import test from 'node:test';
import assert from 'node:assert/strict';
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import crypto from 'node:crypto';
import {fileURLToPath, pathToFileURL} from 'node:url';

const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
const releaseDir=path.join(root,'docs/workshop-skill-release-20261109-r7');
const packageSource=fs.realpathSync(process.env.KSF_REPORT_PACKAGE_DIR||path.join(releaseDir,'package'));
const {planUpdate,publicPlan,applyUpdate,verifyUpdate,rollbackUpdate}=await import(pathToFileURL(path.join(packageSource,'update-skill.mjs')));
const hash=b=>crypto.createHash('sha256').update(b).digest('hex');
const digest=p=>hash(fs.readFileSync(p));
function fileMap(dir){
 const out={};for(const e of fs.readdirSync(dir,{withFileTypes:true})){
  const p=path.join(dir,e.name);
  if(e.isDirectory())for(const[n,h]of Object.entries(fileMap(p)))out[e.name+'/'+n]=h;
  else out[e.name]=digest(p);
 }return out;
}
function fixture(t){
 const temp=fs.mkdtempSync(path.join(os.tmpdir(),'ksf-report-update-test-'));
 t.after(()=>{
  const resolved=fs.realpathSync(temp);
  assert.ok(resolved.startsWith(fs.realpathSync(os.tmpdir())+path.sep)&&path.basename(resolved).startsWith('ksf-report-update-test-'));
  fs.rmSync(resolved,{recursive:true});
 });
 const dataRoot=path.join(temp,'data'),targetDir=path.join(dataRoot,'skills/ksf-workshop-runtime');
 const libraryDir=path.join(dataRoot,'skills/ksf-voc-library'),packageDir=path.join(temp,'package');
 fs.mkdirSync(path.dirname(targetDir),{recursive:true});
 fs.cpSync(path.join(releaseDir,'rehearsal-baseline-r6'),targetDir,{recursive:true});
 fs.cpSync(packageSource,packageDir,{recursive:true});
 const release=JSON.parse(fs.readFileSync(path.join(packageDir,'release.json')));
 const declared=[];
 for(const n of release.researchEntryNames){
  const source=path.join(root,'skills/ksf-voc-library',n),dest=path.join(libraryDir,n);
  fs.mkdirSync(path.dirname(dest),{recursive:true});fs.copyFileSync(source,dest);
  declared.push(digest(dest)+'  '+n+'\n');
 }
 fs.writeFileSync(path.join(libraryDir,'FILES.sha256'),declared.join(''));
 fs.writeFileSync(path.join(targetDir,'credential-binding.json'),'{"fixtureOnly":true}',{mode:0o600});
 fs.writeFileSync(path.join(targetDir,'fixture-private-state.json'),'{"syntheticOnly":true}',{mode:0o600});
 return{temp,dataRoot,targetDir,libraryDir,packageDir,release,before:fileMap(dataRoot)};
}
function restored(f){
 const after=fileMap(f.dataRoot);
 for(const[n,h]of Object.entries(f.before))assert.equal(after[n],h,n);
 for(const n of Object.keys(after).filter(n=>!n.startsWith('ksf-workshop-research-backup-')))assert.ok(Object.hasOwn(f.before,n),n);
}

test('exact r6 dry is read-only; 23 planned changes contain 22 updates and one creation',t=>{
 const f=fixture(t),dry=publicPlan(planUpdate(f));
 assert.equal(dry.baselineId,'r6');assert.equal(dry.changedFiles,23);assert.equal(dry.readOnly,true);
 assert.equal(dry.changes.filter(x=>x.action==='update').length,22);
 assert.equal(dry.changes.filter(x=>x.action==='create').length,1);
 assert.ok(dry.changes.find(x=>x.path.endsWith(path.join('references','workshop-report-design.md'))));
 assert.deepEqual(fileMap(f.dataRoot),f.before);
});

test('apply and verify cover 43 public files, preserve research/runtime/private files and retain 22 backups',t=>{
 const f=fixture(t),applied=applyUpdate(f),verified=verifyUpdate({backup:applied.backup});
 assert.equal(verified.installedFilesVerified,43);assert.equal(verified.changedFilesVerified,23);
 assert.equal(verified.runtimeAndBindingPreserved,true);assert.equal(verified.researchFilesUnchanged,true);
 assert.equal(verified.agentLoaded,false);
 for(const[n,h]of Object.entries(f.release.candidate))assert.equal(digest(path.join(f.targetDir,n)),h,n);
 const after=fileMap(f.dataRoot),owned=new Set(Object.keys(f.release.candidate).map(n=>'skills/ksf-workshop-runtime/'+n));
 for(const[n,h]of Object.entries(f.before))if(!owned.has(n))assert.equal(after[n],h,n);
 assert.equal(fs.readdirSync(applied.backup).filter(n=>n.endsWith('.before')).length,22);
 assert.ok(!fs.readFileSync(path.join(applied.backup,'journal.json'),'utf8').includes('fixtureOnly'));
 assert.equal(fs.existsSync(path.join(f.libraryDir,'SKILL.md')),false);
});

test('repeat install is a no-op; rollback restores r6 and removes only the new reference',t=>{
 const f=fixture(t),applied=applyUpdate(f),after=fileMap(f.dataRoot),repeated=applyUpdate(f);
 assert.equal(repeated.alreadyApplied,true);assert.equal(repeated.readOnly,true);assert.equal(repeated.changedFiles,0);
 assert.deepEqual(fileMap(f.dataRoot),after);
 rollbackUpdate({backup:applied.backup});restored(f);
 assert.equal(fs.existsSync(path.join(f.targetDir,'references/workshop-report-design.md')),false);
 assert.equal(rollbackUpdate({backup:applied.backup}).alreadyRolledBack,true);
});

test('unknown entry, mixed files, stale manifest and runtime edits stop before any installation',t=>{
 for(const [name,code]of [['SKILL.md','UNKNOWN_TARGET_SKILL'],['references/workshop-feedback.md','TARGET_BASELINE_MISMATCH'],['FILES.sha256','TARGET_BASELINE_MISMATCH'],['scripts/ksf-secure.mjs','RUNTIME_BASELINE_MISMATCH']]){
  const f=fixture(t);fs.appendFileSync(path.join(f.targetDir,name),'unknown');const before=fileMap(f.dataRoot);
  assert.throws(()=>applyUpdate(f),{code});assert.deepEqual(fileMap(f.dataRoot),before);
 }
});

test('existing new reference and altered payload are never overwritten or accepted',t=>{
 for(const scenario of ['new-file','payload']){
  const f=fixture(t);
  const name=scenario==='new-file'?path.join(f.targetDir,'references/workshop-report-design.md'):path.join(f.packageDir,'payload/SKILL.md');
  fs.writeFileSync(name,'unexpected');const before=fileMap(f.dataRoot);
  assert.throws(()=>applyUpdate(f),{code:scenario==='new-file'?'UNEXPECTED_EXISTING_FILE':'PACKAGE_HASH_MISMATCH'});
  assert.deepEqual(fileMap(f.dataRoot),before);
 }
});

test('research modifications or a restored legacy entry block installation',t=>{
 for(const scenario of ['entry','reference']){
  const f=fixture(t);
  if(scenario==='entry')fs.writeFileSync(path.join(f.libraryDir,'SKILL.md'),'not allowed');
  else fs.appendFileSync(path.join(f.libraryDir,'references/query-rules.md'),'unknown');
  const before=fileMap(f.dataRoot);
  assert.throws(()=>applyUpdate(f),{code:scenario==='entry'?'LEGACY_ENTRY_REACTIVATED':'RESEARCH_MANIFEST_MISMATCH'});
  assert.deepEqual(fileMap(f.dataRoot),before);
 }
});

test('partial failure after the new file is installed restores r6 bytes',t=>{
 const f=fixture(t);let error;
 try{applyUpdate(f,{afterMutation:i=>{if(i===f.release.plans.r6.findIndex(e=>e.action==='create'))throw Object.assign(Error('injected'),{code:'INJECTED_FAILURE'});}});}catch(e){error=e;}
 assert.equal(error.code,'INJECTED_FAILURE');assert.equal(error.recoveryStatus,'FAILED_RESTORED');restored(f);
 assert.equal(fs.existsSync(path.join(f.targetDir,'references/workshop-report-design.md')),false);
});

test('concurrent binding change is detected and preserved for review',t=>{
 const f=fixture(t);let error;
 try{applyUpdate(f,{afterMutation:i=>{if(i===0)fs.appendFileSync(path.join(f.targetDir,'credential-binding.json'),'concurrent');}});}catch(e){error=e;}
 assert.equal(error.code,'BINDING_CHANGED');assert.equal(error.recoveryStatus,'FAILED_REQUIRES_REVIEW');
 assert.ok(fs.readFileSync(path.join(f.targetDir,'credential-binding.json'),'utf8').endsWith('concurrent'));
 assert.equal(digest(path.join(f.targetDir,'SKILL.md')),f.release.baselines.r6['SKILL.md']);
});

test('verify and rollback refuse later edits without modifying them',t=>{
 const f=fixture(t),applied=applyUpdate(f);fs.appendFileSync(path.join(f.targetDir,'references/workshop-report-design.md'),'later edit');
 const before=fileMap(f.dataRoot);
 assert.throws(()=>verifyUpdate({backup:applied.backup}),{code:'CONCURRENT_FILE_CHANGE'});
 assert.throws(()=>rollbackUpdate({backup:applied.backup}),{code:'CONCURRENT_FILE_CHANGE'});
 assert.deepEqual(fileMap(f.dataRoot),before);
});