import type { RenderedCliResult } from "../output";

import type { SecretSyncOptions } from "./options";
import { displayValue, renderTable } from "./options";
import { record, stringOrNull } from "./utils";

const MAX_PLAN_ITEMS = 14;
const MAX_TARGET_SECRETS = 4;
const MAX_ACTIVATION_RESOURCES = 4;

export function renderAgentRunSecretSyncResult(result: Record<string, unknown>, options: SecretSyncOptions): RenderedCliResult {
  const command = "agentrun control-plane secret-sync";
  if (options.full || options.raw) return renderSecretSyncMachine(command, result, options.output === "yaml" && !options.raw ? "yaml" : "json");
  const payload = compactAgentRunSecretSyncPayload(result);
  if (options.output === "json" || options.output === "yaml") return renderSecretSyncMachine(command, payload, options.output);
  return {
    ok: result.ok !== false,
    command,
    renderedText: `${renderAgentRunSecretSyncText(payload)}\n`,
    contentType: "text/plain",
  };
}

export function compactAgentRunSecretSyncPayload(result: Record<string, unknown>): Record<string, unknown> {
  const target = record(result.target);
  const targetNode = record(target.node);
  const identity = {
    node: boundedText(targetNode.id ?? target.node),
    lane: boundedText(target.lane),
    namespace: boundedText(target.namespace ?? record(target.runtime).namespace),
    valuesPrinted: false,
  };
  const plan = record(result.plan);
  const rawItems = records(plan.items);
  const planItems = rawItems.slice(0, MAX_PLAN_ITEMS).map((item) => compactSecretPlanItem(item, identity));
  const requestedSecretIds = record(result.filter).secretIds;
  const secretIds = Array.isArray(requestedSecretIds)
    ? requestedSecretIds.map((item) => boundedText(item)).filter((item): item is string => item !== null)
    : [];
  const baseCommand = secretSyncBaseCommand(identity, secretIds);
  const activationPreflight = record(result.activationPreflight);
  return {
    apiVersion: "unidesk.pikastech.local/v1alpha1",
    kind: "AgentRunSecretSyncPlan",
    identity,
    status: {
      ok: result.ok !== false,
      status: boundedText(result.status ?? (result.ok === false ? "blocked" : "ready")),
      mode: boundedText(result.mode),
      reason: boundedText(result.degradedReason),
      blockedBeforeMutation: result.blockedBeforeMutation === true,
      secretSyncStarted: result.secretSyncStarted === true || result.mutation === true,
      mutation: result.mutation === true,
      valuesPrinted: false,
    },
    selection: {
      requestedSecretIds: secretIds,
      selectedCount: rawItems.length,
      valuesPrinted: false,
    },
    plan: {
      secretCount: numberOr(plan.secretCount, rawItems.length),
      readyCount: numberOrNull(plan.readyCount),
      unavailableCount: numberOrNull(plan.unavailableCount),
      items: planItems,
      omittedCount: Math.max(0, numberOr(plan.secretCount, rawItems.length) - planItems.length),
      valuesPrinted: false,
    },
    activationFence: Object.keys(activationPreflight).length === 0
      ? null
      : compactActivationFence(activationPreflight, identity),
    execution: compactExecution(record(result.execution)),
    next: {
      secretById: `${secretSyncBaseCommand(identity, [])} --secret-id <secret-id> --dry-run -o json`,
      observeRunners: boundedText(record(result.next).observeRunners),
      retryDryRun: boundedText(record(result.next).retryDryRun),
      retryAfterManagerFence: boundedText(record(result.next).retryAfterManagerFence),
      confirm: boundedText(record(result.next).confirm),
      status: boundedText(record(result.next).status),
      full: `${baseCommand} --dry-run --full -o json`,
      raw: `${baseCommand} --dry-run --raw`,
      valuesPrinted: false,
    },
    redaction: {
      secretValues: "omitted",
      runtimeSecretValuesDecoded: false,
      valuesPrinted: false,
    },
    valuesPrinted: false,
  };
}

export function renderAgentRunSecretSyncText(payload: Record<string, unknown>): string {
  const identity = record(payload.identity);
  const status = record(payload.status);
  const plan = record(payload.plan);
  const planItems = records(plan.items);
  const fence = record(payload.activationFence);
  const next = record(payload.next);
  const lines = [
    "AGENTRUN SECRET SYNC",
    renderTable(
      ["NODE", "LANE", "NAMESPACE", "STATUS", "MODE", "MUTATION", "VALUES"],
      [[
        displayValue(identity.node),
        displayValue(identity.lane),
        displayValue(identity.namespace),
        displayValue(status.status),
        displayValue(status.mode),
        String(status.mutation === true),
        "false",
      ]],
    ),
    `Reason: ${displayValue(status.reason)}`,
    "",
    `SECRET PLAN count=${displayValue(plan.secretCount)} omitted=${displayValue(plan.omittedCount)}`,
    planItems.length === 0
      ? "-"
      : renderTable(["ID", "TARGET", "KEY", "SOURCE", "PRESENT", "FINGERPRINT", "STATUS"], planItems.map((item) => {
        const source = record(item.source);
        const target = record(item.target);
        return [
          displayValue(item.id),
          displayValue(target.identity),
          displayValue(target.key),
          displayValue(source.mode),
          displayValue(source.present),
          shortFingerprint(source.fingerprint),
          source.present === true ? "ready" : "unavailable",
        ];
      })),
  ];
  if (Object.keys(fence).length > 0) {
    const authority = record(fence.authority);
    const observation = record(fence.observation);
    const targetSecrets = records(fence.targetSecrets);
    const resources = records(fence.resources);
    lines.push(
      "",
      "ACTIVATION FENCE",
      renderTable(["IDENTITY", "TYPE", "STATUS", "REASON", "RISKS", "ATOMIC"], [[
        displayValue(fence.identity),
        displayValue(fence.type),
        displayValue(fence.status),
        displayValue(fence.reason),
        displayValue(fence.resourceCount),
        displayValue(authority.atomicFenceAvailable),
      ]]),
      `Observation: targets=${displayValue(observation.targetSecretObservationComplete)} runners=${displayValue(observation.runnerObservationComplete)} mutations=${displayValue(observation.providerSecretMutationCount)} noOp=${displayValue(observation.providerSecretDataNoOp)}`,
    );
    if (targetSecrets.length > 0) {
      lines.push(
        "",
        "FENCE TARGET SECRETS",
        renderTable(["IDENTITY", "KEYS", "PRESENT", "STATUS", "MUTATIONS"], targetSecrets.map((item) => [
          displayValue(item.identity),
          stringList(item.desiredKeys),
          displayValue(item.present),
          displayValue(item.status),
          displayValue(item.mutationCount),
        ])),
      );
    }
    if (resources.length > 0) {
      lines.push(
        "",
        "FENCE RESOURCES",
        renderTable(["IDENTITY", "STATUS", "RUN", "COMMAND", "CLASSIFICATION"], resources.map((item) => [
          displayValue(item.identity),
          displayValue(item.status),
          displayValue(item.runId),
          displayValue(item.commandId),
          displayValue(item.classification),
        ])),
        ...resources.flatMap((item) => records(item.drillDown).map((entry) => `  ${displayValue(item.identity)}: ${displayValue(entry.command)}`)),
      );
    }
  }
  const nextLines = ["secretById", "observeRunners", "retryDryRun", "retryAfterManagerFence", "confirm", "status", "full", "raw"]
    .map((key) => boundedText(next[key]))
    .filter((value): value is string => value !== null);
  lines.push("", "NEXT", ...nextLines.map((line) => `  ${line}`), "", "VALUES PRINTED false");
  return lines.join("\n");
}

function compactSecretPlanItem(item: Record<string, unknown>, identity: Record<string, unknown>): Record<string, unknown> {
  const id = boundedText(item.id);
  const namespace = boundedText(item.namespace);
  const secret = boundedText(item.secret);
  const key = boundedText(item.key);
  void identity;
  return {
    id,
    target: {
      identity: namespace === null || secret === null ? null : `secret/${namespace}/${secret}`,
      key,
    },
    source: {
      mode: boundedText(item.sourceMode),
      present: item.present === true,
      fingerprint: boundedText(item.fingerprint, 96),
      ...(boundedText(item.degradedReason) === null ? {} : { reason: boundedText(item.degradedReason) }),
    },
  };
}

function compactActivationFence(preflight: Record<string, unknown>, identity: Record<string, unknown>): Record<string, unknown> {
  const authority = record(preflight.managerAuthority);
  const nestedAuthority = record(preflight.activationAuthority);
  const targetSecrets = records(preflight.targetSecrets).slice(0, MAX_TARGET_SECRETS).map(compactFenceTargetSecret);
  const rawRisks = records(preflight.activationRisks);
  const resources = rawRisks.slice(0, MAX_ACTIVATION_RESOURCES).map((risk, index) => compactFenceResource(risk, identity, index));
  return {
    apiVersion: "unidesk.pikastech.local/v1alpha1",
    kind: "ProviderSecretActivationFence",
    identity: `providersecretactivationfence/${displayValue(identity.node)}/${displayValue(identity.lane)}`,
    type: "provider-secret-activation",
    status: boundedText(preflight.status ?? (preflight.ok === true ? "ready" : "blocked")),
    reason: boundedText(preflight.reason),
    requiresManagerFence: preflight.requiresManagerFence === true,
    authority: {
      owner: boundedText(authority.owner ?? nestedAuthority.owner),
      atomicFenceAvailable: authority.atomicFenceAvailable === true || nestedAuthority.atomicFenceAvailable === true,
      mutationAuthorized: authority.mutationAuthorized === true || preflight.providerSecretMutationAuthorized === true,
      noOpOnly: authority.noOpOnly !== false && nestedAuthority.noOpOnly !== false,
      trackingIssue: boundedText(authority.trackingIssue),
    },
    observation: {
      targetSecretObservationComplete: preflight.targetSecretObservationComplete === true,
      runnerObservationComplete: preflight.runnerObservationComplete === true,
      allObservationsComplete: preflight.allObservationsComplete === true,
      providerSecretMutationCount: numberOrNull(preflight.providerSecretMutationCount),
      providerSecretDataNoOp: preflight.providerSecretDataNoOp === true,
    },
    targetSecretCount: numberOr(preflight.targetSecretCount, targetSecrets.length),
    targetSecrets,
    targetSecretOmittedCount: Math.max(0, numberOr(preflight.targetSecretCount, targetSecrets.length) - targetSecrets.length),
    resourceCount: numberOr(preflight.activationRiskCount, rawRisks.length),
    resources,
    resourceOmittedCount: Math.max(0, numberOr(preflight.activationRiskCount, rawRisks.length) - resources.length),
    valuesPrinted: false,
  };
}

function compactFenceTargetSecret(item: Record<string, unknown>): Record<string, unknown> {
  const namespace = boundedText(item.namespace);
  const name = boundedText(item.name);
  const mutations = records(item.mutations).slice(0, 6).map((mutation) => {
    const id = boundedText(mutation.id);
    return {
      id,
      key: boundedText(mutation.key),
      changeKind: boundedText(mutation.changeKind),
      desiredFingerprintSuffix: boundedText(mutation.desiredFingerprintSuffix ?? mutation.desiredEncodedFingerprint, 24)?.slice(-12) ?? null,
      runtimeFingerprintSuffix: boundedText(mutation.runtimeFingerprintSuffix ?? mutation.runtimeEncodedFingerprint, 24)?.slice(-12) ?? null,
    };
  });
  const queryOk = item.queryOk === true;
  const mutationCount = numberOr(item.mutationCount, mutations.length);
  return {
    kind: "Secret",
    identity: namespace === null || name === null ? null : `secret/${namespace}/${name}`,
    namespace,
    name,
    desiredKeys: stringArray(item.desiredKeys, 8),
    queryOk,
    present: typeof item.present === "boolean" ? item.present : null,
    status: !queryOk ? "observation-incomplete" : mutationCount === 0 ? "ready-no-op" : "mutation-pending",
    mutationCount,
    mutations,
  };
}

function compactFenceResource(risk: Record<string, unknown>, identity: Record<string, unknown>, index: number): Record<string, unknown> {
  const namespace = boundedText(identity.namespace);
  const runId = boundedText(risk.runId);
  const commandId = boundedText(risk.commandId);
  const runnerJobId = boundedText(risk.runnerJobId);
  const jobName = boundedText(risk.jobName);
  const pod = boundedText(risk.pod);
  const resourceIdentity = runnerJobId !== null
    ? `runnerjob/${runnerJobId}`
    : jobName !== null && namespace !== null
      ? `job/${namespace}/${jobName}`
      : pod !== null && namespace !== null
        ? `pod/${namespace}/${pod}`
        : `activationrisk/${index + 1}`;
  const drillDown = fenceResourceDrillDown(identity, { runId, commandId, runnerJobId });
  return {
    identity: resourceIdentity,
    status: boundedText(risk.phase),
    classification: boundedText(risk.classification),
    runId,
    commandId,
    runnerJobId,
    waitingReasons: stringArray(risk.waitingReasons, 4),
    dependencies: records(risk.dependencies).slice(0, 3).map((dependency) => ({
      identity: boundedText(dependency.name) === null || namespace === null ? null : `secret/${namespace}/${boundedText(dependency.name)}`,
      source: boundedText(dependency.source),
      affectedKeys: stringArray(dependency.affectedDesiredKeys, 6),
      mutationKinds: stringArray(dependency.mutationKinds, 4),
      reason: boundedText(dependency.reason),
    })),
    drillDown,
  };
}

function fenceResourceDrillDown(
  identity: Record<string, unknown>,
  resource: { runId: string | null; commandId: string | null; runnerJobId: string | null },
): Record<string, unknown>[] {
  const nodeLane = nodeLaneArgs(identity);
  const result: Record<string, unknown>[] = [];
  if (resource.runId !== null && resource.runnerJobId !== null) {
    result.push({ kind: "RunnerJob", identity: `runnerjob/${resource.runnerJobId}`, command: `bun scripts/cli.ts agentrun describe runnerjob/${resource.runnerJobId} --run ${resource.runId}${nodeLane}` });
  }
  if (resource.runId !== null && resource.commandId !== null) {
    result.push({ kind: "Command", identity: `command/${resource.commandId}`, command: `bun scripts/cli.ts agentrun describe command/${resource.commandId} --run ${resource.runId}${nodeLane}` });
  }
  if (resource.runId !== null) {
    result.push({ kind: "Run", identity: `run/${resource.runId}`, command: `bun scripts/cli.ts agentrun events run/${resource.runId} --after-seq 0 --limit 100${nodeLane}` });
  }
  return result.slice(0, 3);
}

function compactExecution(value: Record<string, unknown>): Record<string, unknown> {
  return {
    providerSecretClassification: boundedText(value.providerSecretClassification),
    providerSecretWritePolicy: boundedText(value.providerSecretWritePolicy),
    providerSecretWriteBlockedCount: numberOrNull(value.providerSecretWriteBlockedCount),
    providerSecretWriteSkippedCount: numberOrNull(value.providerSecretWriteSkippedCount),
    writableNonProviderSecretCount: numberOrNull(value.writableNonProviderSecretCount),
    secretSyncStarted: value.secretSyncStarted === true,
  };
}

function secretSyncBaseCommand(identity: Record<string, unknown>, secretIds: readonly string[]): string {
  const node = boundedText(identity.node) ?? "<node>";
  const lane = boundedText(identity.lane) ?? "<lane>";
  return [
    "bun scripts/cli.ts agentrun control-plane secret-sync",
    `--node ${node}`,
    `--lane ${lane}`,
    ...secretIds.map((id) => `--secret-id ${id}`),
  ].join(" ");
}

function nodeLaneArgs(identity: Record<string, unknown>): string {
  const node = boundedText(identity.node);
  const lane = boundedText(identity.lane);
  return node === null || lane === null ? "" : ` --node ${node} --lane ${lane}`;
}

function renderSecretSyncMachine(command: string, value: unknown, mode: "json" | "yaml"): RenderedCliResult {
  return {
    ok: record(value).ok !== false && record(record(value).status).ok !== false,
    command,
    renderedText: mode === "json" ? `${JSON.stringify(value)}\n` : `${Bun.YAML.stringify(value)}\n`,
    contentType: mode === "json" ? "application/json" : "application/yaml",
  };
}

function records(value: unknown): Record<string, unknown>[] {
  return Array.isArray(value) ? value.map(record).filter((item) => Object.keys(item).length > 0) : [];
}

function boundedText(value: unknown, max = 240): string | null {
  const text = stringOrNull(value);
  if (text === null) return null;
  const oneLine = text.replace(/\s+/gu, " ").trim();
  return oneLine.length <= max ? oneLine : `${oneLine.slice(0, Math.max(0, max - 3))}...`;
}

function stringArray(value: unknown, max: number): string[] {
  if (!Array.isArray(value)) return [];
  return value.map((item) => boundedText(item, 120)).filter((item): item is string => item !== null).slice(0, max);
}

function numberOr(value: unknown, fallback: number): number {
  return typeof value === "number" && Number.isFinite(value) ? value : fallback;
}

function numberOrNull(value: unknown): number | null {
  return typeof value === "number" && Number.isFinite(value) ? value : null;
}

function shortFingerprint(value: unknown): string {
  const fingerprint = boundedText(value, 96);
  if (fingerprint === null) return "-";
  return fingerprint.length <= 20 ? fingerprint : `${fingerprint.slice(0, 7)}…${fingerprint.slice(-12)}`;
}

function stringList(value: unknown): string {
  return Array.isArray(value) && value.length > 0 ? value.map(String).join(",") : "-";
}