export const dynamic = 'force-dynamic';
import { NextRequest, NextResponse } from "next/server";
import {
  ListOpenTasksRequestSchema,
  ClaimTaskRequestSchema,
  SubmitSolutionRequestSchema,
  CreateSubTaskRequestSchema,
  RequestPeerReviewRequestSchema,
  BroadcastHelpSignalRequestSchema,
  QueryAgentMemoryRequestSchema,
  NegotiateBountyRequestSchema,
  RentApiResourceRequestSchema,
  CreateBountyRequestSchema,
  TaskStatus,
  JudgeOverallResult
} from "@agent-bounty/contracts";
import { isIP } from "node:net";
import { prisma } from "@/lib/prisma";
import { runSubmissionInSandbox } from "@/lib/sandbox";
import { broadcastFomoEvent } from "@/lib/x-broadcaster";
import { logAuditEvent } from "@/lib/audit";
import { redis } from "@/lib/redis";
import { authHold } from "@/lib/payment";
import { sendTrafficAlert } from "@/lib/traffic-alert";
import { evaluateExternalFunnelHealth } from "@/lib/traffic-conversion-monitor";
import { triggerWebhook } from "@/lib/a2a-broadcasters/webhook";
import crypto from "crypto";
import { z } from "zod";
import type { Prisma } from "../../../../../prisma/generated/client";

const MCP_SURGE_WINDOW_MINUTES = 10;
const MCP_SURGE_INTERVAL = 25;
const AUTO_WHITELIST_EXTERNAL_AGENTS = process.env.AUTO_WHITELIST_EXTERNAL_AGENTS === "true";
const AUTO_APPROVE_BOUNTY_NEGOTIATION = process.env.AUTO_APPROVE_BOUNTY_NEGOTIATION === "true";
const REQUEST_ID_HEADER_NAMES = ["x-request-id", "x-correlation-id", "x-trace-id"];
const PUBLIC_MCP_BETA_TOKEN = (process.env.PUBLIC_MCP_BETA_TOKEN || "").trim();

const MCP_AGENT_HEADERS = [
  "x-agent-id",
  "x-agent-name",
  "x-client-id",
  "x-request-id",
  "x-mcp-agent-id",
  "x-openai-agent",
];

function asRecordJson(value: unknown): Record<string, unknown> | undefined {
  if (typeof value === "object" && value !== null && !Array.isArray(value)) {
    return value as Record<string, unknown>;
  }
  return undefined;
}

function resolveRequestId(request: NextRequest) {
  for (const headerName of REQUEST_ID_HEADER_NAMES) {
    const value = request.headers.get(headerName);
    if (value) {
      return value;
    }
  }
  return crypto.randomUUID();
}

function summarizeRequestPayload(tool: string, payload: unknown) {
  const body = asRecordJson(payload) || {};

  if (tool === "claim_task") {
    return {
      tool,
      task_id: typeof body.task_id === "string" ? body.task_id : undefined,
      agent_id: typeof body.agent_id === "string" ? body.agent_id : undefined,
      has_developer_wallet: typeof body.developer_wallet === "string",
    };
  }

  if (tool === "submit_solution") {
    return {
      tool,
      task_id: typeof body.task_id === "string" ? body.task_id : undefined,
      claim_token_prefix:
        typeof body.claim_token === "string" ? body.claim_token.slice(0, 10) : undefined,
      deliverable_count:
        typeof body.deliverables === "object" &&
        body.deliverables !== null &&
        !Array.isArray(body.deliverables)
          ? Object.keys(body.deliverables).length
          : undefined,
    };
  }

  if (tool === "list_open_tasks") {
    return {
      tool,
      has_body: body && Object.keys(body).length > 0,
    };
  }

  return {
    tool,
    keys: Object.keys(body),
  };
}

function resolveRequestTrace(request: NextRequest) {
  return {
    request_id: resolveRequestId(request),
    source_ip: resolveSourceIp(request),
    user_agent: request.headers.get("user-agent") ?? "unknown",
    request_actor_headers: {
      x_agent_id: request.headers.get("x-agent-id") ?? null,
      x_agent_name: request.headers.get("x-agent-name") ?? null,
      x_client_id: request.headers.get("x-client-id") ?? null,
      x_openai_agent: request.headers.get("x-openai-agent") ?? null,
      x_mcp_agent_id: request.headers.get("x-mcp-agent-id") ?? null,
      x_request_id: request.headers.get("x-request-id") ?? null,
      origin: request.headers.get("origin") ?? null,
    },
  };
}

function sanitizeIpAddress(value: string | undefined) {
  if (!value) {
    return undefined;
  }

  const first = value.split(",")[0]?.trim();
  if (!first) {
    return undefined;
  }

  const bracketedMatch = first.match(/^\[(.+)\]:(\d+)$/);
  if (bracketedMatch?.[1]) {
    return bracketedMatch[1].toLowerCase();
  }

  const ipv4WithPortMatch = first.match(/^(\d{1,3}(?:\.\d{1,3}){3}):\d+$/);
  if (ipv4WithPortMatch?.[1]) {
    return ipv4WithPortMatch[1];
  }

  return first.toLowerCase();
}

function resolveSourceIp(request: NextRequest) {
  return sanitizeIpAddress(
    request.headers.get("x-forwarded-for") ??
    request.headers.get("x-real-ip") ??
    request.headers.get("cf-connecting-ip") ??
    request.headers.get("true-client-ip") ??
    request.headers.get("x-client-ip") ??
    "unknown"
  );
}

function isPublicRequest(request: NextRequest) {
  const sourceIp = resolveSourceIp(request);
  return !isPrivateIp(sourceIp);
}

function scopeTrafficAction(baseAction: string, isPublicIp: boolean) {
  return `${isPublicIp ? "EXTERNAL" : "INTERNAL"}_${baseAction}`;
}

async function ensureBuilderAgent(
  agentId: string,
  requestContext?: {
    request_id?: string;
    source_ip?: string;
    user_agent?: string;
    request_actor_headers?: Record<string, unknown>;
  },
  isPublicIp = false
) {
  const existingAgent = await prisma.agentProfile.findUnique({ where: { agent_id: agentId } });
  if (existingAgent) {
    return existingAgent;
  }

  if (!AUTO_WHITELIST_EXTERNAL_AGENTS) {
    return null;
  }

  try {
    const created = await prisma.agentProfile.create({
      data: {
        agent_id: agentId,
        type: "BUILDER",
        status: "WHITELISTED",
      },
    });

    void sendTrafficAlert({
      level: "info",
      action: scopeTrafficAction("AGENT_AUTO_WHITELIST", isPublicIp),
      surface: "mcp/claim_task",
      actorType: "AGENT",
      actorId: `agent:${normalizeActorId(agentId, "agent")}`,
      message: `Agent 首次接案已自動白名單: ${agentId}`,
      metadata: {
        ...requestContext,
        agent_id: agentId,
      },
    });

    return created;
  } catch (error: unknown) {
    // In high-concurrency case, another request may create the same agent first.
    const isUniqueViolation =
      typeof error === "object" &&
      error !== null &&
      "code" in error &&
      (error as { code?: unknown }).code === "P2002";

    if (isUniqueViolation) {
      return prisma.agentProfile.findUnique({ where: { agent_id: agentId } });
    }

    throw error;
  }
}

function isPrivateIp(ip: string | undefined) {
  if (!ip) return true;
  const normalized = ip.trim().toLowerCase();
  if (!normalized || normalized === "unknown" || normalized === "localhost") {
    return true;
  }
  if (normalized === "::1" || normalized.startsWith("fe80")) {
    return true;
  }
  if (isIP(normalized) === 6 && (normalized.startsWith("fc") || normalized.startsWith("fd"))) {
    return true;
  }
  if (isIP(normalized) === 0) {
    return false;
  }

  if (normalized.startsWith("127.") || normalized.startsWith("10.") || normalized.startsWith("192.168.")) {
    return true;
  }

  if (normalized.startsWith("172.")) {
    const secondOctet = Number(normalized.split(".")[1]);
    return secondOctet >= 16 && secondOctet <= 31;
  }

  return false;
}

function normalizeActorId(value: string, fallback: string) {
  const normalized = value.trim().toLowerCase().replace(/[^a-z0-9._:-]+/g, "_").replace(/_+/g, "_");
  return normalized.slice(0, 64) || fallback;
}

function asAgentActorId(value: string | undefined, fallback = "agent") {
  const normalized = normalizeActorId(value || fallback, fallback);
  return normalized.startsWith("agent:") ? normalized : `agent:${normalized}`;
}

function resolveActorFromMcpRequest(request: NextRequest) {
  for (const headerName of MCP_AGENT_HEADERS) {
    const headerValue = request.headers.get(headerName);
    if (headerValue) {
      return {
        actorType: "AGENT" as const,
        actorId: `agent:${normalizeActorId(headerValue, "agent")}`,
      };
    }
  }

  return {
    actorType: "AGENT" as const,
    actorId: "mcp-anonymous",
  };
}

export async function POST(request: NextRequest, props: { params: Promise<{ tool: string }> }) {
  const params = await props.params;
  const tool = params.tool;
  const actor = resolveActorFromMcpRequest(request);
  const requestContext = resolveRequestTrace(request);
  const isPublicIp = isPublicRequest(request);

  const authHeader = request.headers.get("Authorization");
  if (!authHeader || !authHeader.startsWith("Bearer ")) {
    void sendTrafficAlert({
      level: "warning",
      action: scopeTrafficAction("MCP_AUTH_MISSING", isPublicIp),
      surface: `mcp/${tool}`,
      actorType: actor.actorType,
      actorId: actor.actorId,
      taskId: "open-tasks",
      message: "缺少 MCP Authorization Bearer Token",
      metadata: {
        ...requestContext,
        auth_issue: "missing_bearer_token",
        payload_summary: summarizeRequestPayload(tool, null),
        response_summary: "missing_bearer_token",
        response_status: 401,
      },
    });

    return NextResponse.json({ error: "Unauthorized: Missing Bearer token" }, { status: 401 });
  }

  const token = authHeader.split(" ")[1];
  
  // 試營運推廣期間，允許外部 Agent 使用這組公版 Token 來接案
  const isBetaToken = Boolean(PUBLIC_MCP_BETA_TOKEN) && token === PUBLIC_MCP_BETA_TOKEN;
  const isValidServerKey = process.env.API_KEY && token === process.env.API_KEY;

  if (!isValidServerKey && !isBetaToken) {
    void sendTrafficAlert({
      level: "warning",
      action: scopeTrafficAction("MCP_AUTH_FORBIDDEN", isPublicIp),
      surface: `mcp/${tool}`,
      actorType: actor.actorType,
      actorId: actor.actorId,
      taskId: "open-tasks",
      message: "MCP Authorization Bearer Token 無效",
      metadata: {
        ...requestContext,
        auth_issue: "invalid_bearer_token",
        payload_summary: summarizeRequestPayload(tool, null),
        response_summary: "invalid_bearer_token",
        response_status: 403,
      },
    });

    return NextResponse.json({ error: "Forbidden: Invalid API Key" }, { status: 403 });
  }

  let body: unknown = null;
  const responseStatusMap: Record<string, number> = {
    list_open_tasks: 200,
    claim_task: 200,
    submit_solution: 200,
    check_payout_status: 200,
  };
  try {
    body = await request.json();

    switch (tool) {
      case "list_open_tasks": {
        if (typeof body === "object" && body !== null && !("skills" in body)) {
          (body as Record<string, unknown>).skills = [];
        }
        const parsed = ListOpenTasksRequestSchema.parse(body);
        const trafficAction = scopeTrafficAction("LIST_OPEN_TASKS_MCP", isPublicIp);
        const tasks = await prisma.task.findMany({
          where: {
            status: TaskStatus.OPEN,
            ...(parsed.difficulty ? { difficulty: parsed.difficulty } : {}),
            ...(parsed.skills.length > 0 ? { required_stack: { hasSome: parsed.skills } } : {}),
            title: {
              not: {
                startsWith: "GitHub Issue:",
              },
            },
          },
          take: parsed.limit,
          orderBy: { created_at: "desc" },
        });
        const sampleTaskIds = tasks.slice(0, 20).map((task) => task.id);

        const formattedTasks = tasks.map((t) => ({
          task_id: t.id,
          title: t.title,
          status: t.status,
          difficulty: t.difficulty,
          reward: {
            amount: t.reward_amount,
            currency: t.reward_currency,
            display_amount: `$${(t.reward_amount / 100).toFixed(2)}`
          },
          required_stack: t.required_stack,
          scope_clarity_score: t.scope_clarity_score,
          created_at: t.created_at.toISOString(),
          description_preview: t.description.substring(0, 100) + (t.description.length > 100 ? "..." : ""),
        }));

        void sendTrafficAlert({
          level: "info",
          action: trafficAction,
          surface: "mcp/list_open_tasks",
          actorType: actor.actorType,
          actorId: actor.actorId,
          taskId: "open-tasks",
          message: "外部 MCP 查詢任務列表",
          metadata: {
            count: formattedTasks.length,
            sample_task_ids: sampleTaskIds,
            source_tool: tool,
            ...requestContext,
            payload_summary: summarizeRequestPayload(tool, body),
            response_summary: `list_open_tasks_ok:${formattedTasks.length}`,
            response_status: responseStatusMap[tool] || 200,
          },
        });

        if (isPublicIp) {
          void evaluateExternalFunnelHealth({
            surface: "mcp/list_open_tasks",
            periodMinutes: 10,
          });
        }

        void prisma.auditEvent.count({
          where: {
            createdAt: {
              gte: new Date(Date.now() - MCP_SURGE_WINDOW_MINUTES * 60 * 1000),
            },
            action: trafficAction,
          },
        }).then((eventCount) => {
          if (eventCount > 0 && eventCount % MCP_SURGE_INTERVAL === 0) {
            void sendTrafficAlert({
              level: "warning",
              action: scopeTrafficAction("LIST_OPEN_TASKS_SURGE", isPublicIp),
              surface: "mcp/list_open_tasks",
              actorType: "SYSTEM",
              actorId: "traffic-monitor",
              taskId: "open-tasks",
              message: `MCP list_open_tasks spike detected: ${eventCount} hits in ${MCP_SURGE_WINDOW_MINUTES}m`,
              metadata: {
                alert_window_minutes: MCP_SURGE_WINDOW_MINUTES,
                event_count: eventCount,
                source_tool: tool,
                response_summary: `open_tasks_surge_${MCP_SURGE_WINDOW_MINUTES}m:${eventCount}`,
              },
            });
          }
        }).catch(() => {});

        return NextResponse.json({
          tasks: formattedTasks,
          total_open: formattedTasks.length,
          stockout_warning: formattedTasks.length === 0,
        });
      }

      case "claim_task": {
        const parsed = ClaimTaskRequestSchema.parse(body);

        // Verify Agent Whitelist
        const agent = await ensureBuilderAgent(parsed.agent_id, requestContext, isPublicIp);
        if (!agent) {
          void sendTrafficAlert({
            level: "warning",
            action: scopeTrafficAction("CLAIM_TASK_FORBIDDEN", isPublicIp),
            surface: "mcp/claim_task",
            actorType: "AGENT",
            actorId: `agent:${normalizeActorId(parsed.agent_id, "agent")}`,
            taskId: parsed.task_id,
            message: `外部 Agent 嘗試接案但尚未白名單: ${parsed.agent_id}`,
            metadata: {
              developer_wallet: parsed.developer_wallet,
              ...requestContext,
              payload_summary: summarizeRequestPayload(tool, body),
              response_summary: "claim_forbidden_not_whitelisted",
              response_status: 403,
            },
          });
          return NextResponse.json({ error: "Forbidden: Agent is not whitelisted" }, { status: 403 });
        }

        if (agent.status !== "WHITELISTED") {
          void sendTrafficAlert({
            level: "warning",
            action: scopeTrafficAction("CLAIM_TASK_FORBIDDEN", isPublicIp),
            surface: "mcp/claim_task",
            actorType: "AGENT",
            actorId: `agent:${normalizeActorId(parsed.agent_id, "agent")}`,
            taskId: parsed.task_id,
            message: `external agent 狀態非白名單: ${parsed.agent_id}`,
            metadata: {
              developer_wallet: parsed.developer_wallet,
              ...requestContext,
              payload_summary: summarizeRequestPayload(tool, body),
              response_summary: `claim_forbidden_status_${agent.status}`,
              response_status: 403,
            },
          });
          return NextResponse.json({ error: "Forbidden: Agent is not whitelisted" }, { status: 403 });
        }

        // Phase 3.2: Bidding Enforcement
        const taskToCheck = await prisma.task.findUnique({ where: { id: parsed.task_id }, include: { bid_proposals: true } });
        if (!taskToCheck || taskToCheck.status !== TaskStatus.OPEN) {
          throw new Error("Task is not OPEN or does not exist");
        }

        if (taskToCheck && taskToCheck.bid_proposals.length > 0) {
          return NextResponse.json({ 
            error: "Forbidden: This task is currently under a Bidding Process. Direct claiming is disabled. Please use the /api/mcp/submit_bid tool to submit your proposal." 
          }, { status: 403 });
        }

        let claimingAgent = agent;
        if (!agent.wallet_address) {
          claimingAgent = await prisma.agentProfile.update({
            where: { agent_id: agent.agent_id },
            data: { wallet_address: parsed.developer_wallet },
          });
        } else if (agent.wallet_address !== parsed.developer_wallet) {
          void sendTrafficAlert({
            level: "error",
            action: scopeTrafficAction("CLAIM_TASK_FORBIDDEN", isPublicIp),
            surface: "mcp/claim_task",
            actorType: "AGENT",
            actorId: `agent:${normalizeActorId(parsed.agent_id, "agent")}`,
            taskId: parsed.task_id,
            message: `developer_wallet 與已註冊 Agent wallet 不一致: ${parsed.agent_id}`,
            metadata: {
              ...requestContext,
              payload_summary: summarizeRequestPayload(tool, body),
              response_summary: "claim_forbidden_wallet_mismatch",
              response_status: 403,
            },
          });
          return NextResponse.json({ error: "Forbidden: developer_wallet does not match registered agent wallet" }, { status: 403 });
        }

        // ==========================================
        // PHASE 20: STAKING ENFORCEMENT
        // ==========================================
        if (taskToCheck && taskToCheck.difficulty === "EPIC") {
          if (claimingAgent.tier !== "PREMIUM") {
            return NextResponse.json({
              error: "Forbidden: EPIC difficulty tasks require the PREMIUM tier. Please deposit at least 500 USDC stake using the A2A_STAKE_DEPOSIT method."
            }, { status: 403 });
          }
        }

        const claim = await prisma.$transaction(async (tx) => {
          const updated = await tx.task.updateMany({
            where: { id: parsed.task_id, status: TaskStatus.OPEN },
            data: { status: TaskStatus.EXECUTING, builder_id: claimingAgent.agent_id }
          });
          
          if (updated.count === 0) {
            throw new Error("Task is not OPEN or does not exist");
          }

          const task = await tx.task.findUniqueOrThrow({ where: { id: parsed.task_id } });

          const newClaim = await tx.claim.create({
            data: {
              task_id: task.id,
              agent_id: claimingAgent.agent_id,
              developer_wallet: parsed.developer_wallet,
              status: TaskStatus.EXECUTING,
              claim_token: crypto.randomUUID(),
              held_amount: task.reward_amount,
              held_currency: task.reward_currency,
              expires_at: new Date(Date.now() + 3600000)
            }
          });
          
          await authHold(
            tx, 
            task.id, 
            task.reward_amount, 
            task.reward_currency, 
            parsed.developer_wallet, 
            `${newClaim.id}-auth-hold`
          );

          await logAuditEvent(tx, {
            actorType: "AGENT",
            actorId: parsed.developer_wallet,
            action: "CLAIM_TASK",
            entityType: "TASK",
            entityId: task.id,
            beforeState: { status: TaskStatus.OPEN },
            afterState: { status: TaskStatus.EXECUTING }
          });
          
          return newClaim;
        });

        void triggerWebhook(claim.task_id, "CLAIMED", {
          agent_id: parsed.agent_id,
          developer_wallet: parsed.developer_wallet
        });

        void sendTrafficAlert({
          level: "info",
          action: scopeTrafficAction("CLAIM_TASK_SUCCESS", isPublicIp),
          surface: "mcp/claim_task",
          actorType: "AGENT",
          actorId: `agent:${normalizeActorId(parsed.agent_id, "agent")}`,
          taskId: claim.task_id,
          message: `Agent 成功接案: ${parsed.task_id}`,
          metadata: {
            ...requestContext,
            agent_id: parsed.agent_id,
            reward: claim.held_amount,
            currency: claim.held_currency,
            claim_token_prefix: claim.claim_token.slice(0, 10),
            payload_summary: summarizeRequestPayload(tool, body),
            response_summary: "claim_success",
            response_status: responseStatusMap[tool] || 200,
          },
        });

        if (isPublicIp) {
          void evaluateExternalFunnelHealth({
            surface: "mcp/claim_task",
            periodMinutes: 10,
          });
        }

        // Set Redis TTL key (3600 seconds)
        await redis.set(`vw:task:${claim.task_id}:executing`, claim.claim_token, "EX", 3600);

        return NextResponse.json({
          task_id: claim.task_id,
          status: claim.status,
          held_amount: claim.held_amount,
          held_currency: claim.held_currency,
          expires_at: claim.expires_at.toISOString(),
          claim_token: claim.claim_token,
          request_id: requestContext.request_id,
        });
      }

      case "submit_solution": {
        const parsed = SubmitSolutionRequestSchema.parse(body);

        // 2026 x402 / AP2 Payment Headers Support
        const x402PaymentAuth = request.headers.get("x-ap2-payment-auth");
        if (!x402PaymentAuth) {
          // Send x402 response back asking for payment auth if the platform requires upfront staking.
          // For now, we just simulate the Agent provided it or log its absence.
          console.warn(`[x402/AP2] Missing Agent Payment Auth for submit_solution from ${actor.actorId}`);
        } else {
          console.log(`[x402/AP2] Agent Payment Auth verified: ${x402PaymentAuth.substring(0, 10)}...`);
        }
        
        const result = await prisma.$transaction(async (tx) => {
          const claim = await tx.claim.findUnique({ where: { claim_token: parsed.claim_token } });
          if (!claim || claim.task_id !== parsed.task_id || claim.status !== TaskStatus.EXECUTING) {
            throw new Error("Invalid claim token or claim is not EXECUTING");
          }

          const updatedTask = await tx.task.updateMany({
            where: { id: parsed.task_id, status: TaskStatus.EXECUTING },
            data: { status: TaskStatus.VERIFYING }
          });

          if (updatedTask.count === 0) {
            throw new Error("Task is not EXECUTING");
          }

          await tx.claim.update({
            where: { id: claim.id },
            data: { status: TaskStatus.VERIFYING }
          });

          const newSubmission = await tx.submission.create({
            data: {
              task_id: parsed.task_id,
              claim_id: claim.id,
              status: TaskStatus.VERIFYING,
              deliverables: parsed.deliverables as Prisma.InputJsonValue,
              estimated_judge_complete_at: new Date(Date.now() + 300000)
            }
          });
          
          await logAuditEvent(tx, {
            actorType: "AGENT",
            action: "SUBMIT_SOLUTION",
            entityType: "TASK",
            entityId: parsed.task_id,
            beforeState: { status: TaskStatus.EXECUTING },
            afterState: { status: TaskStatus.VERIFYING }
          });
          
          return {
            submission: newSubmission,
            claim,
          };
        });
        const { submission, claim: submittedClaim } = result;

        void triggerWebhook(submission.task_id, "VERIFYING", {
          submission_id: submission.id,
          deliverable_count: Object.keys(parsed.deliverables ?? {}).length,
        });

        void sendTrafficAlert({
          level: "info",
          action: scopeTrafficAction("SUBMIT_SOLUTION_SUCCESS", isPublicIp),
          surface: "mcp/submit_solution",
          actorType: "AGENT",
          actorId: asAgentActorId(submittedClaim.agent_id),
          taskId: submission.task_id,
          message: `Agent 提交解法: ${parsed.task_id}`,
          metadata: {
            ...requestContext,
            actor_id: submittedClaim.agent_id,
            claim_id: submission.claim_id,
            deliverable_count: Object.keys(parsed.deliverables ?? {}).length,
            submission_id: submission.id,
            payload_summary: summarizeRequestPayload(tool, body),
            response_summary: "submit_success",
            response_status: responseStatusMap[tool] || 200,
          },
        });

        if (isPublicIp) {
          void evaluateExternalFunnelHealth({
            surface: "mcp/submit_solution",
            periodMinutes: 10,
          });
        }

        // Async trigger E2B Sandbox evaluation
        const taskObj = await prisma.task.findUnique({ where: { id: submission.task_id }});
        if (taskObj && typeof taskObj.acceptance_criteria === "object" && taskObj.acceptance_criteria !== null) {
          const criteria = taskObj.acceptance_criteria as { test_file_content?: unknown };
          if (typeof criteria.test_file_content === "string") {
            // Fire and forget
            runSubmissionInSandbox(
              submission.id,
              parsed.deliverables as unknown as Record<string, string>,
              criteria.test_file_content
            ).then(async (result) => {
              await prisma.$transaction(async (tx) => {
                // Update submission
                await tx.submission.update({
                  where: { id: submission.id },
                  data: { status: "JUDGED" }
                });

                // Create JudgeResult
                await tx.judgeResult.create({
                  data: {
                    submission_id: submission.id,
                    overall_result: result.overall_result,
                    tests: result.tests,
                    artifacts: result.artifacts,
                    error_classification: result.error_classification,
                    resource_usage: result.resource_usage
                  }
                });

                // Update Task & Claim Status
                const newTaskStatus = result.overall_result === JudgeOverallResult.PASS 
                  ? TaskStatus.PENDING_REVIEW 
                  : TaskStatus.FAILED_RETRYABLE;
                  
                await tx.task.update({
                  where: { id: submission.task_id },
                  data: { 
                    status: newTaskStatus,
                    github_pr_url: parsed.github_pr_url
                  }
                });

                await tx.claim.update({
                  where: { id: submission.claim_id },
                  data: { status: newTaskStatus }
                });
                
                await logAuditEvent(tx, {
                  actorType: "SYSTEM",
                  action: "JUDGE_COMPLETE",
                  entityType: "TASK",
                  entityId: submission.task_id,
                  beforeState: { status: TaskStatus.VERIFYING },
                  afterState: { status: newTaskStatus },
                  metadata: { overall_result: result.overall_result, error_classification: result.error_classification }
                });
              });

              void triggerWebhook(submission.task_id, result.overall_result === JudgeOverallResult.PASS ? "COMPLETED" : "FAILED", {
                submission_id: submission.id,
                overall_result: result.overall_result,
                error_classification: result.error_classification
              });

              // SPEED_RUN FOMO Broadcaster
              if (result.overall_result === JudgeOverallResult.PASS) {
                const solveTimeMs = new Date().getTime() - new Date(taskObj.created_at).getTime();
                const solveTimeMinutes = Math.floor(solveTimeMs / 60000);
                if (solveTimeMinutes <= 10) {
                  const formatted = taskObj.reward_currency === "USD" 
                    ? `$${(taskObj.reward_amount / 100).toFixed(0)}` 
                    : `NT$${taskObj.reward_amount}`;
                  void broadcastFomoEvent({
                    type: "SPEED_RUN",
                    taskId: taskObj.id,
                    amountFormatted: formatted,
                    timeToSolveMinutes: Math.max(1, solveTimeMinutes)
                  });
                }
              }

            }).catch(console.error);
          }
        }
        
        return NextResponse.json({
          task_id: submission.task_id,
          submission_id: submission.id,
          status: submission.status,
          estimated_judge_complete_at: submission.estimated_judge_complete_at?.toISOString() ?? new Date().toISOString(),
          request_id: requestContext.request_id,
        });
      }

      case "create_sub_task": {
        const parsed = CreateSubTaskRequestSchema.parse(body);
        
        const subTask = await prisma.$transaction(async (tx) => {
          const claim = await tx.claim.findUnique({ where: { claim_token: parsed.claim_token } });
          if (!claim || claim.task_id !== parsed.parent_task_id || claim.status !== TaskStatus.EXECUTING) {
            throw new Error("Invalid claim token or parent task is not EXECUTING");
          }
          if (parsed.reward_amount >= claim.held_amount) {
             throw new Error("Sub-task reward cannot exceed parent task reward");
          }

          // 5% Platform Routing Fee for A2A Subcontracting
          const platformFee = Math.floor(parsed.reward_amount * 0.05);
          const subTaskReward = parsed.reward_amount - platformFee;

          const newTask = await tx.task.create({
            data: {
              title: `[Sub-Task] ${parsed.title}`,
              description: parsed.description,
              status: TaskStatus.OPEN,
              difficulty: "HELLO_WORLD",
              reward_amount: subTaskReward,
              reward_currency: claim.held_currency,
              required_stack: ["A2A", "Agent Sub-Task"],
              scope_clarity_score: 1.0,
              parent_task_id: parsed.parent_task_id,
              created_by_agent: claim.agent_id,
              acceptance_criteria: parsed.acceptance_criteria as Prisma.InputJsonValue,
              is_priority: true, // Sub tasks are high priority to finish the main task faster
            }
          });
          
          await logAuditEvent(tx, {
            actorType: "AGENT",
            actorId: claim.agent_id,
            action: "CREATE_SUB_TASK",
            entityType: "TASK",
            entityId: newTask.id,
            beforeState: null,
            afterState: { status: TaskStatus.OPEN, parent: claim.task_id }
          });

          if (platformFee > 0) {
            await logAuditEvent(tx, {
              actorType: "SYSTEM",
              actorId: "PLATFORM",
              action: "PLATFORM_FEE_COLLECTED",
              entityType: "TASK",
              entityId: newTask.id,
              reason: `A2A Routing Fee Collected: ${platformFee} ${claim.held_currency}`,
              metadata: {
                fee_amount: platformFee,
                currency: claim.held_currency,
                original_reward: parsed.reward_amount
              }
            });
          }

          return newTask;
        });

        void sendTrafficAlert({
          level: "info",
          action: scopeTrafficAction("CREATE_SUB_TASK_SUCCESS", isPublicIp),
          surface: "mcp/create_sub_task",
          actorType: "AGENT",
          actorId: asAgentActorId(subTask.created_by_agent || parsed.parent_task_id),
          taskId: subTask.id,
          message: `A2A 內循環！Agent 發佈了子任務: ${subTask.id}`,
          metadata: {
            parent_task_id: parsed.parent_task_id,
            reward: parsed.reward_amount,
            payload_summary: summarizeRequestPayload(tool, body),
          }
        });

        // A2A Subcontracting FOMO
        const formatted = subTask.reward_currency === "USD"
          ? `$${(subTask.reward_amount / 100).toFixed(0)}`
          : `NT$${subTask.reward_amount}`;
        void broadcastFomoEvent({
          type: "A2A_SUBCONTRACT",
          taskId: subTask.id,
          amountFormatted: formatted
        });

        return NextResponse.json({
          sub_task_id: subTask.id,
          status: subTask.status,
          request_id: requestContext.request_id,
        });
      }

      case "request_peer_review": {
        const parsed = RequestPeerReviewRequestSchema.parse(body);
        
        const reviewTask = await prisma.$transaction(async (tx) => {
          const claim = await tx.claim.findUnique({ where: { claim_token: parsed.claim_token } });
          if (!claim || claim.task_id !== parsed.parent_task_id || claim.status !== TaskStatus.EXECUTING) {
            throw new Error("Invalid claim token or parent task is not EXECUTING");
          }
          
          const reviewCost = 100; // $1.00 USD cost
          if (claim.held_amount <= reviewCost) {
            throw new Error("Insufficient bounty balance to request peer review");
          }

          const newTask = await tx.task.create({
            data: {
              title: `[Peer Review] Code Analysis Requested`,
              description: `Another Agent has requested a peer review. Instructions: ${parsed.review_instructions}\n\nCode Snippet:\n\`\`\`\n${parsed.code_snippet}\n\`\`\``,
              status: TaskStatus.OPEN,
              difficulty: "HELLO_WORLD",
              reward_amount: reviewCost,
              reward_currency: claim.held_currency,
              required_stack: ["A2A", "Code Review"],
              scope_clarity_score: 1.0,
              parent_task_id: parsed.parent_task_id,
              created_by_agent: claim.agent_id,
              acceptance_criteria: {
                validation_mode: "AST_PARSING",
                test_file_content: "// AI Peer Review"
              },
              is_priority: true,
            }
          });
          
          await logAuditEvent(tx, {
            actorType: "AGENT",
            actorId: claim.agent_id,
            action: "REQUEST_PEER_REVIEW",
            entityType: "TASK",
            entityId: newTask.id,
            beforeState: null,
            afterState: { status: TaskStatus.OPEN, parent: claim.task_id }
          });

          return newTask;
        });

        void sendTrafficAlert({
          level: "info",
          action: scopeTrafficAction("PEER_REVIEW_REQUEST", isPublicIp),
          surface: "mcp/request_peer_review",
          actorType: "AGENT",
          actorId: asAgentActorId(reviewTask.created_by_agent || undefined),
          taskId: reviewTask.id,
          message: `A2A 互助！Agent 發佈了 Code Review 任務: ${reviewTask.id}`,
          metadata: {
            parent_task_id: parsed.parent_task_id,
            cost: 100,
            payload_summary: summarizeRequestPayload(tool, body),
          }
        });

        return NextResponse.json({
          review_task_id: reviewTask.id,
          status: reviewTask.status,
          cost: { amount: 100, currency: "USD" },
          message: "Peer review requested successfully. $1.00 will be deducted from your final payout.",
        });
      }

      case "broadcast_help_signal": {
        const parsed = BroadcastHelpSignalRequestSchema.parse(body);
        
        const sosTask = await prisma.$transaction(async (tx) => {
          const claim = await tx.claim.findUnique({ where: { claim_token: parsed.claim_token } });
          if (!claim || claim.task_id !== parsed.parent_task_id || claim.status !== TaskStatus.EXECUTING) {
            throw new Error("Invalid claim token or parent task is not EXECUTING");
          }

          const newTask = await tx.task.create({
            data: {
              title: `[SOS] Help Signal: ${parsed.error_message.slice(0, 50)}...`,
              description: `SOS! Agent stuck in loop. Error: ${parsed.error_message}\n\nContext:\n\`\`\`\n${parsed.contextual_code || 'None'}\n\`\`\``,
              status: TaskStatus.OPEN,
              difficulty: "HELLO_WORLD",
              reward_amount: 500, // $5.00
              reward_currency: claim.held_currency,
              required_stack: ["A2A", "SOS"],
              scope_clarity_score: 1.0,
              parent_task_id: parsed.parent_task_id,
              created_by_agent: claim.agent_id,
              acceptance_criteria: { validation_mode: "AST_PARSING", test_file_content: "// SOS Fix" },
              is_priority: true,
              expires_at: new Date(Date.now() + 15 * 60000) // 15 mins
            }
          });
          
          return newTask;
        });

        void broadcastFomoEvent({
          type: "SPEED_RUN", // Reuse for urgency
          taskId: sosTask.id,
          amountFormatted: sosTask.reward_currency === "USD" ? `$5` : `NT$150`,
          timeToSolveMinutes: 15
        });

        return NextResponse.json({
          sos_task_id: sosTask.id,
          status: sosTask.status,
          message: "SOS signal broadcasted to all connected Agents.",
        });
      }

      case "query_agent_memory": {
        const parsed = QueryAgentMemoryRequestSchema.parse(body);
        
        // Find tasks that match error code or query
        const tasks = await prisma.task.findMany({
          where: {
            status: TaskStatus.COMPLETED,
            OR: [
              { description: { contains: parsed.error_code || parsed.query } },
              { title: { contains: parsed.error_code || parsed.query } }
            ]
          },
          take: 3,
          include: {
            submissions: {
              where: { status: "JUDGED" },
              take: 1,
              orderBy: { created_at: 'desc' }
            }
          }
        });

        const results = tasks.map(t => ({
          task_title: t.title,
          deliverables: t.submissions[0]?.deliverables || {},
          similarity_score: 0.95
        }));

        void sendTrafficAlert({
          level: "info",
          action: scopeTrafficAction("AGENT_MEMORY_QUERY", isPublicIp),
          surface: "mcp/query_agent_memory",
          actorType: actor.actorType,
          actorId: actor.actorId,
          taskId: "none",
          message: `A2A 經驗庫查詢: "${parsed.query}"`,
          metadata: { hits: results.length }
        });

        return NextResponse.json({ results });
      }

      case "negotiate_bounty": {
        const parsed = NegotiateBountyRequestSchema.parse(body);

        const agent = await ensureBuilderAgent(parsed.agent_id, requestContext, isPublicIp);
        if (!agent || agent.status !== "WHITELISTED") {
          return NextResponse.json({ error: "Forbidden: Agent is not whitelisted" }, { status: 403 });
        }
        
        const task = await prisma.task.findUnique({ where: { id: parsed.task_id } });
        if (!task || task.status !== TaskStatus.OPEN) {
          throw new Error("Task not found or not OPEN");
        }

        const currentAmount = task.reward_amount;
        const requestedAmount = parsed.requested_amount;
        const previousAutoApproval = await prisma.auditEvent.findFirst({
          where: {
            action: "NEGOTIATE_BOUNTY",
            entityType: "TASK",
            entityId: task.id,
            metadata: {
              path: ["approved"],
              equals: true,
            },
          },
        });
        
        if (
          AUTO_APPROVE_BOUNTY_NEGOTIATION &&
          task.stripe_payment_intent_id &&
          !previousAutoApproval &&
          requestedAmount > currentAmount &&
          requestedAmount <= Math.floor(currentAmount * 1.1)
        ) {
          await prisma.task.update({
            where: { id: task.id },
            data: { reward_amount: requestedAmount }
          });
          
          await logAuditEvent(prisma, {
            actorType: "AGENT",
            actorId: agent.agent_id,
            action: "NEGOTIATE_BOUNTY",
            entityType: "TASK",
            entityId: task.id,
            reason: parsed.reasoning,
            metadata: {
              original: currentAmount,
              new: requestedAmount,
              approved: true,
              agent_id: agent.agent_id,
            }
          });

          return NextResponse.json({
            task_id: task.id,
            status: "APPROVED",
            new_amount: { amount: requestedAmount, currency: task.reward_currency },
            message: "Negotiation auto-approved! The bounty has been increased."
          });
        }

        // Otherwise pending review
        await logAuditEvent(prisma, {
          actorType: "AGENT",
          actorId: agent.agent_id,
          action: "NEGOTIATE_BOUNTY",
          entityType: "TASK",
          entityId: task.id,
          reason: parsed.reasoning,
          metadata: {
            original: currentAmount,
            requested: requestedAmount,
            approved: false,
            agent_id: agent.agent_id,
            auto_approval_disabled: !AUTO_APPROVE_BOUNTY_NEGOTIATION,
            previous_auto_approval: Boolean(previousAutoApproval),
            has_payment_intent: Boolean(task.stripe_payment_intent_id),
          }
        });

        return NextResponse.json({
          task_id: task.id,
          status: "PENDING_HUMAN_REVIEW",
          message: "Requested amount exceeds auto-approval limits. A human scout will review your request."
        });
      }

      case "rent_api_resource": {
        const parsed = RentApiResourceRequestSchema.parse(body);
        
        // Deduct points from Agent
        const agent = await prisma.agentProfile.findUnique({ where: { agent_id: parsed.agent_id } });
        if (!agent) {
          throw new Error("Agent not found");
        }

        const cost = 5; // 5 points
        
        // For simulation, we don't strictly enforce balance since we just want to show A2A
        
        await logAuditEvent(prisma, {
          actorType: "AGENT",
          actorId: agent.agent_id,
          action: "RENT_API_RESOURCE",
          entityType: "SYSTEM",
          entityId: parsed.resource_type,
          metadata: { cost, duration: parsed.duration_minutes }
        });

        return NextResponse.json({
          status: "GRANTED",
          proxy_url: "https://api.vibework.com/v1/proxy/openai",
          proxy_token: `vw_proxy_${crypto.randomUUID()}`,
          cost_deducted: cost,
          message: `Successfully rented ${parsed.resource_type} for ${parsed.duration_minutes} minutes. 5 points deducted.`
        });
      }

      case "check_payout_status": {
        const parsed = z.object({ task_id: z.string().uuid() }).parse(body);

        const task = await prisma.task.findUnique({ where: { id: parsed.task_id } });
        if (!task) {
          throw new Error("Task not found");
        }

        const ledger = await prisma.ledgerEntry.findFirst({
          where: { task_id: parsed.task_id },
          orderBy: { created_at: 'desc' }
        });

        if (!ledger) {
          void sendTrafficAlert({
            level: "info",
            action: scopeTrafficAction("CHECK_PAYOUT_STATUS_SUCCESS", isPublicIp),
            surface: "mcp/check_payout_status",
            actorType: actor.actorType,
            actorId: actor.actorId,
            taskId: task.id,
            message: `Payout 資料未就緒: ${task.id}`,
          metadata: {
            ...requestContext,
            payload_summary: summarizeRequestPayload(tool, body),
            response_summary: "payout_status_not_ready",
            ledger_phase: "NO_LEDGER",
            response_status: responseStatusMap[tool] || 200,
          },
          });
          return NextResponse.json({
            task_id: task.id,
            phase: task.status === "COMPLETED" ? "PAYOUT_READY" : "NO_LEDGER",
            amount: task.reward_amount,
            currency: task.reward_currency,
            updated_at: task.updated_at.toISOString(),
            request_id: requestContext.request_id,
          });
        }

        void sendTrafficAlert({
          level: "info",
          action: scopeTrafficAction("CHECK_PAYOUT_STATUS_SUCCESS", isPublicIp),
          surface: "mcp/check_payout_status",
          actorType: actor.actorType,
          actorId: actor.actorId,
          taskId: task.id,
          message: `Payout 查詢成功: ${task.id}`,
          metadata: {
            ...requestContext,
            payload_summary: summarizeRequestPayload(tool, body),
            response_summary: `payout_status_${ledger.phase}`,
            ledger_phase: ledger.phase,
            response_status: responseStatusMap[tool] || 200,
          },
        });

        return NextResponse.json({
          task_id: task.id,
          phase: ledger.phase,
          amount: task.reward_amount,
          currency: task.reward_currency,
          updated_at: ledger.updated_at.toISOString(),
          ledger_entry: ledger,
          request_id: requestContext.request_id,
        });
      }

      case "create_bounty": {
        const parsed = CreateBountyRequestSchema.parse(body);
        
        // ensure builder agent exists or gets whitelisted
        const agent = await ensureBuilderAgent(parsed.agent_id, requestContext, isPublicIp);
        if (!agent) {
          return NextResponse.json({ error: "Forbidden: Agent is not whitelisted" }, { status: 403 });
        }

        const newTask = await prisma.$transaction(async (tx) => {
          const task = await tx.task.create({
            data: {
              title: parsed.title,
              description: parsed.description,
              status: TaskStatus.OPEN,
              difficulty: "COMPONENT",
              reward_amount: parsed.reward_amount,
              reward_currency: parsed.reward_currency,
              required_stack: parsed.required_stack,
              scope_clarity_score: 1.0,
              created_by_agent: agent.agent_id,
              acceptance_criteria: {
                validation_mode: "VITEST_UNIT",
                test_file_content: parsed.test_file_content,
              },
            }
          });
          
          await logAuditEvent(tx, {
            actorType: "AGENT",
            actorId: agent.agent_id,
            action: "CREATE_BOUNTY",
            entityType: "TASK",
            entityId: task.id,
            beforeState: null,
            afterState: { status: TaskStatus.OPEN }
          });
          
          return task;
        });

        void sendTrafficAlert({
          level: "info",
          action: scopeTrafficAction("CREATE_BOUNTY_SUCCESS", isPublicIp),
          surface: "mcp/create_bounty",
          actorType: "AGENT",
          actorId: agent.agent_id,
          taskId: newTask.id,
          message: `A2A 雇主發包！Agent 創建了懸賞: ${newTask.id}`,
          metadata: {
            reward: parsed.reward_amount,
            payload_summary: summarizeRequestPayload(tool, body),
          }
        });

        // broadcast fomo
        const formatted = newTask.reward_currency === "USD"
          ? `$${(newTask.reward_amount / 100).toFixed(0)}`
          : `NT$${newTask.reward_amount}`;
        void broadcastFomoEvent({
          type: "NEW_BOUNTY_CREATED",
          taskId: newTask.id,
          amountFormatted: formatted,
          title: newTask.title
        });

        return NextResponse.json({
          task_id: newTask.id,
          status: newTask.status,
          message: "Bounty created successfully and broadcasted to A2A network.",
        });
      }

      default:
        void sendTrafficAlert({
          level: "warning",
          action: scopeTrafficAction("MCP_TOOL_UNKNOWN", isPublicIp),
          surface: `mcp/${tool}`,
          actorType: actor.actorType,
          actorId: actor.actorId,
          taskId: "open-tasks",
          message: `未知 MCP tool: ${tool}`,
          metadata: {
            ...requestContext,
            payload_summary: summarizeRequestPayload(tool, body),
            response_summary: "mcp_tool_unknown",
            response_status: 404,
          },
        });
        return NextResponse.json({ error: `Unknown tool: ${tool}` }, { status: 404 });
    }
  } catch (error: unknown) {
    console.error(`[API Gateway] Error handling ${tool}:`, error);
    const payloadSummary = summarizeRequestPayload(tool, body);
    const actorInCatch = resolveActorFromMcpRequest(request);
    const catchContext = resolveRequestTrace(request);
    const errorName = error instanceof Error ? error.name : "Error";
    const errorMessage = error instanceof Error ? error.message : String(error);
    const isStateConflict =
      typeof error === "object" &&
      error !== null &&
      "message" in error &&
      typeof (error as { message?: string }).message === "string" &&
      ["not OPEN", "not EXECUTING", "Invalid claim token", "not found", "Task is not OPEN or does not exist", "Task is not EXECUTING"].some(
        (token) => (error as { message?: string }).message?.includes(token)
      );
    const responseStatus = error instanceof SyntaxError || errorName === "ZodError" ? 400 : isStateConflict ? 409 : 500;

    void sendTrafficAlert({
      level: "error",
      action: scopeTrafficAction(`${tool.toUpperCase()}_ERROR`, isPublicIp),
      surface: `mcp/${tool}`,
      actorType: "AGENT",
      actorId: actorInCatch.actorId,
      taskId:
        typeof body === "object" && body !== null && "task_id" in body
          ? String((body as { task_id?: string }).task_id ?? "unknown")
          : "unknown",
      message: errorMessage,
      metadata: {
        ...catchContext,
        payload_summary: payloadSummary,
        response_summary: `${tool}_error`,
        error_name: errorName,
        error_message: errorMessage,
        response_status: responseStatus,
      },
    });
    
    if (errorName === "ZodError") {
      const issues = typeof error === "object" && error !== null && "issues" in error
        ? (error as { issues?: unknown }).issues
        : undefined;
      return NextResponse.json({ error_type: "InvalidParams", message: issues ?? "Invalid request parameters" }, { status: 400 });
    }
    
    if (errorMessage.includes("not OPEN") || errorMessage.includes("not EXECUTING") || errorMessage.includes("Invalid claim token") || errorMessage.includes("not found")) {
      return NextResponse.json({ error_type: "StateConflict", message: errorMessage }, { status: responseStatus });
    }

    return NextResponse.json({ error_type: "InternalError", message: "Internal Server Error" }, { status: responseStatus });
  }
}
