/**
 * A module's own secret, provided by the vault — and rotated like any other credential.
 *
 * novox/hq ADR 0085: a secret a module needs for itself is a `secret` provision from a vault module,
 * and the credential of that consumer↔vault pair IS the value. So everything design 13 built for a
 * database password applies to it unchanged, and this bed checks exactly what 13 checks: three
 * logins against the real software, from the machine that holds the secret —
 *
 *   1. the delivered password authenticates against redis
 *   2. after `rotate secret`, the new one authenticates
 *   3. the one that was rotated away does not
 *
 * — plus the half that makes the vault an owner rather than a bystander: its ledger records who
 * holds the secret and its fingerprint, notices the rotation, and answers over the mesh without ever
 * returning a value.
 *
 * And the amended half of ADR 0085: the mesh has an operator key, every secret a module holds for
 * itself is sealed to it as well, the vault keeps that export on its disk, and the operator — with
 * the private key that never entered the mesh — recovers exactly the value the node was given.
 * Checked against the value the host unsealed on the machine, and with the store out of the loop.
 *
 * The manifests are the catalogue's own (../mesh-catalog/modules/{mesh-vault,redis}/module.json), with
 * the runtime artifact named as the image the lab built, exactly as the other assigned-* beds do.
 *
 *   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
 *   scripts/build-module-runtime.sh mesh-vault / redis build the two runtime images into the local
 *   daemon; scenarios/vault-node.yml stocks them.
 */

import { test, before, after } from "node:test";
import assert from "node:assert/strict";
import { createHash } from "node:crypto";
import { existsSync, readFileSync } from "node:fs";
import { join } from "node:path";
import { loadScenario } from "../../src/declaration/parse.ts";
import { raise } from "../../src/lifecycle/raise.ts";
import { destroy, exec } from "../../src/lifecycle/operate.ts";
import { hostBinaryPath, HOST_PATH } from "../../src/lifecycle/place.ts";
import { labIsUsable, destroyAll, foundationBundle, onTheMachine } from "./harness.ts";
import type { HeldImage } from "../../src/pinning.ts";

const capability = await labIsUsable();
const binary = hostBinaryPath();
const bundle = process.env["MESH_LAB_BUNDLE"] ?? "";
const catalogue = process.env["MESH_LAB_CATALOG"] ?? "../mesh-catalog";

const skip = !capability.usable
  ? `lab not usable: ${capability.why}`
  : !binary || !existsSync(binary)
    ? "MESH_LAB_HOST_BINARY is not set to a built mesh-host"
    : !bundle || !existsSync(bundle)
      ? "MESH_LAB_BUNDLE is not set to a foundation bundle (mesh-host examples/)"
      : !existsSync(join(catalogue, "modules/mesh-vault/module.json"))
        ? `no catalogue at ${catalogue} (set MESH_LAB_CATALOG)`
        : false;

const SCENARIO = "vault-node";
const MACHINE = "anchor";
const SECRET_FILE = "/var/lib/redis-module/default.secret";
const LEDGER = "/var/lib/mesh-vault/ledger";
const ROOT = "/var/lib/mesh-vault/root";
// Where the operator keeps things on this machine: outside every container, bind-mounted into a
// throwaway one when the operator's own commands run. The controller's container is a scratch
// image with no writable path — the private key could not be written there even by mistake.
const OPERATOR_DIR = "/var/lib/lab-operator";

let instanceId = "";
let held: HeldImage[] = [];

function quote(s: string): string {
  return `'${s.replaceAll("'", `'\\''`)}'`;
}

async function on(command: string, timeoutMs?: number): Promise<{ out: string; ok: boolean }> {
  const { stdout } = await exec(instanceId, MACHINE, [
    "sh", "-c", `exec 2>&1\n${command}\necho "__exit=$?"`,
  ], timeoutMs);
  const marker = stdout.lastIndexOf("__exit=");
  if (marker < 0) return { out: stdout, ok: false };
  return { out: stdout.slice(0, marker), ok: stdout.slice(marker + 7).trim() === "0" };
}

async function must(command: string, timeoutMs?: number): Promise<string> {
  const { out, ok } = await on(command, timeoutMs);
  if (!ok) throw new Error(`${MACHINE}: ${command}\n${out}`);
  return out;
}

async function mesh(command: string, timeoutMs?: number): Promise<string> {
  return must(`docker exec mesh-controller /mesh-controller ${command}`, timeoutMs);
}

function pinned(reference: string): string {
  return onTheMachine(reference, held);
}

function bundleFor(images: HeldImage[]): string {
  return foundationBundle(bundle, images);
}

function tokenFrom(said: string): string {
  const found = said.split("\n").map((l) => l.trim()).find((l) => l.length > 100 && !l.includes(" "));
  assert.ok(found, `no token in:\n${said}`);
  return found;
}

/** sha256:<hex>, the only form in which a secret's value is ever spoken here. */
function fingerprint(value: string): string {
  return "sha256:" + createHash("sha256").update(value, "utf8").digest("hex");
}

/**
 * The catalogue's own manifest, as the lab can run it: the runtime artifact becomes the image this
 * scenario loaded, third-party images are pinned upstream, and `build` goes — nothing here builds.
 */
function catalogueManifest(name: string): string {
  const m = JSON.parse(readFileSync(join(catalogue, `modules/${name}/module.json`), "utf8")) as {
    build?: unknown;
    resources: Record<string, unknown>[];
  };
  delete m.build;
  for (const r of m.resources) {
    if (r["artifact"] === "runtime") {
      delete r["artifact"];
      r["image"] = pinned(`mesh-runtime-${name}`);
    } else if (typeof r["image"] === "string") {
      r["image"] = pinned(r["image"]);
    }
  }
  return JSON.stringify(m);
}

async function until<T>(what: string, ms: number, probe: () => Promise<T | undefined>): Promise<T> {
  const deadline = Date.now() + ms;
  let last: unknown;
  while (Date.now() < deadline) {
    try {
      const got = await probe();
      if (got !== undefined) return got;
    } catch (err) {
      last = err;
    }
    await new Promise((r) => setTimeout(r, 3000));
  }
  throw new Error(`${what} did not happen within ${Math.round(ms / 1000)}s${last ? `; last: ${String(last)}` : ""}`);
}

async function settled(withinMs = 480_000): Promise<void> {
  const deadline = Date.now() + withinMs;
  let last = "";
  while (Date.now() < deadline) {
    const asked = await on(`docker exec mesh-controller /mesh-controller status --json`);
    if (asked.ok) {
      try {
        const state = JSON.parse(asked.out) as {
          wrong: { node: string; outcome: string }[];
          waiting: { node: string }[];
          reported: { node: string; outcome: string; current: boolean }[];
        };
        const bad = state.wrong.find((w) => w.node === MACHINE);
        if (bad) throw new Error(`${MACHINE} did not apply what it was sent: ${bad.outcome}\n${asked.out}`);
        const word = state.reported.find((r) => r.node === MACHINE);
        if (!state.waiting.some((w) => w.node === MACHINE) && word?.outcome === "applied" && word.current) return;
        last = asked.out;
      } catch (err) {
        if (err instanceof Error && err.message.includes("did not apply")) throw err;
        last = asked.out;
      }
    }
    await new Promise((r) => setTimeout(r, 5000));
  }
  throw new Error(`${MACHINE} never caught up within ${Math.round(withinMs / 1000)}s. Last:\n${last}`);
}

/** redis's answer to PING as `password`, from inside its own container — PONG, or why not. */
async function pingAs(password: string): Promise<string> {
  return (await on(`docker exec redis redis-cli --no-auth-warning -a ${quote(password)} ping`)).out.trim();
}

/** The operator's own commands: the controller binary in a throwaway container, with the operator's
 *  directory at /work and nothing of the mesh in reach — no store, no broker. What an operator runs
 *  on their own machine with the binary and a directory. */
async function operator(command: string): Promise<string> {
  return must(
    `docker run --rm -v ${OPERATOR_DIR}:/work --entrypoint /mesh-controller ${pinned("mesh-controller")} ${command}`,
    120_000,
  );
}

/** Invoke one of the vault's tools over the mesh, the way a caller would, and parse its answer. */
async function vaultTool(tool: string, args: Record<string, unknown> = {}): Promise<Record<string, unknown>> {
  const said = await must(
    `docker run --rm --network host -e MESH_BROKER_URL=amqp://guest:guest@127.0.0.1:5672/ ` +
      `${pinned("mesh-runtime-mesh-vault")} invoke mesh-vault ${tool} ${quote(JSON.stringify(args))}`,
    120_000,
  );
  const line = said.split("\n").map((l) => l.trim()).filter(Boolean).pop() ?? "";
  return JSON.parse(line) as Record<string, unknown>;
}

interface Held {
  as: string;
  consumer: string;
  fingerprint: string;
  rotations: number;
  history: { fingerprint: string; until: string }[];
}

before(async () => {
  if (skip) return;

  const raised = await raise(loadScenario(`scenarios/${SCENARIO}.yml`), {
    onProgress: (m) => console.log(`raise: ${m}`),
  });
  instanceId = raised.instanceId;
  held = raised.images;

  await must(`cat > /tmp/foundation.lock <<'MESHBUNDLE'\n${bundleFor(raised.images)}\nMESHBUNDLE`);
  await must(`${HOST_PATH} apply /tmp/foundation.lock`, 600_000);
  const up = await must(`docker ps --format '{{.Names}}'`);
  for (const c of ["mesh-store", "mesh-broker", "mesh-controller"]) {
    assert.match(up, new RegExp(c), `the foundation did not raise ${c}:\n${up}`);
  }

  await mesh(`node add ${MACHINE}`);
  const token = tokenFrom(await mesh(`token issue --node ${MACHINE}`));
  await must(`${HOST_PATH} enrol --token ${quote(token)}`);
  await must(`nohup ${HOST_PATH} run > /var/log/mesh-host.log 2>&1 & sleep 3`);
}, { timeout: 1_800_000 });

after(async () => {
  if (instanceId) await destroy(instanceId);
  await destroyAll(`${SCENARIO}-`);
}, { timeout: 600_000 });

let delivered = "";
let holder = "";

test("redis's own password is a secret the vault provides: it authenticates, and the vault holds its fingerprint", {
  skip, timeout: 900_000,
}, async () => {
  // The operator key first, so everything minted from here on is sealed to it as well. Made off
  // the mesh — a throwaway container with the operator's directory mounted, no store in reach —
  // and only the public half is given to the mesh.
  await must(`mkdir -p ${OPERATOR_DIR} && chmod 777 ${OPERATOR_DIR}`);
  const made = await operator(`operator key make --out /work/operator.key`);
  assert.match(made, /operator key sha256:/, made);
  const publicKey = made.split("\n").map((l) => l.trim()).map((l) => /^public ([A-Za-z0-9+\/]{40,}={0,2})$/.exec(l)?.[1]).find(Boolean);
  assert.ok(publicKey, `no public key in:\n${made}`);
  const privateKey = (await must(`cat ${OPERATOR_DIR}/operator.key`)).trim();
  assert.ok(privateKey.length > 30 && !made.includes(privateKey), "the private key was printed");
  const set = await mesh(`operator key set ${quote(publicKey)}`);
  assert.match(set, /operator key sha256:/, set);

  for (const name of ["mesh-vault", "redis"]) {
    await must(`printf %s ${quote(catalogueManifest(name))} > /tmp/${name}.json && docker cp /tmp/${name}.json mesh-controller:/${name}.json`);
    await mesh(`module add /${name}.json`);
    const issued = await mesh(`module issue ${name} --node ${MACHINE}`);
    assert.match(issued, /scoped to what it emits and consumes/, issued);
    await mesh(`assign ${MACHINE} ${name}`);
  }
  // A consumer that needs TWO values from the vault (novox/hq ADR 0094): its `secrets` entry names
  // them under local names, and each is a pair of its own. It runs no code — the delivery is what
  // is under test. Synthetic, so it wears no catalogue module's name.
  const twoSecrets = JSON.stringify({
    module: "two-secrets", version: "1", slug: "two",
    requires: ["secret"],
    secrets: { secret: { first: "/var/lib/two-secrets/first", second: "/var/lib/two-secrets/second" } },
    resources: [{ id: "state", type: "directory", path: "/var/lib/two-secrets", mode: "0700" }],
  });
  await must(`printf %s ${quote(twoSecrets)} > /tmp/two-secrets.json && docker cp /tmp/two-secrets.json mesh-controller:/two-secrets.json`);
  await mesh("module add /two-secrets.json");
  await mesh(`assign ${MACHINE} two-secrets`);
  await mesh(`push ${MACHINE}`);
  await settled();

  // Two files, two values, and the vault holds two holders for one module — the identity with the
  // local name after it.
  const first = (await must(`cat /var/lib/two-secrets/first`)).replace(/\n$/, "");
  const second = (await must(`cat /var/lib/two-secrets/second`)).replace(/\n$/, "");
  assert.ok(first.length >= 20 && second.length >= 20, "a two-secrets value is empty or implausibly short");
  assert.notEqual(first, second, "two local names were given one value");
  for (const holderOf of ["mesh_anchor_two_first", "mesh_anchor_two_second"]) {
    await until(`the vault holding ${holderOf}`, 90_000, async () =>
      (await on(`test -s ${LEDGER}/${holderOf}.json`)).ok ? true : undefined);
  }

  const running = await must(`docker ps --format '{{.Names}}'`);
  for (const c of ["mesh-vault", "redis", "mesh-redis"]) {
    assert.match(running, new RegExp(`(^|\\n)${c}(\\n|$)`),
      `${c} is not running:\n${running}\n---host log---\n${(await on(`tail -40 /var/log/mesh-host.log`)).out}`);
  }

  // 1. The pair credential the mesh minted is on redis's machine as redis's own password — and
  //    redis accepts it. Not because two files agree: because the login works.
  delivered = (await must(`cat ${SECRET_FILE}`)).replace(/\n$/, "");
  assert.ok(delivered.length >= 20, "the delivered secret is empty or implausibly short");
  const mode = (await must(`stat -c %a ${SECRET_FILE}`)).trim();
  assert.equal(mode, "600", `the secret file is readable by others (mode ${mode})`);
  const pong = await until("redis accepting the delivered password", 120_000, async () => {
    const said = await pingAs(delivered);
    return said === "PONG" ? said : undefined;
  });
  assert.equal(pong, "PONG");
  assert.notEqual(await pingAs("not-the-password"), "PONG", "redis accepted a wrong password — requirepass is not set");

  // 2. The vault took custody: its ledger names the holder, with the fingerprint of exactly the
  //    value redis holds — and no value.
  const recorded = await until("the vault recording redis's secret", 90_000, async () => {
    const ls = await on(`ls ${LEDGER}`);
    const name = ls.ok ? ls.out.split("\n").map((l) => l.trim()).find((l) => l.endsWith(".json")) : undefined;
    if (!name) return undefined;
    return JSON.parse(await must(`cat ${LEDGER}/${name}`)) as Held;
  });
  holder = recorded.as;
  assert.equal(recorded.consumer, MACHINE);
  assert.equal(recorded.fingerprint, fingerprint(delivered), "the vault recorded a fingerprint of something other than what redis holds");
  assert.equal(recorded.rotations, 0);
  const ledgerRaw = await must(`cat ${LEDGER}/*.json`);
  assert.ok(!ledgerRaw.includes(delivered), "the vault's ledger contains the secret's value");
  // The holder is the login the mesh derived for redis on this machine, as the contributions file says.
  const asked = JSON.parse(await must(`cat /var/lib/mesh-vault/grants/mesh.json`)) as { given: { as: string; from?: string }[] };
  assert.ok(asked.given.some((g) => g.as === holder), `the vault was not asked to serve ${holder}:\n${JSON.stringify(asked)}`);

  // 3. And it answers over the mesh — who holds what, verified by fingerprint, never by value.
  const holders = await until("the vault serving its tools", 90_000, async () => {
    const got = await vaultTool("secret_holders");
    return Array.isArray(got["holders"]) && (got["holders"] as Held[]).length > 0 ? got : undefined;
  });
  const mine = (holders["holders"] as (Held & { module: string | null })[]).find((h) => h.as === holder);
  assert.ok(mine, `secret_holders does not list ${holder}:\n${JSON.stringify(holders)}`);
  assert.equal(mine.module, "redis");
  assert.ok(!JSON.stringify(holders).includes(delivered), "secret_holders returned the value");

  const verified = await vaultTool("secret_verify", { as: holder, fingerprint: fingerprint(delivered) });
  assert.equal(verified["ok"], true, JSON.stringify(verified));
  assert.equal(verified["deliveredMatchesRecorded"], true, JSON.stringify(verified));
  assert.equal(verified["givenMatchesRecorded"], true, JSON.stringify(verified));

  const vaultLog = (await on(`docker logs mesh-vault 2>&1`)).out;
  assert.doesNotMatch(vaultLog, /emit .*failed/, `the vault's lifecycle event was refused:\n${vaultLog}`);
  assert.match(vaultLog, /granted: /, `the vault never recorded the grant:\n${vaultLog}`);
});

test("rotating the secret moves both ends: the new password works, the old one is refused, and the vault says so", {
  skip, timeout: 900_000,
}, async () => {
  assert.ok(delivered && holder, "the first test did not run");
  const before = delivered;

  const said = await mesh("rotate secret", 300_000);
  assert.doesNotMatch(said, /nobody holds/i, said);

  // The consumer's file moves — the rotation was delivered, not only recorded.
  const after = await until("the rotated secret reaching redis's machine", 180_000, async () => {
    const now = (await must(`cat ${SECRET_FILE}`)).replace(/\n$/, "");
    return now !== before ? now : undefined;
  });
  assert.notEqual(after, before);

  // Both of the two-secrets consumer's values moved too, apart from each other (ADR 0094).
  const firstAfter = await until("the rotated first secret", 180_000, async () => {
    const now = (await must(`cat /var/lib/two-secrets/first`)).replace(/\n$/, "");
    return now !== "" ? now : undefined;
  });
  const secondAfter = (await must(`cat /var/lib/two-secrets/second`)).replace(/\n$/, "");
  assert.notEqual(firstAfter, secondAfter, "two local names were given one value after rotation");
  for (const holderOf of ["mesh_anchor_two_first", "mesh_anchor_two_second"]) {
    const h = await until(`the vault recording ${holderOf}'s rotation`, 90_000, async () => {
      const got = JSON.parse(await must(`cat ${LEDGER}/${holderOf}.json`)) as Held;
      return got.rotations >= 1 ? got : undefined;
    });
    assert.equal(h.rotations, 1, holderOf);
  }

  // Three logins. The new one works (redis was restarted on its config — `restart-on`), the old one
  // does not: that third check is what makes it a rotation rather than an addition.
  await until("redis accepting the rotated password", 180_000, async () => {
    return (await pingAs(after)) === "PONG" ? true : undefined;
  });
  assert.notEqual(await pingAs(before), "PONG", "the rotated-away password still authenticates — redis kept the credential it started with");

  // The vault noticed: same holder, one rotation, new fingerprint, old one in the history.
  const recorded = await until("the vault recording the rotation", 90_000, async () => {
    const h = JSON.parse(await must(`cat ${LEDGER}/${holder}.json`)) as Held;
    return h.rotations >= 1 ? h : undefined;
  });
  assert.equal(recorded.rotations, 1);
  assert.equal(recorded.fingerprint, fingerprint(after));
  assert.deepEqual(recorded.history.map((h) => h.fingerprint), [fingerprint(before)]);

  const stale = await vaultTool("secret_verify", { as: holder, fingerprint: fingerprint(before) });
  assert.equal(stale["ok"], false, JSON.stringify(stale));
  assert.equal(stale["givenIsAnEarlierValue"], true, JSON.stringify(stale));
  const fresh = await vaultTool("secret_verify", { as: holder, fingerprint: fingerprint(after) });
  assert.equal(fresh["ok"], true, JSON.stringify(fresh));

  const vaultLog = (await on(`docker logs mesh-vault 2>&1`)).out;
  assert.match(vaultLog, /rotated: /, `the vault never announced the rotation:\n${vaultLog}`);
  assert.doesNotMatch(vaultLog, /emit .*failed/, vaultLog);
});

test("the operator recovers a root secret with a key the mesh never held, from the vault's copy and from the store", {
  skip, timeout: 900_000,
}, async () => {
  assert.ok(holder, "the first test did not run");

  // The vault keeps the export on its own disk, written by the mesh, ciphertext throughout.
  const exported = await until("the vault holding the export", 90_000, async () => {
    const got = await on(`cat ${ROOT}/export.json`);
    return got.ok && /"kept"/.test(got.out) ? got.out : undefined;
  });
  const doc = JSON.parse(exported) as {
    "operator-key": string;
    kept: { node: string; module: string; name: string; origin: string; sealed: string }[];
    unrecoverable?: unknown[];
  };
  const mode = (await must(`stat -c %a ${ROOT}/export.json`)).trim();
  assert.equal(mode, "600", `the export is readable by others (mode ${mode})`);
  // mesh-vault's own broker account was issued after the key existed, so it is in the export.
  const ours = doc.kept.find((k) => k.node === MACHINE && k.module === "mesh-vault" && k.name === "broker");
  assert.ok(ours, `the vault's own broker account is not in the export:\n${exported}`);
  assert.equal(ours.origin, "accepted");
  // The value the host unsealed on this machine — what the module actually runs with.
  const onDisk = (await must(`cat /var/lib/mesh/mesh-vault/broker`)).replace(/\n$/, "");
  assert.ok(onDisk.length > 20, "the node's own copy is empty");
  assert.ok(!exported.includes(onDisk), "the export contains a plaintext value");

  // 1. Recovered from the store, with the operator key: the same bytes the node holds. The key is
  //    handed to the running controller for this one call, readable by its own account.
  await must(`chown 65534:65534 ${OPERATOR_DIR}/operator.key && docker cp -a ${OPERATOR_DIR}/operator.key mesh-controller:/operator.key`);
  const fromStore = (await mesh(`secret recover ${MACHINE} mesh-vault broker --key /operator.key --out -`)).replace(/\n$/, "");
  assert.equal(fromStore, onDisk, "the operator recovered a different value from the one the node was given");

  // 2. Recovered from the vault's export alone, off the mesh — no store, no broker, a directory and
  //    the key — so a mesh whose store is gone is still a mesh whose root secrets a person can open.
  await must(`cp ${ROOT}/export.json ${OPERATOR_DIR}/export.json && chmod 644 ${OPERATOR_DIR}/export.json`);
  const said = await operator(`secret recover ${MACHINE} mesh-vault broker --key /work/operator.key --from-export /work/export.json --out /work/recovered`);
  assert.match(said, /recovered to \/work\/recovered/, said);
  assert.ok(!said.includes(onDisk), "recover printed the value");
  const fromExport = (await must(`cat ${OPERATOR_DIR}/recovered`)).replace(/\n$/, "");
  assert.equal(fromExport, onDisk);
  const recoveredMode = (await must(`stat -c %a ${OPERATOR_DIR}/recovered`)).trim();
  assert.equal(recoveredMode, "600");

  // 3. Another key — made, never given to the mesh — opens nothing, and says so.
  await operator(`operator key make --out /work/another.key`);
  const wrong = await on(
    `docker run --rm -v ${OPERATOR_DIR}:/work --entrypoint /mesh-controller ${pinned("mesh-controller")} ` +
      `secret recover ${MACHINE} mesh-vault broker --key /work/another.key --from-export /work/export.json --out /work/nope`,
  );
  assert.equal(wrong.ok, false, `a different operator key opened the secret:\n${wrong.out}`);
  assert.match(wrong.out, /does not open it/, wrong.out);

  // 3b. And the secret the vault PROVIDES — redis's password, a pair credential — is recoverable
  //     the same way, off the mesh: the export names it by the consumer and the provision.
  const redisPassword = (await must(`cat ${SECRET_FILE}`)).replace(/\n$/, "");
  const pairLine = doc.kept.find((k) => k.module === "redis" && k.name === "secret");
  assert.ok(pairLine, `redis's vault-provided secret is not in the export:\n${exported}`);
  await must(`cp ${ROOT}/export.json ${OPERATOR_DIR}/export.json && chmod 644 ${OPERATOR_DIR}/export.json`);
  await operator(`secret recover ${MACHINE} redis secret --key /work/operator.key --from-export /work/export.json --out /work/redis.secret`);
  const recoveredRedis = (await must(`cat ${OPERATOR_DIR}/redis.secret`)).replace(/\n$/, "");
  assert.equal(recoveredRedis, redisPassword, "the recovered pair credential is not the password redis runs with");
  assert.equal(await pingAs(recoveredRedis), "PONG", "the recovered password does not open redis");

  // 4. The vault serves the export over the mesh — ciphertext, plus what is NOT recoverable.
  const served = await vaultTool("secret_export", { sealed: false });
  assert.equal(served["available"], true, JSON.stringify(served));
  assert.equal(served["operator-key"], doc["operator-key"]);
  const listed = served["kept"] as { module: string; name: string }[];
  assert.ok(listed.some((k) => k.module === "mesh-vault" && k.name === "broker"), JSON.stringify(served));
  assert.ok(!JSON.stringify(served).includes(onDisk), "secret_export returned a plaintext value");
});

test("a seeded file is created once, and what a program grows in it survives the next push", {
  skip, timeout: 600_000,
}, async () => {
  // novox/hq ADR 0087, issue 035. A file that says create-once is written when absent and left
  // alone when present — content, mode and owner — so an access list a program persists into is
  // not restored to its seed behind the program's back on every reconcile.
  const manifest = JSON.stringify({
    module: "seed-test", version: "1",
    resources: [
      { id: "dir", type: "directory", path: "/var/lib/seed-test", mode: "0755" },
      { id: "acl", type: "file", path: "/var/lib/seed-test/acl.conf", mode: "0600", "create-once": true,
        content: "user default on\n" },
    ],
  });
  await must(`printf %s ${quote(manifest)} > /tmp/seed-test.json && docker cp /tmp/seed-test.json mesh-controller:/seed-test.json`);
  await mesh("module add /seed-test.json");
  await mesh(`assign ${MACHINE} seed-test`);
  await mesh(`push ${MACHINE}`);
  await settled();
  assert.equal(await must(`cat /var/lib/seed-test/acl.conf`), "user default on\n");

  // The program grows it.
  await must(`printf 'user app-one on >secret\n' >> /var/lib/seed-test/acl.conf`);
  // A second push: the mesh reconciles everything it declared, and leaves the seed alone.
  await mesh(`push ${MACHINE}`);
  await settled();
  assert.equal(await must(`cat /var/lib/seed-test/acl.conf`), "user default on\nuser app-one on >secret\n",
    "the seed was restored and what the program wrote into it was wiped");
});