import assert from 'node:assert/strict';
import {readFileSync,writeFileSync,mkdtempSync,mkdirSync} from 'node:fs';
import {join,dirname,relative} from 'node:path';
import {inspectWaitGuestServicesHost} from './wait-guest-services-host-report.mjs';
import {hashAt} from './boot-contract-report.mjs';
const root=process.cwd();assert.equal(process.argv.length,3);const path=process.argv[2],original=JSON.parse(readFileSync(join(root,path),'utf8'));inspectWaitGuestServicesHost(original,root);
const directory=mkdtempSync(join(dirname(join(root,path)),'damaged-host-controls-'));const results=[];
const reject=(name,edit)=>{const r=structuredClone(original);edit(r);assert.throws(()=>inspectWaitGuestServicesHost(r,root),name);results.push({id:name,status:'REJECTED'});};
reject('false-guest',r=>r.guestAccepted=true);reject('false-kernel-elf',r=>r.kernelElfBound=true);reject('false-hardware-scope',r=>r.measurementScope='ACTUAL_CPU');reject('wrong-tests',r=>r.hostTests++);reject('ARM-rlib',r=>r.arm64Status='RLIB_BUILT');reject('pending-omitted',r=>r.pending=[]);reject('local-numeric',r=>r.localMoves=[1080]);reject('stale-input',r=>r.inputsBefore[0].sha256='0'.repeat(64));reject('input-omitted',r=>r.inputsBefore.pop());reject('source-omitted',r=>r.sources.pop());reject('source-order',r=>r.sources.reverse());reject('mutant-omitted',r=>r.mutants.pop());reject('mutant-unbound-source',r=>r.mutants[0].source=r.sources[0]);reject('mutant-unrelated-manifest',r=>r.mutants[0].sources=r.mutants[1].sources);reject('mutant-zero-exit',r=>r.mutants[0].exitCode=0);reject('wrong-selected-test',r=>r.mutants[0].argv[r.mutants[0].argv.length-4]='unrelated');reject('compile-failure-log',r=>r.mutants[0].log=r.commands[1].log);reject('format-bypass',r=>r.commands[2].argv=[]);reject('clippy-target-bypass',r=>r.commands[3].argv=[]);reject('command-omitted',r=>r.commands.pop());reject('frozen-wait-anchor-unbound',r=>r.anchors[0].sha256='0'.repeat(64));reject('frozen-services-anchor-omitted',r=>r.anchors.pop());reject('false-anchor-tests',r=>r.anchors[0].result.hostTests++);reject('boundary-wait-return-claim',r=>r.boundary+=' actual assembly accepted');reject('floating-row-artifact',r=>r.commands[0].log.path='reports/os-implementation/unrelated/tests.log');reject('source-floated-elsewhere',r=>r.sources[0].path=r.sources[1].path);reject('source-sha-floating',r=>r.sources[0].sha256=r.sources.find(a=>a.sha256!==r.sources[0].sha256).sha256);reject('extra-command',r=>r.commands.push(r.commands[0]));reject('protected-after-drift',r=>r.protectedAfter.inputs[0].sha256='0'.repeat(64));reject('input-after-drift',r=>r.inputsAfter[0].sha256='0'.repeat(64));reject('mutant-source-edit-omitted',r=>r.mutants[16].extra=[]);
// Coherent artifact mutations use a private proof mirror. Canonical evidence
// and all original/frozen source files remain byte-for-byte untouched.
const mirrorDirectory=mkdtempSync(join(root,'reports/os-implementation/K1080-wait-services-preparation-control-mirror-'));
const mirrorPrefix=relative(root,mirrorDirectory),mirror=structuredClone(original),artifacts=new Map();
const collect=v=>{if(v&&typeof v==='object'){if(typeof v.path==='string'&&v.path.startsWith(original.runDirectory+'/')&&typeof v.sha256==='string')artifacts.set(v.path,v.sha256);for(const x of Object.values(v))collect(x);}};collect(original);
for(const[path,sha256]of artifacts){assert.equal(hashAt(root,path),sha256);const dest=join(root,mirrorPrefix+path.slice(original.runDirectory.length));mkdirSync(dirname(dest),{recursive:true});writeFileSync(dest,readFileSync(join(root,path)));}
const rebase=v=>{if(v&&typeof v==='object')for(const[k,x]of Object.entries(v)){if(typeof x==='string')v[k]=x.replaceAll(original.runDirectory,mirrorPrefix);else rebase(x);}};rebase(mirror);
inspectWaitGuestServicesHost(mirror,root);
const mirrorReport=join(mirrorDirectory,'control-fixture.json');writeFileSync(mirrorReport,JSON.stringify({schema:'turkos-wait-guest-services-host-control-mirror/v1',status:'DAMAGE_CONTROL_COPY_ONLY',canonicalParent:{path,sha256:hashAt(root,path)},record:mirror},null,2)+'\n');
const coherent=(name,artifact,alter)=>{
 const at=join(root,artifact.path),before=readFileSync(at),r=structuredClone(mirror);
 try{
  writeFileSync(at,alter(before));
  const sha256=hashAt(root,artifact.path);
  const visit=v=>{if(v&&typeof v==='object'){if(v.path===artifact.path&&'sha256'in v)v.sha256=sha256;for(const x of Object.values(v))visit(x);}};visit(r);
  assert.throws(()=>inspectWaitGuestServicesHost(r,root),name);
  results.push({id:name,status:'REJECTED',coherentArtifactHash:true});
 }finally{writeFileSync(at,before);assert.equal(hashAt(root,artifact.path),artifact.sha256);}
};
coherent('coherent-new-bridge-source',mirror.sources.find(a=>a.originalPath==='os-wait-guest-services/src/bridge.rs'),b=>Buffer.concat([b,Buffer.from('\n// rehashed staged source forgery\n')]));
coherent('coherent-unchanged-frozen-wait-source',mirror.sources.find(a=>a.originalPath==='os-thread-wait/src/thread_wait.rs'),b=>Buffer.concat([b,Buffer.from('\n// rehashed staged source forgery\n')]));
coherent('coherent-compile-failure-is-not-killed-mutant',mirror.mutants[0].log,b=>Buffer.concat([b,Buffer.from('\nerror[E9999]: forged compiler failure\n')]));
inspectWaitGuestServicesHost(original,root);
const result={schema:'turkos-wait-guest-services-host-controls/v1',status:'ALL_REJECTED',parent:{path,sha256:hashAt(root,path)},damagedControls:results.length,results,controlMirror:{path:relative(root,mirrorReport),sha256:hashAt(root,relative(root,mirrorReport))},guestAccepted:false};const out=join(directory,'report.json');writeFileSync(out,JSON.stringify(result,null,2)+'\n');console.log('WAIT SERVICES '+results.length+' REJECTED '+relative(root,out));