import assert from 'node:assert/strict';
import {copyFileSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync} from 'node:fs';
import {spawnSync} from 'node:child_process';
import {createHash} from 'node:crypto';
import {dirname, join, relative, resolve} from 'node:path';

assert.equal(process.argv.length, 3,
  'usage: node vfs-symlink-local.mjs <K1555-matrix-check-report.json>');
const root = process.cwd();
const predecessorPath = resolve(process.argv[2]);
const predecessor = JSON.parse(readFileSync(predecessorPath, 'utf8'));
assert.equal(predecessor.status, 'K1555_VFS_LOOKUP_DEVELOPMENT_MATRIX_VALIDATED');
const dir = mkdtempSync(join(root, 'reports/os-implementation/K1560-vfs-symlink-local-'));
const sha = path => createHash('sha256').update(readFileSync(path)).digest('hex');
const artifact = path => ({path: relative(root, path), sha256: sha(path)});
const copy = (source, target) => {
  mkdirSync(dirname(target), {recursive: true});
  copyFileSync(join(root, source), target);
  return artifact(target);
};
const source = join(dir, 'source');
const model = join(source, 'os-vfs-symlink/src/lib.rs');
const fixture = join(source, 'kernel/tests/os/vfs_symlink.rs');
const sources = {
  model: copy('os-vfs-symlink/src/lib.rs', model),
  pathsModel: copy('os-vfs-paths/src/lib.rs',
    join(source, 'os-vfs-paths/src/lib.rs')),
  fixture: copy('kernel/tests/os/vfs_symlink.rs', fixture),
  contract: copy('kernel/VFS_SYMLINK_BOUNDS_CONTRACT.md',
    join(source, 'kernel/VFS_SYMLINK_BOUNDS_CONTRACT.md')),
  harness: artifact(join(root, 'scripts/os-acceptance/vfs-symlink-local.mjs')),
};
const run = (name, program, args, expected) => {
  const result = spawnSync(program, args, {cwd: root, encoding: 'utf8'});
  const log = join(dir, `${name}.log`);
  writeFileSync(log, `${result.stdout ?? ''}${result.stderr ?? ''}`);
  assert.equal(result.status, expected,
    `${name}: expected exit ${expected}, observed ${result.status}; ${artifact(log).path}`);
  return {exitCode: result.status, log: artifact(log)};
};
const binary = join(dir, 'vfs-symlink-tests');
const tests = {
  compile: run('host-compile', 'rustc', ['--edition=2024', '--test', fixture, '-o', binary], 0),
  green: run('host-tests', binary, [], 0),
};
const greenText = readFileSync(join(dir, 'host-tests.log'), 'utf8');
assert.match(greenText, /os_vfs_paths_symlink_positive \.\.\. ok/);
assert.match(greenText, /os_vfs_paths_symlink_negative \.\.\. ok/);
assert.match(greenText, /2 passed; 0 failed/);
const noStdRoot = join(source, 'no-std-root.rs');
writeFileSync(noStdRoot,
  '#![no_std]\n#[path = "os-vfs-paths/src/lib.rs"]\npub mod os_vfs_paths;\n#[path = "os-vfs-symlink/src/lib.rs"]\npub mod symlink;\n');
sources.noStdRoot = artifact(noStdRoot);
tests.target = run('aarch64-no-std-check', 'rustc', ['--edition=2024',
  '--crate-type=lib', '--target=aarch64-unknown-none', '--emit=metadata',
  noStdRoot, '-o', join(dir, 'model.rmeta')], 0);
const mutantRoot = join(dir, 'mutant');
const mutantModel = join(mutantRoot, 'os-vfs-symlink/src/lib.rs');
const mutantFixture = join(mutantRoot, 'kernel/tests/os/vfs_symlink.rs');
copy('kernel/tests/os/vfs_symlink.rs', mutantFixture);
const mutantPaths = copy('os-vfs-paths/src/lib.rs',
  join(mutantRoot, 'os-vfs-paths/src/lib.rs'));
mkdirSync(dirname(mutantModel), {recursive: true});
const original = readFileSync(model, 'utf8');
const guard = 'if hops == MAX_SYMLINK_HOPS';
assert.equal(original.split(guard).length, 2, 'symlink-hop guard must occur once');
writeFileSync(mutantModel, original.replace(guard, 'if hops == MAX_SYMLINK_HOPS + 1'));
const mutant = artifact(mutantModel);
const mutantBinary = join(dir, 'vfs-symlink-mutant-tests');
tests.mutantCompile = run('mutant-compile', 'rustc',
  ['--edition=2024', '--test', mutantFixture, '-o', mutantBinary], 0);
tests.red = run('mutant-tests', mutantBinary, [], 101);
assert.match(readFileSync(join(dir, 'mutant-tests.log'), 'utf8'),
  /os_vfs_paths_symlink_negative \.\.\. FAILED/);
const report = {
  schema: 'turkos-k1560-vfs-symlink-local/v1',
  status: 'K1556_K1559_LOCAL_VALIDATED',
  guestAccepted: false, productAccepted: false,
  predecessor: artifact(predecessorPath), sources, mutant, mutantPaths,
  tests: {...tests, greenCount: 2, mutationRejected: true},
  scope: 'The bounded exact-path symlink table follows two links across mounts, rejects a 41st hop with Eloop(40), and rejects targets outside the process root without changing namespace state. Two host tests, AArch64 no_std compilation, and a red 41-hop-limit mutant are recorded. Real guest symlink evidence remains for K1560.'
};
const reportPath = join(dir, 'report.json');
writeFileSync(reportPath, JSON.stringify(report, null, 2) + '\n');
console.log(JSON.stringify({status: report.status, report: relative(root, reportPath),
  tests: report.tests.greenCount, mutationRejected: report.tests.mutationRejected}));