"""Host-private Dify service invocation, emits no credentials."""
import json,os,pathlib,subprocess,sys
BASE=pathlib.Path(__file__).resolve().parent
os.umask(0o077)
action=sys.argv[1]
payload={'action':action}
resources=BASE/'resources.private.json'
if action=='create':
    payload['asr_key']=(BASE/'asr-key').read_text().strip()
    assert not resources.exists(), 'RESOURCE_FILE_ALREADY_EXISTS'
else:payload['resources']=json.loads(resources.read_text())
code='PAYLOAD='+repr(payload)+'\n'+(BASE/'dify_operator.py').read_text()
p=subprocess.run(['docker','exec','-i','dify_v1110_eera-api-1','python','-'],input=code,text=True,capture_output=True)
# Never print raw stdout/stderr: credentials may exist in structured output/errors.
lines=[s for s in p.stdout.splitlines() if s.startswith('OPERATOR_RESULT=')]
if p.returncode or len(lines)!=1:
    # Private diagnostic file; callers must not copy it into public artifacts.
    (BASE/'operator-error.private.log').write_text(p.stdout+'\n'+p.stderr)
    print(json.dumps({'action':action,'exit_status':p.returncode,'result':'FAILED','diagnostic_private':True}))
    sys.exit(p.returncode or 1)
data=json.loads(lines[0].split('=',1)[1])
if action=='create':
    value={**data['public'],**data['private']}
    resources.write_text(json.dumps(value,ensure_ascii=False,indent=2)+'\n');resources.chmod(0o600)
    env='DIFY_ASR_APP_KEY='+value['api_key']+'\nDIFY_ASR_APP_ID='+value['app_id']+'\nDIFY_ASR_BASE_URL='+value['base_url']+'\nDIFY_ASR_EXPECTED_MODEL=Qwen/Qwen3-ASR-1.7B\nDIFY_EXTRACTION_EXPECTED_MODEL=qwen3.6-35b\nDIFY_BINDING_REVISION=followup-dify-20261009-v1-'+value['config_sha256'][:16]+'\n'
    (BASE/'dify-runtime.env').write_text(env);(BASE/'dify-runtime.env').chmod(0o600)
print(json.dumps({'action':action,'exit_status':p.returncode,'result':'PASS',**data['public']},ensure_ascii=False))