import assert from "node:assert/strict"
import { randomUUID } from "node:crypto"
import { fingerprint, privateSecretFingerprint } from "../modules/mcp/security.js"
import { basename, dirname, resolve } from "node:path"
import { readFile, writeFile } from "node:fs/promises"
assert.equal(process.env.MMAPP_OWN_CONTROLLED_SCHEMA_REFERENCE, "true")
const databaseUrl = new URL(process.env.DATABASE_URL ?? "")
assert.equal(databaseUrl.hostname, "127.0.0.1"); assert.equal(databaseUrl.pathname, "/postgres")
assert(process.env.MCP_STATE_DIR && basename(dirname(resolve(process.env.MCP_STATE_DIR))).startsWith("mm-mcp-test-"))
const { Pool } = await import("pg")
const { pool, closePool } = await import("./index.js")
const { applySqlMigrations } = await import("./migrate.js")
const { MIGRATION_MANIFEST } = await import("./migration-manifest.js")
const { initialDatabaseSchemaControlState } = await import("./database-schema-control-model.js")
const { executeControlledSqlMigrations } = await import("./controlled-migrations.js")
const { provisionControlledSchemaReference, readControlledSchemaReference, ControlledSchemaReferenceProvisioningError } = await import("./controlled-schema-reference.js")
const { verifyControlledSchemaCurrentState, CONTROLLED_SCHEMA_VERIFICATION_SQL } = await import("./controlled-schema-verification.js")
const originalConnect = pool.connect.bind(pool), cases: string[] = []
let application: InstanceType<typeof Pool> | undefined
async function owned<T>(work: () => Promise<T>) {
  assert(application)
  pool.connect = application.connect.bind(application) as typeof pool.connect
  try { return await work() } finally { pool.connect = originalConnect as typeof pool.connect }
}
try {
  await applySqlMigrations(pool)
  const name = "mm_reference_app_" + randomUUID().replaceAll("-", "")
  assert(/^mm_reference_app_[a-f0-9]{32}$/.test(name))
  await pool.query('CREATE DATABASE "' + name + '" TEMPLATE template0')
  const url = new URL(databaseUrl); url.pathname = "/" + name
  application = new Pool({ connectionString: url.toString(), max: 6 })
  await application.query("CREATE SCHEMA mmapp_control; CREATE TABLE mmapp_control.database_schema_state(id smallint PRIMARY KEY CHECK(id=1),revision bigint NOT NULL CHECK(revision>=0),state jsonb NOT NULL); CREATE TABLE mmapp_control.database_schema_intents(id uuid PRIMARY KEY,intent jsonb NOT NULL,terminal jsonb)")
  await application.query("INSERT INTO mmapp_control.database_schema_state VALUES(1,0,$1::jsonb)", [JSON.stringify(initialDatabaseSchemaControlState())])
  assert.equal((await owned(executeControlledSqlMigrations)).completedFiles, MIGRATION_MANIFEST.length)
  assert.equal(await readControlledSchemaReference(), null)
  const missing = await owned(verifyControlledSchemaCurrentState)
  assert.equal(missing.referenceStatus, "missing"); assert.equal(missing.ready, false); assert.equal(missing.dataFacts.length, 0)
  cases.push("missing reference never promotes a controlled40 ledger or probes data as trusted schema")
  const before = (await application.query("SELECT count(*)::int AS n FROM pg_database WHERE datname LIKE 'mm_schema_reference_%'")).rows[0].n
  const generated = await owned(provisionControlledSchemaReference)
  assert.equal(generated.referenceDatabaseDropped, true); assert.equal(generated.readyAuthorized, false)
  assert.equal((await application.query("SELECT count(*)::int AS n FROM pg_database WHERE datname LIKE 'mm_schema_reference_%'")).rows[0].n, before)
  const reference = await readControlledSchemaReference(); assert(reference)
  assert.equal(reference.sha256, generated.logicalSchemaSha256)
  assert.equal(reference.format, "pg18-application-schema-v3")
  // Reconstruct the retired v2 algorithm from genuine current raw catalogs.
  // This is test-only: numeric indkey/tombstones and old fast-default-only
  // projection are intentional. Production never upgrades or accepts v2.
  const canonical = (value: unknown): string => Array.isArray(value) ? "[" + value.map(canonical).join(",") + "]"
    : value && typeof value === "object" ? "{" + Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => JSON.stringify(key) + ":" + canonical(item)).join(",") + "}"
      : JSON.stringify(value) ?? "null"
  const sortRows = <T>(rows: T[]): T[] => rows.map(row => canonical(row)).sort().map(row => JSON.parse(row) as T)
  const legacySections = structuredClone(reference.sections)
  legacySections.constraints = sortRows(legacySections.constraints.map(row => Object.fromEntries(Object.entries(row).filter(([key]) => key !== "restore_definition"))))
  const legacyLogical = { ...legacySections, columns: sortRows(legacySections.columns.map(row => Object.fromEntries(Object.entries(row).filter(([key]) => key !== "has_missing" && key !== "missing_value")))) }
  const legacyBody = { format: "pg18-application-schema-v2", scope: reference.scope, serverVersion: reference.serverVersion, sections: legacyLogical }
  const legacySchema = { ...legacyBody, sections: legacySections, observedPhysical: reference.observedPhysical, canonical: canonical(legacyBody), sha256: fingerprint(legacyBody) }
  const compatibilityFile = resolve(process.env.MCP_STATE_DIR!, "database-controlled-schema-reference-v1.json"), v3Bytes = await readFile(compatibilityFile)
  const { signature: _v3Signature, canonicalSha256: _v3Canonical, ...v3Payload } = JSON.parse(v3Bytes.toString("utf8"))
  const v2Payload = { ...v3Payload, schema: legacySchema }, v2Canonical = fingerprint(v2Payload)
  const v2Bytes = Buffer.from(JSON.stringify({ ...v2Payload, canonicalSha256: v2Canonical, signature: await privateSecretFingerprint(v2Canonical, "database-controlled-schema-reference-v1") }) + "\n")
  try {
    await writeFile(compatibilityFile, v2Bytes)
    await assert.rejects(readControlledSchemaReference(), /format\/version/)
    await assert.rejects(owned(provisionControlledSchemaReference))
    assert.deepEqual(await readFile(compatibilityFile), v2Bytes)
  } finally { await writeFile(compatibilityFile, v3Bytes) }
  assert.equal((await readControlledSchemaReference())?.sha256, reference.sha256)
  cases.push("genuine raw-catalog legacy-v2 algorithm and fixed-issuer HMAC cannot bypass v3 refusal or overwrite existing reference; fresh v3 producer remains valid")

  cases.push("fixed producer executes current pins in independently created database and drops only its verified owned UUID before publishing HMAC artifact")
  await assert.rejects(owned(provisionControlledSchemaReference))
  assert.equal((await readControlledSchemaReference())?.sha256, reference.sha256)
  cases.push("existing trusted reference is not overwritten or regenerated by a repeat invocation")
  const matching = await owned(verifyControlledSchemaCurrentState)
  assert.equal(matching.referenceStatus, "matched")
  assert.equal(matching.currentPristineDataInvariants, true, JSON.stringify({ data: matching.dataFacts.filter(f => !f.valid), sequences: matching.sequenceFacts.filter(f => !f.valid) }))
  assert.equal(matching.ready, false); assert.equal(matching.historicalDataEquivalent, false)
  cases.push("actual PG18 current schema matches independent issuer reference; exact pristine data and sequence invariants are checked without READY")
  // Run the genuine fixed predicate on typed, temporary copies of already
  // verified pristine rows. No production trigger is bypassed or altered.
  const epochProbe = await application.connect()
  try {
    for (const table of ["traffic_settings", "uptime_settings", "internet_path_settings"]) {
      await epochProbe.query('CREATE TEMP TABLE mm_owned_epoch_seed AS SELECT * FROM public."' + table + '"')
      const timeFields = ["created_at", "updated_at"]
      const seed = (await epochProbe.query("SELECT pg_catalog.to_jsonb(t)-ARRAY['created_at','updated_at','poll_configuration_epoch'] AS seed FROM pg_temp.mm_owned_epoch_seed t")).rows[0].seed
      const original = CONTROLLED_SCHEMA_VERIFICATION_SQL.seed(table)
      const relation = 'FROM public."' + table + '"'
      assert.equal(original.split(relation).length, 2)
      const probe = original.replace(relation, 'FROM pg_temp.mm_owned_epoch_seed')
      const check = async () => (await epochProbe.query(probe, [JSON.stringify(seed), timeFields])).rows[0].valid
      assert.equal(await check(), true)
      for (const epoch of [null, "00000000-0000-0000-0000-000000000000", "12345678-1234-1234-9234-123456789abc", "12345678-1234-4234-7234-123456789abc"]) {
        await epochProbe.query("UPDATE pg_temp.mm_owned_epoch_seed SET poll_configuration_epoch=$1::uuid", [epoch])
        assert.equal(await check(), false)
      }
      await epochProbe.query("UPDATE pg_temp.mm_owned_epoch_seed SET poll_configuration_epoch=pg_catalog.gen_random_uuid()")
      assert.equal(await check(), true)
      await epochProbe.query("UPDATE pg_temp.mm_owned_epoch_seed SET enabled=false")
      assert.equal(await check(), false)
      await epochProbe.query("UPDATE pg_temp.mm_owned_epoch_seed SET enabled=true")
      await epochProbe.query("ALTER TABLE pg_temp.mm_owned_epoch_seed ADD COLUMN unrelated_field integer DEFAULT 1")
      assert.equal(await check(), false)
      await epochProbe.query("DROP TABLE pg_temp.mm_owned_epoch_seed")
    }
  } finally { epochProbe.release(true) }
  assert(matching.gaps.includes("NONDETERMINISTIC_POLL_EPOCH_ORIGIN_UNATTESTED"))
  cases.push("actual typed SQL epoch predicates accept UUIDv4 only for three0042 seeds; null/nil/version/variant, changed settings and unknown columns refuse without historical-origin authority")
  await application.query("INSERT INTO public.servers(host) VALUES('192.0.2.1')")
  const changedData = await owned(verifyControlledSchemaCurrentState)
  assert.equal(changedData.referenceStatus, "matched"); assert.equal(changedData.currentPristineDataInvariants, false)
  assert(changedData.dataFacts.some(f => f.table === "servers" && !f.valid)); assert(changedData.sequenceFacts.some(f => !f.valid))
  cases.push("actual added application row and advanced identity sequence fail pristine data evidence despite equal DDL")
  await application.query("ALTER TABLE public.servers ADD COLUMN mm_owned_schema_drift integer")
  const drift = await owned(verifyControlledSchemaCurrentState)
  assert.equal(drift.referenceStatus, "different"); assert.equal(drift.dataFacts.length, 0)
  cases.push("actual schema drift refuses trusted match before any data-probe classification")
  const file = resolve(process.env.MCP_STATE_DIR!, "database-controlled-schema-reference-v1.json"), original = await readFile(file)
  const oldEnvelope = JSON.parse(original.toString("utf8")); oldEnvelope.prefixLength = 39
  await writeFile(file, JSON.stringify(oldEnvelope))
  await assert.rejects(readControlledSchemaReference(), /artifact envelope/)
  await writeFile(file, original)
  cases.push("historical39 reference envelope cannot be promoted to current40 by startup or restore")
  const fake = JSON.parse(original.toString("utf8")); fake.signature = "f".repeat(64)
  await writeFile(file, JSON.stringify(fake))
  await assert.rejects(readControlledSchemaReference())
  const untrusted = await owned(verifyControlledSchemaCurrentState)
  assert.equal(untrusted.referenceStatus, "invalid"); assert.equal(untrusted.dataFacts.length, 0); assert.equal(untrusted.ready, false)
  await writeFile(file, original)
  cases.push("forged artifact signature is refused by fixed reader and never authorizes data verification")
  const initialStateDirectory = process.env.MCP_STATE_DIR!, faultDirectory = resolve(initialStateDirectory, "owned-reference-create-ack-loss")
  let uncertainName = "", creates = 0, drops = 0
  process.env.MCP_STATE_DIR = faultDirectory
  pool.connect = (async () => {
    const client = await application!.connect()
    return { release(destroy?: boolean) { client.release(destroy) }, async query(text: string, values?: unknown[]) {
      if (text.startsWith("DROP DATABASE ")) drops++
      const result = await client.query(text, values)
      if (text.startsWith('CREATE DATABASE "mm_schema_reference_')) {
        const match = /^CREATE DATABASE "(mm_schema_reference_[a-f0-9]{32})"/.exec(text); assert(match)
        uncertainName = match[1]; creates++
        throw Error("Owned fixture lost actual reference CREATE acknowledgement")
      }
      return result
    } }
  }) as typeof pool.connect
  try {
    await assert.rejects(provisionControlledSchemaReference(), (error: unknown) => error instanceof ControlledSchemaReferenceProvisioningError && error.referenceDatabase === uncertainName && error.phase === "create-unknown" && !error.publicationAttempted && !error.automaticRetry)
    assert.equal(creates, 1); assert.equal(drops, 0); assert.equal(await readControlledSchemaReference(), null)
  } finally { pool.connect = originalConnect as typeof pool.connect; process.env.MCP_STATE_DIR = initialStateDirectory }
  assert(/^mm_schema_reference_[a-f0-9]{32}$/.test(uncertainName))
  const orphan = (await application.query("SELECT datname,pg_get_userbyid(datdba)=current_user AS owned FROM pg_database WHERE datname=$1", [uncertainName])).rows
  assert.deepEqual(orphan, [{ datname: uncertainName, owned: true }])
  // Explicit test-owner cleanup after independently proving the exact UUID.
  // The production producer itself never retries or force-cleans unknown CREATE.
  await application.query('DROP DATABASE "' + uncertainName + '"')
  cases.push("actual CREATE with lost ACK publishes no reference and never retries or drops uncertain database; test owner independently cleans verified UUID")
  console.log("Owned controlled schema reference SQL:", JSON.stringify({ cases: cases.length, names: cases, actualSql: true, referenceGeneratedByRealProducer: true, independentPinnedFiles: MIGRATION_MANIFEST.length, applicationPinnedFiles: MIGRATION_MANIFEST.length, readyAuthorized: false, startupWired: false, productionDatabaseTouched: false }))
} finally {
  pool.connect = originalConnect as typeof pool.connect
  await application?.end()
  await closePool()
}