import { randomBytes } from "node:crypto";
import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
import { dirname, isAbsolute, join } from "node:path";
import type { UniDeskConfig } from "./config";
import { rootPath } from "./config";
import { startJob } from "./jobs";
import type { SshCaptureResult } from "./ssh";
import { capture, fingerprintValues, parseJsonOutput } from "./platform-infra-public-service";
import {
  yamlBooleanField,
  yamlIntegerArrayField,
  yamlIntegerField,
  yamlKubernetesNameField,
  yamlObjectField,
  parseEnvFile,
  yamlRecord,
  yamlStringArrayField,
  yamlStringField,
} from "./platform-infra-ops-library";

export { parseEnvFile } from "./platform-infra-ops-library";

const defaultConfigPath = "config/secrets-distribution.yaml";
const fieldManager = "unidesk-secret-distribution";

interface SecretsOptions {
  configPath: string;
  scope: string | null;
  targetId: string | null;
  confirm: boolean;
  dryRun: boolean;
  wait: boolean;
  full: boolean;
  raw: boolean;
}

interface SecretDistributionConfig {
  configPath: string;
  version: number;
  kind: "unidesk-secret-distribution";
  metadata: { id: string; owner: string; relatedIssues: number[] };
  sources: { root: string; files: SourceFileConfig[] };
  targets: DistributionTarget[];
  kubernetesSecrets: KubernetesSecretConfig[];
}

interface SourceFileConfig {
  sourceRef: string;
  type: "env";
  requiredKeys: string[];
  createIfMissing: {
    enabled: boolean;
    values: Record<string, string>;
    randomHex: Record<string, number>;
    randomBase64Url: Record<string, { bytes: number; prefix: string }>;
  };
}

interface DistributionTarget {
  id: string;
  route: string;
  namespace: string;
  scope: string;
  enabled: boolean;
}

interface KubernetesSecretConfig {
  name: string;
  targetId: string;
  secretName: string;
  type: "Opaque";
  data: SecretDataMapping[];
}

interface SecretDataMapping {
  sourceRef: string;
  sourceKey: string;
  targetKey: string;
}

interface SourceMaterial {
  sourceRef: string;
  sourcePath: string;
  exists: boolean;
  requiredKeys: string[];
  presentKeys: string[];
  missingKeys: string[];
  action: "none" | "create" | "update" | "blocked";
  generatedKeys: string[];
  unmaterializedGeneratedKeys: string[];
  values: Record<string, string>;
  fingerprint: string | null;
}

interface SourceInspection {
  ok: boolean;
  root: string;
  entries: Array<Record<string, unknown>>;
  materials: Map<string, SourceMaterial>;
}

interface DesiredSecret {
  name: string;
  target: DistributionTarget;
  secretName: string;
  type: "Opaque";
  data: Record<string, string>;
  keySources: Array<{ sourceRef: string; sourceKey: string; targetKey: string }>;
  missingKeys: Array<{ sourceRef: string; sourceKey: string; targetKey: string }>;
  pendingGeneratedKeys: string[];
  fingerprint: string | null;
}

export interface EnvSourceFileMaterial {
  sourceRef: string;
  sourcePath: string;
  sourcePathRedacted: string;
  values: Record<string, string>;
  valuesPrinted: false;
}

export function secretsHelp(): Record<string, unknown> {
  return {
    command: "secrets plan|sync|status",
    output: "json",
    usage: [
      "bun scripts/cli.ts secrets plan --config config/secrets-distribution.yaml --scope platform-infra",
      "bun scripts/cli.ts secrets sync --config config/secrets-distribution.yaml --scope platform-infra --confirm",
      "bun scripts/cli.ts secrets status --config config/secrets-distribution.yaml --scope platform-infra",
    ],
    configTruth: defaultConfigPath,
    secretPolicy: "Secret values are never printed or reverse-engineered from runtime. YAML sourceRef files are the authority; sync only pushes declared keys to declared Kubernetes Secret keys.",
  };
}

export async function runSecretsCommand(config: UniDeskConfig, args: string[]): Promise<Record<string, unknown>> {
  const [action = "plan"] = args;
  if (action === "help" || action === "--help" || action === "-h") return secretsHelp();
  if (action === "plan") return plan(parseOptions(args.slice(1)));
  if (action === "sync") return await sync(config, parseOptions(args.slice(1)));
  if (action === "status") return await status(config, parseOptions(args.slice(1)));
  return { ok: false, error: "unsupported-secrets-command", args, help: secretsHelp() };
}

function parseOptions(args: string[]): SecretsOptions {
  let configPath = defaultConfigPath;
  let scope: string | null = null;
  let targetId: string | null = null;
  let confirm = false;
  let dryRun = false;
  let wait = false;
  let full = false;
  let raw = false;
  for (let index = 0; index < args.length; index += 1) {
    const arg = args[index];
    if (arg === "--config") {
      configPath = readOptionValue(args, index, "--config");
      index += 1;
    } else if (arg.startsWith("--config=")) {
      configPath = arg.slice("--config=".length);
    } else if (arg === "--scope") {
      scope = simpleId(readOptionValue(args, index, "--scope"), "--scope");
      index += 1;
    } else if (arg.startsWith("--scope=")) {
      scope = simpleId(arg.slice("--scope=".length), "--scope");
    } else if (arg === "--target") {
      targetId = simpleId(readOptionValue(args, index, "--target"), "--target");
      index += 1;
    } else if (arg.startsWith("--target=")) {
      targetId = simpleId(arg.slice("--target=".length), "--target");
    } else if (arg === "--confirm") {
      confirm = true;
    } else if (arg === "--dry-run") {
      dryRun = true;
    } else if (arg === "--wait") {
      wait = true;
    } else if (arg === "--full") {
      full = true;
    } else if (arg === "--raw") {
      raw = true;
      full = true;
    } else {
      throw new Error(`unsupported secrets option: ${arg}`);
    }
  }
  if (confirm && dryRun) throw new Error("secrets sync accepts only one of --confirm or --dry-run");
  return { configPath, scope, targetId, confirm, dryRun, wait, full, raw };
}

function plan(options: SecretsOptions): Record<string, unknown> {
  const distribution = readSecretDistributionConfig(options.configPath);
  assertSelectedTargets(distribution, options);
  const sources = inspectSources(distribution, false);
  const desired = desiredSecrets(distribution, options, sources);
  return {
    ok: sources.ok && desired.every((secret) => secret.missingKeys.length === 0),
    action: "secrets-plan",
    mutation: false,
    config: configSummary(distribution, options),
    localSources: sourceSummary(sources),
    desiredSecrets: desired.map(desiredSecretSummary),
    policy: {
      sourceAuthority: "local YAML-declared sourceRef files under sources.root",
      runtimeReverseEngineering: false,
      valuesPrinted: false,
    },
    next: {
      sync: `bun scripts/cli.ts secrets sync --config ${distribution.configPath}${options.scope === null ? "" : ` --scope ${options.scope}`}${options.targetId === null ? "" : ` --target ${options.targetId}`} --confirm`,
      status: `bun scripts/cli.ts secrets status --config ${distribution.configPath}${options.scope === null ? "" : ` --scope ${options.scope}`}${options.targetId === null ? "" : ` --target ${options.targetId}`}`,
    },
  };
}

async function sync(config: UniDeskConfig, options: SecretsOptions): Promise<Record<string, unknown>> {
  const distribution = readSecretDistributionConfig(options.configPath);
  assertSelectedTargets(distribution, options);
  if (!options.confirm || options.dryRun) {
    const planned = plan(options);
    return { ...planned, action: "secrets-sync", mode: "dry-run", mutation: false };
  }
  if (!options.wait) {
    const jobArgs = ["bun", "scripts/cli.ts", "secrets", "sync", "--config", distribution.configPath, "--confirm", "--wait"];
    if (options.scope !== null) jobArgs.push("--scope", options.scope);
    if (options.targetId !== null) jobArgs.push("--target", options.targetId);
    const job = startJob("secrets_sync", jobArgs, "Sync YAML-declared local secret source keys into declared Kubernetes Secrets without printing values");
    return {
      ok: true,
      action: "secrets-sync",
      mode: "async-job",
      mutation: true,
      config: configSummary(distribution, options),
      job,
      statusCommand: `bun scripts/cli.ts job status ${job.id} --tail-bytes 12000`,
    };
  }
  const sources = inspectSources(distribution, true);
  if (!sources.ok) return { ok: false, action: "secrets-sync", mode: "blocked-local-sources", mutation: true, config: configSummary(distribution, options), localSources: sourceSummary(sources) };
  const desired = desiredSecrets(distribution, options, sources);
  const missing = desired.flatMap((secret) => secret.missingKeys);
  if (missing.length > 0) {
    return { ok: false, action: "secrets-sync", mode: "blocked-missing-secret-data", mutation: true, config: configSummary(distribution, options), localSources: sourceSummary(sources), missing, valuesPrinted: false };
  }
  const perTarget = await Promise.all(groupDesiredSecretsByTarget(desired).map(async (group) => await applyTargetSecrets(config, group.target, group.secrets, options)));
  return {
    ok: perTarget.every((item) => item.ok === true),
    action: "secrets-sync",
    mode: "confirmed",
    mutation: true,
    config: configSummary(distribution, options),
    localSources: sourceSummary(sources),
    desiredSecrets: desired.map(desiredSecretSummary),
    targets: perTarget,
    valuesPrinted: false,
  };
}

async function status(config: UniDeskConfig, options: SecretsOptions): Promise<Record<string, unknown>> {
  const distribution = readSecretDistributionConfig(options.configPath);
  assertSelectedTargets(distribution, options);
  const sources = inspectSources(distribution, false);
  const desired = desiredSecrets(distribution, options, sources);
  const perTarget = await Promise.all(groupDesiredSecretsByTarget(desired).map(async (group) => await statusTargetSecrets(config, group.target, group.secrets, options)));
  return {
    ok: perTarget.every((item) => item.ok === true),
    action: "secrets-status",
    mutation: false,
    config: configSummary(distribution, options),
    localSources: sourceSummary(sources),
    desiredSecrets: desired.map(desiredSecretSummary),
    targets: perTarget,
    valuesPrinted: false,
  };
}

function readSecretDistributionConfig(pathArg: string): SecretDistributionConfig {
  const configPath = resolveConfigPath(pathArg);
  const label = displayConfigPath(pathArg);
  const root = asRecord(Bun.YAML.parse(readFileSync(configPath, "utf8")) as unknown, label);
  const version = integerField(root, "version", label);
  const kind = stringField(root, "kind", label);
  if (kind !== "unidesk-secret-distribution") throw new Error(`${label}.kind must be unidesk-secret-distribution`);
  const metadata = objectField(root, "metadata", label);
  const sources = objectField(root, "sources", label);
  const config: SecretDistributionConfig = {
    configPath: label,
    version,
    kind,
    metadata: {
      id: stringField(metadata, "id", `${label}.metadata`),
      owner: stringField(metadata, "owner", `${label}.metadata`),
      relatedIssues: numberArrayField(metadata, "relatedIssues", `${label}.metadata`),
    },
    sources: {
      root: stringField(sources, "root", `${label}.sources`),
      files: arrayOfRecords(sources.files, `${label}.sources.files`).map((item, index) => parseSourceFile(item, `${label}.sources.files[${index}]`)),
    },
    targets: arrayOfRecords(root.targets, `${label}.targets`).map((item, index) => parseTarget(item, `${label}.targets[${index}]`)),
    kubernetesSecrets: arrayOfRecords(root.kubernetesSecrets, `${label}.kubernetesSecrets`).map((item, index) => parseKubernetesSecret(item, `${label}.kubernetesSecrets[${index}]`)),
  };
  validateDistributionConfig(config);
  return config;
}

function parseSourceFile(record: Record<string, unknown>, path: string): SourceFileConfig {
  const type = stringField(record, "type", path);
  if (type !== "env") throw new Error(`${path}.type must be env`);
  const createRaw = record.createIfMissing === undefined ? {} : objectField(record, "createIfMissing", path);
  const randomBase64UrlRaw = createRaw.randomBase64Url === undefined ? {} : objectField(createRaw, "randomBase64Url", `${path}.createIfMissing`);
  return {
    sourceRef: sourceRefField(record, "sourceRef", path),
    type,
    requiredKeys: stringArrayField(record, "requiredKeys", path).map((key, index) => envKeyValue(key, `${path}.requiredKeys[${index}]`)),
    createIfMissing: {
      enabled: createRaw.enabled === undefined ? false : booleanField(createRaw, "enabled", `${path}.createIfMissing`),
      values: createRaw.values === undefined ? {} : stringMapField(createRaw, "values", `${path}.createIfMissing`),
      randomHex: createRaw.randomHex === undefined ? {} : numberMapField(createRaw, "randomHex", `${path}.createIfMissing`),
      randomBase64Url: Object.fromEntries(Object.entries(randomBase64UrlRaw).map(([key, value]) => [envKeyValue(key, `${path}.createIfMissing.randomBase64Url`), randomBase64UrlSpec(value, `${path}.createIfMissing.randomBase64Url.${key}`)])),
    },
  };
}

function parseTarget(record: Record<string, unknown>, path: string): DistributionTarget {
  return {
    id: simpleId(stringField(record, "id", path), `${path}.id`),
    route: stringField(record, "route", path),
    namespace: kubernetesNameField(record, "namespace", path),
    scope: simpleId(stringField(record, "scope", path), `${path}.scope`),
    enabled: booleanField(record, "enabled", path),
  };
}

function parseKubernetesSecret(record: Record<string, unknown>, path: string): KubernetesSecretConfig {
  const type = stringField(record, "type", path);
  if (type !== "Opaque") throw new Error(`${path}.type must be Opaque`);
  return {
    name: simpleId(stringField(record, "name", path), `${path}.name`),
    targetId: simpleId(stringField(record, "targetId", path), `${path}.targetId`),
    secretName: kubernetesNameField(record, "secretName", path),
    type,
    data: arrayOfRecords(record.data, `${path}.data`).map((item, index) => ({
      sourceRef: sourceRefField(item, "sourceRef", `${path}.data[${index}]`),
      sourceKey: envKeyField(item, "sourceKey", `${path}.data[${index}]`),
      targetKey: kubernetesSecretKeyField(item, "targetKey", `${path}.data[${index}]`),
    })),
  };
}

function validateDistributionConfig(config: SecretDistributionConfig): void {
  if (config.sources.files.length === 0) throw new Error(`${config.configPath}.sources.files must not be empty`);
  if (config.targets.length === 0) throw new Error(`${config.configPath}.targets must not be empty`);
  const sources = new Map(config.sources.files.map((item) => [item.sourceRef, item]));
  const targets = new Set(config.targets.map((item) => item.id));
  const targetSecrets = new Set<string>();
  for (const secret of config.kubernetesSecrets) {
    if (!targets.has(secret.targetId)) throw new Error(`${config.configPath}.kubernetesSecrets.${secret.name}.targetId is not declared in targets`);
    const secretIdentity = `${secret.targetId}/${secret.secretName}`;
    if (targetSecrets.has(secretIdentity)) throw new Error(`${config.configPath} declares duplicate target Secret ${secretIdentity}`);
    targetSecrets.add(secretIdentity);
    const targetKeys = new Set<string>();
    for (const item of secret.data) {
      const source = sources.get(item.sourceRef);
      if (source === undefined) throw new Error(`${config.configPath}.kubernetesSecrets.${secret.name} references undeclared sourceRef ${item.sourceRef}`);
      if (!source.requiredKeys.includes(item.sourceKey)) throw new Error(`${config.configPath}.kubernetesSecrets.${secret.name} maps ${item.sourceRef}.${item.sourceKey}, but that key is not listed in sources.files.requiredKeys`);
      if (targetKeys.has(item.targetKey)) throw new Error(`${config.configPath}.kubernetesSecrets.${secret.name} maps duplicate target key ${item.targetKey}`);
      targetKeys.add(item.targetKey);
    }
  }
}

function inspectSources(config: SecretDistributionConfig, materialize: boolean): SourceInspection {
  const root = secretRoot(config);
  const materials = new Map<string, SourceMaterial>();
  const entries = config.sources.files.map((source) => {
    const sourcePath = join(root, source.sourceRef);
    const exists = existsSync(sourcePath);
    const existing = exists ? parseEnvFile(readFileSync(sourcePath, "utf8")) : {};
    const next = { ...existing };
    const generatedKeys: string[] = [];
    const unmaterializedGeneratedKeys: string[] = [];
    if (source.createIfMissing.enabled) {
      for (const [key, value] of Object.entries(source.createIfMissing.values)) {
        if (next[key] === undefined || next[key].length === 0) {
          next[key] = value;
          generatedKeys.push(key);
        }
      }
      for (const [key, bytes] of Object.entries(source.createIfMissing.randomHex)) {
        if (next[key] === undefined || next[key].length === 0) {
          next[key] = materialize ? randomBytes(bytes).toString("hex") : `<generated:${key}>`;
          generatedKeys.push(key);
          if (!materialize) unmaterializedGeneratedKeys.push(key);
        }
      }
      for (const [key, spec] of Object.entries(source.createIfMissing.randomBase64Url)) {
        if (next[key] === undefined || next[key].length === 0) {
          next[key] = materialize ? `${spec.prefix}${randomBytes(spec.bytes).toString("base64url")}` : `<generated:${key}>`;
          generatedKeys.push(key);
          if (!materialize) unmaterializedGeneratedKeys.push(key);
        }
      }
    }
    const missingBefore = source.requiredKeys.filter((key) => existing[key] === undefined || existing[key].length === 0);
    const missingKeys = source.requiredKeys.filter((key) => next[key] === undefined || next[key].length === 0);
    const action = missingKeys.length > 0 ? "blocked" : !exists ? "create" : missingBefore.length > 0 ? "update" : "none";
    if (materialize && action !== "blocked" && (action === "create" || action === "update")) writeEnvFile(sourcePath, next);
    const material: SourceMaterial = {
      sourceRef: source.sourceRef,
      sourcePath,
      exists,
      requiredKeys: source.requiredKeys,
      presentKeys: source.requiredKeys.filter((key) => next[key] !== undefined && next[key].length > 0),
      missingKeys,
      action,
      generatedKeys,
      unmaterializedGeneratedKeys,
      values: next,
      fingerprint: missingKeys.length === 0 && unmaterializedGeneratedKeys.length === 0 ? fingerprintValues(next, source.requiredKeys) : null,
    };
    materials.set(source.sourceRef, material);
    return {
      sourceRef: source.sourceRef,
      sourcePath: redactRepoPath(sourcePath),
      exists,
      requiredKeys: source.requiredKeys,
      presentKeys: material.presentKeys,
      missingKeys,
      action,
      generatedKeys,
      unmaterializedGeneratedKeys,
      fingerprint: material.fingerprint,
      valuesPrinted: false,
    };
  });
  return {
    ok: entries.every((entry) => (entry.missingKeys as string[]).length === 0),
    root: redactRepoPath(root),
    entries,
    materials,
  };
}

function desiredSecrets(config: SecretDistributionConfig, options: SecretsOptions, sources: SourceInspection): DesiredSecret[] {
  const selectedTargetIds = new Set(selectedTargets(config, options).map((target) => target.id));
  const targets = new Map(config.targets.map((target) => [target.id, target]));
  return config.kubernetesSecrets
    .map((secret) => ({ secret, target: targets.get(secret.targetId) }))
    .filter((item): item is { secret: KubernetesSecretConfig; target: DistributionTarget } => item.target !== undefined && item.target.enabled)
    .filter(({ target }) => selectedTargetIds.has(target.id))
    .map(({ secret, target }) => {
      const data: Record<string, string> = {};
      const missingKeys: DesiredSecret["missingKeys"] = [];
      const pendingGeneratedKeys: string[] = [];
      for (const item of secret.data) {
        const source = sources.materials.get(item.sourceRef);
        const value = source?.values[item.sourceKey];
        if (value === undefined || value.length === 0) {
          missingKeys.push({ sourceRef: item.sourceRef, sourceKey: item.sourceKey, targetKey: item.targetKey });
        } else {
          data[item.targetKey] = value;
        }
        if (source?.unmaterializedGeneratedKeys.includes(item.sourceKey) === true) pendingGeneratedKeys.push(item.targetKey);
      }
      const keys = Object.keys(data);
      return {
        name: secret.name,
        target,
        secretName: secret.secretName,
        type: secret.type,
        data,
        keySources: secret.data,
        missingKeys,
        pendingGeneratedKeys,
        fingerprint: missingKeys.length === 0 && pendingGeneratedKeys.length === 0 ? fingerprintValues(data, keys) : null,
      };
    });
}

function assertSelectedTargets(config: SecretDistributionConfig, options: SecretsOptions): void {
  const targets = selectedTargets(config, options);
  if (targets.length > 0) return;
  const available = config.targets.filter((target) => target.enabled).map((target) => target.id).sort();
  throw new Error(`no enabled secrets target matches scope=${options.scope ?? "*"} target=${options.targetId ?? "*"}; available targets: ${available.length > 0 ? available.join(", ") : "<none>"}`);
}

function selectedTargets(config: SecretDistributionConfig, options: SecretsOptions): DistributionTarget[] {
  return config.targets
    .filter((target) => target.enabled)
    .filter((target) => options.scope === null || target.scope === options.scope)
    .filter((target) => options.targetId === null || target.id === options.targetId);
}

async function applyTargetSecrets(config: UniDeskConfig, target: DistributionTarget, secrets: DesiredSecret[], options: SecretsOptions): Promise<Record<string, unknown>> {
  if (secrets.length === 0) return { ok: true, target: targetSummary(target), mode: "skipped-no-secrets" };
  const yaml = renderSecretManifest(target, secrets);
  const result = await capture(config, target.route, ["sh"], applySecretScript(target, secrets, yaml));
  const parsed = parseJsonOutput(result.stdout);
  return {
    ok: result.exitCode === 0 && boolField(parsed, "ok", false),
    target: targetSummary(target),
    summary: parsed,
    remote: secretCaptureSummary(result),
    ...(options.raw ? { rawCaptureOmitted: true, rawPolicy: "Secret distribution never returns raw SSH capture because remote output can contain credential-bearing diagnostics." } : {}),
  };
}

async function statusTargetSecrets(config: UniDeskConfig, target: DistributionTarget, secrets: DesiredSecret[], options: SecretsOptions): Promise<Record<string, unknown>> {
  const result = await capture(config, target.route, ["sh"], statusSecretScript(target, secrets));
  const parsed = parseJsonOutput(result.stdout);
  return {
    ok: result.exitCode === 0 && boolField(parsed, "ok", false),
    target: targetSummary(target),
    summary: parsed,
    remote: secretCaptureSummary(result),
    ...(options.raw ? { rawCaptureOmitted: true, rawPolicy: "Secret distribution never returns raw SSH capture because remote output can contain credential-bearing diagnostics." } : {}),
  };
}

function secretCaptureSummary(result: SshCaptureResult): Record<string, unknown> {
  return {
    exitCode: result.exitCode,
    stdoutBytes: Buffer.byteLength(result.stdout, "utf8"),
    stderrBytes: Buffer.byteLength(result.stderr, "utf8"),
    stdoutTailOmitted: true,
    stderrTailOmitted: true,
    valuesPrinted: false,
  };
}

function renderSecretManifest(target: DistributionTarget, secrets: DesiredSecret[]): string {
  return secrets.map((secret) => `apiVersion: v1
kind: Secret
metadata:
  name: ${secret.secretName}
  namespace: ${target.namespace}
  labels:
    app.kubernetes.io/managed-by: unidesk
    app.kubernetes.io/part-of: ${target.scope}
type: ${secret.type}
data:
${Object.entries(secret.data).sort(([a], [b]) => a.localeCompare(b)).map(([key, value]) => `  ${key}: ${Buffer.from(value, "utf8").toString("base64")}`).join("\n")}
`).join("---\n");
}

function applySecretScript(target: DistributionTarget, secrets: DesiredSecret[], yaml: string): string {
  const manifestB64 = Buffer.from(yaml, "utf8").toString("base64");
  const summaryB64 = Buffer.from(JSON.stringify(secrets.map(remoteSecretSummary)), "utf8").toString("base64");
  return `
set -u
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
manifest="$tmp/secrets.yaml"
printf '%s' '${manifestB64}' | base64 -d >"$manifest"
kubectl create namespace ${target.namespace} --dry-run=client -o yaml | kubectl apply --server-side --force-conflicts --field-manager=${fieldManager} -f - >"$tmp/ns.out" 2>"$tmp/ns.err"
ns_rc=$?
if [ "$ns_rc" -eq 0 ]; then
  kubectl apply --server-side --force-conflicts --field-manager=${fieldManager} -f "$manifest" >"$tmp/apply.out" 2>"$tmp/apply.err"
  apply_rc=$?
else
  : >"$tmp/apply.out"
  printf '%s\\n' 'skipped because namespace sync failed' >"$tmp/apply.err"
  apply_rc=1
fi
python3 - "$ns_rc" "$apply_rc" "$tmp/ns.out" "$tmp/ns.err" "$tmp/apply.out" "$tmp/apply.err" <<'PY'
import base64, json, sys
ns_rc, apply_rc = int(sys.argv[1]), int(sys.argv[2])
def text(path, limit=5000):
    try:
        return open(path, encoding="utf-8", errors="replace").read()[-limit:]
    except FileNotFoundError:
        return ""
payload = {
    "ok": ns_rc == 0 and apply_rc == 0,
    "namespace": "${target.namespace}",
    "secrets": json.loads(base64.b64decode("${summaryB64}").decode("utf-8")),
    "valuesPrinted": False,
    "steps": {
        "namespace": {"exitCode": ns_rc, "stdout": text(sys.argv[3]), "stderr": text(sys.argv[4])},
        "apply": {"exitCode": apply_rc, "stdout": text(sys.argv[5]), "stderr": text(sys.argv[6])},
    },
}
print(json.dumps(payload, ensure_ascii=False, indent=2))
sys.exit(0 if payload["ok"] else 1)
PY
`;
}

function statusSecretScript(target: DistributionTarget, secrets: DesiredSecret[]): string {
  const summaryB64 = Buffer.from(JSON.stringify(secrets.map(remoteSecretSummary)), "utf8").toString("base64");
  const commands = secrets.map((secret, index) => [
    `kubectl -n ${target.namespace} get secret ${secret.secretName} -o json >"$tmp/secret.${index}.json" 2>"$tmp/secret.${index}.err"`,
    `printf '%s' "$?" >"$tmp/secret.${index}.rc"`,
  ].join("\n")).join("\n");
  return `
set -u
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
${commands}
python3 - "$tmp" <<'PY'
import base64, json, os, sys
tmp = sys.argv[1]
expected = json.loads(base64.b64decode("${summaryB64}").decode("utf-8"))
items = []
ok = True
for index, item in enumerate(expected):
    try:
        rc = int(open(os.path.join(tmp, f"secret.{index}.rc"), encoding="utf-8").read() or "1")
    except FileNotFoundError:
        rc = 1
    try:
        observed = json.load(open(os.path.join(tmp, f"secret.{index}.json"), encoding="utf-8"))
    except Exception:
        observed = None
    data = (observed or {}).get("data") or {}
    observed_keys = sorted(data.keys())
    expected_keys = item.get("keys") or []
    missing = [key for key in expected_keys if key not in observed_keys]
    exists = rc == 0
    item_ok = exists and len(missing) == 0
    ok = ok and item_ok
    items.append({
        "name": item.get("name"),
        "secretName": item.get("secretName"),
        "exists": exists,
        "keys": observed_keys,
        "expectedKeys": expected_keys,
        "missingKeys": missing,
        "ok": item_ok,
        "valuesPrinted": False,
    })
payload = {"ok": ok, "namespace": "${target.namespace}", "secrets": items, "valuesPrinted": False}
print(json.dumps(payload, ensure_ascii=False, indent=2))
sys.exit(0 if ok else 1)
PY
`;
}

function groupDesiredSecretsByTarget(secrets: DesiredSecret[]): Array<{ target: DistributionTarget; secrets: DesiredSecret[] }> {
  const groups = new Map<string, { target: DistributionTarget; secrets: DesiredSecret[] }>();
  for (const secret of secrets) {
    const existing = groups.get(secret.target.id);
    if (existing === undefined) groups.set(secret.target.id, { target: secret.target, secrets: [secret] });
    else existing.secrets.push(secret);
  }
  return Array.from(groups.values());
}

function configSummary(config: SecretDistributionConfig, options: SecretsOptions): Record<string, unknown> {
  return {
    path: config.configPath,
    metadata: config.metadata,
    root: redactRepoPath(secretRoot(config)),
    scope: options.scope,
    targetId: options.targetId,
    sources: config.sources.files.map((item) => ({ sourceRef: item.sourceRef, requiredKeys: item.requiredKeys, createIfMissing: item.createIfMissing.enabled })),
    targets: config.targets.filter((target) => (options.scope === null || target.scope === options.scope) && (options.targetId === null || target.id === options.targetId)).map(targetSummary),
    valuesPrinted: false,
  };
}

function sourceSummary(sources: SourceInspection): Record<string, unknown> {
  return { ok: sources.ok, root: sources.root, entries: sources.entries, valuesPrinted: false };
}

function desiredSecretSummary(secret: DesiredSecret): Record<string, unknown> {
  return {
    name: secret.name,
    target: targetSummary(secret.target),
    secretName: secret.secretName,
    keys: Object.keys(secret.data).sort(),
    keySources: secret.keySources,
    missingKeys: secret.missingKeys,
    pendingGeneratedKeys: secret.pendingGeneratedKeys,
    fingerprint: secret.fingerprint,
    valuesPrinted: false,
  };
}

function remoteSecretSummary(secret: DesiredSecret): Record<string, unknown> {
  return {
    name: secret.name,
    secretName: secret.secretName,
    keys: Object.keys(secret.data).sort(),
    fingerprint: secret.fingerprint,
    valuesPrinted: false,
  };
}

function targetSummary(target: DistributionTarget): Record<string, unknown> {
  return { id: target.id, route: target.route, namespace: target.namespace, scope: target.scope };
}

function readOptionValue(args: string[], index: number, option: string): string {
  const value = args[index + 1];
  if (value === undefined || value.length === 0 || value.startsWith("--")) throw new Error(`${option} requires a value`);
  return value;
}

function resolveConfigPath(pathArg: string): string {
  if (pathArg.startsWith("/") || pathArg.includes("\0")) throw new Error("--config must be a repo-relative YAML path");
  if (pathArg.includes("..")) throw new Error("--config must not contain ..");
  return rootPath(pathArg);
}

function displayConfigPath(pathArg: string): string {
  if (pathArg.startsWith("/") || pathArg.includes("..")) throw new Error("--config must be a repo-relative YAML path without ..");
  return pathArg;
}

function secretRoot(config: SecretDistributionConfig): string {
  const root = config.sources.root;
  return isAbsolute(root) ? root : rootPath(root);
}

export function readTextFile(path: string): string {
  if (!existsSync(path)) throw new Error(`required secret source ${redactRepoPath(path)} is missing`);
  return readFileSync(path, "utf8");
}

export function readEnvSourceFile(params: { root: string; sourceRef: string; missingMessage?: (sourcePath: string) => string }): EnvSourceFileMaterial {
  const sourcePath = join(params.root, params.sourceRef);
  if (!existsSync(sourcePath)) {
    throw new Error(params.missingMessage?.(sourcePath) ?? `required secret source ${redactRepoPath(sourcePath)} is missing`);
  }
  return {
    sourceRef: params.sourceRef,
    sourcePath,
    sourcePathRedacted: redactRepoPath(sourcePath),
    values: parseEnvFile(readFileSync(sourcePath, "utf8")),
    valuesPrinted: false,
  };
}

export function requiredEnvValue(values: Record<string, string>, key: string, sourceRef: string): string {
  const value = values[key];
  if (value === undefined || value.length === 0) throw new Error(`${sourceRef} is missing required key ${key}`);
  return value;
}

export function fingerprintSecretValues(values: Record<string, string>, keys: string[]): string {
  return fingerprintValues(values, keys);
}

function writeEnvFile(path: string, values: Record<string, string>): void {
  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
  const lines = Object.keys(values).sort().map((key) => `${key}=${quoteEnv(values[key])}`);
  writeFileSync(path, `${lines.join("\n")}\n`, { encoding: "utf8", mode: 0o600 });
  chmodSync(path, 0o600);
}

function quoteEnv(value: string): string {
  if (/^[A-Za-z0-9_./:@%?&=+-]+$/u.test(value)) return value;
  return `'${value.replaceAll("'", "'\"'\"'")}'`;
}

export function redactRepoPath(path: string): string {
  const root = rootPath();
  return path.startsWith(`${root}/`) ? path.slice(root.length + 1) : path;
}

function boolField(value: Record<string, unknown> | null, key: string, fallback: boolean): boolean {
  return typeof value?.[key] === "boolean" ? value[key] : fallback;
}

function asRecord(value: unknown, path: string): Record<string, unknown> {
  return yamlRecord(value, path);
}

function objectField(obj: Record<string, unknown>, key: string, path: string): Record<string, unknown> {
  return yamlObjectField(obj, key, path, "");
}

function arrayOfRecords(value: unknown, path: string): Record<string, unknown>[] {
  if (!Array.isArray(value)) throw new Error(`${path} must be an array`);
  return value.map((item, index) => asRecord(item, `${path}[${index}]`));
}

function stringField(obj: Record<string, unknown>, key: string, path: string): string {
  return yamlStringField(obj, key, path, "");
}

function integerField(obj: Record<string, unknown>, key: string, path: string): number {
  return yamlIntegerField(obj, key, path, "");
}

function booleanField(obj: Record<string, unknown>, key: string, path: string): boolean {
  return yamlBooleanField(obj, key, path, "");
}

function stringArrayField(obj: Record<string, unknown>, key: string, path: string): string[] {
  return yamlStringArrayField(obj, key, path, "");
}

function numberArrayField(obj: Record<string, unknown>, key: string, path: string): number[] {
  return yamlIntegerArrayField(obj, key, path, "");
}

function stringMapField(obj: Record<string, unknown>, key: string, path: string): Record<string, string> {
  const record = objectField(obj, key, path);
  const result: Record<string, string> = {};
  for (const [itemKey, itemValue] of Object.entries(record)) {
    result[envKeyValue(itemKey, `${path}.${key}`)] = stringValue(itemValue, `${path}.${key}.${itemKey}`);
  }
  return result;
}

function numberMapField(obj: Record<string, unknown>, key: string, path: string): Record<string, number> {
  const record = objectField(obj, key, path);
  const result: Record<string, number> = {};
  for (const [itemKey, itemValue] of Object.entries(record)) {
    result[envKeyValue(itemKey, `${path}.${key}`)] = randomByteCount(itemValue, `${path}.${key}.${itemKey}`);
  }
  return result;
}

function randomBase64UrlSpec(value: unknown, path: string): { bytes: number; prefix: string } {
  const record = asRecord(value, path);
  return {
    bytes: randomByteCount(record.bytes, `${path}.bytes`),
    prefix: record.prefix === undefined ? "" : stringValue(record.prefix, `${path}.prefix`),
  };
}

function stringValue(value: unknown, path: string): string {
  if (typeof value !== "string") throw new Error(`${path} must be a string`);
  return value;
}

function randomByteCount(value: unknown, path: string): number {
  if (typeof value !== "number" || !Number.isInteger(value) || value < 16 || value > 128) throw new Error(`${path} must be an integer in 16..128`);
  return value;
}

function sourceRefField(obj: Record<string, unknown>, key: string, path: string): string {
  const value = stringField(obj, key, path);
  if (value.startsWith("/") || value.includes("..") || value.includes("\0") || !/^[A-Za-z0-9_./-]+$/u.test(value)) throw new Error(`${path}.${key} must be a relative source ref without ..`);
  return value;
}

function envKeyField(obj: Record<string, unknown>, key: string, path: string): string {
  return envKeyValue(stringField(obj, key, path), `${path}.${key}`);
}

function envKeyValue(value: string, path: string): string {
  if (!/^[A-Z_][A-Z0-9_]*$/u.test(value)) throw new Error(`${path} must be an uppercase env key`);
  return value;
}

function kubernetesNameField(obj: Record<string, unknown>, key: string, path: string): string {
  return yamlKubernetesNameField(obj, key, path, "");
}

function kubernetesSecretKeyField(obj: Record<string, unknown>, key: string, path: string): string {
  const value = stringField(obj, key, path);
  if (!/^[A-Za-z0-9._-]+$/u.test(value)) throw new Error(`${path}.${key} must be a Kubernetes Secret key`);
  return value;
}

function simpleId(value: string, path: string): string {
  if (!/^[A-Za-z0-9._-]+$/u.test(value)) throw new Error(`${path} must be a simple id`);
  return value;
}