import assert from "node:assert/strict";
import { test } from "node:test";
import { build } from "esbuild";

const bundle = await build({
  stdin: {
    contents: `
      export * as Effect from 'effect/Effect';
      export * as Exit from 'effect/Exit';
      export * as Cause from 'effect/Cause';
      export { DomainAPI } from './control-plane/domain-api.ts';
      export { domainErrors } from './control-plane/domain-metadata.ts';
      export * from './control-plane/domain-errors.ts';
      export * from './control-plane/workflow-boundary.ts';
      export * from './control-plane/domain-operations.ts';
      export { InstallationConflict } from './control-plane/installation-errors.ts';
    `,
    resolveDir: process.cwd(),
  },
  bundle: true,
  format: "esm",
  platform: "node",
  write: false,
});
const {
  Effect,
  Exit,
  Cause,
  DomainAPI,
  domainErrors,
  domainFailure,
  DomainResourceConflict,
  DomainAccountDenied,
  DomainReauthorizationRequired,
  DomainTemporarilyUnavailable,
  runDomainStep,
  attachDomain,
  checkDomainHttps,
  InstallationConflict,
} = await import(
  `data:text/javascript;base64,${Buffer.from(bundle.outputFiles[0].text).toString("base64")}`
);

const domain = {
  revision: 1,
  status: "connecting",
  hostname: "bot.example.com",
  origin: "https://bot.example.com",
  zoneId: "c".repeat(32),
  domainId: null,
  writeIntent: false,
  errorCode: null,
};
const domainId = "d".repeat(40);
const record = {
  accountId: "a".repeat(32),
  resources: { workerName: "worker" },
};

test("domain steps persist safe terminal codes and throw only safe transient codes", async () => {
  assert.deepEqual(await runDomainStep(Effect.void), { error: null });
  for (const code of domainErrors.options) {
    const failure = domainFailure(code);
    failure.privateContent = "private-sentinel";
    const program = Effect.fail(failure);
    const exit = await Effect.runPromiseExit(program);
    assert.ok(Exit.isFailure(exit));
    assert.equal(Exit.findErrorOption(exit).value, failure);
    if (code === "temporarily_unavailable") {
      await assert.rejects(runDomainStep(program), (error) => {
        assert.equal(error.message, code);
        assert.equal(error.privateContent, undefined);
        return true;
      });
    } else assert.deepEqual(await runDomainStep(program), { error: code });
  }
  for (const program of [
    Effect.die(new Error("private-sentinel")),
    Effect.fail(new InstallationConflict()),
  ])
    await assert.rejects(runDomainStep(program), {
      message: "temporarily_unavailable",
    });
});

test("domain provider operations are lazy, preserve native fetch receiver and classify HTTP failures", async () => {
  for (const [status, code] of [
    [401, "reauthorization_required"],
    [403, "account_denied"],
    [409, "resource_conflict"],
    [500, "temporarily_unavailable"],
    [200, "temporarily_unavailable"],
  ]) {
    let calls = 0;
    const api = new DomainAPI("private-token", record, async function (
      _url,
      init,
    ) {
      assert.equal(this, undefined);
      assert.equal(init.redirect, "manual");
      calls++;
      return Response.json({ invalid: "private-sentinel" }, { status });
    });
    const program = api.zones();
    assert.equal(calls, 0);
    await assert.rejects(Effect.runPromise(program), (error) => {
      assert.equal(error.code, code);
      assert.ok(!JSON.stringify(error).includes("private-sentinel"));
      return true;
    });
    assert.equal(calls, 1);
  }
});

test(
  "interrupting a domain body read aborts the provider request",
  { timeout: 5000 },
  async () => {
    let consuming;
    const started = new Promise((resolve) => {
      consuming = resolve;
    });
    let requestSignal;
    const api = new DomainAPI("token", record, async (_url, init) => {
      requestSignal = init.signal;
      return new Response(
        new ReadableStream(
          {
            start(controller) {
              init.signal.addEventListener(
                "abort",
                () => controller.error(new Error("aborted")),
                { once: true },
              );
            },
            pull() {
              consuming();
            },
          },
          { highWaterMark: 0 },
        ),
      );
    });
    const controller = new AbortController();
    const running = Effect.runPromiseExit(api.zones(), {
      signal: controller.signal,
    });
    await started;
    controller.abort();
    const exit = await running;
    assert.ok(Exit.isFailure(exit));
    assert.ok(Cause.hasInterrupts(exit.cause));
    assert.equal(requestSignal.aborted, true);
  },
);

function fixture(attach = Effect.void) {
  const events = [];
  let saved = { ...domain };
  return {
    events,
    saved: () => saved,
    api: {
      preflight: () =>
        Effect.sync(() => {
          events.push("preflight");
        }),
      attach: (value) =>
        Effect.gen(function* () {
          assert.equal(value.writeIntent, true);
          events.push("PUT");
          yield* attach;
        }),
      find: () =>
        Effect.sync(() => {
          events.push("find");
          return domainId;
        }),
    },
    save: (value, changes) =>
      Effect.sync(() => {
        events.push({ ...changes });
        saved = { ...value, ...changes, revision: value.revision + 1 };
        return saved;
      }),
  };
}

test("attachment commits intent before PUT and checkpoints only the observed domain", async () => {
  const f = fixture();
  const program = attachDomain(f.api, domain, f.save);
  assert.deepEqual(f.events, []);
  await Effect.runPromise(program);
  assert.deepEqual(f.events, [
    "preflight",
    { writeIntent: true },
    "PUT",
    "find",
    { domainId },
  ]);
  assert.equal(f.saved().domainId, domainId);
});

test("only definitive attachment rejections clear intent", async () => {
  for (const ErrorType of [
    DomainResourceConflict,
    DomainAccountDenied,
    DomainReauthorizationRequired,
  ]) {
    const failure = new ErrorType();
    const f = fixture(Effect.fail(failure));
    await assert.rejects(
      Effect.runPromise(attachDomain(f.api, domain, f.save)),
      { code: failure.code },
    );
    assert.deepEqual(f.events, [
      "preflight",
      { writeIntent: true },
      "PUT",
      { writeIntent: false, status: "failed", errorCode: failure.code },
    ]);
  }
  for (const failure of [
    Effect.fail(new DomainTemporarilyUnavailable()),
    Effect.die(new Error("lost-reply")),
    Effect.interrupt,
  ]) {
    const f = fixture(failure);
    const exit = await Effect.runPromiseExit(
      attachDomain(f.api, domain, f.save),
    );
    assert.ok(Exit.isFailure(exit));
    assert.equal(f.saved().writeIntent, true);
    assert.deepEqual(f.events, ["preflight", { writeIntent: true }, "PUT"]);
  }
});

test("failed intent never PUTs and uncertain attachments are observed without a second PUT", async () => {
  const failed = fixture();
  await assert.rejects(
    Effect.runPromise(
      attachDomain(failed.api, domain, () =>
        Effect.fail(new InstallationConflict()),
      ),
    ),
    { code: "installation_conflict" },
  );
  assert.deepEqual(failed.events, ["preflight"]);
  for (const found of [null, domainId]) {
    const f = fixture();
    f.api.find = () => Effect.succeed(found);
    const program = attachDomain(
      f.api,
      { ...domain, writeIntent: true },
      f.save,
    );
    if (found) await Effect.runPromise(program);
    else
      await assert.rejects(Effect.runPromise(program), {
        code: "attachment_outcome_unknown",
      });
    assert.ok(!f.events.includes("PUT"));
    assert.ok(!f.events.includes("preflight"));
  }
});

test("HTTPS readiness tolerates health failures but never hides mapping failures", async () => {
  const saved = { ...domain, domainId };
  for (const health of [
    Effect.fail(new DomainTemporarilyUnavailable()),
    Effect.die(new Error("TLS pending")),
  ]) {
    assert.equal(
      await Effect.runPromise(
        checkDomainHttps(
          { find: () => Effect.succeed(domainId) },
          saved,
          health,
        ),
      ),
      false,
    );
  }
  assert.equal(
    await Effect.runPromise(
      checkDomainHttps(
        { find: () => Effect.succeed(domainId) },
        saved,
        Effect.void,
      ),
    ),
    true,
  );
  for (const lookup of [
    Effect.succeed("foreign-domain"),
    Effect.fail(new DomainReauthorizationRequired()),
  ]) {
    let checkedHealth = false;
    const exit = await Effect.runPromiseExit(
      checkDomainHttps(
        { find: () => lookup },
        saved,
        Effect.sync(() => {
          checkedHealth = true;
        }),
      ),
    );
    assert.ok(Exit.isFailure(exit));
    assert.equal(checkedHealth, false);
  }
});