// SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. scripts module for scripts/src/deploy.ts.

// Moved mechanically from scripts/src/deploy.ts:1519-2218 for #903.

import { createHash } from "node:crypto";
import { existsSync, mkdirSync, readFileSync } from "node:fs";
import { join, resolve } from "node:path";
import { pathToFileURL } from "node:url";
import { runCommand } from "../command";
import { type UniDeskConfig, type UniDeskMicroserviceConfig, repoRoot, rootPath } from "../config";
import { ensureGithubSshIdentityForProvider } from "../deploy-ssh-identity";
import { baiduNetdiskRuntimeSecretRequirements, runtimeSecretContractFromEnvText, type RuntimeSecretContract, runArtifactRegistryCommand } from "../artifact-registry";
import { startJob } from "../jobs";
import { coreInternalFetch } from "../microservices";
import { codeQueueSourceImportPreflight, codeQueueSourceSubdir } from "../code-queue-source-guard";
import { k3sGuardShellLines, defaultNativeKubeconfig } from "../k3s-target-guard";
import { composeRuntimeEnvValue } from "../runtime-env";
import {
  compareDeployJsonExecutorMirrors,
  deployJsonCommitImage,
  deployJsonDriftResult,
  deployJsonSourceOfTruth,
  encodeDeployJsonServiceContract,
  hasDeployJsonExecutorContract,
  k3sManifestExecutorMirror,
  parseDeployJsonServiceContract,
  type DeployJsonExecutorMirror,
  type DeployJsonServiceContract,
} from "../deploy-json-contract";

import type { DeployManifestService } from "./types";
import { k3sTargetGuardScript, isUnideskRepo, providerSourceRepoUrl, safeId, shellQuote } from "./options";
import { buildBaseImageFallbacks, buildCachePrelude, buildImageTag, devK3sPrepullImages, directBuildContextOverride, directComposeEnvFile, directComposeFile, directDockerfileOverride, k8sManifestPath, sourceBuildContext, sourceDockerfilePath, sourceFallbackWorktree, sourceProxyPrelude, sourceWorkDir, targetIsMain, targetRepoDir, targetWorkDir } from "./paths";
import { isDevK3sDeployService, isDirectComposeDeployMode } from "./service-plan";
import { k8sKubeconfig, nativeK3sCtrAddress, nativeK3sImage, nativeK3sInstallVersion, providerGatewayWsEgressProxyUrl } from "./types";

export function syncDevFrontendAuthScript(config: UniDeskConfig): string {
  const sshClientToken = composeRuntimeEnvValue("UNIDESK_SSH_CLIENT_TOKEN");
  if (sshClientToken === null) throw new Error(`UNIDESK_SSH_CLIENT_TOKEN must be present in ${rootPath(".state", "docker-compose.env")} before deploying dev frontend`);
  const sshClientRouteAllowlist = composeRuntimeEnvValue("UNIDESK_SSH_CLIENT_ROUTE_ALLOWLIST") ?? "G14,G14:*,D601,D601:*";
  const data = {
    AUTH_USERNAME: Buffer.from(config.auth.username, "utf8").toString("base64"),
    AUTH_PASSWORD: Buffer.from(config.auth.password, "utf8").toString("base64"),
    SESSION_SECRET: Buffer.from(config.auth.sessionSecret, "utf8").toString("base64"),
    UNIDESK_SSH_CLIENT_TOKEN: Buffer.from(sshClientToken, "utf8").toString("base64"),
  };
  const runtimeConfig = {
    SESSION_TTL_SECONDS: String(config.auth.sessionTtlSeconds),
    UNIDESK_SSH_CLIENT_ROUTE_ALLOWLIST: sshClientRouteAllowlist,
  };
  return [
    "set -euo pipefail",
    k3sTargetGuardScript(),
    `secret_patch=${shellQuote(JSON.stringify({ data }))}`,
    `config_patch=${shellQuote(JSON.stringify({ data: runtimeConfig }))}`,
    `kubectl -n unidesk-dev patch secret unidesk-dev-runtime-secrets --type merge -p "$secret_patch"`,
    `kubectl -n unidesk-dev patch configmap unidesk-dev-runtime-config --type merge -p "$config_patch"`,
    "echo dev_frontend_auth_synced=ok",
  ].join("\n");
}

export function prepareSourceScript(service: UniDeskMicroserviceConfig, desired: DeployManifestService, exportDir: string): string {
  if (targetIsMain(service) && isUnideskRepo(desired.repo)) {
    return [
      "set -euo pipefail",
      `repo=${shellQuote(repoRoot)}`,
      `commit=${shellQuote(desired.commitId)}`,
      `export_dir=${shellQuote(exportDir)}`,
      "mkdir -p \"$(dirname \"$export_dir\")\"",
      "git -C \"$repo\" fetch --no-tags origin \"$commit\" || git -C \"$repo\" fetch --no-tags --prune origin '+refs/heads/*:refs/remotes/origin/*' '+refs/tags/*:refs/tags/*'",
      "resolved=$(git -C \"$repo\" rev-parse --verify \"$commit^{commit}\")",
      "rm -rf \"$export_dir\"",
      "mkdir -p \"$export_dir\"",
      "git -C \"$repo\" archive --format=tar \"$resolved\" | tar -xf - -C \"$export_dir\"",
      "printf 'resolved_commit=%s\\nexport_dir=%s\\nsource_repo=%s\\n' \"$resolved\" \"$export_dir\" \"$repo\"",
    ].join("\n");
  }
  const fallbackWorktree = sourceFallbackWorktree(service);
  return [
    "set -euo pipefail",
    sourceProxyPrelude(service),
    `repo=${shellQuote(targetRepoDir(service))}`,
    `repo_url=${shellQuote(providerSourceRepoUrl(desired.repo))}`,
    `commit=${shellQuote(desired.commitId)}`,
    `export_dir=${shellQuote(exportDir)}`,
    `fallback_worktree=${shellQuote(fallbackWorktree)}`,
    "mkdir -p \"$(dirname \"$repo\")\" \"$(dirname \"$export_dir\")\"",
    "source_repo=\"\"",
    "source_mode=\"remote-fetch\"",
    "source_log=$(mktemp /tmp/unidesk-deploy-source.XXXXXX.log)",
    "if { [ -d \"$repo/.git\" ] || { rm -rf \"$repo\" && git clone --no-checkout \"$repo_url\" \"$repo\"; }; } >\"$source_log\" 2>&1; then",
    "  cd \"$repo\"",
    "  if { git remote set-url origin \"$repo_url\" && { git fetch --no-tags origin \"$commit\" || git fetch --no-tags --prune origin '+refs/heads/*:refs/remotes/origin/*' '+refs/tags/*:refs/tags/*'; } && git rev-parse --verify \"$commit^{commit}\" > /tmp/unidesk-deploy-resolved-commit; } >>\"$source_log\" 2>&1; then",
    "    resolved=$(cat /tmp/unidesk-deploy-resolved-commit)",
    "    source_repo=\"$repo\"",
    "  fi",
    "fi",
    "if [ -z \"$source_repo\" ]; then",
    "  echo target_source_remote_prepare=failed",
    "  tail -80 \"$source_log\" || true",
    "  if [ -n \"$fallback_worktree\" ] && git -C \"$fallback_worktree\" rev-parse --is-inside-work-tree >/dev/null 2>&1 && git -C \"$fallback_worktree\" rev-parse --verify \"$commit^{commit}\" > /tmp/unidesk-deploy-resolved-commit 2>/dev/null; then",
    "    resolved=$(cat /tmp/unidesk-deploy-resolved-commit)",
    "    source_repo=$(git -C \"$fallback_worktree\" rev-parse --show-toplevel)",
    "    source_mode=\"provider-worktree\"",
    "    printf 'target_source_fallback_worktree=%s\\n' \"$fallback_worktree\"",
    "  else",
    "    cat \"$source_log\" >&2 || true",
    "    exit 128",
    "  fi",
    "fi",
    "rm -rf \"$export_dir\"",
    "mkdir -p \"$export_dir\"",
    "git -C \"$source_repo\" archive --format=tar \"$resolved\" | tar -xf - -C \"$export_dir\"",
    "rm -f \"$source_log\" /tmp/unidesk-deploy-resolved-commit",
    "printf 'resolved_commit=%s\\nexport_dir=%s\\nsource_repo=%s\\nsource_mode=%s\\n' \"$resolved\" \"$export_dir\" \"$source_repo\" \"$source_mode\"",
  ].filter((line) => line.length > 0).join("\n");
}

export function syncSourceScript(service: UniDeskMicroserviceConfig, exportDir: string): string {
  const workDir = sourceWorkDir(service);
  const buildContext = sourceBuildContext(service);
  const dockerfilePath = sourceDockerfilePath(service);
  const overlayCommands = service.id === "claudeqq" ? claudeqqDeployAssetOverlayCommands() : [];
  return [
    "set -euo pipefail",
    `export_dir=${shellQuote(exportDir)}`,
    `work_dir=${shellQuote(workDir)}`,
    `build_context=${shellQuote(buildContext)}`,
    `dockerfile_path=${shellQuote(dockerfilePath)}`,
    "mkdir -p \"$work_dir\"",
    [
      "rsync -a --delete",
      "--exclude '.git/'",
      "--exclude '.state/'",
      "--exclude 'logs/'",
      "--exclude '**/node_modules/'",
      "--exclude '**/dist/'",
      "\"$export_dir/\"",
      "\"$work_dir/\"",
    ].join(" "),
    ...overlayCommands,
    "test -f \"$build_context/$dockerfile_path\"",
    "printf 'synced deploy worktree to %s\\nbuild_context=%s\\n' \"$work_dir\" \"$build_context\"",
  ].join("\n");
}

export function codeQueueSourcePreflightScript(service: UniDeskMicroserviceConfig): string {
  if (service.id !== "code-queue") return "";
  const workDir = sourceWorkDir(service);
  return [
    "set -euo pipefail",
    `guard_root=${shellQuote(workDir)}`,
    "if [ -f \"$guard_root/scripts/code-queue-source-guard.ts\" ] && command -v bun >/dev/null 2>&1; then",
    "  bun \"$guard_root/scripts/code-queue-source-guard.ts\" --root \"$guard_root\"",
    "else",
    "  python3 - \"$guard_root\" <<'PY'",
    "import json",
    "import os",
    "import re",
    "import sys",
    "",
    `SOURCE_SUBDIR = ${JSON.stringify(codeQueueSourceSubdir)}`,
    "EXTENSIONS = ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs', '.json']",
    "",
    "def rel(root, path):",
    "    return os.path.relpath(path, root).replace(os.sep, '/')",
    "",
    "def strip_comments(text):",
    "    text = re.sub(r'/\\*[\\s\\S]*?\\*/', '', text)",
    "    return re.sub(r'(^|[^:])//.*$', r'\\1', text, flags=re.MULTILINE)",
    "",
    "def specifiers(text):",
    "    clean = strip_comments(text)",
    "    values = set()",
    "    patterns = [",
    "        re.compile(r'\\b(?:import|export)\\s+(?:type\\s+)?(?:[\\s\\S]*?\\s+from\\s+)?[\"\\'](\\.{1,2}/[^\"\\']+)[\"\\']'),",
    "        re.compile(r'\\bimport\\s*\\(\\s*[\"\\'](\\.{1,2}/[^\"\\']+)[\"\\']\\s*\\)'),",
    "    ]",
    "    for pattern in patterns:",
    "        values.update(match.group(1) for match in pattern.finditer(clean))",
    "    return sorted(values)",
    "",
    "def candidates(importer, specifier):",
    "    base = os.path.abspath(os.path.join(os.path.dirname(importer), specifier))",
    "    if any(base.endswith(extension) for extension in EXTENSIONS):",
    "        return [base]",
    "    return [base + extension for extension in EXTENSIONS] + [os.path.join(base, 'index' + extension) for extension in EXTENSIONS]",
    "",
    "root = os.path.abspath(sys.argv[1])",
    "source_root = os.path.join(root, SOURCE_SUBDIR)",
    "if not os.path.isdir(source_root):",
    "    print(json.dumps({'ok': False, 'guard': 'code-queue-hostpath-source-imports', 'root': root, 'sourceRoot': source_root, 'checkedFiles': 0, 'checkedImports': 0, 'missing': [], 'degradedReason': 'source-root-missing', 'message': 'Code Queue source root is missing: ' + SOURCE_SUBDIR}, ensure_ascii=False))",
    "    raise SystemExit(1)",
    "files = []",
    "for current_root, dirs, names in os.walk(source_root):",
    "    dirs[:] = [name for name in dirs if name not in ('node_modules', 'dist', '.git', '.state')]",
    "    for name in names:",
    "        if name.endswith('.ts') or name.endswith('.tsx'):",
    "            files.append(os.path.join(current_root, name))",
    "files.sort()",
    "missing = []",
    "checked_imports = 0",
    "for path in files:",
    "    with open(path, encoding='utf-8') as handle:",
    "        text = handle.read()",
    "    for specifier in specifiers(text):",
    "        checked_imports += 1",
    "        expected = candidates(path, specifier)",
    "        if any(os.path.isfile(candidate) for candidate in expected):",
    "            continue",
    "        missing.append({'importer': rel(root, path), 'specifier': specifier, 'expected': [rel(root, candidate) for candidate in expected]})",
    "result = {'ok': not missing, 'guard': 'code-queue-hostpath-source-imports', 'root': root, 'sourceRoot': source_root, 'checkedFiles': len(files), 'checkedImports': checked_imports, 'missing': missing, 'degradedReason': 'none' if not missing else 'missing-relative-import-target', 'message': 'Code Queue hostPath source import preflight passed (%d files, %d relative imports).' % (len(files), checked_imports) if not missing else 'Code Queue hostPath source import preflight failed: %d relative import target(s) are missing.' % len(missing)}",
    "print(json.dumps(result, ensure_ascii=False))",
    "raise SystemExit(0 if result['ok'] else 1)",
    "PY",
    "fi",
  ].join("\n");
}

export function claudeqqDeployAssetOverlayCommands(): string[] {
  const assets = [
    {
      relativePath: "$build_context/$dockerfile_path",
      sourcePath: rootPath("src/components/microservices/claudeqq/Dockerfile"),
      label: "Dockerfile",
    },
    {
      relativePath: "$build_context/unidesk-adapter.cjs",
      sourcePath: rootPath("src/components/microservices/claudeqq/adapter.js"),
      label: "unidesk-adapter.cjs",
    },
  ];
  return assets.flatMap((asset) => {
    if (!existsSync(asset.sourcePath)) throw new Error(`claudeqq deploy asset missing: ${asset.sourcePath}`);
    const encoded = Buffer.from(readFileSync(asset.sourcePath, "utf8"), "utf8").toString("base64");
    return [
      `mkdir -p "$(dirname "${asset.relativePath}")"`,
      `printf %s ${shellQuote(encoded)} | base64 -d > "${asset.relativePath}"`,
      `printf 'synced_claudeqq_deploy_asset=%s\\n' ${shellQuote(asset.label)}`,
    ];
  });
}

export function syncK8sControlManifestsScript(service: UniDeskMicroserviceConfig): string {
  if (isDevK3sDeployService(service)) {
    const manifest = k8sManifestPath(service);
    return [
      "set -euo pipefail",
      `target_root=${shellQuote(targetWorkDir(service))}`,
      `relative_path=${shellQuote(manifest)}`,
      "target_file=\"$target_root/$relative_path\"",
      "test -f \"$target_file\"",
      "printf 'target_k3s_control_manifest=%s\\n' \"$target_file\"",
    ].join("\n");
  }
  if (service.deployment.mode !== "k3sctl-managed" || isUnideskRepo(service.repository.url)) return "";
  const manifests = service.repository.composeFile.endsWith(".k8s.yaml")
    ? [service.repository.composeFile]
    : [service.repository.composeFile, k8sManifestPath(service)];
  const commands = [
    "set -euo pipefail",
    `target_root=${shellQuote(targetWorkDir(service))}`,
    "mkdir -p \"$target_root\"",
  ];
  for (const relativePath of manifests) {
    const absolutePath = rootPath(relativePath);
    if (!existsSync(absolutePath)) throw new Error(`${service.id} k3s control manifest missing: ${relativePath}`);
    const encoded = Buffer.from(readFileSync(absolutePath, "utf8"), "utf8").toString("base64");
    commands.push(
      `relative_path=${shellQuote(relativePath)}`,
      `target_file="$target_root/$relative_path"`,
      "mkdir -p \"$(dirname \"$target_file\")\"",
      `printf %s ${shellQuote(encoded)} | base64 -d > "$target_file"`,
      "printf 'synced_k3s_control_manifest=%s\\n' \"$target_file\"",
    );
  }
  return commands.join("\n");
}

export function buildImageScript(service: UniDeskMicroserviceConfig, desired: DeployManifestService, resolvedCommit: string): string {
  const image = buildImageTag(service);
  const buildContext = sourceBuildContext(service);
  const dockerfilePath = sourceDockerfilePath(service);
  const dockerfile = `${buildContext}/${dockerfilePath}`;
  const labelArgs = [
    "--label", `unidesk.ai/service-id=${service.id}`,
    "--label", `unidesk.ai/source-repo=${desired.repo}`,
    "--label", `unidesk.ai/source-commit=${resolvedCommit}`,
    "--label", `unidesk.ai/dockerfile=${dockerfilePath}`,
  ];
  const commonArgs = [
    "--progress=plain",
    ...labelArgs,
    "-t", image,
    "-f", dockerfile,
    buildContext,
  ];
  const proxyBuildArgs = targetIsMain(service)
    ? []
    : [
      "--network", "host",
      "--build-arg", `HTTP_PROXY=${providerGatewayWsEgressProxyUrl}`,
      "--build-arg", `HTTPS_PROXY=${providerGatewayWsEgressProxyUrl}`,
      "--build-arg", `ALL_PROXY=${providerGatewayWsEgressProxyUrl}`,
      "--build-arg", "NO_PROXY=localhost,127.0.0.1,::1,host.docker.internal",
    ];
  return [
    "set -euo pipefail",
    sourceProxyPrelude(service),
    `image=${shellQuote(image)}`,
    `dockerfile=${shellQuote(dockerfile)}`,
    "if ! docker buildx version >/dev/null 2>&1; then",
    "  if ! docker buildx inspect default >/dev/null 2>&1; then echo target_build_builder=missing >&2; exit 1; fi",
    "fi",
    ...devK3sPrepullImages(service).flatMap((imageName) => [
      `if ! docker image inspect ${shellQuote(imageName)} >/dev/null 2>&1; then`,
      `  docker pull ${shellQuote(imageName)}`,
      "fi",
    ]),
    "builder_args=()",
    "if docker buildx inspect --builder default >/dev/null 2>&1; then builder_args=(--builder default); echo target_build_builder=default; else echo target_build_builder=implicit; fi",
    "docker buildx inspect \"${builder_args[@]}\" --bootstrap || true",
    "echo target_build_builder_cleanup=not-required",
    ...buildCachePrelude("$dockerfile", buildBaseImageFallbacks(service)),
    `docker buildx build "\${builder_args[@]}" --load "\${cache_args[@]}" "\${base_args[@]}" ${[...proxyBuildArgs, ...commonArgs].map(shellQuote).join(" ")}`,
    "docker image inspect \"$image\" --format 'image_id={{.Id}} labels={{json .Config.Labels}}'",
  ].filter((line) => line.length > 0).join("\n");
}

export function patchDevK3sManifestScript(service: UniDeskMicroserviceConfig, desired: DeployManifestService, resolvedCommit: string): string {
  const manifest = `${targetWorkDir(service)}/${k8sManifestPath(service)}`;
  const image = buildImageTag(service);
  const serviceId = service.id;
  const deploymentName = service.repository.composeService;
  return [
    "set -euo pipefail",
    `manifest=${shellQuote(manifest)}`,
    `service_id=${shellQuote(serviceId)}`,
    `deployment_name=${shellQuote(deploymentName)}`,
    `image=${shellQuote(image)}`,
    `repo=${shellQuote(desired.repo)}`,
    `commit=${shellQuote(resolvedCommit)}`,
    `requested_commit=${shellQuote(desired.commitId)}`,
    `python3 - "$manifest" "$service_id" "$deployment_name" "$image" "$repo" "$commit" "$requested_commit" <<'PY'`,
    "import re",
    "import sys",
    "path, service_id, deployment_name, image, repo, commit, requested_commit = sys.argv[1:]",
    "text = open(path, encoding='utf-8').read()",
    "segments = re.split(r'(?m)^---\\s*$', text)",
    "kept = []",
    "for segment in segments:",
    "    if not segment.strip():",
    "        continue",
    "    haystack = '\\n' + segment + '\\n'",
    "    if f'unidesk.ai/deploy-service-id: {service_id}' in segment or f'\\n  name: {deployment_name}\\n' in haystack:",
    "        kept.append(segment)",
    "if not kept:",
    "    raise SystemExit(f'dev service {service_id}/{deployment_name} not found in {path}')",
    "patched = []",
    "for segment in kept:",
    "    segment = segment.replace('unidesk.ai/image-source: deploy-env-commit', 'unidesk.ai/image-source: deploy-env-commit')",
    "    segment = re.sub(r'image: unidesk-[^\\n]+:dev-placeholder', f'image: {image}', segment)",
    "    segment = re.sub(r'value: replace-with-deploy-env-commit', f'value: {commit}', segment)",
    "    segment = segment.replace('value: https://github.com/pikasTech/unidesk', f'value: {repo}')",
    "    patched.append(segment.strip() + '\\n')",
    "out = '---\\n'.join(patched)",
    "open(path, 'w', encoding='utf-8').write(out)",
    "print(f'dev_k3s_manifest_patched={path}')",
    "print(f'dev_k3s_manifest_service={service_id}')",
    "print(f'dev_k3s_manifest_deployment={deployment_name}')",
    "print(f'dev_k3s_manifest_image={image}')",
    "print(f'dev_k3s_manifest_commit={commit}')",
    "PY",
  ].join("\n");
}

export function directComposeResolveScript(service: UniDeskMicroserviceConfig): string {
  const projectHint = targetIsMain(service) ? "unidesk" : "";
  return [
    `work_dir=${shellQuote(targetWorkDir(service))}`,
    `compose_file=${shellQuote(directComposeFile(service))}`,
    `compose_env_file=${shellQuote(directComposeEnvFile(service))}`,
    `compose_service=${shellQuote(service.repository.composeService)}`,
    `container=${shellQuote(service.repository.containerName)}`,
    `project_hint=${shellQuote(projectHint)}`,
    `build_context_override=${shellQuote(directBuildContextOverride(service))}`,
    `build_dockerfile_override=${shellQuote(directDockerfileOverride(service))}`,
    "compose_env_args=()",
    "if [ -n \"$compose_env_file\" ]; then compose_env_args=(--env-file \"$compose_env_file\"); fi",
    "running_project=$(docker inspect -f '{{ index .Config.Labels \"com.docker.compose.project\" }}' \"$container\" 2>/dev/null || true)",
    "running_service=$(docker inspect -f '{{ index .Config.Labels \"com.docker.compose.service\" }}' \"$container\" 2>/dev/null || true)",
    "running_image=$(docker inspect -f '{{.Config.Image}}' \"$container\" 2>/dev/null || true)",
    "if [ \"$running_project\" = '<no value>' ]; then running_project=''; fi",
    "if [ \"$running_service\" = '<no value>' ]; then running_service=''; fi",
    "project=\"$running_project\"",
    "if [ -z \"$project\" ]; then project=\"$project_hint\"; fi",
    "if [ -z \"$project\" ]; then project=$(basename \"$work_dir\"); fi",
    "config_json=$(docker compose \"${compose_env_args[@]}\" -f \"$compose_file\" -p \"$project\" config --format json)",
    "compose_image=$(printf '%s' \"$config_json\" | python3 -c 'import json,sys; svc=sys.argv[1]; d=json.load(sys.stdin); print(((d.get(\"services\") or {}).get(svc) or {}).get(\"image\") or \"\")' \"$compose_service\")",
    "image=\"$compose_image\"",
    "if [ -z \"$image\" ]; then image=\"$running_image\"; fi",
    "if [ -z \"$image\" ]; then image=\"${project}-${compose_service}\"; fi",
    "build_context=$(printf '%s' \"$config_json\" | python3 -c 'import json,sys; svc=sys.argv[1]; b=(((json.load(sys.stdin).get(\"services\") or {}).get(svc) or {}).get(\"build\") or {}); print((b if isinstance(b,str) else b.get(\"context\")) or \".\")' \"$compose_service\")",
    "build_dockerfile=$(printf '%s' \"$config_json\" | python3 -c 'import json,sys; svc=sys.argv[1]; b=(((json.load(sys.stdin).get(\"services\") or {}).get(svc) or {}).get(\"build\") or {}); print(\"Dockerfile\" if isinstance(b,str) else (b.get(\"dockerfile\") or \"Dockerfile\"))' \"$compose_service\")",
    "build_target=$(printf '%s' \"$config_json\" | python3 -c 'import json,sys; svc=sys.argv[1]; b=(((json.load(sys.stdin).get(\"services\") or {}).get(svc) or {}).get(\"build\") or {}); print(\"\" if isinstance(b,str) else (b.get(\"target\") or \"\"))' \"$compose_service\")",
    "build_args_file=$(mktemp /tmp/unidesk-compose-build-args.XXXXXX)",
    "printf '%s' \"$config_json\" | python3 -c 'import json,sys; svc=sys.argv[1]; b=(((json.load(sys.stdin).get(\"services\") or {}).get(svc) or {}).get(\"build\") or {}); args={} if isinstance(b,str) else (b.get(\"args\") or {}); items=args.items() if isinstance(args,dict) else [(str(x).split(\"=\",1)[0], str(x).split(\"=\",1)[1] if \"=\" in str(x) else \"\") for x in args]; [print(str(k)+\"=\"+(\"\" if v is None else str(v))) for k,v in items]' \"$compose_service\" > \"$build_args_file\"",
    "if [ -n \"$build_context_override\" ]; then build_context=\"$build_context_override\"; fi",
    "if [ -n \"$build_dockerfile_override\" ]; then build_dockerfile=\"$build_dockerfile_override\"; fi",
    "case \"$build_context\" in /*) ;; *) build_context=$(cd \"$(dirname \"$compose_file\")\" && cd \"$build_context\" && pwd) ;; esac",
    "case \"$build_dockerfile\" in /*) dockerfile_abs=\"$build_dockerfile\" ;; *) dockerfile_abs=\"$build_context/$build_dockerfile\" ;; esac",
    "test -f \"$dockerfile_abs\"",
    "printf 'compose_project=%s\\ncompose_service=%s\\ncompose_image=%s\\nbuild_context=%s\\nbuild_dockerfile=%s\\nbuild_target=%s\\n' \"$project\" \"$compose_service\" \"$image\" \"$build_context\" \"$dockerfile_abs\" \"$build_target\"",
  ].join("\n");
}

export function buildDirectImageScript(service: UniDeskMicroserviceConfig, desired: DeployManifestService, resolvedCommit: string): string {
  const proxyBuildArgs = targetIsMain(service)
    ? []
    : [
      "--network", "host",
      "--build-arg", `HTTP_PROXY=${providerGatewayWsEgressProxyUrl}`,
      "--build-arg", `HTTPS_PROXY=${providerGatewayWsEgressProxyUrl}`,
      "--build-arg", `ALL_PROXY=${providerGatewayWsEgressProxyUrl}`,
      "--build-arg", "NO_PROXY=localhost,127.0.0.1,::1,host.docker.internal",
    ];
  const labelArgs = [
    "--label", `unidesk.ai/service-id=${service.id}`,
    "--label", `unidesk.ai/source-repo=${desired.repo}`,
    "--label", `unidesk.ai/source-commit=${resolvedCommit}`,
    "--label", `unidesk.ai/dockerfile=${service.repository.dockerfile}`,
  ];
  return [
    "set -euo pipefail",
    sourceProxyPrelude(service),
    directComposeResolveScript(service),
    "builder_args=()",
    "if docker buildx inspect --builder default >/dev/null 2>&1; then builder_args=(--builder default); echo target_build_builder=default; else echo target_build_builder=implicit; fi",
    "docker buildx inspect \"${builder_args[@]}\" --bootstrap || true",
    ...buildCachePrelude("$dockerfile_abs", buildBaseImageFallbacks(service)),
    "compose_build_args=()",
    "while IFS= read -r item; do [ -n \"$item\" ] && compose_build_args+=(--build-arg \"$item\"); done < \"$build_args_file\"",
    "target_args=()",
    "if [ -n \"$build_target\" ]; then target_args=(--target \"$build_target\"); fi",
    `docker buildx build "\${builder_args[@]}" --load "\${cache_args[@]}" "\${base_args[@]}" ${[...proxyBuildArgs, ...labelArgs].map(shellQuote).join(" ")} "\${compose_build_args[@]}" "\${target_args[@]}" --progress=plain -t "$image" -f "$dockerfile_abs" "$build_context"`,
    "docker image inspect \"$image\" --format 'image_id={{.Id}} labels={{json .Config.Labels}}'",
  ].filter((line) => line.length > 0).join("\n");
}

export function imageLabelVerifyScript(service: UniDeskMicroserviceConfig, expectedCommit: string): string {
  return [
    "set -euo pipefail",
    `container=${shellQuote(service.repository.containerName)}`,
    `expected=${shellQuote(expectedCommit)}`,
    "cid=$(docker ps -q -f name=\"^/${container}$\" | head -1)",
    "test -n \"$cid\"",
    "image_id=$(docker inspect -f '{{.Image}}' \"$cid\")",
    "actual=$(docker image inspect -f '{{ index .Config.Labels \"unidesk.ai/source-commit\" }}' \"$image_id\")",
    "test \"$actual\" = \"$expected\"",
    "printf 'container=%s image_id=%s deploy_commit=%s\\n' \"$container\" \"$image_id\" \"$actual\"",
  ].join("\n");
}

export function directDeployEnvPrefix(service: UniDeskMicroserviceConfig): string {
  return `UNIDESK_${service.id.replace(/[^A-Za-z0-9]+/gu, "_").replace(/^_+|_+$/gu, "").toUpperCase()}_DEPLOY`;
}

export function directComposeDeployEnv(service: UniDeskMicroserviceConfig, desired: DeployManifestService, resolvedCommit: string): Record<string, string> {
  if (!isDirectComposeDeployMode(service)) return {};
  const prefix = directDeployEnvPrefix(service);
  return {
    [`${prefix}_SERVICE_ID`]: service.id,
    [`${prefix}_REPO`]: desired.repo,
    [`${prefix}_COMMIT`]: resolvedCommit,
    [`${prefix}_REQUESTED_COMMIT`]: desired.commitId,
  };
}

export function composeEnvStampLines(service: UniDeskMicroserviceConfig, desired: DeployManifestService, resolvedCommit: string): string[] {
  const deployEnv = directComposeDeployEnv(service, desired, resolvedCommit);
  const entries = Object.entries(deployEnv);
  if (entries.length === 0) return [];
  const encoded = Buffer.from(JSON.stringify(deployEnv), "utf8").toString("base64");
  return [
    `deploy_env_b64=${shellQuote(encoded)}`,
    "if [ -n \"$compose_env_file\" ]; then",
    "  python3 - \"$compose_env_file\" \"$deploy_env_b64\" <<'PY'",
    "import base64, json, re, sys",
    "path = sys.argv[1]",
    "updates = json.loads(base64.b64decode(sys.argv[2]).decode('utf-8'))",
    "def env_value(value):",
    "    text = str(value)",
    "    return text if re.match(r'^[A-Za-z0-9_./:@-]+$', text) else json.dumps(text)",
    "try:",
    "    lines = open(path, encoding='utf-8').read().splitlines()",
    "except FileNotFoundError:",
    "    lines = []",
    "seen = set()",
    "out = []",
    "for line in lines:",
    "    if '=' not in line or line.startswith('#'):",
    "        out.append(line)",
    "        continue",
    "    key = line.split('=', 1)[0]",
    "    if key in updates:",
    "        out.append(f'{key}={env_value(updates[key])}')",
    "        seen.add(key)",
    "    else:",
    "        out.append(line)",
    "for key, value in updates.items():",
    "    if key not in seen:",
    "        out.append(f'{key}={env_value(value)}')",
    "with open(path, 'w', encoding='utf-8') as handle:",
    "    handle.write('\\n'.join(out) + '\\n')",
    "PY",
    "  echo compose_env_deploy_stamp=updated",
    "fi",
  ];
}

export function composeDeployScript(service: UniDeskMicroserviceConfig, desired: DeployManifestService, resolvedCommit: string): string {
  return [
    "set -euo pipefail",
    directComposeResolveScript(service),
    ...composeEnvStampLines(service, desired, resolvedCommit),
    "docker compose \"${compose_env_args[@]}\" -f \"$compose_file\" -p \"$project\" up -d --no-build --no-deps --force-recreate \"$compose_service\"",
    "ready=0",
    "for attempt in $(seq 1 90); do",
    "  cid=$(docker ps -q -f name=\"^/${container}$\" | head -1)",
    "  if [ -n \"$cid\" ]; then",
    "    health=$(docker inspect -f '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' \"$cid\" 2>/dev/null || true)",
    "    echo compose_container_probe container=$container attempt=$attempt health=$health",
    "    if [ \"$health\" = \"healthy\" ] || [ \"$health\" = \"running\" ]; then ready=1; break; fi",
    "  else",
    "    echo compose_container_probe container=$container attempt=$attempt cid=missing",
    "  fi",
    "  sleep 1",
    "done",
    "test \"$ready\" = \"1\"",
  ].join("\n");
}

export function writeComposeEnvFallbackPath(): string {
  return rootPath(".state", "docker-compose.env");
}

export function rootAccessPrelude(): string[] {
  return [
    "root_exec() {",
    "  if [ \"$(id -u)\" = \"0\" ]; then \"$@\"; return; fi",
    "  if sudo -n true >/dev/null 2>&1; then sudo -n \"$@\"; return; fi",
    "  if [ -x /mnt/c/Windows/System32/wsl.exe ]; then /mnt/c/Windows/System32/wsl.exe -u root -- \"$@\"; return; fi",
    "  echo 'native_k3s_root_access=missing' >&2",
    "  return 1",
    "}",
    "root_shell() {",
    "  script=\"$1\"",
    "  if [ \"$(id -u)\" = \"0\" ]; then bash -lc \"$script\"; return; fi",
    "  if sudo -n true >/dev/null 2>&1; then sudo -n bash -lc \"$script\"; return; fi",
    "  if [ -x /mnt/c/Windows/System32/wsl.exe ]; then /mnt/c/Windows/System32/wsl.exe -u root -- bash -lc \"$script\"; return; fi",
    "  echo 'native_k3s_root_access=missing' >&2",
    "  return 1",
    "}",
  ];
}

export function ensureNativeK3sScript(): string {
  const installCommand = [
    "INSTALL_K3S_SKIP_DOWNLOAD=true",
    `INSTALL_K3S_VERSION=${nativeK3sInstallVersion}`,
    "INSTALL_K3S_EXEC=\"server --disable traefik --disable servicelb --disable metrics-server --node-name D601 --node-label unidesk.ai/node-id=D601 --node-label unidesk.ai/provider-id=D601 --tls-san 127.0.0.1 --tls-san host.docker.internal --write-kubeconfig-mode 644\"",
    "sh /tmp/unidesk-install-k3s.sh",
  ].join(" ");
  return [
    "set -euo pipefail",
    ...rootAccessPrelude(),
    `native_k3s_image=${shellQuote(nativeK3sImage)}`,
    `native_ctr_address=${shellQuote(nativeK3sCtrAddress)}`,
    `build_proxy=${shellQuote(providerGatewayWsEgressProxyUrl)}`,
    "configure_provider_deploy_proxy() {",
    "  export DOCKER_CONFIG=/tmp/unidesk-docker-config-clean",
    "  mkdir -p \"$DOCKER_CONFIG\"",
    "  [ -f \"$DOCKER_CONFIG/config.json\" ] || printf '{}' > \"$DOCKER_CONFIG/config.json\"",
    "  export HTTP_PROXY=\"$build_proxy\" HTTPS_PROXY=\"$build_proxy\" ALL_PROXY=\"$build_proxy\"",
    "  export NO_PROXY=\"localhost,127.0.0.1,::1,host.docker.internal\"",
    "  if ! curl -fsSI --max-time 20 -x \"$build_proxy\" https://github.com >/dev/null; then",
    "    echo native_k3s_provider_egress_proxy_unavailable=$build_proxy >&2",
    "    exit 1",
    "  fi",
    "  echo native_k3s_provider_egress_proxy=provider-gateway-ws-egress:$build_proxy",
    "}",
    "install_native_k3s_binaries() {",
    "  missing=0",
    "  for binary in k3s ctr containerd containerd-shim-runc-v2 crictl runc cni flannel bridge host-local loopback portmap bandwidth firewall; do",
    "    command -v \"$binary\" >/dev/null 2>&1 || missing=1",
    "  done",
    "  if [ \"$missing\" = \"0\" ]; then return; fi",
    "  docker image inspect \"$native_k3s_image\" >/dev/null 2>&1 || docker pull \"$native_k3s_image\"",
    "  tmp_dir=$(mktemp -d)",
    "  tmp_container=$(docker create \"$native_k3s_image\" sh -lc true)",
    "  docker cp \"$tmp_container:/bin/.\" \"$tmp_dir/bin\"",
    "  docker rm \"$tmp_container\" >/dev/null",
    "  for binary in k3s ctr containerd containerd-shim-runc-v2 crictl runc cni flannel bridge host-local loopback portmap bandwidth firewall; do",
    "    if [ -e \"$tmp_dir/bin/$binary\" ]; then",
    "      root_exec install -m 755 \"$tmp_dir/bin/$binary\" \"/usr/local/bin/$binary\"",
    "      echo native_k3s_binary_installed=$binary",
    "    fi",
    "  done",
    "  rm -rf \"$tmp_dir\"",
    "}",
    "unmount_invalid_wsl_kubelet_mounts() {",
    "  if awk 'NF != 6 && $0 ~ /\\/Docker\\/host/ {found=1} END {exit found ? 0 : 1}' /proc/mounts; then",
    "    root_exec umount /Docker/host >/dev/null 2>&1 || root_exec umount -l /Docker/host >/dev/null 2>&1 || true",
    "    echo native_k3s_unmounted_invalid_mount=/Docker/host",
    "  fi",
    "  awk 'NF != 6 {print \"native_k3s_invalid_mount_line=\" NR \":\" $0; bad=1} END {exit bad}' /proc/mounts",
    "}",
    "install_system_images_from_legacy_k3s() {",
    "  legacy_container=$(docker ps --format '{{.Names}} {{.Image}}' | awk '$2 ~ /^rancher\\/k3s:/ {print $1; exit}')",
    "  if [ -n \"$legacy_container\" ]; then",
    "    if docker exec \"$legacy_container\" ctr -n k8s.io images export /tmp/unidesk-k3s-system-images.tar docker.io/rancher/local-path-provisioner:v0.0.32 docker.io/rancher/mirrored-coredns-coredns:1.12.3 >/dev/null 2>&1; then",
    "      docker cp \"$legacy_container:/tmp/unidesk-k3s-system-images.tar\" /tmp/unidesk-k3s-system-images.tar >/dev/null",
    "      root_exec ctr --address \"$native_ctr_address\" -n k8s.io images import /tmp/unidesk-k3s-system-images.tar >/dev/null",
    "      echo native_k3s_imported_legacy_system_images=$legacy_container",
    "    fi",
    "  fi",
    "}",
    "install_pause_image() {",
    "  pause_image=rancher/mirrored-pause:3.6",
    "  pause_entrypoint=$(docker image inspect \"$pause_image\" --format '{{json .Config.Entrypoint}}' 2>/dev/null || true)",
    "  if ! printf '%s' \"$pause_entrypoint\" | grep -q '\"/pause\"'; then",
    "    docker image rm \"$pause_image\" >/dev/null 2>&1 || true",
    "    docker pull --platform linux/amd64 \"$pause_image\"",
    "    pause_entrypoint=$(docker image inspect \"$pause_image\" --format '{{json .Config.Entrypoint}}' 2>/dev/null || true)",
    "  fi",
    "  if ! printf '%s' \"$pause_entrypoint\" | grep -q '\"/pause\"'; then",
    "    echo native_k3s_pause_image_invalid_entrypoint=$pause_entrypoint >&2",
    "    exit 1",
    "  fi",
    "  docker save \"$pause_image\" -o /tmp/unidesk-k3s-pause.tar",
    "  root_exec ctr --address \"$native_ctr_address\" -n k8s.io images rm docker.io/rancher/mirrored-pause:3.6 >/dev/null 2>&1 || true",
    "  root_exec ctr --address \"$native_ctr_address\" -n k8s.io images import /tmp/unidesk-k3s-pause.tar >/dev/null",
    "  root_exec ctr --address \"$native_ctr_address\" -n k8s.io images ls | grep -F 'docker.io/rancher/mirrored-pause:3.6' >/dev/null",
    "  echo native_k3s_imported_pause_image=rancher/mirrored-pause:3.6",
    "}",
    "configure_provider_deploy_proxy",
    "install_native_k3s_binaries",
    "unmount_invalid_wsl_kubelet_mounts",
    "if ! systemctl cat k3s.service >/dev/null 2>&1; then",
    "  curl -fsSL --max-time 60 https://get.k3s.io -o /tmp/unidesk-install-k3s.sh",
    `  root_shell ${shellQuote(installCommand)}`,
    "fi",
    "if ! systemctl is-active --quiet k3s; then",
    "  root_exec systemctl enable --now k3s",
    "fi",
    "for attempt in $(seq 1 60); do",
    `  if KUBECONFIG=${shellQuote(k8sKubeconfig)} kubectl get nodes >/dev/null 2>&1; then break; fi`,
    "  sleep 2",
    "done",
    k3sTargetGuardScript(),
    `KUBECONFIG=${shellQuote(k8sKubeconfig)} kubectl get nodes -l unidesk.ai/node-id=D601 --no-headers | grep -q .`,
    `KUBECONFIG=${shellQuote(k8sKubeconfig)} kubectl wait --for=condition=Ready node -l unidesk.ai/node-id=D601 --timeout=180s`,
    "install_system_images_from_legacy_k3s",
    "install_pause_image",
    `KUBECONFIG=${shellQuote(k8sKubeconfig)} kubectl -n kube-system delete pod -l k8s-app=kube-dns --ignore-not-found >/dev/null 2>&1 || true`,
    `KUBECONFIG=${shellQuote(k8sKubeconfig)} kubectl -n kube-system delete pod -l app=local-path-provisioner --ignore-not-found >/dev/null 2>&1 || true`,
    "legacy_k3s_containers=$(docker ps --format '{{.Names}} {{.Image}}' | awk '$2 ~ /^rancher\\/k3s:/ {print $1}')",
    "for container in $legacy_k3s_containers; do",
    "  docker update --restart=no \"$container\" >/dev/null 2>&1 || true",
    "  docker stop \"$container\" >/dev/null",
    "  echo stopped_containerized_k3s=$container",
    "done",
    `KUBECONFIG=${shellQuote(k8sKubeconfig)} kubectl get nodes -o wide`,
    "printf 'native_k3s=ready kubeconfig=%s\\n' /etc/rancher/k3s/k3s.yaml",
  ].join("\n");
}

export function importK3sImageScript(service: UniDeskMicroserviceConfig): string {
  const image = buildImageTag(service);
  const archive = `/tmp/unidesk-${safeId(service.id)}-k3s-image.tar`;
  const manifest = `${targetWorkDir(service)}/${k8sManifestPath(service)}`;
  const codeQueueManifestPreflight = service.id === "code-queue"
    ? [
      "if [ -f \"$manifest\" ]; then",
      "  bad_manifest_images=$(python3 - \"$manifest\" \"$image\" <<'PY'",
      "import re, sys",
      "path, expected = sys.argv[1], sys.argv[2]",
      "required = {'code-queue','code-queue-read','code-queue-write','d601-provider-egress-proxy','d601-tcp-egress-gateway'}",
      "text = open(path, encoding='utf-8').read()",
      "bad = []",
      "seen = set()",
      "for doc in re.split(r'(?m)^---\\s*$', text):",
      "    if not re.search(r'(?m)^kind:\\s*Deployment\\s*$', doc):",
      "        continue",
      "    match = re.search(r'(?ms)^metadata:\\s*$.*?^  name:\\s*([A-Za-z0-9_.-]+)\\s*$', doc)",
      "    name = match.group(1) if match else ''",
      "    if name not in required:",
      "        continue",
      "    seen.add(name)",
      "    images = re.findall(r'(?m)^\\s*image:\\s*\"?([^\"\\s#]+)\"?', doc)",
      "    if not images or any(image != expected for image in images):",
      "        found = ','.join(images) if images else '<none>'",
      "        bad.append(f'{name}:{found}')",
      "missing = sorted(required - seen)",
      "bad.extend(f'{name}:<missing>' for name in missing)",
      "print('\\n'.join(bad))",
      "PY",
      "  )",
      "  if [ -n \"$bad_manifest_images\" ]; then",
      "    printf 'code_queue_manifest_image_preflight_failed image=%s\\n%s\\n' \"$image\" \"$bad_manifest_images\" >&2",
      "    exit 1",
      "  fi",
      "  echo code_queue_manifest_image_preflight=ok image=$image",
      "fi",
    ]
    : [];
  return [
    "set -euo pipefail",
    ...rootAccessPrelude(),
    `image=${shellQuote(image)}`,
    `archive=${shellQuote(archive)}`,
    `manifest=${shellQuote(manifest)}`,
    "docker image inspect \"$image\" >/dev/null",
    ...codeQueueManifestPreflight,
    "rm -f \"$archive\"",
    "docker save \"$image\" -o \"$archive\"",
    `root_exec ctr --address ${shellQuote(nativeK3sCtrAddress)} -n k8s.io images import "$archive"`,
    "rm -f \"$archive\"",
    `if ! root_exec ctr --address ${shellQuote(nativeK3sCtrAddress)} -n k8s.io images ls | grep -F "$image"; then`,
    "  printf 'native_k3s_containerd_image_missing=%s\\n' \"$image\" >&2",
    "  exit 1",
    "fi",
    "printf 'native_k3s_containerd_image_present=%s\\n' \"$image\"",
  ].join("\n");
}