#!/usr/bin/env bun
import { spawnSync } from "node:child_process";
import { mkdirSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
import { dirname, resolve } from "node:path";
import { runtimeGitopsScriptsConfigMap } from "../hwlab/runtime-gitops-scripts-configmap.mjs";
import { hwlabRuntimeLaneSpecForNode } from "../../src/hwlab-node-lanes.ts";

function option(name) {
  const index = process.argv.indexOf(name);
  if (index === -1) return null;
  const value = process.argv[index + 1];
  if (value === undefined || value.length === 0 || value.startsWith("--")) throw new Error(`${name} requires a value`);
  return value;
}

function record(value, path) {
  if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${path} must be an object`);
  return value;
}

function required(value, path) {
  if (typeof value !== "string" || value.length === 0 || value.includes("\n")) throw new Error(`${path} must be a non-empty single-line string`);
  return value;
}

function run(command, args, cwd, allowFailure = false) {
  const result = spawnSync(command, args, { cwd, encoding: "utf8", maxBuffer: 4 * 1024 * 1024 });
  if (result.error !== undefined) throw result.error;
  if (result.status !== 0 && !allowFailure) {
    const detail = `${result.stderr || result.stdout || "command failed"}`.trim().slice(-2000);
    throw new Error(`${command} ${args.join(" ")} failed (${result.status}): ${detail}`);
  }
  return result;
}

function safeManifestPath(value) {
  const path = required(value, "delivery.gitops.manifestPath");
  if (path.startsWith("/") || path.split("/").includes("..")) throw new Error("delivery.gitops.manifestPath must be a safe relative path");
  return path;
}

function safeReleaseStatePath(value) {
  const path = required(value, "delivery.gitops.releaseStatePath");
  if (path.startsWith("/") || path.split("/").includes("..")) throw new Error("delivery.gitops.releaseStatePath must be a safe relative path");
  return path;
}

function safeResourceManifestPath(value, pathLabel) {
  const path = required(value, pathLabel);
  if (path.startsWith("/") || path.split("/").includes("..") || !path.endsWith(".yaml")) throw new Error(`${pathLabel} must be a safe relative .yaml path`);
  return path;
}

export function renderGitOpsResources(gitops, sourceRoot) {
  if (gitops.resources === undefined) return [];
  if (!Array.isArray(gitops.resources)) throw new Error("delivery.gitops.resources must be an array");
  return gitops.resources.map((value, index) => {
    const pathLabel = `delivery.gitops.resources[${index}]`;
    const resource = record(value, pathLabel);
    const renderer = required(resource.renderer, `${pathLabel}.renderer`);
    if (renderer !== "hwlab-runtime-gitops-scripts") throw new Error(`${pathLabel}.renderer is unsupported: ${renderer}`);
    const configRef = required(resource.configRef, `${pathLabel}.configRef`);
    const match = /^config\/hwlab-node-lanes\.yaml#lanes\.([^.]+)\.targets\.([^.]+)$/u.exec(configRef);
    if (match === null) throw new Error(`${pathLabel}.configRef must select config/hwlab-node-lanes.yaml#lanes.<lane>.targets.<node>`);
    const lane = match[1];
    const node = match[2];
    const spec = hwlabRuntimeLaneSpecForNode(lane, node);
    const overlay = {
      nodeId: spec.nodeId,
      lane: spec.lane,
      runtimePath: spec.runtimePath,
      observability: spec.observability,
    };
    const configMapName = `${spec.pipeline}-runtime-gitops-scripts`;
    const manifest = Bun.YAML.stringify(runtimeGitopsScriptsConfigMap({
      overlay,
      scriptsDir: resolve(sourceRoot, "scripts/native/hwlab"),
      featureConfigValidatorPath: resolve(sourceRoot, "scripts/native/cicd/feature-config-schema-warning.mjs"),
      ajvBundlePath: resolve(sourceRoot, "node_modules/ajv-dist/dist/ajv2020.min.js"),
      namespace: required(resource.namespace, `${pathLabel}.namespace`),
      configMapName,
    }));
    return {
      id: required(resource.id, `${pathLabel}.id`),
      path: safeResourceManifestPath(resource.manifestPath, `${pathLabel}.manifestPath`),
      content: `${manifest.trimEnd()}\n`,
    };
  });
}

function releaseValue(releaseDir, name) {
  return required(readFileSync(resolve(releaseDir, name), "utf8").trim(), `${releaseDir}/${name}`);
}

function removeFile(path) {
  try {
    unlinkSync(path);
  } catch (error) {
    if (error?.code !== "ENOENT") throw error;
  }
}

function readReleaseState(path, serviceRef) {
  let value;
  try {
    value = record(JSON.parse(readFileSync(path, "utf8")), path);
  } catch (error) {
    if (error?.code === "ENOENT") return null;
    throw error;
  }
  if (value.kind !== "UniDeskHostReleaseState") throw new Error(`${path}.kind must be UniDeskHostReleaseState`);
  if (value.serviceRef !== serviceRef) throw new Error(`${path}.serviceRef must match delivery.serviceRef`);
  const sourceCommit = required(value.sourceCommit, `${path}.sourceCommit`);
  const digest = required(value.digest, `${path}.digest`);
  const digestRef = required(value.digestRef, `${path}.digestRef`);
  if (!/^[0-9a-f]{40}$/u.test(sourceCommit)) throw new Error(`${path}.sourceCommit must be a full Git commit SHA`);
  if (!/^sha256:[0-9a-f]{64}$/u.test(digest)) throw new Error(`${path}.digest must be sha256:<64 hex>`);
  return { sourceCommit, digest, digestRef };
}

function main() {
const configPath = resolve(option("--config") ?? "config/unidesk-host-k8s.yaml");
const sourceRoot = resolve(option("--source-root") ?? process.cwd());
const metadataPath = resolve(required(option("--metadata"), "--metadata"));
const releaseDir = resolve(required(option("--release-dir"), "--release-dir"));
const sourceCommit = required(option("--source-commit"), "--source-commit");
const worktree = resolve(option("--worktree") ?? "/workspace/unidesk-host-gitops");
if (!/^[0-9a-f]{40}$/u.test(sourceCommit)) throw new Error("--source-commit must be a full Git commit SHA");

const config = record(Bun.YAML.parse(readFileSync(configPath, "utf8")), configPath);
const delivery = record(config.delivery, "delivery");
if (delivery.enabled !== true && delivery.enabled !== false) throw new Error("delivery.enabled must be boolean");
const enabled = delivery.enabled === true;
const action = releaseValue(releaseDir, "action");
const reason = releaseValue(releaseDir, "reason");
const baselineSourceCommit = readFileSync(resolve(releaseDir, "baseline-source-commit"), "utf8").trim() || null;
if (!new Set(["build", "skip", "disabled"]).has(action)) throw new Error(`${releaseDir}/action must be build, skip, or disabled`);
if ((enabled && action === "disabled") || (!enabled && action !== "disabled")) throw new Error("release action does not match delivery.enabled");
const serviceRef = required(delivery.serviceRef, "delivery.serviceRef");
const imageConfig = record(delivery.image, "delivery.image");
const gitops = record(delivery.gitops, "delivery.gitops");
const author = record(gitops.author, "delivery.gitops.author");
const readUrl = required(gitops.readUrl, "delivery.gitops.readUrl");
const writeUrl = required(gitops.writeUrl, "delivery.gitops.writeUrl");
const branch = required(gitops.branch, "delivery.gitops.branch");
const manifestPath = safeManifestPath(gitops.manifestPath);
const releaseStatePath = safeReleaseStatePath(gitops.releaseStatePath);
const gitopsResources = action === "skip" ? [] : renderGitOpsResources(gitops, sourceRoot);
let digest = null;
let digestRef = null;
let manifest = null;
let runtimeSourceCommit = null;

if (action === "build") {
  const metadata = record(JSON.parse(readFileSync(metadataPath, "utf8")), metadataPath);
  digest = required(metadata["containerimage.digest"], `${metadataPath}.containerimage.digest`);
  if (!/^sha256:[0-9a-f]{64}$/u.test(digest)) throw new Error("containerimage.digest must be sha256:<64 hex>");
  digestRef = `${required(imageConfig.repository, "delivery.image.repository")}@${digest}`;
  runtimeSourceCommit = sourceCommit;
  const render = run("bun", [
    "scripts/native/deploy/render-unidesk-host-service.mjs",
    "--config",
    configPath,
    "--service-ref",
    serviceRef,
    "--image",
    digestRef,
    "--source-commit",
    sourceCommit,
  ], sourceRoot);
  manifest = render.stdout;
  if (!manifest.includes("kind: Deployment") || !manifest.includes("kind: Service")) throw new Error("service renderer did not emit Service and Deployment objects");
}

rmSync(worktree, { recursive: true, force: true });
run("git", ["clone", "--no-checkout", readUrl, worktree], sourceRoot);
const fetched = run("git", ["fetch", "origin", branch], worktree, true).status === 0;
if (fetched) {
  run("git", ["checkout", "-B", branch, `origin/${branch}`], worktree);
} else {
  run("git", ["checkout", "--orphan", branch], worktree);
  run("git", ["rm", "-rf", "."], worktree, true);
}

const targetPath = resolve(worktree, manifestPath);
const statePath = resolve(worktree, releaseStatePath);
if (!targetPath.startsWith(`${worktree}/`)) throw new Error("resolved manifest path escaped the GitOps worktree");
if (!statePath.startsWith(`${worktree}/`)) throw new Error("resolved release state path escaped the GitOps worktree");
const existingState = readReleaseState(statePath, serviceRef);
if (action === "skip") {
  if (existingState === null) throw new Error("skip requires an existing GitOps release state");
  digest = existingState.digest;
  digestRef = existingState.digestRef;
  runtimeSourceCommit = existingState.sourceCommit;
  const gitopsCommit = run("git", ["rev-parse", "HEAD"], worktree).stdout.trim();
  process.stdout.write(`${JSON.stringify({
    ok: true,
    phase: "gitops-publish",
    action,
    reason,
    status: "skipped",
    imageStatus: "skipped",
    sourceCommit,
    baselineSourceCommit,
    runtimeSourceCommit,
    digest,
    digestRef,
    gitopsCommit,
    resources: [],
    changed: false,
    pushAttempts: 0,
    valuesPrinted: false,
  })}\n`);
  return;
} else if (action === "build" && manifest !== null) {
  mkdirSync(dirname(targetPath), { recursive: true });
  writeFileSync(targetPath, manifest, "utf8");
  mkdirSync(dirname(statePath), { recursive: true });
  writeFileSync(statePath, `${JSON.stringify({
    version: 1,
    kind: "UniDeskHostReleaseState",
    serviceRef,
    sourceCommit,
    digest,
    digestRef,
  }, null, 2)}\n`, "utf8");
} else {
  removeFile(targetPath);
  removeFile(statePath);
}

for (const resource of gitopsResources) {
  const resourcePath = resolve(worktree, resource.path);
  if (!resourcePath.startsWith(`${worktree}/`)) throw new Error(`resolved resource path escaped the GitOps worktree: ${resource.id}`);
  if (enabled) {
    mkdirSync(dirname(resourcePath), { recursive: true });
    writeFileSync(resourcePath, resource.content, "utf8");
  } else {
    removeFile(resourcePath);
  }
}

run("git", ["config", "user.name", required(author.name, "delivery.gitops.author.name")], worktree);
run("git", ["config", "user.email", required(author.email, "delivery.gitops.author.email")], worktree);
run("git", ["add", "-A"], worktree);
const changed = run("git", ["diff", "--cached", "--quiet"], worktree, true).status !== 0;
if (changed) {
  const commitAction = action === "disabled" ? "remove" : "deploy";
  run("git", ["commit", "-m", `unidesk-host: ${commitAction} ${serviceRef} ${sourceCommit.slice(0, 12)}`], worktree);
}

run("git", ["remote", "set-url", "origin", writeUrl], worktree);
let pushAttempts = 0;
if (changed) {
  let pushed = false;
  for (let attempt = 1; attempt <= 3; attempt += 1) {
    pushAttempts = attempt;
    const push = run("git", ["push", "origin", `HEAD:refs/heads/${branch}`], worktree, true);
    if (push.status === 0) {
      pushed = true;
      break;
    }
    run("git", ["fetch", "origin", branch], worktree);
    const rebase = run("git", ["rebase", `origin/${branch}`], worktree, true);
    if (rebase.status !== 0) {
      run("git", ["rebase", "--abort"], worktree, true);
      throw new Error(`GitOps rebase failed after push attempt ${attempt}`);
    }
  }
  if (!pushed) throw new Error("GitOps push failed after 3 attempts");
}

const head = run("git", ["rev-parse", "HEAD"], worktree, !enabled && !changed);
const gitopsCommit = head.status === 0 ? head.stdout.trim() : null;
process.stdout.write(`${JSON.stringify({
  ok: true,
  phase: "gitops-publish",
  action,
  reason,
  status: action === "build" ? "built" : action === "skip" ? "skipped" : "disabled",
  imageStatus: action === "build" ? "built" : action === "skip" ? "skipped" : "disabled",
  sourceCommit,
  baselineSourceCommit,
  runtimeSourceCommit,
  digest,
  digestRef,
  gitopsCommit,
  resources: gitopsResources.map((resource) => ({ id: resource.id, path: resource.path })),
  changed,
  pushAttempts,
  valuesPrinted: false,
})}\n`);
}

if (import.meta.main && !process.execArgv.includes("--check")) main();
