import assert from 'node:assert/strict';
import {spawnSync} from 'node:child_process';
import {cpSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync} from 'node:fs';
import {join, relative, resolve} from 'node:path';
import {hashAt} from './boot-contract-report.mjs';

assert.equal(process.argv.length, 3,
  'usage: node scripts/os-acceptance/handles-transfer.mjs <K1330-matrix-report.json>');
const root = process.cwd();
const predecessorPath = relative(root, resolve(process.argv[2]));
assert.match(predecessorPath,
  /^reports\/os-implementation\/K1330-owned-el0-matrix-check-[A-Za-z0-9_-]+\/report\.json$/);
const predecessor = JSON.parse(readFileSync(join(root, predecessorPath), 'utf8'));
assert.equal(predecessor.status, 'K1330_OWNED_EL0_DEVELOPMENT_MATRIX_VALIDATED');
assert.equal(predecessor.guestAccepted, true);
const directory = mkdtempSync(join(root,
  'reports/os-implementation/K1335-handles-transfer-local-preflight-'));
const workspace = join(directory, 'workspace');
const source = 'os-handles/transfer/handles.rs';
const tests = 'kernel/tests/os/handles_transfer.rs';
mkdirSync(join(workspace, 'os-handles/transfer'), {recursive: true});
mkdirSync(join(workspace, 'kernel/tests/os'), {recursive: true});
cpSync(join(root, source), join(workspace, source));
cpSync(join(root, tests), join(workspace, tests));
const artifact = path => ({path: relative(root, path),
  sha256: hashAt(root, relative(root, path))});
const run = (name, command, args) => {
  const answer = spawnSync(command, args, {cwd: root, encoding: 'utf8',
    timeout: 600000, maxBuffer: 64 * 1024 * 1024});
  const log = join(directory, name + '.log');
  writeFileSync(log, (answer.stdout ?? '') + (answer.stderr ?? ''));
  return {exitCode: answer.status, error: answer.error?.message ?? null,
    log: artifact(log)};
};
const binary = join(directory, 'handles-transfer-test');
const compile = run('host-compile', 'rustc', ['--edition=2024', '--test',
  join(workspace, tests), '-o', binary]);
assert.equal(compile.exitCode, 0,
  readFileSync(join(root, compile.log.path), 'utf8'));
const green = run('host-tests', binary, ['--nocapture']);
const greenText = readFileSync(join(root, green.log.path), 'utf8');
assert.equal(green.exitCode, 0, greenText);
for (const name of ['message_moves_handle_after_sender_exit',
  'transfer_capacity_and_overflow_leave_escrow_intact',
  'failed_copy_and_rights_denial_keep_sender_handle'])
  assert.match(greenText, new RegExp(`test ${name} \\.\\.\\. ok`));
assert.match(greenText, /3 passed; 0 failed/);

const wrapper = join(workspace, 'os-handles/transfer/no_std_check.rs');
writeFileSync(wrapper, '#![no_std]\n#[path = "handles.rs"]\nmod handles;\n');
const target = run('aarch64-no-std-check', 'rustc', ['--edition=2024',
  '--crate-type=lib', '--target=aarch64-unknown-none', '--emit=metadata',
  wrapper, '-o', join(directory, 'handles-transfer-aarch64.rmeta')]);
assert.equal(target.exitCode, 0,
  readFileSync(join(root, target.log.path), 'utf8'));

const copiedSource = join(workspace, source);
const original = readFileSync(copiedSource, 'utf8');
const guard = 'let mut bytes = [0u8; MAX];\n        copy(&mut bytes[..length])?;\n        let ticket = self.next_ticket;';
assert.equal(original.split(guard).length, 2);
writeFileSync(copiedSource, original.replace(guard,
  'let mut bytes = [0u8; MAX];\n        let _ = copy(&mut bytes[..length]);\n        let ticket = self.next_ticket;'));
const mutantCompile = run('failed-copy-ignored-mutant-compile', 'rustc',
  ['--edition=2024', '--test', join(workspace, tests),
    '-o', join(directory, 'handles-transfer-mutant-test')]);
assert.equal(mutantCompile.exitCode, 0,
  readFileSync(join(root, mutantCompile.log.path), 'utf8'));
const red = run('failed-copy-ignored-mutant',
  join(directory, 'handles-transfer-mutant-test'),
  ['failed_copy_and_rights_denial_keep_sender_handle', '--exact', '--nocapture']);
const redText = readFileSync(join(root, red.log.path), 'utf8');
assert.notEqual(red.exitCode, 0);
assert.match(redText, /failed_copy_and_rights_denial_keep_sender_handle \.\.\. FAILED/);
writeFileSync(copiedSource, original);

const report = {schema: 'turkos-k1335-handles-transfer-local-preflight/v1',
  status: 'K1331_K1334_LOCAL_VALIDATED',
  guestAccepted: false, productAccepted: false,
  predecessor: artifact(join(root, predecessorPath)),
  sources: {contract: artifact(join(root,
    'os-handles/transfer/CONTRACT.md')),
  handles: artifact(join(root, source)), tests: artifact(join(root, tests)),
  harness: artifact(join(root, 'scripts/os-acceptance/handles-transfer.mjs'))},
  tests: {compile, green, target, mutantCompile, red,
    greenCount: 3, mutationRejected: true},
  scope: 'Local message handle-transfer model: sender loses a typed generation-tagged handle only after private user-data copy, an escrow retains object and attenuated rights, and a designated recipient receives a fresh handle and FIFO bytes. Denials, ticket and generation overflow, capacity rollback, AArch64 no_std compilation and a failed-copy mutant are checked. Native EL0 six-profile integration remains K1335.'};
const reportPath = join(directory, 'report.json');
writeFileSync(reportPath, JSON.stringify(report, null, 2) + '\n');
console.log(JSON.stringify({status: report.status,
  report: relative(root, reportPath), green: report.tests.greenCount}));