import { createHash } from "node:crypto";
import { existsSync, readFileSync } from "node:fs";
import { dirname, relative, resolve } from "node:path";
import { rootPath } from "./config";
import type { PublicServiceExposure, PublicServiceTarget } from "./platform-infra-public-service";
import { assertNoDuplicateYamlMappingKeys, createYamlFieldReader, readYamlRecord, resolveRepoPath } from "./platform-infra-ops-library";

export const sub2RankConfigPath = rootPath("config", "platform-infra", "sub2rank.yaml");
export const sub2RankConfigLabel = "config/platform-infra/sub2rank.yaml";

const y = createYamlFieldReader(sub2RankConfigLabel);

export interface Sub2RankConfig {
  version: number;
  kind: "platform-infra-sub2rank";
  warnings: string[];
  metadata: { id: string; owner: string; relatedIssues: number[] };
  defaults: { targetId: string };
  application: {
    repository: string;
    remote: string;
    branch: string;
    sourceRoot: string;
    configRef: string;
    sourceConfigPath: string;
    dockerfile: string;
    runtimeTarget: string;
    configText: string;
    configSha256: string;
    sourceCommit: string;
    sourceClean: boolean;
    sourceRemotePresent: boolean;
    sourceRemoteMatches: boolean;
    sourceConfigPathMatches: boolean;
    configMatchesSourceCommit: boolean;
    deploymentBlockPresent: boolean;
    automaticCreditEnabled: boolean;
    server: { listenPort: number; databasePath: string; envKeys: string[] };
  };
  image: { repository: string; pullPolicy: "Always" | "IfNotPresent" | "Never" };
  delivery: {
    enabled: boolean;
    pipeline: {
      namespace: string;
      name: string;
      runPrefix: string;
      serviceAccountName: string;
      timeout: string;
      workspaceSize: string;
      toolsImage: string;
      buildkitImage: string;
      sourceSnapshotPrefix: string;
    };
    build: {
      networkMode: "host";
      proxy: { http: string; https: string; all: string; noProxy: string[] };
    };
    gitops: {
      readUrl: string;
      writeUrl: string;
      branch: string;
      manifestPath: string;
      releaseStatePath: string;
      maxPushAttempts: number;
      author: { name: string; email: string };
      application: {
        name: string;
        namespace: string;
        project: string;
        path: string;
        destinationNamespace: string;
        automated: boolean;
      };
    };
  };
  targets: Sub2RankTarget[];
  runtime: {
    sharedNetworkPolicyRef: { name: string; managedBySub2Rank: false };
    service: { name: string; port: number };
    configMap: { name: string; key: string; mountPath: string };
    command: string[];
    storage: { claimName: string; size: string; mountPath: string };
    secret: ResolvedSecretDeclaration & { configRef: string; declarationId: string; requiredTargetKeys: string[]; appEnvTargetKeys: string[] };
    probes: { healthPath: string; initialDelaySeconds: number; periodSeconds: number; timeoutSeconds: number; failureThreshold: number };
    rollout: { fieldManager: string; waitTimeoutSeconds: number };
  };
}

export interface Sub2RankTarget extends PublicServiceTarget {
  enabled: boolean;
  publicExposure: PublicServiceExposure & {
    frpc: PublicServiceExposure["frpc"] & {
      configMapName: string;
      configKey: string;
      tokenEnvName: string;
      tokenTargetKey: string;
    };
  };
}

interface ParsedTarget {
  id: string;
  route: string;
  namespace: string;
  enabled: boolean;
  replicas: number;
  exposure: Omit<Sub2RankTarget["publicExposure"], "frpc"> & {
    frpc: Omit<Sub2RankTarget["publicExposure"]["frpc"], "secretName" | "secretKey" | "tokenSourceRef" | "tokenSourceKey">;
  };
}

interface ResolvedSecretDeclaration {
  targetId: string;
  route: string;
  namespace: string;
  secretName: string;
  mappings: Array<{ sourceRef: string; sourceKey: string; targetKey: string }>;
}

export function readSub2RankConfig(): Sub2RankConfig {
  const root = readYamlRecord<Record<string, unknown>>(sub2RankConfigPath, "platform-infra-sub2rank");
  const version = y.integerField(root, "version", "");
  if (version !== 1) throw new Error(`${sub2RankConfigLabel}.version must be 1`);
  const metadataRecord = y.objectField(root, "metadata", "");
  const defaultsRecord = y.objectField(root, "defaults", "");
  const applicationRecord = y.objectField(root, "application", "");
  const imageRecord = y.objectField(root, "image", "");
  const deliveryRecord = y.objectField(root, "delivery", "");
  const runtimeRecord = y.objectField(root, "runtime", "");
  const defaults = { targetId: simpleId(y.stringField(defaultsRecord, "targetId", "defaults"), "defaults.targetId") };
  const application = parseApplication(applicationRecord);
  const image = parseImage(imageRecord);
  const delivery = parseDelivery(deliveryRecord);
  const runtimeBase = parseRuntime(runtimeRecord);
  const secret = resolveSecretDeclaration(runtimeBase.secret.configRef, runtimeBase.secret.declarationId);
  const targets = parseTargets(root.targets, secret);
  if (!targets.some((target) => target.id === defaults.targetId)) throw new Error(`${sub2RankConfigLabel}.targets must include defaults.targetId ${defaults.targetId}`);
  const warnings = validateResolvedConfig(application, image, delivery, runtimeBase, secret, targets);
  return {
    version,
    kind: "platform-infra-sub2rank",
    warnings,
    metadata: {
      id: y.stringField(metadataRecord, "id", "metadata"),
      owner: y.stringField(metadataRecord, "owner", "metadata"),
      relatedIssues: y.numberArrayField(metadataRecord, "relatedIssues", "metadata"),
    },
    defaults,
    application,
    image,
    delivery,
    targets,
    runtime: { ...runtimeBase, secret: { ...runtimeBase.secret, ...secret } },
  };
}

export function resolveSub2RankTarget(config: Sub2RankConfig, targetId: string | null): Sub2RankTarget {
  const selected = targetId ?? config.defaults.targetId;
  const target = config.targets.find((item) => item.id === selected);
  if (target === undefined) throw new Error(`unknown Sub2Rank target ${selected}; known targets: ${config.targets.map((item) => item.id).join(", ")}`);
  if (!target.enabled) throw new Error(`Sub2Rank target ${selected} is disabled in ${sub2RankConfigLabel}`);
  return target;
}

function parseApplication(record: Record<string, unknown>): Sub2RankConfig["application"] {
  const repository = repositoryValue(y.stringField(record, "repository", "application"), "application.repository");
  const remote = y.stringField(record, "remote", "application");
  const branch = simpleId(y.stringField(record, "branch", "application"), "application.branch");
  const sourceRoot = y.absolutePathField(record, "sourceRoot", "application");
  const configRef = y.absolutePathField(record, "configRef", "application");
  const sourceConfigPath = safeRelativePath(y.stringField(record, "sourceConfigPath", "application"), "application.sourceConfigPath");
  const dockerfile = safeRelativePath(y.stringField(record, "dockerfile", "application"), "application.dockerfile");
  const runtimeTarget = simpleId(y.stringField(record, "runtimeTarget", "application"), "application.runtimeTarget");
  if (!configRef.startsWith(`${sourceRoot.replace(/\/+$/u, "")}/`)) throw new Error(`${sub2RankConfigLabel}.application.configRef must be inside application.sourceRoot`);
  if (!existsSync(resolve(sourceRoot, dockerfile))) throw new Error(`${sub2RankConfigLabel}.application.dockerfile does not exist under application.sourceRoot`);
  const configText = readFileSync(configRef, "utf8");
  assertNoDuplicateYamlMappingKeys(configText, configRef);
  const app = y.asRecord(Bun.YAML.parse(configText), configRef);
  if (app.kind !== "Sub2Rank") throw new Error(`${configRef}.kind must be Sub2Rank`);
  const appRuntime = app.runtime;
  if (typeof appRuntime !== "object" || appRuntime === null || Array.isArray(appRuntime)) throw new Error(`${configRef}.runtime must be an object`);
  const serverTargets = (appRuntime as Record<string, unknown>).serverTargets;
  if (typeof serverTargets !== "object" || serverTargets === null || Array.isArray(serverTargets)) throw new Error(`${configRef}.runtime.serverTargets must be an object`);
  const serverValue = (serverTargets as Record<string, unknown>)[runtimeTarget];
  if (typeof serverValue !== "object" || serverValue === null || Array.isArray(serverValue)) throw new Error(`${configRef}.runtime.serverTargets.${runtimeTarget} must be an object`);
  const server = serverValue as Record<string, unknown>;
  const lottery = app.lottery;
  if (typeof lottery !== "object" || lottery === null || Array.isArray(lottery)) throw new Error(`${configRef}.lottery must be an object`);
  const automaticCredit = (lottery as Record<string, unknown>).automaticCredit;
  if (typeof automaticCredit !== "object" || automaticCredit === null || Array.isArray(automaticCredit)) throw new Error(`${configRef}.lottery.automaticCredit must be an object`);
  const automaticCreditEnabled = (automaticCredit as Record<string, unknown>).enabled;
  if (typeof automaticCreditEnabled !== "boolean") throw new Error(`${configRef}.lottery.automaticCredit.enabled must be a boolean`);
  const sourceCommit = gitText(sourceRoot, ["rev-parse", "HEAD"], "resolve Sub2Rank source commit");
  if (!/^[a-f0-9]{40}$/u.test(sourceCommit)) throw new Error(`${sourceRoot} HEAD must resolve to a full Git commit`);
  const statusShort = gitText(sourceRoot, ["status", "--porcelain"], "read Sub2Rank source status", true);
  const observedRemote = gitText(sourceRoot, ["remote", "get-url", "origin"], "read Sub2Rank origin", true);
  const configRelativePath = relative(sourceRoot, configRef).replaceAll("\\", "/");
  const committedConfig = gitText(sourceRoot, ["show", `${sourceCommit}:${configRelativePath}`], "read committed Sub2Rank application config", true, false);
  return {
    repository,
    remote,
    branch,
    sourceRoot,
    configRef,
    sourceConfigPath,
    dockerfile,
    runtimeTarget,
    configText,
    configSha256: createHash("sha256").update(configText).digest("hex"),
    sourceCommit,
    sourceClean: statusShort.length === 0,
    sourceRemotePresent: observedRemote.length > 0,
    sourceRemoteMatches: sameRepositoryIdentity(remote, observedRemote),
    sourceConfigPathMatches: configRelativePath === sourceConfigPath,
    configMatchesSourceCommit: committedConfig === configText.trimEnd(),
    deploymentBlockPresent: app.deployment !== undefined,
    automaticCreditEnabled,
    server: {
      listenPort: integerValue(server.listenPort, `${configRef}.runtime.serverTargets.${runtimeTarget}.listenPort`),
      databasePath: absolutePathValue(server.databasePath, `${configRef}.runtime.serverTargets.${runtimeTarget}.databasePath`),
      envKeys: ["adminTokenEnv", "sub2apiAdminEmailEnv", "sub2apiAdminPasswordEnv"].map((key) => envKeyValue(server[key], `${configRef}.runtime.serverTargets.${runtimeTarget}.${key}`)),
    },
  };
}

function parseImage(record: Record<string, unknown>): Sub2RankConfig["image"] {
  const repository = y.stringField(record, "repository", "image");
  const pullPolicy = y.enumField(record, "pullPolicy", "image", ["Always", "IfNotPresent", "Never"] as const);
  if (!/^[A-Za-z0-9._:/-]+$/u.test(repository) || repository.endsWith("/")) throw new Error(`${sub2RankConfigLabel}.image.repository has an unsupported format`);
  return { repository, pullPolicy };
}

function parseDelivery(record: Record<string, unknown>): Sub2RankConfig["delivery"] {
  const pipeline = y.objectField(record, "pipeline", "delivery");
  const build = y.objectField(record, "build", "delivery");
  const proxy = y.objectField(build, "proxy", "delivery.build");
  const gitops = y.objectField(record, "gitops", "delivery");
  const author = y.objectField(gitops, "author", "delivery.gitops");
  const application = y.objectField(gitops, "application", "delivery.gitops");
  const timeout = y.stringField(pipeline, "timeout", "delivery.pipeline");
  if (!/^[1-9][0-9]*s$/u.test(timeout)) throw new Error(`${sub2RankConfigLabel}.delivery.pipeline.timeout must be positive seconds`);
  const sourceSnapshotPrefix = y.stringField(pipeline, "sourceSnapshotPrefix", "delivery.pipeline");
  if (!/^refs\/[A-Za-z0-9._/-]+$/u.test(sourceSnapshotPrefix) || sourceSnapshotPrefix.includes("..")) throw new Error(`${sub2RankConfigLabel}.delivery.pipeline.sourceSnapshotPrefix must be a safe refs/ prefix`);
  const email = y.stringField(author, "email", "delivery.gitops.author");
  if (!/^[^@\s]+@[^@\s]+$/u.test(email)) throw new Error(`${sub2RankConfigLabel}.delivery.gitops.author.email must be an email address`);
  const automated = y.booleanField(application, "automated", "delivery.gitops.application");
  return {
    enabled: y.booleanField(record, "enabled", "delivery"),
    pipeline: {
      namespace: y.kubernetesNameField(pipeline, "namespace", "delivery.pipeline"),
      name: y.kubernetesNameField(pipeline, "name", "delivery.pipeline"),
      runPrefix: y.kubernetesNameField(pipeline, "runPrefix", "delivery.pipeline"),
      serviceAccountName: y.kubernetesNameField(pipeline, "serviceAccountName", "delivery.pipeline"),
      timeout,
      workspaceSize: storageSize(y.stringField(pipeline, "workspaceSize", "delivery.pipeline")),
      toolsImage: imageValue(y.stringField(pipeline, "toolsImage", "delivery.pipeline"), "delivery.pipeline.toolsImage"),
      buildkitImage: imageValue(y.stringField(pipeline, "buildkitImage", "delivery.pipeline"), "delivery.pipeline.buildkitImage"),
      sourceSnapshotPrefix,
    },
    build: {
      networkMode: y.enumField(build, "networkMode", "delivery.build", ["host"] as const),
      proxy: {
        http: httpUrlValue(y.stringField(proxy, "http", "delivery.build.proxy"), "delivery.build.proxy.http"),
        https: httpUrlValue(y.stringField(proxy, "https", "delivery.build.proxy"), "delivery.build.proxy.https"),
        all: httpUrlValue(y.stringField(proxy, "all", "delivery.build.proxy"), "delivery.build.proxy.all"),
        noProxy: y.stringArrayField(proxy, "noProxy", "delivery.build.proxy"),
      },
    },
    gitops: {
      readUrl: httpUrlValue(y.stringField(gitops, "readUrl", "delivery.gitops"), "delivery.gitops.readUrl"),
      writeUrl: httpUrlValue(y.stringField(gitops, "writeUrl", "delivery.gitops"), "delivery.gitops.writeUrl"),
      branch: simpleId(y.stringField(gitops, "branch", "delivery.gitops"), "delivery.gitops.branch"),
      manifestPath: safeRelativePath(y.stringField(gitops, "manifestPath", "delivery.gitops"), "delivery.gitops.manifestPath"),
      releaseStatePath: safeRelativePath(y.stringField(gitops, "releaseStatePath", "delivery.gitops"), "delivery.gitops.releaseStatePath"),
      maxPushAttempts: positiveInteger(gitops, "maxPushAttempts", "delivery.gitops"),
      author: { name: y.stringField(author, "name", "delivery.gitops.author"), email },
      application: {
        name: y.kubernetesNameField(application, "name", "delivery.gitops.application"),
        namespace: y.kubernetesNameField(application, "namespace", "delivery.gitops.application"),
        project: y.kubernetesNameField(application, "project", "delivery.gitops.application"),
        path: safeRelativePath(y.stringField(application, "path", "delivery.gitops.application"), "delivery.gitops.application.path"),
        destinationNamespace: y.kubernetesNameField(application, "destinationNamespace", "delivery.gitops.application"),
        automated,
      },
    },
  };
}

function parseRuntime(record: Record<string, unknown>): Omit<Sub2RankConfig["runtime"], "secret"> & {
  secret: { configRef: string; declarationId: string; requiredTargetKeys: string[]; appEnvTargetKeys: string[] };
} {
  const service = y.objectField(record, "service", "runtime");
  const sharedNetworkPolicyRef = y.objectField(record, "sharedNetworkPolicyRef", "runtime");
  const configMap = y.objectField(record, "configMap", "runtime");
  const storage = y.objectField(record, "storage", "runtime");
  const secret = y.objectField(record, "secret", "runtime");
  const probes = y.objectField(record, "probes", "runtime");
  const rollout = y.objectField(record, "rollout", "runtime");
  const configRefValue = y.stringField(secret, "configRef", "runtime.secret");
  return {
    sharedNetworkPolicyRef: {
      name: y.kubernetesNameField(sharedNetworkPolicyRef, "name", "runtime.sharedNetworkPolicyRef"),
      managedBySub2Rank: disabledField(sharedNetworkPolicyRef, "managedBySub2Rank", "runtime.sharedNetworkPolicyRef"),
    },
    service: { name: y.kubernetesNameField(service, "name", "runtime.service"), port: y.portField(service, "port", "runtime.service") },
    configMap: {
      name: y.kubernetesNameField(configMap, "name", "runtime.configMap"),
      key: y.stringField(configMap, "key", "runtime.configMap"),
      mountPath: y.absolutePathField(configMap, "mountPath", "runtime.configMap"),
    },
    command: y.stringArrayField(record, "command", "runtime"),
    storage: {
      claimName: y.kubernetesNameField(storage, "claimName", "runtime.storage"),
      size: storageSize(y.stringField(storage, "size", "runtime.storage")),
      mountPath: y.absolutePathField(storage, "mountPath", "runtime.storage"),
    },
    secret: {
      configRef: configRefValue,
      declarationId: simpleId(y.stringField(secret, "declarationId", "runtime.secret"), "runtime.secret.declarationId"),
      requiredTargetKeys: y.stringArrayField(secret, "requiredTargetKeys", "runtime.secret").map((key) => envKeyValue(key, "runtime.secret.requiredTargetKeys")),
      appEnvTargetKeys: y.stringArrayField(secret, "appEnvTargetKeys", "runtime.secret").map((key) => envKeyValue(key, "runtime.secret.appEnvTargetKeys")),
    },
    probes: {
      healthPath: y.apiPathField(probes, "healthPath", "runtime.probes"),
      initialDelaySeconds: positiveInteger(probes, "initialDelaySeconds", "runtime.probes"),
      periodSeconds: positiveInteger(probes, "periodSeconds", "runtime.probes"),
      timeoutSeconds: positiveInteger(probes, "timeoutSeconds", "runtime.probes"),
      failureThreshold: positiveInteger(probes, "failureThreshold", "runtime.probes"),
    },
    rollout: {
      fieldManager: simpleId(y.stringField(rollout, "fieldManager", "runtime.rollout"), "runtime.rollout.fieldManager"),
      waitTimeoutSeconds: positiveInteger(rollout, "waitTimeoutSeconds", "runtime.rollout"),
    },
  };
}

function parseTargets(value: unknown, secret: ResolvedSecretDeclaration): Sub2RankTarget[] {
  const records = y.arrayOfRecords(value, "targets");
  const ids = new Set<string>();
  return records.map((record, index) => {
    const path = `targets[${index}]`;
    const parsed = parseTarget(record, path);
    if (ids.has(parsed.id)) throw new Error(`${sub2RankConfigLabel}.targets contains duplicate id ${parsed.id}`);
    ids.add(parsed.id);
    const mapping = secret.mappings.find((item) => item.targetKey === parsed.exposure.frpc.tokenTargetKey);
    if (mapping === undefined) throw new Error(`${sub2RankConfigLabel}.${path}.publicExposure.frpc.tokenTargetKey is not provided by runtime.secret.declarationId`);
    return {
      id: parsed.id,
      route: parsed.route,
      namespace: parsed.namespace,
      enabled: parsed.enabled,
      replicas: parsed.replicas,
      publicExposure: {
        ...parsed.exposure,
        frpc: {
          ...parsed.exposure.frpc,
          secretName: secret.secretName,
          secretKey: mapping.targetKey,
          tokenSourceRef: mapping.sourceRef,
          tokenSourceKey: mapping.sourceKey,
        },
      },
    };
  });
}

function parseTarget(record: Record<string, unknown>, path: string): ParsedTarget {
  const exposure = y.objectField(record, "publicExposure", path);
  const dns = y.objectField(exposure, "dns", `${path}.publicExposure`);
  const frpc = y.objectField(exposure, "frpc", `${path}.publicExposure`);
  const pk01 = y.objectField(exposure, "pk01", `${path}.publicExposure`);
  return {
    id: simpleId(y.stringField(record, "id", path), `${path}.id`),
    route: routeValue(y.stringField(record, "route", path), `${path}.route`),
    namespace: y.kubernetesNameField(record, "namespace", path),
    enabled: y.booleanField(record, "enabled", path),
    replicas: positiveInteger(record, "replicas", path),
    exposure: {
      enabled: y.booleanField(exposure, "enabled", `${path}.publicExposure`),
      publicBaseUrl: y.httpsUrlField(exposure, "publicBaseUrl", `${path}.publicExposure`),
      dns: {
        hostname: y.hostField(dns, "hostname", `${path}.publicExposure.dns`),
        expectedA: y.hostField(dns, "expectedA", `${path}.publicExposure.dns`),
        resolvers: y.stringArrayField(dns, "resolvers", `${path}.publicExposure.dns`),
      },
      frpc: {
        deploymentName: y.kubernetesNameField(frpc, "deploymentName", `${path}.publicExposure.frpc`),
        configMapName: y.kubernetesNameField(frpc, "configMapName", `${path}.publicExposure.frpc`),
        configKey: y.stringField(frpc, "configKey", `${path}.publicExposure.frpc`),
        image: imageValue(y.stringField(frpc, "image", `${path}.publicExposure.frpc`), `${path}.publicExposure.frpc.image`),
        serverAddr: y.hostField(frpc, "serverAddr", `${path}.publicExposure.frpc`),
        serverPort: y.portField(frpc, "serverPort", `${path}.publicExposure.frpc`),
        proxyName: simpleId(y.stringField(frpc, "proxyName", `${path}.publicExposure.frpc`), `${path}.publicExposure.frpc.proxyName`),
        remotePort: y.portField(frpc, "remotePort", `${path}.publicExposure.frpc`),
        localIP: y.hostField(frpc, "localIP", `${path}.publicExposure.frpc`),
        localPort: y.portField(frpc, "localPort", `${path}.publicExposure.frpc`),
        tokenEnvName: y.envKeyField(frpc, "tokenEnvName", `${path}.publicExposure.frpc`),
        tokenTargetKey: y.envKeyField(frpc, "tokenTargetKey", `${path}.publicExposure.frpc`),
      },
      pk01: {
        route: routeValue(y.stringField(pk01, "route", `${path}.publicExposure.pk01`), `${path}.publicExposure.pk01.route`),
        caddyConfigPath: y.absolutePathField(pk01, "caddyConfigPath", `${path}.publicExposure.pk01`),
        caddyServiceName: simpleId(y.stringField(pk01, "caddyServiceName", `${path}.publicExposure.pk01`), `${path}.publicExposure.pk01.caddyServiceName`),
        responseHeaderTimeoutSeconds: positiveInteger(pk01, "responseHeaderTimeoutSeconds", `${path}.publicExposure.pk01`),
      },
    },
  };
}

function resolveSecretDeclaration(configRef: string, declarationId: string): ResolvedSecretDeclaration {
  const path = resolveRepoPath(configRef);
  const root = readYamlRecord<Record<string, unknown>>(path, "unidesk-secret-distribution");
  const declarations = Array.isArray(root.kubernetesSecrets) ? root.kubernetesSecrets : [];
  const declaration = declarations.find((item) => typeof item === "object" && item !== null && !Array.isArray(item) && (item as Record<string, unknown>).name === declarationId);
  if (typeof declaration !== "object" || declaration === null || Array.isArray(declaration)) throw new Error(`${configRef} does not contain kubernetesSecrets name=${declarationId}`);
  const item = declaration as Record<string, unknown>;
  const targetId = stringValue(item.targetId, `${configRef}.kubernetesSecrets[name=${declarationId}].targetId`);
  const secretName = kubernetesNameValue(item.secretName, `${configRef}.kubernetesSecrets[name=${declarationId}].secretName`);
  const targets = Array.isArray(root.targets) ? root.targets : [];
  const target = targets.find((value) => typeof value === "object" && value !== null && !Array.isArray(value) && (value as Record<string, unknown>).id === targetId);
  if (typeof target !== "object" || target === null || Array.isArray(target)) throw new Error(`${configRef} does not contain targets id=${targetId}`);
  const targetRecord = target as Record<string, unknown>;
  const data = Array.isArray(item.data) ? item.data : [];
  const mappings = data.map((value, index) => {
    if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${configRef}.kubernetesSecrets[name=${declarationId}].data[${index}] must be an object`);
    const mapping = value as Record<string, unknown>;
    return {
      sourceRef: sourceRefValue(mapping.sourceRef, `${configRef}.kubernetesSecrets[name=${declarationId}].data[${index}].sourceRef`),
      sourceKey: envKeyValue(mapping.sourceKey, `${configRef}.kubernetesSecrets[name=${declarationId}].data[${index}].sourceKey`),
      targetKey: envKeyValue(mapping.targetKey, `${configRef}.kubernetesSecrets[name=${declarationId}].data[${index}].targetKey`),
    };
  });
  return {
    targetId,
    route: routeValue(stringValue(targetRecord.route, `${configRef}.targets[id=${targetId}].route`), `${configRef}.targets[id=${targetId}].route`),
    namespace: kubernetesNameValue(targetRecord.namespace, `${configRef}.targets[id=${targetId}].namespace`),
    secretName,
    mappings,
  };
}

function validateResolvedConfig(
  application: Sub2RankConfig["application"],
  image: Sub2RankConfig["image"],
  delivery: Sub2RankConfig["delivery"],
  runtime: ReturnType<typeof parseRuntime>,
  secret: ResolvedSecretDeclaration,
  targets: Sub2RankTarget[],
): string[] {
  const warnings: string[] = [];
  if (!application.sourceConfigPathMatches) warnings.push("application.sourceConfigPath 与 application.configRef 的相对路径不一致");
  if (!application.configMatchesSourceCommit) warnings.push(`application.configRef 与源码提交 ${application.sourceCommit} 中的文件不一致`);
  if (!application.sourceRemoteMatches) warnings.push("application.remote 与 application.sourceRoot 的 origin 不一致");
  if (!sameRepositoryIdentity(application.remote, `https://github.com/${application.repository}.git`)) warnings.push("application.repository 与 application.remote 指向的仓库不一致");
  if (!delivery.enabled) warnings.push("delivery.enabled=false，自动交付当前关闭");
  if (delivery.gitops.maxPushAttempts > 5) warnings.push("delivery.gitops.maxPushAttempts 大于 5，失败时可能延长流水线耗时");
  if (dirname(delivery.gitops.manifestPath).replaceAll("\\", "/") !== delivery.gitops.application.path) warnings.push("delivery.gitops.manifestPath 不在 application.path 的直接子路径下");
  if (!delivery.build.proxy.noProxy.includes("hyueapi.com") || !delivery.build.proxy.noProxy.includes(".hyueapi.com")) throw new Error(`${sub2RankConfigLabel}.delivery.build.proxy.noProxy must retain hyueapi.com and .hyueapi.com`);
  if (!image.repository.startsWith("127.0.0.1:5000/")) warnings.push("image.repository 未使用 NC01 本地 registry");
  const required = new Set(runtime.secret.requiredTargetKeys);
  const provided = new Set(secret.mappings.map((item) => item.targetKey));
  const missing = [...required].filter((key) => !provided.has(key));
  if (missing.length > 0) throw new Error(`${sub2RankConfigLabel}.runtime.secret.requiredTargetKeys missing from ${runtime.secret.configRef} declaration ${runtime.secret.declarationId}: ${missing.join(", ")}`);
  if (!sameStringSet(application.server.envKeys, runtime.secret.appEnvTargetKeys)) warnings.push("runtime.secret.appEnvTargetKeys 与应用声明的环境变量集合不一致");
  if (application.server.listenPort !== runtime.service.port) warnings.push("runtime.service.port 与应用 listenPort 不一致");
  if (!application.server.databasePath.startsWith(`${runtime.storage.mountPath.replace(/\/+$/u, "")}/`)) warnings.push("应用 databasePath 不在 runtime.storage.mountPath 下");
  if (!delivery.gitops.application.automated) warnings.push("delivery.gitops.application.automated=false，Argo 自动同步当前关闭");
  if (application.deploymentBlockPresent) warnings.push("应用配置仍包含 deployment 段；部署事实应以 platform-infra YAML 为准");
  for (const target of targets) {
    if (target.route !== secret.route || target.namespace !== secret.namespace) warnings.push(`targets[${target.id}] 的 route/namespace 与 Secret 目标 ${secret.targetId} 不一致`);
    if (target.publicExposure.frpc.localPort !== runtime.service.port) warnings.push(`targets[${target.id}].publicExposure.frpc.localPort 与 runtime.service.port 不一致`);
    if (target.namespace !== delivery.gitops.application.destinationNamespace) warnings.push(`targets[${target.id}].namespace 与 Argo destinationNamespace 不一致`);
  }
  return warnings;
}

function positiveInteger(record: Record<string, unknown>, key: string, path: string): number {
  const value = y.integerField(record, key, path);
  if (value <= 0) throw new Error(`${sub2RankConfigLabel}.${path}.${key} must be > 0`);
  return value;
}

function disabledField(record: Record<string, unknown>, key: string, path: string): false {
  const value = y.booleanField(record, key, path);
  if (value) throw new Error(`${sub2RankConfigLabel}.${path}.${key} must remain false because the resource is shared and owned outside Sub2Rank`);
  return false;
}

function storageSize(value: string): string {
  if (!/^[1-9][0-9]*(?:Mi|Gi|Ti)$/u.test(value)) throw new Error(`${sub2RankConfigLabel}.runtime.storage.size must use Mi, Gi, or Ti`);
  return value;
}

function simpleId(value: string, path: string): string {
  if (!/^[A-Za-z0-9._-]+$/u.test(value)) throw new Error(`${sub2RankConfigLabel}.${path} must be a simple id`);
  return value;
}

function routeValue(value: string, path: string): string {
  if (!/^[A-Za-z0-9:_./-]+$/u.test(value)) throw new Error(`${path} has an unsupported route format`);
  return value;
}

function imageValue(value: string, path: string): string {
  if (!/^[A-Za-z0-9._:/-]+:[A-Za-z0-9._-]+$/u.test(value)) throw new Error(`${sub2RankConfigLabel}.${path} must be an image reference with tag`);
  return value;
}

function integerValue(value: unknown, path: string): number {
  if (!Number.isInteger(value)) throw new Error(`${path} must be an integer`);
  return Number(value);
}

function absolutePathValue(value: unknown, path: string): string {
  const text = stringValue(value, path);
  if (!text.startsWith("/") || text.includes("..")) throw new Error(`${path} must be an absolute path without ..`);
  return text;
}

function envKeyValue(value: unknown, path: string): string {
  const text = stringValue(value, path);
  if (!/^[A-Z_][A-Z0-9_]*$/u.test(text)) throw new Error(`${path} must be an environment key`);
  return text;
}

function sourceRefValue(value: unknown, path: string): string {
  const text = stringValue(value, path);
  if (text.startsWith("/") || text.includes("..") || !/^[A-Za-z0-9._/-]+$/u.test(text)) throw new Error(`${path} must be a relative sourceRef`);
  return text;
}

function safeRelativePath(value: string, path: string): string {
  if (value.startsWith("/") || value.split(/[\\/]/u).includes("..") || !/^[A-Za-z0-9._/-]+$/u.test(value)) throw new Error(`${sub2RankConfigLabel}.${path} must be a safe relative path`);
  return value;
}

function repositoryValue(value: string, path: string): string {
  if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u.test(value)) throw new Error(`${sub2RankConfigLabel}.${path} must be owner/repository`);
  return value;
}

function httpUrlValue(value: string, path: string): string {
  let parsed: URL;
  try {
    parsed = new URL(value);
  } catch {
    throw new Error(`${sub2RankConfigLabel}.${path} must be an HTTP URL`);
  }
  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`${sub2RankConfigLabel}.${path} must be an HTTP URL`);
  if (parsed.username.length > 0 || parsed.password.length > 0 || parsed.hash.length > 0) throw new Error(`${sub2RankConfigLabel}.${path} must not contain credentials or a fragment`);
  return value;
}

function sameRepositoryIdentity(left: string, right: string): boolean {
  const identity = (value: string): string | null => {
    const scp = /^[^/@\s]+@([^:\s]+):(.+)$/u.exec(value.trim());
    let host = scp?.[1] ?? "";
    let path = scp?.[2] ?? "";
    if (host.length === 0 || path.length === 0) {
      try {
        const parsed = new URL(value.trim());
        host = parsed.hostname;
        path = parsed.pathname;
      } catch {
        return null;
      }
    }
    const parts = path.replace(/^\/+|\/+$/gu, "").split("/");
    if (parts.length !== 2) return null;
    return `${host.toLowerCase()}/${parts[0]?.toLowerCase()}/${parts[1]?.replace(/\.git$/iu, "").toLowerCase()}`;
  };
  const leftIdentity = identity(left);
  return leftIdentity !== null && leftIdentity === identity(right);
}

function kubernetesNameValue(value: unknown, path: string): string {
  const text = stringValue(value, path);
  if (!/^[a-z0-9](?:[-a-z0-9.]*[a-z0-9])?$/u.test(text)) throw new Error(`${path} must be a Kubernetes name`);
  return text;
}

function stringValue(value: unknown, path: string): string {
  if (typeof value !== "string" || value.length === 0) throw new Error(`${path} must be a non-empty string`);
  return value;
}

function sameStringSet(left: string[], right: string[]): boolean {
  return left.length === right.length && [...left].sort().every((value, index) => value === [...right].sort()[index]);
}

function gitText(
  cwd: string,
  args: string[],
  label: string,
  allowEmpty = false,
  trim = true,
): string {
  const result = Bun.spawnSync(["git", ...args], { cwd, stdout: "pipe", stderr: "pipe" });
  if (result.exitCode !== 0) {
    const stderr = new TextDecoder().decode(result.stderr).replace(/\s+/gu, " ").trim().slice(0, 500);
    throw new Error(`${label} failed (exit ${result.exitCode}): ${stderr}`);
  }
  const output = new TextDecoder().decode(result.stdout);
  const value = trim ? output.trim() : output.trimEnd();
  if (!allowEmpty && value.length === 0) throw new Error(`${label} returned no output`);
  return value;
}