/** Owned disposable PostgreSQL acceptance only. Native license GET is genuine
 * localhost HTTP; external stop/restart enforcement remains SYNTHETIC. */
import assert from "node:assert/strict"
import { createHash, generateKeyPairSync, randomUUID, sign } from "node:crypto"
import { mkdtemp, rm, writeFile } from "node:fs/promises"
import { dirname, resolve, sep } from "node:path"
import { assertOwnedBandwidthSql } from "./bandwidth-admission-process.sql-helper.js"
import { canonicalBandwidthNodeValue } from "./bandwidth-node-bootstrap.js"
import { bandwidthOperatorEnrollmentGrantSchema } from "./bandwidth-operator-enrollment.js"
import { createBandwidthOperatorWriterComposition } from "./bandwidth-operator-writer-composition.js"
import { BandwidthOperatorWriterFenceUnknown } from "./bandwidth-operator-writer-window.js"
import { bandwidthPeerRefKey, type BandwidthPeerRef } from "./bandwidth-peer-reference.js"
import type { createOwnedExternalRegistryHarness } from "./bandwidth-external-node-registry.sql-helper.js"

type Harness = Awaited<ReturnType<typeof createOwnedExternalRegistryHarness>>
type Signed = Awaited<ReturnType<Harness["createSignedSource"]>>
export async function acceptOwnedOperatorWriterComposition(f: Harness, signed: Signed): Promise<string[]> {
  assertOwnedBandwidthSql(); assert.equal(process.env.MMAPP_OWN_BANDWIDTH_EXTERNAL_REGISTRY, "true")
  assert.equal(typeof signed.node.openWithOwnershipFence, "function")
  const state = resolve(process.env.MCP_STATE_DIR!), folder = await mkdtemp(resolve(state, "operator-writer-"))
  assert.equal(dirname(folder), state)
  const trustKeyFile = resolve(folder, "trust.pem"), grantFile = resolve(folder, "grant.json")
  const keys = generateKeyPairSync("ed25519"), sha = (bytes: Buffer | string) => createHash("sha256").update(bytes).digest("hex")
  await writeFile(trustKeyFile, keys.publicKey.export({ type: "spki", format: "pem" }), { flag: "wx", mode: 0o600 })
  const { Client } = await import("pg"), originalQuery = Client.prototype.query
  const rival = await f.owner.connect(), pids = new Set<number>(), checks: string[] = []
  let allowedPeer: BandwidthPeerRef | undefined, syntheticStopped = true, externalHeld = false, removeAfterCommit = false
  let leaseOpens = 0, physicalDestroys = 0, credentialReads = 0, rivalChecks = 0
  let diagnostic = { began: Date.now(), queries: 0, rawOwnership: 0, commitAttempted: false, commitAcknowledged: false, boundary: "construction" }
  async function assertHeld() {
    assert(externalHeld, "synthetic external fence must stay held")
    assert.equal(pids.size, 1, "one physical configured source PID; no nested control checkout")
    const pid = [...pids][0]
    const held = await rival.query("SELECT EXISTS(SELECT 1 FROM pg_catalog.pg_locks WHERE locktype='advisory' AND pid=$1 AND classid=0::pg_catalog.oid AND objid=8723116::pg_catalog.oid AND objsubid=1 AND mode='ExclusiveLock' AND granted) AS held", [pid])
    assert.equal(held.rows[0].held, true)
    const shared = await rival.query("SELECT pg_catalog.pg_try_advisory_lock_shared(8723116) AS acquired")
    if (shared.rows[0].acquired === true) { await rival.query("SELECT pg_catalog.pg_advisory_unlock_shared(8723116)"); assert.fail("rival native shared handoff entered exclusive operator window") }
    rivalChecks++
  }
  Client.prototype.query = function(this: InstanceType<typeof Client>, ...args: unknown[]) {
    const physical = this as unknown as { connectionParameters: { user: string; database: string }; processID: number }
    if (physical.connectionParameters.user === signed.runtimeRole && physical.connectionParameters.database === f.databaseName) pids.add(physical.processID)
    return Reflect.apply(originalQuery, this, args)
  } as typeof Client.prototype.query
  const composition = createBandwidthOperatorWriterComposition({
    config: { ...f.root, trustKeyFile, grantFile, trustKeySha256: sha(keys.publicKey.export({ type: "spki", format: "der" })) },
    nodeSource: { ...signed.node, async openWithOwnershipFence(scope, guard, ownership) {
      leaseOpens++; diagnostic.boundary = "source-open"
      const session = await signed.node.openWithOwnershipFence(scope, guard, async fence => {
        diagnostic.rawOwnership++; diagnostic.boundary = "raw-ownership"
        await ownership(fence)
      })
      let closed = false
      return { ...session, close() { if (!closed) { closed = true; physicalDestroys++ }; session.close() }, connection: {
        release: session.connection.release.bind(session.connection),
        async query(text, values, options) {
          diagnostic.queries++; diagnostic.boundary = text === "COMMIT" ? "commit" : "driver-query"
          if (text === "COMMIT") diagnostic.commitAttempted = true
          const result = await session.connection.query(text, values, options)
          // Opening lock and PID queries precede the held phase; all registry
          // queries thereafter must preserve the same session exclusion.
          if (!text.includes("pg_try_advisory_lock(") && !text.includes("pg_backend_pid()")) await assertHeld()
          if (text === "COMMIT" && "command" in result && result.command === "COMMIT") diagnostic.commitAcknowledged = true
          if (text === "COMMIT" && removeAfterCommit) { removeAfterCommit = false; await rm(grantFile) }
          return result
        },
      } }
    } },
    observationSource: { async read(peer, scope) {
      diagnostic.boundary = "before-credentials"; assert(allowedPeer)
      assert.equal(bandwidthPeerRefKey(peer), bandwidthPeerRefKey(allowedPeer)); await assertHeld()
      credentialReads++; return f.readPeerSnapshot(peer, scope)
    } },
    externalStop: { async acquire(original, scope) {
      assert(syntheticStopped); assert.equal(original.grant.executorInventorySha256, sha("OWNED SYNTHETIC STOP/RESTART FIXTURE"))
      scope.signal?.throwIfAborted(); externalHeld = true
      return { async assertCurrent(current, requested) {
        assert(syntheticStopped && externalHeld); assert.equal(current.grant.grantId, original.grant.grantId)
        requested.signal?.throwIfAborted(); assert(Date.now() < requested.deadlineAt)
      }, close() { externalHeld = false } }
    } },
  })
  async function publish(peer: BandwidthPeerRef) {
    const snapshot = await f.readPeerSnapshot(peer, f.scope()); assert(snapshot)
    const now = Date.now(), grant = bandwidthOperatorEnrollmentGrantSchema.parse({ format: "mmapp-bandwidth-operator-enrollment-v1", ...f.root,
      grantId: randomUUID(), operatorId: "owned-writer-window", executorInventorySha256: sha("OWNED SYNTHETIC STOP/RESTART FIXTURE"),
      executorsStoppedAt: now - 1000, issuedAt: now - 1000, expiresAt: now + 120000, peerRef: peer, sourceProof: snapshot.sourceProof,
      authorityGeneration: snapshot.authorityGeneration, routingEndpointEpoch: snapshot.endpoint.routingEndpointEpoch,
      claims: [{ kind: "system-id", value: "OWNED-SHARED-SYSTEM" }, { kind: "software-id", value: "OWNED-SHARED-SOFTWARE" }] })
    const bytes = Buffer.from(canonicalBandwidthNodeValue(grant))
    await writeFile(grantFile, JSON.stringify({ format: "mmapp-bandwidth-operator-enrollment-envelope-v1", payload: bytes.toString("base64url"), signature: sign(null, bytes, keys.privateKey).toString("base64url") }), { mode: 0o600 })
    allowedPeer = peer
  }
  async function register() {
    pids.clear(); diagnostic = { began: Date.now(), queries: 0, rawOwnership: 0, commitAttempted: false, commitAcknowledged: false, boundary: "original-authority" }
    try { return await composition.register({ deadlineAt: Date.now() + 5000 }) }
    catch (error) {
      console.error("Owned writer window diagnostic:", JSON.stringify({ elapsedMs: Date.now() - diagnostic.began, queries: diagnostic.queries,
        rawOwnership: diagnostic.rawOwnership, commitAttempted: diagnostic.commitAttempted, commitAcknowledged: diagnostic.commitAcknowledged,
        boundary: diagnostic.boundary, physicalPids: pids.size, code: error && typeof error === "object" && "code" in error ? String(error.code).slice(0, 100) : "unclassified" }))
      throw error
    }
  }
  const coreTables = ["bandwidth_attempts", "bandwidth_node_occupancy", "bandwidth_attempt_events"]
  try {
    const occupied = await f.owner.query("SELECT o.node_id FROM mmapp_control.bandwidth_node_occupancy o JOIN mmapp_control.bandwidth_attempts a ON a.attempt_id=o.attempt_id WHERE a.state='unknown_busy'")
    assert(occupied.rows.length > 0, "the caller must establish genuine journal UNKNOWN occupancy first")
    const before = await f.digest(coreTables), claims = { "system-id": "OWNED-SHARED-SYSTEM", "software-id": "OWNED-SHARED-SOFTWARE" }
    const managedPeer: BandwidthPeerRef = { kind: "server", serverId: await f.managedEndpoint(claims) }
    await publish(managedPeer); const managed = await register()
    const externalPeer: BandwidthPeerRef = { kind: "external", enrollmentId: f.externalEndpoint(claims) }
    await publish(externalPeer); const external = await register()
    assert.equal(managed.canonicalNodeId, external.canonicalNodeId)
    assert(occupied.rows.some(row => row.node_id === managed.canonicalNodeId), "safe alias reuses the occupied canonical")
    assert.equal(await f.digest(coreTables), before)
    assert.equal(leaseOpens, 2); assert.equal(physicalDestroys, 2); assert(credentialReads > 0 && rivalChecks > 0)
    checks.push("actual writer composition: original Ed25519 grant before synthetic external Q; genuine localhost managed/external license GET and actual registries reuse the same UNKNOWN-occupied canonical with unchanged journal/owners")
    checks.push("each operation uses one configured physical PID and session-exclusive 8723116 through credentials and registry COMMIT; rival native shared acquisition refuses, raw ownership checks avoid nested source checkout, final owner destroys")
    await publish(externalPeer); removeAfterCommit = true
    await assert.rejects(register(), error => error instanceof BandwidthOperatorWriterFenceUnknown && error.automaticReplay === false)
    assert.equal(removeAfterCommit, false); assert(diagnostic.commitAcknowledged)
    assert.equal(physicalDestroys, 3); assert.equal(await f.digest(coreTables), before)
    const reads = credentialReads, opens = leaseOpens
    syntheticStopped = false; await publish(externalPeer); await assert.rejects(register())
    assert.equal(credentialReads, reads); assert.equal(leaseOpens, opens)
    checks.push("actual acknowledged COMMIT followed by grant withdrawal returns owner UNKNOWN without replay; revoked synthetic external stop rejects before configured lease and credentials; production stop issuer remains absent")
    return checks
  } finally {
    composition.close(); Client.prototype.query = originalQuery; rival.release(true)
    assert.equal(dirname(folder), state); assert(folder.startsWith(state + sep)); await rm(folder, { recursive: true, force: true })
  }
}