// Signable targets of an Xcode project (app + share extension + App Group entitlements): `apple signing ensure`
// registers the extension's bundle id, enables the capabilities its entitlements need, creates its profile and checks
// the App Group against the profile (the API cannot assign a group to a bundle id); `apple build` over SSH names the
// keychain fixes; `storebound api` writes say how an agent confirms. Fixtures are placeholders (com.example.*).
import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
import { toXmlPlist } from '../cli/lib/plist';
import { run as signing, discoverTargets, profileEntitlements } from '../cli/apple/signing';
import { decide, NOT_A_TTY } from '../cli/api/gate';
import { USAGE } from '../cli/api';
import { keychainPassword, KEYCHAIN_PASSWORD_ENV, parseKeychainList, showSecurity, sshBuildRefusal, unlockSteps } from '../cli/lib/keychain';
import { planProfile, validateSigning } from '../cli/lib/signing';
import { appGroupGaps, appGroupGapsFor, appGroupSteps, appGroupVerdicts, bundleIdPortalUrl, capabilityGroups, pbxTargets, targetKind } from '../cli/lib/targets';
import { consolePlan, planText } from '../cli/lib/console-plan';
import { verifyAppGroupsApi, verifyText } from '../cli/lib/console-verify';
import { PLAN_FORM_IDS } from '../cli/lib/console-answers';
import { CONSOLE_PLAN_FORMS, TOOLS, validateInput } from '../cli/mcp-tools';
import { upsertTiming } from '../cli/lib/upsert';
import { ascEnv, BASE, capture, mockFetch, project, restore } from './helpers/store-mock';

const APP_ENT = `<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0"><dict>
  <key>aps-environment</key><string>development</string>
  <key>com.apple.security.application-groups</key><array><string>group.com.example.notes</string></array>
</dict></plist>`;
const SHARE_ENT = `<?xml version="1.0" encoding="UTF-8"?>
<plist version="1.0"><dict>
  <key>com.apple.security.application-groups</key><array><string>group.com.example.notes</string></array>
  <key>keychain-access-groups</key><array><string>$(AppIdentifierPrefix)com.example.notes</string></array>
  <key>com.apple.developer.associated-domains</key><array><string>applinks:example.com</string></array>
</dict></plist>`;

/** A pbxproj the way Xcode 15 writes it: app, share extension, a unit test bundle, a framework, one variable bundle id. */
const PBX = `// !$*UTF8*$!
{
	archiveVersion = 1;
	objects = {
/* Begin PBXNativeTarget section */
		AAAAAAAAAAAAAAAAAAAAAA01 /* App */ = {
			isa = PBXNativeTarget;
			buildConfigurationList = CCCCCCCCCCCCCCCCCCCCCC01 /* Build configuration list for PBXNativeTarget "App" */;
			buildPhases = ( );
			name = App;
			productName = App;
			productType = "com.apple.product-type.application";
		};
		AAAAAAAAAAAAAAAAAAAAAA02 /* ShareExt */ = {
			isa = PBXNativeTarget;
			buildConfigurationList = CCCCCCCCCCCCCCCCCCCCCC02 /* Build configuration list for PBXNativeTarget "ShareExt" */;
			name = ShareExt;
			productType = "com.apple.product-type.app-extension";
		};
		AAAAAAAAAAAAAAAAAAAAAA03 /* AppTests */ = {
			isa = PBXNativeTarget;
			buildConfigurationList = CCCCCCCCCCCCCCCCCCCCCC03 /* x */;
			name = AppTests;
			productType = "com.apple.product-type.bundle.unit-test";
		};
		AAAAAAAAAAAAAAAAAAAAAA04 /* Kit */ = {
			isa = PBXNativeTarget;
			buildConfigurationList = CCCCCCCCCCCCCCCCCCCCCC03 /* x */;
			name = Kit;
			productType = "com.apple.product-type.framework";
		};
		AAAAAAAAAAAAAAAAAAAAAA05 /* Widget */ = {
			isa = PBXNativeTarget;
			buildConfigurationList = CCCCCCCCCCCCCCCCCCCCCC05 /* x */;
			name = Widget;
			productType = "com.apple.product-type.app-extension";
		};
/* End PBXNativeTarget section */
/* Begin XCBuildConfiguration section */
		BBBBBBBBBBBBBBBBBBBBBB01 /* Debug */ = {
			isa = XCBuildConfiguration;
			buildSettings = { PRODUCT_BUNDLE_IDENTIFIER = com.example.notes.debug; };
			name = Debug;
		};
		BBBBBBBBBBBBBBBBBBBBBB02 /* Release */ = {
			isa = XCBuildConfiguration;
			buildSettings = {
				CODE_SIGN_ENTITLEMENTS = App/App.entitlements;
				FRAMEWORK_SEARCH_PATHS = (
					"$(inherited)",
					"{braces}",
				);
				PRODUCT_BUNDLE_IDENTIFIER = com.example.notes;
				PRODUCT_NAME = "$(TARGET_NAME)";
			};
			name = Release;
		};
		BBBBBBBBBBBBBBBBBBBBBB03 /* Release */ = {
			isa = XCBuildConfiguration;
			buildSettings = {
				CODE_SIGN_ENTITLEMENTS = "$(SRCROOT)/Share/Share.entitlements";
				PRODUCT_BUNDLE_IDENTIFIER = "com.example.notes.$(PRODUCT_NAME:rfc1034identifier)";
				PRODUCT_NAME = "$(TARGET_NAME)";
			};
			name = Release;
		};
		BBBBBBBBBBBBBBBBBBBBBB04 /* Release */ = {
			isa = XCBuildConfiguration;
			buildSettings = { PRODUCT_BUNDLE_IDENTIFIER = "$(MY_BASE_ID).widget"; };
			name = Release;
		};
/* End XCBuildConfiguration section */
/* Begin XCConfigurationList section */
		CCCCCCCCCCCCCCCCCCCCCC01 /* x */ = {
			isa = XCConfigurationList;
			buildConfigurations = (
				BBBBBBBBBBBBBBBBBBBBBB01 /* Debug */,
				BBBBBBBBBBBBBBBBBBBBBB02 /* Release */,
			);
		};
		CCCCCCCCCCCCCCCCCCCCCC02 /* x */ = {
			isa = XCConfigurationList;
			buildConfigurations = ( BBBBBBBBBBBBBBBBBBBBBB03 /* Release */, );
		};
		CCCCCCCCCCCCCCCCCCCCCC03 /* x */ = { isa = XCConfigurationList; buildConfigurations = ( ); };
		CCCCCCCCCCCCCCCCCCCCCC05 /* x */ = { isa = XCConfigurationList; buildConfigurations = ( BBBBBBBBBBBBBBBBBBBBBB04 ); };
/* End XCConfigurationList section */
	};
}
`;

const files = { 'ios/App/App.xcodeproj/project.pbxproj': PBX, 'ios/App/App/App.entitlements': APP_ENT, 'ios/App/Share/Share.entitlements': SHARE_ENT };

describe('pbxproj targets', () => {
  test('targetKind: only signable product types', () => {
    expect(targetKind('com.apple.product-type.application')).toBe('app');
    expect(targetKind('com.apple.product-type.app-extension')).toBe('extension');
    expect(targetKind('com.apple.product-type.app-extension.messages-sticker-pack')).toBe('extension');
    expect(targetKind('com.apple.product-type.application.watchapp2')).toBe('watch');
    expect(targetKind('com.apple.product-type.application.on-demand-install-capable')).toBe('clip');
    expect(targetKind('com.apple.product-type.framework')).toBeNull();
    expect(targetKind('com.apple.product-type.bundle.unit-test')).toBeNull();
  });

  test('app + share extension + widget: bundle ids resolved from Release, entitlements paths, tests and frameworks skipped', () => {
    const t = pbxTargets(PBX);
    expect(t.map(x => x.name)).toEqual(['App', 'ShareExt', 'Widget']);
    expect(t[0]).toMatchObject({ kind: 'app', bundleId: 'com.example.notes', entitlements: 'App/App.entitlements' });
    expect(t[1]).toMatchObject({ kind: 'extension', bundleId: 'com.example.notes.ShareExt', entitlements: 'Share/Share.entitlements' });
    expect(t[2]).toMatchObject({ bundleId: null, unresolved: '$(MY_BASE_ID).widget' });
  });

  test('discoverTargets reads the entitlements: capabilities and app groups per target; unresolved ids are noted', () => {
    const p = project({ ...BASE, apple: { bundleId: 'com.example.notes', appId: '6400000101' } }, files);
    const s = discoverTargets(p.root, p.loaded.config);
    expect(s.main).toMatchObject({ bundleId: 'com.example.notes', appGroups: ['group.com.example.notes'] });
    expect(s.main!.capabilities.map(c => c.type).sort()).toEqual(['APP_GROUPS', 'PUSH_NOTIFICATIONS']);
    expect(s.extensions).toHaveLength(1);
    expect(s.extensions[0]).toMatchObject({ bundleId: 'com.example.notes.ShareExt', kind: 'extension', source: 'xcode', appGroups: ['group.com.example.notes'] });
    expect(s.extensions[0]!.capabilities.map(c => c.type).sort()).toEqual(['APP_GROUPS', 'ASSOCIATED_DOMAINS']);   // keychain-access-groups has no capability
    expect(s.notes.join('\n')).toContain('Widget has bundle id "$(MY_BASE_ID).widget"');
  });

  test('apple.signing.extensions replaces the detected extensions; extraBundleIds are added', () => {
    const cfg = { ...BASE, apple: { bundleId: 'com.example.notes', signing: { extensions: [{ bundleId: 'com.example.notes.widget', capabilities: ['PUSH_NOTIFICATIONS' as const], appGroups: ['group.com.example.notes'] }], extraBundleIds: ['com.example.notes.watch'] } } };
    const p = project(cfg, files);
    const s = discoverTargets(p.root, p.loaded.config);
    expect(s.extensions.map(t => t.bundleId)).toEqual(['com.example.notes.widget', 'com.example.notes.watch']);
    expect(s.extensions[0]).toMatchObject({ source: 'config', appGroups: ['group.com.example.notes'], capabilities: [{ type: 'PUSH_NOTIFICATIONS' }] });
  });

  test('validateSigning checks the extensions override', () => {
    expect(validateSigning({ extensions: [{ bundleId: 'com.example.app.share', capabilities: ['APP_GROUPS'], appGroups: ['group.com.example.app'] }] })).toEqual([]);
    const e = validateSigning({ extensions: [{ bundleId: 'bad id', capabilities: ['NOPE' as never], appGroups: ['x'] }, { bundleId: 'com.example.a', capabilities: ['NOPE' as never], appGroups: ['x'] }] });
    expect(e.join('\n')).toContain('"bad id" is not a bundle id');
    expect(e.join('\n')).toContain('unknown capability "NOPE"');
    expect(e.join('\n')).toContain('appGroups are ids like group.');
  });
});

describe('App Group check', () => {
  const prov = (ent: Record<string, unknown>): string => Buffer.from(`\x30\x82\x01junk${toXmlPlist({ Name: 'x', Entitlements: ent as Record<string, string | string[]> })}\x00trailer`, 'latin1').toString('base64');
  const profile = (ent: Record<string, unknown>) => ({ id: 'P1', attributes: { name: 'p', profileType: 'IOS_APP_STORE', profileState: 'ACTIVE', expirationDate: '2099-01-01T00:00:00Z', profileContent: prov(ent) } });

  test('the profile plist is decoded and compared with the target\'s groups', () => {
    const ent = profileEntitlements([profile({ 'application-identifier': 'ABCDE12345.com.example.notes.share', 'com.apple.security.application-groups': ['group.com.example.other'] })])!;
    expect(appGroupGaps(['group.com.example.notes', 'group.com.example.other'], ent)).toEqual(['group.com.example.notes']);
    expect(appGroupGaps(['group.com.example.notes'], { 'com.apple.security.application-groups': ['*'] })).toEqual([]);
    expect(appGroupGaps(['group.com.example.notes'], {})).toEqual(['group.com.example.notes']);
  });

  test('a managed or contentless profile is unknown, not a gap', () => {
    expect(profileEntitlements([{ id: 'M', attributes: { profileType: 'IOS_APP_STORE', profileState: 'ACTIVE' }, managed: true }])).toBeNull();
    expect(appGroupGapsFor([{ bundleId: 'com.example.notes', appGroups: ['group.com.example.notes'] }], () => null, () => 'X')).toEqual([]);
  });

  test('the gap carries the portal deep link and the agent-first steps with a never-press list', () => {
    const g = appGroupGapsFor([{ bundleId: 'com.example.notes.share', appGroups: ['group.com.example.notes'] }], () => ({}), () => 'EXT0001');
    expect(g).toEqual([{ bundleId: 'com.example.notes.share', resourceId: 'EXT0001', groups: ['group.com.example.notes'], url: 'https://developer.apple.com/account/resources/identifiers/bundleId/edit/EXT0001' }]);
    expect(bundleIdPortalUrl('EXT0001')).toBe(g[0]!.url!);
    const steps = appGroupSteps(g[0]!).join('\n');
    expect(steps).toContain(g[0]!.url!);
    expect(steps).toContain('Never press');
    expect(steps).toContain('signing ensure --refresh-profile');
  });

  test('planProfile: --refresh-profile makes a new profile although an active one is reusable', () => {
    const existing = [{ id: 'P1', certIds: ['C1'], attributes: { name: 'old', profileType: 'IOS_APP_STORE' as const, profileState: 'ACTIVE', expirationDate: '2099-01-01T00:00:00Z' } }];
    const o = { bundleId: 'com.example.notes', bundleIdId: 'B1', certId: 'C1', type: 'IOS_APP_STORE' as const };
    expect(planProfile(existing, o).reuse?.id).toBe('P1');
    const r = planProfile(existing, { ...o, refresh: true });
    expect(r.reuse).toBeNull();
    expect(r.create?.path).toBe('/v1/profiles');
    expect(r.why).toContain('--refresh-profile');
  });
});

describe('signing ensure with an extension (fake App Store Connect)', () => {
  beforeEach(() => { upsertTiming.waitMs = 0; });
  afterEach(() => { restore(); upsertTiming.waitMs = 3000; });

  const MAIN = 'BUNDLE0001', EXT = 'EXT0001';
  const cfg = (style: 'automatic' | 'manual') => ({ ...BASE, apple: { bundleId: 'com.example.notes', appId: '6400000101', signing: { style, capabilities: ['IN_APP_PURCHASE' as const] } } });
  const prov = (ent: Record<string, unknown>): string => Buffer.from(`\x30\x82\x01junk${toXmlPlist({ Name: 'x', Entitlements: ent as Record<string, string | string[]> })}\x00`, 'latin1').toString('base64');

  function store(o: { groupInProfile: boolean }) {
    const caps: Record<string, string[]> = { [MAIN]: ['IN_APP_PURCHASE', 'PUSH_NOTIFICATIONS', 'APP_GROUPS'], [EXT]: [] };
    let registered = false;
    const bundle = (id: string, ident: string) => ({ type: 'bundleIds', id, attributes: { identifier: ident, platform: 'IOS', seedId: 'ABCDE12345' },
      relationships: { bundleIdCapabilities: { data: caps[id]!.map(t => ({ type: 'bundleIdCapabilities', id: `${id}_${t}` })) } } });
    const incl = (id: string) => caps[id]!.map(t => ({ type: 'bundleIdCapabilities', id: `${id}_${t}`, attributes: { capabilityType: t, settings: null } }));
    const page = (data: unknown[], included: unknown[] = []) => ({ data, included, links: { self: '' }, meta: { paging: { total: data.length, limit: 200 } } });
    const routes = [
      { match: /^\/v1\/bundleIds\?filter\[identifier\]=com\.example\.notes\.ShareExt/, answer: () => (registered ? page([bundle(EXT, 'com.example.notes.ShareExt')], incl(EXT)) : page([])) },
      { match: /^\/v1\/bundleIds\?filter\[identifier\]=com\.example\.notes&/, answer: () => page([bundle(MAIN, 'com.example.notes')], incl(MAIN)) },
      { method: 'POST', match: /^\/v1\/bundleIds$/, answer: () => { registered = true; return { data: bundle(EXT, 'com.example.notes.ShareExt') }; } },
      { method: 'POST', match: /^\/v1\/bundleIdCapabilities$/, answer: (c: { body: unknown }) => {
        const a = (c.body as { data: { attributes: { capabilityType: string }; relationships: { bundleId: { data: { id: string } } } } }).data;
        caps[a.relationships.bundleId.data.id]!.push(a.attributes.capabilityType);
        return { data: { type: 'bundleIdCapabilities', id: 'x', attributes: { capabilityType: a.attributes.capabilityType } } };
      } },
      { match: /^\/v1\/certificates\?/, answer: page([]) },
      { method: 'POST', match: /^\/v1\/certificates$/, answer: { data: { type: 'certificates', id: 'CERT0001', attributes: { certificateType: 'DISTRIBUTION', name: 'Apple Distribution: Example', expirationDate: '2099-01-01T00:00:00.000+00:00', certificateContent: Buffer.from('cert').toString('base64') } } } },
      { match: /^\/v1\/bundleIds\/[A-Z0-9]+\/profiles/, answer: page([]) },
      { method: 'POST', match: /^\/v1\/profiles$/, answer: (c: { body: unknown }) => {
        const id = (c.body as { data: { relationships: { bundleId: { data: { id: string } } } } }).data.relationships.bundleId.data.id;
        const groups = o.groupInProfile ? { 'com.apple.security.application-groups': ['group.com.example.notes'] } : {};
        return { data: { type: 'profiles', id: `PROF_${id}`, attributes: { name: `storebound ${id}`, profileType: 'IOS_APP_STORE', profileState: 'ACTIVE', uuid: `uuid-${id}`, expirationDate: '2099-01-01T00:00:00.000+00:00', profileContent: prov({ 'application-identifier': `ABCDE12345.${id}`, ...groups }) } } };
      } },
      { match: /^\/v1\/apps\/6400000101\/gameCenterDetail/, answer: { errors: [{ status: '404' }] }, status: 404 },
    ];
    return { routes: routes as never, caps, isRegistered: () => registered };
  }

  test('--dry lists every target: the extension bundle id, its capabilities and (manual) its profile', async () => {
    ascEnv();
    const p = project(cfg('manual'), files);
    const s = store({ groupInProfile: true });
    const calls = mockFetch(s.routes);
    const r = await capture(() => signing(p.ctx(['ensure', '--dry'])));
    const all = r.out + r.err;
    expect(all).toContain('POST /v1/bundleIds');
    expect(all).toContain('register com.example.notes.ShareExt');
    expect(all).toMatch(/POST \/v1\/bundleIdCapabilities \{capabilityType="APP_GROUPS"\}  # com\.example\.notes\.ShareExt, after it is registered/);
    expect(all).toContain('ASSOCIATED_DOMAINS');
    expect(all).toContain('# com.example.notes.ShareExt: with the new certificate');
    expect(all).not.toContain('ASSOCIATED_DOMAINS is in ios/App/Share/Share.entitlements');   // the extension's entitlements are not compared with the app's App ID
    expect(calls.filter(c => c.method !== 'GET')).toEqual([]);
  });

  test('automatic: registers the extension bundle id and its capabilities, reads them back, no profile', async () => {
    ascEnv();
    const p = project(cfg('automatic'), files);
    const s = store({ groupInProfile: true });
    const calls = mockFetch(s.routes);
    const r = await capture(() => signing(p.ctx(['ensure', '--yes'])));
    expect(r.exit).toBeNull();
    const writes = calls.filter(c => c.method !== 'GET').map(c => `${c.method} ${c.path}`);
    expect(writes[0]).toBe('POST /v1/bundleIds');
    expect(writes.filter(w => w === 'POST /v1/bundleIdCapabilities')).toHaveLength(2);
    expect(writes.some(w => /profiles|certificates/.test(w))).toBe(false);
    expect(s.caps.EXT0001!.sort()).toEqual(['APP_GROUPS', 'ASSOCIATED_DOMAINS']);
    const reg = calls.find(c => c.method === 'POST' && c.path === '/v1/bundleIds')!.body as { data: { attributes: Record<string, string> } };
    expect(reg.data.attributes).toMatchObject({ identifier: 'com.example.notes.ShareExt', platform: 'IOS', name: 'Example Notes ShareExt' });
  });

  test('manual: a profile for the app and the extension; the group missing from the profile fails with the portal link and steps', async () => {
    ascEnv();
    const p = project(cfg('manual'), files);
    const s = store({ groupInProfile: false });
    const calls = mockFetch(s.routes);
    const r = await capture(() => signing(p.ctx(['ensure', '--yes', '--no-install']))).catch(e => ({ out: '', err: String(e.message ?? e), exit: 1 }));
    const all = r.out + r.err;
    expect(calls.filter(c => c.method === 'POST' && c.path === '/v1/profiles')).toHaveLength(2);
    expect(all).toContain('com.example.notes.ShareExt: the newest profile lacks App Group(s) group.com.example.notes');
    expect(all).toContain('console plan apple-app-group --bundle-id com.example.notes');
    expect(all).toContain('https://developer.apple.com/account/resources/identifiers/bundleId/edit/EXT0001');
    expect(all).toContain('signing ensure --refresh-profile');
  });

  test('manual: the profile carries the group: ensure finishes', async () => {
    ascEnv();
    const p = project(cfg('manual'), files);
    const s = store({ groupInProfile: true });
    mockFetch(s.routes);
    const r = await capture(() => signing(p.ctx(['ensure', '--yes', '--no-install'])));
    expect(r.exit).toBeNull();
    expect(r.out + r.err).toContain('signing ready');
  });
});

describe('App Group association: verdicts (pure)', () => {
  const t = [{ bundleId: 'com.example.notes.ShareExt', appGroups: ['group.com.example.notes'] }];
  const ent = (g: string[]) => ({ 'com.apple.security.application-groups': g });

  test('a readable profile with the group proves it; one without it is a gap with the deep link', () => {
    expect(appGroupVerdicts(t, () => ({ resourceId: 'EXT0001', capabilityOn: true, profileEnt: ent(['group.com.example.notes']) }))).toEqual({ gaps: [], unproven: [], ok: ['com.example.notes.ShareExt'] });
    const v = appGroupVerdicts(t, () => ({ resourceId: 'EXT0001', capabilityOn: true, profileEnt: {} }));
    expect(v.gaps).toHaveLength(1);
    expect(v.gaps[0]).toMatchObject({ bundleId: 'com.example.notes.ShareExt', groups: ['group.com.example.notes'], url: bundleIdPortalUrl('EXT0001') });
    expect(v.gaps[0]!.why).toContain('empty application-groups');
  });

  test('capability settings that name the group prove it without a profile', () => {
    const settings = [{ key: 'APP_GROUPS', options: [{ key: 'group.com.example.notes' }] }];
    expect(capabilityGroups(settings, ['group.com.example.notes', 'group.com.example.other'])).toEqual(['group.com.example.notes']);
    expect(appGroupVerdicts(t, () => ({ resourceId: 'EXT0001', capabilityOn: true, capabilitySettings: settings, profileEnt: null })).ok).toEqual(['com.example.notes.ShareExt']);
  });

  test('nothing readable is unproven (not a gap); the capability off is a gap even without a profile', () => {
    const u = appGroupVerdicts(t, () => ({ resourceId: 'EXT0001', capabilityOn: true, capabilitySettings: null, profileEnt: null }));
    expect([u.gaps.length, u.unproven.length]).toEqual([0, 1]);
    expect(u.unproven[0]!.why).toContain('cannot be proven');
    expect(appGroupVerdicts(t, () => null).unproven).toHaveLength(1);
    const off = appGroupVerdicts(t, () => ({ resourceId: 'EXT0001', capabilityOn: false, profileEnt: null }));
    expect(off.gaps[0]!.why).toContain('capability is not enabled');
  });

  test('the steps name the portal path, the deep link, the plan command and the refresh', () => {
    const s = appGroupSteps({ bundleId: 'com.example.notes.ShareExt', resourceId: 'EXT0001', groups: ['group.com.example.notes'], url: bundleIdPortalUrl('EXT0001') }).join('\n');
    expect(s).toContain('Certificates, Identifiers & Profiles > Identifiers > com.example.notes.ShareExt > App Groups');
    expect(s).toContain('Configure > tick group.com.example.notes');
    expect(s).toContain('Continue > Save');
    expect(s).toContain('storebound console plan apple-app-group --bundle-id com.example.notes.ShareExt');
    expect(s).toContain('storebound apple signing ensure --refresh-profile');
  });
});

describe('App Group association under automatic signing (fake App Store Connect)', () => {
  beforeEach(() => { upsertTiming.waitMs = 0; });
  afterEach(() => { restore(); upsertTiming.waitMs = 3000; });

  const MAIN = 'BUNDLE0001', EXT = 'EXT0001';
  const cfg = { ...BASE, apple: { bundleId: 'com.example.notes', appId: '6400000101', signing: { style: 'automatic' as const, teamId: 'ABCDE12345', capabilities: ['IN_APP_PURCHASE' as const] } } };
  const prov = (ent: Record<string, unknown>): string => Buffer.from(`\x30\x82\x01junk${toXmlPlist({ Name: 'x', Entitlements: ent as Record<string, string | string[]> })}\x00`, 'latin1').toString('base64');
  const managed = (id: string, ent: Record<string, unknown>) => ({ type: 'profiles', id: `MANAGED_${id}`, attributes: { name: `iOS Team Store Provisioning Profile: ${id}`, profileType: 'IOS_APP_STORE', profileState: 'ACTIVE', uuid: `uuid-${id}`, expirationDate: '2099-01-01T00:00:00.000+00:00', profileContent: prov(ent) } });
  const GROUP = { 'com.apple.security.application-groups': ['group.com.example.notes'] };
  const page = (data: unknown[], included: unknown[] = []) => ({ data, included, links: { self: '' }, meta: { paging: { total: data.length, limit: 200 } } });

  function api(o: { ext?: unknown[]; main?: unknown[]; extSettings?: unknown; extCaps?: string[] }) {
    const caps: Record<string, string[]> = { [MAIN]: ['IN_APP_PURCHASE', 'PUSH_NOTIFICATIONS', 'APP_GROUPS'], [EXT]: o.extCaps ?? ['APP_GROUPS', 'ASSOCIATED_DOMAINS'] };
    const bundle = (id: string, ident: string) => ({ type: 'bundleIds', id, attributes: { identifier: ident, platform: 'IOS', seedId: 'ABCDE12345' }, relationships: { bundleIdCapabilities: { data: caps[id]!.map(t => ({ type: 'bundleIdCapabilities', id: `${id}_${t}` })) } } });
    const incl = (id: string) => caps[id]!.map(t => ({ type: 'bundleIdCapabilities', id: `${id}_${t}`, attributes: { capabilityType: t, settings: id === EXT && t === 'APP_GROUPS' ? (o.extSettings ?? null) : null } }));
    return [
      { match: /^\/v1\/bundleIds\?filter\[identifier\]=com\.example\.notes\.ShareExt/, answer: () => page([bundle(EXT, 'com.example.notes.ShareExt')], incl(EXT)) },
      { match: /^\/v1\/bundleIds\?filter\[identifier\]=com\.example\.notes&/, answer: () => page([bundle(MAIN, 'com.example.notes')], incl(MAIN)) },
      { match: /^\/v1\/certificates\?/, answer: page([]) },
      { match: new RegExp(`^/v1/bundleIds/${EXT}/profiles`), answer: () => page(o.ext ?? []) },
      { match: new RegExp(`^/v1/bundleIds/${MAIN}/profiles`), answer: () => page(o.main ?? [managed('com.example.notes', GROUP)]) },
      { match: /^\/v1\/profiles\/MANAGED_[^/]+\/relationships\/certificates/, answer: { errors: [{ status: '404' }] }, status: 404 },
      { match: /^\/v1\/apps\/6400000101\/gameCenterDetail/, answer: { errors: [{ status: '404' }] }, status: 404 },
    ] as never;
  }
  const ensure = async (argv: string[] = ['ensure', '--yes']) => {
    const p = project(cfg, files);
    const calls = mockFetch(api(current));
    const r = await capture(() => signing(p.ctx(argv))).catch(e => ({ out: '', err: String(e.message ?? e), exit: 1 }));
    return { r, all: r.out + r.err, calls };
  };
  let current: Parameters<typeof api>[0] = {};

  test('the extension\'s newest (Xcode-managed) profile has an empty group list: ensure stops with the steps, the deep link and the plan command', async () => {
    ascEnv();
    current = { ext: [managed('com.example.notes.ShareExt', {})] };
    const { r, all, calls } = await ensure();
    expect(r.exit).toBe(1);
    expect(all).toContain('com.example.notes.ShareExt: the newest profile lacks App Group(s) group.com.example.notes');
    expect(all).toContain('https://developer.apple.com/account/resources/identifiers/bundleId/edit/EXT0001');
    expect(all).toContain('Configure > tick group.com.example.notes');
    expect(all).toContain('storebound console plan apple-app-group --bundle-id com.example.notes.ShareExt');
    expect(all).toContain('storebound apple signing ensure --refresh-profile');
    expect(calls.filter(c => c.method !== 'GET')).toEqual([]);
  });

  test('the managed profile carries the group: ensure finishes without a warning', async () => {
    ascEnv();
    current = { ext: [managed('com.example.notes.ShareExt', GROUP)] };
    const { r, all } = await ensure();
    expect(r.exit).toBeNull();
    expect(all).not.toContain('cannot be proven');
    expect(all).toContain('capabilities in step');
  });

  test('no profile and no capability field to read: ensure warns with the portal steps instead of passing silently', async () => {
    ascEnv();
    current = { ext: [] };
    const { r, all } = await ensure();
    expect(r.exit).toBeNull();
    expect(all).toContain('cannot be proven');
    expect(all).toContain('storebound console plan apple-app-group --bundle-id com.example.notes.ShareExt');
  });

  test('a capability field that names the group proves it', async () => {
    ascEnv();
    current = { ext: [], extSettings: [{ key: 'APP_GROUPS', options: [{ key: 'group.com.example.notes' }] }] };
    const { all } = await ensure();
    expect(all).not.toContain('cannot be proven');
  });

  test('status --json lists the gap and the unproven targets; the main app (profile without groups) is a gap too', async () => {
    ascEnv();
    current = { ext: [], main: [managed('com.example.notes', {})] };
    const p = project(cfg, files);
    mockFetch(api(current));
    const r = await capture(() => signing(p.ctx(['status', '--json'])));
    const j = JSON.parse(r.out.slice(r.out.indexOf('{')));
    expect(j.appGroupGaps.map((g: { bundleId: string }) => g.bundleId)).toEqual(['com.example.notes']);
    expect(j.appGroupUnproven.map((g: { bundleId: string }) => g.bundleId)).toEqual(['com.example.notes.ShareExt']);
  });

  test('apple build stops before the archive on a proven gap, builds on --allow-app-group-gap, and only warns on an unproven one', async () => {
    ascEnv();
    const { run: build } = await import('../cli/apple/build');
    const argv = ['--build-number', '5', '--no-prebuild', '--dry'];
    // dry: warns (never throws)
    current = { ext: [managed('com.example.notes.ShareExt', {})] };
    let p = project(cfg, files);
    mockFetch(api(current));
    let r = await capture(() => build(p.ctx(argv)));
    expect(r.err).toContain('the newest profile lacks App Group(s)');
    // not dry: early exit, before any xcodebuild step
    p = project(cfg, files);
    mockFetch(api(current));
    r = await capture(() => build(p.ctx(['--build-number', '5', '--no-prebuild']))).catch(e => ({ out: '', err: String(e.message ?? e), exit: 1 }));
    expect(r.exit).toBe(1);
    expect(r.err).toContain('stopped before the archive');
    expect(r.err).toContain('console plan apple-app-group --bundle-id com.example.notes.ShareExt');
    expect(r.err).toContain('--allow-app-group-gap');
    // unproven: a warning with the same steps, no throw at the group check
    current = { ext: [] };
    p = project(cfg, files);
    mockFetch(api(current));
    r = await capture(() => build(p.ctx(argv)));
    expect(r.err).toContain('cannot be proven');
  });
});

describe('console plan / verify apple-app-group', () => {
  afterEach(() => { restore(); });

  test('the plan: deep link per resource id, the portal labels, the answer sheet per extension, never-press list, Save is the agent\'s', () => {
    const p = consolePlan('apple-app-group', BASE, { appGroupTargets: [{ bundleId: 'com.example.notes.ShareExt', groups: ['group.com.example.notes'], resourceId: 'EXT0001' }] });
    expect(p).toMatchObject({ form: 'apple-app-group', store: 'apple', fillable: true });
    expect(p.start).toEqual({ url: 'https://developer.apple.com/account/resources/identifiers/bundleId/edit/EXT0001', deepLink: true, reach: [] });
    const text = p.steps.map(s => s.text).join('\n');
    for (const label of ['App Groups', 'Configure', 'Continue', 'Save', 'Confirm']) expect(text).toContain(label);
    expect(p.answers.map(a => a.id)).toEqual(['com.example.notes.ShareExt/capability', 'com.example.notes.ShareExt/group.com.example.notes']);
    expect(p.answers[1]).toMatchObject({ label: 'group.com.example.notes', action: 'tick', control: 'checkbox', status: 'certain' });
    const inSteps = new Set(p.steps.flatMap(s => s.answers ?? []));
    for (const a of p.answers) expect(inSteps.has(a.id)).toBe(true);
    for (const b of ['Remove', 'Delete', 'Revoke', 'Publish', 'Submit']) expect(p.buttons.neverPress).toContain(b);
    expect(p.buttons.neverPress).not.toContain('Save');
    expect(p.buttons).toMatchObject({ final: 'Save', finalByAgent: true });
    for (const b of p.buttons.allowed) expect(b.class).not.toBe('final-submit');
    expect(p.ownerBatch).toEqual([]);
    expect(p.verify.command).toBe('storebound console verify apple-app-group --bundle-id com.example.notes.ShareExt');
    expect(planText(p)).toContain('the agent\'s own, not a store submission');
    p.steps.forEach((s, i) => expect(s.n).toBe(i + 1));
  });

  test('without a resource id the plan starts at the Identifiers list and says --lookup; without targets the group ids are asked', () => {
    const p = consolePlan('apple-app-group', BASE, { appGroupTargets: [{ bundleId: 'com.example.notes.ShareExt', groups: ['group.com.example.notes'] }] });
    expect(p.start).toMatchObject({ url: 'https://developer.apple.com/account/resources/identifiers/list', deepLink: false });
    expect(p.start.reach.join(' ')).toContain('--lookup');
    const none = consolePlan('apple-app-group', BASE);
    expect(none.answers[0]).toMatchObject({ status: 'ask-owner', value: null });
    expect(none.askOwner).toHaveLength(1);
  });

  test('the plan is in the form list and the MCP tools, and the plan command works from the CLI', async () => {
    expect(PLAN_FORM_IDS).toContain('apple-app-group');
    expect(CONSOLE_PLAN_FORMS).toContain('apple-app-group');
    const t = TOOLS.find(x => x.name === 'console_plan')!;
    expect(validateInput(t, { form: 'apple-app-group', bundleId: 'com.example.notes.ShareExt', lookup: true })).toEqual([]);
    expect(t.args!({ form: 'apple-app-group', bundleId: 'com.example.notes.ShareExt', groups: 'group.com.example.notes' })).toEqual(['apple-app-group', '--bundle-id', 'com.example.notes.ShareExt', '--groups', 'group.com.example.notes', '--json']);
    const { run: plan } = await import('../cli/console/plan');
    const p = project({ ...BASE, apple: { bundleId: 'com.example.notes' } }, files);
    const r = await capture(() => plan(p.ctx(['apple-app-group', '--json'])));
    const j = JSON.parse(r.out);
    expect(j.answers.map((a: { id: string }) => a.id)).toEqual(['com.example.notes/capability', 'com.example.notes/group.com.example.notes', 'com.example.notes.ShareExt/capability', 'com.example.notes.ShareExt/group.com.example.notes']);
    const one = await capture(() => plan(p.ctx(['apple-app-group', '--bundle-id', 'com.example.notes.ShareExt', '--json'])));
    expect(JSON.parse(one.out).answers).toHaveLength(2);
  });

  test('verify reads the API: present groups match, a missing one mismatches, an unprovable one fails', async () => {
    const targets = [{ bundleId: 'com.example.notes.ShareExt', appGroups: ['group.com.example.notes', 'group.com.example.other'] }];
    const ok = verifyAppGroupsApi(targets, { gaps: [], unproven: [], ok: ['com.example.notes.ShareExt'] });
    expect([ok.ok, ok.matched, ok.mismatches]).toEqual([true, 2, 0]);
    const gap = verifyAppGroupsApi(targets, { gaps: [{ bundleId: 'com.example.notes.ShareExt', resourceId: 'EXT0001', groups: ['group.com.example.other'], url: null, why: 'the newest profile lacks it' }], unproven: [], ok: [] });
    expect([gap.ok, gap.matched, gap.mismatches]).toEqual([false, 1, 1]);
    expect(gap.rows.find(r => r.status === 'mismatch')!.item).toContain('group.com.example.other');
    const un = verifyAppGroupsApi(targets, { gaps: [], unproven: [{ bundleId: 'com.example.notes.ShareExt', resourceId: null, groups: ['group.com.example.notes', 'group.com.example.other'], url: null }], ok: [] });
    expect(un.ok).toBe(false);
    expect(un.rows[0]!.note).toContain('signing ensure --refresh-profile');
    expect(() => verifyText('apple-app-group', BASE, 'x')).toThrow('reads the App Store Connect API');
  });

  test('console verify apple-app-group end to end with a fake API: missing then present after the refreshed profile', async () => {
    ascEnv();
    const { run: verify } = await import('../cli/console/verify');
    const prov = (ent: Record<string, unknown>): string => Buffer.from(`\x30\x82\x01junk${toXmlPlist({ Name: 'x', Entitlements: ent as Record<string, string | string[]> })}\x00`, 'latin1').toString('base64');
    const prof = (ent: Record<string, unknown>) => ({ type: 'profiles', id: 'P1', attributes: { name: 'p', profileType: 'IOS_APP_STORE', profileState: 'ACTIVE', uuid: 'u', expirationDate: '2099-01-01T00:00:00.000+00:00', profileContent: prov(ent) } });
    const page = (data: unknown[], included: unknown[] = []) => ({ data, included, links: { self: '' }, meta: { paging: { total: data.length, limit: 200 } } });
    const run = async (ent: Record<string, unknown>) => {
      mockFetch([
        { match: /^\/v1\/bundleIds\?filter\[identifier\]=com\.example\.notes\.ShareExt/, answer: page([{ type: 'bundleIds', id: 'EXT0001', attributes: { identifier: 'com.example.notes.ShareExt', platform: 'IOS' }, relationships: { bundleIdCapabilities: { data: [{ type: 'bundleIdCapabilities', id: 'c1' }] } } }], [{ type: 'bundleIdCapabilities', id: 'c1', attributes: { capabilityType: 'APP_GROUPS', settings: null } }]) },
        { match: /^\/v1\/bundleIds\/EXT0001\/profiles/, answer: page([prof(ent)]) },
      ] as never);
      const p = project({ ...BASE, apple: { bundleId: 'com.example.notes', appId: '6400000101' } }, files);
      return capture(() => verify(p.ctx(['apple-app-group', '--bundle-id', 'com.example.notes.ShareExt'])));
    };
    const before = await run({});
    expect(before.exit).toBe(1);
    expect(before.out).toContain('mismatch');
    restore(); ascEnv();
    const after = await run({ 'com.apple.security.application-groups': ['group.com.example.notes'] });
    expect(after.exit).toBeNull();
    expect(after.out).toContain('match');
  });
});

describe('apple build over SSH: the keychain fixes', () => {
  test('the refusal names the GUI session, the CI runner and the keychain flags', () => {
    const m = sshBuildRefusal('this is an SSH session');
    expect(m).toContain('errSecInternalComponent');
    expect(m).toContain('open -a Terminal');
    expect(m).toContain('Jenkins');
    expect(m).toContain('security unlock-keychain');
    expect(m).toContain('security set-key-partition-list');
    expect(m).toContain('--keychain-unlock');
    expect(m).toContain('--keychain <path>');
    expect(m).toContain(KEYCHAIN_PASSWORD_ENV);
    expect(sshBuildRefusal('x', { unlockFlag: false })).not.toContain('--keychain-unlock');
  });

  test('unlock steps carry a PASSWORD placeholder that is never shown; the build keychain joins the search list', () => {
    const steps = unlockSteps('/tmp/build.keychain-db', ['/Users/example/Library/Keychains/login.keychain-db']);
    expect(steps.map(s => s[1])).toEqual(['unlock-keychain', 'set-key-partition-list', 'list-keychains']);
    expect(steps[1]).toContain('apple-tool:,apple:,codesign:');
    expect(steps[2]).toEqual(['security', 'list-keychains', '-d', 'user', '-s', '/tmp/build.keychain-db', '/Users/example/Library/Keychains/login.keychain-db']);
    expect(showSecurity(steps[0]!)).toBe(`security unlock-keychain -p $${KEYCHAIN_PASSWORD_ENV} /tmp/build.keychain-db`);
    expect(unlockSteps('/a', ['/a']).map(s => s[1])).toEqual(['unlock-keychain', 'set-key-partition-list']);
    expect(parseKeychainList('    "/Users/example/Library/Keychains/login.keychain-db"\n    "/Library/Keychains/System.keychain"\n')).toEqual(['/Users/example/Library/Keychains/login.keychain-db', '/Library/Keychains/System.keychain']);
  });

  test('the password comes from the environment; its absence is an error that names the variable only', () => {
    expect(() => keychainPassword({})).toThrow(KEYCHAIN_PASSWORD_ENV);
    expect(keychainPassword({ [KEYCHAIN_PASSWORD_ENV]: 'pw-for-test' })).toBe('pw-for-test');
    try { keychainPassword({}); } catch (e) { expect((e as Error).message).not.toContain('pw-for-test'); }
  });
});

describe('storebound api writes: --yes --confirm <operationId>', () => {
  const w = { store: 'apple' as const, method: 'POST', kind: 'write' as const, opId: 'bundleIds_createInstance', yes: false, tty: false, dry: false, agent: false };
  test('the usage and the refusals show the example', () => {
    expect(USAGE).toContain('--yes --confirm bundleIds_createInstance');
    expect(NOT_A_TTY).toContain('--yes --confirm bundleIds_createInstance');
    const d = decide(w as never);
    expect(d.action).toBe('dry');
    const why = (d as { why: string }).why;
    expect(why).toContain('--yes --confirm bundleIds_createInstance');
    expect(why).toContain('storebound api apple bundleIds_createInstance --body body.json');
  });
});