import assert from "node:assert/strict";
import crypto from "node:crypto";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import { pathToFileURL } from "node:url";
import test from "node:test";
import ts from "typescript";

const root = path.resolve(import.meta.dirname, "../../..");
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "io-format-receipt-freshness-unit-"));
const stableValue = (value) => Array.isArray(value) ? value.map(stableValue) : value && typeof value === "object" ? Object.fromEntries(Object.keys(value).sort().map((key) => [key, stableValue(value[key])])) : value;
const stableSha256 = (value) => crypto.createHash("sha256").update(JSON.stringify(stableValue(value))).digest("hex");

function transpile(sourcePath, outputName, replacements = []) {
  const result = ts.transpileModule(fs.readFileSync(sourcePath, "utf8"), {
    compilerOptions: { module: ts.ModuleKind.ES2022, target: ts.ScriptTarget.ES2022 },
    fileName: sourcePath,
    reportDiagnostics: true,
  });
  assert.deepEqual(result.diagnostics, []);
  let output = result.outputText;
  for (const [from, to] of replacements) output = output.replaceAll(from, to);
  const outputPath = path.join(temporary, outputName);
  fs.writeFileSync(outputPath, output);
  return outputPath;
}

const parentPath = path.join(root, "tests/golden/M12-05E/bound-runtime-receipts.json");
const freshnessPath = path.join(root, "tests/golden/M12-05F/fresh-runtime-receipts.json");
const parentBytes = fs.readFileSync(parentPath);
const bound = JSON.parse(parentBytes);
const freshness = JSON.parse(fs.readFileSync(freshnessPath, "utf8"));
const protocolPath = path.join(root, "web/protocol/io-format-receipt-freshness.ts");
transpile(path.join(root, "web/protocol/io-format-runtime-receipt.ts"), "io-format-runtime-receipt.mjs");
transpile(path.join(root, "web/protocol/io-format-receipt-binding.ts"), "io-format-receipt-binding.mjs");
const protocol = await import(pathToFileURL(transpile(protocolPath, "io-format-receipt-freshness.mjs", [["./io-format-receipt-binding\"", "./io-format-receipt-binding.mjs\""], ["./io-format-runtime-receipt\"", "./io-format-runtime-receipt.mjs\""]])));
const expected = {
  parentBindingSha256: crypto.createHash("sha256").update(parentBytes).digest("hex"),
  parentReceiptSetSha256: bound.parentReceiptSetSha256,
  inventorySha256: bound.inventorySha256,
  boundReceiptSetSha256: stableSha256(bound),
  runtimeSha256: stableSha256(bound.runtime),
  runtime: bound.runtime,
  receiptIdentities: bound.receipts,
};

test("M12-05F artifact is deterministic and bound to M12-05E", () => {
  const manifest = JSON.parse(fs.readFileSync(path.join(root, "tests/golden/M12-05F/manifest.json"), "utf8"));
  assert.equal(manifest.task, "M12-05F");
  assert.equal(manifest.parentTask, "M12-05E");
  assert.equal(manifest.nextTask, "M12-06A");
  for (const artifact of Object.values(manifest.artifacts)) {
    assert.equal(crypto.createHash("sha256").update(fs.readFileSync(path.join(root, artifact.path))).digest("hex"), artifact.sha256, artifact.path);
  }
  assert.equal(freshness.parentBindingSha256, expected.parentBindingSha256);
  assert.equal(freshness.boundReceiptSetSha256, expected.boundReceiptSetSha256);
  assert.equal(freshness.runtimeSha256, expected.runtimeSha256);
});

test("M12-05F accepts only the exact trusted runtime receipt", async () => {
  const parsed = await protocol.verifyIOFormatReceiptFreshness(freshness, expected);
  assert.equal(parsed.bound.receipts.length, 14);
  assert.equal(protocol.resolveFreshIOFormatRuntimeRoute(freshness, expected, { format: "GLB", operation: "EXPORT" }).status, "READY");
  assert.equal(protocol.resolveFreshIOFormatRuntimeRoute(freshness, expected, { format: "USD", operation: "EXPORT" }).status, "BLOCKED");
});

test("M12-05F rejects forged content before route execution", async () => {
  const forged = structuredClone(freshness);
  forged.bound.receipts[0].operator = "forged.operator";
  await assert.rejects(() => protocol.verifyIOFormatReceiptFreshness(forged, expected), (error) => error.reason === "RECEIPT_FORGED");
  const malformed = structuredClone(freshness);
  delete malformed.boundReceiptSetSha256;
  assert.equal(protocol.resolveFreshIOFormatRuntimeRoute(malformed, expected, { format: "GLB", operation: "EXPORT" }).reason, "RECEIPT_FORGED");
});

test("M12-05F rejects stale parent identity and cross-version runtime", () => {
  const stale = structuredClone(freshness);
  stale.bound.inventorySha256 = "a".repeat(64);
  assert.equal(protocol.resolveFreshIOFormatRuntimeRoute(stale, expected, { format: "GLB", operation: "EXPORT" }).reason, "RECEIPT_STALE");
  const crossVersion = structuredClone(freshness);
  crossVersion.bound.runtime.versionTuple = [5, 3, 0];
  assert.equal(protocol.resolveFreshIOFormatRuntimeRoute(crossVersion, expected, { format: "GLB", operation: "EXPORT" }).reason, "RECEIPT_CROSS_VERSION");
});

test.after(() => fs.rmSync(temporary, { recursive: true, force: true }));