import { createHash } from 'node:crypto';
import { execFile } from 'node:child_process';
import { access, readFile, stat } from 'node:fs/promises';
import { createRequire } from 'node:module';
import path from 'node:path';
import { promisify } from 'node:util';
import { parse as parseYaml } from 'yaml';
import type { WorksPublishData } from './works-publish-file';
import {
  GAME_CANVAS_DYNAMIC_WORKS_DEPLOY_CHECK_ID,
  CONDITIONAL_DYNAMIC_WORKS_DEPLOY_CHECK_IDS,
  REQUIRED_DYNAMIC_WORKS_DEPLOY_CHECK_IDS,
  WORKS_DEPLOY_CHECK_FILE_NAME,
  WORKS_DEPLOY_CHECK_SCHEMA_VERSION,
  WORKS_DEPLOY_REPORT_FILE_NAME,
  type WorksCanvasEvidence,
  type WorksCanvasMeasurement,
  type WorksDeployCheckItem,
  type WorksDeployCheckReport,
  type WorksDeployCheckResult,
  type WorksDeployCheckExecution,
  type WorksDeployCheckStatus,
} from '../../shared/works-square-deploy-check';

const AdmZip = createRequire(import.meta.url)('adm-zip') as typeof import('adm-zip');
const execFileAsync = promisify(execFile);

const MAX_ZIP_BYTES = 50 * 1024 * 1024;
const MAX_UNCOMPRESSED_BYTES = 200 * 1024 * 1024;
const MAX_ZIP_ENTRIES = 2_000;
const MAX_SCANNED_TEXT_BYTES = 32 * 1024 * 1024;

const FORBIDDEN_RUNTIME_ACTIONS = /\b(?:npm\s+(?:install|ci|build|run\s+build)|pnpm\s+(?:install|i|build|run\s+build)|yarn\s+(?:install|build|run\s+build)|bun\s+(?:install|build|run\s+build)|pip\s+install|uv\s+sync|flutter\s+build)\b/i;
const STORAGE_ACCESS = /\b(?:localStorage|sessionStorage|document\.cookie|indexedDB|navigator\.serviceWorker|serviceWorker\.register)\b/i;
const PRIVATE_KEY_CONTENT = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/i;
const HIGH_CONFIDENCE_SECRET = /\b(?:AKIA[0-9A-Z]{16}|gh[pousr]_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|sk-[A-Za-z0-9]{20,})\b/;
const ENVIRONMENT_CAPABILITY_UNAVAILABLE = /(?:docker\s+(?:is\s+)?not\s+installed|docker\s+unavailable|no\s+(?:browser\s+automation|playwright|puppeteer)\s+available|(?:playwright|puppeteer|browser\s+automation)\s+unavailable)/i;
const DYNAMIC_CHECK_IDS = new Set<string>([
  ...REQUIRED_DYNAMIC_WORKS_DEPLOY_CHECK_IDS,
  ...CONDITIONAL_DYNAMIC_WORKS_DEPLOY_CHECK_IDS,
]);

const EXCLUDED_ENTRY = /^(?:\.git(?:\/|$)|node_modules(?:\/|$)|dist(?:\/|$)|build(?:\/|$)|\.next(?:\/|$)|\.nuxt(?:\/|$)|\.vite(?:\/|$)|\.dart_tool(?:\/|$)|\.pub-cache(?:\/|$)|android\/\.gradle(?:\/|$)|ios\/Pods(?:\/|$)|\.venv(?:\/|$)|venv(?:\/|$)|.*\/__pycache__(?:\/|$)|__pycache__(?:\/|$)|.*\.pyc$|.*\.DS_Store$)/i;
const SENSITIVE_ENTRY = /(?:^|\/)(?:\.env(?!\.example$)[^/]*|id_rsa(?:\.[^/]*)?|id_ed25519(?:\.[^/]*)?|credentials?\.(?:json|ya?ml)|service[-_]?account\.(?:json|ya?ml)|.*\.(?:pem|key|p12|pfx|jks))$/i;
const TEXT_ENTRY = /\.(?:c|cc|css|csv|html?|js|jsx|json|md|mjs|mts|py|scss|sh|sql|toml|ts|tsx|vue|yml|yaml|lock|conf|ini|txt|xml)$/i;

type UnknownRecord = Record<string, unknown>;
type ArchiveEntry = ReturnType<AdmZip['getEntries']>[number];
type ArchiveIndex = Map<string, ArchiveEntry>;
export type WorksDeployCheckMode = 'local' | 'cloud';

function asRecord(value: unknown): UnknownRecord | null {
  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
  return value as UnknownRecord;
}

function readString(record: UnknownRecord, key: string): string {
  return typeof record[key] === 'string' ? record[key].trim() : '';
}

function readRequiredString(record: UnknownRecord, key: string): string {
  const value = readString(record, key);
  if (!value) throw new Error(`Missing ${key}`);
  return value;
}

function isStatus(value: unknown): value is WorksDeployCheckStatus {
  return value === 'PASS' || value === 'SKIPPED' || value === 'BLOCKED';
}

function normalizeCheckStatus(id: string, status: WorksDeployCheckStatus, detail: string): WorksDeployCheckStatus {
  if (status !== 'BLOCKED' || !DYNAMIC_CHECK_IDS.has(id)) return status;
  return ENVIRONMENT_CAPABILITY_UNAVAILABLE.test(detail) ? 'SKIPPED' : status;
}

function normalizeCanvasMeasurement(value: unknown): WorksCanvasMeasurement | null {
  const record = asRecord(value);
  const width = record?.width;
  const height = record?.height;
  if (typeof width !== 'number' || !Number.isFinite(width) || width <= 0) return null;
  if (typeof height !== 'number' || !Number.isFinite(height) || height <= 0) return null;
  return { width, height };
}

function normalizeCanvasEvidence(value: unknown): WorksCanvasEvidence | null {
  const record = asRecord(value);
  const logicalResolution = normalizeCanvasMeasurement(record?.logical_resolution);
  const desktopViewport = normalizeCanvasMeasurement(record?.desktop_viewport);
  const mobileViewport = normalizeCanvasMeasurement(record?.mobile_viewport);
  const desktopCanvas = normalizeCanvasMeasurement(record?.desktop_canvas);
  const mobileCanvas = normalizeCanvasMeasurement(record?.mobile_canvas);
  const expectedMaxCanvas = asRecord(record?.expected_max_canvas);
  const expectedDesktop = normalizeCanvasMeasurement(expectedMaxCanvas?.desktop);
  const expectedMobile = normalizeCanvasMeasurement(expectedMaxCanvas?.mobile);
  if (!logicalResolution || !desktopViewport || !mobileViewport || !desktopCanvas || !mobileCanvas) return null;
  if (!expectedDesktop || !expectedMobile || typeof record?.resize_verified !== 'boolean') return null;
  return {
    logical_resolution: logicalResolution,
    desktop_viewport: desktopViewport,
    mobile_viewport: mobileViewport,
    desktop_canvas: desktopCanvas,
    mobile_canvas: mobileCanvas,
    expected_max_canvas: {
      desktop: expectedDesktop,
      mobile: expectedMobile,
    },
    resize_verified: record.resize_verified,
  };
}

function normalizeReport(value: unknown): WorksDeployCheckReport {
  const record = asRecord(value);
  if (!record) throw new Error(`${WORKS_DEPLOY_CHECK_FILE_NAME} must contain a JSON object`);
  if (record.schema_version !== WORKS_DEPLOY_CHECK_SCHEMA_VERSION) {
    throw new Error(`${WORKS_DEPLOY_CHECK_FILE_NAME} has unsupported schema_version`);
  }

  const status = record.status;
  if (!isStatus(status)) throw new Error(`${WORKS_DEPLOY_CHECK_FILE_NAME} has invalid status`);
  const checkedAt = readRequiredString(record, 'checked_at');
  const zipFilePath = readRequiredString(record, 'zip_file_path');
  const zipSha256 = readRequiredString(record, 'zip_sha256').toLowerCase();
  if (!/^[a-f0-9]{64}$/.test(zipSha256)) throw new Error('zip_sha256 must be a SHA-256 hex string');

  const checksRecord = asRecord(record.checks);
  if (!checksRecord) throw new Error(`${WORKS_DEPLOY_CHECK_FILE_NAME} is missing checks`);
  const checks: Record<string, WorksDeployCheckItem> = {};
  for (const [id, rawCheck] of Object.entries(checksRecord)) {
    const check = asRecord(rawCheck);
    if (!check || !isStatus(check.status) || !readString(check, 'detail')) {
      throw new Error(`${WORKS_DEPLOY_CHECK_FILE_NAME} has invalid check: ${id}`);
    }
    const execution = check.execution;
    if (execution !== undefined && execution !== 'executed' && execution !== 'unavailable') {
      throw new Error(`${WORKS_DEPLOY_CHECK_FILE_NAME} has invalid execution for check: ${id}`);
    }
    const canvasEvidence = id === GAME_CANVAS_DYNAMIC_WORKS_DEPLOY_CHECK_ID && check.canvas_evidence !== undefined
      ? normalizeCanvasEvidence(check.canvas_evidence)
      : undefined;
    if (id === GAME_CANVAS_DYNAMIC_WORKS_DEPLOY_CHECK_ID && check.canvas_evidence !== undefined && !canvasEvidence) {
      throw new Error(`${WORKS_DEPLOY_CHECK_FILE_NAME} has invalid canvas_evidence`);
    }
    const detail = readString(check, 'detail');
    checks[id] = {
      status: normalizeCheckStatus(id, check.status, detail),
      detail,
      ...(readString(check, 'command') ? { command: readString(check, 'command') } : {}),
      ...(readString(check, 'checked_at') ? { checked_at: readString(check, 'checked_at') } : {}),
      ...(execution ? { execution: execution as WorksDeployCheckExecution } : {}),
      ...(canvasEvidence ? { canvas_evidence: canvasEvidence } : {}),
    };
  }

  for (const id of REQUIRED_DYNAMIC_WORKS_DEPLOY_CHECK_IDS) {
    if (!checks[id]) throw new Error(`${WORKS_DEPLOY_CHECK_FILE_NAME} is missing check: ${id}`);
    if (!checks[id]?.command) throw new Error(`${WORKS_DEPLOY_CHECK_FILE_NAME} is missing command for check: ${id}`);
  }
  for (const id of CONDITIONAL_DYNAMIC_WORKS_DEPLOY_CHECK_IDS) {
    if (checks[id] && !checks[id]?.command) throw new Error(`${WORKS_DEPLOY_CHECK_FILE_NAME} is missing command for check: ${id}`);
  }

  const normalizedStatus = Object.values(checks).some((check) => check.status === 'BLOCKED')
    ? 'BLOCKED'
    : Object.values(checks).some((check) => check.status === 'SKIPPED')
      ? 'SKIPPED'
      : status;

  return {
    schema_version: WORKS_DEPLOY_CHECK_SCHEMA_VERSION,
    status: normalizedStatus,
    checked_at: checkedAt,
    zip_file_path: zipFilePath,
    zip_sha256: zipSha256,
    checks,
  };
}

function normalizeArchivePath(value: string): string | null {
  const replaced = value.replaceAll('\\', '/');
  const withoutTrailingSlash = replaced.endsWith('/') ? replaced.slice(0, -1) : replaced;
  if (!withoutTrailingSlash || withoutTrailingSlash.startsWith('/') || /^[A-Za-z]:\//.test(withoutTrailingSlash)) return null;
  const parts = withoutTrailingSlash.split('/');
  if (parts.some((part) => !part || part === '.' || part === '..' || part.includes('\0'))) return null;
  return parts.join('/');
}

function isSymlink(entry: ArchiveEntry): boolean {
  const unixMode = (entry.attr >>> 16) & 0xffff;
  return (unixMode & 0xf000) === 0xa000;
}

function isTextEntry(name: string): boolean {
  return TEXT_ENTRY.test(name) || name.endsWith('Dockerfile') || name.endsWith('nginx.conf');
}

function safePath(value: string): string | null {
  const normalized = value.replaceAll('\\', '/').trim();
  if (!normalized || normalized.startsWith('/') || /^[A-Za-z]:\//.test(normalized)) return null;
  const parts = normalized.split('/');
  if (parts.some((part) => !part || part === '..')) return null;
  return parts.filter((part) => part !== '.').join('/');
}

function joinArchivePath(directory: string, file: string): string | null {
  const safeDirectory = safePath(directory) ?? '';
  const safeFile = safePath(file);
  if (safeFile === null) return null;
  return [safeDirectory, safeFile].filter(Boolean).join('/');
}

function getBuildSpec(service: UnknownRecord): { context: string; dockerfile: string } | null {
  const build = service.build;
  if (typeof build === 'string') return { context: build, dockerfile: 'Dockerfile' };
  const buildRecord = asRecord(build);
  if (!buildRecord) return null;
  return {
    context: readString(buildRecord, 'context') || '.',
    dockerfile: readString(buildRecord, 'dockerfile') || 'Dockerfile',
  };
}

function valuesAsList(value: unknown): unknown[] {
  return Array.isArray(value) ? value : value === undefined ? [] : [value];
}

function stringifyCommand(value: unknown): string {
  if (typeof value === 'string') return value;
  if (Array.isArray(value)) return value.filter((item): item is string => typeof item === 'string').join(' ');
  return '';
}

function isWindowsAbsolute(value: string): boolean {
  return /^[A-Za-z]:[\\/]/.test(value);
}

function resolveZipPath(projectPath: string, value: string): string {
  return path.isAbsolute(value) || isWindowsAbsolute(value) ? value : path.resolve(projectPath, value);
}

function samePath(left: string, right: string): boolean {
  return path.normalize(left).toLowerCase() === path.normalize(right).toLowerCase();
}

function extractPort(value: unknown): { hostIp: string; hostPort: string; containerPort: string } | null {
  if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
    const record = value as UnknownRecord;
    return {
      hostIp: readString(record, 'host_ip'),
      hostPort: record.published === undefined ? '' : String(record.published),
      containerPort: record.target === undefined ? '' : String(record.target),
    };
  }
  if (typeof value !== 'string') return null;
  const parts = value.trim().split(':');
  if (parts.length === 3) return { hostIp: parts[0] ?? '', hostPort: parts[1] ?? '', containerPort: parts[2] ?? '' };
  if (parts.length === 2) return { hostIp: '', hostPort: parts[0] ?? '', containerPort: parts[1] ?? '' };
  return { hostIp: '', hostPort: '', containerPort: parts[0] ?? '' };
}

function volumeSource(value: unknown): { source: string; type: string } | null {
  if (typeof value === 'string') {
    const parts = value.split(':');
    if (parts.length < 2) return { source: '', type: 'anonymous' };
    return { source: parts.slice(0, -1).join(':'), type: 'string' };
  }
  const record = asRecord(value);
  if (!record) return null;
  return { source: readString(record, 'source'), type: readString(record, 'type') || 'volume' };
}

function hasSafeStorageAdapter(text: string): boolean {
  if (/safeStorage|safe-storage|safe_storage/i.test(text)) return true;
  return /try\s*\{[\s\S]{0,4000}(?:localStorage|sessionStorage|document\.cookie|indexedDB|serviceWorker)[\s\S]{0,4000}\}\s*catch\s*(?:\([^)]*\))?\s*\{/i.test(text);
}

function hasUnsafeComposeEnvironment(value: unknown): boolean {
  const text = JSON.stringify(value ?? '');
  for (const match of text.matchAll(/\$\{([^}]+)\}/g)) {
    const expression = match[1]?.trim() ?? '';
    const defaultMatch = expression.match(/^[A-Za-z_][A-Za-z0-9_]*:-(.+)$/);
    if (!defaultMatch || !defaultMatch[1]?.trim() || HIGH_CONFIDENCE_SECRET.test(defaultMatch[1])) return true;
  }
  return /\$(?!\{)[A-Za-z_][A-Za-z0-9_]*/.test(text);
}

function hasSafeEnvFile(value: unknown, index: ArchiveIndex): boolean {
  const files = valuesAsList(value);
  return files.length > 0 && files.every((item) => {
    if (typeof item !== 'string') return false;
    const safeName = safePath(item);
    return safeName !== null && Boolean(index.get(safeName)) && !SENSITIVE_ENTRY.test(safeName);
  });
}

function sourceTextEntries(textEntries: Map<string, string>): string[] {
  return [...textEntries.entries()]
    .filter(([name]) => !/\.(?:md|lock)$/i.test(name))
    .map(([, text]) => text);
}

function isCanvasProject(publish: WorksPublishData, index: ArchiveIndex, textEntries: Map<string, string>): boolean {
  if (/(?:game|canvas|游戏|画布)/i.test(publish.category)) return true;
  const names = [...index.keys()].filter((name) => /(?:game|canvas|phaser|webgl)[^/]*\.(?:css|html?|js|jsx|ts|tsx|vue)$/i.test(name));
  const sourceText = sourceTextEntries(textEntries).join('\n');
  return names.length > 0 || /<canvas\b|canvas\.getContext|HTMLCanvasElement|Phaser(?:\.|\s)|WebGLRenderingContext|game-container/i.test(sourceText);
}

function inspectCanvasLayout(textEntries: Map<string, string>): { pass: boolean; detail: string } {
  const sourceText = sourceTextEntries(textEntries).join('\n');
  const hasRootSelector = /(?:^|[,{\s])(?:html|body|#(?:app|root|game-container))\b/i.test(sourceText);
  const hasFullWidth = /\bwidth\s*:\s*100%/i.test(sourceText);
  const hasFullHeight = /\bheight\s*:\s*100%/i.test(sourceText);
  const hasResponsiveScale = /Phaser\.Scale\.(?:FIT|RESIZE)|(?:mode|scaleMode)\s*[:=]\s*(?:Phaser\.Scale\.)?(?:FIT|RESIZE)|ResizeObserver|(?:addEventListener|on)\s*\(\s*['"]resize|(?:window\.)?resize\s*\(/i.test(sourceText);
  const hasFixedCanvas = /(?:canvas|#(?:game-container|app|root))[^{}]*\{[^}]*\b(?:width|height)\s*:\s*\d+(?:\.\d+)?px[^}]*\}/is.test(sourceText);
  const missing: string[] = [];
  if (!hasRootSelector || !hasFullWidth || !hasFullHeight) missing.push('根节点未声明 width/height: 100%');
  if (!hasResponsiveScale) missing.push('未发现 FIT/RESIZE 或 resize/ResizeObserver 自适应逻辑');
  if (hasFixedCanvas) missing.push('发现固定像素 canvas 或游戏容器尺寸');
  return missing.length === 0
    ? { pass: true, detail: '游戏/画布项目具备根节点全屏和响应式画布布局线索' }
    : { pass: false, detail: `游戏/画布项目响应式布局不完整：${missing.join('、')}` };
}

function expectedCanvasSize(logical: WorksCanvasMeasurement, viewport: WorksCanvasMeasurement): WorksCanvasMeasurement {
  const scale = Math.min(viewport.width / logical.width, viewport.height / logical.height);
  return {
    width: logical.width * scale,
    height: logical.height * scale,
  };
}

function measurementMatchesExpected(actual: WorksCanvasMeasurement, expected: WorksCanvasMeasurement): boolean {
  return actual.width >= expected.width * 0.95
    && actual.height >= expected.height * 0.95
    && actual.width <= expected.width * 1.05
    && actual.height <= expected.height * 1.05;
}

function validateCanvasEvidence(evidence: WorksCanvasEvidence): string | null {
  if (!evidence.resize_verified) return '游戏/画布项目未提供 viewport/全屏变化后的重新布局证据';
  const expectedDesktop = expectedCanvasSize(evidence.logical_resolution, evidence.desktop_viewport);
  const expectedMobile = expectedCanvasSize(evidence.logical_resolution, evidence.mobile_viewport);
  if (!measurementMatchesExpected(evidence.expected_max_canvas.desktop, expectedDesktop)) return '桌面视口的最大等比尺寸记录不一致';
  if (!measurementMatchesExpected(evidence.expected_max_canvas.mobile, expectedMobile)) return '移动视口的最大等比尺寸记录不一致';
  if (!measurementMatchesExpected(evidence.desktop_canvas, expectedDesktop)) return '桌面主画布比最大等比尺寸小超过 5% 或溢出';
  if (!measurementMatchesExpected(evidence.mobile_canvas, expectedMobile)) return '移动主画布比最大等比尺寸小超过 5% 或溢出';
  return null;
}

function checkCanvasReportEvidence(report: WorksDeployCheckReport, mode: WorksDeployCheckMode): WorksDeployCheckItem {
  const check = report.checks[GAME_CANVAS_DYNAMIC_WORKS_DEPLOY_CHECK_ID];
  if (!check) return { status: 'BLOCKED', detail: '游戏/画布项目缺少 game_canvas_smoke 检查' };
  const unavailable = check.execution === 'unavailable'
    && (check.status === 'BLOCKED' || check.status === 'SKIPPED');
  if (mode === 'cloud' && unavailable) {
    return { status: 'PASS', detail: '本机 game_canvas_smoke 环境不可用，交由 Works Square 云端构建/运行链路继续验证' };
  }
  if (check.status === 'SKIPPED') return { status: 'SKIPPED', detail: check.detail };
  if (check.status === 'BLOCKED') return { status: 'BLOCKED', detail: check.detail };
  if (!check.command) return { status: 'BLOCKED', detail: 'game_canvas_smoke 缺少实际执行命令' };
  if (!check.canvas_evidence) return { status: 'BLOCKED', detail: 'game_canvas_smoke 缺少桌面/移动视口和画布尺寸证据' };
  const evidenceError = validateCanvasEvidence(check.canvas_evidence);
  return evidenceError
    ? { status: 'BLOCKED', detail: evidenceError }
    : { status: 'PASS', detail: 'game_canvas_smoke 包含桌面、移动、最大等比尺寸和 resize 复测证据' };
}

function checkCanvasHumanReportEvidence(
  reportText: string,
  report: WorksDeployCheckReport,
  mode: WorksDeployCheckMode,
): WorksDeployCheckItem {
  const canvasCheck = report.checks[GAME_CANVAS_DYNAMIC_WORKS_DEPLOY_CHECK_ID];
  if (mode === 'cloud' && canvasCheck?.execution === 'unavailable'
    && (canvasCheck.status === 'BLOCKED' || canvasCheck.status === 'SKIPPED')) {
    return { status: 'PASS', detail: '本机画布报告字段因浏览器环境不可用暂缺，云端构建链路继续承担运行验收' };
  }
  const requiredFields: Array<{ label: string; pattern: RegExp }> = [
    { label: '逻辑分辨率', pattern: /逻辑分辨率|logical_resolution/i },
    { label: '桌面视口', pattern: /桌面(?:视口|viewport)|desktop_viewport/i },
    { label: '移动视口', pattern: /移动(?:视口|viewport)|mobile_viewport/i },
    { label: '主画布实际尺寸', pattern: /(?:主画布|canvas).*(?:实际尺寸|actual|desktop_canvas|mobile_canvas)/is },
    { label: '最大等比预期尺寸', pattern: /最大等比|expected_max_canvas/i },
    { label: 'resize 复测', pattern: /resize|全屏.*(?:变化|复测)|重新布局/i },
  ];
  const missing = requiredFields.filter(({ pattern }) => !pattern.test(reportText)).map(({ label }) => label);
  return missing.length > 0
    ? { status: 'BLOCKED', detail: `部署报告缺少游戏/画布字段：${missing.join('、')}` }
    : { status: 'PASS', detail: '部署报告包含游戏/画布逻辑分辨率、视口、画布尺寸、最大等比预期和 resize 证据' };
}

async function readArchiveData(archivePath: string, entry: ArchiveEntry): Promise<Buffer> {
  const data = entry.getData();
  if (data.byteLength > 0 || entry.header.size === 0) return data;
  try {
    const result = await execFileAsync('unzip', ['-p', archivePath, entry.entryName], { maxBuffer: MAX_SCANNED_TEXT_BYTES });
    return Buffer.from(result.stdout);
  } catch (error) {
    throw new Error(
      `Unable to read archive entry ${entry.entryName}: ${error instanceof Error ? error.message : String(error)}`,
      { cause: error },
    );
  }
}

async function readArchiveText(archivePath: string, entry: ArchiveEntry): Promise<string> {
  return (await readArchiveData(archivePath, entry)).toString('utf8');
}

function checkReportEvidence(
  projectPath: string,
  report: WorksDeployCheckReport,
  publish: WorksPublishData,
  zipSha256: string,
  mode: WorksDeployCheckMode,
): WorksDeployCheckItem[] {
  const checks: WorksDeployCheckItem[] = [];
  const add = (status: WorksDeployCheckStatus, detail: string) => checks.push({ status, detail });
  const isEnvironmentUnavailable = (check: WorksDeployCheckItem): boolean => check.execution === 'unavailable'
    || (check.status === 'SKIPPED' && ENVIRONMENT_CAPABILITY_UNAVAILABLE.test(check.detail));
  const isAllowedCloudUnavailable = (check: WorksDeployCheckItem): boolean => mode === 'cloud'
    && isEnvironmentUnavailable(check)
    && (check.status === 'BLOCKED' || check.status === 'SKIPPED');
  const reportStatus = aggregateVerificationStatus([
    { status: report.status, detail: '部署报告总状态' },
    ...Object.values(report.checks),
  ]);
  const reportChecksPass = Object.values(report.checks).every((check) => check.status === 'PASS');
  const reportChecksCloudReady = Object.values(report.checks).every((check) => check.status === 'PASS' || isAllowedCloudUnavailable(check));
  const reportReady = mode === 'cloud'
    ? (report.status === 'PASS' && reportChecksPass
      || (report.status === 'BLOCKED' || report.status === 'SKIPPED') && reportChecksCloudReady)
    : reportStatus !== 'BLOCKED';
  add(reportReady ? (mode === 'cloud' ? 'PASS' : reportStatus) : 'BLOCKED', reportReady
    ? (mode === 'cloud' && !reportChecksPass
      ? '本地动态 smoke 未执行但均明确标记 unavailable，ZIP 可交由 Works Square 云端构建'
      : reportStatus === 'SKIPPED' ? '部署报告包含因当前环境能力不足而未执行的检查' : '部署报告及其检查项标记为 PASS')
    : '部署报告或其中一项检查标记为 BLOCKED');
  const reportZipPath = resolveZipPath(projectPath, report.zip_file_path);
  const publishZipPath = resolveZipPath(projectPath, publish.zip_file_path);
  add(samePath(reportZipPath, publishZipPath) ? 'PASS' : 'BLOCKED', samePath(reportZipPath, publishZipPath) ? '报告和 works-publish.json 指向同一个 zip' : '报告和 works-publish.json 指向不同 zip');
  add(report.zip_sha256 === zipSha256 ? 'PASS' : 'BLOCKED', report.zip_sha256 === zipSha256 ? '报告绑定了当前 zip' : '报告中的 zip_sha256 与当前 zip 不一致');
  for (const id of REQUIRED_DYNAMIC_WORKS_DEPLOY_CHECK_IDS) {
    const check = report.checks[id];
    const status = check.status === 'PASS' || isAllowedCloudUnavailable(check)
      ? 'PASS'
      : check.status === 'SKIPPED' && mode !== 'cloud'
        ? 'SKIPPED'
        : 'BLOCKED';
    add(status, check.detail);
  }
  return checks;
}

export async function readWorksDeployCheck(
  projectPath: string,
  publish: WorksPublishData | null,
  options: { mode?: WorksDeployCheckMode } = {},
): Promise<WorksDeployCheckResult> {
  const mode = options.mode ?? 'local';
  const filePath = path.join(projectPath, WORKS_DEPLOY_CHECK_FILE_NAME);
  try {
    await access(filePath);
  } catch {
    return { status: 'missing', filePath };
  }

  try {
    const report = normalizeReport(JSON.parse(await readFile(filePath, 'utf8')) as unknown);
    if (!publish) return { status: 'blocked', filePath, report, error: 'works-publish.json 缺失或无效' };
    const verification = await verifyWorksDeployPackage(projectPath, publish, report, { mode });
    return {
      status: verification.status === 'PASS'
        ? 'pass'
        : verification.status === 'SKIPPED'
          ? 'warning'
          : 'blocked',
      filePath,
      report,
      checks: report.checks,
      static_checks: Object.fromEntries(verification.checks.map((check, index) => [`static_${index + 1}`, check])),
      ...(verification.zipSha256 ? { zip_sha256: verification.zipSha256 } : {}),
      ...(verification.status === 'BLOCKED' ? { error: verification.error } : {}),
    };
  } catch (error) {
    return { status: 'invalid', filePath, error: error instanceof Error ? error.message : String(error) };
  }
}

type VerificationResult = {
  status: WorksDeployCheckStatus;
  checks: WorksDeployCheckItem[];
  zipSha256?: string;
  error?: string;
};

export async function verifyWorksDeployPackage(
  projectPath: string,
  publish: WorksPublishData,
  report: WorksDeployCheckReport,
  options: { mode?: WorksDeployCheckMode } = {},
): Promise<VerificationResult> {
  const mode = options.mode ?? 'local';
  const checks: WorksDeployCheckItem[] = [];
  const add = (status: WorksDeployCheckStatus, detail: string) => checks.push({ status, detail });
  const zipPath = resolveZipPath(projectPath, publish.zip_file_path);

  let archiveStat;
  try {
    archiveStat = await stat(zipPath);
    if (!archiveStat.isFile()) throw new Error('zip_file_path must point to a file');
  } catch (error) {
    add('BLOCKED', `找不到 zip 程序包：${error instanceof Error ? error.message : String(error)}`);
    return { status: 'BLOCKED', checks, error: '找不到 zip 程序包' };
  }

  if (archiveStat.size > MAX_ZIP_BYTES) add('BLOCKED', `zip 大小超过 50 MB：${archiveStat.size} bytes`);
  else add('PASS', `zip 大小符合限制：${archiveStat.size} bytes`);

  let deploymentReportText = '';
  try {
    deploymentReportText = await readFile(path.join(projectPath, WORKS_DEPLOY_REPORT_FILE_NAME), 'utf8');
    add('PASS', '项目根目录包含部署报告');
  } catch {
    add('BLOCKED', '项目根目录缺少部署报告');
  }

  const zipBytes = await readFile(zipPath);
  const zipSha256 = createHash('sha256').update(zipBytes).digest('hex');
  checks.push(...checkReportEvidence(projectPath, report, publish, zipSha256, mode));

  let archive: AdmZip;
  try {
    archive = new AdmZip(zipPath);
    if (!archive.test()) throw new Error('zip integrity test failed');
  } catch (error) {
    add('BLOCKED', `无法读取或解压 zip：${error instanceof Error ? error.message : String(error)}`);
    return finalizeVerification(checks, zipSha256);
  }

  const entries = archive.getEntries();
  const index: ArchiveIndex = new Map();
  let uncompressedBytes = 0;
  let invalidPath = false;
  let duplicatePath = false;
  let unsafeEntry = false;
  for (const entry of entries) {
    const normalized = normalizeArchivePath(entry.entryName);
    if (!normalized) {
      invalidPath = true;
      continue;
    }
    if (index.has(normalized)) duplicatePath = true;
    index.set(normalized, entry);
    uncompressedBytes += entry.header.size;
    if (isSymlink(entry)) unsafeEntry = true;
    if (EXCLUDED_ENTRY.test(normalized)) unsafeEntry = true;
    if (SENSITIVE_ENTRY.test(normalized)) unsafeEntry = true;
  }
  if (entries.length > MAX_ZIP_ENTRIES) add('BLOCKED', `zip 文件数量超过 2000：${entries.length}`);
  else add('PASS', `zip 文件数量符合限制：${entries.length}`);
  if (uncompressedBytes > MAX_UNCOMPRESSED_BYTES) add('BLOCKED', `zip 解压后超过 200 MB：${uncompressedBytes} bytes`);
  else add('PASS', `zip 解压后大小符合限制：${uncompressedBytes} bytes`);
  add(invalidPath ? 'BLOCKED' : 'PASS', invalidPath ? 'zip 包含绝对路径、空路径或路径穿越' : 'zip 路径安全');
  add(duplicatePath ? 'BLOCKED' : 'PASS', duplicatePath ? 'zip 包含重复规范化路径' : 'zip 没有重复规范化路径');
  add(unsafeEntry ? 'BLOCKED' : 'PASS', unsafeEntry ? 'zip 包含符号链接、缓存目录或敏感文件' : 'zip 没有符号链接、缓存目录或敏感文件');

  const manifestEntry = index.get('niancode.yml');
  const composeEntry = index.get('docker-compose.yml');
  add(manifestEntry && !manifestEntry.isDirectory ? 'PASS' : 'BLOCKED', manifestEntry && !manifestEntry.isDirectory ? 'zip 根目录包含 niancode.yml' : 'zip 根目录缺少 niancode.yml');
  add(composeEntry && !composeEntry.isDirectory ? 'PASS' : 'BLOCKED', composeEntry && !composeEntry.isDirectory ? 'zip 根目录包含 docker-compose.yml' : 'zip 根目录缺少 docker-compose.yml');

  if (!manifestEntry || !composeEntry || manifestEntry.isDirectory || composeEntry.isDirectory) {
    return finalizeVerification(checks, zipSha256);
  }

  const manifestText = await readArchiveText(zipPath, manifestEntry);
  const composeText = await readArchiveText(zipPath, composeEntry);
  let parsedManifest: unknown;
  let parsedCompose: unknown;
  try {
    parsedManifest = parseYaml(manifestText);
    parsedCompose = parseYaml(composeText);
  } catch (error) {
    add('BLOCKED', `niancode.yml 或 docker-compose.yml 不是合法 YAML：${error instanceof Error ? error.message : String(error)}`);
    return finalizeVerification(checks, zipSha256);
  }

  const manifest = asRecord(parsedManifest);
  const compose = asRecord(parsedCompose);
  const manifestCompose = asRecord(manifest?.compose);
  const runtimeOk = manifest?.runtime === 'compose';
  const fileOk = readString(manifestCompose ?? {}, 'file') === 'docker-compose.yml';
  const publicService = readString(manifestCompose ?? {}, 'public_service');
  const publicPort = manifestCompose?.public_port;
  add(runtimeOk && fileOk && publicPort === 8080 ? 'PASS' : 'BLOCKED', runtimeOk && fileOk && publicPort === 8080 ? 'niancode.yml 使用 runtime: compose、根目录 docker-compose.yml 和数字端口 8080' : 'niancode.yml 不符合 Works Square Compose manifest 要求');

  const services = asRecord(compose?.services);
  const topLevelVolumes = asRecord(compose?.volumes);
  add(compose?.version === undefined ? 'PASS' : 'BLOCKED', compose?.version === undefined ? 'docker-compose.yml 没有顶层 version' : 'docker-compose.yml 禁止使用顶层 version');
  add(services ? 'PASS' : 'BLOCKED', services ? 'Compose services 是对象' : 'Compose 缺少 services 对象');
  if (!services) return finalizeVerification(checks, zipSha256);

  const publicConfig = asRecord(services[publicService]);
  add(publicConfig ? 'PASS' : 'BLOCKED', publicConfig ? `Compose 存在公开服务 ${publicService}` : `Compose 不存在公开服务 ${publicService}`);
  if (!publicConfig) return finalizeVerification(checks, zipSha256);
  add(getBuildSpec(publicConfig) ? 'PASS' : 'BLOCKED', getBuildSpec(publicConfig) ? '公开服务使用 build 构建自包含镜像' : '公开服务缺少 build，不能依赖运行时宿主机文件');

  const buildContextPaths: Array<{ service: string; context: string; dockerfile: string }> = [];
  let hasUnsafeComposeConfig = false;
  for (const [serviceName, rawService] of Object.entries(services)) {
    const service = asRecord(rawService);
    if (!service) {
      hasUnsafeComposeConfig = true;
      continue;
    }
    if (service.privileged === true || service.network_mode === 'host' || service.pid === 'host' || service.ipc === 'host') hasUnsafeComposeConfig = true;
    if (service.env_file !== undefined && !hasSafeEnvFile(service.env_file, index)) hasUnsafeComposeConfig = true;
    if (service.ports !== undefined && !Array.isArray(service.ports)) hasUnsafeComposeConfig = true;
    if (service.volumes !== undefined && !Array.isArray(service.volumes)) hasUnsafeComposeConfig = true;
    if (service.expose !== undefined && !Array.isArray(service.expose)) hasUnsafeComposeConfig = true;
    if (hasUnsafeComposeEnvironment(service.environment)) hasUnsafeComposeConfig = true;
    const build = getBuildSpec(service);
    if (build) buildContextPaths.push({ service: serviceName, context: build.context, dockerfile: build.dockerfile });
    if (FORBIDDEN_RUNTIME_ACTIONS.test(stringifyCommand(service.command)) || FORBIDDEN_RUNTIME_ACTIONS.test(stringifyCommand(service.entrypoint))) hasUnsafeComposeConfig = true;
    for (const volume of valuesAsList(service.volumes)) {
      const parsedVolume = volumeSource(volume);
      if (!parsedVolume || parsedVolume.type === 'bind' || !parsedVolume.source || parsedVolume.source.startsWith('.') || parsedVolume.source.startsWith('/') || parsedVolume.source.startsWith('~') || isWindowsAbsolute(parsedVolume.source) || parsedVolume.source.includes('..') || !topLevelVolumes?.[parsedVolume.source]) {
        hasUnsafeComposeConfig = true;
      }
    }
    if (serviceName === publicService) {
      const ports = valuesAsList(service.ports).map(extractPort);
      const publicPortOk = ports.length > 0 && ports.every((port) => port?.hostIp === '127.0.0.1' && port.hostPort === '' && port.containerPort === '8080');
      add(publicPortOk ? 'PASS' : 'BLOCKED', publicPortOk ? '公开服务使用 127.0.0.1::8080 动态端口' : '公开服务没有使用 127.0.0.1::8080 动态端口');
    } else if (service.ports !== undefined) {
      hasUnsafeComposeConfig = true;
    }
  }
  add(hasUnsafeComposeConfig ? 'BLOCKED' : 'PASS', hasUnsafeComposeConfig ? 'Compose 含有 bind mount、危险宿主配置、未声明环境变量或运行时构建命令' : 'Compose 没有 bind mount、危险宿主配置或运行时构建命令');

  let scannedTextBytes = 0;
  let storageUnsafe = false;
  let secretUnsafe = false;
  const textEntries = new Map<string, string>();
  for (const [name, entry] of index) {
    if (entry.isDirectory || !isTextEntry(name)) continue;
    if (scannedTextBytes >= MAX_SCANNED_TEXT_BYTES) break;
    const data = await readArchiveData(zipPath, entry);
    scannedTextBytes += data.byteLength;
    const text = data.toString('utf8');
    textEntries.set(name, text);
    if (PRIVATE_KEY_CONTENT.test(text) || HIGH_CONFIDENCE_SECRET.test(text)) secretUnsafe = true;
    if (STORAGE_ACCESS.test(text) && !hasSafeStorageAdapter(text)) storageUnsafe = true;
  }
  add(storageUnsafe ? 'BLOCKED' : 'PASS', storageUnsafe ? '浏览器持久化 API 使用没有可识别的异常降级保护' : 'Web Storage、Cookie、IndexedDB 和 Service Worker 使用具备降级保护或未使用');
  add(secretUnsafe ? 'BLOCKED' : 'PASS', secretUnsafe ? '源码或配置包含私钥/高置信度凭据' : '没有发现私钥或高置信度凭据');

  let contextUnsafe = false;
  for (const build of buildContextPaths) {
    const context = safePath(build.context);
    const dockerfile = joinArchivePath(build.context, build.dockerfile);
    if (context === null || dockerfile === null || !index.get(dockerfile) || index.get(dockerfile)?.isDirectory) {
      contextUnsafe = true;
      continue;
    }
    const prefix = context === '' ? '' : `${context}/`;
    const contextNames = [...index.keys()].filter((name) => name === context || name.startsWith(prefix));
    const hasPackage = contextNames.includes(`${prefix}package.json`) || contextNames.includes('package.json') && context === '';
    const hasNodeLock = ['package-lock.json', 'pnpm-lock.yaml', 'yarn.lock'].some((lock) => contextNames.includes(`${prefix}${lock}`) || context === '' && contextNames.includes(lock));
    const hasPythonDeclaration = contextNames.some((name) => name === `${prefix}pyproject.toml` || name === `${prefix}requirements.txt` || context === '' && (name === 'pyproject.toml' || name === 'requirements.txt'));
    const hasPythonLock = contextNames.some((name) => /(?:^|\/)(?:uv\.lock|poetry\.lock|pdm\.lock|requirements\.lock)$/.test(name));
    if (hasPackage && !hasNodeLock) contextUnsafe = true;
    if (hasPythonDeclaration && !hasPythonLock) contextUnsafe = true;
    const dockerfileText = index.get(dockerfile) ? await readArchiveText(zipPath, index.get(dockerfile) as ArchiveEntry) : '';
    const dockerStartText = (dockerfileText.match(/^\s*(?:CMD|ENTRYPOINT).*$/gim) ?? []).join('\n').replace(/[,[\]"'()]/g, ' ');
    if (!/^\s*(?:CMD|ENTRYPOINT)\b/im.test(dockerfileText) || FORBIDDEN_RUNTIME_ACTIONS.test(dockerStartText)) contextUnsafe = true;
    if (hasPackage && !/\b(?:npm|pnpm|yarn)\s+(?:ci|install|i)\b/i.test(dockerfileText)) contextUnsafe = true;
    const packageEntryName = context === '' ? 'package.json' : `${prefix}package.json`;
    const packageText = hasPackage && index.get(packageEntryName)
      ? await readArchiveText(zipPath, index.get(packageEntryName) as ArchiveEntry)
      : '';
    const viteConfigName = contextNames.find((name) => /(?:^|\/)vite\.config\.(?:js|ts|mjs|mts|cjs|cts)$/.test(name));
    const isViteProject = Boolean(viteConfigName || /\b(?:vite|@vitejs\/plugin-[A-Za-z0-9_-]+)\b/i.test(packageText));
    if (isViteProject) {
      const viteConfig = viteConfigName && index.get(viteConfigName) ? await readArchiveText(zipPath, index.get(viteConfigName) as ArchiveEntry) : '';
      if (!hasPackage || !hasNodeLock || !viteConfigName || !/\bbase\s*:\s*["']\.\/["']/.test(viteConfig)) contextUnsafe = true;
      if (!/\b(?:npm|pnpm|yarn)\s+(?:run\s+build|build)\b/i.test(dockerfileText)) contextUnsafe = true;
    }
    if (hasPackage && /(?:^|\/)index\.html$/.test(contextNames.join('\n'))) {
      const htmlEntry = contextNames.find((name) => /(?:^|\/)index\.html$/.test(name));
      const html = htmlEntry && index.get(htmlEntry) ? await readArchiveText(zipPath, index.get(htmlEntry) as ArchiveEntry) : '';
      if (/(?:src|href)=["']\/assets\//i.test(html)) contextUnsafe = true;
    }
    let runtimeText = `${dockerfileText}\n${packageText}`;
    for (const name of contextNames) {
      const entry = index.get(name);
      if (!entry || !/(?:nginx\.conf|server\.(?:js|ts)|main\.(?:py|js|ts))$/.test(name)) continue;
      runtimeText += `\n${await readArchiveText(zipPath, entry)}`;
    }
    const mentions8080 = /8080/.test(runtimeText);
    const listensOnAllInterfaces = /0\.0\.0\.0|listen\s+8080\b|--host\s+0\.0\.0\.0/i.test(runtimeText);
    if (!mentions8080 || !listensOnAllInterfaces) contextUnsafe = true;
  }
  add(contextUnsafe ? 'BLOCKED' : 'PASS', contextUnsafe ? 'build context、Dockerfile、锁文件、Vite 相对资源、0.0.0.0:8080 监听或运行约束不完整' : 'build context、Dockerfile、锁文件、Vite 资源路径和 0.0.0.0:8080 运行约束通过');

  const canvasProject = isCanvasProject(publish, index, textEntries);
  if (canvasProject) {
    const canvasLayout = inspectCanvasLayout(textEntries);
    add(canvasLayout.pass ? 'PASS' : 'BLOCKED', canvasLayout.detail);
    checks.push(checkCanvasReportEvidence(report, mode));
    checks.push(checkCanvasHumanReportEvidence(deploymentReportText, report, mode));
  }

  return finalizeVerification(checks, zipSha256);
}

function finalizeVerification(checks: WorksDeployCheckItem[], zipSha256?: string): VerificationResult {
  const failed = checks.filter((check) => check.status === 'BLOCKED');
  return {
    status: aggregateVerificationStatus(checks),
    checks,
    ...(zipSha256 ? { zipSha256 } : {}),
    ...(failed.length > 0 ? { error: failed.map((check) => check.detail).join('；') } : {}),
  };
}

function aggregateVerificationStatus(checks: WorksDeployCheckItem[]): WorksDeployCheckStatus {
  if (checks.some((check) => check.status === 'BLOCKED')) return 'BLOCKED';
  if (checks.some((check) => check.status === 'SKIPPED')) return 'SKIPPED';
  return 'PASS';
}