/**
 * OFFLINE image runtime gate: exercise the shipped Photon/WASM resize core and
 * actual worker, with file modules confined to the standalone payload. No app,
 * provider, canvas, or network needed; a tiny synthetic PNG is generated here.
 *
 * node scripts/smoke-image-runtime.mjs [--standalone <dir>] [--runtime <Node/Electron>]
 */
import assert from "node:assert/strict";
import { spawnSync } from "node:child_process";
import * as fs from "node:fs";
import { createRequire } from "node:module";
import * as os from "node:os";
import * as path from "node:path";
import { fileURLToPath, pathToFileURL } from "node:url";
import { Worker } from "node:worker_threads";
import { deflateSync } from "node:zlib";
import { formatProbeError, probeEnv } from "./smoke-demo-runtime.mjs";

export function verifyImageRuntime(standalone, runtime = process.execPath) {
	const home = fs.mkdtempSync(path.join(os.tmpdir(), "lh-image-runtime-"));
	try {
		fs.writeFileSync(path.join(home, "auth.json"), "{}\n", { mode: 0o600 });
		const result = spawnSync(runtime, [fileURLToPath(import.meta.url), "--probe", path.resolve(standalone)], {
			cwd: home,
			env: { ...probeEnv(process.env, home), ELECTRON_RUN_AS_NODE: "1" },
			encoding: "utf8", timeout: 30_000, killSignal: "SIGKILL", maxBuffer: 128 * 1024,
		});
		if (result.status !== 0 || result.error) {
			throw new Error(`image runtime probe failed (${result.error?.message ?? result.status}):\n${result.stdout ?? ""}${result.stderr ?? ""}`);
		}
		assert.match(result.stdout, /Photon in-process and worker resizing passed/, "probe exited without success marker");
		process.stdout.write(result.stdout);
	} finally { fs.rmSync(home, { recursive: true, force: true }); }
}

// Self-contained so the eval worker can install the SAME guards using only
// builtins, before importing any payload module. Module hooks do not otherwise
// propagate from the dedicated probe process into Worker threads.
function installGuards(require, standalone) {
	const assert = require("node:assert/strict");
	const fs = require("node:fs");
	const path = require("node:path");
	const { fileURLToPath } = require("node:url");
	const { registerHooks, syncBuiltinESMExports } = require("node:module");
	const root = fs.realpathSync(standalone);
	const inside = (file) => {
		const real = fs.realpathSync(file);
		const relative = path.relative(root, real);
		assert.ok(relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative),
			`dependency escaped standalone payload: ${file}`);
		return real;
	};
	const photonRoot = path.join(root, "node_modules/@silvia-odwyer/photon-node");
	const manifest = JSON.parse(fs.readFileSync(inside(path.join(photonRoot, "package.json")), "utf8"));
	assert.equal(manifest.version, "0.3.4", "unexpected Photon engine version");
	const photonEntry = inside(path.join(photonRoot, "photon_rs.js"));
	const photonWasm = inside(path.join(photonRoot, "photon_rs_bg.wasm"));
	assert.ok(fs.statSync(photonWasm).size > 0, "empty Photon WASM asset");
	let attempts = 0;
	const deny = () => { attempts++; throw new Error("OFFLINE image gate: network forbidden"); };
	globalThis.fetch = deny;
	globalThis.WebSocket = class { constructor() { deny(); } };
	for (const [name, methods] of [
		["http", ["request", "get"]], ["https", ["request", "get"]],
		["net", ["connect", "createConnection"]], ["tls", ["connect"]],
		["dgram", ["createSocket"]],
		["dns", ["lookup", "resolve", "resolve4", "resolve6", "resolveAny", "reverse"]],
		["dns/promises", ["lookup", "resolve", "resolve4", "resolve6", "resolveAny", "reverse"]],
	]) {
		const module = require(`node:${name}`);
		for (const method of methods) module[method] = deny;
	}
	require("node:net").Socket.prototype.connect = deny;
	const loaded = new Set();
	const wasmReads = new Set();
	const originalRead = fs.readFileSync;
	fs.readFileSync = function (file, ...args) {
		const filename = file instanceof URL ? fileURLToPath(file) : file;
		const wasmFile = typeof filename === "string" && filename.endsWith(".wasm") ? inside(filename) : null;
		const bytes = originalRead.call(this, file, ...args);
		if (wasmFile) wasmReads.add(wasmFile);
		return bytes;
	};
	syncBuiltinESMExports();
	const hooks = registerHooks({
		resolve(specifier, context, nextResolve) {
			const result = nextResolve(specifier, context);
			if (result.url.startsWith("file:")) loaded.add(inside(fileURLToPath(result.url)));
			else assert.ok(result.url.startsWith("node:"), `unexpected dependency URL: ${result.url}`);
			return result;
		},
	});
	return {
		report() {
			assert.equal(attempts, 0, "image runtime attempted network access");
			assert.ok(loaded.has(photonEntry), "Photon JS was not loaded from the payload");
			assert.ok(wasmReads.has(photonWasm), "Photon WASM was not loaded from the payload");
			return { modules: loaded.size, wasmFiles: [...wasmReads], networkAttempts: attempts };
		},
		cleanup() {
			hooks.deregister();
			fs.readFileSync = originalRead;
			syncBuiltinESMExports();
		},
	};
}

/** Pure Node 2×2 RGBA PNG, with valid PNG CRCs and zlib image data. */
function fixturePng() {
	const chunk = (type, data) => {
		const buffer = Buffer.alloc(data.length + 12);
		buffer.writeUInt32BE(data.length);
		buffer.write(type, 4, "ascii");
		data.copy(buffer, 8);
		let crc = ~0;
		for (const byte of buffer.subarray(4, -4)) {
			crc ^= byte;
			for (let bit = 0; bit < 8; bit++) crc = (crc >>> 1) ^ (0xedb88320 & -(crc & 1));
		}
		buffer.writeUInt32BE(~crc >>> 0, buffer.length - 4);
		return buffer;
	};
	const header = Buffer.alloc(13);
	header.writeUInt32BE(2, 0);
	header.writeUInt32BE(2, 4);
	header[8] = 8; // bit depth
	header[9] = 6; // RGBA
	const pixels = Buffer.from([
		0, 255, 0, 0, 255, 0, 255, 0, 255,
		0, 0, 0, 255, 255, 255, 255, 255, 255,
	]);
	return Buffer.concat([Buffer.from("89504e470d0a1a0a", "hex"), chunk("IHDR", header), chunk("IDAT", deflateSync(pixels)), chunk("IEND", Buffer.alloc(0))]);
}

function assertResized(result) {
	assert.ok(result, "resize returned null (missing/broken Photon must not silently pass)");
	assert.equal(result.originalWidth, 2);
	assert.equal(result.originalHeight, 2);
	assert.equal(result.width, 1);
	assert.equal(result.height, 1);
	assert.equal(result.wasResized, true);
	assert.equal(result.mimeType, "image/png");
	const png = Buffer.from(result.data, "base64");
	assert.equal(png.subarray(0, 8).toString("hex"), "89504e470d0a1a0a");
	assert.equal(png.readUInt32BE(16), 1);
	assert.equal(png.readUInt32BE(20), 1);
}

async function probeWorker(root, inputBytes, options, responseType) {
	const readyType = "lh:image-runtime-ready";
	const worker = new Worker(`
		const { parentPort, workerData } = require("node:worker_threads");
		const guards = (${installGuards.toString()})(require, workerData.root);
		const post = parentPort.postMessage.bind(parentPort);
		parentPort.postMessage = (message, ...args) => {
			if (message?.type === workerData.responseType) {
				post({ ...message, runtimeProof: guards.report() }, ...args);
			} else post(message, ...args);
		};
		void import(workerData.entry).then(() => post({ type: workerData.readyType }));
	`, {
		eval: true,
		workerData: { root, responseType, readyType, entry: pathToFileURL(path.join(root, "src/agent/image-processing/resize-worker.mjs")).href },
	});
	try {
		return await new Promise((resolve, reject) => {
			const timer = setTimeout(() => reject(new Error("image resize worker timed out")), 10_000);
			const fail = (error) => { clearTimeout(timer); reject(error); };
			let ready = false;
			worker.once("error", fail);
			worker.once("exit", (code) => fail(new Error(`image resize worker exited before response: ${code}`)));
			worker.on("message", (message) => {
				try {
					if (message?.type === readyType) {
						assert.equal(ready, false, "duplicate worker READY");
						ready = true;
						worker.postMessage({ inputBytes, mimeType: "image/png", options });
					} else if (message?.type === responseType) {
						assert.equal(ready, true, "worker replied before its import completed");
						assert.equal(message.error, undefined, `worker resize failed: ${message.error}`);
						assertResized(message.result);
						assert.ok(message.runtimeProof?.modules > 0, "missing worker module-confinement proof");
						assert.equal(message.runtimeProof.networkAttempts, 0);
						assert.equal(message.runtimeProof.wasmFiles.length, 1);
						clearTimeout(timer);
						resolve(message.runtimeProof);
					}
				} catch (error) { fail(error); }
			});
		});
	} finally { await worker.terminate(); }
}

async function probe(standalone) {
	const root = fs.realpathSync(standalone);
	const guards = installGuards(createRequire(import.meta.url), root);
	try {
		const entry = pathToFileURL(path.join(root, "src/agent/image-processing/resize-core.mjs"));
		const { resizeImageInProcess, IMAGE_RESIZE_WORKER_RESPONSE_TYPE } = await import(entry.href);
		assert.equal(typeof resizeImageInProcess, "function");
		assert.equal(IMAGE_RESIZE_WORKER_RESPONSE_TYPE, "pi:image-resize-response");
		const input = fixturePng();
		const options = { maxWidth: 1, maxHeight: 1, maxBytes: 1024 * 1024 };
		assertResized(await resizeImageInProcess(input, "image/png", options));
		const inProcess = guards.report();
		console.log(`[smoke-image-runtime] shipped resize core: PNG 2×2 → 1×1; ${inProcess.modules} modules and Photon WASM confined to ${root}`);
		const worker = await probeWorker(root, input, options, IMAGE_RESIZE_WORKER_RESPONSE_TYPE);
		guards.report();
		console.log(`[smoke-image-runtime] shipped resize worker: READY then tagged PNG 2×2 → 1×1; ${worker.modules} modules and Photon WASM confined to ${root}`);
		console.log("[smoke-image-runtime] Photon in-process and worker resizing passed; zero network attempts");
	} finally { guards.cleanup(); }
}

async function main() {
	const args = process.argv.slice(2);
	if (args[0] === "--probe") return probe(args[1]);
	const value = (name, fallback) => {
		const index = args.indexOf(name);
		if (index < 0) return fallback;
		assert.ok(args[index + 1] && !args[index + 1].startsWith("--"), `${name} requires a path`);
		return path.resolve(args[index + 1]);
	};
	verifyImageRuntime(value("--standalone", path.resolve(import.meta.dirname, "../.next/standalone")), value("--runtime", process.execPath));
}

if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
	main().catch((error) => { console.error(`[smoke-image-runtime] FAIL: ${formatProbeError(error)}`); process.exitCode = 1; });
}