import { Buffer } from "node:buffer";
import { createHash } from "node:crypto";
import type { UniDeskConfig } from "./config";
import { rootPath } from "./config";
import type { RenderedCliResult } from "./output";
import {
  capture,
  compactCapture,
  createYamlFieldReader,
  parseJsonOutput,
  readYamlRecord,
  shQuote,
} from "./platform-infra-ops-library";

const configFile = rootPath("config", "platform-infra", "secret-plane.yaml");
const configLabel = "config/platform-infra/secret-plane.yaml";
const fieldManager = "unidesk-platform-infra-secret-plane";
const serviceId = "secret-plane";
const y = createYamlFieldReader(configLabel);

type ImagePullPolicy = "Always" | "IfNotPresent" | "Never";

interface ImageSpec {
  repository: string;
  tag: string;
  pullPolicy: ImagePullPolicy;
}

interface SecretPlaneTarget {
  id: string;
  route: string;
  namespace: string;
  role: "active" | "standby";
  enabled: boolean;
  createNamespace: boolean;
}

interface EsoConfig {
  enabled: boolean;
  version: string;
  manifestUrl: string;
  releaseName: string;
  controllerDeploymentName: string;
  webhookDeploymentName: string;
  certControllerDeploymentName: string;
  crds: string[];
}

interface VaultConfig {
  mode: "dev-kv-v2";
  deploymentName: string;
  serviceName: string;
  tokenSecretName: string;
  tokenSecretKey: string;
  image: ImageSpec;
  port: number;
  bootstrap: {
    tokenMode: "generated-if-missing";
    tokenLengthBytes: number;
  };
}

interface SyncProbeConfig {
  secretStoreName: string;
  clusterSecretStoreName: string;
  externalSecretName: string;
  targetSecretName: string;
  refreshInterval: string;
  vaultMountPath: string;
  remotePath: string;
  remoteProperty: string;
  expectedFingerprint: string;
  testValueSource: {
    mode: "repo-poc-static";
    value: string;
  };
  consumer: {
    deploymentName: string;
    envName: string;
    image: ImageSpec;
  };
}

interface SecretPlaneConfig {
  version: number;
  kind: "platform-infra-secret-plane";
  metadata: {
    id: string;
    owner: string;
    spec: string;
    relatedIssues: number[];
  };
  defaults: { targetId: string };
  targets: SecretPlaneTarget[];
  eso: EsoConfig;
  vault: VaultConfig;
  syncProbe: SyncProbeConfig;
  validation: {
    timeoutSeconds: number;
    pollSeconds: number;
  };
}

interface CommonOptions {
  targetId: string | null;
  full: boolean;
  raw: boolean;
}

interface ApplyOptions extends CommonOptions {
  dryRun: boolean;
  confirm: boolean;
}

export async function runSecretPlaneCommand(config: UniDeskConfig, args: string[]): Promise<Record<string, unknown> | RenderedCliResult> {
  const [action] = args;
  if (action === undefined || action === "plan") {
    const options = parseCommonOptions(args.slice(action === "plan" ? 1 : 0));
    const result = plan(options);
    return options.full || options.raw ? result : renderPlan(result);
  }
  if (action === "apply") return await apply(config, parseApplyOptions(args.slice(1)));
  if (action === "status") {
    const options = parseCommonOptions(args.slice(1));
    const result = await status(config, options);
    return options.full || options.raw ? result : renderStatus(result);
  }
  if (action === "validate") return await validate(config, parseCommonOptions(args.slice(1)));
  return {
    ok: false,
    error: "unsupported-platform-infra-secret-plane-command",
    args,
    usage: [
      "bun scripts/cli.ts platform-infra secret-plane plan --target D518",
      "bun scripts/cli.ts platform-infra secret-plane apply --target D518 --dry-run",
      "bun scripts/cli.ts platform-infra secret-plane apply --target D518 --confirm",
      "bun scripts/cli.ts platform-infra secret-plane status --target D518",
      "bun scripts/cli.ts platform-infra secret-plane validate --target D518",
    ],
  };
}

function readSecretPlaneConfig(): SecretPlaneConfig {
  const root = readYamlRecord<Record<string, unknown>>(configFile, "platform-infra-secret-plane");
  const version = y.integerField(root, "version", "");
  if (version !== 1) throw new Error(`${configLabel}.version must be 1`);
  const metadata = y.objectField(root, "metadata", "");
  const defaults = y.objectField(root, "defaults", "");
  const eso = parseEso(y.objectField(root, "eso", ""));
  const vault = parseVault(y.objectField(root, "vault", ""));
  const syncProbe = parseSyncProbe(y.objectField(root, "syncProbe", ""));
  const validation = y.objectField(root, "validation", "");
  const parsed: SecretPlaneConfig = {
    version,
    kind: "platform-infra-secret-plane",
    metadata: {
      id: y.stringField(metadata, "id", "metadata"),
      owner: y.stringField(metadata, "owner", "metadata"),
      spec: y.stringField(metadata, "spec", "metadata"),
      relatedIssues: y.numberArrayField(metadata, "relatedIssues", "metadata"),
    },
    defaults: { targetId: y.stringField(defaults, "targetId", "defaults") },
    targets: y.arrayOfRecords(root.targets, "targets").map(parseTarget),
    eso,
    vault,
    syncProbe,
    validation: {
      timeoutSeconds: y.integerField(validation, "timeoutSeconds", "validation"),
      pollSeconds: y.integerField(validation, "pollSeconds", "validation"),
    },
  };
  if (parsed.targets.length === 0) throw new Error(`${configLabel}.targets must not be empty`);
  resolveTarget(parsed, parsed.defaults.targetId);
  if (!/^sha256:[a-f0-9]{64}$/u.test(parsed.syncProbe.expectedFingerprint)) throw new Error(`${configLabel}.syncProbe.expectedFingerprint must be a sha256 fingerprint`);
  const actualFingerprint = sha256Fingerprint(parsed.syncProbe.testValueSource.value);
  if (actualFingerprint !== parsed.syncProbe.expectedFingerprint) throw new Error(`${configLabel}.syncProbe.expectedFingerprint does not match syncProbe.testValueSource.value`);
  if (parsed.validation.timeoutSeconds < 5 || parsed.validation.timeoutSeconds > 55) throw new Error(`${configLabel}.validation.timeoutSeconds must be between 5 and 55`);
  if (parsed.validation.pollSeconds < 1 || parsed.validation.pollSeconds > parsed.validation.timeoutSeconds) throw new Error(`${configLabel}.validation.pollSeconds must be between 1 and timeoutSeconds`);
  return parsed;
}

function parseTarget(record: Record<string, unknown>, index: number): SecretPlaneTarget {
  const path = `targets[${index}]`;
  return {
    id: y.stringField(record, "id", path),
    route: y.stringField(record, "route", path),
    namespace: y.kubernetesNameField(record, "namespace", path),
    role: y.enumField(record, "role", path, ["active", "standby"] as const),
    enabled: y.booleanField(record, "enabled", path),
    createNamespace: y.booleanField(record, "createNamespace", path),
  };
}

function parseEso(record: Record<string, unknown>): EsoConfig {
  return {
    enabled: y.booleanField(record, "enabled", "eso"),
    version: y.stringField(record, "version", "eso"),
    manifestUrl: y.httpsUrlField(record, "manifestUrl", "eso"),
    releaseName: y.stringField(record, "releaseName", "eso"),
    controllerDeploymentName: y.kubernetesNameField(record, "controllerDeploymentName", "eso"),
    webhookDeploymentName: y.kubernetesNameField(record, "webhookDeploymentName", "eso"),
    certControllerDeploymentName: y.kubernetesNameField(record, "certControllerDeploymentName", "eso"),
    crds: y.stringArrayField(record, "crds", "eso"),
  };
}

function parseVault(record: Record<string, unknown>): VaultConfig {
  const bootstrap = y.objectField(record, "bootstrap", "vault");
  return {
    mode: y.enumField(record, "mode", "vault", ["dev-kv-v2"] as const),
    deploymentName: y.kubernetesNameField(record, "deploymentName", "vault"),
    serviceName: y.kubernetesNameField(record, "serviceName", "vault"),
    tokenSecretName: y.kubernetesNameField(record, "tokenSecretName", "vault"),
    tokenSecretKey: y.stringField(record, "tokenSecretKey", "vault"),
    image: parseImage(y.objectField(record, "image", "vault"), "vault.image"),
    port: y.portField(record, "port", "vault"),
    bootstrap: {
      tokenMode: y.enumField(bootstrap, "tokenMode", "vault.bootstrap", ["generated-if-missing"] as const),
      tokenLengthBytes: y.integerField(bootstrap, "tokenLengthBytes", "vault.bootstrap"),
    },
  };
}

function parseSyncProbe(record: Record<string, unknown>): SyncProbeConfig {
  const testValueSource = y.objectField(record, "testValueSource", "syncProbe");
  const consumer = y.objectField(record, "consumer", "syncProbe");
  const remoteProperty = y.stringField(record, "remoteProperty", "syncProbe");
  if (!/^[A-Za-z0-9._-]+$/u.test(remoteProperty)) throw new Error(`${configLabel}.syncProbe.remoteProperty must be a simple key`);
  return {
    secretStoreName: y.kubernetesNameField(record, "secretStoreName", "syncProbe"),
    clusterSecretStoreName: y.kubernetesNameField(record, "clusterSecretStoreName", "syncProbe"),
    externalSecretName: y.kubernetesNameField(record, "externalSecretName", "syncProbe"),
    targetSecretName: y.kubernetesNameField(record, "targetSecretName", "syncProbe"),
    refreshInterval: y.stringField(record, "refreshInterval", "syncProbe"),
    vaultMountPath: y.stringField(record, "vaultMountPath", "syncProbe"),
    remotePath: y.stringField(record, "remotePath", "syncProbe"),
    remoteProperty,
    expectedFingerprint: y.stringField(record, "expectedFingerprint", "syncProbe"),
    testValueSource: {
      mode: y.enumField(testValueSource, "mode", "syncProbe.testValueSource", ["repo-poc-static"] as const),
      value: y.stringField(testValueSource, "value", "syncProbe.testValueSource"),
    },
    consumer: {
      deploymentName: y.kubernetesNameField(consumer, "deploymentName", "syncProbe.consumer"),
      envName: y.envKeyField(consumer, "envName", "syncProbe.consumer"),
      image: parseImage(y.objectField(consumer, "image", "syncProbe.consumer"), "syncProbe.consumer.image"),
    },
  };
}

function parseImage(record: Record<string, unknown>, path: string): ImageSpec {
  const image = {
    repository: y.stringField(record, "repository", path),
    tag: y.stringField(record, "tag", path),
    pullPolicy: y.enumField(record, "pullPolicy", path, ["Always", "IfNotPresent", "Never"] as const),
  };
  if (!/^[A-Za-z0-9._/:@-]+$/u.test(`${image.repository}:${image.tag}`)) throw new Error(`${configLabel}.${path} must render a valid image reference`);
  return image;
}

function resolveTarget(secretPlane: SecretPlaneConfig, targetId: string | null): SecretPlaneTarget {
  const resolved = targetId ?? secretPlane.defaults.targetId;
  const target = secretPlane.targets.find((item) => item.id.toLowerCase() === resolved.toLowerCase());
  if (target === undefined) throw new Error(`unknown secret-plane target ${resolved}; known targets: ${secretPlane.targets.map((item) => item.id).join(", ")}`);
  if (!target.enabled) throw new Error(`secret-plane target ${target.id} is disabled in ${configLabel}`);
  return target;
}

function plan(options: CommonOptions): Record<string, unknown> {
  const secretPlane = readSecretPlaneConfig();
  const target = resolveTarget(secretPlane, options.targetId);
  const yaml = renderWorkloadManifest(secretPlane, target);
  const policy = policyChecks(secretPlane, target, yaml);
  return {
    ok: policy.every((check) => check.ok),
    action: "platform-infra-secret-plane-plan",
    mutation: false,
    config: configSummary(secretPlane, target),
    renderPlan: {
      target: targetSummary(target),
      objects: manifestObjectSummary(yaml),
      eso: {
        enabled: secretPlane.eso.enabled,
        version: secretPlane.eso.version,
        manifestUrl: secretPlane.eso.manifestUrl,
        namespaceRewrite: target.namespace,
        crds: secretPlane.eso.crds,
        deployments: [
          secretPlane.eso.controllerDeploymentName,
          secretPlane.eso.webhookDeploymentName,
          secretPlane.eso.certControllerDeploymentName,
        ],
      },
      vault: vaultSummary(secretPlane, target),
      syncProbe: syncProbeSummary(secretPlane),
    },
    policy,
    next: {
      dryRun: `bun scripts/cli.ts platform-infra secret-plane apply --target ${target.id} --dry-run`,
      apply: `bun scripts/cli.ts platform-infra secret-plane apply --target ${target.id} --confirm`,
      status: `bun scripts/cli.ts platform-infra secret-plane status --target ${target.id}`,
      validate: `bun scripts/cli.ts platform-infra secret-plane validate --target ${target.id}`,
    },
  };
}

async function apply(config: UniDeskConfig, options: ApplyOptions): Promise<Record<string, unknown>> {
  const secretPlane = readSecretPlaneConfig();
  const target = resolveTarget(secretPlane, options.targetId);
  const workloadYaml = renderWorkloadManifest(secretPlane, target);
  const policy = policyChecks(secretPlane, target, workloadYaml);
  if (!policy.every((check) => check.ok)) {
    return { ok: false, action: "platform-infra-secret-plane-apply", mode: "policy-blocked", mutation: false, policy };
  }
  const esoYaml = secretPlane.eso.enabled ? await fetchEsoManifest(secretPlane, target) : "";
  const script = options.dryRun
    ? dryRunScript(secretPlane, target, esoYaml, workloadYaml)
    : applyScript(secretPlane, target, esoYaml, workloadYaml);
  const result = await capture(config, target.route, ["sh"], script);
  const parsed = parseJsonOutput(result.stdout);
  return {
    ok: result.exitCode === 0 && parsed?.ok === true,
    action: "platform-infra-secret-plane-apply",
    mode: options.dryRun ? "dry-run" : "confirmed",
    mutation: !options.dryRun,
    target: targetSummary(target),
    config: configSummary(secretPlane, target),
    policy,
    remote: parsed ?? compactCapture(result, { full: true }),
    next: {
      status: `bun scripts/cli.ts platform-infra secret-plane status --target ${target.id}`,
      validate: `bun scripts/cli.ts platform-infra secret-plane validate --target ${target.id}`,
    },
  };
}

async function status(config: UniDeskConfig, options: CommonOptions): Promise<Record<string, unknown>> {
  const secretPlane = readSecretPlaneConfig();
  const target = resolveTarget(secretPlane, options.targetId);
  const result = await capture(config, target.route, ["sh"], statusScript(secretPlane, target, options.full));
  const parsed = parseJsonOutput(result.stdout);
  const summary = parsed === null ? null : compactStatus(parsed, options.full);
  return {
    ok: result.exitCode === 0 && parsed?.ready === true,
    action: "platform-infra-secret-plane-status",
    mutation: false,
    target: targetSummary(target),
    config: configSummary(secretPlane, target),
    summary,
    remote: options.raw ? parsed : summary ?? compactCapture(result, { full: true }),
    next: {
      plan: `bun scripts/cli.ts platform-infra secret-plane plan --target ${target.id}`,
      apply: `bun scripts/cli.ts platform-infra secret-plane apply --target ${target.id} --confirm`,
      validate: `bun scripts/cli.ts platform-infra secret-plane validate --target ${target.id}`,
    },
  };
}

async function validate(config: UniDeskConfig, options: CommonOptions): Promise<Record<string, unknown>> {
  const secretPlane = readSecretPlaneConfig();
  const target = resolveTarget(secretPlane, options.targetId);
  const result = await capture(config, target.route, ["sh"], validateScript(secretPlane, target, options.full));
  const parsed = parseJsonOutput(result.stdout);
  return {
    ok: result.exitCode === 0 && parsed?.ok === true,
    action: "platform-infra-secret-plane-validate",
    mutation: true,
    target: targetSummary(target),
    config: configSummary(secretPlane, target),
    validation: parsed ?? null,
    remote: options.raw ? parsed : compactCapture(result, { full: options.full || result.exitCode !== 0 }),
  };
}

async function fetchEsoManifest(secretPlane: SecretPlaneConfig, target: SecretPlaneTarget): Promise<string> {
  const response = await fetch(secretPlane.eso.manifestUrl, { redirect: "follow" });
  if (!response.ok) throw new Error(`failed to fetch ESO manifest ${secretPlane.eso.manifestUrl}: HTTP ${response.status}`);
  const text = await response.text();
  if (!text.includes(secretPlane.eso.version) || !text.includes("kind: CustomResourceDefinition")) {
    throw new Error(`ESO manifest ${secretPlane.eso.manifestUrl} does not look like ${secretPlane.eso.version} static install YAML`);
  }
  return rewriteEsoManifestNamespace(text, target.namespace);
}

function rewriteEsoManifestNamespace(text: string, namespaceName: string): string {
  const rewritten = text
    .replace(/^(\s*namespace:\s*)default\s*$/gmu, `$1${namespaceName}`)
    .replaceAll("external-secrets-webhook.default.svc", `external-secrets-webhook.${namespaceName}.svc`)
    .replaceAll("--service-namespace=default", `--service-namespace=${namespaceName}`)
    .replaceAll("--secret-namespace=default", `--secret-namespace=${namespaceName}`);
  const remainingRuntimeDefaultRefs = [
    "external-secrets-webhook.default.svc",
    "--service-namespace=default",
    "--secret-namespace=default",
  ].filter((needle) => rewritten.includes(needle));
  if (remainingRuntimeDefaultRefs.length > 0) throw new Error(`ESO manifest namespace rewrite left runtime default references: ${remainingRuntimeDefaultRefs.join(", ")}`);
  return rewritten;
}

function renderWorkloadManifest(secretPlane: SecretPlaneConfig, target: SecretPlaneTarget): string {
  const vault = secretPlane.vault;
  const probe = secretPlane.syncProbe;
  const vaultImage = imageRef(vault.image);
  const consumerImage = imageRef(probe.consumer.image);
  return `apiVersion: v1
kind: Namespace
metadata:
  name: ${target.namespace}
  labels:
    app.kubernetes.io/name: platform-infra
    app.kubernetes.io/managed-by: unidesk
    unidesk.ai/runtime-node: ${target.id}
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-all
  namespace: ${target.namespace}
  labels:
    app.kubernetes.io/name: platform-infra
    app.kubernetes.io/part-of: platform-infra
    app.kubernetes.io/managed-by: unidesk
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - {}
  egress:
    - {}
---
apiVersion: v1
kind: Service
metadata:
  name: ${vault.serviceName}
  namespace: ${target.namespace}
  labels:
    app.kubernetes.io/name: ${vault.deploymentName}
    app.kubernetes.io/component: vault-backend
    app.kubernetes.io/part-of: platform-infra
    app.kubernetes.io/managed-by: unidesk
    unidesk.ai/runtime-node: ${target.id}
spec:
  type: ClusterIP
  selector:
    app.kubernetes.io/name: ${vault.deploymentName}
    app.kubernetes.io/component: vault-backend
  ports:
    - name: http
      port: ${vault.port}
      targetPort: http
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ${vault.deploymentName}
  namespace: ${target.namespace}
  labels:
    app.kubernetes.io/name: ${vault.deploymentName}
    app.kubernetes.io/component: vault-backend
    app.kubernetes.io/part-of: platform-infra
    app.kubernetes.io/managed-by: unidesk
    unidesk.ai/runtime-node: ${target.id}
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: ${vault.deploymentName}
      app.kubernetes.io/component: vault-backend
  template:
    metadata:
      labels:
        app.kubernetes.io/name: ${vault.deploymentName}
        app.kubernetes.io/component: vault-backend
        app.kubernetes.io/part-of: platform-infra
        app.kubernetes.io/managed-by: unidesk
      annotations:
        unidesk.ai/secret-plane-mode: ${vault.mode}
        unidesk.ai/bootstrap-token-mode: ${vault.bootstrap.tokenMode}
    spec:
      containers:
        - name: vault
          image: ${vaultImage}
          imagePullPolicy: ${vault.image.pullPolicy}
          args:
            - server
            - -dev
          env:
            - name: VAULT_DEV_ROOT_TOKEN_ID
              valueFrom:
                secretKeyRef:
                  name: ${vault.tokenSecretName}
                  key: ${vault.tokenSecretKey}
            - name: VAULT_DEV_LISTEN_ADDRESS
              value: "0.0.0.0:${vault.port}"
            - name: VAULT_ADDR
              value: "http://127.0.0.1:${vault.port}"
          ports:
            - name: http
              containerPort: ${vault.port}
          readinessProbe:
            httpGet:
              path: /v1/sys/health
              port: http
            initialDelaySeconds: 3
            periodSeconds: 5
---
apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: ${probe.secretStoreName}
  namespace: ${target.namespace}
  labels:
    app.kubernetes.io/name: ${probe.secretStoreName}
    app.kubernetes.io/component: secretstore
    app.kubernetes.io/part-of: platform-infra
    app.kubernetes.io/managed-by: unidesk
spec:
  provider:
    vault:
      server: "http://${vault.serviceName}.${target.namespace}.svc.cluster.local:${vault.port}"
      path: ${probe.vaultMountPath}
      version: v2
      auth:
        tokenSecretRef:
          name: ${vault.tokenSecretName}
          key: ${vault.tokenSecretKey}
---
apiVersion: external-secrets.io/v1
kind: ClusterSecretStore
metadata:
  name: ${probe.clusterSecretStoreName}
  labels:
    app.kubernetes.io/name: ${probe.clusterSecretStoreName}
    app.kubernetes.io/component: cluster-secretstore
    app.kubernetes.io/part-of: platform-infra
    app.kubernetes.io/managed-by: unidesk
spec:
  provider:
    vault:
      server: "http://${vault.serviceName}.${target.namespace}.svc.cluster.local:${vault.port}"
      path: ${probe.vaultMountPath}
      version: v2
      auth:
        tokenSecretRef:
          name: ${vault.tokenSecretName}
          key: ${vault.tokenSecretKey}
          namespace: ${target.namespace}
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: ${probe.externalSecretName}
  namespace: ${target.namespace}
  labels:
    app.kubernetes.io/name: ${probe.externalSecretName}
    app.kubernetes.io/component: external-secret
    app.kubernetes.io/part-of: platform-infra
    app.kubernetes.io/managed-by: unidesk
spec:
  refreshInterval: ${probe.refreshInterval}
  secretStoreRef:
    name: ${probe.secretStoreName}
    kind: SecretStore
  target:
    name: ${probe.targetSecretName}
    creationPolicy: Owner
  data:
    - secretKey: ${probe.remoteProperty}
      remoteRef:
        key: ${probe.remotePath}
        property: ${probe.remoteProperty}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ${probe.consumer.deploymentName}
  namespace: ${target.namespace}
  labels:
    app.kubernetes.io/name: ${probe.consumer.deploymentName}
    app.kubernetes.io/component: secret-consumer
    app.kubernetes.io/part-of: platform-infra
    app.kubernetes.io/managed-by: unidesk
    unidesk.ai/runtime-node: ${target.id}
spec:
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/name: ${probe.consumer.deploymentName}
      app.kubernetes.io/component: secret-consumer
  template:
    metadata:
      labels:
        app.kubernetes.io/name: ${probe.consumer.deploymentName}
        app.kubernetes.io/component: secret-consumer
        app.kubernetes.io/part-of: platform-infra
        app.kubernetes.io/managed-by: unidesk
    spec:
      containers:
        - name: consumer
          image: ${consumerImage}
          imagePullPolicy: ${probe.consumer.image.pullPolicy}
          command:
            - sh
            - -c
            - while true; do sleep 3600; done
          env:
            - name: ${probe.consumer.envName}
              valueFrom:
                secretKeyRef:
                  name: ${probe.targetSecretName}
                  key: ${probe.remoteProperty}
`;
}

function dryRunScript(secretPlane: SecretPlaneConfig, target: SecretPlaneTarget, esoYaml: string, workloadYaml: string): string {
  const esoEncoded = Buffer.from(esoYaml, "utf8").toString("base64");
  const workloadEncoded = Buffer.from(workloadYaml, "utf8").toString("base64");
  return `
set -u
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
eso="$tmp/external-secrets.yaml"
workload="$tmp/secret-plane.yaml"
core="$tmp/secret-plane-core.yaml"
custom="$tmp/secret-plane-custom.yaml"
printf '%s' '${esoEncoded}' | base64 -d >"$eso"
printf '%s' '${workloadEncoded}' | base64 -d >"$workload"
python3 - "$workload" "$core" "$custom" <<'PY'
import re, sys
source, core_path, custom_path = sys.argv[1:4]
text = open(source, encoding="utf-8").read()
core_docs = []
custom_docs = []
for doc in re.split(r"^---\\s*$", text, flags=re.M):
    if not doc.strip():
        continue
    match = re.search(r"^\\s*kind:\\s*([A-Za-z0-9]+)\\s*$", doc, flags=re.M)
    kind = match.group(1) if match else ""
    if kind in {"SecretStore", "ClusterSecretStore", "ExternalSecret"}:
        custom_docs.append(doc.strip() + "\\n")
    else:
        core_docs.append(doc.strip() + "\\n")
open(core_path, "w", encoding="utf-8").write("---\\n".join(core_docs))
open(custom_path, "w", encoding="utf-8").write("---\\n".join(custom_docs))
PY
client_out="$tmp/client.out"
client_err="$tmp/client.err"
server_out="$tmp/server.out"
server_err="$tmp/server.err"
custom_out="$tmp/custom.out"
custom_err="$tmp/custom.err"
kubectl apply --dry-run=client --validate=false -f "$eso" -f "$core" >"$client_out" 2>"$client_err"
client_rc=$?
if kubectl get crd ${secretPlane.eso.crds.map((name) => name).join(" ")} >/dev/null 2>&1; then
  kubectl apply --dry-run=client --validate=false -f "$custom" >"$custom_out" 2>"$custom_err"
  custom_rc=$?
  custom_disposition=executed
else
  custom_rc=0
  custom_disposition=skipped-crds-missing
  printf '%s\\n' 'SecretStore/ClusterSecretStore/ExternalSecret dry-run skipped because ESO CRDs are not installed yet; real apply installs CRDs first.' >"$custom_out"
  : >"$custom_err"
fi
if kubectl get namespace ${target.namespace} >/dev/null 2>&1; then
  kubectl apply --server-side --dry-run=server --validate=false --field-manager=${fieldManager} -f "$eso" -f "$core" >"$server_out" 2>"$server_err"
  server_rc=$?
  server_disposition=executed
else
  server_rc=0
  server_disposition=skipped-namespace-missing
  printf '%s\\n' 'server dry-run skipped because namespace does not exist yet' >"$server_out"
  : >"$server_err"
fi
python3 - "$client_rc" "$custom_rc" "$server_rc" "$custom_disposition" "$server_disposition" "$client_out" "$client_err" "$custom_out" "$custom_err" "$server_out" "$server_err" <<'PY'
import json, os, sys
client_rc, custom_rc, server_rc = int(sys.argv[1]), int(sys.argv[2]), int(sys.argv[3])
def text(path, limit=1200):
    try:
        return open(path, encoding="utf-8", errors="replace").read()[-limit:]
    except FileNotFoundError:
        return ""
payload = {
    "ok": client_rc == 0 and custom_rc == 0 and server_rc == 0,
    "target": "${target.id}",
    "route": "${target.route}",
    "namespace": "${target.namespace}",
    "mode": "dry-run",
    "esoManifestBytes": ${Buffer.byteLength(esoYaml, "utf8")},
    "workloadManifestBytes": ${Buffer.byteLength(workloadYaml, "utf8")},
    "clientDryRun": {"exitCode": client_rc, "stdoutTail": text(sys.argv[6]), "stderrTail": text(sys.argv[7])},
    "customResourceDryRun": {"exitCode": custom_rc, "disposition": sys.argv[4], "stdoutTail": text(sys.argv[8]), "stderrTail": text(sys.argv[9])},
    "serverDryRun": {"exitCode": server_rc, "disposition": sys.argv[5], "stdoutTail": text(sys.argv[10]), "stderrTail": text(sys.argv[11])},
    "valuesPrinted": False,
}
print(json.dumps(payload, ensure_ascii=False, indent=2))
sys.exit(0 if payload["ok"] else 1)
PY
`;
}

function applyScript(secretPlane: SecretPlaneConfig, target: SecretPlaneTarget, esoYaml: string, workloadYaml: string): string {
  const esoEncoded = Buffer.from(esoYaml, "utf8").toString("base64");
  const workloadEncoded = Buffer.from(workloadYaml, "utf8").toString("base64");
  const crdArgs = secretPlane.eso.crds.map((name) => `crd/${name}`).join(" ");
  return `
set -u
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
eso="$tmp/external-secrets.yaml"
workload="$tmp/secret-plane.yaml"
printf '%s' '${esoEncoded}' | base64 -d >"$eso"
printf '%s' '${workloadEncoded}' | base64 -d >"$workload"
ns_out="$tmp/ns.out"; ns_err="$tmp/ns.err"
token_out="$tmp/token.out"; token_err="$tmp/token.err"
eso_out="$tmp/eso.out"; eso_err="$tmp/eso.err"
crd_out="$tmp/crd.out"; crd_err="$tmp/crd.err"
eso_wait_out="$tmp/eso-wait.out"; eso_wait_err="$tmp/eso-wait.err"
workload_out="$tmp/workload.out"; workload_err="$tmp/workload.err"
kubectl create namespace ${target.namespace} --dry-run=client -o yaml | kubectl apply --server-side --force-conflicts --field-manager=${fieldManager} -f - >"$ns_out" 2>"$ns_err"
ns_rc=$?
token_action=not-run
token_rc=1
if [ "$ns_rc" -eq 0 ]; then
  if kubectl -n ${target.namespace} get secret ${secretPlane.vault.tokenSecretName} >/dev/null 2>&1; then
    token_action=kept-existing
    token_rc=0
    : >"$token_out"
    : >"$token_err"
  else
    token_action=generated-if-missing
    token_file="$tmp/vault-token"
    (head -c ${secretPlane.vault.bootstrap.tokenLengthBytes} /dev/urandom | base64 | tr -dc 'A-Za-z0-9' | head -c $(( ${secretPlane.vault.bootstrap.tokenLengthBytes} * 2 ))) >"$token_file" 2>"$token_err" || true
    if [ ! -s "$token_file" ]; then
      printf '%s' "unidesk-$(${dateCommand()})-$$" >"$token_file"
    fi
    kubectl -n ${target.namespace} create secret generic ${secretPlane.vault.tokenSecretName} --from-file=${secretPlane.vault.tokenSecretKey}="$token_file" --dry-run=client -o yaml | kubectl apply --server-side --force-conflicts --field-manager=${fieldManager} -f - >"$token_out" 2>>"$token_err"
    token_rc=$?
  fi
else
  printf '%s\\n' 'namespace apply failed; skipped token secret' >"$token_err"
fi
if [ "$ns_rc" -eq 0 ] && [ "$token_rc" -eq 0 ]; then
  kubectl apply --server-side --force-conflicts --validate=false --field-manager=${fieldManager} -f "$eso" >"$eso_out" 2>"$eso_err"
  eso_rc=$?
else
  eso_rc=1
  printf '%s\\n' 'skipped because namespace or token secret failed' >"$eso_err"
fi
if [ "$eso_rc" -eq 0 ]; then
  kubectl wait --for=condition=Established --timeout=25s ${crdArgs} >"$crd_out" 2>"$crd_err"
  crd_rc=$?
else
  crd_rc=1
  printf '%s\\n' 'skipped because ESO manifest apply failed' >"$crd_err"
fi
if [ "$crd_rc" -eq 0 ]; then
  kubectl -n ${target.namespace} wait --for=condition=available --timeout=${secretPlane.validation.timeoutSeconds}s deployment/${secretPlane.eso.controllerDeploymentName} deployment/${secretPlane.eso.webhookDeploymentName} deployment/${secretPlane.eso.certControllerDeploymentName} >"$eso_wait_out" 2>"$eso_wait_err"
  eso_wait_rc=$?
else
  eso_wait_rc=1
  printf '%s\\n' 'skipped because ESO CRDs are not established' >"$eso_wait_err"
fi
if [ "$eso_wait_rc" -eq 0 ]; then
  kubectl apply --server-side --force-conflicts --validate=false --field-manager=${fieldManager} -f "$workload" >"$workload_out" 2>"$workload_err"
  workload_rc=$?
else
  workload_rc=1
  printf '%s\\n' 'skipped because ESO deployments are not available' >"$workload_err"
fi
python3 - "$ns_rc" "$token_rc" "$eso_rc" "$crd_rc" "$eso_wait_rc" "$workload_rc" "$token_action" "$ns_out" "$ns_err" "$token_out" "$token_err" "$eso_out" "$eso_err" "$crd_out" "$crd_err" "$eso_wait_out" "$eso_wait_err" "$workload_out" "$workload_err" <<'PY'
import json, sys
def text(path, limit=1200):
    try:
        return open(path, encoding="utf-8", errors="replace").read()[-limit:]
    except FileNotFoundError:
        return ""
ns_rc, token_rc, eso_rc, crd_rc, eso_wait_rc, workload_rc = [int(value) for value in sys.argv[1:7]]
paths = sys.argv[8:]
payload = {
    "ok": ns_rc == 0 and token_rc == 0 and eso_rc == 0 and crd_rc == 0 and eso_wait_rc == 0 and workload_rc == 0,
    "target": "${target.id}",
    "route": "${target.route}",
    "namespace": "${target.namespace}",
    "mode": "confirmed",
    "secretMaterial": {
        "name": "${secretPlane.vault.tokenSecretName}",
        "key": "${secretPlane.vault.tokenSecretKey}",
        "action": sys.argv[7],
        "valuesPrinted": False,
    },
    "steps": {
        "namespace": {"exitCode": ns_rc, "stdoutTail": text(paths[0]), "stderrTail": text(paths[1])},
        "tokenSecret": {"exitCode": token_rc, "stdoutTail": text(paths[2]), "stderrTail": text(paths[3]), "valuesPrinted": False},
        "externalSecretsOperator": {"exitCode": eso_rc, "stdoutTail": text(paths[4]), "stderrTail": text(paths[5])},
        "crdsEstablished": {"exitCode": crd_rc, "stdoutTail": text(paths[6]), "stderrTail": text(paths[7])},
        "esoDeploymentsReady": {"exitCode": eso_wait_rc, "stdoutTail": text(paths[8]), "stderrTail": text(paths[9])},
        "secretPlaneWorkload": {"exitCode": workload_rc, "stdoutTail": text(paths[10]), "stderrTail": text(paths[11])},
    },
    "next": {
        "status": "bun scripts/cli.ts platform-infra secret-plane status --target ${target.id}",
        "validate": "bun scripts/cli.ts platform-infra secret-plane validate --target ${target.id}"
    },
    "valuesPrinted": False,
}
print(json.dumps(payload, ensure_ascii=False, indent=2))
sys.exit(0 if payload["ok"] else 1)
PY
`;
}

function statusScript(secretPlane: SecretPlaneConfig, target: SecretPlaneTarget, full: boolean): string {
  const esoDeployments = [
    secretPlane.eso.controllerDeploymentName,
    secretPlane.eso.webhookDeploymentName,
    secretPlane.eso.certControllerDeploymentName,
  ];
  const directDeployments = [...esoDeployments, secretPlane.vault.deploymentName, secretPlane.syncProbe.consumer.deploymentName];
  const deploymentArgs = directDeployments.map((name) => `deployment/${name}`).join(" ");
  const crdArgs = secretPlane.eso.crds.map((name) => `crd/${name}`).join(" ");
  return `
set -u
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
capture_json() {
  name="$1"
  shift
  "$@" -o json >"$tmp/$name.json" 2>"$tmp/$name.err"
  rc=$?
  printf '%s' "$rc" >"$tmp/$name.rc"
}
capture_json ns kubectl get namespace ${target.namespace}
capture_json deployments kubectl -n ${target.namespace} get ${deploymentArgs}
capture_json pods kubectl -n ${target.namespace} get pods -l app.kubernetes.io/part-of=platform-infra
capture_json services kubectl -n ${target.namespace} get service ${secretPlane.vault.serviceName}
capture_json crds kubectl get ${crdArgs}
capture_json secretstore kubectl -n ${target.namespace} get secretstore ${secretPlane.syncProbe.secretStoreName}
capture_json clustersecretstore kubectl get clustersecretstore ${secretPlane.syncProbe.clusterSecretStoreName}
capture_json externalsecret kubectl -n ${target.namespace} get externalsecret ${secretPlane.syncProbe.externalSecretName}
capture_json targetsecret kubectl -n ${target.namespace} get secret ${secretPlane.syncProbe.targetSecretName}
capture_json tokensecret kubectl -n ${target.namespace} get secret ${secretPlane.vault.tokenSecretName}
python3 - "$tmp" <<'PY'
import base64, hashlib, json, os, sys
tmp = sys.argv[1]
def rc(name):
    try:
        return int(open(os.path.join(tmp, f"{name}.rc"), encoding="utf-8").read() or "1")
    except FileNotFoundError:
        return 1
def load(name):
    path = os.path.join(tmp, f"{name}.json")
    try:
        return json.load(open(path, encoding="utf-8"))
    except (FileNotFoundError, json.JSONDecodeError):
        return None
def list_items(name):
    data = load(name)
    if isinstance(data, dict) and isinstance(data.get("items"), list):
        return data["items"]
    if isinstance(data, dict) and data.get("kind") != "Status":
        return [data]
    return []
def deployment_summary(item):
    spec = item.get("spec") or {}
    status = item.get("status") or {}
    desired = spec.get("replicas", 1)
    available = status.get("availableReplicas", 0)
    containers = ((spec.get("template") or {}).get("spec") or {}).get("containers", [])
    return {
        "name": item.get("metadata", {}).get("name"),
        "desired": desired,
        "readyReplicas": status.get("readyReplicas", 0),
        "availableReplicas": available,
        "updatedReplicas": status.get("updatedReplicas", 0),
        "ready": available >= desired,
        "images": [container.get("image") for container in containers],
    }
def service_summary(item):
    spec = item.get("spec") or {}
    return {
        "name": item.get("metadata", {}).get("name"),
        "type": spec.get("type", "ClusterIP"),
        "clusterIP": spec.get("clusterIP"),
        "ports": [{"name": p.get("name"), "port": p.get("port"), "targetPort": p.get("targetPort")} for p in spec.get("ports", [])],
    }
def condition_summary(item):
    status = item.get("status") or {}
    return [
        {"type": c.get("type"), "status": c.get("status"), "reason": c.get("reason"), "message": c.get("message")}
        for c in status.get("conditions", [])
    ]
def ready_condition(item):
    return any(c.get("type") == "Ready" and c.get("status") == "True" for c in condition_summary(item))
def secret_key_summary(item, keys):
    data = (item or {}).get("data") or {}
    out = {"name": (item or {}).get("metadata", {}).get("name"), "ready": bool(data), "keys": sorted(data.keys()), "missingKeys": [key for key in keys if key not in data], "fingerprints": {}, "valuesPrinted": False}
    for key in keys:
        raw = data.get(key)
        if isinstance(raw, str):
            try:
                decoded = base64.b64decode(raw)
                out["fingerprints"][key] = "sha256:" + hashlib.sha256(decoded).hexdigest()
            except Exception:
                out["fingerprints"][key] = "decode-error"
    return out
deployments = [deployment_summary(item) for item in list_items("deployments")]
deployment_ready = {item["name"]: item["ready"] for item in deployments}
crds = list_items("crds")
crd_names = sorted([item.get("metadata", {}).get("name") for item in crds if isinstance(item, dict)])
target_secret = secret_key_summary(load("targetsecret"), ["${secretPlane.syncProbe.remoteProperty}"])
token_secret = secret_key_summary(load("tokensecret"), ["${secretPlane.vault.tokenSecretKey}"])
secretstore = load("secretstore") or {}
clustersecretstore = load("clustersecretstore") or {}
externalsecret = load("externalsecret") or {}
eso_ready = all(deployment_ready.get(name) is True for name in ${JSON.stringify(esoDeployments)})
vault_ready = deployment_ready.get("${secretPlane.vault.deploymentName}") is True
consumer_ready = deployment_ready.get("${secretPlane.syncProbe.consumer.deploymentName}") is True
crds_ready = all(name in crd_names for name in ${JSON.stringify(secretPlane.eso.crds)})
secretstore_ready = ready_condition(secretstore)
clustersecretstore_ready = ready_condition(clustersecretstore)
synced = target_secret["fingerprints"].get("${secretPlane.syncProbe.remoteProperty}") == "${secretPlane.syncProbe.expectedFingerprint}"
payload = {
    "ready": eso_ready and vault_ready and crds_ready and secretstore_ready and clustersecretstore_ready,
    "target": "${target.id}",
    "route": "${target.route}",
    "namespace": "${target.namespace}",
    "namespaceExists": rc("ns") == 0,
    "crdsReady": crds_ready,
    "esoReady": eso_ready,
    "vaultReady": vault_ready,
    "secretStoreReady": secretstore_ready,
    "clusterSecretStoreReady": clustersecretstore_ready,
    "consumerReady": consumer_ready,
    "syncReady": synced,
    "deployments": deployments,
    "services": [service_summary(item) for item in list_items("services")],
    "secretStore": {"name": "${secretPlane.syncProbe.secretStoreName}", "conditions": condition_summary(secretstore)},
    "clusterSecretStore": {"name": "${secretPlane.syncProbe.clusterSecretStoreName}", "conditions": condition_summary(clustersecretstore)},
    "externalSecret": {"name": "${secretPlane.syncProbe.externalSecretName}", "conditions": condition_summary(externalsecret), "refreshTime": (externalsecret.get("status") or {}).get("refreshTime")},
    "targetSecret": target_secret,
    "tokenSecret": {"name": token_secret["name"], "ready": token_secret["ready"], "keys": token_secret["keys"], "missingKeys": token_secret["missingKeys"], "valuesPrinted": False},
    "valuesPrinted": False,
}
if ${full ? "False" : "True"}:
    for item in payload["deployments"]:
        item["images"] = item["images"][:1]
print(json.dumps(payload, ensure_ascii=False, indent=2))
sys.exit(0 if payload["ready"] else 1)
PY
`;
}

function validateScript(secretPlane: SecretPlaneConfig, target: SecretPlaneTarget, full: boolean): string {
  const testValue = secretPlane.syncProbe.testValueSource.value;
  const vaultKvPath = `${secretPlane.syncProbe.vaultMountPath}/${secretPlane.syncProbe.remotePath}`;
  const vaultPutCommand = `set -u; export VAULT_ADDR=http://127.0.0.1:${secretPlane.vault.port}; export VAULT_TOKEN="$VAULT_DEV_ROOT_TOKEN_ID"; vault kv put ${shQuote(vaultKvPath)} ${secretPlane.syncProbe.remoteProperty}="$(cat)" >/dev/null`;
  const vaultMetadataCommand = `set -u; export VAULT_ADDR=http://127.0.0.1:${secretPlane.vault.port}; export VAULT_TOKEN="$VAULT_DEV_ROOT_TOKEN_ID"; vault kv metadata get -format=json ${shQuote(vaultKvPath)} >/tmp/unidesk-vault-metadata.json`;
  const consumerEnvRef = `\${${secretPlane.syncProbe.consumer.envName}:-}`;
  const consumerCommand = `test "${consumerEnvRef}" = "$(cat)"`;
  return `
set -u
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
expected="$tmp/expected"
printf '%s' ${shQuote(testValue)} >"$expected"
vault_pod="$(kubectl -n ${target.namespace} get pod -l app.kubernetes.io/name=${secretPlane.vault.deploymentName},app.kubernetes.io/component=vault-backend -o jsonpath='{.items[0].metadata.name}' 2>"$tmp/vault-pod.err" || true)"
printf '%s' "$vault_pod" >"$tmp/vault-pod.txt"
if [ -n "$vault_pod" ]; then
  kubectl -n ${target.namespace} exec -i "$vault_pod" -- sh -lc ${shQuote(vaultPutCommand)} <"$expected" >"$tmp/vault-put.out" 2>"$tmp/vault-put.err"
  vault_put_rc=$?
  kubectl -n ${target.namespace} exec "$vault_pod" -- sh -lc ${shQuote(vaultMetadataCommand)} >"$tmp/vault-metadata.out" 2>"$tmp/vault-metadata.err"
  vault_metadata_rc=$?
else
  vault_put_rc=1
  vault_metadata_rc=1
  printf '%s\\n' 'vault pod not found' >"$tmp/vault-put.err"
  printf '%s\\n' 'vault pod not found' >"$tmp/vault-metadata.err"
fi
deadline=$(( $(date +%s) + ${secretPlane.validation.timeoutSeconds} ))
sync_rc=1
secret_fingerprint=missing
while [ "$(date +%s)" -le "$deadline" ]; do
  if kubectl -n ${target.namespace} get secret ${secretPlane.syncProbe.targetSecretName} -o jsonpath='{.data.${secretPlane.syncProbe.remoteProperty}}' >"$tmp/secret.b64" 2>"$tmp/secret.err"; then
    if base64 -d "$tmp/secret.b64" >"$tmp/secret.value" 2>>"$tmp/secret.err"; then
      secret_fingerprint="$(sha256sum "$tmp/secret.value" | awk '{print "sha256:" $1}')"
      if cmp -s "$expected" "$tmp/secret.value"; then
        sync_rc=0
        break
      fi
    fi
  fi
  sleep ${secretPlane.validation.pollSeconds}
done
if [ "$sync_rc" -eq 0 ]; then
  kubectl -n ${target.namespace} rollout restart deployment/${secretPlane.syncProbe.consumer.deploymentName} >"$tmp/consumer-rollout-restart.out" 2>"$tmp/consumer-rollout-restart.err"
  consumer_rollout_restart_rc=$?
  if [ "$consumer_rollout_restart_rc" -eq 0 ]; then
    kubectl -n ${target.namespace} rollout status deployment/${secretPlane.syncProbe.consumer.deploymentName} --timeout=25s >"$tmp/consumer-rollout.out" 2>"$tmp/consumer-rollout.err"
    consumer_rollout_rc=$?
  else
    consumer_rollout_rc=1
    printf '%s\\n' 'consumer rollout restart failed' >"$tmp/consumer-rollout.err"
  fi
else
  consumer_rollout_restart_rc=1
  consumer_rollout_rc=1
  printf '%s\\n' 'secret sync not ready' >"$tmp/consumer-rollout-restart.err"
  printf '%s\\n' 'secret sync not ready' >"$tmp/consumer-rollout.err"
fi
consumer_pod="$(kubectl -n ${target.namespace} get pod -l app.kubernetes.io/name=${secretPlane.syncProbe.consumer.deploymentName},app.kubernetes.io/component=secret-consumer -o jsonpath='{.items[0].metadata.name}' 2>"$tmp/consumer-pod.err" || true)"
printf '%s' "$consumer_pod" >"$tmp/consumer-pod.txt"
if [ "$sync_rc" -eq 0 ] && [ "$consumer_rollout_rc" -eq 0 ] && [ -n "$consumer_pod" ]; then
  kubectl -n ${target.namespace} exec -i "$consumer_pod" -- sh -lc ${shQuote(consumerCommand)} <"$expected" >"$tmp/consumer-env.out" 2>"$tmp/consumer-env.err"
  consumer_env_rc=$?
else
  consumer_env_rc=1
  if [ -z "$consumer_pod" ]; then printf '%s\\n' 'consumer pod not found' >"$tmp/consumer-env.err"; elif [ "$consumer_rollout_rc" -ne 0 ]; then printf '%s\\n' 'consumer rollout not ready' >"$tmp/consumer-env.err"; else printf '%s\\n' 'secret sync not ready' >"$tmp/consumer-env.err"; fi
fi
kubectl -n ${target.namespace} get secretstore ${secretPlane.syncProbe.secretStoreName} -o json >"$tmp/secretstore.json" 2>"$tmp/secretstore.err"
secretstore_rc=$?
kubectl get clustersecretstore ${secretPlane.syncProbe.clusterSecretStoreName} -o json >"$tmp/clustersecretstore.json" 2>"$tmp/clustersecretstore.err"
clustersecretstore_rc=$?
kubectl -n ${target.namespace} get externalsecret ${secretPlane.syncProbe.externalSecretName} -o json >"$tmp/externalsecret.json" 2>"$tmp/externalsecret.err"
externalsecret_rc=$?
python3 - "$vault_put_rc" "$vault_metadata_rc" "$sync_rc" "$consumer_rollout_restart_rc" "$consumer_rollout_rc" "$consumer_env_rc" "$secretstore_rc" "$clustersecretstore_rc" "$externalsecret_rc" "$secret_fingerprint" "$tmp" <<'PY'
import json, os, sys
vault_put_rc, vault_metadata_rc, sync_rc, consumer_rollout_restart_rc, consumer_rollout_rc, consumer_env_rc, secretstore_rc, clustersecretstore_rc, externalsecret_rc = [int(value) for value in sys.argv[1:10]]
secret_fingerprint = sys.argv[10]
tmp = sys.argv[11]
def text(name, limit=3000):
    try:
        return open(os.path.join(tmp, name), encoding="utf-8", errors="replace").read()[-limit:]
    except FileNotFoundError:
        return ""
def load(name):
    try:
        return json.load(open(os.path.join(tmp, name), encoding="utf-8"))
    except (FileNotFoundError, json.JSONDecodeError):
        return None
def conditions(obj):
    status = (obj or {}).get("status") or {}
    return [{"type": c.get("type"), "status": c.get("status"), "reason": c.get("reason"), "message": c.get("message")} for c in status.get("conditions", [])]
payload = {
    "ok": vault_put_rc == 0 and vault_metadata_rc == 0 and sync_rc == 0 and consumer_rollout_restart_rc == 0 and consumer_rollout_rc == 0 and consumer_env_rc == 0 and secretstore_rc == 0 and clustersecretstore_rc == 0 and externalsecret_rc == 0,
    "target": "${target.id}",
    "namespace": "${target.namespace}",
    "checks": {
        "vaultKvWrite": {"exitCode": vault_put_rc, "pod": text("vault-pod.txt", 200), "stderrTail": text("vault-put.err")},
        "vaultKvMetadata": {"exitCode": vault_metadata_rc, "stderrTail": text("vault-metadata.err")},
        "externalSecretSync": {
            "exitCode": sync_rc,
            "targetSecretName": "${secretPlane.syncProbe.targetSecretName}",
            "targetKey": "${secretPlane.syncProbe.remoteProperty}",
            "fingerprint": secret_fingerprint,
            "expectedFingerprint": "${secretPlane.syncProbe.expectedFingerprint}",
            "valuesPrinted": False,
            "stderrTail": text("secret.err"),
        },
        "consumerEnvInjection": {
            "rolloutRestartExitCode": consumer_rollout_restart_rc,
            "rolloutExitCode": consumer_rollout_rc,
            "rolloutStdoutTail": text("consumer-rollout.out"),
            "rolloutStderrTail": text("consumer-rollout.err"),
            "exitCode": consumer_env_rc,
            "deploymentName": "${secretPlane.syncProbe.consumer.deploymentName}",
            "pod": text("consumer-pod.txt", 200),
            "envName": "${secretPlane.syncProbe.consumer.envName}",
            "valuesPrinted": False,
            "stderrTail": text("consumer-env.err"),
        },
        "secretStore": {"exitCode": secretstore_rc, "conditions": conditions(load("secretstore.json")), "stderrTail": text("secretstore.err")},
        "clusterSecretStore": {"exitCode": clustersecretstore_rc, "conditions": conditions(load("clustersecretstore.json")), "stderrTail": text("clustersecretstore.err")},
        "externalSecret": {"exitCode": externalsecret_rc, "conditions": conditions(load("externalsecret.json")), "stderrTail": text("externalsecret.err")},
    },
    "boundary": "platform-infra only; no HWLAB namespace or workload integration was created",
    "valuesPrinted": False,
}
if ${full ? "False" : "True"}:
    for check in payload["checks"].values():
        if isinstance(check, dict):
            for key in list(check.keys()):
                if key.endswith("Tail") and isinstance(check[key], str):
                    check[key] = check[key][-1200:]
print(json.dumps(payload, ensure_ascii=False, indent=2))
sys.exit(0 if payload["ok"] else 1)
PY
`;
}

function dateCommand(): string {
  return "date +%s";
}

function configSummary(secretPlane: SecretPlaneConfig, target: SecretPlaneTarget): Record<string, unknown> {
  return {
    path: configLabel,
    version: secretPlane.version,
    kind: secretPlane.kind,
    metadata: secretPlane.metadata,
    target: targetSummary(target),
  };
}

function targetSummary(target: SecretPlaneTarget): Record<string, unknown> {
  return {
    id: target.id,
    route: target.route,
    namespace: target.namespace,
    role: target.role,
    createNamespace: target.createNamespace,
  };
}

function vaultSummary(secretPlane: SecretPlaneConfig, target: SecretPlaneTarget): Record<string, unknown> {
  const vault = secretPlane.vault;
  return {
    mode: vault.mode,
    deploymentName: vault.deploymentName,
    serviceName: vault.serviceName,
    serviceDns: `${vault.serviceName}.${target.namespace}.svc.cluster.local:${vault.port}`,
    image: imageRef(vault.image),
    pullPolicy: vault.image.pullPolicy,
    tokenSecret: {
      name: vault.tokenSecretName,
      key: vault.tokenSecretKey,
      tokenMode: vault.bootstrap.tokenMode,
      valuesPrinted: false,
    },
  };
}

function syncProbeSummary(secretPlane: SecretPlaneConfig): Record<string, unknown> {
  const probe = secretPlane.syncProbe;
  return {
    dataFlow: "Vault KV v2 -> ESO SecretStore/ClusterSecretStore -> ExternalSecret -> Kubernetes Secret -> consumer env",
    secretStoreName: probe.secretStoreName,
    clusterSecretStoreName: probe.clusterSecretStoreName,
    externalSecretName: probe.externalSecretName,
    targetSecretName: probe.targetSecretName,
    refreshInterval: probe.refreshInterval,
    remoteRef: {
      mountPath: probe.vaultMountPath,
      key: probe.remotePath,
      property: probe.remoteProperty,
    },
    expectedFingerprint: probe.expectedFingerprint,
    consumer: {
      deploymentName: probe.consumer.deploymentName,
      envName: probe.consumer.envName,
      image: imageRef(probe.consumer.image),
    },
    valuesPrinted: false,
  };
}

function policyChecks(secretPlane: SecretPlaneConfig, target: SecretPlaneTarget, yaml: string): Array<Record<string, unknown>> {
  const kinds = manifestObjectSummary(yaml).map((item) => item.kind);
  return [
    { name: "target-is-active", ok: target.role === "active", detail: "PoC target must be the YAML-selected active secret-plane target." },
    { name: "target-route-is-k3s", ok: target.route === `${target.id}:k3s`, detail: "Secret plane deployment uses the selected node k3s route." },
    { name: "namespace-is-platform-infra", ok: target.namespace === "platform-infra", detail: "Secret plane is external platform infrastructure and not an HWLAB namespace." },
    { name: "no-hwlab-workloads", ok: !/namespace:\s*hwlab/iu.test(yaml) && !/hwlab-v0?3/iu.test(yaml), detail: "This PoC must not integrate into HWLAB v0.3 yet." },
    { name: "no-nodeport-or-loadbalancer", ok: !/^\s*type:\s*(NodePort|LoadBalancer)\s*$/mu.test(yaml), detail: "Secret plane services stay ClusterIP-only." },
    { name: "no-hardcoded-token", ok: !yaml.includes("VAULT_DEV_ROOT_TOKEN_ID:") && secretPlane.vault.bootstrap.tokenMode === "generated-if-missing", detail: "Vault dev token is generated into a Kubernetes Secret when missing and never committed." },
    { name: "required-objects-rendered", ok: kinds.includes("Deployment") && kinds.includes("SecretStore") && kinds.includes("ClusterSecretStore") && kinds.includes("ExternalSecret"), detail: "Vault backend, ESO SecretStore/ClusterSecretStore and ExternalSecret PoC objects are rendered from YAML." },
  ];
}

function manifestObjectSummary(yaml: string): Array<Record<string, string>> {
  return yaml.split(/^---\s*$/mu).map((document) => {
    const kind = /^\s*kind:\s*([A-Za-z0-9]+)\s*$/mu.exec(document)?.[1];
    const name = /^\s*name:\s*([A-Za-z0-9._-]+)\s*$/mu.exec(document)?.[1];
    const namespace = /^\s*namespace:\s*([A-Za-z0-9._-]+)\s*$/mu.exec(document)?.[1];
    return kind === undefined || name === undefined ? null : { kind, name, namespace: namespace ?? "" };
  }).filter((item): item is Record<string, string> => item !== null);
}

function compactStatus(parsed: Record<string, unknown>, full: boolean): Record<string, unknown> {
  if (full) return parsed;
  return {
    ready: parsed.ready,
    target: parsed.target,
    namespace: parsed.namespace,
    crdsReady: parsed.crdsReady,
    esoReady: parsed.esoReady,
    vaultReady: parsed.vaultReady,
    secretStoreReady: parsed.secretStoreReady,
    clusterSecretStoreReady: parsed.clusterSecretStoreReady,
    consumerReady: parsed.consumerReady,
    syncReady: parsed.syncReady,
    deployments: parsed.deployments,
    secretStore: parsed.secretStore,
    clusterSecretStore: parsed.clusterSecretStore,
    externalSecret: parsed.externalSecret,
    targetSecret: parsed.targetSecret,
    tokenSecret: parsed.tokenSecret,
    valuesPrinted: false,
  };
}

function renderPlan(result: Record<string, unknown>): RenderedCliResult {
  const config = record(result.config);
  const target = record(config.target);
  const renderPlan = record(result.renderPlan);
  const eso = record(renderPlan.eso);
  const vault = record(renderPlan.vault);
  const syncProbe = record(renderPlan.syncProbe);
  const policy = arrayRecords(result.policy);
  const failed = policy.filter((item) => item.ok === false);
  const next = record(result.next);
  const rows = [
    ["TARGET", stringValue(target.id), "route", stringValue(target.route)],
    ["NAMESPACE", stringValue(target.namespace), "role", stringValue(target.role)],
    ["ESO", stringValue(eso.version), "manifest", stringValue(eso.manifestUrl)],
    ["VAULT", stringValue(vault.deploymentName), "service", stringValue(vault.serviceDns)],
    ["STORE", stringValue(syncProbe.secretStoreName), "clusterStore", stringValue(syncProbe.clusterSecretStoreName)],
    ["SYNC", stringValue(syncProbe.externalSecretName), "targetSecret", stringValue(syncProbe.targetSecretName)],
    ["POLICY", failed.length === 0 ? "ok" : `failed=${failed.length}`, "valuesPrinted", "false"],
  ];
  return rendered(result, "platform-infra secret-plane plan", [
    "PLATFORM-INFRA SECRET-PLANE PLAN",
    ...table(["FIELD", "VALUE", "DETAIL", "VALUE"], rows),
    "",
    "NEXT",
    `  dry-run: ${stringValue(next.dryRun)}`,
    `  apply: ${stringValue(next.apply)}`,
    `  status: ${stringValue(next.status)}`,
    `  validate: ${stringValue(next.validate)}`,
    "",
    `Boundary: ${stringValue(target.id)} platform-infra only; no HWLAB v0.3 integration is rendered.`,
    "Disclosure: Secret values are not printed; only object/key/fingerprint summaries are shown.",
  ]);
}

function renderStatus(result: Record<string, unknown>): RenderedCliResult {
  const target = record(result.target);
  const summary = record(result.summary);
  const deployments = arrayRecords(summary.deployments).map((item) => [
    stringValue(item.name),
    boolText(item.ready),
    `${stringValue(item.readyReplicas, "0")}/${stringValue(item.desired, "0")}`,
  ]);
  const targetSecret = record(summary.targetSecret);
  const tokenSecret = record(summary.tokenSecret);
  return rendered(result, "platform-infra secret-plane status", [
    "PLATFORM-INFRA SECRET-PLANE STATUS",
    ...table(["TARGET", "ROUTE", "NAMESPACE", "READY"], [[stringValue(target.id), stringValue(target.route), stringValue(target.namespace), boolText(summary.ready)]]),
    "",
    "WORKLOADS",
    ...(deployments.length === 0 ? ["-"] : table(["NAME", "READY", "REPLICAS"], deployments)),
    "",
    "CHECKS",
    ...table(["CHECK", "VALUE", "DETAIL"], [
      ["crds", boolText(summary.crdsReady), "ESO API installed"],
      ["eso", boolText(summary.esoReady), "controller/webhook/cert-controller"],
      ["vault", boolText(summary.vaultReady), "Vault dev KV v2 backend"],
      ["secretStore", boolText(summary.secretStoreReady), stringValue(record(summary.secretStore).name)],
      ["clusterStore", boolText(summary.clusterSecretStoreReady), stringValue(record(summary.clusterSecretStore).name)],
      ["sync", boolText(summary.syncReady), `secret=${stringValue(targetSecret.name)} key=${stringValue(arrayValues(targetSecret.keys).join(","), "-")}`],
      ["token", boolText(tokenSecret.ready), `secret=${stringValue(tokenSecret.name)} valuesPrinted=false`],
    ]),
    "",
    `NEXT  bun scripts/cli.ts platform-infra secret-plane validate --target ${stringValue(target.id)}`,
  ]);
}

function rendered(result: Record<string, unknown>, command: string, lines: string[]): RenderedCliResult {
  return { ok: result.ok !== false, command, renderedText: lines.join("\n"), contentType: "text/plain" };
}

function parseApplyOptions(args: string[]): ApplyOptions {
  const options = parseCommonOptions(args);
  if (args.includes("--confirm") && args.includes("--dry-run")) throw new Error("apply accepts only one of --confirm or --dry-run");
  return { ...options, dryRun: !args.includes("--confirm") || args.includes("--dry-run"), confirm: args.includes("--confirm") };
}

function parseCommonOptions(args: string[]): CommonOptions {
  let targetId: string | null = null;
  let full = false;
  let raw = false;
  for (let index = 0; index < args.length; index += 1) {
    const arg = args[index];
    if (arg === "--target") {
      const value = args[index + 1];
      if (value === undefined || value.startsWith("--")) throw new Error("--target requires a value");
      targetId = value;
      index += 1;
    } else if (arg.startsWith("--target=")) {
      targetId = arg.slice("--target=".length);
    } else if (arg === "--full") {
      full = true;
    } else if (arg === "--raw") {
      raw = true;
      full = true;
    } else if (arg === "--dry-run" || arg === "--confirm") {
      continue;
    } else {
      throw new Error(`unsupported option: ${arg}`);
    }
  }
  if (targetId !== null && !/^[A-Za-z0-9._-]+$/u.test(targetId)) throw new Error("--target must be a simple target id");
  return { targetId, full, raw };
}

function imageRef(image: ImageSpec): string {
  return `${image.repository}:${image.tag}`;
}

function sha256Fingerprint(value: string): string {
  return `sha256:${createHash("sha256").update(value).digest("hex")}`;
}

function record(value: unknown): Record<string, unknown> {
  return typeof value === "object" && value !== null && !Array.isArray(value) ? value as Record<string, unknown> : {};
}

function arrayRecords(value: unknown): Record<string, unknown>[] {
  return Array.isArray(value) ? value.map(record) : [];
}

function arrayValues(value: unknown): unknown[] {
  return Array.isArray(value) ? value : [];
}

function stringValue(value: unknown, fallback = "-"): string {
  if (value === undefined || value === null || value === "") return fallback;
  return String(value);
}

function boolText(value: unknown): string {
  return value === true ? "yes" : value === false ? "no" : "-";
}

function table(headers: string[], rows: string[][]): string[] {
  const widths = headers.map((header, index) => Math.max(header.length, ...rows.map((row) => row[index]?.length ?? 0)));
  const renderRow = (row: string[]) => row.map((cell, index) => cell.padEnd(widths[index] ?? cell.length)).join("  ").trimEnd();
  return [renderRow(headers), ...rows.map(renderRow)];
}