#!/usr/bin/env bash
set -Eeuo pipefail

APP_NAME="妙境 AI 创作平台"
APP_MARKER=".miaojing-deployment"
DEFAULT_PROJECT_DIR="/opt/miaojingAI"
DEFAULT_DATA_DIR="/var/lib/miaojingAI"
DEFAULT_WEB_PORT="5000"
DEFAULT_API_PORT="5100"
DEFAULT_CONSOLE_PORT="5200"
DEFAULT_ADMIN_ACCOUNT="admin"
DEFAULT_ADMIN_EMAIL="admin@example.com"
DEFAULT_DOMAIN=""
DEFAULT_NODE_MAJOR="24"
MIRRORS=(
  "https://registry.npmmirror.com"
  "https://registry.npmjs.org"
  "https://mirrors.cloud.tencent.com/npm/"
  "https://mirrors.huaweicloud.com/repository/npm/"
)
NODE_DIST_MIRRORS=(
  "https://npmmirror.com/mirrors/node"
  "https://mirrors.tuna.tsinghua.edu.cn/nodejs-release"
  "https://mirrors.cloud.tencent.com/nodejs-release"
  "https://mirrors.huaweicloud.com/nodejs"
  "https://nodejs.org/dist"
)

SOURCE_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
LOG_FILE=""
PROJECT_DIR=""
DATA_DIR=""
WEB_PORT=""
API_PORT=""
CONSOLE_PORT=""
ADMIN_ACCOUNT=""
ADMIN_EMAIL=""
ADMIN_PASSWORD=""
LOCAL_DB_URL_INPUT=""
MODE=""
BACKUP_FILE=""
SERVER_HOST_IP=""
EXISTING_LOCAL_STORAGE_DIR=""
APP_PUBLIC_URL=""
NODE_MAJOR="${DEPLOY_NODE_MAJOR:-${DEFAULT_NODE_MAJOR}}"
NODE_INSTALL_ROOT="${DEPLOY_NODE_INSTALL_DIR:-}"
NODE_BIN_DIR=""
NODE_VERSION=""
NPM_BIN="npm"

log() {
  local message="$*"
  if [ -n "${LOG_FILE:-}" ]; then
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] ${message}" | tee -a "${LOG_FILE}"
  else
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] ${message}"
  fi
}

log_pipe() {
  if [ -n "${LOG_FILE:-}" ]; then
    tee -a "${LOG_FILE}"
  else
    cat
  fi
}

fail() {
  local message="$*"
  echo
  echo "❌ 部署失败：${message}" | tee -a "${LOG_FILE:-/dev/null}" >&2
  if [ -n "${LOG_FILE:-}" ]; then
    echo "详细日志：${LOG_FILE}" >&2
  fi
  if [ -n "${BACKUP_FILE:-}" ]; then
    echo "已生成升级前备份：${BACKUP_FILE}" >&2
    echo "如需回滚，可在部署目录执行：pnpm backup:restore \"${BACKUP_FILE}\"" >&2
  fi
  exit 1
}

trap 'fail "脚本执行中断，请查看上方错误日志。"' ERR

require_command() {
  local command_name="$1"
  local install_hint="$2"
  if ! command -v "${command_name}" >/dev/null 2>&1; then
    fail "缺少命令 ${command_name}。${install_hint}"
  fi
}

prompt_value() {
  local var_name="$1"
  local label="$2"
  local default_value="$3"
  local value=""
  read -r -p "${label} [${default_value}]: " value
  printf -v "${var_name}" '%s' "${value:-$default_value}"
}

prompt_secret() {
  local var_name="$1"
  local label="$2"
  local value=""
  while [ -z "${value}" ]; do
    read -r -s -p "${label}: " value
    echo
    if [ -z "${value}" ]; then
      echo "该项不能为空，请重新输入。"
    fi
  done
  printf -v "${var_name}" '%s' "${value}"
}

random_hex() {
  if command -v openssl >/dev/null 2>&1; then
    openssl rand -hex 32
  else
    head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n'
  fi
}

env_quote() {
  local value="$1"
  value="${value//\\/\\\\}"
  value="${value//\"/\\\"}"
  value="${value//\$/\\\$}"
  value="${value//\`/\\\`}"
  value="${value//$'\n'/\\n}"
  printf '"%s"' "${value}"
}

env_get_value() {
  local key="$1"
  local file="$2"
  local line value
  if [ ! -f "${file}" ]; then
    return 1
  fi

  while IFS= read -r line || [ -n "${line}" ]; do
    case "${line}" in
      "${key}="*)
        value="${line#*=}"
        value="${value%$'\r'}"
        if [[ "${value}" == \"*\" ]] && [[ "${value}" == *\" ]]; then
          value="${value:1:${#value}-2}"
          value="${value//\\\"/\"}"
          value="${value//\\\\/\\}"
        fi
        printf '%s\n' "${value}"
        return 0
        ;;
    esac
  done < "${file}"

  return 1
}

env_set_value() {
  local key="$1"
  local value="$2"
  local file="$3"
  local quoted tmp_file
  quoted="$(env_quote "${value}")"
  tmp_file="$(mktemp)"

  if [ -f "${file}" ]; then
    awk -v key="${key}" -v replacement="${key}=${quoted}" '
      BEGIN { found = 0 }
      $0 ~ "^" key "=" {
        if (found == 0) print replacement
        found = 1
        next
      }
      { print }
      END {
        if (found == 0) print replacement
      }
    ' "${file}" > "${tmp_file}"
  else
    printf '%s=%s\n' "${key}" "${quoted}" > "${tmp_file}"
  fi

  mv "${tmp_file}" "${file}"
}

js_quote() {
  local value="$1"
  value="${value//\\/\\\\}"
  value="${value//\'/\\\'}"
  value="${value//$'\n'/\\n}"
  printf "'%s'" "${value}"
}

detect_host_ip() {
  SERVER_HOST_IP="$(hostname -I 2>/dev/null | awk '{print $1}')"
  SERVER_HOST_IP="${SERVER_HOST_IP:-127.0.0.1}"
}

prepend_node_path() {
  if [ -n "${NODE_BIN_DIR:-}" ] && [ -d "${NODE_BIN_DIR}" ]; then
    case ":${PATH}:" in
      *":${NODE_BIN_DIR}:"*) ;;
      *) export PATH="${NODE_BIN_DIR}:${PATH}" ;;
    esac
    NPM_BIN="${NODE_BIN_DIR}/npm"
  else
    NPM_BIN="npm"
  fi
}

node_major_version() {
  node -p "Number(process.versions.node.split('.')[0])" 2>/dev/null || printf '0'
}

node_version_matches_target() {
  command -v node >/dev/null 2>&1 && [ "$(node_major_version)" = "${NODE_MAJOR}" ]
}

node_platform_arch() {
  local machine
  machine="$(uname -m)"
  case "${machine}" in
    x86_64|amd64)
      printf 'linux-x64'
      ;;
    aarch64|arm64)
      printf 'linux-arm64'
      ;;
    *)
      fail "暂不支持当前 CPU 架构：${machine}。部署脚本支持 x86_64/amd64 和 arm64/aarch64。"
      ;;
  esac
}

detect_latest_node_version() {
  local mirror="$1"
  curl -fsSL "${mirror}/index.json" \
    | sed -n "s/.*\"version\"[[:space:]]*:[[:space:]]*\"\\(v${NODE_MAJOR}\\.[0-9][^\"]*\\)\".*/\\1/p" \
    | head -n 1
}

install_node_from_mirrors() {
  local platform_arch version mirror archive_url tmp_dir archive install_dir node_bin
  platform_arch="$(node_platform_arch)"
  NODE_INSTALL_ROOT="${NODE_INSTALL_ROOT:-${DATA_DIR}/node}"

  mkdir -p "${NODE_INSTALL_ROOT}"
  tmp_dir="$(mktemp -d)"

  for mirror in "${NODE_DIST_MIRRORS[@]}"; do
    log "尝试从 Node.js 镜像源获取 ${NODE_MAJOR}.x LTS：${mirror}"
    version="$(NODE_MAJOR="${NODE_MAJOR}" detect_latest_node_version "${mirror}" || true)"
    if [ -z "${version}" ]; then
      log "当前镜像源未获取到 Node.js ${NODE_MAJOR}.x 版本索引，切换下一个源。"
      continue
    fi

    archive="node-${version}-${platform_arch}.tar.xz"
    archive_url="${mirror}/${version}/${archive}"
    log "准备下载 Node.js ${version}：${archive_url}"
    if ! curl -fL --retry 2 --connect-timeout 15 -o "${tmp_dir}/${archive}" "${archive_url}" 2>&1 | log_pipe; then
      log "Node.js 下载失败，切换下一个镜像源。"
      continue
    fi

    install_dir="${NODE_INSTALL_ROOT}/node-${version}-${platform_arch}"
    rm -rf "${install_dir}"
    mkdir -p "${install_dir}"
    tar -xJf "${tmp_dir}/${archive}" -C "${NODE_INSTALL_ROOT}"
    NODE_BIN_DIR="${install_dir}/bin"
    node_bin="${NODE_BIN_DIR}/node"
    if [ -x "${node_bin}" ]; then
      prepend_node_path
      NODE_VERSION="$("${node_bin}" -v)"
      log "Node.js ${NODE_VERSION} 安装完成，路径：${NODE_BIN_DIR}"
      rm -rf "${tmp_dir}"
      return 0
    fi
  done

  rm -rf "${tmp_dir}"
  return 1
}

ensure_node_runtime() {
  if ! [[ "${NODE_MAJOR}" =~ ^(22|24)$ ]]; then
    fail "DEPLOY_NODE_MAJOR 只允许设置为 22 或 24，当前值：${NODE_MAJOR}"
  fi

  if node_version_matches_target; then
    NODE_VERSION="$(node -v)"
    log "Node.js 版本符合生产要求：${NODE_VERSION}"
    return 0
  fi

  if command -v node >/dev/null 2>&1; then
    log "当前 Node.js 版本为 $(node -v)，将自动安装并切换到 Node.js ${NODE_MAJOR}.x LTS。"
  else
    log "未检测到 Node.js，将自动安装 Node.js ${NODE_MAJOR}.x LTS。"
  fi

  install_node_from_mirrors || fail "Node.js ${NODE_MAJOR}.x LTS 自动安装失败，请检查网络或手动安装后重试。"

  if ! node_version_matches_target; then
    fail "Node.js 已安装但版本校验失败，当前版本：$(node -v 2>/dev/null || printf '未检测到')"
  fi
}

normalize_data_dir_from_storage() {
  local storage_dir="$1"
  if [ -z "${storage_dir}" ]; then
    return 1
  fi

  storage_dir="$(realpath -m "${storage_dir}")"
  if [ "$(basename "${storage_dir}")" = "storage" ]; then
    dirname "${storage_dir}"
  else
    printf '%s\n' "${storage_dir}"
  fi
}

read_marker_value() {
  local key="$1"
  local file="$2"
  local marker_key marker_value
  if [ ! -f "${file}" ]; then
    return 1
  fi

  while IFS='=' read -r marker_key marker_value; do
    if [ "${marker_key}" = "${key}" ]; then
      printf '%s\n' "${marker_value}"
      return 0
    fi
  done < "${file}"

  return 1
}

detect_existing_deployment() {
  if [ -f "${PROJECT_DIR}/package.json" ] && { [ -f "${PROJECT_DIR}/${APP_MARKER}" ] || [ -f "${PROJECT_DIR}/.env.local" ]; }; then
    MODE="upgrade"
  else
    MODE="install"
  fi
}

load_existing_defaults() {
  local marker_data_dir=""
  if [ -f "${PROJECT_DIR}/${APP_MARKER}" ]; then
    marker_data_dir="$(read_marker_value "data_dir" "${PROJECT_DIR}/${APP_MARKER}" || true)"
  fi

  if [ -f "${PROJECT_DIR}/.env.local" ]; then
    # shellcheck disable=SC1090
    set +u; set -a; source "${PROJECT_DIR}/.env.local"; set +a; set -u
    if [ -n "${LOCAL_STORAGE_DIR:-}" ]; then
      EXISTING_LOCAL_STORAGE_DIR="$(realpath -m "${LOCAL_STORAGE_DIR}")"
      DATA_DIR="$(normalize_data_dir_from_storage "${LOCAL_STORAGE_DIR}")"
    elif [ -n "${BACKUP_DIR:-}" ]; then
      DATA_DIR="$(dirname "$(realpath -m "${BACKUP_DIR}")")"
    elif [ -n "${marker_data_dir}" ]; then
      DATA_DIR="${marker_data_dir}"
    fi
    LOCAL_DB_URL_INPUT="${LOCAL_DB_URL:-${LOCAL_DB_URL_INPUT:-postgresql://postgres:postgres@localhost:5432/miaojing}}"
    WEB_PORT="${DEPLOY_RUN_PORT:-${WEB_PORT:-$DEFAULT_WEB_PORT}}"
    API_PORT="${MIAOJING_API_PORT:-${API_PORT:-$DEFAULT_API_PORT}}"
    CONSOLE_PORT="${MIAOJING_CONSOLE_PORT:-${CONSOLE_PORT:-$DEFAULT_CONSOLE_PORT}}"
    ADMIN_EMAIL="${ADMIN_EMAIL:-${DEFAULT_ADMIN_EMAIL}}"
  elif [ -n "${marker_data_dir}" ]; then
    DATA_DIR="${marker_data_dir}"
  fi

  if [ -z "${APP_PUBLIC_URL}" ] && [ -f "${PROJECT_DIR}/.env.local" ]; then
    APP_PUBLIC_URL="$(env_get_value "NEXT_PUBLIC_APP_URL" "${PROJECT_DIR}/.env.local" || true)"
  fi
  if [ -z "${APP_PUBLIC_URL}" ] && [ -f "${PROJECT_DIR}/.env.local" ]; then
    APP_PUBLIC_URL="$(env_get_value "APP_BASE_URL" "${PROJECT_DIR}/.env.local" || true)"
  fi

  if [ -z "${EXISTING_LOCAL_STORAGE_DIR}" ] && [ -d "${PROJECT_DIR}/local-storage" ]; then
    EXISTING_LOCAL_STORAGE_DIR="$(realpath -m "${PROJECT_DIR}/local-storage")"
  elif [ -z "${EXISTING_LOCAL_STORAGE_DIR}" ] && [ -n "${marker_data_dir}" ] && [ -d "${marker_data_dir}/storage" ]; then
    EXISTING_LOCAL_STORAGE_DIR="$(realpath -m "${marker_data_dir}/storage")"
  fi
}

validate_port() {
  local label="$1"
  local value="$2"
  if ! [[ "${value}" =~ ^[0-9]+$ ]] || [ "${value}" -lt 1 ] || [ "${value}" -gt 65535 ]; then
    fail "${label}必须是 1-65535 之间的数字。"
  fi
}

validate_inputs() {
  validate_port "前端访问端口" "${WEB_PORT}"
  validate_port "后端 API 内部端口" "${API_PORT}"
  validate_port "管理后台内部端口" "${CONSOLE_PORT}"

  if [ "${WEB_PORT}" = "${API_PORT}" ] || [ "${WEB_PORT}" = "${CONSOLE_PORT}" ] || [ "${API_PORT}" = "${CONSOLE_PORT}" ]; then
    fail "前端、后端 API、管理后台端口不能重复。"
  fi

  if [ -z "${ADMIN_ACCOUNT}" ] || [ -z "${ADMIN_EMAIL}" ]; then
    fail "管理员账号和管理员邮箱不能为空。"
  fi

  if ! [[ "${ADMIN_EMAIL}" =~ ^[^[:space:]@]+@[^[:space:]@]+[.][^[:space:]@]+$ ]]; then
    fail "管理员邮箱格式不正确。"
  fi

  if [ -z "${LOCAL_DB_URL_INPUT}" ]; then
    fail "PostgreSQL 连接地址不能为空。"
  fi

  if [ -n "${APP_PUBLIC_URL}" ] && ! [[ "${APP_PUBLIC_URL}" =~ ^https?://[^[:space:]]+$ ]]; then
    fail "正式访问地址必须是 http:// 或 https:// 开头的完整地址。"
  fi

  if [ "${MODE}" = "install" ] && [ "${ADMIN_PASSWORD}" = "admin123" ]; then
    fail "生产环境不允许使用默认管理员密码 admin123，请设置高强度密码。"
  fi
}

collect_inputs() {
  echo "=============================================="
  echo "${APP_NAME} 一键部署/升级脚本"
  echo "=============================================="
  echo "请按提示填写部署参数。直接回车将使用默认值。"
  echo

  prompt_value PROJECT_DIR "项目部署目录" "${DEPLOY_PROJECT_DIR:-$DEFAULT_PROJECT_DIR}"
  PROJECT_DIR="$(realpath -m "${PROJECT_DIR}")"
  DATA_DIR="${DEPLOY_DATA_DIR:-$DEFAULT_DATA_DIR}"
  WEB_PORT="${DEPLOY_WEB_PORT:-$DEFAULT_WEB_PORT}"
  API_PORT="${DEPLOY_API_PORT:-$DEFAULT_API_PORT}"
  CONSOLE_PORT="${DEPLOY_CONSOLE_PORT:-$DEFAULT_CONSOLE_PORT}"
  ADMIN_ACCOUNT="${DEPLOY_ADMIN_ACCOUNT:-$DEFAULT_ADMIN_ACCOUNT}"
  ADMIN_EMAIL="${DEPLOY_ADMIN_EMAIL:-$DEFAULT_ADMIN_EMAIL}"
  LOCAL_DB_URL_INPUT="${DEPLOY_LOCAL_DB_URL:-postgresql://postgres:postgres@localhost:5432/miaojing}"

  detect_existing_deployment
  load_existing_defaults

  if [ "${MODE}" = "install" ]; then
    echo
    echo "检测结果：目标目录未部署项目，将执行首次部署流程。"
  else
    echo
    echo "检测结果：目标目录已存在部署，将执行安全升级流程。"
  fi

  prompt_value DATA_DIR "数据存储目录" "${DATA_DIR}"
  DATA_DIR="$(realpath -m "${DATA_DIR}")"
  prompt_value WEB_PORT "前端访问端口" "${WEB_PORT}"
  prompt_value API_PORT "后端 API 内部端口" "${API_PORT}"
  prompt_value CONSOLE_PORT "管理后台内部端口" "${CONSOLE_PORT}"
  prompt_value ADMIN_ACCOUNT "管理员账号/昵称" "${ADMIN_ACCOUNT}"
  prompt_value ADMIN_EMAIL "管理员邮箱" "${ADMIN_EMAIL}"
  prompt_value APP_PUBLIC_URL "正式访问地址（有域名请填 https://域名，留空则使用服务器IP和端口）" "${APP_PUBLIC_URL:-$DEFAULT_DOMAIN}"

  if [ "${MODE}" = "install" ]; then
    prompt_secret ADMIN_PASSWORD "管理员密码"
    prompt_value LOCAL_DB_URL_INPUT "PostgreSQL 连接地址" "${LOCAL_DB_URL_INPUT}"
  else
    read -r -s -p "管理员密码（升级时可留空表示不修改）: " ADMIN_PASSWORD
    echo
    prompt_value LOCAL_DB_URL_INPUT "PostgreSQL 连接地址" "${LOCAL_DB_URL_INPUT}"
  fi

  validate_inputs
}

prepare_log() {
  mkdir -p "${DATA_DIR}/logs"
  LOG_FILE="${DATA_DIR}/logs/deploy-$(date +%Y%m%d-%H%M%S).log"
  touch "${LOG_FILE}"
  chmod 600 "${LOG_FILE}"
  log "日志文件：${LOG_FILE}"
}

check_prerequisites() {
  log "检查运行依赖..."
  require_command tar "请安装 tar。"
  require_command rsync "请安装 rsync。"
  require_command curl "请安装 curl。"
  ensure_node_runtime
  prepend_node_path
  require_command node "Node.js 自动安装后仍不可用，请检查 PATH。"
  require_command npm "Node.js 自动安装后 npm 仍不可用，请检查 Node.js 安装包。"
  require_command psql "请安装 PostgreSQL 客户端，例如 postgresql-client。"
  require_command pg_dump "请安装 PostgreSQL 客户端，例如 postgresql-client。"

  log "当前使用 Node.js：$(node -v)，npm：$(npm -v)"

  if ! command -v pnpm >/dev/null 2>&1; then
    log "未检测到 pnpm，准备通过 npm 安装 pnpm@9..."
    install_pnpm
  fi

  if ! command -v pm2 >/dev/null 2>&1; then
    log "未检测到 pm2，准备通过 npm 安装 pm2..."
    install_pm2
  fi
}

npm_install_global_with_mirrors() {
  local package_name="$1"
  local mirror
  for mirror in "${MIRRORS[@]}"; do
    log "尝试使用镜像源安装 ${package_name}：${mirror}"
    if "${NPM_BIN}" --registry="${mirror}" install -g "${package_name}" 2>&1 | log_pipe; then
      log "${package_name} 安装成功。"
      return 0
    fi
    log "镜像源不可用或安装失败，切换下一个源。"
  done
  return 1
}

install_pnpm() {
  npm_install_global_with_mirrors "pnpm@9" || fail "pnpm 安装失败，请检查网络或手动安装。"
}

install_pm2() {
  npm_install_global_with_mirrors "pm2" || fail "pm2 安装失败，请检查网络或手动安装。"
}

install_dependencies_with_mirrors() {
  local mirror
  for mirror in "${MIRRORS[@]}"; do
    log "尝试使用依赖镜像源：${mirror}"
    pnpm config set registry "${mirror}" >/dev/null 2>&1 || true
    if pnpm install --frozen-lockfile --reporter=append-only 2>&1 | log_pipe; then
      log "依赖安装成功，使用源：${mirror}"
      return 0
    fi
    log "依赖安装失败，切换下一个镜像源。"
  done
  fail "所有依赖镜像源均安装失败，请检查网络。"
}

sync_project_files() {
  if [ "${SOURCE_DIR}" = "${PROJECT_DIR}" ]; then
    log "源码目录与部署目录一致，跳过代码同步。"
    return 0
  fi

  log "同步项目代码到部署目录：${PROJECT_DIR}"
  mkdir -p "${PROJECT_DIR}"
  rsync -a --delete \
    --exclude ".git" \
    --exclude "node_modules" \
    --exclude ".next" \
    --exclude "dist" \
    --exclude "backups" \
    --exclude "local-storage" \
    --exclude ".env.local" \
    --exclude ".codex_tmp" \
    "${SOURCE_DIR}/" "${PROJECT_DIR}/" 2>&1 | log_pipe
}

migrate_local_storage() {
  if [ "${MODE}" != "upgrade" ]; then
    return 0
  fi

  local target_storage="${DATA_DIR}/storage"
  if [ -z "${EXISTING_LOCAL_STORAGE_DIR}" ] || [ ! -d "${EXISTING_LOCAL_STORAGE_DIR}" ]; then
    log "未检测到旧版本地存储目录，跳过本地存储迁移。"
    return 0
  fi

  if [ "$(realpath -m "${EXISTING_LOCAL_STORAGE_DIR}")" = "$(realpath -m "${target_storage}")" ]; then
    log "本地存储目录未变化，跳过迁移：${target_storage}"
    return 0
  fi

  log "同步旧本地存储到新的持久化目录：${EXISTING_LOCAL_STORAGE_DIR} -> ${target_storage}"
  mkdir -p "${target_storage}"
  rsync -a "${EXISTING_LOCAL_STORAGE_DIR}/" "${target_storage}/" 2>&1 | log_pipe
}

write_env_file() {
  local env_file encryption_key jwt_secret generation_secret invite_code admin_default_password app_base_url existing_admin_password
  env_file="${PROJECT_DIR}/.env.local"
  encryption_key="$(env_get_value "DATA_ENCRYPTION_KEY" "${env_file}" || random_hex)"
  jwt_secret="$(env_get_value "JWT_SECRET" "${env_file}" || random_hex)"
  generation_secret="$(env_get_value "GENERATION_INTERNAL_SECRET" "${env_file}" || random_hex)"
  invite_code="$(env_get_value "ADMIN_INVITE_CODE" "${env_file}" || true)"
  invite_code="${invite_code:-miaojing-admin-$(random_hex | cut -c1-8)}"
  existing_admin_password="$(env_get_value "ADMIN_DEFAULT_PASSWORD" "${env_file}" || true)"
  admin_default_password="${ADMIN_PASSWORD:-${existing_admin_password}}"
  app_base_url="${APP_PUBLIC_URL:-http://${SERVER_HOST_IP}:${WEB_PORT}}"

  mkdir -p "${DATA_DIR}/storage" "${DATA_DIR}/backups"

  if [ ! -f "${env_file}" ]; then
    cat > "${env_file}" <<EOF
# ${APP_NAME} 生产环境配置
EOF
  fi

  env_set_value "LOCAL_DB_URL" "${LOCAL_DB_URL_INPUT}" "${env_file}"
  env_set_value "LOCAL_DB_ANON_KEY" "$(env_get_value "LOCAL_DB_ANON_KEY" "${env_file}" || printf '%s' "local-anon-key")" "${env_file}"
  env_set_value "LOCAL_DB_SERVICE_ROLE_KEY" "$(env_get_value "LOCAL_DB_SERVICE_ROLE_KEY" "${env_file}" || printf '%s' "local-service-role-key")" "${env_file}"
  env_set_value "LOCAL_STORAGE_DIR" "${DATA_DIR}/storage" "${env_file}"
  env_set_value "BACKUP_DIR" "${DATA_DIR}/backups" "${env_file}"
  env_set_value "DEPLOY_RUN_PORT" "${WEB_PORT}" "${env_file}"
  env_set_value "MIAOJING_API_PORT" "${API_PORT}" "${env_file}"
  env_set_value "MIAOJING_CONSOLE_PORT" "${CONSOLE_PORT}" "${env_file}"
  env_set_value "ADMIN_INVITE_CODE" "${invite_code}" "${env_file}"
  env_set_value "ADMIN_DEFAULT_PASSWORD" "${admin_default_password}" "${env_file}"
  env_set_value "DATA_ENCRYPTION_KEY" "${encryption_key}" "${env_file}"
  env_set_value "JWT_SECRET" "${jwt_secret}" "${env_file}"
  env_set_value "GENERATION_INTERNAL_SECRET" "${generation_secret}" "${env_file}"
  env_set_value "COZE_PROJECT_ENV" "PROD" "${env_file}"
  env_set_value "NODE_ENV" "production" "${env_file}"
  env_set_value "APP_BIND_HOST" "$(env_get_value "APP_BIND_HOST" "${env_file}" || printf '%s' "127.0.0.1")" "${env_file}"
  env_set_value "NEXT_PUBLIC_APP_URL" "${app_base_url}" "${env_file}"
  env_set_value "APP_BASE_URL" "${app_base_url}" "${env_file}"
  env_set_value "ENABLE_DANGER_ADMIN_CLEAR_USERS" "$(env_get_value "ENABLE_DANGER_ADMIN_CLEAR_USERS" "${env_file}" || printf '%s' "false")" "${env_file}"
  env_set_value "DB_POOL_MAX" "$(env_get_value "DB_POOL_MAX" "${env_file}" || printf '%s' "20")" "${env_file}"
  env_set_value "DB_CONNECTION_TIMEOUT_MS" "$(env_get_value "DB_CONNECTION_TIMEOUT_MS" "${env_file}" || printf '%s' "5000")" "${env_file}"
  env_set_value "DB_IDLE_TIMEOUT_MS" "$(env_get_value "DB_IDLE_TIMEOUT_MS" "${env_file}" || printf '%s' "30000")" "${env_file}"
  env_set_value "HTTP_REQUEST_TIMEOUT_MS" "$(env_get_value "HTTP_REQUEST_TIMEOUT_MS" "${env_file}" || printf '%s' "190000")" "${env_file}"
  env_set_value "HTTP_HEADERS_TIMEOUT_MS" "$(env_get_value "HTTP_HEADERS_TIMEOUT_MS" "${env_file}" || printf '%s' "65000")" "${env_file}"
  env_set_value "HTTP_KEEP_ALIVE_TIMEOUT_MS" "$(env_get_value "HTTP_KEEP_ALIVE_TIMEOUT_MS" "${env_file}" || printf '%s' "5000")" "${env_file}"
  env_set_value "HTTP_MAX_HEADERS_COUNT" "$(env_get_value "HTTP_MAX_HEADERS_COUNT" "${env_file}" || printf '%s' "200")" "${env_file}"
  env_set_value "DEPLOY_NODE_MAJOR" "${NODE_MAJOR}" "${env_file}"
  if [ -n "${NODE_BIN_DIR:-}" ]; then
    env_set_value "DEPLOY_NODE_BIN_DIR" "${NODE_BIN_DIR}" "${env_file}"
  fi

  chmod 600 "${env_file}"
  log "已写入环境配置：${env_file}（保留原有非部署配置项）"
}

write_ecosystem_file() {
  local npm_path pm2_path
  npm_path="$(command -v npm)"
  pm2_path="${PATH}"
  cat > "${PROJECT_DIR}/ecosystem.config.cjs" <<EOF
module.exports = {
  apps: [
    {
      name: 'miaojing-api',
      cwd: $(js_quote "${PROJECT_DIR}"),
      script: $(js_quote "${npm_path}"),
      args: 'run start',
      interpreter: 'none',
      exec_mode: 'fork',
      instances: 1,
      max_memory_restart: '512M',
      restart_delay: 3000,
      env: {
        NODE_ENV: 'production',
        COZE_PROJECT_ENV: 'PROD',
        APP_RUNTIME_ROLE: 'backend',
        DEPLOY_RUN_PORT: '${API_PORT}',
        DEPLOY_NODE_BIN_DIR: $(js_quote "${NODE_BIN_DIR:-}"),
        PATH: $(js_quote "${pm2_path}"),
      },
    },
    {
      name: 'miaojing-web',
      cwd: $(js_quote "${PROJECT_DIR}"),
      script: $(js_quote "${npm_path}"),
      args: 'run start',
      interpreter: 'none',
      exec_mode: 'fork',
      instances: 1,
      max_memory_restart: '512M',
      restart_delay: 3000,
      env: {
        NODE_ENV: 'production',
        COZE_PROJECT_ENV: 'PROD',
        APP_RUNTIME_ROLE: 'frontend',
        BACKEND_INTERNAL_URL: 'http://127.0.0.1:${API_PORT}',
        CONSOLE_INTERNAL_URL: 'http://127.0.0.1:${CONSOLE_PORT}',
        DEPLOY_RUN_PORT: '${WEB_PORT}',
        DEPLOY_NODE_BIN_DIR: $(js_quote "${NODE_BIN_DIR:-}"),
        PATH: $(js_quote "${pm2_path}"),
      },
    },
    {
      name: 'miaojing-console',
      cwd: $(js_quote "${PROJECT_DIR}"),
      script: $(js_quote "${npm_path}"),
      args: 'run start',
      interpreter: 'none',
      exec_mode: 'fork',
      instances: 1,
      max_memory_restart: '512M',
      restart_delay: 3000,
      env: {
        NODE_ENV: 'production',
        COZE_PROJECT_ENV: 'PROD',
        APP_RUNTIME_ROLE: 'console',
        DEPLOY_RUN_PORT: '${CONSOLE_PORT}',
        DEPLOY_NODE_BIN_DIR: $(js_quote "${NODE_BIN_DIR:-}"),
        PATH: $(js_quote "${pm2_path}"),
      },
    },
  ],
};
EOF
  log "已生成 PM2 配置。"
}

backup_before_upgrade() {
  if [ "${MODE}" != "upgrade" ]; then
    return 0
  fi

  log "升级前开始备份数据库、环境配置和本地存储..."
  cd "${PROJECT_DIR}"
  mkdir -p "${DATA_DIR}/backups"

  if [ -f "${PROJECT_DIR}/.env.local" ]; then
    set +u; set -a
    # shellcheck disable=SC1091
    source "${PROJECT_DIR}/.env.local"
    set +a; set -u
  fi

  if [ -f "${SOURCE_DIR}/scripts/backup-create.sh" ]; then
    LOCAL_DB_URL="${LOCAL_DB_URL:-$LOCAL_DB_URL_INPUT}" BACKUP_DIR="${DATA_DIR}/backups" COZE_WORKSPACE_PATH="${PROJECT_DIR}" \
      bash "${SOURCE_DIR}/scripts/backup-create.sh" 2>&1 | log_pipe > "${DATA_DIR}/logs/.last-backup-path"
    BACKUP_FILE="$(tail -n 1 "${DATA_DIR}/logs/.last-backup-path" || true)"
    log "升级前备份完成：${BACKUP_FILE}"
  else
    log "未找到旧版备份脚本，执行基础文件备份。"
    BACKUP_FILE="${DATA_DIR}/backups/miaojing-files-$(date +%Y%m%d-%H%M%S).tar.gz"
    if [ -d "${DATA_DIR}/storage" ]; then
      tar -czf "${BACKUP_FILE}" -C "${PROJECT_DIR}" .env.local -C "${DATA_DIR}" storage
    else
      tar -czf "${BACKUP_FILE}" -C "${PROJECT_DIR}" .env.local
    fi
    log "基础备份完成：${BACKUP_FILE}"
  fi
}

initialize_database() {
  log "检查数据库连接..."
  psql "${LOCAL_DB_URL_INPUT}" -v ON_ERROR_STOP=1 -c "SELECT 1;" >/dev/null

  log "执行数据库结构初始化/升级 SQL（幂等，不会删除用户数据）..."
  psql "${LOCAL_DB_URL_INPUT}" -v ON_ERROR_STOP=1 -f "${PROJECT_DIR}/scripts/init-database.sql" 2>&1 | log_pipe

  if [ -f "${PROJECT_DIR}/scripts/database-optimization-patch.sql" ]; then
    psql "${LOCAL_DB_URL_INPUT}" -v ON_ERROR_STOP=1 -f "${PROJECT_DIR}/scripts/database-optimization-patch.sql" 2>&1 | log_pipe
  fi

  apply_runtime_schema_patch
}

apply_runtime_schema_patch() {
  log "补齐生产运行所需的动态配置表..."
  psql "${LOCAL_DB_URL_INPUT}" -v ON_ERROR_STOP=1 <<'SQL' 2>&1 | log_pipe
CREATE EXTENSION IF NOT EXISTS "pgcrypto";
CREATE SCHEMA IF NOT EXISTS auth;

DO $$
BEGIN
  IF NOT EXISTS (
    SELECT 1 FROM pg_proc p
    JOIN pg_namespace n ON n.oid = p.pronamespace
    WHERE n.nspname = 'auth' AND p.proname = 'uid'
  ) THEN
    EXECUTE 'CREATE FUNCTION auth.uid() RETURNS UUID AS $fn$ SELECT NULLIF(current_setting(''request.jwt.claim.sub'', true), '''')::UUID; $fn$ LANGUAGE SQL STABLE';
  END IF;

  IF NOT EXISTS (
    SELECT 1 FROM pg_proc p
    JOIN pg_namespace n ON n.oid = p.pronamespace
    WHERE n.nspname = 'auth' AND p.proname = 'role'
  ) THEN
    EXECUTE 'CREATE FUNCTION auth.role() RETURNS TEXT AS $fn$ SELECT COALESCE(NULLIF(current_setting(''request.jwt.claim.role'', true), ''''), ''anon''); $fn$ LANGUAGE SQL STABLE';
  END IF;
END $$;

ALTER TABLE profiles
  ADD COLUMN IF NOT EXISTS email_verified BOOLEAN NOT NULL DEFAULT FALSE,
  ADD COLUMN IF NOT EXISTS email_verified_at TIMESTAMPTZ,
  ADD COLUMN IF NOT EXISTS email_bound_at TIMESTAMPTZ,
  ADD COLUMN IF NOT EXISTS email_sender_domain VARCHAR(255),
  ADD COLUMN IF NOT EXISTS preferred_theme VARCHAR(16) NOT NULL DEFAULT 'dark';

UPDATE profiles
   SET preferred_theme = 'dark'
 WHERE preferred_theme IS NULL
    OR preferred_theme NOT IN ('dark', 'light');

ALTER TABLE site_config
  ADD COLUMN IF NOT EXISTS site_description TEXT NOT NULL DEFAULT '',
  ADD COLUMN IF NOT EXISTS site_keywords TEXT NOT NULL DEFAULT '',
  ADD COLUMN IF NOT EXISTS announcement TEXT NOT NULL DEFAULT '',
  ADD COLUMN IF NOT EXISTS membership_enabled BOOLEAN NOT NULL DEFAULT TRUE,
  ADD COLUMN IF NOT EXISTS terms_of_service TEXT NOT NULL DEFAULT '',
  ADD COLUMN IF NOT EXISTS privacy_policy TEXT NOT NULL DEFAULT '',
  ADD COLUMN IF NOT EXISTS about_us TEXT NOT NULL DEFAULT '',
  ADD COLUMN IF NOT EXISTS help_center TEXT NOT NULL DEFAULT '',
  ADD COLUMN IF NOT EXISTS filing_info TEXT NOT NULL DEFAULT '',
  ADD COLUMN IF NOT EXISTS filing_url TEXT NOT NULL DEFAULT '',
  ADD COLUMN IF NOT EXISTS public_security_filing_info TEXT NOT NULL DEFAULT '',
  ADD COLUMN IF NOT EXISTS public_security_filing_url TEXT NOT NULL DEFAULT '';

ALTER TABLE works
  ADD COLUMN IF NOT EXISTS updated_at TIMESTAMPTZ,
  ADD COLUMN IF NOT EXISTS views_count INTEGER NOT NULL DEFAULT 0;

ALTER TABLE announcements
  ADD COLUMN IF NOT EXISTS type VARCHAR(32) NOT NULL DEFAULT 'site';

ALTER TABLE user_api_keys ADD COLUMN IF NOT EXISTS supplier_name VARCHAR(128);
ALTER TABLE user_api_keys ADD COLUMN IF NOT EXISTS note TEXT NOT NULL DEFAULT '';
ALTER TABLE user_api_keys ADD COLUMN IF NOT EXISTS type VARCHAR(16) NOT NULL DEFAULT 'image';

CREATE TABLE IF NOT EXISTS system_api_configs (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  provider VARCHAR(128),
  name VARCHAR(255) NOT NULL,
  api_url TEXT NOT NULL DEFAULT '',
  model_name VARCHAR(255) NOT NULL,
  note TEXT NOT NULL DEFAULT '',
  api_key_encrypted TEXT NOT NULL DEFAULT '',
  api_key_preview VARCHAR(64) NOT NULL DEFAULT '',
  type VARCHAR(16) NOT NULL DEFAULT 'image',
  credits_per_use INTEGER NOT NULL DEFAULT 10,
  is_active BOOLEAN NOT NULL DEFAULT true,
  sort_order INTEGER NOT NULL DEFAULT 0,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  updated_at TIMESTAMPTZ
);
CREATE INDEX IF NOT EXISTS system_api_configs_active_type_sort_idx ON system_api_configs (is_active, type, sort_order);

CREATE TABLE IF NOT EXISTS payment_methods (
  id VARCHAR(64) PRIMARY KEY,
  type VARCHAR(32) NOT NULL,
  name VARCHAR(128) NOT NULL,
  is_active BOOLEAN NOT NULL DEFAULT FALSE,
  public_config JSONB NOT NULL DEFAULT '{}'::jsonb,
  secret_config_encrypted JSONB NOT NULL DEFAULT '{}'::jsonb,
  secret_config_preview JSONB NOT NULL DEFAULT '{}'::jsonb,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  updated_at TIMESTAMPTZ
);
INSERT INTO payment_methods (id, type, name, is_active) VALUES
  ('pm-alipay', 'alipay', '支付宝', true),
  ('pm-wechat', 'wechat', '微信支付', false),
  ('pm-manual', 'manual', '手动转账', false),
  ('pm-stripe', 'stripe', 'Stripe', false)
ON CONFLICT (id) DO NOTHING;

ALTER TABLE generation_jobs ADD COLUMN IF NOT EXISTS user_id UUID;
ALTER TABLE generation_jobs ADD COLUMN IF NOT EXISTS provider VARCHAR(128);
ALTER TABLE generation_jobs ADD COLUMN IF NOT EXISTS model_name VARCHAR(255);
ALTER TABLE generation_jobs ADD COLUMN IF NOT EXISTS api_url TEXT;
ALTER TABLE generation_jobs ADD COLUMN IF NOT EXISTS progress JSONB NOT NULL DEFAULT '{}'::jsonb;
CREATE INDEX IF NOT EXISTS generation_jobs_user_created_idx ON generation_jobs (user_id, created_at DESC);
CREATE INDEX IF NOT EXISTS generation_jobs_provider_model_created_idx ON generation_jobs (type, provider, model_name, created_at DESC);

ALTER TABLE site_config ADD COLUMN IF NOT EXISTS log_retention_days INTEGER NOT NULL DEFAULT 30;
UPDATE site_config SET log_retention_days = LEAST(90, GREATEST(1, log_retention_days));

CREATE TABLE IF NOT EXISTS platform_log_settings (
  id INTEGER PRIMARY KEY DEFAULT 1,
  retention_days INTEGER NOT NULL DEFAULT 30,
  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);
INSERT INTO platform_log_settings (id, retention_days)
VALUES (1, 30)
ON CONFLICT (id) DO NOTHING;

CREATE TABLE IF NOT EXISTS platform_logs (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  type VARCHAR(32) NOT NULL,
  level VARCHAR(16) NOT NULL DEFAULT 'info',
  action VARCHAR(128) NOT NULL,
  message TEXT NOT NULL,
  user_id UUID,
  user_name VARCHAR(255),
  user_email VARCHAR(255),
  target_type VARCHAR(64),
  target_id VARCHAR(255),
  ip_address VARCHAR(64),
  user_agent TEXT,
  metadata JSONB NOT NULL DEFAULT '{}'::jsonb,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);
CREATE INDEX IF NOT EXISTS platform_logs_type_created_idx ON platform_logs (type, created_at DESC);
CREATE INDEX IF NOT EXISTS platform_logs_level_created_idx ON platform_logs (level, created_at DESC);
CREATE INDEX IF NOT EXISTS platform_logs_user_created_idx ON platform_logs (user_id, created_at DESC);
CREATE INDEX IF NOT EXISTS platform_logs_created_idx ON platform_logs (created_at DESC);
CREATE INDEX IF NOT EXISTS platform_logs_user_name_idx ON platform_logs (LOWER(COALESCE(user_name, '')));
CREATE INDEX IF NOT EXISTS platform_logs_user_email_idx ON platform_logs (LOWER(COALESCE(user_email, '')));

CREATE TABLE IF NOT EXISTS email_settings (
  id INTEGER PRIMARY KEY DEFAULT 1,
  enabled BOOLEAN NOT NULL DEFAULT FALSE,
  smtp_host VARCHAR(255),
  smtp_port INTEGER NOT NULL DEFAULT 465,
  smtp_secure BOOLEAN NOT NULL DEFAULT TRUE,
  smtp_user VARCHAR(255),
  smtp_password_encrypted TEXT,
  smtp_password_preview VARCHAR(64),
  from_email VARCHAR(255),
  from_name VARCHAR(255),
  reply_to VARCHAR(255),
  app_name VARCHAR(120),
  app_base_url TEXT,
  logo_url TEXT,
  contact_email VARCHAR(255),
  copyright TEXT,
  code_length INTEGER NOT NULL DEFAULT 6,
  code_charset VARCHAR(32) NOT NULL DEFAULT 'alphanumeric',
  code_ttl_minutes INTEGER NOT NULL DEFAULT 5,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
  updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE TABLE IF NOT EXISTS email_verification_codes (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  email VARCHAR(255) NOT NULL,
  code_hash TEXT NOT NULL,
  type VARCHAR(32) NOT NULL,
  user_id UUID,
  ip_address VARCHAR(64),
  attempts INTEGER NOT NULL DEFAULT 0,
  max_attempts INTEGER NOT NULL DEFAULT 5,
  is_used BOOLEAN NOT NULL DEFAULT FALSE,
  locked_until TIMESTAMPTZ,
  expires_at TIMESTAMPTZ NOT NULL,
  used_at TIMESTAMPTZ,
  metadata JSONB NOT NULL DEFAULT '{}'::jsonb,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE TABLE IF NOT EXISTS email_send_logs (
  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  email VARCHAR(255) NOT NULL,
  type VARCHAR(64) NOT NULL,
  ip_address VARCHAR(64),
  status VARCHAR(32) NOT NULL,
  error_message TEXT,
  created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE INDEX IF NOT EXISTS email_codes_email_type_idx ON email_verification_codes (LOWER(email), type, created_at DESC);
CREATE INDEX IF NOT EXISTS email_codes_ip_created_idx ON email_verification_codes (ip_address, created_at DESC);
CREATE INDEX IF NOT EXISTS email_send_logs_email_created_idx ON email_send_logs (LOWER(email), created_at DESC);
CREATE INDEX IF NOT EXISTS email_send_logs_ip_created_idx ON email_send_logs (ip_address, created_at DESC);
SQL
}

ensure_admin_user() {
  if [ -z "${ADMIN_PASSWORD:-}" ] && [ "${MODE}" = "upgrade" ]; then
    log "升级模式未输入管理员密码，跳过管理员密码更新。"
    return 0
  fi

  log "创建/更新管理员账号..."
  psql "${LOCAL_DB_URL_INPUT}" \
    -v ON_ERROR_STOP=1 \
    -v admin_email="${ADMIN_EMAIL}" \
    -v admin_account="${ADMIN_ACCOUNT}" \
    -v admin_password="${ADMIN_PASSWORD}" <<'SQL' 2>&1 | log_pipe
CREATE TEMP TABLE _deploy_admin_input (
  email TEXT NOT NULL,
  account TEXT NOT NULL,
  password TEXT NOT NULL
);

INSERT INTO _deploy_admin_input (email, account, password)
VALUES (:'admin_email', :'admin_account', :'admin_password');

DO $$
DECLARE
  r RECORD;
  v_admin_id UUID;
BEGIN
  SELECT * INTO r FROM _deploy_admin_input LIMIT 1;

  SELECT id INTO v_admin_id FROM profiles WHERE lower(email) = lower(r.email) LIMIT 1;
  IF v_admin_id IS NULL THEN
    SELECT id INTO v_admin_id FROM auth.users WHERE lower(email) = lower(r.email) LIMIT 1;
  END IF;
  IF v_admin_id IS NULL THEN
    v_admin_id := gen_random_uuid();
  END IF;

  INSERT INTO auth.users (id, email, password_hash, raw_user_meta_data, created_at)
  VALUES (
    v_admin_id,
    r.email,
    crypt(r.password, gen_salt('bf')),
    jsonb_build_object('nickname', r.account),
    NOW()
  )
  ON CONFLICT (email) DO UPDATE SET
    password_hash = EXCLUDED.password_hash,
    raw_user_meta_data = EXCLUDED.raw_user_meta_data;

  SELECT id INTO v_admin_id FROM auth.users WHERE lower(email) = lower(r.email) LIMIT 1;

  INSERT INTO profiles (
    id, email, nickname, role, membership_tier, credits_balance,
    daily_quota_limit, daily_quota_used, is_active,
    email_verified, email_verified_at, email_bound_at, email_sender_domain
  )
  VALUES (
    v_admin_id, r.email, r.account, 'admin', 'enterprise',
    9999, 999, 0, true, true, NOW(), NOW(), split_part(r.email, '@', 2)
  )
  ON CONFLICT (id) DO UPDATE SET
    email = EXCLUDED.email,
    nickname = EXCLUDED.nickname,
    role = 'admin',
    membership_tier = 'enterprise',
    credits_balance = GREATEST(profiles.credits_balance, 9999),
    daily_quota_limit = GREATEST(profiles.daily_quota_limit, 999),
    is_active = true,
    email_verified = true,
    email_verified_at = COALESCE(profiles.email_verified_at, NOW()),
    email_bound_at = COALESCE(profiles.email_bound_at, NOW()),
    email_sender_domain = COALESCE(NULLIF(profiles.email_sender_domain, ''), EXCLUDED.email_sender_domain),
    updated_at = NOW();
END $$;
SQL
}

build_project() {
  log "开始安装依赖..."
  cd "${PROJECT_DIR}"
  install_dependencies_with_mirrors

  log "开始生产构建..."
  pnpm run check:boundaries 2>&1 | log_pipe
  pnpm run build 2>&1 | log_pipe
}

run_security_audit() {
  log "执行生产依赖漏洞扫描..."
  cd "${PROJECT_DIR}"
  local mirror audit_status
  audit_status=1

  for mirror in "${MIRRORS[@]}"; do
    log "尝试使用漏洞库源执行 pnpm audit：${mirror}"
    if pnpm audit --prod --audit-level=high --registry="${mirror}" 2>&1 | log_pipe; then
      audit_status=0
      break
    fi
    log "当前源审计失败或发现高危漏洞，继续尝试下一个源。"
  done

  if [ "${audit_status}" -ne 0 ]; then
    fail "生产依赖漏洞扫描未通过。请先处理 high/critical 级别漏洞后再上线。"
  fi

  if ! pnpm audit --prod --audit-level=moderate --registry="https://registry.npmjs.org" 2>&1 | log_pipe; then
    log "提醒：仍存在 moderate 级别漏洞。脚本不会阻断升级，但正式上线前建议升级相关依赖链并重新构建验证。"
  fi
}

start_services() {
  log "启动/重载 PM2 服务..."
  cd "${PROJECT_DIR}"
  pm2 startOrReload ecosystem.config.cjs --update-env 2>&1 | log_pipe
  pm2 save 2>&1 | log_pipe || true
}

wait_for_health() {
  log "等待服务启动并执行健康检查..."
  local api_url="http://127.0.0.1:${WEB_PORT}/api/health"
  local console_url="http://127.0.0.1:${WEB_PORT}/console"
  local attempt
  for attempt in $(seq 1 30); do
    if curl -fsS "${api_url}" >/dev/null 2>&1 && curl -fsS "${console_url}" >/dev/null 2>&1; then
      log "健康检查通过：前端、后端 API、管理后台均可访问。"
      return 0
    fi
    sleep 2
  done
  fail "健康检查失败，请检查 PM2 日志：pm2 logs miaojing-web"
}

mark_deployment() {
  cat > "${PROJECT_DIR}/${APP_MARKER}" <<EOF
deployed_at=$(date -Iseconds)
project_dir=${PROJECT_DIR}
data_dir=${DATA_DIR}
web_port=${WEB_PORT}
api_port=${API_PORT}
console_port=${CONSOLE_PORT}
EOF
}

print_success() {
  local mode_label
  mode_label="部署"
  if [ "${MODE}" = "upgrade" ]; then
    mode_label="升级"
  fi

  echo
  echo "=============================================="
  echo "✅ ${APP_NAME} ${mode_label}成功"
  echo "=============================================="
  echo "访问地址：http://${SERVER_HOST_IP}:${WEB_PORT}"
  echo "管理后台：http://${SERVER_HOST_IP}:${WEB_PORT}/console"
  echo "管理员账号：${ADMIN_ACCOUNT}"
  echo "管理员邮箱：${ADMIN_EMAIL}"
  if [ -n "${ADMIN_PASSWORD:-}" ]; then
    echo "管理员密码：${ADMIN_PASSWORD}"
  else
    echo "管理员密码：升级时未修改，请继续使用原密码"
  fi
  echo "项目目录：${PROJECT_DIR}"
  echo "数据目录：${DATA_DIR}"
  echo "日志文件：${LOG_FILE}"
  if [ -n "${BACKUP_FILE:-}" ]; then
    echo "升级前备份：${BACKUP_FILE}"
  fi
  echo "生产安全提醒：正式上线请通过 Nginx/HTTPS 访问，只开放 80/443/SSH，并禁止公网直连 ${API_PORT}/${CONSOLE_PORT}。"
  echo "=============================================="
}

main() {
  collect_inputs
  detect_host_ip
  prepare_log
  log "当前源码目录：${SOURCE_DIR}"
  log "执行模式：${MODE}"
  check_prerequisites
  backup_before_upgrade
  migrate_local_storage
  sync_project_files
  write_env_file
  write_ecosystem_file
  initialize_database
  ensure_admin_user
  build_project
  run_security_audit
  start_services
  wait_for_health
  mark_deployment
  print_success
}

main "$@"