// SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. status-script module for scripts/src/platform-infra.ts.

// Moved mechanically from scripts/src/platform-infra.ts:3091-3538 for #903.

import { createHash, randomBytes } from "node:crypto";
import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
import { dirname, isAbsolute, join } from "node:path";
import type { UniDeskConfig } from "../config";
import { rootPath } from "../config";
import { startJob } from "../jobs";
import type { RenderedCliResult } from "../output";
import { pk01CaddyMergeManagedBlocksPython, renderCaddyManagedBlock, renderSimpleReverseProxyCaddySiteBlock } from "../pk01-caddy";
import { capture, compactCapture, parseJsonOutput, prepareFrpcSecret, shQuote } from "../platform-infra-public-service";
import { yamlBooleanField, yamlFieldLabel, yamlIntegerField } from "../platform-infra-ops-library";
import { fingerprintSecretValues, parseEnvFile, readEnvSourceFile, readTextFile, redactRepoPath, requiredEnvValue } from "../secrets";

import type { Sub2ApiConfig, Sub2ApiTargetConfig } from "./entry";
import { requiredSecretKeys, serviceName } from "./entry";
import { codexPoolSentinelResourceNames, imageRef, managedResourceCleanupPlan, sub2ApiProxyEnv } from "./manifest";

export function statusScript(sub2api: Sub2ApiConfig, target: Sub2ApiTargetConfig): string {
  const expectedImage = imageRef(sub2api, target);
  const expectedUrlAllowlist = sub2api.security.urlAllowlist;
  const externalPending = target.databaseMode === "external-pending";
  const externalActive = target.databaseMode === "external-active";
  const proxy = target.egressProxy?.enabled ? target.egressProxy : null;
  const localHttps = target.publicExposure?.enabled === true && target.publicExposure.mode === "node-local-https" ? target.publicExposure.localHttps : null;
  const localHttpsExposure = localHttps === null ? null : target.publicExposure;
  const expectedProxyEnv = sub2ApiProxyEnv(target);
  const cleanupPlan = managedResourceCleanupPlan(sub2api, target);
  const appSecretName = sub2api.runtime.database.secretName;
  const redisService = sub2api.runtime.redis.serviceName;
  return `
set -u
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
capture_json() {
  name="$1"
  shift
  "$@" -o json >"$tmp/$name.json" 2>"$tmp/$name.err"
  rc=$?
  printf '%s' "$rc" >"$tmp/$name.rc"
}
capture_json ns kubectl get namespace ${target.namespace}
capture_json deployments kubectl -n ${target.namespace} get deployments -l app.kubernetes.io/part-of=platform-infra
capture_json statefulsets kubectl -n ${target.namespace} get statefulsets -l app.kubernetes.io/part-of=platform-infra
capture_json pods kubectl -n ${target.namespace} get pods -l app.kubernetes.io/part-of=platform-infra
capture_json services kubectl -n ${target.namespace} get services -l app.kubernetes.io/part-of=platform-infra
capture_json pvc kubectl -n ${target.namespace} get pvc -l app.kubernetes.io/part-of=platform-infra
capture_json secrets kubectl -n ${target.namespace} get secret ${appSecretName}
capture_json configmap kubectl -n ${target.namespace} get configmap sub2api-config
capture_json networkpolicies kubectl -n ${target.namespace} get networkpolicy
capture_json cronjobs kubectl -n ${target.namespace} get cronjob -l app.kubernetes.io/part-of=platform-infra
capture_json ingresses kubectl -n ${target.namespace} get ingress
capture_json quotas kubectl -n ${target.namespace} get resourcequota
capture_json limitranges kubectl -n ${target.namespace} get limitrange
local_https_rc=0
local_https_ps_rc=0
local_https_probe_rc=0
local_https_action="not-enabled"
local_https_ps=""
local_https_probe_url=""
if [ "${localHttps === null ? "false" : "true"}" = "true" ]; then
  local_https_action="inspect"
  local_https_ps="$(docker ps --filter ${localHttps === null ? "\"\"" : shQuote(`name=^/${localHttps.containerName}$`)} --format '{{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}' 2>"$tmp/local-https-ps.err" || true)"
  if [ -n "$local_https_ps" ]; then local_https_ps_rc=0; else local_https_ps_rc=1; fi
  printf '%s' "$local_https_ps" >"$tmp/local-https-ps.out"
  local_https_probe_url=${localHttpsExposure === null ? "\"\"" : shQuote(`${localHttpsExposure.publicBaseUrl}/health`)}
  curl --noproxy '*' -kfsS --connect-timeout 5 --max-time 20 --resolve ${localHttpsExposure === null || localHttps === null ? "\"\"" : shQuote(`${localHttpsExposure.dns.hostname}:${localHttps.httpsPort}:127.0.0.1`)} "$local_https_probe_url" >"$tmp/local-https-probe.out" 2>"$tmp/local-https-probe.err"
  local_https_probe_rc=$?
  if [ "$local_https_ps_rc" -ne 0 ] || [ "$local_https_probe_rc" -ne 0 ]; then local_https_rc=1; fi
else
  : >"$tmp/local-https-ps.out"
  : >"$tmp/local-https-ps.err"
  : >"$tmp/local-https-probe.out"
  : >"$tmp/local-https-probe.err"
fi
printf '%s' "$local_https_rc" >"$tmp/local-https.rc"
printf '%s' "$local_https_ps_rc" >"$tmp/local-https-ps.rc"
printf '%s' "$local_https_probe_rc" >"$tmp/local-https-probe.rc"
printf '%s' "$local_https_action" >"$tmp/local-https-action.txt"
printf '%s' "$local_https_probe_url" >"$tmp/local-https-probe-url.txt"
pod_name="$(kubectl -n ${target.namespace} get pod -l app.kubernetes.io/name=${serviceName},app.kubernetes.io/component=app -o jsonpath='{.items[0].metadata.name}' 2>"$tmp/pod-name.err" || true)"
printf '%s' "$pod_name" >"$tmp/pod-name.txt"
if [ -n "$pod_name" ]; then
  kubectl -n ${target.namespace} exec "$pod_name" -- sh -c 'printf "SECURITY_URL_ALLOWLIST_ENABLED=%s\\n" "$SECURITY_URL_ALLOWLIST_ENABLED"; printf "SECURITY_URL_ALLOWLIST_ALLOW_INSECURE_HTTP=%s\\n" "$SECURITY_URL_ALLOWLIST_ALLOW_INSECURE_HTTP"; printf "SECURITY_URL_ALLOWLIST_ALLOW_PRIVATE_HOSTS=%s\\n" "$SECURITY_URL_ALLOWLIST_ALLOW_PRIVATE_HOSTS"; printf "SECURITY_URL_ALLOWLIST_UPSTREAM_HOSTS=%s\\n" "$SECURITY_URL_ALLOWLIST_UPSTREAM_HOSTS"; printf "HTTP_PROXY=%s\\n" "$HTTP_PROXY"; printf "HTTPS_PROXY=%s\\n" "$HTTPS_PROXY"; printf "ALL_PROXY=%s\\n" "$ALL_PROXY"; printf "NO_PROXY=%s\\n" "$NO_PROXY"' >"$tmp/pod-env.out" 2>"$tmp/pod-env.err"
  printf '%s' "$?" >"$tmp/pod-env.rc"
else
  : >"$tmp/pod-env.out"
  printf '%s\\n' 'sub2api app pod not found' >"$tmp/pod-env.err"
  printf '%s' "1" >"$tmp/pod-env.rc"
fi
python3 - "$tmp" <<'PY'
import json
import os
import sys

tmp = sys.argv[1]

def rc(name):
    try:
        return int(open(os.path.join(tmp, f"{name}.rc"), encoding="utf-8").read() or "1")
    except FileNotFoundError:
        return 1

def load(name):
    path = os.path.join(tmp, f"{name}.json")
    if not os.path.exists(path):
        return None
    try:
        return json.load(open(path, encoding="utf-8"))
    except json.JSONDecodeError:
        return None

def items(name):
    data = load(name)
    if not isinstance(data, dict):
        return []
    return data.get("items") or []

def text(name, limit=None):
    path = os.path.join(tmp, name)
    try:
        data = open(path, encoding="utf-8", errors="replace").read()
        return data if limit is None else data[-limit:]
    except FileNotFoundError:
        return ""

def deployment_summary(item):
    spec = item.get("spec") or {}
    status = item.get("status") or {}
    desired = spec.get("replicas", 1)
    available = status.get("availableReplicas", 0)
    init_containers = ((spec.get("template") or {}).get("spec") or {}).get("initContainers", [])
    containers = ((spec.get("template") or {}).get("spec") or {}).get("containers", [])
    return {
        "name": item["metadata"]["name"],
        "desired": desired,
        "readyReplicas": status.get("readyReplicas", 0),
        "availableReplicas": available,
        "updatedReplicas": status.get("updatedReplicas", 0),
        "ready": available >= desired,
        "images": [c.get("image") for c in containers],
        "initImages": [c.get("image") for c in init_containers],
    }

def statefulset_summary(item):
    spec = item.get("spec") or {}
    status = item.get("status") or {}
    desired = spec.get("replicas", 1)
    ready = status.get("readyReplicas", 0)
    return {
        "name": item["metadata"]["name"],
        "desired": desired,
        "readyReplicas": ready,
        "currentReplicas": status.get("currentReplicas", 0),
        "updatedReplicas": status.get("updatedReplicas", 0),
        "ready": ready >= desired,
        "images": [c.get("image") for c in ((spec.get("template") or {}).get("spec") or {}).get("containers", [])],
    }

def pod_summary(item):
    status = item.get("status") or {}
    container_statuses = status.get("containerStatuses") or []
    return {
        "name": item["metadata"]["name"],
        "phase": status.get("phase"),
        "ready": all((cs.get("ready") is True) for cs in container_statuses) if container_statuses else False,
        "restarts": sum(int(cs.get("restartCount") or 0) for cs in container_statuses),
        "nodeName": (item.get("spec") or {}).get("nodeName"),
        "containers": [
            {
                "name": cs.get("name"),
                "ready": cs.get("ready"),
                "restartCount": cs.get("restartCount"),
                "image": cs.get("image"),
                "state": list((cs.get("state") or {}).keys()),
                "stateDetail": cs.get("state") or {},
            }
            for cs in container_statuses
        ],
        "initContainers": [
            {
                "name": cs.get("name"),
                "ready": cs.get("ready"),
                "restartCount": cs.get("restartCount"),
                "image": cs.get("image"),
                "state": list((cs.get("state") or {}).keys()),
                "stateDetail": cs.get("state") or {},
            }
            for cs in (status.get("initContainerStatuses") or [])
        ],
        "conditions": [
            {
                "type": condition.get("type"),
                "status": condition.get("status"),
                "reason": condition.get("reason"),
                "message": condition.get("message"),
            }
            for condition in status.get("conditions", [])
        ],
    }

def service_summary(item):
    spec = item.get("spec") or {}
    return {
        "name": item["metadata"]["name"],
        "type": spec.get("type", "ClusterIP"),
        "clusterIP": spec.get("clusterIP"),
        "ports": [
            {
                "name": p.get("name"),
                "port": p.get("port"),
                "targetPort": p.get("targetPort"),
                "nodePort": p.get("nodePort"),
            }
            for p in spec.get("ports", [])
        ],
    }

def pvc_summary(item):
    spec = item.get("spec") or {}
    status = item.get("status") or {}
    req = (spec.get("resources") or {}).get("requests") or {}
    return {
        "name": item["metadata"]["name"],
        "phase": status.get("phase"),
        "storageClassName": spec.get("storageClassName"),
        "requestedStorage": req.get("storage"),
    }

def network_policy_summary(item):
    spec = item.get("spec") or {}
    return {
        "name": item["metadata"]["name"],
        "podSelector": spec.get("podSelector"),
        "policyTypes": spec.get("policyTypes") or [],
        "ingress": spec.get("ingress") or [],
        "egress": spec.get("egress") or [],
    }

def is_allow_all_network_policy(item):
    spec = item.get("spec") or {}
    return (
        item.get("metadata", {}).get("name") == "allow-all"
        and spec.get("podSelector") == {}
        and set(spec.get("policyTypes") or []) == {"Ingress", "Egress"}
        and spec.get("ingress") == [{}]
        and spec.get("egress") == [{}]
    )

def boundary_violations(kind, collection):
    findings = []
    for item in collection:
        spec = item.get("spec") or {}
        template_spec = ((spec.get("template") or {}).get("spec") or {})
        if template_spec.get("hostNetwork") is True:
            findings.append({"kind": kind, "name": item["metadata"]["name"], "field": "hostNetwork"})
        all_containers = [(container, "containers") for container in template_spec.get("containers", [])] + [(container, "initContainers") for container in template_spec.get("initContainers", [])]
        for container, container_group in all_containers:
            for port in container.get("ports", []):
                if "hostPort" in port:
                    findings.append({"kind": kind, "name": item["metadata"]["name"], "container": container.get("name"), "containerGroup": container_group, "field": "hostPort", "value": port.get("hostPort")})
    return findings

deployments = items("deployments")
statefulsets = items("statefulsets")
services = items("services")
pods = items("pods")
pvcs = items("pvc")
networkpolicies = items("networkpolicies")
cronjobs = items("cronjobs")
secret = load("secrets")
configmap = load("configmap")
configmap_data = (configmap or {}).get("data") or {}
secret_keys = sorted(((secret or {}).get("data") or {}).keys())
missing_secret_keys = [key for key in ${JSON.stringify(requiredSecretKeys)} if key not in secret_keys]
external_pending = ${externalPending ? "True" : "False"}
external_active = ${externalActive ? "True" : "False"}
expected_app_replicas = ${target.appReplicas}
expected_redis_replicas = ${target.redisReplicas}
cleanup_plan = json.loads(${JSON.stringify(JSON.stringify(cleanupPlan))})
external_db_state = cleanup_plan["externalDbState"]
redis_persistent_state = cleanup_plan["redisPersistentState"]
public_exposure_state = cleanup_plan["publicExposure"]
egress_proxy_state = cleanup_plan["egressProxy"]
service_violations = []
for svc in services:
    spec = svc.get("spec") or {}
    if spec.get("type", "ClusterIP") != "ClusterIP":
        service_violations.append({"name": svc["metadata"]["name"], "type": spec.get("type")})
    for port in spec.get("ports", []):
        if "nodePort" in port:
            service_violations.append({"name": svc["metadata"]["name"], "nodePort": port.get("nodePort")})
resource_violations = boundary_violations("Deployment", deployments) + boundary_violations("StatefulSet", statefulsets)
expected_resource_protection = json.loads(${JSON.stringify(JSON.stringify(target.resourceProtection))})
def workload_resource_contract(name, container_name):
    workload = next((item for item in deployments if item.get("metadata", {}).get("name") == name), None)
    pod_spec = (((workload or {}).get("spec") or {}).get("template") or {}).get("spec") or {}
    container = next((item for item in pod_spec.get("containers", []) if item.get("name") == container_name), None)
    return {"priorityClassName": pod_spec.get("priorityClassName"), "resources": (container or {}).get("resources") or {}}
resource_contracts = {
    "app": workload_resource_contract("${serviceName}", "${serviceName}"),
    "redis": workload_resource_contract("${redisService}", "redis"),
}
resource_protection_aligned = expected_resource_protection is None or (
    resource_contracts["app"]["priorityClassName"] == expected_resource_protection["priorityClassName"]
    and resource_contracts["redis"]["priorityClassName"] == expected_resource_protection["priorityClassName"]
    and resource_contracts["app"]["resources"] == {"requests": expected_resource_protection["app"]["requests"], "limits": expected_resource_protection["app"]["limits"]}
    and resource_contracts["redis"]["resources"] == {"requests": expected_resource_protection["redis"]["requests"], "limits": expected_resource_protection["redis"]["limits"]}
)
expected_image = "${expectedImage}"
expected_url_allowlist = json.loads(${JSON.stringify(JSON.stringify(expectedUrlAllowlist))})
sub2api_deployment = next((deployment_summary(item) for item in deployments if item["metadata"]["name"] == "${serviceName}"), None)
redis_deployment = next((deployment_summary(item) for item in deployments if item["metadata"]["name"] == "${redisService}"), None)
sub2api_desired_aligned = sub2api_deployment is not None and sub2api_deployment.get("desired") == expected_app_replicas
redis_desired_aligned = redis_deployment is not None and redis_deployment.get("desired") == expected_redis_replicas
image_aligned = sub2api_deployment is not None and expected_image in sub2api_deployment.get("images", [])
url_allowlist_runtime = {
    "enabled": configmap_data.get("SECURITY_URL_ALLOWLIST_ENABLED"),
    "allowInsecureHttp": configmap_data.get("SECURITY_URL_ALLOWLIST_ALLOW_INSECURE_HTTP"),
    "allowPrivateHosts": configmap_data.get("SECURITY_URL_ALLOWLIST_ALLOW_PRIVATE_HOSTS"),
    "upstreamHosts": configmap_data.get("SECURITY_URL_ALLOWLIST_UPSTREAM_HOSTS"),
}
pod_env = {}
for line in text("pod-env.out").splitlines():
    if "=" not in line:
        continue
    key, value = line.split("=", 1)
    pod_env[key] = value
url_allowlist_pod_env = {
    "enabled": pod_env.get("SECURITY_URL_ALLOWLIST_ENABLED"),
    "allowInsecureHttp": pod_env.get("SECURITY_URL_ALLOWLIST_ALLOW_INSECURE_HTTP"),
    "allowPrivateHosts": pod_env.get("SECURITY_URL_ALLOWLIST_ALLOW_PRIVATE_HOSTS"),
    "upstreamHosts": pod_env.get("SECURITY_URL_ALLOWLIST_UPSTREAM_HOSTS"),
}
expected_url_allowlist_strings = {
    "enabled": str(expected_url_allowlist.get("enabled")).lower(),
    "allowInsecureHttp": str(expected_url_allowlist.get("allowInsecureHttp")).lower(),
    "allowPrivateHosts": str(expected_url_allowlist.get("allowPrivateHosts")).lower(),
    "upstreamHosts": ",".join(expected_url_allowlist.get("upstreamHosts") or []),
}
expected_proxy_env = json.loads(${JSON.stringify(JSON.stringify({
    enabled: proxy !== null && proxy.applyToSub2Api,
    httpProxy: expectedProxyEnv.httpProxy,
    noProxy: expectedProxyEnv.noProxy,
    deploymentName: proxy?.deploymentName ?? null,
    serviceName: proxy?.serviceName ?? null,
  }))})
url_allowlist_configmap_aligned = url_allowlist_runtime == expected_url_allowlist_strings
url_allowlist_pod_env_aligned = rc("pod-env") == 0 and url_allowlist_pod_env == expected_url_allowlist_strings
url_allowlist_aligned = url_allowlist_configmap_aligned and (url_allowlist_pod_env_aligned or (external_pending and expected_app_replicas == 0))
proxy_env_runtime = {
    "HTTP_PROXY": pod_env.get("HTTP_PROXY"),
    "HTTPS_PROXY": pod_env.get("HTTPS_PROXY"),
    "ALL_PROXY": pod_env.get("ALL_PROXY"),
    "NO_PROXY": pod_env.get("NO_PROXY"),
}
if expected_proxy_env.get("enabled"):
    proxy_env_aligned = (
        rc("pod-env") == 0
        and proxy_env_runtime.get("HTTP_PROXY") == expected_proxy_env.get("httpProxy")
        and proxy_env_runtime.get("HTTPS_PROXY") == expected_proxy_env.get("httpProxy")
        and proxy_env_runtime.get("ALL_PROXY") == expected_proxy_env.get("httpProxy")
        and proxy_env_runtime.get("NO_PROXY") == expected_proxy_env.get("noProxy")
    )
else:
    proxy_env_aligned = True
allow_all_network_policy = next((item for item in networkpolicies if item.get("metadata", {}).get("name") == "allow-all"), None)
network_policy = {
    "requiredName": "allow-all",
    "exists": allow_all_network_policy is not None,
    "ok": allow_all_network_policy is not None and is_allow_all_network_policy(allow_all_network_policy),
    "policies": [network_policy_summary(item) for item in networkpolicies],
}
boundary = {
    "internalOnly": len(service_violations) == 0 and len(items("ingresses")) == 0,
    "serviceViolations": service_violations,
    "ingressCount": len(items("ingresses")),
    "resourceQuotaCount": len(items("quotas")),
    "limitRangeCount": len(items("limitranges")),
    "resourceViolations": resource_violations,
}
deployment_summaries = [deployment_summary(item) for item in deployments]
statefulset_summaries = [statefulset_summary(item) for item in statefulsets]
workload_ready = all(d["ready"] for d in deployment_summaries) and all(s["ready"] for s in statefulset_summaries)
local_postgres_present = (
    any(item.get("metadata", {}).get("name") == external_db_state["postgresStatefulSetName"] for item in statefulsets)
    or any(item.get("metadata", {}).get("name") == external_db_state["postgresServiceName"] for item in services)
    or any(item.get("metadata", {}).get("name") in [external_db_state["postgresPvcName"], external_db_state["appDataPvcName"]] for item in pvcs)
)
redis_pvc_present = any(item.get("metadata", {}).get("name") == redis_persistent_state["pvcName"] for item in pvcs)
public_exposure_deployment_present = any(item.get("metadata", {}).get("name") == public_exposure_state["deploymentName"] for item in deployments)
egress_proxy_deployment_present = any(item.get("metadata", {}).get("name") == egress_proxy_state["deploymentName"] for item in deployments)
sentinel_cronjob_present = any(item.get("metadata", {}).get("name") == "${codexPoolSentinelResourceNames().cronJobName}" for item in cronjobs)
standby_disabled_resources_ok = not external_pending or (
    not public_exposure_deployment_present
    and not egress_proxy_deployment_present
    and not sentinel_cronjob_present
)
secret_ready = len(missing_secret_keys) == 0
secret_ok = secret_ready or external_pending
if external_pending:
    state_model_ok = (
        not local_postgres_present
        and not redis_pvc_present
        and sub2api_desired_aligned
        and redis_desired_aligned
        and expected_app_replicas == 0
        and expected_redis_replicas == 0
        and standby_disabled_resources_ok
    )
elif external_active:
    state_model_ok = (
        not local_postgres_present
        and not redis_pvc_present
        and sub2api_desired_aligned
        and redis_desired_aligned
        and expected_app_replicas == 1
        and expected_redis_replicas == 1
    )
else:
    state_model_ok = local_postgres_present and sub2api_desired_aligned and redis_desired_aligned
status_label = "pending-external-db" if external_pending else "external-db-active" if external_active else "active"
payload = {
    "ok": rc("ns") == 0 and workload_ready and image_aligned and url_allowlist_aligned and proxy_env_aligned and network_policy["ok"] and boundary["internalOnly"] and len(resource_violations) == 0 and resource_protection_aligned and boundary["resourceQuotaCount"] == 0 and boundary["limitRangeCount"] == 0 and secret_ok and state_model_ok and rc("local-https") == 0,
    "target": "${target.id}",
    "route": "${target.route}",
    "namespace": "${target.namespace}",
    "status": status_label,
    "databaseMode": "${target.databaseMode}",
    "redisMode": "${target.redisMode}",
    "expectedAppReplicas": expected_app_replicas,
    "expectedRedisReplicas": expected_redis_replicas,
    "namespaceExists": rc("ns") == 0,
    "deployments": deployment_summaries,
    "statefulsets": statefulset_summaries,
    "pods": [pod_summary(item) for item in pods],
    "services": [service_summary(item) for item in services],
    "pvcs": [pvc_summary(item) for item in pvcs],
    "networkPolicy": network_policy,
    "resourceProtection": {"expected": expected_resource_protection, "observed": resource_contracts, "aligned": resource_protection_aligned},
    "localHttpsExposure": {
        "enabled": ${localHttps === null ? "False" : "True"},
        "action": text("local-https-action.txt"),
        "ok": rc("local-https") == 0,
        "mode": ${localHttps === null ? "None" : JSON.stringify("node-local-docker-caddy")},
        "publicBaseUrl": ${localHttpsExposure === null ? "None" : JSON.stringify(localHttpsExposure.publicBaseUrl)},
        "hostname": ${localHttpsExposure === null ? "None" : JSON.stringify(localHttpsExposure.dns.hostname)},
        "bind": ${localHttps === null ? "None" : JSON.stringify(`${localHttps.hostBind}:${localHttps.httpsPort}`)},
        "containerName": ${localHttps === null ? "None" : JSON.stringify(localHttps.containerName)},
        "ps": {"exitCode": rc("local-https-ps"), "stdout": text("local-https-ps.out"), "stderr": text("local-https-ps.err")},
        "probe": {"exitCode": rc("local-https-probe"), "url": text("local-https-probe-url.txt"), "stdout": text("local-https-probe.out", 2000), "stderr": text("local-https-probe.err", 2000)},
        "valuesPrinted": False,
    },
    "secret": {
        "name": "${appSecretName}",
        "exists": rc("secrets") == 0,
        "requiredKeys": ${JSON.stringify(requiredSecretKeys)},
        "missingKeys": missing_secret_keys,
        "ready": secret_ready,
        "requiredForPredeployOk": not external_pending,
        "valuesPrinted": False,
    },
    "stateModel": {
        "localPostgresPresent": local_postgres_present,
        "redisPvcPresent": redis_pvc_present,
        "sub2apiDesiredReplicasAligned": sub2api_desired_aligned,
        "redisDesiredReplicasAligned": redis_desired_aligned,
        "standbyDisabledResourcesOk": standby_disabled_resources_ok,
        "publicExposureDeploymentPresent": public_exposure_deployment_present,
        "egressProxyDeploymentPresent": egress_proxy_deployment_present,
        "sentinelCronJobPresent": sentinel_cronjob_present,
        "ok": state_model_ok,
    },
    "imageControl": {
        "desiredImage": expected_image,
        "configPath": "config/platform-infra/sub2api.yaml",
        "aligned": image_aligned,
        "runningImages": sub2api_deployment.get("images", []) if sub2api_deployment else [],
    },
    "security": {
        "urlAllowlist": {
            "configPath": "config/platform-infra/sub2api.yaml",
            "expected": expected_url_allowlist,
            "runtime": url_allowlist_runtime,
            "podEnv": url_allowlist_pod_env,
            "aligned": url_allowlist_aligned,
            "configMapAligned": url_allowlist_configmap_aligned,
            "podEnvAligned": url_allowlist_pod_env_aligned,
            "podEnvRequired": not (external_pending and expected_app_replicas == 0),
            "configMapExists": rc("configmap") == 0,
            "podEnvProbe": {
                "podName": text("pod-name.txt"),
                "exitCode": rc("pod-env"),
                "stderr": text("pod-env.err")[-1000:],
            },
        }
    },
    "egressProxy": {
        "enabled": expected_proxy_env.get("enabled"),
        "deploymentName": expected_proxy_env.get("deploymentName"),
        "serviceName": expected_proxy_env.get("serviceName"),
        "expectedHttpProxy": expected_proxy_env.get("httpProxy"),
        "expectedNoProxy": expected_proxy_env.get("noProxy"),
        "podEnv": proxy_env_runtime,
        "aligned": proxy_env_aligned,
        "valuesPrinted": False,
    },
    "boundary": boundary,
    "serviceDns": "${serviceName}.${target.namespace}.svc.cluster.local:8080",
    "next": {
        "apply": "bun scripts/cli.ts platform-infra sub2api apply --target ${target.id} --confirm",
        "validate": "bun scripts/cli.ts platform-infra sub2api validate --target ${target.id}",
    },
}
print(json.dumps(payload, ensure_ascii=False, indent=2))
sys.exit(0 if payload["ok"] else 1)
PY
`;
}
