/** Proof for: a negative settled_spend lowers cap_charge and today's spend. Fails on the current code. */
import { describe, expect, it } from "vitest";
import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { main, type IO } from "../../src/cli.js";
import { MockProvider, type CompleteReq, type CompleteRes, type Provider } from "../../src/providers.js";

const SEAT = "42";
const tmpHome = () => mkdtempSync(join(tmpdir(), "imd-flop-proof-"));
async function cli(home: string, args: string[], extra: Partial<IO> = {}) {
  const out: string[] = [];
  const err: string[] = [];
  const code = await main(args, { out: (s) => out.push(s), err: (s) => err.push(s), env: { IMD_FLOP_HOME: home }, ...extra });
  return { code, out: out.join("\n"), err: err.join("\n"), json: () => JSON.parse(out.join("\n")) };
}
const readLines = (p: string) => readFileSync(p, "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l));
async function readySeat(home: string, cap = "1") {
  await cli(home, ["init", "--seat", SEAT]);
  await cli(home, ["link", "--token", SEAT, "--agent", "7"]);
  await cli(home, ["cap", "set", cap]);
}
const rpc = (obj: unknown, status = 200) => new Response(JSON.stringify(obj), { status, headers: { "content-type": "application/json" } });
/** Completion is the plain mock; the receipt is scripted. */
class ReceiptProvider implements Provider {
  readonly name = "mock" as const;
  calls = 0;
  private inner = new MockProvider("ok");
  constructor(private settled: number | null, private state: "reserved" | "estimated" | "settled" | "released") {}
  estimate(b: { model: string; prompt: string; max_tokens: number }) { return this.inner.estimate(b); }
  async complete(req: CompleteReq): Promise<CompleteRes> { this.calls++; return this.inner.complete(req); }
  async readReceipt(requestId: string) {
    const rr = await this.inner.readReceipt(requestId);
    return { ...rr, receipt: { ...rr.receipt!, settled_spend: this.settled, state: this.state } };
  }
}
const RUN = (job: string) => ["run", "--seat", SEAT, "--job", job, "--prompt", "Say hi", "--max-tokens", "8", "--provider", "mock", "--json"];
describe("cap_charge never goes below zero", () => {
  it("a receipt with settled_spend -100 must not lower the daily total or be accepted as a charge", async () => {
    const h = tmpHome();
    await readySeat(h, "1");
    const a = await cli(h, RUN("neg"), { provider: new ReceiptProvider(-100, "settled") });
    expect(a.code).toBe(0);
    // Expected: a negative settlement is malformed; the charge stays at the padded quote (0.18), never below 0.
    expect(a.json().cap_charge).toBeGreaterThanOrEqual(0);
    const st = await cli(h, ["status", "--seat", SEAT, "--json"]);
    expect(st.json().today_utc.mock).toBeGreaterThanOrEqual(0);
    const b = await cli(h, RUN("after-neg"), { provider: new ReceiptProvider(null, "estimated") });
    const rows = readLines(join(h, "ledger.jsonl")) as { job: string; spent_before: number | null }[];
    expect(rows.find((r) => r.job === "after-neg")!.spent_before).toBeGreaterThanOrEqual(0);
    expect(b.code).toBe(0);
  });
});

/** Proof for: settled_spend 0 on a receipt still in state "estimated" is charged as 0. Fails on the current code. */
import { describe, expect, it } from "vitest";
import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { main, type IO } from "../../src/cli.js";
import { MockProvider, type CompleteReq, type CompleteRes, type Provider } from "../../src/providers.js";

const SEAT = "42";
const tmpHome = () => mkdtempSync(join(tmpdir(), "imd-flop-proof-"));
async function cli(home: string, args: string[], extra: Partial<IO> = {}) {
  const out: string[] = [];
  const err: string[] = [];
  const code = await main(args, { out: (s) => out.push(s), err: (s) => err.push(s), env: { IMD_FLOP_HOME: home }, ...extra });
  return { code, out: out.join("\n"), err: err.join("\n"), json: () => JSON.parse(out.join("\n")) };
}
const readLines = (p: string) => readFileSync(p, "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l));
async function readySeat(home: string, cap = "1") {
  await cli(home, ["init", "--seat", SEAT]);
  await cli(home, ["link", "--token", SEAT, "--agent", "7"]);
  await cli(home, ["cap", "set", cap]);
}
const rpc = (obj: unknown, status = 200) => new Response(JSON.stringify(obj), { status, headers: { "content-type": "application/json" } });
/** Completion is the plain mock; the receipt is scripted. */
class ReceiptProvider implements Provider {
  readonly name = "mock" as const;
  calls = 0;
  private inner = new MockProvider("ok");
  constructor(private settled: number | null, private state: "reserved" | "estimated" | "settled" | "released") {}
  estimate(b: { model: string; prompt: string; max_tokens: number }) { return this.inner.estimate(b); }
  async complete(req: CompleteReq): Promise<CompleteRes> { this.calls++; return this.inner.complete(req); }
  async readReceipt(requestId: string) {
    const rr = await this.inner.readReceipt(requestId);
    return { ...rr, receipt: { ...rr.receipt!, settled_spend: this.settled, state: this.state } };
  }
}
const RUN = (job: string) => ["run", "--seat", SEAT, "--job", job, "--prompt", "Say hi", "--max-tokens", "8", "--provider", "mock", "--json"];
describe("an unresolved receipt keeps the reservation", () => {
  it("settled_spend 0 with state estimated must keep cap_charge at the padded quote", async () => {
    const h = tmpHome();
    await readySeat(h, "1");
    const r = await cli(h, RUN("zero-pending"), { provider: new ReceiptProvider(0, "estimated") });
    expect(r.code).toBe(0);
    const rows = readLines(join(h, "ledger.jsonl")) as { state: string; cap_charge: number; quote_padded: number }[];
    const latest = rows.at(-1)!;
    expect(latest.state).toBe("estimated"); // the receipt itself says spend is not settled
    // Expected: while the receipt state is not settled/released, the reservation (0.18) stays.
    expect(latest.cap_charge).toBe(latest.quote_padded);
    const st = await cli(h, ["status", "--seat", SEAT, "--json"]);
    expect(st.json().today_utc.mock).toBe(latest.quote_padded);
  });
});

/** Proof for: the run deadline does not cover the pre-mint recheck; a child key is minted after it. Fails on the current code. */
import { describe, expect, it } from "vitest";
import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { main, type IO } from "../../src/cli.js";
import { MockProvider, type CompleteReq, type CompleteRes, type Provider } from "../../src/providers.js";

const SEAT = "42";
const tmpHome = () => mkdtempSync(join(tmpdir(), "imd-flop-proof-"));
async function cli(home: string, args: string[], extra: Partial<IO> = {}) {
  const out: string[] = [];
  const err: string[] = [];
  const code = await main(args, { out: (s) => out.push(s), err: (s) => err.push(s), env: { IMD_FLOP_HOME: home }, ...extra });
  return { code, out: out.join("\n"), err: err.join("\n"), json: () => JSON.parse(out.join("\n")) };
}
const readLines = (p: string) => readFileSync(p, "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l));
async function readySeat(home: string, cap = "1") {
  await cli(home, ["init", "--seat", SEAT]);
  await cli(home, ["link", "--token", SEAT, "--agent", "7"]);
  await cli(home, ["cap", "set", cap]);
}
const rpc = (obj: unknown, status = 200) => new Response(JSON.stringify(obj), { status, headers: { "content-type": "application/json" } });
import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";
import { NETWORKS } from "../../src/networks.js";
import { gatewayKeyFile } from "../../src/paths.js";
import { writeSecretFile } from "../../src/store.js";
import { clearSecretRegistry } from "../../src/secrets.js";
import type { LinkFile } from "../../src/link.js";

const PIN = NETWORKS.devnet.genesisHash;
const ETH = "https://eth.example/rpc";
async function signHolder(h: string): Promise<string> {
  const file = join(h, "seats", SEAT, "link.json");
  const link = JSON.parse(readFileSync(file, "utf8")) as LinkFile;
  const wallet = privateKeyToAccount(generatePrivateKey());
  const td = link.eip712;
  const sig = await wallet.signTypedData({ domain: td.domain, types: td.types, primaryType: td.primaryType, message: { ...td.message, tokenId: BigInt(td.message.tokenId), issuedAt: BigInt(td.message.issuedAt) } });
  writeFileSync(file, JSON.stringify({ ...link, wallet: { address: wallet.address, signature: sig } }));
  return wallet.address;
}
type Seen = { url: string; method?: string };
/** Offline stand-in for every HTTP endpoint the paid run touches. Paid inference is never answered. */
function paidFetch(owner: string, seen: Seen[], opts: { faucetDelayMs?: number }): typeof fetch {
  return (async (input: unknown, init?: RequestInit) => {
    if (init?.signal?.aborted) throw init.signal.reason; // fetch spec: already-aborted signal sends nothing
    const url = String(input);
    let method: string | undefined;
    if (init?.body) { try { method = (JSON.parse(String(init.body)) as { method?: string }).method; } catch { /* not json */ } }
    seen.push({ url, method });
    if (method === "eth_chainId") return rpc({ jsonrpc: "2.0", id: 1, result: "0x1" });
    if (method === "eth_call") return rpc({ jsonrpc: "2.0", id: 1, result: "0x" + "0".repeat(24) + owner.slice(2).toLowerCase() });
    if (url.endsWith("/chain")) { if (opts.faucetDelayMs) await new Promise((r) => setTimeout(r, opts.faucetDelayMs)); return rpc({ genesisHash: PIN }); }
    if (url.endsWith("/models/estimate")) return rpc({ estimated_cost_flop: 0.012, estimated_input_tokens: 1, estimated_output_tokens: 1 });
    if (url.endsWith("/keys/ephemeral")) return rpc({ token: "flop_ek_" + "a".repeat(40), expires_at: 0 }, 201);
    if (url.includes("/chat/completions")) throw new Error(`paid inference ${url}`);
    throw new Error(`unexpected url ${url}`);
  }) as typeof fetch;
}
/** Fake devnet WebSocket RPC; `answer` is called with the socket index (0 = the up-front gate, 1 = the pre-mint recheck). */
function withWs<T>(answer: (socketIndex: number) => string, fn: () => Promise<T>): Promise<T> {
  const real = globalThis.WebSocket;
  let n = 0;
  class FakeWS {
    onopen?: () => void;
    onmessage?: (ev: { data: string }) => void;
    private idx = n++;
    constructor() { setTimeout(() => this.onopen?.(), 0); }
    send() { setTimeout(() => this.onmessage?.({ data: answer(this.idx) }), 0); }
    close() {}
  }
  (globalThis as { WebSocket: unknown }).WebSocket = FakeWS;
  return fn().finally(() => { globalThis.WebSocket = real; });
}
const PAID = (extra: string[] = []) => ["run", "--job", "job-abc", "--prompt", "Say hi", "--max-tokens", "8", "--provider", "flop", "--live", ...extra];
describe("the run deadline covers the pre-mint recheck", () => {
  it("when --timeout-ms expires during the recheck, no child key is minted and the ledger does not claim unknown spend", async () => {
    const h = tmpHome();
    await readySeat(h);
    const owner = await signHolder(h);
    writeSecretFile(gatewayKeyFile(h, SEAT), "test-gateway-bearer\n");
    const seen: Seen[] = [];
    try {
      const r = await withWs(() => JSON.stringify({ result: PIN }), () =>
        cli(h, PAID(["--timeout-ms", "20"]), { fetch: paidFetch(owner, seen, { faucetDelayMs: 40 }), env: { IMD_FLOP_HOME: h, ETH_RPC_URL: ETH } }),
      );
      expect(seen.some((s) => s.url.includes("/chat/completions"))).toBe(false); // nothing was sent (holds today)
      // Expected: a deadline that passed before the mint means no mint and no "spend unknown" row.
      expect(seen.some((s) => s.url.endsWith("/keys/ephemeral"))).toBe(false);
      const rows = readLines(join(h, "ledger.jsonl")) as { state: string; cap_charge: number }[];
      expect(rows.at(-1)!.state).not.toBe("timeout_unknown");
      expect(r.code).not.toBe(6);
    } finally {
      clearSecretRegistry();
    }
  });
});

/** Proof for: remote RPC error text can make the refused_local ledger line unwritable. Fails on the current code. */
import { describe, expect, it } from "vitest";
import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { main, type IO } from "../../src/cli.js";
import { MockProvider, type CompleteReq, type CompleteRes, type Provider } from "../../src/providers.js";

const SEAT = "42";
const tmpHome = () => mkdtempSync(join(tmpdir(), "imd-flop-proof-"));
async function cli(home: string, args: string[], extra: Partial<IO> = {}) {
  const out: string[] = [];
  const err: string[] = [];
  const code = await main(args, { out: (s) => out.push(s), err: (s) => err.push(s), env: { IMD_FLOP_HOME: home }, ...extra });
  return { code, out: out.join("\n"), err: err.join("\n"), json: () => JSON.parse(out.join("\n")) };
}
const readLines = (p: string) => readFileSync(p, "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l));
async function readySeat(home: string, cap = "1") {
  await cli(home, ["init", "--seat", SEAT]);
  await cli(home, ["link", "--token", SEAT, "--agent", "7"]);
  await cli(home, ["cap", "set", cap]);
}
const rpc = (obj: unknown, status = 200) => new Response(JSON.stringify(obj), { status, headers: { "content-type": "application/json" } });
import { generatePrivateKey, privateKeyToAccount } from "viem/accounts";
import { NETWORKS } from "../../src/networks.js";
import { gatewayKeyFile } from "../../src/paths.js";
import { writeSecretFile } from "../../src/store.js";
import { clearSecretRegistry } from "../../src/secrets.js";
import type { LinkFile } from "../../src/link.js";

const PIN = NETWORKS.devnet.genesisHash;
const ETH = "https://eth.example/rpc";
async function signHolder(h: string): Promise<string> {
  const file = join(h, "seats", SEAT, "link.json");
  const link = JSON.parse(readFileSync(file, "utf8")) as LinkFile;
  const wallet = privateKeyToAccount(generatePrivateKey());
  const td = link.eip712;
  const sig = await wallet.signTypedData({ domain: td.domain, types: td.types, primaryType: td.primaryType, message: { ...td.message, tokenId: BigInt(td.message.tokenId), issuedAt: BigInt(td.message.issuedAt) } });
  writeFileSync(file, JSON.stringify({ ...link, wallet: { address: wallet.address, signature: sig } }));
  return wallet.address;
}
type Seen = { url: string; method?: string };
/** Offline stand-in for every HTTP endpoint the paid run touches. Paid inference is never answered. */
function paidFetch(owner: string, seen: Seen[], opts: { faucetDelayMs?: number }): typeof fetch {
  return (async (input: unknown, init?: RequestInit) => {
    if (init?.signal?.aborted) throw init.signal.reason; // fetch spec: already-aborted signal sends nothing
    const url = String(input);
    let method: string | undefined;
    if (init?.body) { try { method = (JSON.parse(String(init.body)) as { method?: string }).method; } catch { /* not json */ } }
    seen.push({ url, method });
    if (method === "eth_chainId") return rpc({ jsonrpc: "2.0", id: 1, result: "0x1" });
    if (method === "eth_call") return rpc({ jsonrpc: "2.0", id: 1, result: "0x" + "0".repeat(24) + owner.slice(2).toLowerCase() });
    if (url.endsWith("/chain")) { if (opts.faucetDelayMs) await new Promise((r) => setTimeout(r, opts.faucetDelayMs)); return rpc({ genesisHash: PIN }); }
    if (url.endsWith("/models/estimate")) return rpc({ estimated_cost_flop: 0.012, estimated_input_tokens: 1, estimated_output_tokens: 1 });
    if (url.endsWith("/keys/ephemeral")) return rpc({ token: "flop_ek_" + "a".repeat(40), expires_at: 0 }, 201);
    if (url.includes("/chat/completions")) throw new Error(`paid inference ${url}`);
    throw new Error(`unexpected url ${url}`);
  }) as typeof fetch;
}
/** Fake devnet WebSocket RPC; `answer` is called with the socket index (0 = the up-front gate, 1 = the pre-mint recheck). */
function withWs<T>(answer: (socketIndex: number) => string, fn: () => Promise<T>): Promise<T> {
  const real = globalThis.WebSocket;
  let n = 0;
  class FakeWS {
    onopen?: () => void;
    onmessage?: (ev: { data: string }) => void;
    private idx = n++;
    constructor() { setTimeout(() => this.onopen?.(), 0); }
    send() { setTimeout(() => this.onmessage?.({ data: answer(this.idx) }), 0); }
    close() {}
  }
  (globalThis as { WebSocket: unknown }).WebSocket = FakeWS;
  return fn().finally(() => { globalThis.WebSocket = real; });
}
const PAID = (extra: string[] = []) => ["run", "--job", "job-abc", "--prompt", "Say hi", "--max-tokens", "8", "--provider", "flop", "--live", ...extra];
describe("a pre-mint refusal always lands in the ledger", () => {
  it("an RPC error whose message carries a bare 64-hex run still yields refused_local with cap charge 0", async () => {
    const h = tmpHome();
    await readySeat(h);
    const owner = await signHolder(h);
    writeSecretFile(gatewayKeyFile(h, SEAT), "test-gateway-bearer\n");
    const seen: Seen[] = [];
    const hexNo0x = "deadbeef".repeat(8);
    try {
      const r = await withWs(
        (i) => (i === 0 ? JSON.stringify({ result: PIN }) : JSON.stringify({ error: { message: `block ${hexNo0x} unknown` } })),
        () => cli(h, PAID(), { fetch: paidFetch(owner, seen, {}), env: { IMD_FLOP_HOME: h, ETH_RPC_URL: ETH } }),
      );
      expect(seen.some((s) => s.url.endsWith("/keys/ephemeral"))).toBe(false); // the mint was refused (holds today)
      // Expected: the latest line is refused_local, charge 0, today's flop spend 0, and the error names the genesis refusal.
      const rows = readLines(join(h, "ledger.jsonl")) as { state: string; cap_charge: number }[];
      expect(rows.at(-1)!.state).toBe("refused_local");
      expect(rows.at(-1)!.cap_charge).toBe(0);
      const st = await cli(h, ["status", "--json"]);
      expect(st.json().today_utc.flop).toBe(0);
      expect(st.json().pending_receipts).toEqual([]);
      expect(r.err).toMatch(/genesis check failed/);
    } finally {
      clearSecretRegistry();
    }
  });
});