"""外部系统目录、用户可见授权和密文连接的持久化服务层。"""

from __future__ import annotations

from collections.abc import Sequence
from datetime import datetime, timezone
from typing import Any, Optional
from urllib.parse import urlparse
from uuid import UUID

from sqlalchemy import delete, exists, or_, select
from sqlalchemy.exc import IntegrityError

from core.storage import session_scope
from core.storage.models import (
    ExternalSystem,
    ExternalSystemAudit,
    ExternalSystemDefinition,
    ExternalSystemGrant,
    User,
)

from .crypto import configured as crypto_configured
from .crypto import decrypt_secret, encrypt_secret, mask_username
from .openapi import OpenApiClient, OpenApiConfig, OpenApiError
from .registry import credential_fields, get_provider, merged_config, provider_specs


class ExternalSystemError(RuntimeError):
    pass


_REVERIFY_KEYS = frozenset(
    {
        "base_url",
        "openapi_url",
        "login_path",
        "auth_type",
        "username_field",
        "password_field",
        "token_field",
        "auth_header_name",
        "auth_header_template",
        "verify_tls",
    }
)


def _runtime_config(provider: str, data: dict[str, Any]) -> OpenApiConfig:
    try:
        return OpenApiConfig.from_mapping(merged_config(provider, data))
    except (OpenApiError, TypeError, ValueError) as exc:
        raise ExternalSystemError(str(exc)) from exc


def _normalized_config(provider: str, data: dict[str, Any]) -> dict[str, Any]:
    cfg = _runtime_config(provider, data)
    return {
        "base_url": cfg.base_url,
        "openapi_url": cfg.openapi_url,
        "login_path": cfg.login_path,
        "operation_mode": cfg.operation_mode,
        "operation_policies": dict(sorted(cfg.operation_policies.items())),
        "timeout_seconds": cfg.timeout_seconds,
        "max_result_bytes": cfg.max_result_bytes,
        "max_total_result_bytes": cfg.max_total_result_bytes,
        "max_page_size": cfg.max_page_size,
        "verify_tls": cfg.verify_tls,
        "query_guidance": cfg.query_guidance,
        "recommended_operation_ids": list(cfg.recommended_operation_ids),
        "auth_type": cfg.auth_type,
        **cfg.auth_config,
    }


def _classify_definition_config_change(
    provider: str,
    old_data: dict[str, Any],
    new_data: dict[str, Any],
) -> tuple[dict[str, Any], dict[str, Any], frozenset[str], str]:
    """按运行语义比较配置，避免旧 JSON 缺省字段被误判成认证变化。"""
    old_config = _normalized_config(provider, old_data)
    new_config = _normalized_config(provider, new_data)
    changed = frozenset(
        key
        for key in old_config.keys() | new_config.keys()
        if old_config.get(key) != new_config.get(key)
    )
    if not changed:
        impact = "none"
    elif changed & _REVERIFY_KEYS:
        impact = "reverify"
    else:
        impact = "runtime"
    return old_config, new_config, changed, impact


def _definition_view(
    row: ExternalSystemDefinition, *, include_config: bool
) -> dict[str, Any]:
    config = row.config or {}
    result = {
        "definition_id": str(row.definition_id),
        "provider": row.provider,
        "provider_title": get_provider(row.provider).title,
        "connector": get_provider(row.provider).connector,
        "name": row.name,
        "enabled": row.enabled,
        "revision": row.revision,
        "owner_type": row.owner_type,
        "owner_user_id": str(row.owner_user_id) if row.owner_user_id else None,
        "visibility": row.visibility,
        "trust_level": row.trust_level,
        "review_status": row.review_status,
        "egress_policy_id": row.egress_policy_id,
        "host": urlparse(str(config.get("base_url") or "")).hostname or "",
        "created_at": row.created_at.isoformat() if row.created_at else None,
        "updated_at": row.updated_at.isoformat() if row.updated_at else None,
        "credential_fields": credential_fields(row.provider, config),
    }
    if include_config:
        result["config"] = config
    return result


def _validate_visibility(visibility: str) -> str:
    mode = (visibility or "selected").strip().lower()
    if mode not in {"organization", "selected", "private"}:
        raise ExternalSystemError("visibility 必须是 organization、selected 或 private")
    return mode


def _mark_connections_for_reverify(connections: Sequence[ExternalSystem]) -> None:
    """保留密文凭据，但在用户主动测试前阻止 agent 使用变更后的目标。"""
    for connection in connections:
        connection.last_verified_at = None
        connection.last_error = "系统定义已更新，请重新验证连接"
        connection.status = (
            "needs_reverify" if connection.credentials else "needs_credentials"
        )


def _advance_active_connections(
    connections: Sequence[ExternalSystem], *, revision: int
) -> None:
    """仅运行策略变化不影响连接有效性，active 连接原子跟随新 revision。"""
    for connection in connections:
        if connection.status != "active":
            continue
        if connection.credentials:
            connection.verified_revision = revision
        else:
            connection.status = "needs_credentials"
            connection.last_verified_at = None
            connection.last_error = "连接凭据缺失，请重新填写凭据"


def _selected_user_ids(s: Any, definition_id: UUID) -> list[str]:
    return [
        str(uid)
        for uid in s.execute(
            select(ExternalSystemGrant.user_id)
            .where(ExternalSystemGrant.definition_id == definition_id)
            .order_by(ExternalSystemGrant.user_id)
        )
        .scalars()
        .all()
    ]


def _sync_selected_users(
    s: Any,
    definition: ExternalSystemDefinition,
    selected_user_ids: list[UUID],
    *,
    granted_by: UUID | None,
) -> None:
    wanted = set(selected_user_ids)
    if wanted:
        existing_users = set(
            s.execute(select(User.user_id).where(User.user_id.in_(wanted)))
            .scalars()
            .all()
        )
        missing = wanted - existing_users
        if missing:
            raise ExternalSystemError(
                "包含不存在的用户: " + ", ".join(sorted(map(str, missing)))
            )
    current_rows = (
        s.execute(
            select(ExternalSystemGrant).where(
                ExternalSystemGrant.definition_id == definition.definition_id
            )
        )
        .scalars()
        .all()
    )
    current = {row.user_id: row for row in current_rows}
    for uid, row in current.items():
        if uid not in wanted:
            s.delete(row)
            connection = s.execute(
                select(ExternalSystem).where(
                    ExternalSystem.definition_id == definition.definition_id,
                    ExternalSystem.user_id == uid,
                )
            ).scalar_one_or_none()
            if connection is not None:
                s.delete(connection)  # 撤权同时删除该用户的密文凭据
    connections = (
        s.execute(
            select(ExternalSystem).where(
                ExternalSystem.definition_id == definition.definition_id
            )
        )
        .scalars()
        .all()
    )
    for connection in connections:
        if connection.user_id not in wanted:
            s.delete(connection)
    for uid in wanted - set(current):
        s.add(
            ExternalSystemGrant(
                user_id=uid,
                definition_id=definition.definition_id,
                granted_by=granted_by,
            )
        )


def provider_catalog(user_id: UUID) -> list[dict[str, Any]]:
    try:
        with session_scope() as s:
            rows = (
                s.execute(
                    select(ExternalSystemDefinition)
                    .where(
                        ExternalSystemDefinition.enabled.is_(True),
                        or_(
                            ExternalSystemDefinition.visibility == "organization",
                            ExternalSystemDefinition.owner_user_id == user_id,
                            exists(
                                select(ExternalSystemGrant.user_id).where(
                                    ExternalSystemGrant.definition_id
                                    == ExternalSystemDefinition.definition_id,
                                    ExternalSystemGrant.user_id == user_id,
                                )
                            ),
                        ),
                        ExternalSystemDefinition.review_status == "active",
                    )
                    .order_by(ExternalSystemDefinition.name)
                )
                .scalars()
                .all()
            )
            definitions_by_provider: dict[str, list[dict[str, Any]]] = {}
            for row in rows:
                definitions_by_provider.setdefault(row.provider, []).append(
                    _definition_view(row, include_config=False)
                )
    except Exception:
        definitions_by_provider = {}
    key_ok = crypto_configured()
    return [
        {
            "provider": spec.provider,
            "title": spec.title,
            "connector": spec.connector,
            "default_auth_type": spec.default_auth_type,
            "allowed_auth_types": list(spec.allowed_auth_types),
            "configured": bool(definitions_by_provider.get(spec.provider) and key_ok),
            "reason": ""
            if key_ok
            else "ZCBOT_CREDENTIAL_MASTER_KEY 未配置或少于 32 字符",
            "definitions": definitions_by_provider.get(spec.provider, []),
        }
        for spec in provider_specs()
    ]


def list_external_system_definitions() -> list[dict[str, Any]]:
    with session_scope() as s:
        rows = (
            s.execute(
                select(ExternalSystemDefinition).order_by(ExternalSystemDefinition.name)
            )
            .scalars()
            .all()
        )
        results = []
        for row in rows:
            item = _definition_view(row, include_config=True)
            item["selected_user_ids"] = _selected_user_ids(s, row.definition_id)
            results.append(item)
        return results


def create_external_system_definition(
    admin_user_id: UUID,
    *,
    provider: str,
    name: str,
    config: dict[str, Any],
    enabled: bool = True,
    visibility: str = "selected",
    selected_user_ids: Optional[list[UUID]] = None,
) -> dict[str, Any]:
    provider = (provider or "").strip()
    name = (name or "").strip()
    try:
        get_provider(provider)
    except ValueError as exc:
        raise ExternalSystemError(str(exc)) from exc
    if not name or len(name) > 80:
        raise ExternalSystemError("系统名称不能为空且不能超过 80 字符")
    row = ExternalSystemDefinition(
        provider=provider,
        name=name,
        config=_normalized_config(provider, config),
        enabled=bool(enabled),
        visibility=_validate_visibility(visibility),
        owner_type="platform",
        trust_level="managed",
        review_status="active",
        created_by=admin_user_id,
    )
    try:
        with session_scope() as s:
            s.add(row)
            s.flush()
            if row.visibility == "selected":
                _sync_selected_users(
                    s, row, selected_user_ids or [], granted_by=admin_user_id
                )
                s.flush()
            result = _definition_view(row, include_config=True)
            result["selected_user_ids"] = _selected_user_ids(s, row.definition_id)
            return result
    except IntegrityError as exc:
        raise ExternalSystemError("同名外部系统定义已存在") from exc


def update_external_system_definition(
    definition_id: UUID,
    *,
    name: str,
    config: dict[str, Any],
    enabled: bool,
    visibility: str,
    selected_user_ids: Optional[list[UUID]] = None,
) -> dict[str, Any]:
    name = (name or "").strip()
    if not name or len(name) > 80:
        raise ExternalSystemError("系统名称不能为空且不能超过 80 字符")
    try:
        with session_scope() as s:
            row = s.execute(
                select(ExternalSystemDefinition).where(
                    ExternalSystemDefinition.definition_id == definition_id
                )
            ).scalar_one_or_none()
            if row is None:
                raise ExternalSystemError("external system definition not found")
            _, new_config, _, impact = (
                _classify_definition_config_change(
                    row.provider,
                    row.config or {},
                    config,
                )
            )
            config_changed = impact != "none"
            connections = (
                s.execute(
                    select(ExternalSystem).where(
                        ExternalSystem.definition_id == definition_id
                    )
                )
                .scalars()
                .all()
                if config_changed
                else []
            )
            row.name = name
            row.config = new_config
            row.enabled = bool(enabled)
            row.visibility = _validate_visibility(visibility)
            if config_changed:
                row.revision += 1
                if impact == "runtime":
                    _advance_active_connections(connections, revision=row.revision)
                else:
                    _mark_connections_for_reverify(connections)
            if row.visibility == "selected":
                _sync_selected_users(
                    s, row, selected_user_ids or [], granted_by=row.created_by
                )
            else:
                grants = (
                    s.execute(
                        select(ExternalSystemGrant).where(
                            ExternalSystemGrant.definition_id == definition_id
                        )
                    )
                    .scalars()
                    .all()
                )
                for grant in grants:
                    s.delete(grant)
            s.flush()
            result = _definition_view(row, include_config=True)
            result["selected_user_ids"] = _selected_user_ids(s, row.definition_id)
            return result
    except IntegrityError as exc:
        raise ExternalSystemError("同名外部系统定义已存在") from exc


def delete_external_system_definition(definition_id: UUID) -> bool:
    try:
        with session_scope() as s:
            result = s.execute(
                delete(ExternalSystemDefinition).where(
                    ExternalSystemDefinition.definition_id == definition_id
                )
            )
            return bool(getattr(result, "rowcount", 0))
    except IntegrityError as exc:
        raise ExternalSystemError("该系统已有用户连接，请先停用而不是删除") from exc


def get_definition(
    definition_id: UUID, *, enabled_only: bool = False
) -> ExternalSystemDefinition:
    with session_scope() as s:
        stmt = select(ExternalSystemDefinition).where(
            ExternalSystemDefinition.definition_id == definition_id
        )
        if enabled_only:
            stmt = stmt.where(ExternalSystemDefinition.enabled.is_(True))
        row = s.execute(stmt).scalar_one_or_none()
        if row is None:
            raise ExternalSystemError("external system definition not found")
        s.expunge(row)
        return row


def get_definition_for_user(
    user_id: UUID, definition_id: UUID
) -> ExternalSystemDefinition:
    with session_scope() as s:
        row = s.execute(
            select(ExternalSystemDefinition).where(
                ExternalSystemDefinition.definition_id == definition_id,
                ExternalSystemDefinition.enabled.is_(True),
                ExternalSystemDefinition.review_status == "active",
                or_(
                    ExternalSystemDefinition.visibility == "organization",
                    ExternalSystemDefinition.owner_user_id == user_id,
                    exists(
                        select(ExternalSystemGrant.user_id).where(
                            ExternalSystemGrant.definition_id == definition_id,
                            ExternalSystemGrant.user_id == user_id,
                        )
                    ),
                ),
            )
        ).scalar_one_or_none()
        if row is None:
            raise ExternalSystemError("external system definition not found")
        s.expunge(row)
        return row


def _client(
    provider: str,
    credentials: dict[str, str],
    config: dict[str, Any],
    *,
    cache_namespace: str = "",
) -> OpenApiClient:
    spec = get_provider(provider)
    if spec.connector != "openapi":
        raise ExternalSystemError(
            f"unsupported external system connector: {spec.connector}"
        )
    return OpenApiClient(
        credentials,
        _runtime_config(provider, config),
        cache_namespace=cache_namespace,
    )


def _credential_values(
    provider: str, config: dict[str, Any], credentials: dict[str, str]
) -> dict[str, str]:
    fields = credential_fields(provider, config)
    normalized = {
        field["name"]: str(credentials.get(field["name"]) or "").strip()
        for field in fields
    }
    missing = [field["label"] for field in fields if not normalized[field["name"]]]
    if missing:
        raise ExternalSystemError("请填写" + "、".join(missing))
    return normalized


def _credentials(
    provider: str,
    config: dict[str, Any],
    credentials: dict[str, str],
    *,
    user_id: UUID,
    definition_id: UUID,
) -> dict[str, str]:
    normalized = _credential_values(provider, config, credentials)
    try:
        return {
            name: encrypt_secret(
                value,
                aad=f"{user_id}:{definition_id}:{name}",
            )
            for name, value in normalized.items()
        }
    except (RuntimeError, ValueError) as exc:
        raise ExternalSystemError(str(exc)) from exc


def credentials_for(row: ExternalSystem) -> dict[str, str]:
    try:
        return {
            name: decrypt_secret(
                value,
                aad=f"{row.user_id}:{row.definition_id}:{name}",
            )
            for name, value in row.credentials.items()
        }
    except (AttributeError, RuntimeError) as exc:
        raise ExternalSystemError(str(exc)) from exc


def client_for_external_system(row: ExternalSystem) -> OpenApiClient:
    definition = get_definition_for_user(row.user_id, row.definition_id)
    if row.status != "active" or row.verified_revision != definition.revision:
        raise ExternalSystemError("外部系统连接需要重新验证")
    return _client(
        definition.provider,
        credentials_for(row),
        definition.config or {},
        cache_namespace=(
            f"connection:{row.external_system_id}:revision:{row.verified_revision}"
        ),
    )


def _view(row: ExternalSystem, definition: ExternalSystemDefinition) -> dict[str, Any]:
    try:
        credential_ok = bool(row.credentials)
    except (AttributeError, TypeError):
        credential_ok = False
    runtime_config = _runtime_config(definition.provider, definition.config or {})
    return {
        "external_system_id": str(row.external_system_id),
        "definition_id": str(row.definition_id),
        "system_name": definition.name,
        "provider": definition.provider,
        "connector": get_provider(definition.provider).connector,
        "name": row.name,
        "status": row.status if definition.enabled else "disabled",
        "username_masked": row.credential_hint or "***",
        "credential_configured": credential_ok,
        "credential_fields": credential_fields(
            definition.provider, definition.config or {}
        ),
        "query_guidance": runtime_config.query_guidance,
        "recommended_operation_ids": list(runtime_config.recommended_operation_ids),
        "operation_mode": runtime_config.operation_mode,
        "last_verified_at": row.last_verified_at.isoformat()
        if row.last_verified_at
        else None,
        "definition_revision": definition.revision,
        "verified_revision": row.verified_revision,
        "last_error": row.last_error or "",
        "created_at": row.created_at.isoformat() if row.created_at else None,
        "updated_at": row.updated_at.isoformat() if row.updated_at else None,
    }


def list_external_systems(user_id: UUID) -> list[dict[str, Any]]:
    with session_scope() as s:
        rows = s.execute(
            select(ExternalSystem, ExternalSystemDefinition)
            .join(
                ExternalSystemDefinition,
                ExternalSystemDefinition.definition_id == ExternalSystem.definition_id,
            )
            .where(ExternalSystem.user_id == user_id)
            .order_by(ExternalSystem.created_at)
        ).all()
        return [_view(row, definition) for row, definition in rows]


def get_external_system(
    user_id: UUID, system_id: UUID, *, active_only: bool = False
) -> ExternalSystem:
    with session_scope() as s:
        stmt = select(ExternalSystem).where(
            ExternalSystem.external_system_id == system_id,
            ExternalSystem.user_id == user_id,
        )
        if active_only:
            stmt = stmt.where(ExternalSystem.status == "active")
        row = s.execute(stmt).scalar_one_or_none()
        if row is None:
            raise ExternalSystemError("external system not found")
        s.expunge(row)
        return row


def create_external_system(
    user_id: UUID,
    *,
    definition_id: UUID,
    name: str,
    credentials: dict[str, str],
) -> dict[str, Any]:
    if not crypto_configured():
        raise ExternalSystemError("ZCBOT_CREDENTIAL_MASTER_KEY 未配置或少于 32 字符")
    definition = get_definition_for_user(user_id, definition_id)
    name = (name or definition.name).strip()
    if not name or len(name) > 80:
        raise ExternalSystemError("连接名称不能为空且不能超过 80 字符")
    plain = _credential_values(
        definition.provider,
        definition.config or {},
        credentials,
    )
    try:
        _client(
            definition.provider,
            plain,
            definition.config,
            cache_namespace=(
                f"probe:{definition.definition_id}:revision:{definition.revision}:"
                f"user:{user_id}"
            ),
        ).test_connection()
    except OpenApiError as exc:
        raise ExternalSystemError(str(exc)) from exc
    try:
        with session_scope() as s:
            row = s.execute(
                select(ExternalSystem).where(
                    ExternalSystem.user_id == user_id,
                    ExternalSystem.definition_id == definition.definition_id,
                )
            ).scalar_one_or_none()
            if row is not None:
                raise ExternalSystemError("该外部系统已连接，请使用更新凭据")
            row = ExternalSystem(
                user_id=user_id,
                definition_id=definition.definition_id,
            )
            s.add(row)
            row.name = name
            row.credentials = _credentials(
                definition.provider,
                definition.config or {},
                plain,
                user_id=user_id,
                definition_id=definition.definition_id,
            )
            row.credential_hint = (
                mask_username(plain["username"]) if plain.get("username") else "***"
            )
            row.status = "active"
            row.verified_revision = definition.revision
            row.last_error = None
            row.last_verified_at = datetime.now(timezone.utc)
            s.flush()
            return _view(row, definition)
    except IntegrityError as exc:
        raise ExternalSystemError("同名外部系统连接已存在") from exc


def update_external_system_credentials(
    user_id: UUID,
    system_id: UUID,
    *,
    credentials: dict[str, str],
) -> dict[str, Any]:
    row = get_external_system(user_id, system_id)
    definition = get_definition(row.definition_id, enabled_only=True)
    plain = _credential_values(
        definition.provider,
        definition.config or {},
        credentials,
    )
    try:
        _client(
            definition.provider,
            plain,
            definition.config,
            cache_namespace=(
                f"probe:{system_id}:revision:{definition.revision}:user:{user_id}"
            ),
        ).test_connection()
    except OpenApiError as exc:
        raise ExternalSystemError(str(exc)) from exc
    with session_scope() as s:
        current = s.execute(
            select(ExternalSystem).where(
                ExternalSystem.external_system_id == system_id,
                ExternalSystem.user_id == user_id,
            )
        ).scalar_one()
        current.credentials = _credentials(
            definition.provider,
            definition.config or {},
            plain,
            user_id=user_id,
            definition_id=definition.definition_id,
        )
        current.credential_hint = (
            mask_username(plain["username"]) if plain.get("username") else "***"
        )
        current.status = "active"
        current.verified_revision = definition.revision
        current.last_error = None
        current.last_verified_at = datetime.now(timezone.utc)
        s.flush()
        return _view(current, definition)


def test_external_system(user_id: UUID, system_id: UUID) -> dict[str, Any]:
    row = get_external_system(user_id, system_id)
    ok, error, probe = False, "", {}
    try:
        definition = get_definition_for_user(user_id, row.definition_id)
        probe = _client(
            definition.provider,
            credentials_for(row),
            definition.config or {},
            cache_namespace=(
                f"connection:{row.external_system_id}:revision:{definition.revision}"
            ),
        ).test_connection()
        ok = True
    except (ExternalSystemError, OpenApiError) as exc:
        error = str(exc)
    with session_scope() as s:
        current = s.execute(
            select(ExternalSystem).where(
                ExternalSystem.external_system_id == system_id,
                ExternalSystem.user_id == user_id,
            )
        ).scalar_one()
        current.status = "active" if ok else "invalid"
        current.last_error = None if ok else error[:2000]
        if ok:
            current.last_verified_at = datetime.now(timezone.utc)
            current_definition = s.execute(
                select(ExternalSystemDefinition).where(
                    ExternalSystemDefinition.definition_id == current.definition_id
                )
            ).scalar_one()
            current.verified_revision = current_definition.revision
    return {"ok": ok, "error": error if not ok else "", **probe}


def delete_external_system(user_id: UUID, system_id: UUID) -> bool:
    with session_scope() as s:
        row = s.execute(
            select(ExternalSystem).where(
                ExternalSystem.external_system_id == system_id,
                ExternalSystem.user_id == user_id,
            )
        ).scalar_one_or_none()
        if row is None:
            return False
        s.delete(row)  # grants 独立存在，断开连接不撤销可见授权。
        return True


def external_system_tools_available(user_id: UUID) -> bool:
    if not crypto_configured():
        return False
    try:
        with session_scope() as s:
            return (
                s.execute(
                    select(ExternalSystem.external_system_id)
                    .join(
                        ExternalSystemDefinition,
                        ExternalSystemDefinition.definition_id
                        == ExternalSystem.definition_id,
                    )
                    .where(
                        ExternalSystem.user_id == user_id,
                        ExternalSystem.status == "active",
                        ExternalSystemDefinition.enabled.is_(True),
                        ExternalSystemDefinition.review_status == "active",
                        ExternalSystem.verified_revision
                        == ExternalSystemDefinition.revision,
                    )
                    .limit(1)
                ).scalar_one_or_none()
                is not None
            )
    except Exception:
        return False


def external_system_status_available(user_id: UUID) -> bool:
    """只读状态工具不需要解密凭据；有连接即向 agent 暴露状态。"""
    try:
        with session_scope() as s:
            return (
                s.execute(
                    select(ExternalSystem.external_system_id)
                    .where(ExternalSystem.user_id == user_id)
                    .limit(1)
                ).scalar_one_or_none()
                is not None
            )
    except Exception:
        return False


def record_external_system_audit(
    *,
    user_id: UUID,
    task_id: UUID | None,
    external_system_id: UUID | None,
    definition_id: UUID | None,
    definition_revision: int,
    event: str,
    operation_id: str | None,
    outcome: str,
    duration_ms: int,
    status_code: int | None = None,
    response_bytes: int | None = None,
    detail: dict[str, Any] | None = None,
) -> None:
    """写入无敏感载荷的调用审计；调用方决定失败时是否降级。"""
    with session_scope() as s:
        s.add(
            ExternalSystemAudit(
                user_id=user_id,
                task_id=task_id,
                external_system_id=external_system_id,
                definition_id=definition_id,
                definition_revision=max(0, int(definition_revision)),
                event=event,
                operation_id=operation_id,
                outcome=outcome,
                status_code=status_code,
                duration_ms=max(0, int(duration_ms)),
                response_bytes=response_bytes,
                detail=detail or {},
            )
        )