package acceptancesnapshot

import (
	"bytes"
	"context"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"net/url"
	"regexp"
	"sort"
	"strconv"
	"strings"
	"time"

	"github.com/jackc/pgx/v5"
	"github.com/jackc/pgx/v5/pgxpool"
)

const (
	SchemaVersion          = "acceptance-snapshot/v1"
	LocalClusterSettingKey = "acceptance_local_cluster_id"
)

var (
	fullSHAPattern = regexp.MustCompile(`^[0-9a-f]{40}$`)
	hashPattern    = regexp.MustCompile(`^[0-9a-f]{64}$`)
)

type Source struct {
	ReleaseSHA string    `json:"releaseSha"`
	ConfigHash string    `json:"configHash"`
	CreatedAt  time.Time `json:"createdAt"`
}

type Snapshot struct {
	SchemaVersion  string      `json:"schemaVersion"`
	Source         Source      `json:"source"`
	Candidates     []Candidate `json:"candidates"`
	SnapshotSHA256 string      `json:"snapshotSha256"`
	SecretSafe     bool        `json:"secretSafe"`
}

type Candidate struct {
	Workload      string          `json:"workload"`
	Provider      Provider        `json:"provider"`
	BaseModel     BaseModel       `json:"baseModel"`
	Platform      Platform        `json:"platform"`
	PlatformModel PlatformModel   `json:"platformModel"`
	RuntimePolicy RuntimePolicy   `json:"runtimePolicy"`
	PricingRules  []PricingRule   `json:"pricingRules"`
	Metadata      CandidateSource `json:"metadata"`
}

type Provider struct {
	ProviderKey            string         `json:"providerKey"`
	ProviderCode           string         `json:"providerCode"`
	DisplayName            string         `json:"displayName"`
	ProviderType           string         `json:"providerType"`
	CapabilitySchema       map[string]any `json:"capabilitySchema"`
	DefaultRateLimitPolicy map[string]any `json:"defaultRateLimitPolicy"`
}

type BaseModel struct {
	CanonicalModelKey      string         `json:"canonicalModelKey"`
	InvocationName         string         `json:"invocationName"`
	ProviderModelName      string         `json:"providerModelName"`
	ModelType              []string       `json:"modelType"`
	DisplayName            string         `json:"displayName"`
	Capabilities           map[string]any `json:"capabilities"`
	BaseBillingConfig      map[string]any `json:"baseBillingConfig"`
	DefaultRateLimitPolicy map[string]any `json:"defaultRateLimitPolicy"`
	RuntimePolicyOverride  map[string]any `json:"runtimePolicyOverride"`
	PricingVersion         int            `json:"pricingVersion"`
}

type Platform struct {
	Provider              string         `json:"provider"`
	PlatformKey           string         `json:"platformKey"`
	Name                  string         `json:"name"`
	BaseURLPath           string         `json:"baseUrlPath"`
	AuthType              string         `json:"authType"`
	Config                map[string]any `json:"config"`
	DefaultPricingMode    string         `json:"defaultPricingMode"`
	DefaultDiscountFactor string         `json:"defaultDiscountFactor"`
	RetryPolicy           map[string]any `json:"retryPolicy"`
	RateLimitPolicy       map[string]any `json:"rateLimitPolicy"`
	Priority              int            `json:"priority"`
}

type PlatformModel struct {
	ModelName             string         `json:"modelName"`
	ProviderModelName     string         `json:"providerModelName"`
	ModelAlias            string         `json:"modelAlias"`
	ModelType             []string       `json:"modelType"`
	DisplayName           string         `json:"displayName"`
	CapabilityOverride    map[string]any `json:"capabilityOverride"`
	Capabilities          map[string]any `json:"capabilities"`
	PricingMode           string         `json:"pricingMode"`
	DiscountFactor        string         `json:"discountFactor"`
	BillingConfigOverride map[string]any `json:"billingConfigOverride"`
	BillingConfig         map[string]any `json:"billingConfig"`
	PermissionConfig      map[string]any `json:"permissionConfig"`
	RetryPolicy           map[string]any `json:"retryPolicy"`
	RateLimitPolicy       map[string]any `json:"rateLimitPolicy"`
	RuntimePolicyOverride map[string]any `json:"runtimePolicyOverride"`
}

type RuntimePolicy struct {
	RateLimitPolicy   map[string]any `json:"rateLimitPolicy"`
	RetryPolicy       map[string]any `json:"retryPolicy"`
	AutoDisablePolicy map[string]any `json:"autoDisablePolicy"`
	DegradePolicy     map[string]any `json:"degradePolicy"`
}

type PricingRule struct {
	RuleKey         string         `json:"ruleKey"`
	DisplayName     string         `json:"displayName"`
	ResourceType    string         `json:"resourceType"`
	Unit            string         `json:"unit"`
	BasePrice       string         `json:"basePrice"`
	Currency        string         `json:"currency"`
	BaseWeight      map[string]any `json:"baseWeight"`
	DynamicWeight   map[string]any `json:"dynamicWeight"`
	CalculatorType  string         `json:"calculatorType"`
	DimensionSchema map[string]any `json:"dimensionSchema"`
	FormulaConfig   map[string]any `json:"formulaConfig"`
	Priority        int            `json:"priority"`
}

type CandidateSource struct {
	PlatformID      string `json:"platformId"`
	PlatformModelID string `json:"platformModelId"`
	BaseModelID     string `json:"baseModelId"`
}

type ExportOptions struct {
	ReleaseSHA string
	Now        func() time.Time
}

func Export(ctx context.Context, pool *pgxpool.Pool, options ExportOptions) (Snapshot, error) {
	releaseSHA := strings.ToLower(strings.TrimSpace(options.ReleaseSHA))
	if !fullSHAPattern.MatchString(releaseSHA) {
		return Snapshot{}, errors.New("source release SHA must be a full lowercase Git SHA")
	}
	now := options.Now
	if now == nil {
		now = time.Now
	}
	snapshot := Snapshot{
		SchemaVersion: SchemaVersion,
		Source: Source{
			ReleaseSHA: releaseSHA,
			CreatedAt:  now().UTC(),
		},
		SecretSafe: true,
	}
	for _, workload := range []string{"gemini_image_edit", "multi_reference_video"} {
		candidate, err := exportCandidate(ctx, pool, workload)
		if err != nil {
			return Snapshot{}, err
		}
		snapshot.Candidates = append(snapshot.Candidates, candidate)
	}
	sort.Slice(snapshot.Candidates, func(i, j int) bool {
		return snapshot.Candidates[i].Workload < snapshot.Candidates[j].Workload
	})
	configHash, err := candidateConfigHash(snapshot.Candidates)
	if err != nil {
		return Snapshot{}, err
	}
	snapshot.Source.ConfigHash = configHash
	snapshot.SnapshotSHA256, err = snapshotHash(snapshot)
	if err != nil {
		return Snapshot{}, err
	}
	if err := Validate(snapshot); err != nil {
		return Snapshot{}, err
	}
	return snapshot, nil
}

func Decode(payload []byte) (Snapshot, error) {
	decoder := json.NewDecoder(bytes.NewReader(payload))
	decoder.UseNumber()
	decoder.DisallowUnknownFields()
	var snapshot Snapshot
	if err := decoder.Decode(&snapshot); err != nil {
		return Snapshot{}, fmt.Errorf("decode acceptance snapshot: %w", err)
	}
	if err := Validate(snapshot); err != nil {
		return Snapshot{}, err
	}
	return snapshot, nil
}

func Encode(snapshot Snapshot) ([]byte, error) {
	if err := Validate(snapshot); err != nil {
		return nil, err
	}
	payload, err := json.MarshalIndent(snapshot, "", "  ")
	if err != nil {
		return nil, err
	}
	return append(payload, '\n'), nil
}

func Validate(snapshot Snapshot) error {
	if snapshot.SchemaVersion != SchemaVersion {
		return fmt.Errorf("unsupported acceptance snapshot schema %q", snapshot.SchemaVersion)
	}
	if !fullSHAPattern.MatchString(snapshot.Source.ReleaseSHA) {
		return errors.New("snapshot source release SHA is invalid")
	}
	if !hashPattern.MatchString(snapshot.Source.ConfigHash) || !hashPattern.MatchString(snapshot.SnapshotSHA256) {
		return errors.New("snapshot hashes must be lowercase SHA-256 values")
	}
	if !snapshot.SecretSafe {
		return errors.New("snapshot is not marked secret-safe")
	}
	if len(snapshot.Candidates) != 2 {
		return fmt.Errorf("snapshot must contain exactly two workload candidates, got %d", len(snapshot.Candidates))
	}
	workloads := map[string]bool{}
	for index := range snapshot.Candidates {
		candidate := &snapshot.Candidates[index]
		if candidate.Workload != "gemini_image_edit" && candidate.Workload != "multi_reference_video" {
			return fmt.Errorf("unsupported snapshot workload %q", candidate.Workload)
		}
		if workloads[candidate.Workload] {
			return fmt.Errorf("duplicate snapshot workload %q", candidate.Workload)
		}
		workloads[candidate.Workload] = true
		if err := validateCandidate(*candidate); err != nil {
			return fmt.Errorf("%s: %w", candidate.Workload, err)
		}
	}
	configHash, err := candidateConfigHash(snapshot.Candidates)
	if err != nil {
		return err
	}
	if configHash != snapshot.Source.ConfigHash {
		return errors.New("snapshot candidate config hash does not match")
	}
	hash, err := snapshotHash(snapshot)
	if err != nil {
		return err
	}
	if hash != snapshot.SnapshotSHA256 {
		return errors.New("snapshot SHA-256 does not match its content")
	}
	payload, err := json.Marshal(snapshot)
	if err != nil {
		return err
	}
	if unsafePath, ok := findUnsafeJSON(payload); ok {
		return fmt.Errorf("snapshot contains forbidden secret-like field %s", unsafePath)
	}
	return nil
}

func Import(ctx context.Context, pool *pgxpool.Pool, snapshot Snapshot, localClusterID string) error {
	if err := Validate(snapshot); err != nil {
		return err
	}
	localClusterID = strings.TrimSpace(localClusterID)
	if localClusterID == "" {
		return errors.New("local cluster ID is required")
	}
	var marker string
	err := pool.QueryRow(ctx, `
SELECT COALESCE(value->>'clusterId', '')
FROM system_settings
WHERE setting_key = $1`, LocalClusterSettingKey).Scan(&marker)
	if err != nil {
		return fmt.Errorf("read local acceptance cluster marker: %w", err)
	}
	if marker != localClusterID {
		return fmt.Errorf("refusing snapshot import: local cluster marker mismatch")
	}
	tx, err := pool.Begin(ctx)
	if err != nil {
		return err
	}
	defer func() { _ = tx.Rollback(ctx) }()

	platformKeys := make([]string, 0, len(snapshot.Candidates))
	for _, candidate := range snapshot.Candidates {
		if err := importCandidate(ctx, tx, candidate, snapshot.Source.ConfigHash); err != nil {
			return fmt.Errorf("import %s candidate: %w", candidate.Workload, err)
		}
		platformKeys = append(platformKeys, candidate.Platform.PlatformKey)
	}
	if _, err := tx.Exec(ctx, `
UPDATE integration_platforms
SET status = 'disabled',
    disabled_reason = 'local_acceptance_snapshot_isolation',
    updated_at = now()
WHERE deleted_at IS NULL
  AND NOT (platform_key = ANY($1::text[]))`, platformKeys); err != nil {
		return err
	}
	_, err = tx.Exec(ctx, `
INSERT INTO system_settings (setting_key, value)
VALUES ('acceptance_snapshot', $1::jsonb)
ON CONFLICT (setting_key) DO UPDATE
SET value = EXCLUDED.value, updated_at = now()`,
		mustJSON(map[string]any{
			"schemaVersion":  snapshot.SchemaVersion,
			"releaseSha":     snapshot.Source.ReleaseSHA,
			"configHash":     snapshot.Source.ConfigHash,
			"snapshotSha256": snapshot.SnapshotSHA256,
		}),
	)
	if err != nil {
		return err
	}
	return tx.Commit(ctx)
}

func exportCandidate(ctx context.Context, pool *pgxpool.Pool, workload string) (Candidate, error) {
	row := pool.QueryRow(ctx, exportCandidateSQL, workload)
	var candidate Candidate
	var providerCapability, providerRateLimit []byte
	var baseModelType, baseCapabilities, baseBilling, baseRateLimit, baseRuntimeOverride []byte
	var platformConfig, platformRetry, platformRateLimit []byte
	var modelType, modelCapabilityOverride, modelCapabilities []byte
	var modelBillingOverride, modelBilling, modelPermission, modelRetry, modelRateLimit, modelRuntimeOverride []byte
	var runtimeRateLimit, runtimeRetry, runtimeAutoDisable, runtimeDegrade []byte
	var pricingRules []byte
	var baseURL string
	err := row.Scan(
		&candidate.Provider.ProviderKey,
		&candidate.Provider.ProviderCode,
		&candidate.Provider.DisplayName,
		&candidate.Provider.ProviderType,
		&providerCapability,
		&providerRateLimit,
		&candidate.BaseModel.CanonicalModelKey,
		&candidate.BaseModel.InvocationName,
		&candidate.BaseModel.ProviderModelName,
		&baseModelType,
		&candidate.BaseModel.DisplayName,
		&baseCapabilities,
		&baseBilling,
		&baseRateLimit,
		&baseRuntimeOverride,
		&candidate.BaseModel.PricingVersion,
		&candidate.Platform.Provider,
		&candidate.Platform.PlatformKey,
		&candidate.Platform.Name,
		&baseURL,
		&candidate.Platform.AuthType,
		&platformConfig,
		&candidate.Platform.DefaultPricingMode,
		&candidate.Platform.DefaultDiscountFactor,
		&platformRetry,
		&platformRateLimit,
		&candidate.Platform.Priority,
		&candidate.PlatformModel.ModelName,
		&candidate.PlatformModel.ProviderModelName,
		&candidate.PlatformModel.ModelAlias,
		&modelType,
		&candidate.PlatformModel.DisplayName,
		&modelCapabilityOverride,
		&modelCapabilities,
		&candidate.PlatformModel.PricingMode,
		&candidate.PlatformModel.DiscountFactor,
		&modelBillingOverride,
		&modelBilling,
		&modelPermission,
		&modelRetry,
		&modelRateLimit,
		&modelRuntimeOverride,
		&runtimeRateLimit,
		&runtimeRetry,
		&runtimeAutoDisable,
		&runtimeDegrade,
		&pricingRules,
		&candidate.Metadata.PlatformID,
		&candidate.Metadata.PlatformModelID,
		&candidate.Metadata.BaseModelID,
	)
	if errors.Is(err, pgx.ErrNoRows) {
		return Candidate{}, fmt.Errorf("no enabled production candidate found for %s", workload)
	}
	if err != nil {
		return Candidate{}, err
	}
	candidate.Workload = workload
	candidate.Provider.CapabilitySchema = decodeObject(providerCapability)
	candidate.Provider.DefaultRateLimitPolicy = decodeObject(providerRateLimit)
	candidate.BaseModel.ModelType = decodeStringArray(baseModelType)
	candidate.BaseModel.Capabilities = decodeObject(baseCapabilities)
	candidate.BaseModel.BaseBillingConfig = decodeObject(baseBilling)
	candidate.BaseModel.DefaultRateLimitPolicy = decodeObject(baseRateLimit)
	candidate.BaseModel.RuntimePolicyOverride = decodeObject(baseRuntimeOverride)
	candidate.Platform.BaseURLPath = safeBaseURLPath(baseURL)
	candidate.Platform.Config = sanitizeMap(decodeObject(platformConfig))
	candidate.Platform.RetryPolicy = decodeObject(platformRetry)
	candidate.Platform.RateLimitPolicy = decodeObject(platformRateLimit)
	candidate.PlatformModel.ModelType = decodeStringArray(modelType)
	candidate.PlatformModel.CapabilityOverride = decodeObject(modelCapabilityOverride)
	candidate.PlatformModel.Capabilities = decodeObject(modelCapabilities)
	candidate.PlatformModel.BillingConfigOverride = decodeObject(modelBillingOverride)
	candidate.PlatformModel.BillingConfig = decodeObject(modelBilling)
	candidate.PlatformModel.PermissionConfig = decodeObject(modelPermission)
	candidate.PlatformModel.RetryPolicy = decodeObject(modelRetry)
	candidate.PlatformModel.RateLimitPolicy = decodeObject(modelRateLimit)
	candidate.PlatformModel.RuntimePolicyOverride = decodeObject(modelRuntimeOverride)
	candidate.RuntimePolicy = RuntimePolicy{
		RateLimitPolicy:   decodeObject(runtimeRateLimit),
		RetryPolicy:       decodeObject(runtimeRetry),
		AutoDisablePolicy: decodeObject(runtimeAutoDisable),
		DegradePolicy:     decodeObject(runtimeDegrade),
	}
	if err := decodeJSON(pricingRules, &candidate.PricingRules); err != nil {
		return Candidate{}, err
	}
	return candidate, nil
}

func importCandidate(ctx context.Context, tx pgx.Tx, candidate Candidate, configHash string) error {
	var providerID string
	err := tx.QueryRow(ctx, `
INSERT INTO model_catalog_providers (
  provider_key, provider_code, display_name, provider_type, source,
  capability_schema, default_rate_limit_policy, metadata, status
)
VALUES ($1, $2, $3, $4, 'acceptance-snapshot',
        $5::jsonb, $6::jsonb, $7::jsonb, 'active')
ON CONFLICT (provider_key) DO UPDATE
SET provider_code = EXCLUDED.provider_code,
    display_name = EXCLUDED.display_name,
    provider_type = EXCLUDED.provider_type,
    source = EXCLUDED.source,
    capability_schema = EXCLUDED.capability_schema,
    default_rate_limit_policy = EXCLUDED.default_rate_limit_policy,
    metadata = EXCLUDED.metadata,
    status = 'active',
    updated_at = now()
RETURNING id::text`,
		candidate.Provider.ProviderKey,
		candidate.Provider.ProviderCode,
		candidate.Provider.DisplayName,
		candidate.Provider.ProviderType,
		mustJSON(candidate.Provider.CapabilitySchema),
		mustJSON(candidate.Provider.DefaultRateLimitPolicy),
		mustJSON(map[string]any{"acceptanceSnapshot": true, "configHash": configHash}),
	).Scan(&providerID)
	if err != nil {
		return err
	}
	runtimePolicyID, err := importRuntimePolicy(ctx, tx, candidate, configHash)
	if err != nil {
		return err
	}
	pricingRuleSetID, err := importPricingRules(ctx, tx, candidate, configHash)
	if err != nil {
		return err
	}
	var baseModelID string
	err = tx.QueryRow(ctx, `
INSERT INTO base_model_catalog (
  provider_id, provider_key, canonical_model_key, invocation_name,
  provider_model_name, model_type, display_name, capabilities,
  base_billing_config, default_rate_limit_policy, pricing_rule_set_id,
  runtime_policy_set_id, runtime_policy_override, pricing_version,
  catalog_type, status, metadata
)
VALUES (
  $1::uuid, $2, $3, $4, $5, $6::jsonb, $7, $8::jsonb,
  $9::jsonb, $10::jsonb, NULLIF($11, '')::uuid,
  NULLIF($12, '')::uuid, $13::jsonb, $14,
  'custom', 'active', $15::jsonb
)
ON CONFLICT (canonical_model_key) DO UPDATE
SET provider_id = EXCLUDED.provider_id,
    provider_key = EXCLUDED.provider_key,
    invocation_name = EXCLUDED.invocation_name,
    provider_model_name = EXCLUDED.provider_model_name,
    model_type = EXCLUDED.model_type,
    display_name = EXCLUDED.display_name,
    capabilities = EXCLUDED.capabilities,
    base_billing_config = EXCLUDED.base_billing_config,
    default_rate_limit_policy = EXCLUDED.default_rate_limit_policy,
    pricing_rule_set_id = EXCLUDED.pricing_rule_set_id,
    runtime_policy_set_id = EXCLUDED.runtime_policy_set_id,
    runtime_policy_override = EXCLUDED.runtime_policy_override,
    pricing_version = EXCLUDED.pricing_version,
    metadata = EXCLUDED.metadata,
    status = 'active',
    updated_at = now()
RETURNING id::text`,
		providerID,
		candidate.Provider.ProviderKey,
		candidate.BaseModel.CanonicalModelKey,
		candidate.BaseModel.InvocationName,
		candidate.BaseModel.ProviderModelName,
		mustJSON(candidate.BaseModel.ModelType),
		candidate.BaseModel.DisplayName,
		mustJSON(candidate.BaseModel.Capabilities),
		mustJSON(candidate.BaseModel.BaseBillingConfig),
		mustJSON(candidate.BaseModel.DefaultRateLimitPolicy),
		pricingRuleSetID,
		runtimePolicyID,
		mustJSON(candidate.BaseModel.RuntimePolicyOverride),
		max(candidate.BaseModel.PricingVersion, 1),
		mustJSON(map[string]any{"acceptanceSnapshot": true, "configHash": configHash}),
	).Scan(&baseModelID)
	if err != nil {
		return err
	}
	var platformID string
	platformConfig := sanitizeMap(candidate.Platform.Config)
	platformConfig["testMode"] = false
	platformConfig["acceptanceSnapshot"] = true
	err = tx.QueryRow(ctx, `
INSERT INTO integration_platforms (
  provider, platform_key, name, base_url, auth_type, credentials, config,
  default_pricing_mode, default_discount_factor, pricing_rule_set_id,
  retry_policy, rate_limit_policy, priority, status, disabled_reason,
  cooldown_until, deleted_at
)
VALUES (
  $1, $2, $3, 'https://acceptance.invalid' || $4, $5,
  '{"apiKey":"local-acceptance-placeholder"}'::jsonb, $6::jsonb,
  $7, $8::numeric, NULLIF($9, '')::uuid,
  $10::jsonb, $11::jsonb, $12, 'enabled', NULL, NULL, NULL
)
ON CONFLICT (platform_key) DO UPDATE
SET provider = EXCLUDED.provider,
    name = EXCLUDED.name,
    base_url = EXCLUDED.base_url,
    auth_type = EXCLUDED.auth_type,
    credentials = EXCLUDED.credentials,
    config = EXCLUDED.config,
    default_pricing_mode = EXCLUDED.default_pricing_mode,
    default_discount_factor = EXCLUDED.default_discount_factor,
    pricing_rule_set_id = EXCLUDED.pricing_rule_set_id,
    retry_policy = EXCLUDED.retry_policy,
    rate_limit_policy = EXCLUDED.rate_limit_policy,
    priority = EXCLUDED.priority,
    status = 'enabled',
    disabled_reason = NULL,
    cooldown_until = NULL,
    deleted_at = NULL,
    updated_at = now()
RETURNING id::text`,
		candidate.Platform.Provider,
		candidate.Platform.PlatformKey,
		candidate.Platform.Name,
		candidate.Platform.BaseURLPath,
		candidate.Platform.AuthType,
		mustJSON(platformConfig),
		candidate.Platform.DefaultPricingMode,
		decimalOrDefault(candidate.Platform.DefaultDiscountFactor, "1"),
		pricingRuleSetID,
		mustJSON(candidate.Platform.RetryPolicy),
		mustJSON(candidate.Platform.RateLimitPolicy),
		candidate.Platform.Priority,
	).Scan(&platformID)
	if err != nil {
		return err
	}
	_, err = tx.Exec(ctx, `
INSERT INTO platform_models (
  platform_id, base_model_id, model_name, provider_model_name, model_alias,
  model_type, display_name, capability_override, capabilities,
  pricing_mode, discount_factor, pricing_rule_set_id,
  billing_config_override, billing_config, permission_config,
  retry_policy, rate_limit_policy, runtime_policy_set_id,
  runtime_policy_override, enabled, cooldown_until
)
VALUES (
  $1::uuid, $2::uuid, $3, $4, NULLIF($5, ''),
  $6::jsonb, $7, $8::jsonb, $9::jsonb,
  $10, NULLIF($11, '')::numeric, NULLIF($12, '')::uuid,
  $13::jsonb, $14::jsonb, $15::jsonb,
  $16::jsonb, $17::jsonb, NULLIF($18, '')::uuid,
  $19::jsonb, true, NULL
)
ON CONFLICT (platform_id, model_name) DO UPDATE
SET base_model_id = EXCLUDED.base_model_id,
    provider_model_name = EXCLUDED.provider_model_name,
    model_alias = EXCLUDED.model_alias,
    model_type = EXCLUDED.model_type,
    display_name = EXCLUDED.display_name,
    capability_override = EXCLUDED.capability_override,
    capabilities = EXCLUDED.capabilities,
    pricing_mode = EXCLUDED.pricing_mode,
    discount_factor = EXCLUDED.discount_factor,
    pricing_rule_set_id = EXCLUDED.pricing_rule_set_id,
    billing_config_override = EXCLUDED.billing_config_override,
    billing_config = EXCLUDED.billing_config,
    permission_config = EXCLUDED.permission_config,
    retry_policy = EXCLUDED.retry_policy,
    rate_limit_policy = EXCLUDED.rate_limit_policy,
    runtime_policy_set_id = EXCLUDED.runtime_policy_set_id,
    runtime_policy_override = EXCLUDED.runtime_policy_override,
    enabled = true,
    cooldown_until = NULL,
    updated_at = now()`,
		platformID,
		baseModelID,
		candidate.PlatformModel.ModelName,
		candidate.PlatformModel.ProviderModelName,
		candidate.PlatformModel.ModelAlias,
		mustJSON(candidate.PlatformModel.ModelType),
		candidate.PlatformModel.DisplayName,
		mustJSON(candidate.PlatformModel.CapabilityOverride),
		mustJSON(candidate.PlatformModel.Capabilities),
		candidate.PlatformModel.PricingMode,
		decimalOrDefault(candidate.PlatformModel.DiscountFactor, ""),
		pricingRuleSetID,
		mustJSON(candidate.PlatformModel.BillingConfigOverride),
		mustJSON(candidate.PlatformModel.BillingConfig),
		mustJSON(candidate.PlatformModel.PermissionConfig),
		mustJSON(candidate.PlatformModel.RetryPolicy),
		mustJSON(candidate.PlatformModel.RateLimitPolicy),
		runtimePolicyID,
		mustJSON(candidate.PlatformModel.RuntimePolicyOverride),
	)
	return err
}

func importRuntimePolicy(ctx context.Context, tx pgx.Tx, candidate Candidate, configHash string) (string, error) {
	key := "acceptance-" + strings.ReplaceAll(candidate.Workload, "_", "-") + "-runtime-v1"
	var id string
	err := tx.QueryRow(ctx, `
INSERT INTO model_runtime_policy_sets (
  policy_key, name, description, rate_limit_policy, retry_policy,
  auto_disable_policy, degrade_policy, metadata, status
)
VALUES ($1, $2, 'Imported from a secret-safe production acceptance snapshot',
        $3::jsonb, $4::jsonb, $5::jsonb, $6::jsonb, $7::jsonb, 'active')
ON CONFLICT (policy_key) DO UPDATE
SET rate_limit_policy = EXCLUDED.rate_limit_policy,
    retry_policy = EXCLUDED.retry_policy,
    auto_disable_policy = EXCLUDED.auto_disable_policy,
    degrade_policy = EXCLUDED.degrade_policy,
    metadata = EXCLUDED.metadata,
    status = 'active',
    updated_at = now()
RETURNING id::text`,
		key,
		"Acceptance "+candidate.Workload+" runtime policy",
		mustJSON(candidate.RuntimePolicy.RateLimitPolicy),
		mustJSON(candidate.RuntimePolicy.RetryPolicy),
		mustJSON(candidate.RuntimePolicy.AutoDisablePolicy),
		mustJSON(candidate.RuntimePolicy.DegradePolicy),
		mustJSON(map[string]any{"acceptanceSnapshot": true, "configHash": configHash}),
	).Scan(&id)
	return id, err
}

func importPricingRules(ctx context.Context, tx pgx.Tx, candidate Candidate, configHash string) (string, error) {
	key := "acceptance-" + strings.ReplaceAll(candidate.Workload, "_", "-") + "-pricing-v1"
	var id string
	err := tx.QueryRow(ctx, `
INSERT INTO model_pricing_rule_sets (
  rule_set_key, name, description, category, currency, status, metadata
)
VALUES ($1, $2, 'Imported from a secret-safe production acceptance snapshot',
        'acceptance', 'resource', 'active', $3::jsonb)
ON CONFLICT (rule_set_key) DO UPDATE
SET name = EXCLUDED.name,
    description = EXCLUDED.description,
    status = 'active',
    metadata = EXCLUDED.metadata,
    updated_at = now()
RETURNING id::text`,
		key,
		"Acceptance "+candidate.Workload+" pricing",
		mustJSON(map[string]any{"acceptanceSnapshot": true, "configHash": configHash}),
	).Scan(&id)
	if err != nil {
		return "", err
	}
	if _, err := tx.Exec(ctx, `DELETE FROM model_pricing_rules WHERE rule_set_id = $1::uuid`, id); err != nil {
		return "", err
	}
	for _, rule := range candidate.PricingRules {
		_, err := tx.Exec(ctx, `
INSERT INTO model_pricing_rules (
  rule_set_id, rule_key, display_name, scope_type, scope_id,
  resource_type, unit, base_price, currency, base_weight, dynamic_weight,
  calculator_type, dimension_schema, formula_config, priority, status, metadata
)
VALUES (
  $1::uuid, $2, $3, 'rule_set', $1::uuid,
  $4, $5, $6::numeric, $7, $8::jsonb, $9::jsonb,
  $10, $11::jsonb, $12::jsonb, $13, 'active',
  '{"acceptanceSnapshot":true}'::jsonb
)`,
			id,
			rule.RuleKey,
			rule.DisplayName,
			rule.ResourceType,
			rule.Unit,
			decimalOrDefault(rule.BasePrice, "0"),
			rule.Currency,
			mustJSON(rule.BaseWeight),
			mustJSON(rule.DynamicWeight),
			rule.CalculatorType,
			mustJSON(rule.DimensionSchema),
			mustJSON(rule.FormulaConfig),
			rule.Priority,
		)
		if err != nil {
			return "", err
		}
	}
	return id, nil
}

func validateCandidate(candidate Candidate) error {
	required := []string{
		candidate.Provider.ProviderKey,
		candidate.Provider.ProviderCode,
		candidate.BaseModel.CanonicalModelKey,
		candidate.BaseModel.InvocationName,
		candidate.BaseModel.ProviderModelName,
		candidate.Platform.Provider,
		candidate.Platform.PlatformKey,
		candidate.Platform.Name,
		candidate.Platform.AuthType,
		candidate.PlatformModel.ModelName,
		candidate.PlatformModel.ProviderModelName,
	}
	for _, value := range required {
		if strings.TrimSpace(value) == "" {
			return errors.New("candidate contains an empty required identity field")
		}
	}
	if len(candidate.BaseModel.ModelType) == 0 || len(candidate.PlatformModel.ModelType) == 0 {
		return errors.New("candidate model type is empty")
	}
	if candidate.Workload == "gemini_image_edit" && !contains(candidate.PlatformModel.ModelType, "image_edit") {
		return errors.New("Gemini candidate does not support image_edit")
	}
	if candidate.Workload == "multi_reference_video" {
		if !contains(candidate.PlatformModel.ModelType, "omni_video") {
			return errors.New("video candidate does not support omni_video")
		}
		maxImages := nestedInt(
			candidate.PlatformModel.CapabilityOverride,
			candidate.PlatformModel.Capabilities,
			candidate.BaseModel.Capabilities,
			"omni_video",
			"max_images",
		)
		if maxImages < 9 {
			return fmt.Errorf("video candidate max_images=%d, want at least 9", maxImages)
		}
	}
	if candidate.Platform.BaseURLPath == "" || !strings.HasPrefix(candidate.Platform.BaseURLPath, "/") {
		return errors.New("platform base URL path must be absolute")
	}
	if _, err := strconv.ParseFloat(decimalOrDefault(candidate.Platform.DefaultDiscountFactor, "1"), 64); err != nil {
		return errors.New("platform discount factor is invalid")
	}
	return nil
}

func candidateConfigHash(candidates []Candidate) (string, error) {
	payload, err := json.Marshal(candidates)
	if err != nil {
		return "", err
	}
	sum := sha256.Sum256(payload)
	return hex.EncodeToString(sum[:]), nil
}

func snapshotHash(snapshot Snapshot) (string, error) {
	snapshot.SnapshotSHA256 = ""
	payload, err := json.Marshal(snapshot)
	if err != nil {
		return "", err
	}
	sum := sha256.Sum256(payload)
	return hex.EncodeToString(sum[:]), nil
}

func safeBaseURLPath(value string) string {
	parsed, err := url.Parse(strings.TrimSpace(value))
	if err != nil || parsed.Path == "" {
		return "/"
	}
	path := parsed.EscapedPath()
	if path == "" {
		path = "/"
	}
	return path
}

func sanitizeMap(input map[string]any) map[string]any {
	value := sanitizeValue(input)
	out, _ := value.(map[string]any)
	if out == nil {
		return map[string]any{}
	}
	return out
}

func sanitizeValue(value any) any {
	switch typed := value.(type) {
	case map[string]any:
		out := make(map[string]any, len(typed))
		for key, item := range typed {
			if unsafeJSONKey(key) {
				continue
			}
			out[key] = sanitizeValue(item)
		}
		return out
	case []any:
		out := make([]any, 0, len(typed))
		for _, item := range typed {
			out = append(out, sanitizeValue(item))
		}
		return out
	default:
		return value
	}
}

func findUnsafeJSON(payload []byte) (string, bool) {
	decoder := json.NewDecoder(bytes.NewReader(payload))
	decoder.UseNumber()
	var value any
	if err := decoder.Decode(&value); err != nil {
		return "$", true
	}
	var walk func(any, string) (string, bool)
	walk = func(current any, path string) (string, bool) {
		switch typed := current.(type) {
		case map[string]any:
			for key, item := range typed {
				next := path + "." + key
				if unsafeJSONKey(key) {
					return next, true
				}
				if found, ok := walk(item, next); ok {
					return found, true
				}
			}
		case []any:
			for index, item := range typed {
				if found, ok := walk(item, fmt.Sprintf("%s[%d]", path, index)); ok {
					return found, true
				}
			}
		case string:
			lower := strings.ToLower(strings.TrimSpace(typed))
			if strings.HasPrefix(lower, "postgres://") ||
				strings.HasPrefix(lower, "postgresql://") ||
				strings.HasPrefix(lower, "mongodb://") ||
				strings.HasPrefix(lower, "redis://") {
				return path, true
			}
			if parsed, err := url.Parse(typed); err == nil && parsed.User != nil {
				return path, true
			}
		}
		return "", false
	}
	return walk(value, "$")
}

func unsafeJSONKey(key string) bool {
	normalized := strings.ToLower(strings.NewReplacer("_", "", "-", "", ".", "").Replace(strings.TrimSpace(key)))
	if normalized == "secretsafe" {
		return false
	}
	for _, marker := range []string{
		"credential", "password", "secret", "token", "authorization",
		"apikey", "accesskey", "privatekey", "connectionstring",
		"proxy",
	} {
		if strings.Contains(normalized, marker) {
			return true
		}
	}
	return false
}

func decodeObject(payload []byte) map[string]any {
	var out map[string]any
	if err := decodeJSON(payload, &out); err != nil || out == nil {
		return map[string]any{}
	}
	return out
}

func decodeStringArray(payload []byte) []string {
	var out []string
	if err := decodeJSON(payload, &out); err != nil {
		return nil
	}
	return out
}

func decodeJSON(payload []byte, target any) error {
	if len(bytes.TrimSpace(payload)) == 0 {
		payload = []byte("null")
	}
	decoder := json.NewDecoder(bytes.NewReader(payload))
	decoder.UseNumber()
	return decoder.Decode(target)
}

func mustJSON(value any) string {
	payload, err := json.Marshal(value)
	if err != nil {
		panic(err)
	}
	return string(payload)
}

func decimalOrDefault(value string, fallback string) string {
	value = strings.TrimSpace(value)
	if value == "" {
		return fallback
	}
	if _, err := strconv.ParseFloat(value, 64); err != nil {
		return fallback
	}
	return value
}

func contains(items []string, expected string) bool {
	for _, item := range items {
		if item == expected {
			return true
		}
	}
	return false
}

func nestedInt(objects ...any) int {
	if len(objects) < 2 {
		return 0
	}
	path, ok := objects[len(objects)-2].(string)
	if !ok {
		return 0
	}
	key, ok := objects[len(objects)-1].(string)
	if !ok {
		return 0
	}
	for _, raw := range objects[:len(objects)-2] {
		object, _ := raw.(map[string]any)
		nested, _ := object[path].(map[string]any)
		switch value := nested[key].(type) {
		case json.Number:
			number, _ := strconv.Atoi(value.String())
			if number > 0 {
				return number
			}
		case float64:
			if value > 0 {
				return int(value)
			}
		case int:
			if value > 0 {
				return value
			}
		case string:
			number, _ := strconv.Atoi(value)
			if number > 0 {
				return number
			}
		}
	}
	return 0
}

const exportCandidateSQL = `
SELECT provider.provider_key,
       provider.provider_code,
       provider.display_name,
       provider.provider_type,
       provider.capability_schema,
       provider.default_rate_limit_policy,
       base_model.canonical_model_key,
       base_model.invocation_name,
       base_model.provider_model_name,
       base_model.model_type,
       base_model.display_name,
       base_model.capabilities,
       base_model.base_billing_config,
       base_model.default_rate_limit_policy,
       base_model.runtime_policy_override,
       base_model.pricing_version,
       platform.provider,
       platform.platform_key,
       platform.name,
       COALESCE(platform.base_url, ''),
       platform.auth_type,
       platform.config,
       platform.default_pricing_mode,
       platform.default_discount_factor::text,
       platform.retry_policy,
       platform.rate_limit_policy,
       platform.priority,
       model.model_name,
       COALESCE(NULLIF(model.provider_model_name, ''), model.model_name),
       COALESCE(model.model_alias, ''),
       model.model_type,
       model.display_name,
       model.capability_override,
       model.capabilities,
       model.pricing_mode,
       COALESCE(model.discount_factor::text, ''),
       model.billing_config_override,
       model.billing_config,
       model.permission_config,
       model.retry_policy,
       model.rate_limit_policy,
       model.runtime_policy_override,
       COALESCE(runtime_policy.rate_limit_policy, '{}'::jsonb),
       COALESCE(runtime_policy.retry_policy, '{}'::jsonb),
       COALESCE(runtime_policy.auto_disable_policy, '{}'::jsonb),
       COALESCE(runtime_policy.degrade_policy, '{}'::jsonb),
       COALESCE((
         SELECT jsonb_agg(
           jsonb_build_object(
             'ruleKey', rule.rule_key,
             'displayName', rule.display_name,
             'resourceType', rule.resource_type,
             'unit', rule.unit,
             'basePrice', rule.base_price::text,
             'currency', rule.currency,
             'baseWeight', rule.base_weight,
             'dynamicWeight', rule.dynamic_weight,
             'calculatorType', rule.calculator_type,
             'dimensionSchema', rule.dimension_schema,
             'formulaConfig', rule.formula_config,
             'priority', rule.priority
           )
           ORDER BY rule.priority, rule.rule_key
         )
         FROM model_pricing_rules rule
         WHERE rule.rule_set_id = COALESCE(
           model.pricing_rule_set_id,
           platform.pricing_rule_set_id,
           base_model.pricing_rule_set_id
         )
           AND rule.status = 'active'
       ), '[]'::jsonb),
       platform.id::text,
       model.id::text,
       base_model.id::text
FROM platform_models model
JOIN integration_platforms platform ON platform.id = model.platform_id
JOIN base_model_catalog base_model ON base_model.id = model.base_model_id
JOIN model_catalog_providers provider ON provider.provider_key = base_model.provider_key
LEFT JOIN model_runtime_policy_sets runtime_policy
  ON runtime_policy.id = COALESCE(model.runtime_policy_set_id, base_model.runtime_policy_set_id)
WHERE platform.status = 'enabled'
  AND platform.deleted_at IS NULL
  AND model.enabled = true
  AND base_model.status = 'active'
  AND (
    (
      $1 = 'gemini_image_edit'
      AND lower(platform.provider) IN ('gemini', 'google-gemini', 'gemini-openai')
      AND model.model_type @> '["image_edit"]'::jsonb
    )
    OR
    (
      $1 = 'multi_reference_video'
      AND model.model_type @> '["omni_video"]'::jsonb
      AND COALESCE(
        NULLIF(model.capability_override #>> '{omni_video,max_images}', '')::int,
        NULLIF(model.capabilities #>> '{omni_video,max_images}', '')::int,
        NULLIF(base_model.capabilities #>> '{omni_video,max_images}', '')::int,
        0
      ) >= 9
    )
  )
ORDER BY
  CASE
    WHEN $1 = 'gemini_image_edit' AND lower(base_model.invocation_name) = 'gemini-3.1-flash-image' THEN 0
    WHEN $1 = 'gemini_image_edit'
      AND lower(base_model.invocation_name) LIKE '%gemini%image%'
      AND lower(base_model.invocation_name) NOT LIKE '%preview%' THEN 1
    WHEN $1 = 'multi_reference_video'
      AND lower(base_model.invocation_name) LIKE '%seedance%2%fast%' THEN 0
    WHEN $1 = 'multi_reference_video'
      AND lower(base_model.invocation_name) LIKE '%seedance%2%' THEN 1
    ELSE 2
  END,
  platform.priority,
  model.created_at
LIMIT 1`