cufflink-cli 0.14.2

use crate::config::CliConfig;
use crate::project_config::ProjectConfig;
use std::collections::HashMap;
use std::path::Path;
use std::process::Command;
use std::time::Duration;

const CLI_DEPLOY_API_VERSION: u32 = 1;

/// Package the bundled node_modules must contain for the web-runner to accept
/// the artifact. Validated at deploy time so a broken bundle fails the CLI
/// (non-zero, with the real cause) instead of being rejected after upload.
const REQUIRED_PACKAGE: &str = "next";

pub async fn run(
    allow_destructive: bool,
    commit_hash_override: Option<String>,
    env: Option<&str>,
    tenant_override: Option<&str>,
) -> eyre::Result<()> {
    let mut config = CliConfig::load_with_env(env)?;
    if let Some(tenant) = tenant_override {
        config.tenant_override = Some(tenant.to_string());
    }

    if let Some(ref name) = config.env_name {
        println!("Environment: {}", name);
    }

    // Check if this is a web project
    let project = ProjectConfig::find_and_load()?;
    let mode = project
        .as_ref()
        .and_then(|p| p.service.mode.as_deref())
        .unwrap_or("rust");

    let commit_hash = commit_hash_override.or_else(detect_git_commit_hash);

    if mode == "web" {
        let service_name = project
            .as_ref()
            .and_then(|p| p.service.name.as_deref())
            .ok_or_else(|| eyre::eyre!("Web mode requires [service].name in Cufflink.toml"))?;
        deploy_web(
            &config,
            service_name,
            project.as_ref(),
            commit_hash.as_deref(),
            env,
        )
        .await
    } else {
        deploy_rust(
            &config,
            allow_destructive,
            project.as_ref(),
            commit_hash.as_deref(),
            env,
        )
        .await
    }
}

async fn deploy_rust(
    config: &CliConfig,
    allow_destructive: bool,
    project: Option<&ProjectConfig>,
    commit_hash: Option<&str>,
    env: Option<&str>,
) -> eyre::Result<()> {
    let client = config.http_client();

    verify_platform_version(config, &client).await?;

    println!("Building service...");
    let output = Command::new("cargo")
        .args(["run", "--", "--emit-manifest"])
        .output()?;

    if !output.status.success() {
        let stderr = String::from_utf8_lossy(&output.stderr);
        eyre::bail!("Build failed:\n{}", stderr);
    }

    let stdout = String::from_utf8(output.stdout)?;
    let manifest_json: serde_json::Value = serde_json::from_str(stdout.trim())
        .map_err(|e| eyre::eyre!("Failed to parse manifest JSON: {}", e))?;
    let manifest: cufflink_types::ServiceManifest =
        serde_json::from_value(manifest_json.clone())
            .map_err(|e| eyre::eyre!("Manifest is not a valid ServiceManifest: {}", e))?;

    let mode_label = match manifest.mode {
        cufflink_types::ServiceMode::Wasm => "wasm",
        cufflink_types::ServiceMode::Container => "container",
        cufflink_types::ServiceMode::Web => "web",
        cufflink_types::ServiceMode::Crud => "crud",
    };
    println!("Deploying {} (mode: {})...", manifest.name, mode_label);

    let wasm_artifact = if manifest.requires_wasm() {
        println!(
            "  WASM required ({}); building...",
            wasm_required_reason(&manifest)
        );
        let artifact = build_wasm_artifact()?;
        println!(
            "  Bundled WASM: {} bytes, hash: {}",
            artifact.size,
            &artifact.hash[..16]
        );
        Some(artifact)
    } else {
        None
    };

    let expected_wasm_hash = wasm_artifact.as_ref().map(|a| a.hash.clone());

    let deploy_req = serde_json::json!({
        "manifest": manifest_json,
        "allow_destructive": allow_destructive,
        "commit_hash": commit_hash,
        "wasm_base64": wasm_artifact.as_ref().map(|a| a.base64.clone()),
        "cli_version": env!("CARGO_PKG_VERSION"),
        "api_version": CLI_DEPLOY_API_VERSION,
    });

    let resp = config
        .auth_request(
            &client,
            reqwest::Method::POST,
            &format!("{}/api/services/deploy", config.api_url),
        )
        .json(&deploy_req)
        .send()
        .await?;

    if !resp.status().is_success() {
        let status = resp.status();
        let body = resp.text().await.unwrap_or_default();
        eyre::bail!("Deploy failed ({}): {}", status, body);
    }

    let body: serde_json::Value = resp.json().await?;
    let service_id = body["service_id"]
        .as_str()
        .ok_or_else(|| eyre::eyre!("No service_id in deploy response"))?
        .to_string();

    // Skipped deploys echo the previous deployment's wasm_hash, not ours.
    // Upload the new binary via the dedicated endpoint instead.
    if body["skipped"].as_bool() == Some(true) {
        println!(
            "No schema changes for {} v{} — manifest unchanged",
            body["name"].as_str().unwrap_or("?"),
            body["version"]
        );
        maybe_sync_configs(config, &service_id, project, env).await?;
        if manifest.requires_wasm() {
            upload_wasm(config, &client, &service_id).await?;
        }
        verify_deploy_ready(config, &client, &service_id).await?;
        return Ok(());
    }

    if let Some(ref expected) = expected_wasm_hash {
        match body["wasm_hash"].as_str() {
            Some(h) if h == expected => {}
            Some(h) => {
                eyre::bail!(
                    "WASM hash mismatch: CLI built {} but platform stored {}. \
                     This indicates corruption somewhere in the upload path.",
                    &expected[..16],
                    &h[..16.min(h.len())]
                );
            }
            None => {
                eyre::bail!(
                    "Platform did not echo wasm_hash in the deploy response. \
                     This usually means the platform is older than expected; \
                     check `curl {}/api/version`.",
                    config.api_url
                );
            }
        }
    }

    maybe_sync_configs(config, &service_id, project, env).await?;

    println!(
        "Deployed {} v{}",
        body["name"].as_str().unwrap_or("?"),
        body["version"]
    );
    println!("  Schema changes: {}", body["schema_changes"]);
    println!("  Deployment ID:  {}", body["deployment_id"]);
    println!("  Tenant:         {}", body["tenant_slug"]);
    if let Some(hash) = body["commit_hash"].as_str() {
        println!("  Commit:         {}", hash);
    }
    if let Some(hash) = body["wasm_hash"].as_str() {
        println!("  WASM hash:      {}", &hash[..16.min(hash.len())]);
    }
    if let Some(ref handler) = manifest.on_migrate {
        println!("  on_migrate:     {} (ran between phases)", handler);
    }

    verify_deploy_ready(config, &client, &service_id).await?;

    Ok(())
}

async fn verify_platform_version(config: &CliConfig, client: &reqwest::Client) -> eyre::Result<()> {
    let url = format!("{}/api/version", config.api_url);
    let resp = match client.get(&url).send().await {
        Ok(r) => r,
        Err(e) => {
            eyre::bail!(
                "Could not reach platform at {}: {}\n\
                 Check your CUFFLINK_API_URL / Cufflink.toml api_url and network connectivity.",
                url,
                e
            );
        }
    };

    if resp.status().as_u16() == 404 {
        // Old platform that predates `/api/version`. Refuse — we have no
        // way to know whether it understands bundled-WASM or not, and
        // silently sending fields it drops is exactly the failure mode
        // we're fixing.
        eyre::bail!(
            "Platform at {} does not expose /api/version. \
             This CLI (v{}) requires a platform that supports deploy api_version >= {}. \
             Upgrade the platform image before deploying.",
            config.api_url,
            env!("CARGO_PKG_VERSION"),
            CLI_DEPLOY_API_VERSION
        );
    }

    if !resp.status().is_success() {
        let status = resp.status();
        let body = resp.text().await.unwrap_or_default();
        eyre::bail!("Platform /api/version returned {}: {}", status, body);
    }

    let info: serde_json::Value = resp.json().await?;
    let platform_api = info["api_version"].as_u64().unwrap_or(0) as u32;
    if platform_api < CLI_DEPLOY_API_VERSION {
        eyre::bail!(
            "Platform deploy api_version is {} but this CLI (v{}) requires >= {}. \
             Upgrade the platform image before deploying.",
            platform_api,
            env!("CARGO_PKG_VERSION"),
            CLI_DEPLOY_API_VERSION
        );
    }
    Ok(())
}

/// Poll `wasm/status` until `db_state: true` (binary durable in S3).
/// No-op for non-WASM services.
async fn verify_deploy_ready(
    config: &CliConfig,
    client: &reqwest::Client,
    service_id: &str,
) -> eyre::Result<()> {
    let url = format!("{}/api/services/{}/wasm/status", config.api_url, service_id);

    let delays = [
        Duration::from_millis(100),
        Duration::from_millis(200),
        Duration::from_millis(500),
        Duration::from_secs(1),
        Duration::from_secs(2),
        Duration::from_secs(4),
        Duration::from_secs(8),
        Duration::from_secs(14),
    ];

    let mut last_body = String::new();
    for delay in delays {
        let resp = config
            .auth_request(client, reqwest::Method::GET, &url)
            .send()
            .await?;
        if !resp.status().is_success() {
            let status = resp.status();
            let body = resp.text().await.unwrap_or_default();
            eyre::bail!(
                "Deploy verification failed ({} on wasm/status): {}",
                status,
                body
            );
        }
        let body: serde_json::Value = resp.json().await?;
        last_body = serde_json::to_string(&body).unwrap_or_default();

        let is_wasm_service = body["wasm_hash"]
            .as_str()
            .map(|s| !s.is_empty())
            .unwrap_or(false);
        if !is_wasm_service {
            return Ok(());
        }

        if body["db_state"].as_bool() == Some(true) {
            println!(
                "  Deploy verified: db_state=true, local_cache={}",
                body["local_cache"].as_bool().unwrap_or(false)
            );
            return Ok(());
        }

        tokio::time::sleep(delay).await;
    }

    eyre::bail!(
        "Deploy verification timed out: wasm/status never reported db_state=true \
         within 30s. Last status body: {}. The platform accepted the deploy but \
         the WASM binary is not durably persisted — this is a bug. Check platform \
         logs (`cufflink_deployment_wasm_missing_total` metric) and retry.",
        last_body
    );
}

/// Deploy a Next.js web app: run checks, build, create tarball, upload
async fn deploy_web(
    config: &CliConfig,
    service_name: &str,
    project: Option<&ProjectConfig>,
    commit_hash: Option<&str>,
    env: Option<&str>,
) -> eyre::Result<()> {
    println!("Deploying web app: {}", service_name);

    // Step 1: Pre-deploy checks
    let pkg_json = read_package_json()?;
    let scripts = pkg_json["scripts"].as_object();

    if let Some(s) = scripts {
        if s.contains_key("typecheck") {
            run_npm_script("typecheck", "Type checking")?;
        }
        if s.contains_key("lint") {
            run_npm_script("lint", "Linting")?;
        }
        if s.contains_key("test") {
            run_npm_script("test", "Running tests")?;
        }
    }

    // Step 2: Register service on platform (POST manifest before build so service exists)
    let version = pkg_json["version"].as_str().unwrap_or("0.1.0");
    let manifest = serde_json::json!({
        "name": service_name,
        "mode": "web",
        "version": version,
        "tables": [],
    });

    let deploy_req = serde_json::json!({
        "manifest": manifest,
        "allow_destructive": false,
        "commit_hash": commit_hash,
    });

    let client = config.http_client();
    let resp = config
        .auth_request(
            &client,
            reqwest::Method::POST,
            &format!("{}/api/services/deploy", config.api_url),
        )
        .json(&deploy_req)
        .send()
        .await?;

    if !resp.status().is_success() {
        let status = resp.status();
        let body = resp.text().await.unwrap_or_default();
        eyre::bail!("Deploy failed ({}): {}", status, body);
    }

    let body: serde_json::Value = resp.json().await?;
    let service_id = body["service_id"]
        .as_str()
        .ok_or_else(|| eyre::eyre!("No service_id in deploy response"))?;

    println!(
        "Registered {} v{}",
        body["name"].as_str().unwrap_or("?"),
        body["version"]
    );
    println!("  Deployment ID: {}", body["deployment_id"]);
    println!("  Tenant:        {}", body["tenant_slug"]);
    if let Some(hash) = body["commit_hash"].as_str() {
        println!("  Commit:        {}", hash);
    }

    // Step 3: Sync configs from Cufflink.toml to platform
    maybe_sync_configs(config, service_id, project, env).await?;

    // Step 4: Resolve build-time env vars. The platform `GET /config` masks
    // every is_secret=true value as "***", so for any `NEXT_PUBLIC_*` secret
    // the bundle would ship the literal "***". Local Cufflink.toml +
    // securestore holds the declared source of truth — merge that over the
    // platform response so local wins on collision; platform-only extras
    // (admin-set, not declared locally) come through as a fallback.
    println!("Resolving service configs...");
    let local_envs = resolve_local_build_envs(project, env)?;
    let mut build_envs: HashMap<String, String> = fetch_service_configs(config, service_name)
        .await
        .into_iter()
        .collect();
    build_envs.extend(local_envs);

    if !build_envs.is_empty() {
        println!(
            "  Injecting {} service configs into build",
            build_envs.len()
        );
    }

    // Step 5: Check pnpm workspace membership before building
    check_pnpm_workspace()?;

    // Step 6: Build
    println!("Building Next.js app...");
    let pm = detect_package_manager();
    let mut build_cmd = Command::new(&pm);
    build_cmd.args(["run", "build"]);
    for (key, value) in &build_envs {
        build_cmd.env(key, value);
    }
    let build_output = build_cmd.output()?;

    if !build_output.status.success() {
        eyre::bail!("Build failed:\n{}", format_command_output(&build_output));
    }
    println!("  Build complete");

    // Step 6: Verify build output exists
    if !Path::new(".next").exists() {
        eyre::bail!("Next.js build output not found at .next/");
    }

    // Step 7: Create tarball
    println!("Creating deployment artifact...");
    let tarball = create_web_tarball()?;
    let tarball_size = tarball.len();
    println!(
        "  Artifact size: {} bytes ({:.1} MB)",
        tarball_size,
        tarball_size as f64 / 1_048_576.0
    );

    // Step 8: Upload tarball
    println!("Uploading web artifact...");
    let resp = config
        .auth_request(
            &client,
            reqwest::Method::POST,
            &format!("{}/api/services/{}/web", config.api_url, service_id),
        )
        .header("Content-Type", "application/gzip")
        .body(tarball)
        .send()
        .await?;

    if resp.status().is_success() {
        let body: serde_json::Value = resp.json().await?;
        println!(
            "  Artifact hash: {}",
            body["artifact_hash"].as_str().unwrap_or("?")
        );
        println!("  Size:          {} bytes", body["size_bytes"]);
    } else {
        let status = resp.status();
        let body = resp.text().await.unwrap_or_default();
        eyre::bail!("Web artifact upload failed ({}): {}", status, body);
    }

    println!("\nWeb app deployed successfully!");
    Ok(())
}

fn check_pnpm_workspace() -> eyre::Result<()> {
    use crate::pnpm::{check_workspace_membership, WorkspaceCheck};

    let cwd = std::env::current_dir()?;
    if let WorkspaceCheck::NotIncluded {
        workspace_file,
        suggested_glob,
        ..
    } = check_workspace_membership(&cwd)
    {
        eyre::bail!(
            "This package is inside a pnpm workspace but is not listed in {}\n\n\
             pnpm install will not have installed dependencies for this package,\n\
             so the build will fail.\n\n\
             Add \"{}\" to the packages list in {} and run pnpm install",
            workspace_file.display(),
            suggested_glob,
            workspace_file.display(),
        );
    }
    Ok(())
}

fn read_package_json() -> eyre::Result<serde_json::Value> {
    let content = std::fs::read_to_string("package.json")
        .map_err(|_| eyre::eyre!("package.json not found in current directory"))?;
    serde_json::from_str(&content).map_err(|e| eyre::eyre!("Failed to parse package.json: {}", e))
}

fn run_npm_script(script: &str, label: &str) -> eyre::Result<()> {
    println!("{}...", label);
    let pm = detect_package_manager();
    let output = Command::new(&pm).args(["run", script]).output()?;

    if !output.status.success() {
        eyre::bail!("{} failed:\n{}", label, format_command_output(&output));
    }
    println!("  {} passed", label);
    Ok(())
}

/// Detect the package manager by searching for lock files upward from CWD.
fn detect_package_manager() -> String {
    let mut dir = std::env::current_dir().unwrap_or_default();
    loop {
        if dir.join("pnpm-lock.yaml").exists() {
            return "pnpm".to_string();
        }
        if dir.join("yarn.lock").exists() {
            return "yarn".to_string();
        }
        if dir.join("bun.lockb").exists() || dir.join("bun.lock").exists() {
            return "bun".to_string();
        }
        if dir.join("package-lock.json").exists() {
            return "npm".to_string();
        }
        if !dir.pop() {
            break;
        }
    }
    "npm".to_string()
}

/// Render a finished command's captured streams into one block. pnpm writes
/// its actionable errors (e.g. ERR_PNPM_CATALOG_ENTRY_NOT_FOUND_FOR_SPEC) to
/// stdout, so surfacing stderr alone hides the cause in CI logs.
fn format_command_output(output: &std::process::Output) -> String {
    [&output.stdout, &output.stderr]
        .into_iter()
        .map(|bytes| String::from_utf8_lossy(bytes).trim().to_owned())
        .filter(|stream| !stream.is_empty())
        .collect::<Vec<_>>()
        .join("\n")
}

/// Create a gzipped tarball of the Next.js app for deployment.
/// Bundles .next/, node_modules/, package.json, and public/ — same approach
/// as a standard Next.js Docker deployment (no standalone mode needed).
///
/// Uses the system `tar` command instead of the Rust tar crate because the
/// crate fails to archive files cloned by pnpm on macOS APFS filesystems.
fn create_web_tarball() -> eyre::Result<Vec<u8>> {
    let cwd = std::env::current_dir()?;
    let nm_dir = resolve_node_modules()?;

    // Create a staging dir with symlinks so tar can bundle files from
    // different locations (CWD and the pnpm deploy temp dir) into one archive.
    let staging = tempfile::tempdir()?;
    let stage = staging.path();

    // Symlink .next/ from CWD
    let next_dir = cwd.join(".next");
    if next_dir.exists() {
        std::os::unix::fs::symlink(&next_dir, stage.join(".next"))?;
    }

    // Symlink node_modules/ from pnpm deploy output (or nearest)
    std::os::unix::fs::symlink(&nm_dir, stage.join("node_modules"))?;

    // Symlink package.json from CWD
    std::os::unix::fs::symlink(cwd.join("package.json"), stage.join("package.json"))?;

    // Symlink public/ from CWD if it exists
    let public_dir = cwd.join("public");
    let has_public = public_dir.exists();
    if has_public {
        std::os::unix::fs::symlink(&public_dir, stage.join("public"))?;
    }

    // Use system tar with -h to dereference symlinks
    let mut args = vec!["czfh", "-", ".next", "node_modules", "package.json"];
    if has_public {
        args.push("public");
    }

    let output = Command::new("tar")
        .args(&args)
        .current_dir(stage)
        .output()?;

    if !output.status.success() {
        eyre::bail!("tar command failed:\n{}", format_command_output(&output));
    }

    // Clean up pnpm deploy temp dir
    if let Some(parent) = nm_dir.parent() {
        if parent.starts_with(std::env::temp_dir()) {
            let _ = std::fs::remove_dir_all(parent);
        }
    }

    Ok(output.stdout)
}

/// Resolve the node_modules directory to bundle for the web artifact.
///
/// In a pnpm monorepo, `pnpm deploy --prod` produces a pruned, flat
/// node_modules with only production dependencies. If that fails — or yields a
/// tree missing the runtime — its full output is surfaced and we fall back to
/// the nearest ancestor node_modules that actually contains the runtime.
fn resolve_node_modules() -> eyre::Result<std::path::PathBuf> {
    if let Some(root) = find_pnpm_workspace_root() {
        println!("  Detected pnpm monorepo, creating pruned node_modules...");
        match pnpm_deploy_node_modules(&root) {
            Ok(node_modules) => return Ok(node_modules),
            Err(err) => eprintln!("  {err}\n  Falling back to nearest node_modules..."),
        }
    }

    find_node_modules()
}

/// Build a pruned production node_modules via `pnpm deploy`. Fails (with the
/// command's combined output) when pnpm errors or omits the required runtime,
/// cleaning up the temp dir so a partial tree is never bundled.
fn pnpm_deploy_node_modules(root: &Path) -> eyre::Result<std::path::PathBuf> {
    let pkg_name = read_package_name()?;
    let deploy_dir = tempfile::tempdir()?.keep();

    let output = Command::new("pnpm")
        .args([
            "--filter",
            &pkg_name,
            "deploy",
            "--prod",
            &deploy_dir.display().to_string(),
        ])
        .current_dir(root)
        .output()?;

    let node_modules = deploy_dir.join("node_modules");
    if output.status.success() && node_modules.join(REQUIRED_PACKAGE).exists() {
        println!("  Pruned node_modules ready");
        return Ok(node_modules);
    }

    let _ = std::fs::remove_dir_all(&deploy_dir);
    if output.status.success() {
        eyre::bail!("pnpm deploy succeeded but produced no `{REQUIRED_PACKAGE}` package");
    }
    eyre::bail!("pnpm deploy failed:\n{}", format_command_output(&output));
}

fn read_package_name() -> eyre::Result<String> {
    read_package_json()?
        .get("name")
        .and_then(serde_json::Value::as_str)
        .map(str::to_owned)
        .ok_or_else(|| eyre::eyre!("package.json missing 'name' field"))
}

/// Find the pnpm workspace root by searching upward for pnpm-lock.yaml.
fn find_pnpm_workspace_root() -> Option<std::path::PathBuf> {
    let mut dir = std::env::current_dir().ok()?;
    loop {
        if dir.join("pnpm-lock.yaml").exists() {
            // Only consider it a monorepo if we're not already at the root
            // (i.e., there's a parent with a different package.json)
            return Some(dir);
        }
        if !dir.pop() {
            break;
        }
    }
    None
}

/// Find the nearest ancestor node_modules that contains the required runtime
/// package. Keying on `REQUIRED_PACKAGE` rather than "any entry" skips pnpm
/// metadata-only dirs and `node-linker=hoisted` workspace dirs that omit
/// hoisted dependencies, mirroring the web-runner's post-extract validation.
fn find_node_modules() -> eyre::Result<std::path::PathBuf> {
    find_node_modules_from(&std::env::current_dir()?)
}

fn find_node_modules_from(start: &Path) -> eyre::Result<std::path::PathBuf> {
    let mut dir = start.to_path_buf();
    loop {
        let candidate = dir.join("node_modules");
        if candidate.join(REQUIRED_PACKAGE).exists() {
            return Ok(candidate);
        }
        if !dir.pop() {
            break;
        }
    }
    eyre::bail!(
        "No node_modules containing `{REQUIRED_PACKAGE}` found in any ancestor of {}.\n\
         Run a dependency install (e.g. `pnpm install`) before deploying.",
        start.display()
    )
}

/// Resolve the declared `[config]` + `[secrets]` for the active environment
/// into a flat env-var map for build-time injection. Returns an empty map if
/// no Cufflink.toml or no environment is selected — callers fall back to
/// platform-fetched configs only.
fn resolve_local_build_envs(
    project: Option<&ProjectConfig>,
    env: Option<&str>,
) -> eyre::Result<HashMap<String, String>> {
    let project = match project {
        Some(p) => p,
        None => return Ok(HashMap::new()),
    };
    let env_name = env
        .map(|s| s.to_string())
        .or_else(|| project.service.default_env.clone());
    let env_name = match env_name {
        Some(n) => n,
        None => return Ok(HashMap::new()),
    };
    super::config_cmd::resolve_local_envs(project, &env_name)
}

/// Sync configs and secrets from Cufflink.toml to the platform, if any are defined.
async fn maybe_sync_configs(
    config: &CliConfig,
    service_id: &str,
    project: Option<&ProjectConfig>,
    env: Option<&str>,
) -> eyre::Result<()> {
    let project = match project {
        Some(p) => p,
        None => return Ok(()),
    };

    let env_name = env
        .map(|s| s.to_string())
        .or_else(|| project.service.default_env.clone());

    let env_name = match env_name {
        Some(n) => n,
        None => return Ok(()),
    };

    let env_config = match project.environments.get(&env_name) {
        Some(c) => c,
        None => return Ok(()),
    };

    if env_config.config.is_empty() && env_config.secrets.is_empty() {
        return Ok(());
    }

    println!("Syncing configs...");
    super::config_cmd::sync_to_platform(
        config,
        service_id,
        &env_config.config,
        &env_config.secrets,
        project,
        &env_name,
    )
    .await
}

/// Fetch service configs from the platform to inject as build-time env vars.
/// Returns empty vec on any failure (first deploy, platform unreachable, etc.)
/// so the build proceeds with local env vars.
async fn fetch_service_configs(config: &CliConfig, service_name: &str) -> Vec<(String, String)> {
    let client = config.http_client();

    // Step 1: Find service ID by name
    let resp = match config
        .auth_request(
            &client,
            reqwest::Method::GET,
            &format!("{}/api/services", config.api_url),
        )
        .send()
        .await
    {
        Ok(r) => r,
        Err(_) => return Vec::new(),
    };

    let services: serde_json::Value = match resp.json().await {
        Ok(v) => v,
        Err(_) => return Vec::new(),
    };

    let service_id = match services["services"].as_array().and_then(|arr| {
        arr.iter()
            .find(|s| s["name"].as_str() == Some(service_name))
            .and_then(|s| s["id"].as_str())
    }) {
        Some(id) => id.to_string(),
        None => return Vec::new(),
    };

    // Step 2: Fetch configs for this service
    let resp = match config
        .auth_request(
            &client,
            reqwest::Method::GET,
            &format!("{}/api/services/{}/config", config.api_url, service_id),
        )
        .send()
        .await
    {
        Ok(r) if r.status().is_success() => r,
        _ => return Vec::new(),
    };

    let body: serde_json::Value = match resp.json().await {
        Ok(v) => v,
        Err(_) => return Vec::new(),
    };

    // Step 3: Extract key/value pairs
    body["configs"]
        .as_array()
        .map(|configs| {
            configs
                .iter()
                .filter_map(|c| {
                    let key = c["key"].as_str()?;
                    let value = c["value"].as_str()?;
                    Some((key.to_string(), value.to_string()))
                })
                .collect()
        })
        .unwrap_or_default()
}

fn detect_git_commit_hash() -> Option<String> {
    Command::new("git")
        .args(["rev-parse", "HEAD"])
        .output()
        .ok()
        .filter(|o| o.status.success())
        .and_then(|o| String::from_utf8(o.stdout).ok())
        .map(|s| s.trim().to_string())
        .filter(|s| !s.is_empty())
}

struct WasmArtifact {
    base64: String,
    size: usize,
    hash: String,
}

/// Human-readable explanation of why a manifest needs a WASM bundle.
/// Mirrors the predicate in [`cufflink_types::ServiceManifest::requires_wasm`]
/// so the CLI's "I'm building WASM" message matches the platform's reasoning.
fn wasm_required_reason(manifest: &cufflink_types::ServiceManifest) -> String {
    use cufflink_types::{HandlerType, ServiceMode};
    if manifest.mode == ServiceMode::Wasm {
        return "mode: wasm".into();
    }
    if manifest.on_migrate.is_some() {
        return "on_migrate hook declared".into();
    }
    if let Some(t) = manifest.tables.iter().find(|t| t.hooks.is_some()) {
        return format!("table '{}' declares CRUD hooks", t.name);
    }
    if !manifest.custom_routes.is_empty() {
        return "custom_routes declared".into();
    }
    if manifest
        .subscriptions
        .iter()
        .any(|s| matches!(s.handler_type, HandlerType::Wasm))
    {
        return "wasm subscription declared".into();
    }
    "user code declared".into()
}

fn build_wasm_artifact() -> eyre::Result<WasmArtifact> {
    let rustup_check = Command::new("rustup")
        .args(["target", "list", "--installed"])
        .output()?;
    let installed_targets = String::from_utf8_lossy(&rustup_check.stdout);
    if !installed_targets.contains("wasm32-unknown-unknown") {
        eyre::bail!("WASM target not installed. Run:\n  rustup target add wasm32-unknown-unknown");
    }

    println!("Building WASM module...");
    let build_output = Command::new("cargo")
        .args([
            "build",
            "--lib",
            "--target",
            "wasm32-unknown-unknown",
            "--release",
        ])
        .output()?;

    if !build_output.status.success() {
        let stderr = String::from_utf8_lossy(&build_output.stderr);
        eyre::bail!("WASM build failed:\n{}", stderr);
    }

    let wasm_path = find_wasm_artifact()?;
    let wasm_bytes = std::fs::read(&wasm_path)?;
    let size = wasm_bytes.len();
    println!("  WASM artifact: {} ({} bytes)", wasm_path.display(), size);

    use sha2::{Digest, Sha256};
    let mut hasher = Sha256::new();
    hasher.update(&wasm_bytes);
    let hash = hex::encode(hasher.finalize());

    use base64::Engine as _;
    let base64 = base64::engine::general_purpose::STANDARD.encode(&wasm_bytes);

    Ok(WasmArtifact { base64, size, hash })
}

/// Legacy WASM upload via the dedicated `POST /api/services/:id/wasm`
/// endpoint. Kept for backwards compat with platforms that don't yet
/// support bundled WASM in the deploy request, and for the manifest-
/// unchanged path where the deploy endpoint short-circuits before any
/// WASM handling.
async fn upload_wasm(
    config: &CliConfig,
    client: &reqwest::Client,
    service_id: &str,
) -> eyre::Result<()> {
    let artifact = build_wasm_artifact()?;
    let expected_hash = artifact.hash.clone();
    let upload_req = serde_json::json!({ "wasm_base64": artifact.base64 });

    println!("Uploading WASM module...");
    let resp = config
        .auth_request(
            client,
            reqwest::Method::POST,
            &format!("{}/api/services/{}/wasm", config.api_url, service_id),
        )
        .json(&upload_req)
        .send()
        .await?;

    if resp.status().is_success() {
        let body: serde_json::Value = resp.json().await?;
        let echoed = body["wasm_hash"].as_str().unwrap_or("");
        println!("  WASM hash:  {}", echoed);
        println!("  Size:       {} bytes", body["size_bytes"]);
        if echoed != expected_hash {
            eyre::bail!(
                "WASM hash mismatch on upload: CLI built {} but platform stored {}",
                &expected_hash[..16],
                &echoed[..16.min(echoed.len())]
            );
        }
    } else {
        let status = resp.status();
        let body = resp.text().await.unwrap_or_default();
        eyre::bail!("WASM upload failed ({}): {}", status, body);
    }

    Ok(())
}

fn find_wasm_artifact() -> eyre::Result<std::path::PathBuf> {
    // Use cargo metadata to find the target directory and crate name
    let metadata_output = Command::new("cargo")
        .args(["metadata", "--format-version", "1", "--no-deps"])
        .output()?;

    if !metadata_output.status.success() {
        eyre::bail!("Failed to run cargo metadata");
    }

    let metadata: serde_json::Value = serde_json::from_slice(&metadata_output.stdout)?;
    let target_dir = metadata["target_directory"]
        .as_str()
        .ok_or_else(|| eyre::eyre!("Cannot determine target directory"))?;

    // Find the lib target name from the current package
    let cwd = std::env::current_dir()?;
    let cwd_str = cwd.to_string_lossy();

    let crate_name = metadata["packages"]
        .as_array()
        .and_then(|pkgs| {
            pkgs.iter().find(|p| {
                p["manifest_path"]
                    .as_str()
                    .map(|mp| mp.starts_with(cwd_str.as_ref()))
                    .unwrap_or(false)
            })
        })
        .and_then(|pkg| {
            // Look for a cdylib target first, then fall back to package name
            pkg["targets"]
                .as_array()
                .and_then(|targets| {
                    targets.iter().find(|t| {
                        t["crate_types"]
                            .as_array()
                            .map(|types| types.iter().any(|ct| ct.as_str() == Some("cdylib")))
                            .unwrap_or(false)
                    })
                })
                .and_then(|t| t["name"].as_str())
                .or_else(|| pkg["name"].as_str())
        })
        .unwrap_or("unknown");

    let wasm_name = crate_name.replace('-', "_");
    let wasm_path = std::path::PathBuf::from(target_dir)
        .join("wasm32-unknown-unknown")
        .join("release")
        .join(format!("{}.wasm", wasm_name));

    if wasm_path.exists() {
        return Ok(wasm_path);
    }

    eyre::bail!(
        "WASM artifact not found at {:?}.\n\
         Ensure your Cargo.toml has:\n  \
         [lib]\n  \
         crate-type = [\"cdylib\"]",
        wasm_path
    )
}

#[cfg(test)]
mod tests {
    use super::*;
    use std::os::unix::process::ExitStatusExt;
    use std::process::{ExitStatus, Output};

    fn install_package(node_modules: &Path, name: &str) {
        std::fs::create_dir_all(node_modules.join(name)).unwrap();
    }

    fn output(code: i32, stdout: &str, stderr: &str) -> Output {
        Output {
            status: ExitStatus::from_raw(code),
            stdout: stdout.as_bytes().to_vec(),
            stderr: stderr.as_bytes().to_vec(),
        }
    }

    #[test]
    fn find_node_modules_walks_past_hoisted_workspace_dir_to_root() {
        let root = tempfile::tempdir().unwrap();
        let root_nm = root.path().join("node_modules");
        install_package(&root_nm, REQUIRED_PACKAGE);

        let app = root.path().join("apps").join("portal");
        install_package(&app.join("node_modules"), "@scope-only");

        assert_eq!(find_node_modules_from(&app).unwrap(), root_nm);
    }

    #[test]
    fn find_node_modules_uses_local_dir_when_it_has_the_runtime() {
        let root = tempfile::tempdir().unwrap();
        let app = root.path().join("app");
        let app_nm = app.join("node_modules");
        install_package(&app_nm, REQUIRED_PACKAGE);

        assert_eq!(find_node_modules_from(&app).unwrap(), app_nm);
    }

    #[test]
    fn find_node_modules_errors_when_runtime_absent() {
        let root = tempfile::tempdir().unwrap();
        let app = root.path().join("app");
        install_package(&app.join("node_modules"), "other");

        let err = find_node_modules_from(&app).unwrap_err().to_string();
        assert!(err.contains(REQUIRED_PACKAGE));
    }

    #[test]
    fn format_command_output_combines_and_trims_streams() {
        assert_eq!(
            format_command_output(&output(0, "  out line  \n", "err line")),
            "out line\nerr line"
        );
    }

    #[test]
    fn format_command_output_skips_empty_streams() {
        assert_eq!(
            format_command_output(&output(0, "", "only stderr\n")),
            "only stderr"
        );
    }
}