "inspect-provider-profile", operation: "describe", resourceKind: "provider-profile", resourceName: profile, profile }),
      providerActionDescriptor({ action: "set-provider-key", operation: "set-key", resourceKind: "provider-profile", resourceName: profile, profile, inputKind: "credential" }),
      providerActionDescriptor({ action: "validate-provider-profile", operation: "validate", resourceKind: "provider-profile", resourceName: profile, profile, wait: true, timeoutMs: 120_000 }),
    ],
  };
}

export async function setProviderProfileCredential(profileValue: string, body: unknown, options: ProviderProfileOptions = {}): Promise<JsonRecord> {
  const profile = validateBackendProfile(profileValue);
  const spec = requiredSpec(profile);
  const record = asRecord(body ?? {}, "providerProfileCredential");
  const credential = credentialAuthJson(record);
  const delegatedBy = delegatedBySummary(record.delegatedBy);
  const namespace = profileNamespace(options);
  const existingSecret = await kubectlGetSecret(spec.defaultSecretName, namespace, options.kubectlCommand ?? "kubectl");
  const existingData = asOptionalRecord(existingSecret?.data);
  const renderedConfig = await renderedConfigForWrite(profile, record, options);
  const secretData = providerProfileSecretData({ profile, authJsonData: base64Data(credential.authJson), configToml: renderedConfig.configToml, existingData });
  const secretManifest: JsonRecord = {
    apiVersion: "v1",
    kind: "Secret",
    metadata: {
      name: spec.defaultSecretName,
      namespace,
      labels: {
        "app.kubernetes.io/part-of": "agentrun",
        "agentrun.pikastech.local/profile": profile,
      },
      annotations: {
        [`${credentialAnnotationPrefix}-profile`]: profile,
        [`${credentialAnnotationPrefix}-credential-hash-suffix`]: shortHash(credential.authJson),
        [`${credentialAnnotationPrefix}-config-hash-suffix`]: shortHash(renderedConfig.configToml),
        [`${credentialAnnotationPrefix}-updated-at`]: new Date().toISOString(),
        ...(delegatedBy ? { [`${credentialAnnotationPrefix}-delegated-system`]: delegatedBy.system, [`${credentialAnnotationPrefix}-delegated-request-id`]: delegatedBy.requestId ?? "" } : {}),
      },
    },
    type: "Opaque",
    data: secretData,
  };
  const applied = await kubectlUpsertSecret(secretManifest, options.kubectlCommand ?? "kubectl");
  return {
    action: "provider-profile-credential-updated",
    mutation: true,
    profile,
    configured: hasRequiredKeys(secretData, spec.requiredSecretKeys),
    secretRef: secretRefSummary(profile, namespace),
    resourceVersion: objectPath(applied, ["metadata", "resourceVersion"]),
    credentialHashSuffix: shortHash(credential.authJson),
    configHashSuffix: shortHash(renderedConfig.configToml),
    updatedAt: objectPath(applied, ["metadata", "annotations", `${credentialAnnotationPrefix}-updated-at`]) ?? new Date().toISOString(),
    credentialSource: credential.source,
    configSummary: renderedConfig.configSummary,
    delegatedBy,
    requiresExternalBridgeUpdate: profileUsesMoonBridge(profile, renderedConfig.configToml),
    valuesPrinted: false,
    pollActions: [
      providerActionDescriptor({ action: "inspect-provider-profile", operation: "describe", resourceKind: "provider-profile", resourceName: profile, profile }),
      providerActionDescriptor({ action: "validate-provider-profile", operation: "validate", resourceKind: "provider-profile", resourceName: profile, profile, wait: true, timeoutMs: 120_000 }),
    ],
  };
}

function providerActionDescriptor(input: { action: string; operation: string; resourceKind: string; resourceName: string; profile?: string | null; inputKind?: string | null; wait?: boolean; timeoutMs?: number | null }): JsonRecord {
  return {
    action: input.action,
    operation: input.operation,
    resourceKind: input.resourceKind,
    resourceName: input.resourceName,
    profile: input.profile ?? null,
    ...(input.inputKind ? { inputKind: input.inputKind } : {}),
    ...(input.wait === true ? { wait: true } : {}),
    ...(input.timeoutMs !== undefined ? { timeoutMs: input.timeoutMs } : {}),
    valuesPrinted: false,
  };
}

export async function validateProviderProfile(profileValue: string, body: unknown, options: ProviderProfileValidationOptions): Promise<JsonRecord> {
  const profile = validateBackendProfile(profileValue);
  const namespace = profileNamespace(options);
  const runnerDefaults = runnerDefaultsForValidation(options, namespace);
  const record = body === null ? {} : asRecord(body ?? {}, "providerProfileValidation");
  const validationId = `val_${randomUUID().replace(/-/gu, "")}`;
  const prompt = typeof record.prompt === "string" && record.prompt.trim().length > 0 ? record.prompt.trim() : `只回复 AGENTRUN_PROVIDER_PROFILE_OK_${profile.replace(/[^a-z0-9]/gu, "_").toUpperCase()}`;
  const run = await options.store.createRun({
    tenantId: "hwlab",
    projectId: "pikasTech/HWLAB",
    workspaceRef: { kind: "opaque", path: "/home/agentrun/agentrun-source" },
    providerId: "G14",
    backendProfile: profile,
    executionPolicy: validationExecutionPolicy(profile, namespace),
    traceSink: null,
    sessionRef: { sessionId: `sess_${validationId}`, metadata: { purpose: "provider-profile-validation", validationId, profile } },
    resourceBundleRef: null,
  });
  const command = await options.store.createCommand(run.id, { type: "turn", payload: { prompt }, idempotencyKey: validationId });
  const runnerJob = await createKubernetesRunnerJob({
    store: options.store,
    runId: run.id,
    input: {
      commandId: command.id,
      idempotencyKey: validationId,
      attemptId: `attempt_${validationId.slice(4, 16)}`,
    },
    defaults: runnerDefaults,
  });
  return validationResponse({ profile, validationId, runId: run.id, commandId: command.id, runnerJob, status: "running" });
}

export async function getProviderProfileValidation(profileValue: string, validationId: string, options: { store: AgentRunStore }): Promise<JsonRecord> {
  const profile = validateBackendProfile(profileValue);
  if (!/^val_[a-f0-9]{32}$/u.test(validationId)) throw new AgentRunError("schema-invalid", `validationId ${validationId} is not valid`, { httpStatus: 400 });
  const session = await options.store.getSession(`sess_${validationId}`);
  const runId = session?.lastRunId ?? session?.activeRunId;
  const commandId = session?.lastCommandId ?? session?.activeCommandId;
  if (!runId || !commandId) throw new AgentRunError("schema-invalid", `validation ${validationId} was not found`, { httpStatus: 404 });
  const [result, jobs, events] = await Promise.all([
    buildRunResult(options.store, runId, commandId),
    options.store.listRunnerJobs(runId, commandId),
    options.store.listEvents(runId, 0, 500),
  ]);
  const status = validationStatus(result as JsonRecord);
  return {
    validationId,
    profile,
    runId,
    commandId,
    status,
    result: result as JsonRecord,
    runnerJobs: jobs.map((job) => runnerJobStatusSummary(job, events)),
    lastSeq: events.at(-1)?.seq ?? 0,
    valuesPrinted: false,
  };
}

async function providerProfileStatus(profile: BackendProfile, options: ProviderProfileOptions): Promise<JsonRecord> {
  const spec = requiredSpec(profile);
  const namespace = profileNamespace(options);
  const secretRef = secretRefSummary(profile, namespace);
  const secret = await kubectlGetSecret(spec.defaultSecretName, namespace, options.kubectlCommand ?? "kubectl");
  if (!secret) {
    return {
      profile,
      backendKind: spec.backendKind,
      configured: false,
      failureKind: "secret-unavailable",
      secretRef,
      resourceVersion: null,
      credentialHashSuffix: null,
      configHashSuffix: null,
      updatedAt: null,
      valuesPrinted: false,
    };
  }
  const data = asOptionalRecord(secret.data);
  const annotations = asOptionalRecord(asOptionalRecord(secret.metadata)?.annotations);
  return {
    profile,
    backendKind: spec.backendKind,
    configured: hasRequiredKeys(data, spec.requiredSecretKeys),
    failureKind: hasRequiredKeys(data, spec.requiredSecretKeys) ? null : "secret-unavailable",
    secretRef,
    resourceVersion: stringPath(secret, ["metadata", "resourceVersion"]),
    credentialHashSuffix: hashDataKey(data, "auth.json") ?? stringPath(annotations, [`${credentialAnnotationPrefix}-credential-hash-suffix`]),
    configHashSuffix: hashDataKey(data, "config.toml") ?? stringPath(annotations, [`${credentialAnnotationPrefix}-config-hash-suffix`]),
    updatedAt: stringPath(annotations, [`${credentialAnnotationPrefix}-updated-at`]) ?? stringPath(secret, ["metadata", "creationTimestamp"]),
    keyPresence: Object.fromEntries(spec.requiredSecretKeys.map((key) => [key, typeof data?.[key] === "string"])) as JsonRecord,
    lastValidation: null,
    valuesPrinted: false,
  };
}

async function listProviderProfileIds(options: ProviderProfileOptions): Promise<BackendProfile[]> {
  const profiles = new Set<BackendProfile>(backendProfileSpecs.map((spec) => spec.profile));
  const namespace = profileNamespace(options);
  const secrets = await kubectlListSecrets(namespace, options.kubectlCommand ?? "kubectl");
  for (const item of secrets) {
    const secretProfile = providerProfileFromSecret(item);
    if (secretProfile) profiles.add(secretProfile);
  }
  return [...profiles].sort(compareProviderProfiles);
}

function compareProviderProfiles(left: string, right: string): number {
  return compareBackendProfiles(left, right);
}

function isBuiltinProviderProfile(profile: BackendProfile): boolean {
  return backendProfileSpecs.some((item) => item.profile === profile);
}

function providerProfileFromSecret(secret: JsonRecord): BackendProfile | null {
  const metadata = asOptionalRecord(secret.metadata);
  const labels = asOptionalRecord(metadata?.labels);
  const annotatedProfile = stringPath(asOptionalRecord(metadata?.annotations), [`${credentialAnnotationPrefix}-profile`]);
  const labeledProfile = stringPath(labels, ["agentrun.pikastech.local/profile"]);
  const namedProfile = profileFromSecretName(stringPath(metadata, ["name"]));
  for (const candidate of [annotatedProfile, labeledProfile, namedProfile]) {
    if (candidate && isBackendProfileSlug(candidate)) return candidate;
  }
  return null;
}

function profileFromSecretName(name: string | null): string | null {
  if (!name || !name.startsWith(providerSecretNamePrefix)) return null;
  const profile = name.slice(providerSecretNamePrefix.length);
  return profile.length > 0 ? profile : null;
}

function providerProfileSecretData(input: { profile: BackendProfile; authJsonData?: string | null; configToml: string; existingData?: JsonRecord | null }): JsonRecord {
  const data: JsonRecord = { "config.toml": base64Data(input.configToml) };
  if (input.authJsonData) data["auth.json"] = input.authJsonData;
  const modelCatalogData = input.profile === "dsflash-go" ? dataKey(input.existingData ?? null, dsflashGoModelCatalogFile) ?? defaultModelCatalogData(input.profile) : null;
  if (modelCatalogData) data[dsflashGoModelCatalogFile] = modelCatalogData;
  return data;
}

function defaultModelCatalogData(profile: BackendProfile): string | null {
  return profile === "dsflash-go" ? base64Data(dsflashGoModelCatalogJson()) : null;
}

function credentialAuthJson(record: JsonRecord): { authJson: string; source: "auth-json" | "api-key" } {
  const authJson = record.authJson;
  if (typeof authJson === "string" && authJson.trim().length > 0) return { authJson: authJsonField(authJson), source: "auth-json" };
  const apiKey = stringField(record, "apiKey");
  if (apiKey.length < 8) throw new AgentRunError("secret-unavailable", "apiKey is too short", { httpStatus: 400 });
  return { authJson: `${JSON.stringify(authPayload(apiKey))}\n`, source: "api-key" };
}

function authJsonField(value: string): string {
  if (!value.trim()) throw new AgentRunError("schema-invalid", "authJson is required", { httpStatus: 400 });
  let parsed: unknown;
  try {
    parsed = JSON.parse(value);
  } catch {
    throw new AgentRunError("schema-invalid", "authJson must be valid JSON", { httpStatus: 400 });
  }
  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new AgentRunError("schema-invalid", "authJson must be a JSON object", { httpStatus: 400 });
  return value;
}

function authPayload(apiKey: string): JsonRecord {
  return { OPENAI_API_KEY: apiKey };
}

function renderConfigToml(config: ProfileConfig): string {
  const { contextWindow, autoCompactTokenLimit } = contextWindowSettings(config.model);
  return [
    `model_provider = ${tomlString(config.providerName)}`,
    `model = ${tomlString(config.model)}`,
    `review_model = ${tomlString(config.model)}`,
    "disable_response_storage = true",
    "network_access = \"enabled\"",
    `model_context_window = ${contextWindow}`,
    `model_auto_compact_token_limit = ${autoCompactTokenLimit}`,
    ...(config.modelCatalogPath ? [`model_catalog_json = ${tomlString(config.modelCatalogPath)}`] : []),
    "approvals_reviewer = \"user\"",
    "",
    `[model_providers.${config.providerName}]`,
    `name = ${tomlString(config.displayName)}`,
    `base_url = ${tomlString(config.baseUrl)}`,
    `wire_api = ${tomlString(config.wireApi)}`,
    "requires_openai_auth = true",
    "",
    "[projects.\"/root\"]",
    "trust_level = \"trusted\"",
    "",
    "[projects.\"/home/agentrun/workspaces\"]",
    "trust_level = \"trusted\"",
    "",
    "[tui.model_availability_nux]",
    `${tomlString(config.model)} = 4`,
    "",
    "[notice]",
    "hide_full_access_warning = true",
    "",
  ].join("\n");
}

async function renderedConfigForWrite(profile: BackendProfile, record: JsonRecord, options: ProviderProfileOptions): Promise<RenderedConfig> {
  if (record.config !== undefined && record.config !== null) return renderedConfigFromProfileConfig(configField(record.config, profile), "request-config");
  const existing = await existingConfigToml(profile, options);
  if (existing && existingConfigAllowed(profile, existing)) {
    return { configToml: existing, configSummary: { source: "existing-secret", preserved: true, valuesPrinted: false } };
  }
  return renderedConfigFromProfileConfig(defaultConfig(profile), "profile-default");
}

function renderedConfigFromProfileConfig(config: ProfileConfig, source: string): RenderedConfig {
  return {
    configToml: renderConfigToml(config),
    configSummary: {
      source,
      model: config.model,
      providerName: config.providerName,
      baseUrl: config.baseUrl,
      authField: config.envKey,
      wireApi: config.wireApi,
      modelCatalogJson: config.modelCatalogPath ?? null,
      valuesPrinted: false,
    },
  };
}

async function existingConfigToml(profile: BackendProfile, options: ProviderProfileOptions): Promise<string | null> {
  const spec = requiredSpec(profile);
  const namespace = profileNamespace(options);
  const secret = await kubectlGetSecret(spec.defaultSecretName, namespace, options.kubectlCommand ?? "kubectl");
  const data = asOptionalRecord(secret?.data);
  const value = data?.["config.toml"];
  if (typeof value !== "string" || value.length === 0) return null;
  try {
    return Buffer.from(value, "base64").toString("utf8");
  } catch {
    return null;
  }
}

function existingConfigAllowed(profile: BackendProfile, configToml: string): boolean {
  if (configToml.trim().length === 0) return false;
  if ((profile === "deepseek" || profile === "dsflash-go") && configToml.includes("hyueapi.com")) return false;
  if (profile === "deepseek" && !configToml.includes("hwlab-deepseek-proxy.hwlab-v02.svc.cluster.local")) return false;
  if (profile === "dsflash-go") {
    if (!configToml.includes(dsflashGoModelSlug)) return false;
    if (modelCatalogPathFromConfigToml(configToml) !== dsflashGoRuntimeModelCatalogPath) return false;
    const baseUrl = baseUrlFromConfigToml(configToml);
    if (!baseUrl) return false;
    try {
      if (!isAllowedDsflashBridgeUrl(new URL(baseUrl))) return false;
    } catch {
      return false;
    }
  }
  return true;
}

function configTomlFromData(data: JsonRecord | null, profile: BackendProfile): string {
  const encoded = dataKey(data, "config.toml");
  if (!encoded) throw new AgentRunError("secret-unavailable", `provider profile ${profile} config.toml is not configured`, { httpStatus: 404, details: { profile, key: "config.toml" } });
  try {
    return Buffer.from(encoded, "base64").toString("utf8");
  } catch {
    throw new AgentRunError("schema-invalid", `provider profile ${profile} config.toml is not valid base64`, { httpStatus: 400, details: { profile, key: "config.toml" } });
  }
}

function configTomlField(record: JsonRecord, profile: BackendProfile): string {
  const value = record.configToml;
  if (typeof value !== "string" || value.trim().length === 0) throw new AgentRunError("schema-invalid", "configToml is required", { httpStatus: 400 });
  validateConfigTomlForProfile(profile, value);
  return value;
}

function configField(value: unknown, profile: BackendProfile): ProfileConfig {
  const defaults = defaultConfig(profile);
  if (value === undefined || value === null) return defaults;
  const record = asRecord(value, "config");
  const model = optionalString(record.model) ?? defaults.model;
  const baseUrl = optionalString(record.baseUrl) ?? defaults.baseUrl;
  const providerName = optionalString(record.providerName) ?? defaults.providerName;
  const envKey = optionalString(record.envKey) ?? defaults.envKey;
  if (profile === "dsflash-go" && model !== dsflashGoModelSlug) throw new AgentRunError("schema-invalid", `dsflash-go model must be ${dsflashGoModelSlug}`, { httpStatus: 400 });
  validateBaseUrl(profile, baseUrl);
  if (!/^[A-Z_][A-Z0-9_]{0,63}$/u.test(envKey)) throw new AgentRunError("schema-invalid", "config.envKey must be an uppercase env name", { httpStatus: 400 });
  if (!/^[A-Za-z][A-Za-z0-9_-]{0,63}$/u.test(providerName)) throw new AgentRunError("schema-invalid", "config.providerName must be a provider identifier", { httpStatus: 400 });
  return { ...defaults, model, baseUrl, providerName, envKey };
}

function defaultConfig(profile: BackendProfile): ProfileConfig {
  if (profile === "deepseek") {
    return {
      model: "deepseek-chat",
      providerName: "OpenAI",
      baseUrl: "http://hwlab-deepseek-proxy.hwlab-v02.svc.cluster.local:4000/v1",
      envKey: "OPENAI_API_KEY",
      wireApi: "responses",
      displayName: "OpenAI",
    };
  }
  if (profile === "dsflash-go") {
    return {
      model: "deepseek-v4-flash",
      providerName: "opencode",
      baseUrl: "http://hwlab-deepseek-proxy.hwlab-v02.svc.cluster.local:4000/v1",
      envKey: "OPENAI_API_KEY",
      wireApi: "responses",
      displayName: "Moon Bridge OpenCode Zen Go Flash",
      modelCatalogPath: dsflashGoRuntimeModelCatalogPath,
    };
  }
  if (profile === "minimax-m3") {
    return {
      model: "MiniMax-M3",
      providerName: "minimax",
      baseUrl: "https://api.minimaxi.com/v1",
      envKey: "OPENAI_API_KEY",
      wireApi: "responses",
      displayName: "MiniMax",
    };
  }
  return {
    model: "gpt-5-codex",
    providerName: "openai",
    baseUrl: "https://api.openai.com/v1",
    envKey: "OPENAI_API_KEY",
    wireApi: "responses",
    displayName: "OpenAI",
  };
}

function profileUsesMoonBridge(profile: BackendProfile, configToml: string): boolean {
  return profile === "deepseek" || profile === "dsflash-go" || /hwlab-deepseek-proxy\.hwlab-v02\.svc\.cluster\.local|moon|bridge/iu.test(configToml);
}

function validateBaseUrl(profile: BackendProfile, value: string): void {
  let url: URL;
  try {
    url = new URL(value);
  } catch {
    throw new AgentRunError("schema-invalid", "config.baseUrl must be a valid URL", { httpStatus: 400 });
  }
  if ((profile === "deepseek" || profile === "dsflash-go") && isHyueHost(url.hostname)) {
    throw new AgentRunError("tenant-policy-denied", `${profile} profile must use HWLAB Moon Bridge, not hyueapi.com`, { httpStatus: 403 });
  }
  if (profile === "deepseek" && url.hostname !== "hwlab-deepseek-proxy.hwlab-v02.svc.cluster.local") {
    throw new AgentRunError("tenant-policy-denied", "deepseek profile baseUrl must point to HWLAB v0.2 DeepSeek bridge", { httpStatus: 403 });
  }
  if (profile === "dsflash-go" && !isAllowedDsflashBridgeUrl(url)) {
    throw new AgentRunError("tenant-policy-denied", "dsflash-go profile baseUrl must point to a Moon Bridge service or wrapper-local bridge", { httpStatus: 403 });
  }
}

function validateConfigTomlForProfile(profile: BackendProfile, configToml: string): void {
  if ((profile === "deepseek" || profile === "dsflash-go") && /hyueapi\.com/iu.test(configToml)) {
    throw new AgentRunError("tenant-policy-denied", `${profile} profile must use HWLAB Moon Bridge, not hyueapi.com`, { httpStatus: 403 });
  }
  if (profile === "deepseek" && !configToml.includes("hwlab-deepseek-proxy.hwlab-v02.svc.cluster.local")) {
    throw new AgentRunError("tenant-policy-denied", "deepseek profile config.toml must point to HWLAB v0.2 DeepSeek bridge", { httpStatus: 403 });
  }
  if (profile !== "dsflash-go") return;
  if (!configToml.includes(dsflashGoModelSlug)) throw new AgentRunError("schema-invalid", `dsflash-go config.toml must use model ${dsflashGoModelSlug}`, { httpStatus: 400 });
  if (modelCatalogPathFromConfigToml(configToml) !== dsflashGoRuntimeModelCatalogPath) throw new AgentRunError("schema-invalid", `dsflash-go config.toml must set model_catalog_json to ${dsflashGoRuntimeModelCatalogPath}`, { httpStatus: 400 });
  const baseUrl = baseUrlFromConfigToml(configToml);
  if (!baseUrl) throw new AgentRunError("schema-invalid", "dsflash-go config.toml must include model_providers base_url", { httpStatus: 400 });
  validateBaseUrl(profile, baseUrl);
}

function isHyueHost(hostname: string): boolean {
  return hostname === "hyueapi.com" || hostname.endsWith(".hyueapi.com");
}

function isAllowedDsflashBridgeUrl(url: URL): boolean {
  if (url.hostname === "127.0.0.1" || url.hostname === "localhost") return true;
  if (url.hostname === "hwlab-deepseek-proxy.hwlab-v02.svc.cluster.local") return true;
  return url.hostname.endsWith(".svc.cluster.local") && /moon|bridge|deepseek|opencode/iu.test(url.hostname);
}

function baseUrlFromConfigToml(configToml: string): string | null {
  const match = configToml.match(/^\s*base_url\s*=\s*"([^"]+)"\s*$/mu);
  return match?.[1] ?? null;
}

function modelCatalogPathFromConfigToml(configToml: string): string | null {
  const match = configToml.match(/^\s*model_catalog_json\s*=\s*"([^"]+)"\s*$/mu);
  return match?.[1] ?? null;
}

function contextWindowSettings(model: string): { contextWindow: number; autoCompactTokenLimit: number } {
  if (model === "deepseek-v4-pro" || model === "deepseek-v4-flash") {
    return { contextWindow: 1_000_000, autoCompactTokenLimit: 900_000 };
  }
  return { contextWindow: 200_000, autoCompactTokenLimit: 180_000 };
}

function validationExecutionPolicy(profile: BackendProfile, namespace: string): ExecutionPolicy {
  const spec = requiredSpec(profile);
  return {
    sandbox: "workspace-write",
    approval: "never",
    timeoutMs: 120_000,
    network: "enabled",
    secretScope: {
      allowCredentialEcho: false,
      providerCredentials: [{ profile, secretRef: { namespace, name: spec.defaultSecretName, keys: [...spec.requiredSecretKeys] } }],
    },
  };
}

function runnerDefaultsForValidation(options: ProviderProfileValidationOptions, namespace: string): RunnerJobDefaults {
  const bootRepoUrl = optionalString(options.runnerJobDefaults?.bootRepoUrl ?? process.env.AGENTRUN_BOOT_REPO_URL);
  return {
    namespace,
    managerUrl: options.runnerJobDefaults?.managerUrl ?? process.env.AGENTRUN_INTERNAL_MGR_URL ?? `http://agentrun-mgr.${namespace}.svc.cluster.local:8080`,
    image: options.runnerJobDefaults?.image ?? process.env.AGENTRUN_RUNNER_IMAGE ?? "",
    ...(bootRepoUrl ? { bootRepoUrl } : {}),
    sourceCommit: options.runnerJobDefaults?.sourceCommit ?? options.sourceCommit,
    serviceAccountName: options.runnerJobDefaults?.serviceAccountName ?? process.env.AGENTRUN_RUNNER_SERVICE_ACCOUNT ?? "agentrun-v01-runner",
    kubectlCommand: options.runnerJobDefaults?.kubectlCommand ?? options.kubectlCommand ?? "kubectl",
  };
}

function validationResponse(input: { profile: BackendProfile; validationId: string; runId: string; commandId: string; runnerJob: JsonRecord; status: string }): JsonRecord {
  const jobIdentity = asOptionalRecord(input.runnerJob.jobIdentity);
  const jobName = typeof jobIdentity?.name === "string" ? jobIdentity.name : typeof input.runnerJob.jobName === "string" ? input.runnerJob.jobName : null;
  return {
    action: "provider-profile-validation-started",
    validationId: input.validationId,
    profile: input.profile,
    runId: input.runId,
    commandId: input.commandId,
    jobName,
    status: input.status,
    pollUrl: `/api/v1/provider-profiles/${encodeURIComponent(input.profile)}/validations/${encodeURIComponent(input.validationId)}`,
    runnerJob: input.runnerJob,
    valuesPrinted: false,
  };
}

function validationStatus(result: JsonRecord): string {
  const status = typeof result.status === "string" ? result.status : null;
  const terminalStatus = typeof result.terminalStatus === "string" ? result.terminalStatus : null;
  if (terminalStatus === "completed" || status === "completed") return "completed";
  if (terminalStatus === "cancelled" || status === "cancelled") return "cancelled";
  if (terminalStatus === "failed" || terminalStatus === "blocked" || status === "failed" || status === "blocked") return "failed";
  return "running";
}

function secretRefSummary(profile: BackendProfile, namespace: string): JsonRecord {
  const spec = requiredSpec(profile);
  return { namespace, name: spec.defaultSecretName, keys: [...spec.requiredSecretKeys], valuesPrinted: false };
}

function requiredSpec(profile: BackendProfile) {
  const spec = backendProfileSpec(profile);
  if (!spec) throw new AgentRunError("schema-invalid", `backendProfile ${profile} must be a lowercase slug`, { httpStatus: 400 });
  return spec;
}

function profileNamespace(options: ProviderProfileOptions): string {
  return options.namespace ?? process.env.AGENTRUN_RUNTIME_NAMESPACE ?? defaultNamespace;
}

async function kubectlGetSecret(name: string, namespace: string, kubectlCommand: string): Promise<JsonRecord | null> {
  const result = await runKubectl(kubectlCommand, ["get", "secret", name, "-n", namespace, "-o", "json"]);
  if (result.code !== 0) {
    const failureText = `${result.stderr}\n${result.stdout}`;
    if (/notfound|not found|not-found/iu.test(failureText)) return null;
    throw new AgentRunError("infra-failed", `kubectl get secret ${namespace}/${name} failed with code ${result.code}`, { httpStatus: 502, details: redactJson({ stderr: redactText(result.stderr.slice(-2000)), stdout: redactText(result.stdout.slice(-1000)) }) });
  }
  return parseKubectlObject(result.stdout, "secret");
}

async function kubectlListSecrets(namespace: string, kubectlCommand: string): Promise<JsonRecord[]> {
  const result = await runKubectl(kubectlCommand, ["get", "secrets", "-n", namespace, "-o", "json"]);
  if (result.code !== 0) {
    throw new AgentRunError("infra-failed", `kubectl get secrets ${namespace} failed with code ${result.code}`, { httpStatus: 502, details: redactJson({ stderr: redactText(result.stderr.slice(-2000)), stdout: redactText(result.stdout.slice(-1000)) }) });
  }
  const parsed = parseKubectlObject(result.stdout, "secret-list");
  const items = Array.isArray(parsed.items) ? parsed.items : [];
  return items.filter((item): item is JsonRecord => typeof item === "object" && item !== null && !Array.isArray(item));
}

async function kubectlUpsertSecret(manifest: JsonRecord, kubectlCommand: string): Promise<JsonRecord> {
  const name = stringPath(manifest, ["metadata", "name"]) ?? "<unknown>";
  const namespace = stringPath(manifest, ["metadata", "namespace"]) ?? defaultNamespace;
  const stdin = `${JSON.stringify(manifest)}\n`;
  const replace = await runKubectl(kubectlCommand, ["replace", "-f", "-", "-o", "json"], stdin);
  if (replace.code === 0) return await kubectlRemoveLastAppliedAnnotation(kubectlCommand, name, namespace);
  if (isKubectlNotFoundFailure(replace)) {
    const created = await runKubectl(kubectlCommand, ["create", "-f", "-", "-o", "json"], stdin);
    if (created.code === 0) return parseKubectlObject(created.stdout, "provider profile secret create", { redactSecretData: true });
    throw new AgentRunError("infra-failed", `kubectl create provider profile secret ${namespace}/${name} failed with code ${created.code}`, { httpStatus: 502, details: redactJson({ stderr: redactText(created.stderr.slice(-2000)), stdout: redactText(created.stdout.slice(-1000)) }) });
  }
  throw new AgentRunError("infra-failed", `kubectl replace provider profile secret ${namespace}/${name} failed with code ${replace.code}`, { httpStatus: 502, details: redactJson({ stderr: redactText(replace.stderr.slice(-2000)), stdout: redactText(replace.stdout.slice(-1000)) }) });
}

async function kubectlDeleteSecret(name: string, namespace: string, kubectlCommand: string): Promise<void> {
  const result = await runKubectl(kubectlCommand, ["delete", "secret", name, "-n", namespace, "--ignore-not-found=true"]);
  if (result.code !== 0) {
    throw new AgentRunError("infra-failed", `kubectl delete provider profile secret ${namespace}/${name} failed with code ${result.code}`, { httpStatus: 502, details: redactJson({ stderr: redactText(result.stderr.slice(-2000)), stdout: redactText(result.stdout.slice(-1000)) }) });
  }
}

function isKubectlNotFoundFailure(result: { stdout: string; stderr: string }): boolean {
  return /notfound|not found|not-found/iu.test(`${result.stderr}\n${result.stdout}`);
}

async function kubectlRemoveLastAppliedAnnotation(kubectlCommand: string, name: string, namespace: string): Promise<JsonRecord> {
  const patch = { metadata: { annotations: { [kubectlLastAppliedAnnotation]: null } } };
  const result = await runKubectl(kubectlCommand, ["patch", "secret", name, "-n", namespace, "--type", "merge", "-p", JSON.stringify(patch), "-o", "json"]);
  if (result.code !== 0) {
    throw new AgentRunError("infra-failed", `kubectl remove provider profile secret last-applied annotation ${namespace}/${name} failed with code ${result.code}`, { httpStatus: 502, details: redactJson({ stderr: redactText(result.stderr.slice(-2000)), stdout: redactText(result.stdout.slice(-1000)) }) });
  }
  return parseKubectlObject(result.stdout, "provider profile secret annotation cleanup", { redactSecretData: true });
}

async function runKubectl(kubectlCommand: string, args: string[], stdin?: string): Promise<{ code: number | null; signal: NodeJS.Signals | null; stdout: string; stderr: string }> {
  const child = spawn(kubectlCommand, args, { stdio: ["pipe", "pipe", "pipe"] });
  let stdout = "";
  let stderr = "";
  child.stdout.setEncoding("utf8");
  child.stderr.setEncoding("utf8");
  child.stdout.on("data", (chunk) => { stdout += String(chunk); });
  child.stderr.on("data", (chunk) => { stderr += String(chunk); });
  child.stdin.end(stdin ?? "");
  const result = await new Promise<{ code: number | null; signal: NodeJS.Signals | null }>((resolve, reject) => {
    child.on("error", reject);
    child.on("close", (code, signal) => resolve({ code, signal }));
  }).catch((error: unknown) => {
    throw new AgentRunError("infra-failed", `failed to start kubectl: ${error instanceof Error ? error.message : String(error)}`, { httpStatus: 503 });
  });
  return { ...result, stdout, stderr };
}

function parseKubectlObject(stdout: string, label: string, options: { redactSecretData?: boolean } = {}): JsonRecord {
  try {
    const parsed = JSON.parse(stdout) as unknown;
    if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) return options.redactSecretData ? redactSecretObject(parsed as JsonRecord) : parsed as JsonRecord;
  } catch (error) {
    throw new AgentRunError("infra-failed", `kubectl returned invalid JSON for ${label}: ${error instanceof Error ? error.message : String(error)}`, { httpStatus: 502, details: { stdoutPreview: label.includes("secret") ? "REDACTED" : redactText(stdout.slice(0, 1000)) } });
  }
  throw new AgentRunError("infra-failed", `kubectl returned non-object JSON for ${label}`, { httpStatus: 502 });
}

function redactSecretObject(object: JsonRecord): JsonRecord {
  const copy = JSON.parse(JSON.stringify(object)) as JsonRecord;
  if (copy.data) copy.data = "REDACTED";
  if (copy.stringData) copy.stringData = "REDACTED";
  return copy;
}

function hasRequiredKeys(data: JsonRecord | null, keys: readonly string[]): boolean {
  return keys.every((key) => typeof data?.[key] === "string" && String(data[key]).length > 0);
}

function hashDataKey(data: JsonRecord | null, key: string): string | null {
  const value = data?.[key];
  if (typeof value !== "string" || value.length === 0) return null;
  try {
    return shortHash(Buffer.from(value, "base64").toString("utf8"));
  } catch {
    return shortHash(value);
  }
}

function base64Data(value: string): string {
  return Buffer.from(value, "utf8").toString("base64");
}

function dataKey(data: JsonRecord | null, key: string): string | null {
  const value = data?.[key];
  return typeof value === "string" && value.length > 0 ? value : null;
}

function shortHash(value: string): string {
  return createHash("sha256").update(value).digest("hex").slice(0, 12);
}

function stringField(record: JsonRecord, key: string): string {
  const value = record[key];
  if (typeof value !== "string" || value.trim().length === 0) throw new AgentRunError("schema-invalid", `${key} is required`, { httpStatus: 400 });
  return value.trim();
}

function optionalString(value: unknown): string | undefined {
  return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
}

function objectPath(record: JsonRecord, path: string[]): JsonValue | null {
  let current: unknown = record;
  for (const key of path) {
    if (typeof current !== "object" || current === null || Array.isArray(current)) return null;
    current = (current as JsonRecord)[key];
  }
  return current as JsonValue;
}

function stringPath(record: JsonRecord | null | undefined, path: string[]): string | null {
  if (!record) return null;
  const value = objectPath(record, path);
  return typeof value === "string" ? value : null;
}

function asOptionalRecord(value: unknown): JsonRecord | null {
  return typeof value === "object" && value !== null && !Array.isArray(value) ? value as JsonRecord : null;
}

function delegatedBySummary(value: unknown): JsonRecord | null {
  if (value === undefined || value === null) return null;
  const record = asRecord(value, "delegatedBy");
  const system = optionalString(record.system) ?? "operator-cli";
  return {
    system,
    userId: optionalString(record.userId) ?? null,
    username: optionalString(record.username) ?? null,
    requestId: optionalString(record.requestId) ?? null,
    valuesPrinted: false,
  };
}

function tomlString(value: string): string {
  return JSON.stringify(value);
}