"use strict";

const { createHash } = require("node:crypto");

function record(value) {
  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : {};
}

function stringOrNull(value) {
  return typeof value === "string" && value.length > 0 ? value : null;
}

function stringArray(value) {
  return Array.isArray(value) && value.every((item) => typeof item === "string") ? value : null;
}

function digestFromImage(value) {
  if (typeof value !== "string" || !value.includes("@")) return null;
  return value.split("@").slice(1).join("@") || null;
}

function normalizeGitopsRevisionRelation(value) {
  const relation = record(value);
  const expectedRevision = stringOrNull(relation.expectedRevision);
  const observedRevision = stringOrNull(relation.observedRevision);
  const validRevision = /^[0-9a-f]{7,64}$/iu;
  if (expectedRevision === null
    || observedRevision === null
    || expectedRevision !== observedRevision
    || !validRevision.test(expectedRevision)) {
    return relation;
  }

  const originalReason = stringOrNull(relation.reason);
  const warnings = Array.isArray(relation.warnings) ? [...relation.warnings] : [];
  if (originalReason === "owning-git-fetch-failed"
    && !warnings.some((item) => record(item).code === "pac-owning-git-fetch-failed")) {
    warnings.push({
      warning: true,
      blocking: false,
      code: "pac-owning-git-fetch-failed",
      object: { kind: "gitops-revision", id: "owning-git" },
      configPath: "live:gitops-revision",
      reason: originalReason,
      mutation: false,
      valuesPrinted: false,
    });
  }

  const graphProven = relation.relation === "exact" && relation.proof === "owning-git-commit-graph";
  const directlyProven = relation.relation === "exact" && relation.proof === "direct-revision-equality";
  return {
    ...relation,
    relation: "exact",
    expectedRevision,
    observedRevision,
    proof: graphProven || directlyProven ? relation.proof : "direct-revision-equality",
    reason: graphProven ? "commits-equal" : "revisions-equal",
    contextReason: graphProven
      ? null
      : directlyProven
        ? stringOrNull(relation.contextReason)
        : originalReason,
    warnings,
    valuesPrinted: false,
  };
}

function exactSkipMarker(records, event) {
  return [...records].reverse().find((item) => item.event === event
    && item.status === "skipped"
    && item.reason === "no-build-no-rollout-plan") || null;
}

function exactRuntimeGitopsVerifyMarker(records) {
  return [...records].reverse().find((item) => item.event === "gitops-promote"
    && item.status === "continuing"
    && item.reason === "no-build-no-rollout-plan-gitops-verify") || null;
}

function featureConfigSchemaObservation(records) {
  const item = [...records].reverse().find((recordValue) => recordValue.event === "feature-config-schema-validation") || null;
  if (item === null) return null;
  const candidate = record(item.candidate);
  const code = stringOrNull(item.code);
  const schemaPath = stringOrNull(item.schemaPath);
  const firstError = stringOrNull(item.firstError);
  return {
    warning: item.warning === true,
    blocking: false,
    code: code === null ? "feature-config-schema-invalid" : code.slice(0, 100),
    schemaPath: schemaPath === null ? "config/feature-config.schema.json" : schemaPath.slice(0, 200),
    errorCount: Number.isInteger(item.errorCount) ? Math.max(0, item.errorCount) : null,
    firstError: firstError === null ? null : firstError.replace(/\s+/gu, " ").trim().slice(0, 240),
    candidate: Object.keys(candidate).length === 0 ? null : {
      source: stringOrNull(candidate.source),
      renderedRoot: stringOrNull(candidate.renderedRoot),
      fileCount: Number.isInteger(candidate.fileCount) ? candidate.fileCount : null,
      workloadCount: Number.isInteger(candidate.workloadCount) ? candidate.workloadCount : null,
      matchedValueCount: Number.isInteger(candidate.matchedValueCount) ? candidate.matchedValueCount : null,
      propertyCount: Number.isInteger(candidate.propertyCount) ? candidate.propertyCount : null,
      valuesPrinted: false,
    },
    spanEvent: "cicd.feature_config.schema",
    mutation: false,
    valuesPrinted: false,
  };
}

const pacContractTasks = new Set(["plan-artifacts", "collect-artifacts", "gitops-promote"]);

function firstString(...values) {
  for (const value of values) {
    if (typeof value === "string" && value.length > 0) return value;
  }
  return null;
}

function pipelineRunMatchesConsumer(consumerInput, itemInput) {
  const consumer = record(consumerInput);
  const item = record(itemInput);
  const metadata = record(item.metadata);
  const labels = record(metadata.labels);
  const spec = record(item.spec);
  const pipelineRef = record(spec.pipelineRef);
  const name = stringOrNull(metadata.name) || "";
  const prefix = stringOrNull(consumer.pipelineRunPrefix) || "";
  const pipeline = stringOrNull(consumer.pipeline) || "";
  return (prefix.length > 0 && name.startsWith(prefix))
    || (pipeline.length > 0 && labels["tekton.dev/pipeline"] === pipeline)
    || (pipeline.length > 0 && labels["tekton.dev/pipelineName"] === pipeline)
    || (pipeline.length > 0 && pipelineRef.name === pipeline);
}

function stableCanonicalJson(value) {
  if (Array.isArray(value)) return `[${value.map(stableCanonicalJson).join(",")}]`;
  if (typeof value === "object" && value !== null) {
    return `{${Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${stableCanonicalJson(item)}`).join(",")}}`;
  }
  return JSON.stringify(value);
}

function liveAdmissionSpecSha256(targetId, policyName, bindingName, policySpecInput, bindingSpecInput) {
  const policySpec = normalizeAdmissionPolicySpec(policySpecInput);
  const bindingSpec = normalizeAdmissionBindingSpec(bindingSpecInput);
  const normalized = {
    targetId,
    policyName,
    bindingName,
    policySpec,
    bindingSpec,
  };
  return `sha256:${createHash("sha256").update(stableCanonicalJson(normalized)).digest("hex")}`;
}

function normalizeAdmissionPolicySpec(value) {
  const spec = { ...record(value) };
  if (Object.prototype.hasOwnProperty.call(spec, "matchConstraints")) {
    const matchConstraints = { ...record(spec.matchConstraints) };
    if (!Object.prototype.hasOwnProperty.call(matchConstraints, "matchPolicy")) matchConstraints.matchPolicy = "Equivalent";
    for (const selector of ["namespaceSelector", "objectSelector"]) {
      if (isEmptyRecord(matchConstraints[selector])) delete matchConstraints[selector];
    }
    if (Array.isArray(matchConstraints.resourceRules)) {
      matchConstraints.resourceRules = matchConstraints.resourceRules.map((value) => {
        const rule = { ...record(value) };
        if (rule.scope === "*") delete rule.scope;
        return rule;
      });
    }
    spec.matchConstraints = matchConstraints;
  }
  return spec;
}

function normalizeAdmissionBindingSpec(value) {
  const spec = { ...record(value) };
  if (Object.prototype.hasOwnProperty.call(spec, "matchResources")) {
    const matchResources = { ...record(spec.matchResources) };
    if (!Object.prototype.hasOwnProperty.call(matchResources, "matchPolicy")) matchResources.matchPolicy = "Equivalent";
    spec.matchResources = matchResources;
  }
  return spec;
}

function isEmptyRecord(value) {
  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.keys(value).length === 0;
}

function evaluatePacAdmissionState(inputValue) {
  const input = record(inputValue);
  const policy = record(input.policy);
  const binding = record(input.binding);
  const role = record(input.role);
  const roleBinding = record(input.roleBinding);
  const expected = record(input.expected);
  const namespace = stringOrNull(input.namespace);
  const policyMetadata = record(policy.metadata);
  const bindingMetadata = record(binding.metadata);
  const roleMetadata = record(role.metadata);
  const roleBindingMetadata = record(roleBinding.metadata);
  const policyAnnotations = record(policyMetadata.annotations);
  const bindingAnnotations = record(bindingMetadata.annotations);
  const roleAnnotations = record(roleMetadata.annotations);
  const roleBindingAnnotations = record(roleBindingMetadata.annotations);
  const policySpec = record(policy.spec);
  const bindingSpec = record(binding.spec);
  const policyStatus = record(policy.status);
  const typeChecking = record(policyStatus.typeChecking);
  const warnings = Array.isArray(typeChecking.expressionWarnings) ? typeChecking.expressionWarnings : [];
  const reasons = [];
  const targetId = stringOrNull(expected.targetId);
  const liveSpecSha256 = targetId === null
    ? null
    : liveAdmissionSpecSha256(targetId, expected.policyName, expected.bindingName, policySpec, bindingSpec);
  if (targetId === null) reasons.push("admission-target-id-missing");
  if (liveSpecSha256 !== expected.configSha256) reasons.push("admission-live-spec-sha256-mismatch");
  if (policyMetadata.name !== expected.policyName) reasons.push("policy-missing");
  if (bindingMetadata.name !== expected.bindingName) reasons.push("binding-missing");
  for (const [kind, annotations] of [["policy", policyAnnotations], ["binding", bindingAnnotations]]) {
    if (annotations["unidesk.ai/pac-provenance-version"] !== expected.version) reasons.push(`${kind}-version-mismatch`);
    if (annotations["unidesk.ai/pac-controller-identity"] !== expected.controllerIdentity) reasons.push(`${kind}-controller-identity-mismatch`);
    if (annotations["unidesk.ai/effective-config-sha256"] !== expected.configSha256) reasons.push(`${kind}-config-sha256-mismatch`);
  }
  if (policySpec.failurePolicy !== "Ignore") reasons.push("policy-failure-policy-not-ignore");
  if (bindingSpec.policyName !== expected.policyName) reasons.push("binding-policy-name-mismatch");
  if (!Array.isArray(bindingSpec.validationActions) || stableCanonicalJson(bindingSpec.validationActions) !== stableCanonicalJson(["Warn", "Audit"])) reasons.push("binding-validation-actions-not-warning-only");
  if (!Number.isInteger(policyMetadata.generation) || !Number.isInteger(policyStatus.observedGeneration) || policyStatus.observedGeneration < policyMetadata.generation) reasons.push("policy-generation-not-observed");
  if (warnings.length > 0) reasons.push("policy-expression-warning");
  if (roleMetadata.name !== "unidesk-pac-consumer-runner") reasons.push("default-role-missing");
  if (roleBindingMetadata.name !== "unidesk-pac-consumer-runner-default") reasons.push("default-rolebinding-missing");
  if (roleAnnotations["unidesk.ai/effective-config-sha256"] !== expected.rbacConfigSha256) reasons.push("default-role-config-sha256-mismatch");
  if (roleBindingAnnotations["unidesk.ai/effective-config-sha256"] !== expected.rbacConfigSha256) reasons.push("default-rolebinding-config-sha256-mismatch");
  const forbiddenVerbs = new Set(["create", "patch", "update", "delete", "deletecollection"]);
  const roleRules = Array.isArray(role.rules) ? role.rules : [];
  const roleHasMutation = roleRules.some((ruleValue) => {
    const rule = record(ruleValue);
    return (Array.isArray(rule.verbs) ? rule.verbs : []).some((verb) => forbiddenVerbs.has(verb));
  });
  if (roleHasMutation) reasons.push("default-role-declares-mutation");
  const expectedRoleRules = [
    { apiGroups: ["tekton.dev"], resources: ["pipelineruns", "taskruns"], verbs: ["get", "list", "watch"] },
    { apiGroups: [""], resources: ["pods", "pods/log"], verbs: ["get", "list", "watch"] },
  ];
  if (stableCanonicalJson(roleRules) !== stableCanonicalJson(expectedRoleRules)) reasons.push("default-role-rules-mismatch");
  const roleRef = record(roleBinding.roleRef);
  const subjects = Array.isArray(roleBinding.subjects) ? roleBinding.subjects.map(record) : [];
  if (roleRef.apiGroup !== "rbac.authorization.k8s.io" || roleRef.kind !== "Role" || roleRef.name !== "unidesk-pac-consumer-runner") reasons.push("default-rolebinding-role-ref-mismatch");
  if (namespace === null || subjects.length !== 1 || subjects[0].kind !== "ServiceAccount" || subjects[0].name !== "default" || subjects[0].namespace !== namespace) reasons.push("default-rolebinding-subject-mismatch");
  if (typeof input.defaultCanMutate !== "boolean") reasons.push("default-serviceaccount-mutation-probe-unavailable");
  if (input.defaultCanMutate === true) reasons.push("default-serviceaccount-can-mutate-tekton-runs");
  const timestamps = [policyMetadata.creationTimestamp, bindingMetadata.creationTimestamp]
    .filter((value) => typeof value === "string" && Number.isFinite(Date.parse(value)))
    .sort((left, right) => Date.parse(left) - Date.parse(right));
  const activeAfter = timestamps.length === 2 ? timestamps[1] : null;
  if (activeAfter === null) reasons.push("admission-creation-time-missing");
  return {
    configured: true,
    required: true,
    ready: reasons.length === 0,
    blocking: false,
    warning: reasons.length > 0,
    warnings: reasons,
    source: "live-admissionregistration-v1",
    policyName: stringOrNull(policyMetadata.name),
    bindingName: stringOrNull(bindingMetadata.name),
    version: stringOrNull(policyAnnotations["unidesk.ai/pac-provenance-version"]),
    controllerIdentity: stringOrNull(policyAnnotations["unidesk.ai/pac-controller-identity"]),
    configSha256: stringOrNull(policyAnnotations["unidesk.ai/effective-config-sha256"]),
    liveSpecSha256,
    policyUid: stringOrNull(policyMetadata.uid),
    bindingUid: stringOrNull(bindingMetadata.uid),
    policyGeneration: Number.isInteger(policyMetadata.generation) ? policyMetadata.generation : null,
    observedGeneration: Number.isInteger(policyStatus.observedGeneration) ? policyStatus.observedGeneration : null,
    rbacConfigSha256: stringOrNull(roleAnnotations["unidesk.ai/effective-config-sha256"]),
    defaultCanMutate: typeof input.defaultCanMutate === "boolean" ? input.defaultCanMutate : null,
    activeAfter,
    reasons,
    valuesPrinted: false,
  };
}

function classifyPacPipelineRun(consumerInput, itemInput) {
  const consumer = record(consumerInput);
  const item = record(itemInput);
  const metadata = record(item.metadata);
  const labels = record(metadata.labels);
  const annotations = record(metadata.annotations);
  const candidate = pipelineRunMatchesConsumer(consumer, item);
  const eventType = firstString(
    labels["pipelinesascode.tekton.dev/event-type"],
    annotations["pipelinesascode.tekton.dev/event-type"],
  );
  const repository = firstString(
    labels["pipelinesascode.tekton.dev/repository"],
    annotations["pipelinesascode.tekton.dev/repository"],
  );
  const managedBy = stringOrNull(labels["app.kubernetes.io/managed-by"]);
  const provider = stringOrNull(annotations["pipelinesascode.tekton.dev/git-provider"]);
  const expectedRepository = stringOrNull(consumer.repository);
  const provenance = record(consumer.deliveryProvenance);
  const admissionState = record(consumer.admissionState);
  const outer = candidate
    && eventType === "push"
    && expectedRepository !== null
    && repository === expectedRepository
    && managedBy === "pipelinesascode.tekton.dev"
    && provider === "gitea";
  const inner = candidate
    && !outer
    && labels["app.kubernetes.io/part-of"] === "hwlab-web-probe-sentinel"
    && labels["unidesk.ai/ci-system"] === "tekton"
    && annotations["unidesk.ai/source-authority"] === "gitea-snapshot"
    && typeof annotations["unidesk.ai/publish-gitops"] === "string";
  const provenanceRequired = provenance.required === true;
  const markerAnnotation = stringOrNull(provenance.markerAnnotation);
  const markerValue = stringOrNull(provenance.markerValue);
  const executionServiceAccountName = stringOrNull(provenance.executionServiceAccountName);
  const taskRunTemplate = record(record(item.spec).taskRunTemplate);
  const createdAt = stringOrNull(metadata.creationTimestamp);
  const activeAfter = stringOrNull(admissionState.activeAfter);
  const createdAfterAdmission = createdAt !== null
    && activeAfter !== null
    && Number.isFinite(Date.parse(createdAt))
    && Number.isFinite(Date.parse(activeAfter))
    && Date.parse(createdAt) >= Date.parse(activeAfter);
  const admissionProvenanceVerified = outer
    && provenanceRequired
    && admissionState.ready === true
    && admissionState.source === "live-admissionregistration-v1"
    && admissionState.policyName === provenance.policyName
    && admissionState.bindingName === provenance.bindingName
    && admissionState.version === provenance.version
    && admissionState.controllerIdentity === provenance.controllerIdentity
    && admissionState.configSha256 === provenance.configSha256
    && markerAnnotation !== null
    && markerValue !== null
    && annotations[markerAnnotation] === markerValue
    && executionServiceAccountName !== null
    && taskRunTemplate.serviceAccountName === executionServiceAccountName
    && createdAfterAdmission;

  const deliveryClass = outer
    ? "outer-pac-event"
    : inner
      ? "inner-deterministic-publish"
      : "unknown";
  const reason = outer
    ? admissionProvenanceVerified
      ? "admission-owned-pac-push-provenance-verified"
      : provenanceRequired
        ? "pac-push-metadata-observed-but-admission-provenance-unverified"
        : "observed-pac-push-metadata-matches-consumer"
    : inner
      ? "deterministic-sentinel-publish-without-proven-parent"
      : candidate
        ? "consumer-candidate-lacks-classification-evidence"
        : "not-a-consumer-candidate";
  return {
    deliveryClass,
    reason,
    candidate,
    deliveryAuthorityEligible: outer,
    deliveryOwner: outer ? admissionProvenanceVerified ? "pac-controller-admission" : "pac-controller-observed" : null,
    executionOwner: inner ? "tekton-child-unattached" : null,
    parentPipelineRun: null,
    parentRelation: inner ? "unproven" : null,
    metadataObservationOnly: outer && !admissionProvenanceVerified,
    admissionProvenanceVerified,
    admissionWarning: outer && !admissionProvenanceVerified ? {
      code: "pac-admission-provenance-unverified",
      blocking: false,
      reasons: Array.isArray(admissionState.reasons) ? admissionState.reasons : [],
    } : null,
    admissionPolicyReady: admissionState.ready === true,
    admissionPolicyName: stringOrNull(admissionState.policyName),
    admissionBindingName: stringOrNull(admissionState.bindingName),
    admissionConfigSha256: stringOrNull(admissionState.configSha256),
    admissionActiveAfter: activeAfter,
    createdAfterAdmission,
    valuesPrinted: false,
  };
}

function taskTerminalRecord(value) {
  const taskRun = record(value);
  const metadata = record(taskRun.metadata);
  const labels = record(metadata.labels);
  const pipelineTask = stringOrNull(labels["tekton.dev/pipelineTask"]);
  if (pipelineTask === null || !pacContractTasks.has(pipelineTask)) return null;
  const status = record(taskRun.status);
  const condition = Array.isArray(status.conditions)
    ? status.conditions.map(record).find((item) => item.type === "Succeeded") || {}
    : {};
  const conditionStatus = stringOrNull(condition.status);
  const normalizedStatus = conditionStatus === "True"
    ? "succeeded"
    : conditionStatus === "False"
      ? "failed"
      : "running";
  return {
    event: "pac-task-terminal",
    pipelineTask,
    taskRun: stringOrNull(metadata.name),
    status: normalizedStatus,
    reason: stringOrNull(condition.reason),
    results: Array.isArray(status.results)
      ? status.results.map(record).map((item) => stringOrNull(item.name)).filter(Boolean)
      : [],
  };
}

function parsePacLogRecords(value) {
  const records = [];
  const lines = String(value || "").split(/\r?\n/u);
  let pending = "";
  for (const line of lines) {
    const trimmed = line.trim();
    if (pending.length === 0) {
      if (!trimmed.startsWith("{")) continue;
      pending = trimmed;
    } else {
      pending += `\n${line}`;
    }
    try {
      records.push(JSON.parse(pending));
      pending = "";
    } catch {
      if (pending.length > 2 * 1024 * 1024) pending = "";
    }
  }
  return records;
}

function exactTaskTerminal(records, pipelineTask) {
  return [...records].reverse().find((item) => item.event === "pac-task-terminal"
    && item.pipelineTask === pipelineTask) || null;
}

function terminalSource(task, marker, markerStatus = "skipped", markerSource = "structured-log-marker") {
  return {
    present: task !== null || marker !== null,
    status: task?.status || (marker === null ? "missing" : markerStatus),
    source: task !== null ? "taskrun-condition" : marker === null ? null : markerSource,
    taskRun: task?.taskRun || null,
    reason: task?.reason || marker?.reason || null,
    results: Array.isArray(task?.results) ? task.results : [],
    markerPresent: marker !== null,
    markerSource: marker === null ? null : markerSource,
  };
}

function extractPacSourceObservation(recordsInput) {
  const records = Array.isArray(recordsInput) ? recordsInput.map(record) : [];
  const featureConfigSchema = featureConfigSchemaObservation(records);
  const plan = [...records].reverse().find((item) => item.event === "pac-delivery-plan" || item.event === "g14-ci-plan") || null;
  const collectMarker = exactSkipMarker(records, "collect-artifacts");
  const promoteMarker = exactSkipMarker(records, "gitops-promote");
  const runtimeGitopsVerifyMarker = exactRuntimeGitopsVerifyMarker(records);
  const planTask = exactTaskTerminal(records, "plan-artifacts");
  const collectTask = exactTaskTerminal(records, "collect-artifacts");
  const promoteTask = exactTaskTerminal(records, "gitops-promote");
  if (plan === null && collectMarker === null && promoteMarker === null && runtimeGitopsVerifyMarker === null && planTask === null && collectTask === null && promoteTask === null) return null;

  const affected = stringArray(plan?.affectedServices);
  const rollout = stringArray(plan?.rolloutServices);
  const build = stringArray(plan?.buildServices);
  const reused = stringArray(plan?.reusedServices);
  const sourceCommit = stringOrNull(plan?.sourceCommitId);
  const planShapeValid = affected !== null && rollout !== null && build !== null;
  const sourceCommitValid = sourceCommit !== null && /^[0-9a-f]{40}$/iu.test(sourceCommit);
  const noRuntimeChangePlan = planShapeValid
    && affected.length === 0
    && rollout.length === 0
    && build.length === 0;
  const noRuntimeChangeMarkers = collectMarker !== null && promoteMarker !== null;
  const skipMarkerSeen = collectMarker !== null || promoteMarker !== null;
  const skipMarkerConflict = skipMarkerSeen && !noRuntimeChangePlan;
  const runtimeGitopsVerifyMarkerConflict = runtimeGitopsVerifyMarker !== null
    && (!noRuntimeChangePlan || promoteMarker !== null);
  const deliveryTerminalReady = planTask?.status === "succeeded"
    && collectTask?.status === "succeeded"
    && promoteTask?.status === "succeeded";
  const deliveryTerminalFailed = planTask?.status === "failed"
    || collectTask?.status === "failed"
    || promoteTask?.status === "failed";

  let mode = "inconsistent";
  let valid = false;
  let reason = "structured-plan-or-terminal-marker-is-incomplete";
  if (planShapeValid && sourceCommitValid && noRuntimeChangePlan && noRuntimeChangeMarkers && runtimeGitopsVerifyMarker === null) {
    mode = "no-runtime-change";
    valid = true;
    reason = "no-build-no-rollout-plan";
  } else if (planShapeValid && sourceCommitValid && noRuntimeChangePlan && runtimeGitopsVerifyMarker !== null && !runtimeGitopsVerifyMarkerConflict && deliveryTerminalReady) {
    mode = "runtime-gitops-verify";
    valid = true;
    reason = "no-build-no-rollout-plan-gitops-verify";
  } else if (planShapeValid && sourceCommitValid && !noRuntimeChangePlan && runtimeGitopsVerifyMarker === null && !skipMarkerConflict && deliveryTerminalReady) {
    mode = "delivery";
    valid = true;
    reason = "artifact-or-runtime-delivery-required";
  } else if (!sourceCommitValid) {
    reason = "source-commit-invalid-or-missing";
  } else if (!planShapeValid) {
    reason = "delivery-plan-shape-invalid-or-missing";
  } else if (runtimeGitopsVerifyMarkerConflict) {
    reason = "runtime-gitops-verify-marker-conflicts-with-plan-or-skip-marker";
  } else if (skipMarkerConflict) {
    reason = "no-runtime-change-marker-conflicts-with-delivery-plan";
  } else if (deliveryTerminalFailed) {
    reason = "delivery-terminal-failed";
  } else if (noRuntimeChangePlan && runtimeGitopsVerifyMarker !== null) {
    reason = "runtime-gitops-verify-terminal-evidence-incomplete";
  } else if (!noRuntimeChangePlan) {
    reason = "delivery-terminal-evidence-incomplete";
  }

  const planMarkerSource = plan?.event === "pac-delivery-plan"
    ? "pac-delivery-plan-structured-log"
    : plan?.event === "g14-ci-plan"
      ? "g14-ci-plan-structured-log"
      : "delivery-plan-structured-log";
  return {
    schemaVersion: "v1",
    contract: plan?.event === "pac-delivery-plan" ? "pac-delivery-plan-v1" : "hwlab-g14-ci-plan",
    mode,
    valid,
    reason,
    sourceCommit,
    plan: {
      affectedServiceCount: affected?.length ?? null,
      rolloutServiceCount: rollout?.length ?? null,
      buildServiceCount: build?.length ?? null,
      reusedServiceCount: reused?.length ?? null,
    },
    terminal: {
      planArtifacts: planTask?.status || (plan === null ? "missing" : "observed"),
      collectArtifacts: collectMarker !== null ? "no-build-no-rollout-plan" : collectTask?.status || "missing",
      gitopsPromote: promoteMarker !== null ? "no-build-no-rollout-plan" : promoteTask?.status || "missing",
    },
    terminalSources: {
      planArtifacts: terminalSource(planTask, plan, "observed", planMarkerSource),
      collectArtifacts: terminalSource(collectTask, collectMarker),
      gitopsPromote: runtimeGitopsVerifyMarker === null
        ? terminalSource(promoteTask, promoteMarker)
        : terminalSource(promoteTask, runtimeGitopsVerifyMarker, "continuing", "runtime-gitops-verify-structured-log"),
    },
    featureConfigSchema,
    valuesPrinted: false,
  };
}

function digestOf(item) {
  const digest = stringOrNull(item.digest);
  if (digest !== null) return digest;
  const digestRef = stringOrNull(item.digestRef);
  return digestRef !== null && digestRef.includes("@") ? digestRef.split("@").slice(1).join("@") : null;
}

function extractPacArtifactEvidence(recordsInput, logText) {
  const records = Array.isArray(recordsInput) ? recordsInput.map(record) : [];
  const envReuseRecord = [...records].reverse().find((item) => item.phase === "env-reuse") || null;
  const imageBuildRecord = [...records].reverse().find((item) => item.phase === "image-build" || item.phase === "image-build-complete") || null;
  const stageTimings = Object.assign({}, ...records.map((item) => record(item.stageTimings)));
  const sourceObservation = extractPacSourceObservation(records);
  const catalog = [...records].reverse().find((item) => item.status === "published"
    && Array.isArray(item.services)
    && typeof item.registryVerified === "boolean") || null;
  const publish = [...records].reverse().find((item) => item.phase === "gitops-publish" || stringOrNull(item.gitopsCommit) !== null) || null;
  const image = publish || [...records].reverse().find((item) => stringOrNull(item.imageStatus) !== null
    || item.status === "reused"
    || item.status === "built") || null;
  const logLines = String(logText || "").split(/\r?\n/u);
  const gitopsCommit = stringOrNull(image?.gitopsCommit)
    || [...logLines].reverse().map((line) => line.match(/^\[[^\]]+\s+([0-9a-f]{7,64})\]/u)?.[1] || null).find(Boolean)
    || null;
  const catalogDigests = catalog === null
    ? []
    : [...new Set(catalog.services.map(record).map(digestOf).filter((value) => /^sha256:[0-9a-f]{64}$/iu.test(value || "")))];
  const loggedDigests = [...new Set(logLines.flatMap((line) => [...line.matchAll(/"(?:digest|environmentDigest)"\s*:\s*"(sha256:[0-9a-f]{64})"/gu)].map((match) => match[1])))];
  const digests = catalogDigests.length > 0 ? catalogDigests : loggedDigests;
  const envHeaderIndex = logLines.findIndex((line) => /^ENV_REUSE\s+NODE_DEPS\s+/u.test(line.trim()));
  let humanEnv = null;
  if (envHeaderIndex >= 0) {
    const row = (logLines.slice(envHeaderIndex + 1).find((line) => line.trim()) || "").trim().split(/\s+/u);
    if (row.length >= 5) humanEnv = { envReuse: row[0], nodeDeps: row[1], buildPackage: row[2], buildNetwork: row[3], cache: row[4] };
  }
  if (catalog !== null) {
    const reusedCount = Number.isInteger(catalog.reusedCount) ? catalog.reusedCount : null;
    const publishedCount = Number.isInteger(catalog.publishedCount) ? catalog.publishedCount : null;
    return {
      imageStatus: reusedCount !== null && reusedCount > 0 && publishedCount === 0 ? "reused" : "published",
      envIdentity: null,
      envReuse: reusedCount !== null && reusedCount > 0 ? "hit" : null,
      nodeDepsReuse: null,
      buildCache: null,
      digest: digests.length === 1 ? digests[0] : null,
      digests,
      gitopsCommit,
      sourceCommit: stringOrNull(catalog.sourceCommitId) || sourceObservation?.sourceCommit || null,
      runtimeSourceCommit: null,
      action: "artifact-catalog-published",
      reason: reusedCount !== null && reusedCount > 0 ? "reused-env-catalog" : "artifact-catalog",
      catalog: {
        present: true,
        status: stringOrNull(catalog.status),
        sourceCommit: stringOrNull(catalog.sourceCommitId),
        registryVerified: catalog.registryVerified === true,
        publishedCount,
        reusedCount,
        requiredServiceCount: Number.isInteger(catalog.requiredServiceCount) ? catalog.requiredServiceCount : null,
        digestCount: digests.length,
        source: "collect-artifacts-structured-log",
        valuesPrinted: false,
      },
      sourceObservation,
      valuesPrinted: false,
    };
  }
  if (image !== null) {
    const env = record(image.envReuse);
    const reuseEnv = record(envReuseRecord?.envReuse);
    return {
      imageStatus: stringOrNull(image.imageStatus) || stringOrNull(image.status)
        || (imageBuildRecord !== null || stringOrNull(image.digestRef) !== null ? "built" : null),
      envIdentity: stringOrNull(image.envIdentity) || stringOrNull(envReuseRecord?.envIdentity),
      envReuse: stringOrNull(env.dependencyReuse) || stringOrNull(env.status) || stringOrNull(image.envReuseStatus)
        || stringOrNull(reuseEnv.dependencyReuse) || stringOrNull(reuseEnv.status) || stringOrNull(envReuseRecord?.envReuseStatus),
      nodeDepsReuse: null,
      buildCache: null,
      digest: digestOf(image) || (digests.length === 1 ? digests[0] : null),
      digests,
      gitopsCommit,
      sourceCommit: stringOrNull(image.sourceCommit) || sourceObservation?.sourceCommit || null,
      runtimeSourceCommit: stringOrNull(image.runtimeSourceCommit),
      baselineSourceCommit: stringOrNull(image.baselineSourceCommit),
      action: stringOrNull(image.action),
      reason: stringOrNull(image.reason),
      stageTimings,
      sourceObservation,
      valuesPrinted: false,
    };
  }
  if (sourceObservation !== null) {
    return {
      imageStatus: sourceObservation.mode === "no-runtime-change" && sourceObservation.valid === true ? "retained" : null,
      envIdentity: null,
      envReuse: null,
      nodeDepsReuse: null,
      buildCache: null,
      digest: null,
      digests: [],
      gitopsCommit,
      sourceCommit: sourceObservation.sourceCommit || null,
      runtimeSourceCommit: null,
      action: sourceObservation.mode,
      reason: sourceObservation.reason,
      sourceObservation,
      valuesPrinted: false,
    };
  }
  return {
    imageStatus: humanEnv !== null ? "published" : null,
    envIdentity: null,
    envReuse: humanEnv?.envReuse || null,
    nodeDepsReuse: humanEnv?.nodeDeps || null,
    buildCache: humanEnv?.cache || null,
    buildPackage: humanEnv?.buildPackage || null,
    buildNetwork: humanEnv?.buildNetwork || null,
    digest: digests.length === 1 ? digests[0] : null,
    digests,
    gitopsCommit,
    sourceCommit: null,
    sourceObservation: null,
    valuesPrinted: false,
  };
}

function evaluatePacStatus(inputValue) {
  const input = record(inputValue);
  const registryApplicability = input.registryApplicability === "not-configured"
    ? "not-configured"
    : input.registryApplicability === "configured" || stringOrNull(input.imageRepository) !== null
      ? "configured"
      : "not-configured";
  const artifact = record(input.artifact);
  const argo = record(input.argo);
  const runtime = record(input.runtime);
  const sourceObservation = record(artifact.sourceObservation);
  const revisionRelation = normalizeGitopsRevisionRelation(argo.revisionRelation);
  const gitopsRelation = stringOrNull(revisionRelation.relation) || "unknown";
  const sourceCommit = stringOrNull(input.sourceCommit);
  const registryDigest = stringOrNull(input.registryDigest);
  const artifactDigest = stringOrNull(artifact.digest);
  const expectedDigest = registryDigest || artifactDigest;
  const runtimeImage = stringOrNull(runtime.image);
  const runtimeDigest = stringOrNull(runtime.digest) || digestFromImage(runtimeImage);
  const runtimeMatches = expectedDigest === null || runtimeDigest === expectedDigest;
  const runtimeReady = Number.isInteger(runtime.replicas)
    && runtime.replicas > 0
    && runtime.readyReplicas === runtime.replicas
    && (!Number.isInteger(runtime.updatedReplicas) || runtime.updatedReplicas === runtime.replicas)
    && (!Number.isInteger(runtime.generation) || !Number.isInteger(runtime.observedGeneration) || runtime.observedGeneration >= runtime.generation);
  const selectedArtifactDigests = [...new Set([
    artifactDigest,
    ...(Array.isArray(artifact.digests) ? artifact.digests : []),
  ].filter((value) => typeof value === "string" && value.length > 0))];
  const selectedArtifactMatchesRuntime = runtimeDigest !== null && selectedArtifactDigests.includes(runtimeDigest);
  const registryMatchesArtifact = registryDigest === null || artifactDigest === null || registryDigest === artifactDigest;
  const healthUrl = stringOrNull(input.healthUrl);
  const healthStatus = stringOrNull(input.healthStatus);
  const healthReady = healthUrl === null || healthStatus === "200";
  const gitopsReady = stringOrNull(artifact.gitopsCommit) !== null && stringOrNull(argo.revision) !== null;
  const gitopsRevisionAligned = gitopsRelation === "exact" || gitopsRelation === "descendant";
  const deliveryDisabled = artifact.imageStatus === "disabled";
  const deliverySkipped = artifact.imageStatus === "skipped";
  const sourceObservationMode = stringOrNull(sourceObservation.mode);
  const hwlabCatalogDelivery = (sourceObservationMode === "delivery" || sourceObservationMode === "runtime-gitops-verify")
    && sourceObservation.contract === "hwlab-g14-ci-plan";
  const noRuntimeChange = sourceObservationMode === "no-runtime-change";
  const catalog = record(artifact.catalog);
  const catalogPresent = catalog.present === true;
  const catalogSourceCommit = stringOrNull(catalog.sourceCommit);
  const catalogSourceMatches = catalogSourceCommit !== null && catalogSourceCommit === sourceCommit;
  const catalogDeliveryEvidence = (sourceObservationMode === "delivery" || sourceObservationMode === "runtime-gitops-verify")
    && sourceObservation.valid === true
    && catalogPresent
    && catalog.status === "published"
    && catalog.registryVerified === true
    && catalogSourceMatches;
  const registryEvidenceReady = input.registryPresent === true || catalogDeliveryEvidence;
  const sourceObservationInconsistent = sourceObservationMode === "inconsistent"
    || (sourceObservationMode !== null && sourceObservation.valid !== true);
  const observationSourceCommit = stringOrNull(sourceObservation.sourceCommit);
  const observationSourceMatches = sourceCommit !== null && observationSourceCommit === sourceCommit;
  const retainedRevision = stringOrNull(argo.revision);
  const retainedDigestReady = runtimeDigest !== null && /^sha256:[0-9a-f]{64}$/iu.test(runtimeDigest);
  const retainedOutputConflict = noRuntimeChange
    && (stringOrNull(artifact.gitopsCommit) !== null
      || artifactDigest !== null
      || selectedArtifactDigests.length > 0);

  let code = "pac-diagnostics-not-applicable";
  let phase = "not-applicable";
  let ok = true;
  let hint = "consumer did not expose artifact or runtime alignment evidence";
  if (deliveryDisabled) {
    code = "pac-delivery-disabled";
    phase = "disabled";
    hint = "delivery is disabled by YAML; registry, GitOps and runtime artifacts are intentionally absent";
  } else if (!sourceCommit) {
    ok = false;
    code = "pac-source-unknown";
    phase = "source-unknown";
    hint = "latest PaC PipelineRun did not expose a source commit";
  } else if (sourceObservationInconsistent) {
    ok = false;
    code = "pac-source-observation-inconsistent";
    phase = "source-observation-inconsistent";
    hint = "structured delivery plan or terminal evidence is incomplete or contradictory";
  } else if (sourceObservationMode !== null && !observationSourceMatches) {
    ok = false;
    code = "pac-source-observation-mismatch";
    phase = "source-observation-mismatch";
    hint = "the structured source observation does not belong to the selected PipelineRun source commit";
  } else if (noRuntimeChange && retainedOutputConflict) {
    ok = false;
    code = "pac-retained-output-conflict";
    phase = "source-only-output-conflict";
    hint = "a no-runtime-change PipelineRun unexpectedly reported a new artifact or GitOps output";
  } else if (noRuntimeChange && retainedRevision === null) {
    ok = false;
    code = "pac-retained-gitops-missing";
    phase = "retained-gitops-missing";
    hint = "the no-runtime-change observation is valid but the retained Argo GitOps revision is missing";
  } else if (noRuntimeChange && gitopsRelation !== "retained") {
    ok = false;
    code = "pac-retained-revision-unproven";
    phase = "retained-revision-unproven";
    hint = "the retained GitOps revision was not linked to the structured no-runtime-change observation";
  } else if (noRuntimeChange && !runtimeReady) {
    ok = false;
    code = "pac-retained-runtime-not-ready";
    phase = "retained-runtime-not-ready";
    hint = "the retained runtime ready replicas do not match the desired replica count";
  } else if (noRuntimeChange && !retainedDigestReady) {
    ok = false;
    code = "pac-retained-runtime-digest-missing";
    phase = "retained-runtime-digest-missing";
    hint = "the retained runtime is not pinned to a visible sha256 digest";
  } else if (noRuntimeChange && !healthReady) {
    ok = false;
    code = "pac-retained-health-not-ready";
    phase = "retained-health-not-ready";
    hint = "the retained runtime health endpoint is not ready";
  } else if (noRuntimeChange) {
    code = "pac-ready-no-runtime-change";
    phase = "ready-no-runtime-change";
    hint = "the successful source observation requires no artifact, GitOps or runtime change; retained runtime provenance and minimal health remain ready";
  } else if (catalogPresent && !catalogSourceMatches) {
    ok = false;
    code = "pac-artifact-catalog-source-mismatch";
    phase = "artifact-catalog-source-mismatch";
    hint = "the artifact catalog source commit does not match the selected PipelineRun";
  } else if (hwlabCatalogDelivery && (!catalogPresent || catalog.status !== "published")) {
    ok = false;
    code = "pac-artifact-catalog-missing";
    phase = "artifact-catalog-missing";
    hint = "the HWLAB delivery plan completed but a published artifact catalog is not visible";
  } else if (hwlabCatalogDelivery && catalog.registryVerified !== true) {
    ok = false;
    code = "pac-artifact-catalog-unverified";
    phase = "artifact-catalog-unverified";
    hint = "the HWLAB artifact catalog did not prove registry verification";
  } else if (hwlabCatalogDelivery && selectedArtifactDigests.length === 0) {
    ok = false;
    code = "pac-artifact-catalog-digest-missing";
    phase = "artifact-catalog-digest-missing";
    hint = "the HWLAB artifact catalog did not expose any sha256 digest";
  } else if (registryApplicability === "configured" && stringOrNull(input.imageRepository) !== null && !registryEvidenceReady) {
    ok = false;
    code = "pac-registry-missing";
    phase = "source-ready-registry-missing";
    hint = "PaC source commit is known but neither the configured registry tag nor a verified artifact catalog is visible";
  } else if (!registryMatchesArtifact) {
    ok = false;
    code = "pac-artifact-registry-mismatch";
    phase = "artifact-registry-mismatch";
    hint = "PipelineRun artifact digest does not match the configured registry digest";
  } else if (!gitopsReady) {
    ok = false;
    code = "pac-gitops-missing";
    phase = "artifact-ready-gitops-missing";
    hint = "PipelineRun completed but its GitOps commit is not visible";
  } else if (!gitopsRevisionAligned) {
    ok = false;
    code = `pac-argo-revision-${gitopsRelation}`;
    phase = `gitops-ready-argo-revision-${gitopsRelation}`;
    hint = `Argo revision relation is ${gitopsRelation}; only exact or commit-graph-proven descendant is deployable`;
  } else if (catalogDeliveryEvidence && !selectedArtifactMatchesRuntime) {
    ok = false;
    code = "pac-catalog-artifact-runtime-mismatch";
    phase = "artifact-catalog-runtime-mismatch";
    hint = "the runtime digest is not present in the verified artifact catalog for this PipelineRun";
  } else if (gitopsRelation === "descendant" && !selectedArtifactMatchesRuntime) {
    ok = false;
    code = "pac-descendant-artifact-runtime-mismatch";
    phase = "argo-descendant-runtime-mismatch";
    hint = "a GitOps descendant is ready only when the selected PipelineRun artifact digest exactly matches the runtime digest";
  } else if (!runtimeMatches) {
    ok = false;
    code = "pac-runtime-not-aligned";
    phase = "argo-ready-runtime-mismatch";
    hint = "runtime image digest does not match the artifact digest produced by the selected PipelineRun";
  } else if (!runtimeReady) {
    ok = false;
    code = "pac-runtime-not-ready";
    phase = "runtime-replicas-not-ready";
    hint = "runtime ready replicas do not match the desired replica count";
  } else if (!healthReady) {
    ok = false;
    code = "pac-health-not-ready";
    phase = "runtime-ready-health-pending";
    hint = "runtime image is aligned but the configured health endpoint is not ready";
  } else if (artifactDigest || selectedArtifactDigests.length > 0 || stringOrNull(input.imageRepository) !== null) {
    code = deliverySkipped
      ? "pac-ready-runtime-unchanged"
      : gitopsRelation === "descendant"
        ? "pac-ready-gitops-descendant"
        : "pac-ready-gitops-exact";
    phase = "ready";
    hint = deliverySkipped
      ? "YAML-declared runtime inputs are unchanged; the existing image, GitOps manifest, runtime and health remain aligned"
      : gitopsRelation === "descendant"
        ? "the observed GitOps revision is a commit-graph-proven descendant and the selected artifact, runtime and minimal health are aligned"
        : "the observed GitOps revision exactly matches and the artifact, runtime and minimal health are aligned";
  }

  return {
    ok,
    code,
    phase,
    hint,
    sourceCommit,
    runtimeSourceCommit: stringOrNull(input.runtimeSourceCommit),
    imageRepository: stringOrNull(input.imageRepository),
    registryProbeBase: stringOrNull(input.registryProbeBase),
    imageTag: stringOrNull(input.imageTag),
    registry: {
      applicability: registryApplicability,
      status: registryApplicability === "configured" ? (registryEvidenceReady ? "present" : "missing") : "not-configured",
      present: registryApplicability === "configured" ? registryEvidenceReady : null,
      probePresent: input.registryPresent === true,
      catalogVerified: catalogDeliveryEvidence,
      digest: registryDigest,
      url: stringOrNull(input.registryUrl),
    },
    selectedArtifactDigests,
    gitops: {
      branch: stringOrNull(input.gitopsBranch),
      manifestPath: stringOrNull(input.gitopsManifestPath),
      commit: noRuntimeChange ? retainedRevision : stringOrNull(artifact.gitopsCommit) || retainedRevision,
      revisionRelation,
    },
    argo: {
      sync: stringOrNull(argo.sync),
      health: stringOrNull(argo.health),
      revision: retainedRevision,
      repoURL: stringOrNull(argo.repoURL),
      targetRevision: stringOrNull(argo.targetRevision),
      revisionRelation,
    },
    runtime: {
      image: runtimeImage,
      digest: runtimeDigest,
      readyReplicas: runtime.readyReplicas ?? null,
      replicas: runtime.replicas ?? null,
    },
    health: { url: healthUrl, status: healthStatus, ready: healthReady },
    pipelineRun: stringOrNull(input.pipelineRun),
    deliveryDisabled,
    deliverySkipped,
    deliveryMode: noRuntimeChange ? "no-runtime-change" : sourceObservationMode || "delivery",
    sourceObservation: Object.keys(sourceObservation).length > 0 ? sourceObservation : null,
    provenance: noRuntimeChange ? {
      relation: "retained",
      sourceCommit,
      gitopsRevision: retainedRevision,
      runtimeImage,
      runtimeDigest,
      newArtifact: false,
      newGitopsRevision: false,
      runtimeChanged: false,
      valuesPrinted: false,
    } : {
      relation: gitopsRelation,
      sourceCommit,
      gitopsRevision: retainedRevision,
      runtimeImage,
      runtimeDigest,
      valuesPrinted: false,
    },
    valuesPrinted: false,
  };
}

function evaluatePacNodeStatusSnapshot(inputValue) {
  const input = record(inputValue);
  const consumers = Array.isArray(input.consumers) ? input.consumers.map(record) : [];
  const pipelineRuns = Array.isArray(record(input.pipelineRuns).items) ? input.pipelineRuns.items.map(record) : [];
  const applications = Array.isArray(record(input.applications).items) ? input.applications.items.map(record) : [];
  const deployments = Array.isArray(record(input.deployments).items) ? input.deployments.items.map(record) : [];
  const readErrors = Array.isArray(input.readErrors) ? input.readErrors.map(record) : [];
  const readErrorStages = new Set(readErrors.map((item) => stringOrNull(item.stage)).filter(Boolean));

  function condition(item) {
    const conditions = Array.isArray(record(item.status).conditions) ? item.status.conditions.map(record) : [];
    const value = conditions.find((candidate) => candidate.type === "Succeeded") || {};
    return { status: stringOrNull(value.status), reason: stringOrNull(value.reason) };
  }

  function mapParams(value) {
    const out = {};
    for (const item of Array.isArray(value) ? value.map(record) : []) {
      if (typeof item.name !== "string") continue;
      out[item.name] = typeof item.value === "string" ? item.value : JSON.stringify(item.value);
    }
    return out;
  }

  function sourceCommit(item) {
    const metadata = record(item.metadata);
    const labels = record(metadata.labels);
    const annotations = record(metadata.annotations);
    const params = mapParams(record(item.spec).params);
    return firstString(
      labels["pipelinesascode.tekton.dev/sha"],
      labels["pipelinesascode.tekton.dev/commit"],
      labels["agentrun.pikastech.local/source-commit"],
      labels["unidesk.ai/source-commit"],
      labels["hwlab.pikastech.local/source-commit"],
      annotations["pipelinesascode.tekton.dev/sha"],
      annotations["pipelinesascode.tekton.dev/commit"],
      annotations["unidesk.ai/source-commit"],
      params.revision,
      params.source_revision,
      params.sourceCommit,
      params.source_commit,
      params.git_sha,
      params.sha,
      params.commit,
    );
  }

  function deploymentSourceCommit(item) {
    const templateMetadata = record(record(record(item.spec).template).metadata);
    const labels = record(templateMetadata.labels);
    const annotations = record(templateMetadata.annotations);
    return firstString(
      labels["unidesk.ai/source-commit"],
      labels["hwlab.pikastech.local/source-commit"],
      labels["agentrun.pikastech.local/source-commit"],
      annotations["unidesk.ai/source-commit"],
      annotations["hwlab.pikastech.local/source-commit"],
      annotations["agentrun.pikastech.local/source-commit"],
    );
  }

  function boundedMessage(value) {
    if (typeof value !== "string") return null;
    return value
      .replace(/(authorization\s*[:=]\s*)(?:bearer\s+)?\S+/giu, "$1[REDACTED]")
      .replace(/(token|password|secret)(\s*[:=]\s*)\S+/giu, "$1$2[REDACTED]")
      .replace(/\s+/gu, " ")
      .trim()
      .slice(0, 480) || null;
  }

  function pipelineSummary(item) {
    if (item === null) return {};
    const pipelineCondition = condition(item);
    return {
      name: firstString(record(item.metadata).name),
      status: pipelineCondition.status,
      reason: pipelineCondition.reason,
      sourceCommit: sourceCommit(item),
      durationSeconds: durationSeconds(item),
      valuesPrinted: false,
    };
  }

  function workloadSummary(item) {
    const metadata = record(item.metadata);
    const spec = record(item.spec);
    const status = record(item.status);
    const podSpec = record(record(record(spec.template).spec));
    const containers = Array.isArray(podSpec.containers) ? podSpec.containers.map(record) : [];
    const image = firstString(containers[0]?.image);
    return {
      namespace: firstString(metadata.namespace),
      deployment: firstString(metadata.name),
      readyReplicas: Number.isInteger(status.readyReplicas) ? status.readyReplicas : 0,
      replicas: Number.isInteger(spec.replicas) ? spec.replicas : null,
      sourceCommit: deploymentSourceCommit(item),
      image,
      digest: digestFromImage(image),
      valuesPrinted: false,
    };
  }

  function argoDegradation(application) {
    const appStatus = record(application?.status);
    const resources = Array.isArray(appStatus.resources) ? appStatus.resources.map(record) : [];
    const degraded = resources.find((item) => item.status === "OutOfSync"
      || record(item.health).status === "Degraded"
      || record(item.health).status === "Missing")
      || resources.find((item) => item.status !== "Synced"
        || (stringOrNull(record(item.health).status) !== null && record(item.health).status !== "Healthy"))
      || null;
    const conditions = Array.isArray(appStatus.conditions) ? appStatus.conditions.map(record) : [];
    const operationState = record(appStatus.operationState);
    const conditionValue = conditions[0]
      || (stringOrNull(operationState.phase) !== null && operationState.phase !== "Succeeded"
        ? { type: operationState.phase, message: operationState.message }
        : null);
    return {
      firstDegradedResource: degraded === null ? null : {
        group: firstString(degraded.group),
        kind: firstString(degraded.kind),
        namespace: firstString(degraded.namespace),
        name: firstString(degraded.name),
        status: firstString(degraded.status),
        health: firstString(record(degraded.health).status),
      },
      firstCondition: conditionValue === null ? null : {
        type: firstString(record(conditionValue).type),
        message: boundedMessage(record(conditionValue).message),
      },
    };
  }

  function durationSeconds(item) {
    const status = record(item.status);
    const start = stringOrNull(status.startTime);
    const completed = stringOrNull(status.completionTime);
    if (start === null || !Number.isFinite(Date.parse(start))) return null;
    const end = completed !== null && Number.isFinite(Date.parse(completed)) ? Date.parse(completed) : Date.now();
    return Math.max(0, Math.round((end - Date.parse(start)) / 1000));
  }

  function applicationFor(consumer) {
    return applications.find((item) => {
      const metadata = record(item.metadata);
      return metadata.namespace === consumer.argoNamespace && metadata.name === consumer.argoApplication;
    }) || null;
  }

  function deploymentTarget(consumer, application) {
    const params = record(consumer.params);
    const prefix = consumer.id === "unidesk-host" ? "unidesk_host_" : "";
    const runtimeNamespace = firstString(params[`${prefix}runtime_namespace`], params.runtime_namespace);
    const runtimeDeployment = firstString(params[`${prefix}runtime_deployment`], params.runtime_deployment);
    if (runtimeNamespace !== null && runtimeDeployment !== null) return { namespace: runtimeNamespace, name: runtimeDeployment };
    const resources = Array.isArray(record(application?.status).resources) ? application.status.resources.map(record) : [];
    const deployment = resources.find((item) => item.kind === "Deployment" && stringOrNull(item.namespace) !== null && stringOrNull(item.name) !== null);
    return deployment === undefined ? null : { namespace: deployment.namespace, name: deployment.name };
  }

  const rows = consumers.map((consumer) => {
    const candidates = pipelineRuns
      .filter((item) => record(item.metadata).namespace === consumer.namespace && pipelineRunMatchesConsumer(consumer, item))
      .map((item) => ({ item, classification: classifyPacPipelineRun(consumer, item) }))
      .filter(({ classification }) => classification.deliveryClass === "outer-pac-event" && classification.deliveryAuthorityEligible === true)
      .sort((left, right) => Date.parse(record(right.item.metadata).creationTimestamp || 0) - Date.parse(record(left.item.metadata).creationTimestamp || 0))
      .map(({ item }) => item);
    const latest = candidates[0] || null;
    const expectedSourceCommit = stringOrNull(consumer.expectedSourceCommit);
    const exact = expectedSourceCommit === null
      ? null
      : candidates.find((item) => sourceCommit(item) === expectedSourceCommit) || null;
    const selected = exact || latest;
    const pipelineCondition = selected === null ? { status: null, reason: null } : condition(selected);
    const application = applicationFor(consumer);
    const appStatus = record(application?.status);
    const appSync = record(appStatus.sync);
    const appHealth = record(appStatus.health);
    const appSpec = record(application?.spec);
    const appSource = record(appSpec.source ?? (Array.isArray(appSpec.sources) ? appSpec.sources[0] : null));
    const argoDegraded = argoDegradation(application);
    const target = deploymentTarget(consumer, application);
    const deployment = target === null ? null : deployments.find((item) => {
      const metadata = record(item.metadata);
      return metadata.namespace === target.namespace && metadata.name === target.name;
    }) || null;
    const deploymentSpec = record(deployment?.spec);
    const deploymentStatus = record(deployment?.status);
    const podSpec = record(record(record(deploymentSpec.template).spec));
    const containers = Array.isArray(podSpec.containers) ? podSpec.containers.map(record) : [];
    const image = firstString(containers[0]?.image);
    const digest = digestFromImage(image);
    const desired = Number.isInteger(deploymentSpec.replicas) ? deploymentSpec.replicas : null;
    const readyReplicas = Number.isInteger(deploymentStatus.readyReplicas) ? deploymentStatus.readyReplicas : 0;
    const updatedReplicas = Number.isInteger(deploymentStatus.updatedReplicas) ? deploymentStatus.updatedReplicas : 0;
    const generation = Number.isInteger(record(deployment?.metadata).generation) ? deployment.metadata.generation : null;
    const observedGeneration = Number.isInteger(deploymentStatus.observedGeneration) ? deploymentStatus.observedGeneration : null;
    const pipelineReadReady = !readErrorStages.has("pipeline-runs");
    const argoReadReady = !readErrorStages.has("argo-applications");
    const runtimeReadReady = !readErrorStages.has("deployments");
    const ciReady = pipelineReadReady && selected !== null && pipelineCondition.status === "True";
    const argoReady = argoReadReady && application !== null;
    const runtimeNotApplicable = target === null;
    const runtimeReady = runtimeReadReady && (runtimeNotApplicable || (deployment !== null
      && desired !== null
      && desired > 0
      && readyReplicas === desired
      && updatedReplicas === desired
      && generation !== null
      && observedGeneration !== null
      && observedGeneration >= generation));
    const ready = ciReady && runtimeReady;
    const reason = !pipelineReadReady
      ? "pipeline-read-failed"
      : !ciReady
        ? selected === null ? "pipeline-missing" : `ci:${pipelineCondition.reason || pipelineCondition.status || "unknown"}`
        : !runtimeReadReady
              ? "runtime-read-failed"
              : !runtimeReady
                ? "runtime-not-ready"
                : "ready";
    return {
      consumer: consumer.id,
      node: consumer.node,
      lane: consumer.lane,
      repository: consumer.repo,
      namespace: consumer.namespace,
      pipeline: consumer.pipeline,
      argoApplication: consumer.argoApplication,
      ready,
      ciReady,
      argoReady,
      runtimeReady,
      diagnosticsReady: readErrors.length === 0,
      latestPipelineRun: firstString(record(selected?.metadata).name),
      pipelineStatus: pipelineCondition.reason || pipelineCondition.status,
      durationSeconds: selected === null ? null : durationSeconds(selected),
      sourceCommit: selected === null ? null : sourceCommit(selected),
      imageStatus: runtimeNotApplicable ? "not-applicable" : image === null ? "missing" : "runtime",
      digest,
      gitopsCommit: firstString(appSync.revision),
      argo: {
        sync: firstString(appSync.status),
        health: firstString(appHealth.status),
        revision: firstString(appSync.revision),
        repoURL: firstString(appSource.repoURL),
        targetRevision: firstString(appSource.targetRevision),
        ...argoDegraded,
        revisionRelation: { relation: "summary-not-evaluated", valuesPrinted: false },
      },
      runtime: {
        deployment: firstString(record(deployment?.metadata).name),
        readyReplicas,
        updatedReplicas,
        replicas: desired,
        generation,
        observedGeneration,
        digest,
        image,
        ...(expectedSourceCommit === null ? {} : {
          workloads: target === null
            ? []
            : deployments
              .filter((item) => record(item.metadata).namespace === target.namespace)
              .map(workloadSummary)
              .sort((left, right) => String(left.deployment).localeCompare(String(right.deployment)))
              .slice(0, 100),
        }),
      },
      ...(expectedSourceCommit === null ? {} : {
        latestPipelineRunSummary: pipelineSummary(latest),
        pipelineRuns: [...new Set([latest, exact].filter(Boolean))].map(pipelineSummary),
      }),
      diagnostics: {
        ok: readErrors.length === 0,
        code: readErrors.length === 0 ? "pac-node-snapshot-ready" : "pac-node-snapshot-partial",
        phase: "node-summary",
        hint: readErrors.length === 0 ? "single target-side snapshot" : "one or more target-side list operations failed",
      },
      traceId: null,
      firstBreak: ready ? null : { code: reason, phase: "node-summary", valuesPrinted: false },
      error: null,
      reason,
      valuesPrinted: false,
    };
  });
  return {
    ok: readErrors.length === 0,
    mutation: false,
    readErrors,
    consumers: rows,
    valuesPrinted: false,
  };
}

function fixtureInput(overrides = {}) {
  const digest = `sha256:${"a".repeat(64)}`;
  const revision = "b".repeat(40);
  return {
    sourceCommit: "c".repeat(40),
    artifact: {},
    argo: {
      sync: "Synced",
      health: "Healthy",
      revision,
      revisionRelation: { relation: "retained", observedRevision: revision },
    },
    runtime: { image: `registry/service@${digest}`, digest, replicas: 1, readyReplicas: 1 },
    registryPresent: false,
    healthUrl: null,
    healthStatus: null,
    ...overrides,
  };
}

function noRuntimeChangeObservation(sourceCommit = "c".repeat(40)) {
  return extractPacSourceObservation([
    {
      event: "g14-ci-plan",
      sourceCommitId: sourceCommit,
      affectedServices: [],
      rolloutServices: [],
      buildServices: [],
      reusedServices: ["service"],
    },
    { event: "collect-artifacts", status: "skipped", reason: "no-build-no-rollout-plan" },
    { event: "gitops-promote", status: "skipped", reason: "no-build-no-rollout-plan" },
  ]);
}

function deliveryObservation(sourceCommit = "c".repeat(40)) {
  return extractPacSourceObservation([
    {
      event: "g14-ci-plan",
      sourceCommitId: sourceCommit,
      affectedServices: ["service"],
      rolloutServices: ["service"],
      buildServices: ["service"],
      reusedServices: [],
    },
    { event: "pac-task-terminal", pipelineTask: "plan-artifacts", taskRun: "plan", status: "succeeded", reason: "Succeeded", results: [] },
    { event: "pac-task-terminal", pipelineTask: "collect-artifacts", taskRun: "collect", status: "succeeded", reason: "Succeeded", results: [] },
    { event: "pac-task-terminal", pipelineTask: "gitops-promote", taskRun: "promote", status: "succeeded", reason: "Succeeded", results: [] },
  ]);
}

function runtimeGitopsVerifyObservation(sourceCommit = "c".repeat(40)) {
  return extractPacSourceObservation([
    {
      event: "g14-ci-plan",
      sourceCommitId: sourceCommit,
      affectedServices: [],
      rolloutServices: [],
      buildServices: [],
      reusedServices: Array.from({ length: 8 }, (_item, index) => `service-${index}`),
      noImageBuildReason: "test-only-change",
    },
    { event: "collect-artifacts", status: "skipped", reason: "no-build-no-rollout-plan" },
    { event: "gitops-promote", status: "continuing", reason: "no-build-no-rollout-plan-gitops-verify" },
    { event: "pac-task-terminal", pipelineTask: "plan-artifacts", taskRun: "plan", status: "succeeded", reason: "Succeeded", results: [] },
    { event: "pac-task-terminal", pipelineTask: "collect-artifacts", taskRun: "collect", status: "succeeded", reason: "Succeeded", results: [] },
    { event: "pac-task-terminal", pipelineTask: "gitops-promote", taskRun: "promote", status: "succeeded", reason: "Succeeded", results: [] },
  ]);
}

function publishedCatalog(sourceCommit = "c".repeat(40)) {
  return { present: true, status: "published", sourceCommit, registryVerified: true };
}

function runPacStatusFixtureChecks() {
  const digestA = `sha256:${"a".repeat(64)}`;
  const digestD = `sha256:${"d".repeat(64)}`;
  const revision = "b".repeat(40);
  const retained = noRuntimeChangeObservation();
  const delivery = deliveryObservation();
  const runtimeGitopsVerify = runtimeGitopsVerifyObservation();
  const exactArgo = { sync: "Synced", health: "Healthy", revision, revisionRelation: { relation: "exact", expectedRevision: revision, observedRevision: revision } };
  const cases = [
    {
      id: "retained-ready",
      expectedOk: true,
      expectedCode: "pac-ready-no-runtime-change",
      input: fixtureInput({ artifact: { imageStatus: "retained", sourceObservation: retained } }),
    },
    {
      id: "runtime-gitops-verify-ready",
      expectedOk: true,
      expectedCode: "pac-ready-gitops-exact",
      input: fixtureInput({ artifact: { imageStatus: "reused", digest: digestA, digests: [digestA], gitopsCommit: revision, sourceObservation: runtimeGitopsVerify, catalog: publishedCatalog() }, argo: exactArgo }),
    },
    {
      id: "runtime-gitops-verify-catalog-missing",
      expectedOk: false,
      expectedCode: "pac-artifact-catalog-missing",
      input: fixtureInput({ artifact: { imageStatus: "reused", digest: digestA, digests: [digestA], gitopsCommit: revision, sourceObservation: runtimeGitopsVerify }, argo: exactArgo }),
    },
    {
      id: "runtime-gitops-verify-gitops-missing",
      expectedOk: false,
      expectedCode: "pac-gitops-missing",
      input: fixtureInput({ artifact: { imageStatus: "reused", digest: digestA, digests: [digestA], sourceObservation: runtimeGitopsVerify, catalog: publishedCatalog() }, argo: exactArgo }),
    },
    {
      id: "retained-gitops-missing",
      expectedOk: false,
      expectedCode: "pac-retained-gitops-missing",
      input: fixtureInput({ artifact: { imageStatus: "retained", sourceObservation: retained }, argo: { sync: "Synced", health: "Healthy", revision: null, revisionRelation: { relation: "unknown" } } }),
    },
    {
      id: "delivery-ready-exact",
      expectedOk: true,
      expectedCode: "pac-ready-gitops-exact",
      input: fixtureInput({ artifact: { imageStatus: "built", digest: digestA, digests: [digestA], gitopsCommit: revision, sourceObservation: delivery, catalog: publishedCatalog() }, argo: exactArgo, runtime: { image: `registry/service@${digestA}`, digest: digestA, replicas: 1, readyReplicas: 1 } }),
    },
    {
      id: "delivery-ready-ignores-argo-aggregate-health",
      expectedOk: true,
      expectedCode: "pac-ready-gitops-exact",
      input: fixtureInput({ artifact: { imageStatus: "built", digest: digestA, digests: [digestA], gitopsCommit: revision, sourceObservation: delivery, catalog: publishedCatalog() }, argo: { ...exactArgo, sync: "OutOfSync", health: "Degraded" }, runtime: { image: `registry/service@${digestA}`, digest: digestA, replicas: 1, readyReplicas: 1 } }),
    },
    {
      id: "equal-revisions-ignore-owning-git-fetch-failure",
      expectedOk: true,
      expectedCode: "pac-ready-gitops-exact",
      input: fixtureInput({
        artifact: { imageStatus: "built", digest: digestA, digests: [digestA], gitopsCommit: revision, sourceObservation: delivery, catalog: publishedCatalog() },
        argo: { ...exactArgo, revisionRelation: { relation: "unknown", expectedRevision: revision, observedRevision: revision, proof: "unavailable", reason: "owning-git-fetch-failed", fetchOk: false } },
        runtime: { image: `registry/service@${digestA}`, digest: digestA, replicas: 1, readyReplicas: 1 },
      }),
    },
    {
      id: "gitops-only-registry-not-configured",
      expectedOk: true,
      expectedCode: "pac-ready-gitops-exact",
      input: fixtureInput({ registryApplicability: "not-configured", imageRepository: "registry/shared-repository-image", artifact: { gitopsCommit: revision }, argo: exactArgo }),
    },
    {
      id: "image-registry-missing-fails-closed",
      expectedOk: false,
      expectedCode: "pac-registry-missing",
      input: fixtureInput({ registryApplicability: "configured", imageRepository: "registry/service", artifact: { imageStatus: "built", digest: digestA, gitopsCommit: revision }, argo: exactArgo }),
    },
    {
      id: "delivery-ready-descendant",
      expectedOk: true,
      expectedCode: "pac-ready-gitops-descendant",
      input: fixtureInput({ artifact: { imageStatus: "built", digest: digestA, digests: [digestA], gitopsCommit: revision, sourceObservation: delivery, catalog: publishedCatalog() }, argo: { ...exactArgo, revision: "d".repeat(40), revisionRelation: { relation: "descendant", expectedRevision: revision, observedRevision: "d".repeat(40) } }, runtime: { image: `registry/service@${digestA}`, digest: digestA, replicas: 1, readyReplicas: 1 } }),
    },
    {
      id: "delivery-stale-gitops-fails-closed",
      expectedOk: false,
      expectedCode: "pac-argo-revision-stale",
      input: fixtureInput({ artifact: { imageStatus: "built", digest: digestA, digests: [digestA], gitopsCommit: revision, sourceObservation: delivery, catalog: publishedCatalog() }, argo: { ...exactArgo, revision: "d".repeat(40), revisionRelation: { relation: "stale", expectedRevision: revision, observedRevision: "d".repeat(40) } }, runtime: { image: `registry/service@${digestA}`, digest: digestA, replicas: 1, readyReplicas: 1 } }),
    },
    {
      id: "different-revisions-fetch-failure-remains-unknown",
      expectedOk: false,
      expectedCode: "pac-argo-revision-unknown",
      input: fixtureInput({
        artifact: { imageStatus: "built", digest: digestA, digests: [digestA], gitopsCommit: revision, sourceObservation: delivery, catalog: publishedCatalog() },
        argo: { ...exactArgo, revision: "d".repeat(40), revisionRelation: { relation: "unknown", expectedRevision: revision, observedRevision: "d".repeat(40), proof: "unavailable", reason: "owning-git-fetch-failed", fetchOk: false } },
        runtime: { image: `registry/service@${digestA}`, digest: digestA, replicas: 1, readyReplicas: 1 },
      }),
    },
    {
      id: "delivery-gitops-missing",
      expectedOk: false,
      expectedCode: "pac-gitops-missing",
      input: fixtureInput({ artifact: { imageStatus: "built", digest: digestA, digests: [digestA], sourceObservation: delivery, catalog: publishedCatalog() }, argo: { sync: "Synced", health: "Healthy", revision: null, revisionRelation: { relation: "unknown" } } }),
    },
    {
      id: "delivery-runtime-mismatch",
      expectedOk: false,
      expectedCode: "pac-catalog-artifact-runtime-mismatch",
      input: fixtureInput({ artifact: { imageStatus: "built", digest: digestA, digests: [digestA], gitopsCommit: revision, sourceObservation: delivery, catalog: publishedCatalog() }, argo: exactArgo, runtime: { image: `registry/service@${digestD}`, digest: digestD, replicas: 1, readyReplicas: 1 } }),
    },
    {
      id: "catalog-delivery-ready",
      expectedOk: true,
      expectedCode: "pac-ready-gitops-exact",
      input: fixtureInput({ imageRepository: "registry/service", artifact: { imageStatus: "reused", digests: [digestA], gitopsCommit: revision, sourceObservation: delivery, catalog: { present: true, status: "published", sourceCommit: "c".repeat(40), registryVerified: true } }, argo: exactArgo, runtime: { image: `registry/service@${digestA}`, digest: digestA, replicas: 1, readyReplicas: 1 } }),
    },
    {
      id: "catalog-delivery-missing",
      expectedOk: false,
      expectedCode: "pac-artifact-catalog-missing",
      input: fixtureInput({ imageRepository: "registry/service", artifact: { imageStatus: "reused", digest: digestA, digests: [digestA], gitopsCommit: revision, sourceObservation: delivery }, registryPresent: true, argo: exactArgo, runtime: { image: `registry/service@${digestA}`, digest: digestA, replicas: 1, readyReplicas: 1 } }),
    },
    {
      id: "catalog-delivery-unverified",
      expectedOk: false,
      expectedCode: "pac-artifact-catalog-unverified",
      input: fixtureInput({ imageRepository: "registry/service", artifact: { imageStatus: "reused", digest: digestA, digests: [digestA], gitopsCommit: revision, sourceObservation: delivery, catalog: { present: true, status: "published", sourceCommit: "c".repeat(40), registryVerified: false } }, registryPresent: true, argo: exactArgo, runtime: { image: `registry/service@${digestA}`, digest: digestA, replicas: 1, readyReplicas: 1 } }),
    },
    {
      id: "catalog-delivery-digest-missing",
      expectedOk: false,
      expectedCode: "pac-artifact-catalog-digest-missing",
      input: fixtureInput({ imageRepository: "registry/service", artifact: { imageStatus: "reused", gitopsCommit: revision, sourceObservation: delivery, catalog: { present: true, status: "published", sourceCommit: "c".repeat(40), registryVerified: true } }, registryPresent: true, argo: exactArgo, runtime: { image: `registry/service@${digestA}`, digest: digestA, replicas: 1, readyReplicas: 1 } }),
    },
    {
      id: "catalog-delivery-runtime-mismatch",
      expectedOk: false,
      expectedCode: "pac-catalog-artifact-runtime-mismatch",
      input: fixtureInput({ imageRepository: "registry/service", artifact: { imageStatus: "reused", digests: [digestA], gitopsCommit: revision, sourceObservation: delivery, catalog: { present: true, status: "published", sourceCommit: "c".repeat(40), registryVerified: true } }, argo: exactArgo, runtime: { image: `registry/service@${digestD}`, digest: digestD, replicas: 1, readyReplicas: 1 } }),
    },
    {
      id: "delivery-terminal-evidence-missing",
      expectedOk: false,
      expectedCode: "pac-source-observation-inconsistent",
      input: fixtureInput({ artifact: { sourceObservation: extractPacSourceObservation([{ event: "g14-ci-plan", sourceCommitId: "c".repeat(40), affectedServices: ["service"], rolloutServices: ["service"], buildServices: [], reusedServices: ["service"] }]) } }),
    },
    {
      id: "incomplete-no-runtime-change-markers",
      expectedOk: false,
      expectedCode: "pac-source-observation-inconsistent",
      input: fixtureInput({ artifact: { sourceObservation: extractPacSourceObservation([{ event: "g14-ci-plan", sourceCommitId: "c".repeat(40), affectedServices: [], rolloutServices: [], buildServices: [], reusedServices: [] }]) } }),
    },
    {
      id: "runtime-gitops-verify-marker-missing",
      expectedOk: false,
      expectedCode: "pac-source-observation-inconsistent",
      input: fixtureInput({ artifact: { sourceObservation: extractPacSourceObservation([
        { event: "g14-ci-plan", sourceCommitId: "c".repeat(40), affectedServices: [], rolloutServices: [], buildServices: [], reusedServices: ["service"] },
        { event: "pac-task-terminal", pipelineTask: "plan-artifacts", taskRun: "plan", status: "succeeded", reason: "Succeeded", results: [] },
        { event: "pac-task-terminal", pipelineTask: "collect-artifacts", taskRun: "collect", status: "succeeded", reason: "Succeeded", results: [] },
        { event: "pac-task-terminal", pipelineTask: "gitops-promote", taskRun: "promote", status: "succeeded", reason: "Succeeded", results: [] },
      ]) } }),
    },
    {
      id: "runtime-gitops-verify-promote-marker-conflict",
      expectedOk: false,
      expectedCode: "pac-source-observation-inconsistent",
      input: fixtureInput({ artifact: { sourceObservation: extractPacSourceObservation([
        { event: "g14-ci-plan", sourceCommitId: "c".repeat(40), affectedServices: [], rolloutServices: [], buildServices: [], reusedServices: ["service"] },
        { event: "collect-artifacts", status: "skipped", reason: "no-build-no-rollout-plan" },
        { event: "gitops-promote", status: "skipped", reason: "no-build-no-rollout-plan" },
        { event: "gitops-promote", status: "continuing", reason: "no-build-no-rollout-plan-gitops-verify" },
        { event: "pac-task-terminal", pipelineTask: "plan-artifacts", taskRun: "plan", status: "succeeded", reason: "Succeeded", results: [] },
        { event: "pac-task-terminal", pipelineTask: "collect-artifacts", taskRun: "collect", status: "succeeded", reason: "Succeeded", results: [] },
        { event: "pac-task-terminal", pipelineTask: "gitops-promote", taskRun: "promote", status: "succeeded", reason: "Succeeded", results: [] },
      ]) } }),
    },
    {
      id: "runtime-gitops-verify-nonzero-plan-conflict",
      expectedOk: false,
      expectedCode: "pac-source-observation-inconsistent",
      input: fixtureInput({ artifact: { sourceObservation: extractPacSourceObservation([
        { event: "g14-ci-plan", sourceCommitId: "c".repeat(40), affectedServices: ["service"], rolloutServices: ["service"], buildServices: [], reusedServices: ["service"] },
        { event: "gitops-promote", status: "continuing", reason: "no-build-no-rollout-plan-gitops-verify" },
        { event: "pac-task-terminal", pipelineTask: "plan-artifacts", taskRun: "plan", status: "succeeded", reason: "Succeeded", results: [] },
        { event: "pac-task-terminal", pipelineTask: "collect-artifacts", taskRun: "collect", status: "succeeded", reason: "Succeeded", results: [] },
        { event: "pac-task-terminal", pipelineTask: "gitops-promote", taskRun: "promote", status: "succeeded", reason: "Succeeded", results: [] },
      ]) } }),
    },
    {
      id: "runtime-gitops-verify-terminal-evidence-missing",
      expectedOk: false,
      expectedCode: "pac-source-observation-inconsistent",
      input: fixtureInput({ artifact: { sourceObservation: extractPacSourceObservation([
        { event: "g14-ci-plan", sourceCommitId: "c".repeat(40), affectedServices: [], rolloutServices: [], buildServices: [], reusedServices: ["service"] },
        { event: "collect-artifacts", status: "skipped", reason: "no-build-no-rollout-plan" },
        { event: "gitops-promote", status: "continuing", reason: "no-build-no-rollout-plan-gitops-verify" },
        { event: "pac-task-terminal", pipelineTask: "plan-artifacts", taskRun: "plan", status: "succeeded", reason: "Succeeded", results: [] },
        { event: "pac-task-terminal", pipelineTask: "collect-artifacts", taskRun: "collect", status: "succeeded", reason: "Succeeded", results: [] },
      ]) } }),
    },
    {
      id: "retained-source-mismatch",
      expectedOk: false,
      expectedCode: "pac-source-observation-mismatch",
      input: fixtureInput({ sourceCommit: "e".repeat(40), artifact: { imageStatus: "retained", sourceObservation: retained } }),
    },
    {
      id: "delivery-one-sided-skip-conflict",
      expectedOk: false,
      expectedCode: "pac-source-observation-inconsistent",
      input: fixtureInput({ artifact: { sourceObservation: extractPacSourceObservation([
        { event: "g14-ci-plan", sourceCommitId: "c".repeat(40), affectedServices: ["service"], rolloutServices: ["service"], buildServices: ["service"], reusedServices: [] },
        { event: "gitops-promote", status: "skipped", reason: "no-build-no-rollout-plan" },
      ]) } }),
    },
  ];
  const checks = cases.map((item) => {
    const result = evaluatePacStatus(item.input);
    return {
      id: item.id,
      ok: result.ok === item.expectedOk && result.code === item.expectedCode,
      expectedOk: item.expectedOk,
      actualOk: result.ok,
      expectedCode: item.expectedCode,
      actualCode: result.code,
    };
  });
  const provenance = {
    required: true,
    version: "admission-pac-v1",
    controllerIdentity: "system:serviceaccount:pipelines-as-code:pipelines-as-code-controller",
    policyName: "unidesk-pac-delivery-provenance-v1",
    bindingName: "unidesk-pac-delivery-provenance-v1",
    configSha256: `sha256:${"1".repeat(64)}`,
    markerAnnotation: "unidesk.ai/pac-admission-provenance",
    markerValue: "admission-pac-v1:fixture",
    executionServiceAccountName: "fixture-pac-runner",
  };
  const admissionState = {
    ready: true,
    source: "live-admissionregistration-v1",
    policyName: provenance.policyName,
    bindingName: provenance.bindingName,
    version: provenance.version,
    controllerIdentity: provenance.controllerIdentity,
    configSha256: provenance.configSha256,
    activeAfter: "2026-01-01T00:00:00Z",
  };
  const consumer = {
    id: "fixture",
    repository: "fixture-repository",
    pipeline: "fixture-pipeline",
    pipelineRunPrefix: "fixture-run-",
    deliveryProvenance: provenance,
    admissionState,
  };
  const verifiedRun = {
    metadata: {
      name: "fixture-run-verified",
      creationTimestamp: "2026-01-01T00:00:01Z",
      labels: {
        "app.kubernetes.io/managed-by": "pipelinesascode.tekton.dev",
        "pipelinesascode.tekton.dev/event-type": "push",
        "pipelinesascode.tekton.dev/repository": "fixture-repository",
      },
      annotations: {
        "pipelinesascode.tekton.dev/git-provider": "gitea",
        [provenance.markerAnnotation]: provenance.markerValue,
      },
    },
    spec: { taskRunTemplate: { serviceAccountName: provenance.executionServiceAccountName } },
  };
  const classificationCases = [
    { id: "admission-provenance-verified", expected: true, item: verifiedRun, state: admissionState },
    { id: "pre-bootstrap-run-warning-only", expected: false, item: { ...verifiedRun, metadata: { ...verifiedRun.metadata, creationTimestamp: "2025-12-31T23:59:59Z" } }, state: admissionState },
    { id: "marker-mismatch-warning-only", expected: false, item: { ...verifiedRun, metadata: { ...verifiedRun.metadata, annotations: { ...verifiedRun.metadata.annotations, [provenance.markerAnnotation]: "forged" } } }, state: admissionState },
    { id: "candidate-label-warning-only", expected: false, item: { ...verifiedRun, metadata: { ...verifiedRun.metadata, name: "unrelated", labels: { ...verifiedRun.metadata.labels, "tekton.dev/pipeline": consumer.pipeline }, annotations: { ...verifiedRun.metadata.annotations, [provenance.markerAnnotation]: "forged" } } }, state: admissionState },
    { id: "candidate-pipeline-ref-warning-only", expected: false, item: { ...verifiedRun, metadata: { ...verifiedRun.metadata, name: "unrelated", annotations: { ...verifiedRun.metadata.annotations, [provenance.markerAnnotation]: "forged" } }, spec: { ...verifiedRun.spec, pipelineRef: { name: consumer.pipeline } } }, state: admissionState },
    { id: "service-account-mismatch-warning-only", expected: false, item: { ...verifiedRun, spec: { taskRunTemplate: { serviceAccountName: "default" } } }, state: admissionState },
    { id: "policy-identity-mismatch-warning-only", expected: false, item: verifiedRun, state: { ...admissionState, configSha256: `sha256:${"2".repeat(64)}` } },
  ];
  for (const item of classificationCases) {
    const result = classifyPacPipelineRun({ ...consumer, admissionState: item.state }, item.item);
    checks.push({
      id: item.id,
      ok: result.admissionProvenanceVerified === item.expected && result.deliveryAuthorityEligible === true,
      expectedOk: true,
      actualOk: result.deliveryAuthorityEligible,
      expectedCode: item.expected ? "admission-owned-pac-push-provenance-verified" : "pac-push-metadata-observed-but-admission-provenance-unverified",
      actualCode: result.reason,
    });
  }
  return { ok: checks.every((item) => item.ok), checks, valuesPrinted: false };
}

module.exports = {
  classifyPacPipelineRun,
  evaluatePacAdmissionState,
  evaluatePacNodeStatusSnapshot,
  evaluatePacStatus,
  extractPacArtifactEvidence,
  extractPacSourceObservation,
  normalizeGitopsRevisionRelation,
  parsePacLogRecords,
  runPacStatusFixtureChecks,
  pipelineRunMatchesConsumer,
  taskTerminalRecord,
};
