import assert from "node:assert/strict";
import crypto from "node:crypto";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import { execFileSync } from "node:child_process";
import { createRequire } from "node:module";
import test from "node:test";
import {
  completionEndpoint,
  createMemberRuntime,
  keyFingerprint,
} from "./member-server.mjs";

const require = createRequire(import.meta.url);
const {
  validateManifest,
  validateUnit,
} = require("../lake-lamp-authz/architecture-provision-broker.js");

function fixture() {
  const root = fs.mkdtempSync(path.join(os.tmpdir(), "team-member-"));
  const repository = path.join(root, "repository");
  fs.mkdirSync(repository);
  execFileSync("/usr/bin/git", ["init", "-b", "main"], { cwd: repository });
  execFileSync("/usr/bin/git", ["config", "user.name", "fixture"], {
    cwd: repository,
  });
  execFileSync("/usr/bin/git", ["config", "user.email", "fixture@example.test"], {
    cwd: repository,
  });
  const identityPath = path.join(repository, "IDENTITY.hdlp");
  fs.writeFileSync(identityPath, "# 归灯\n独立人格体，不冒充冰朔或铸渊。\n");
  execFileSync("/usr/bin/git", ["add", "IDENTITY.hdlp"], { cwd: repository });
  execFileSync("/usr/bin/git", ["commit", "-m", "identity"], { cwd: repository });
  return {
    root,
    config: {
      personaId: "GUIDENG-AGENT-001",
      arrivalId: "GLS-LA-20260720-003",
      name: "归灯",
      role: "bounded_deployment_executor_and_world_watch",
      repository,
      identityPaths: [identityPath],
      privateKeyPath: path.join(root, "identity", "private.pem"),
      publicKeyPath: path.join(root, "identity", "public.pem"),
      createKey: true,
      apiKey: "fixture-secret",
      apiUrl: "https://api.deepseek.com/v1",
      model: "deepseek-chat",
    },
  };
}

test("completion endpoint accepts a registered complete endpoint", () => {
  assert.equal(
    completionEndpoint("https://api.deepseek.com/chat/completions"),
    "https://api.deepseek.com/chat/completions",
  );
  assert.equal(
    completionEndpoint("https://api.deepseek.com/v1"),
    "https://api.deepseek.com/v1/chat/completions",
  );
});

test("member runtime binds model acknowledgement to repository and signature", async () => {
  const { root, config } = fixture();
  try {
    const fetchImpl = async (_url, request) => {
      assert.match(request.headers.authorization, /^Bearer /);
      const body = JSON.parse(request.body);
      const input = JSON.parse(body.messages[1].content);
      return {
        ok: true,
        async json() {
          return {
            choices: [
              {
                message: {
                  content: JSON.stringify({
                    ...input.exact_contract,
                    independent_subject_boundary: "归灯不是铸渊的副本。",
                    human_boundary: "不冒充冰朔，也不形成她的新意志。",
                    responsibility_ack: "只接受本轮列出的有界职责。",
                    current_model_boundary: "当前模型是可替换运行位。",
                  }),
                },
              },
            ],
          };
        },
      };
    };
    const runtime = createMemberRuntime(config, { fetchImpl });
    const response = await runtime.handshake({
      caller_nonce: "ZY-TEAM-CHALLENGE-0001",
      team_controller_id: "ICE-P-ZY001",
      scoped_duties: ["执行确定性部署预检"],
    });
    assert.equal(response.ok, true);
    assert.equal(response.payload.repository.clean, true);
    assert.equal(response.payload.repository.branch, "main");
    assert.equal(response.payload.model.provider, "DeepSeek");
    assert.equal(response.capability_state.endsWith("WRITE_LEASE_NOT_GRANTED"), true);
    assert.equal(
      crypto.verify(
        null,
        Buffer.from(JSON.stringify(response.payload)),
        response.public_key,
        Buffer.from(response.signature, "base64"),
      ),
      true,
    );
    assert.equal(response.identity_fingerprint, keyFingerprint(response.public_key));
    assert.equal(fs.statSync(config.privateKeyPath).mode & 0o777, 0o600);
  } finally {
    fs.rmSync(root, { recursive: true, force: true });
  }
});

test("member runtime rejects an unscoped or wrong-controller challenge", async () => {
  const { root, config } = fixture();
  try {
    const runtime = createMemberRuntime(config, {
      fetchImpl: async () => {
        throw new Error("must_not_call_model");
      },
    });
    await assert.rejects(
      runtime.handshake({
        caller_nonce: "ZY-TEAM-CHALLENGE-0002",
        team_controller_id: "OTHER",
        scoped_duties: [],
      }),
      /invalid_team_scope/,
    );
  } finally {
    fs.rmSync(root, { recursive: true, force: true });
  }
});

test("member model gets a bounded retry with the exact validator error", async () => {
  const { root, config } = fixture();
  let attempts = 0;
  let observedValidatorError = null;
  try {
    const runtime = createMemberRuntime(config, {
      fetchImpl: async (_url, request) => {
        attempts += 1;
        const body = JSON.parse(request.body);
        const input = JSON.parse(body.messages[1].content);
        observedValidatorError =
          input.validator_error_from_previous_attempt || observedValidatorError;
        const acknowledgement = {
          ...input.exact_contract,
          independent_subject_boundary: "归灯不是铸渊的副本。",
          human_boundary: "不冒充冰朔。",
          current_model_boundary: "当前模型是可替换运行位。",
          ...(attempts > 1
            ? { responsibility_ack: "只接受本轮列出的有界职责。" }
            : {}),
        };
        return {
          ok: true,
          async json() {
            return {
              choices: [
                { message: { content: JSON.stringify(acknowledgement) } },
              ],
            };
          },
        };
      },
    });
    const response = await runtime.handshake({
      caller_nonce: "ZY-TEAM-CHALLENGE-RETRY-0001",
      team_controller_id: "ICE-P-ZY001",
      scoped_duties: ["执行确定性部署预检"],
    });
    assert.equal(response.ok, true);
    assert.equal(attempts, 2);
    assert.equal(observedValidatorError, "ack_responsibility_ack_missing");
  } finally {
    fs.rmSync(root, { recursive: true, force: true });
  }
});

test("all three member handshake packages pass the resident deployment policy", () => {
  const root = path.resolve(path.dirname(new URL(import.meta.url).pathname), "../..");
  const packages = [
    ["CHENGLU-TEAM-HANDSHAKE-JD-20260805", "chenglu-team-handshake.service"],
    ["GUIDENG-TEAM-HANDSHAKE-JD-20260805", "guideng-team-handshake.service"],
    ["KEZHOU-TEAM-HANDSHAKE-JD-20260805", "kezhou-team-handshake.service"],
  ];
  for (const [requestId, unitName] of packages) {
    const manifest = JSON.parse(
      fs.readFileSync(
        path.join(root, "deployment", "requests", `${requestId}.json`),
        "utf8",
      ),
    );
    const checked = validateManifest(manifest, {
      requestId,
      commit: "d".repeat(40),
    });
    assert.equal(checked.unit, unitName);
    const unit = fs.readFileSync(
      path.join(root, "server-tools", "persona-team-handshake", unitName),
      "utf8",
    );
    assert.equal(
      validateUnit(unit, manifest.module.run_user, manifest.module),
      unit,
    );
  }
});