/** @jest-environment node */

import { mkdir, mkdtemp, readFile, rm, writeFile } from 'fs/promises'
import { existsSync, readFileSync } from 'fs'
import { spawnSync } from 'child_process'
import os from 'os'
import path from 'path'

function extractBashFunction(source: string, name: string): string {
  const match = source.match(new RegExp(`(?:^|\\n)${name}\\(\\) \\{[\\s\\S]*?\\n\\}`, 'm'))
  if (!match) {
    throw new Error(`Bash function not found: ${name}`)
  }
  return match[0].trimStart()
}

function findBash(): string | null {
  const candidates = process.platform === 'win32'
    ? [
        'C:\\Program Files\\Git\\bin\\bash.exe',
        'C:\\Program Files\\Git\\usr\\bin\\bash.exe',
      ]
    : ['/bin/bash', '/usr/bin/bash']
  return candidates.find(existsSync) || null
}

function toBashPath(value: string): string {
  if (process.platform !== 'win32') return value
  const match = value.match(/^([A-Za-z]):[\\/](.*)$/)
  if (!match) return value.replace(/\\/g, '/')
  return `/${match[1].toLowerCase()}/${match[2].replace(/\\/g, '/')}`
}

function runBashGate(
  bash: string,
  functions: string,
  invocation: string,
  variables: Record<string, string>,
) {
  return spawnSync(bash, ['-s'], {
    cwd: process.cwd(),
    encoding: 'utf8',
    input: `set -u\n${functions}\n${invocation}\n`,
    env: {
      ...process.env,
      MSYS2_ARG_CONV_EXCL: '*',
      MSYS_NO_PATHCONV: '1',
      ...variables,
    },
  })
}

describe('production video transcode drain gate', () => {
  let script: string

  beforeAll(async () => {
    script = (await readFile(path.join(process.cwd(), 'scripts/git-incremental-deploy.ps1'), 'utf8'))
      .replace(/\r\n/g, '\n')
  })

  test('默认走单槽直接替换：同名停旧、启新，健康失败时恢复旧镜像', () => {
    const strategy = script.indexOf("[ValidateSet('direct')]")
    const directFunction = script.indexOf('direct_replace_active_container() {')
    const directBranch = script.indexOf('direct_replace_active_container "$CURRENT_CONTAINER"')
    const legacyDrain = script.indexOf('for TRANSCODE_DRAIN_SOURCE in $TRANSCODE_DRAIN_SOURCES; do')
    const directBody = extractBashFunction(script, 'direct_replace_active_container')
    const restoreBody = extractBashFunction(script, 'restore_direct_previous_container')
    const retireBody = extractBashFunction(script, 'retire_inactive_direct_slot')

    expect(strategy).toBeGreaterThan(0)
    expect(script).toContain("[string]$DeploymentStrategy = 'direct'")
    expect(directFunction).toBeGreaterThan(0)
    expect(directBranch).toBeGreaterThan(0)
    expect(directBranch).toBeLessThan(legacyDrain)
    expect(directBody).toContain('docker stop --time 10 "$name"')
    expect(directBody).toContain('docker rm "$name"')
    expect(directBody).toContain('create_container "$name" "$REGISTRY_COMMIT" 0')
    expect(directBody).toContain('fail_direct_replace_with_restore')
    expect(directBody).toContain('retire_inactive_direct_slot "$name"')
    expect(directBody).toContain('rm -f -- "$(transcode_drain_file "$name")" "$(task_detail_drain_file "$name")"')
    expect(restoreBody).toContain('create_container "$name" "$previous_image" 0')
    expect(restoreBody).toContain('verify_proxy_target "$name"')
    expect(retireBody).toContain('docker stop --time 10 "$inactive_name"')
    expect(retireBody).toContain('docker rm "$inactive_name"')
  })

  test('复用镜像只接受已发布的同一精确 SHA，且不触发 Docker 构建或推送', () => {
    const reuse = script.indexOf('if [ "$REUSE_VERIFIED_IMAGE" = "1" ]; then')
    const build = script.indexOf('start_remote_step "Docker Build"')
    const verify = script.indexOf('start_remote_step "Verify Existing Image"')
    const identity = script.indexOf('resolve_published_image_identity() {')

    expect(script).toContain('[switch]$ReuseVerifiedImage')
    expect(script).toContain('-ReuseVerifiedImage cannot be combined with -SkipBuild, -SkipPush, -SkipDeploy, or -NoCache.')
    expect(script).toContain('docker pull "$LOCAL_REGISTRY_COMMIT"')
    expect(script).toContain('Existing exact-SHA image does not contain the requested Git revision')
    expect(script).toContain('docker tag "$LOCAL_REGISTRY_COMMIT" "$REGISTRY_TAG"')
    expect(reuse).toBeGreaterThan(0)
    expect(verify).toBeGreaterThan(reuse)
    expect(build).toBeGreaterThan(verify)
    expect(identity).toBeGreaterThan(build)
  })

  test('先设置旧容器两类后台 worker drain 并确认 inactive，再启动候选容器', () => {
    const drain = script.indexOf('request_video_transcode_drain "$TRANSCODE_DRAIN_SOURCE"')
    const taskDetailDrain = script.indexOf('request_task_detail_upload_drain "$TRANSCODE_DRAIN_SOURCE"', drain)
    const candidate = script.indexOf('log "Starting candidate container $NEXT_CONTAINER"')

    expect(drain).toBeGreaterThan(0)
    expect(taskDetailDrain).toBeGreaterThan(drain)
    expect(candidate).toBeGreaterThan(taskDetailDrain)
    expect(script).toContain('wait_for_video_transcode_drain "$name"')
    expect(script).toContain('wait_for_task_detail_upload_drain "$name"')
  })

  test('蓝绿入口存在时仍逐个排空意外运行的直连容器，且绝不强制删除', () => {
    const discoverCurrent = script.indexOf('if ! CURRENT_CONTAINER="$(discover_current_container)"; then')
    const collectDirect = script.indexOf('if [ -n "$LEGACY_IMAGE" ] && container_running "$CONTAINER_NAME"; then', discoverCurrent)
    const drainLoop = script.indexOf('for TRANSCODE_DRAIN_SOURCE in $TRANSCODE_DRAIN_SOURCES; do', collectDirect)
    const verifyLease = script.indexOf('verify_transcode_lease_schema "$TRANSCODE_DRAIN_SOURCE"', drainLoop)
    const requestDrain = script.indexOf('request_video_transcode_drain "$TRANSCODE_DRAIN_SOURCE"', verifyLease)
    const candidate = script.indexOf('log "Starting candidate container $NEXT_CONTAINER"', requestDrain)
    const finalDirectRemoval = script.lastIndexOf('remove_video_container_safely "$CONTAINER_NAME"')

    expect(collectDirect).toBeGreaterThan(discoverCurrent)
    expect(drainLoop).toBeGreaterThan(collectDirect)
    expect(verifyLease).toBeGreaterThan(drainLoop)
    expect(requestDrain).toBeGreaterThan(verifyLease)
    expect(candidate).toBeGreaterThan(requestDrain)
    expect(finalDirectRemoval).toBeGreaterThan(candidate)
    expect(script).toContain('TRANSCODE_DRAIN_SOURCES="${TRANSCODE_DRAIN_SOURCES} ${CONTAINER_NAME}"')
    expect(script).toContain('Legacy direct container could not be proven inactive and was preserved')
    expect(script).not.toContain('docker rm -f "$CONTAINER_NAME"')
  })

  test('正式发布发现任何运行中的影子容器时，在触碰生产入口前 fail-closed', () => {
    const shadowDiscovery = script.indexOf("RUNNING_CONTAINER_METADATA=\"$(docker ps --format")
    const shadowFailure = script.indexOf('Running shadow container(s) detected; production deployment is blocked', shadowDiscovery)
    const directTopologyGate = script.indexOf('LEGACY_IMAGE="$(docker inspect', shadowFailure)
    const proxyMutation = script.indexOf('mkdir -p "$PROXY_ROOT"', directTopologyGate)
    const currentDiscovery = script.indexOf('CURRENT_CONTAINER="$(discover_current_container)"', proxyMutation)

    expect(shadowDiscovery).toBeGreaterThan(0)
    expect(shadowFailure).toBeGreaterThan(shadowDiscovery)
    expect(directTopologyGate).toBeGreaterThan(shadowFailure)
    expect(proxyMutation).toBeGreaterThan(directTopologyGate)
    expect(currentDiscovery).toBeGreaterThan(proxyMutation)
    expect(script).toContain('if [ "$TARGET" = "production" ]; then')
    expect(script).toContain('$1 == "youyidian-3d-material-shadow"')
    expect(script).toContain('$1 ~ /^youyidian-3d-shadow($|[-_])/')
    expect(script).toContain('{{.Label "com.docker.compose.service"}}')
    expect(script).toContain('$2 == "app-shadow"')
    expect(script).toContain('Cannot inspect running containers for shadow topology')
    expect(script).toContain('until they are stopped and verified')
  })

  test('uploads 路径必须显式落入受控 allowlist，默认锁定当前正式 ZFS 数据集', () => {
    expect(script).toContain("$defaultUploadsMount = '/mnt/PoolOne/youyidian-uploads'")
    expect(script).toContain("'/mnt/PoolOne/apps/youyidian-3d/uploads'")
    expect(script).toContain('[string]$UploadsMount = $env:GONGXIANGP2_UPLOADS_MOUNT')
    expect(script).toContain('$trustedUploadsMounts -cnotcontains $UploadsMount')
    expect(script).toContain("'__UPLOADS_MOUNT__'            = ConvertTo-ShellSingleQuoted $UploadsMount")
    expect(script).not.toContain("UPLOADS_MOUNT='/mnt/PoolOne/apps/youyidian-3d/uploads'")
  })

  test('findmnt 模拟拒绝根盘目录壳、多行或未受信 tuple，并接受两条显式路径', () => {
    const bash = findBash()
    expect(bash).not.toBeNull()
    if (!bash) return

    const helper = extractBashFunction(script, 'uploads_findmnt_metadata_is_trusted')
    const invoke = 'uploads_findmnt_metadata_is_trusted "$CASE_PATH" "$CASE_MOUNT" "$CASE_ROOT"'
    const run = (casePath: string, mount: string, root = '/ /dev/sda2 ext4') => runBashGate(
      bash,
      helper,
      invoke,
      { CASE_PATH: casePath, CASE_MOUNT: mount, CASE_ROOT: root },
    )

    expect(run(
      '/mnt/PoolOne/youyidian-uploads',
      '/mnt/PoolOne/youyidian-uploads PoolOne/youyidian-uploads zfs',
    ).status).toBe(0)
    expect(run(
      '/mnt/PoolOne/apps/youyidian-3d/uploads',
      '/mnt/PoolOne PoolOne zfs',
    ).status).toBe(0)
    expect(run(
      '/mnt/PoolOne/youyidian-uploads',
      '/ /dev/sda2 ext4',
    ).status).not.toBe(0)
    expect(run(
      '/mnt/PoolOne/youyidian-uploads',
      '/mnt/PoolOne/youyidian-uploads PoolOne/youyidian-uploads ext4',
    ).status).not.toBe(0)
    expect(run(
      '/mnt/PoolOne/youyidian-uploads',
      '/mnt/PoolOne/youyidian-uploads PoolOne/youyidian-uploads zfs\n/ /dev/sda2 ext4',
    ).status).not.toBe(0)
  })

  test('Docker Mounts 模拟拒绝 volume、错 source、只读和重复 /app/uploads；旧容器仅可用已解析到同一数据盘的别名', () => {
    const bash = findBash()
    expect(bash).not.toBeNull()
    if (!bash) return

    const helper = extractBashFunction(script, 'uploads_container_mount_metadata_is_trusted')
    const invoke = 'uploads_container_mount_metadata_is_trusted "$EXPECTED_SOURCE" "$CASE_METADATA"'
    const expectedSource = '/mnt/PoolOne/youyidian-uploads'
    const run = (metadata: string) => runBashGate(
      bash,
      helper,
      invoke,
      { EXPECTED_SOURCE: expectedSource, CASE_METADATA: metadata },
    )

    expect(run(`/app/uploads\tbind\t${expectedSource}\ttrue`).status).toBe(0)
    expect(run('/app/uploads\tvolume\tuploads-volume\ttrue').status).not.toBe(0)
    expect(run('/app/uploads\tbind\t/mnt/PoolOne/apps/youyidian-3d/uploads\ttrue').status).not.toBe(0)
    expect(run(`/app/uploads\tbind\t${expectedSource}\tfalse`).status).not.toBe(0)
    expect(run(
      `/app/uploads\tbind\t${expectedSource}\ttrue\n/app/uploads\tbind\t${expectedSource}\ttrue`,
    ).status).not.toBe(0)

    const legacySource = '/mnt/PoolOne/apps/youyidian-3d/uploads'
    const aliasHelper = `
readlink() {
  if [ "$3" = "${legacySource}" ]; then
    printf '%s\\n' "${expectedSource}"
  else
    printf '%s\\n' "$3"
  fi
}
${helper}`
    const runWithResolvedAlias = (allowAlias: string) => runBashGate(
      bash,
      aliasHelper,
      'uploads_container_mount_metadata_is_trusted "$EXPECTED_SOURCE" "$CASE_METADATA" "$ALLOW_ALIAS"',
      {
        EXPECTED_SOURCE: expectedSource,
        CASE_METADATA: `/app/uploads\tbind\t${legacySource}\ttrue`,
        ALLOW_ALIAS: allowAlias,
      },
    )
    expect(runWithResolvedAlias('0').status).not.toBe(0)
    expect(runWithResolvedAlias('1').status).toBe(0)
  })

  test('statfs 模拟必须拒绝宿主根盘签名和宿主/容器不一致', () => {
    const bash = findBash()
    expect(bash).not.toBeNull()
    if (!bash) return

    const helpers = [
      extractBashFunction(script, 'host_statfs_signature_is_trusted'),
      extractBashFunction(script, 'statfs_signatures_match'),
    ].join('\n')
    const runHost = (uploads: string, root: string) => runBashGate(
      bash,
      helpers,
      'host_statfs_signature_is_trusted "$UPLOADS_SIGNATURE" "$ROOT_SIGNATURE"',
      { UPLOADS_SIGNATURE: uploads, ROOT_SIGNATURE: root },
    )
    const runContainer = (host: string, container: string) => runBashGate(
      bash,
      helpers,
      'statfs_signatures_match "$HOST_SIGNATURE" "$CONTAINER_SIGNATURE"',
      { HOST_SIGNATURE: host, CONTAINER_SIGNATURE: container },
    )

    expect(runHost('a1b2:2fc12fc1', '9abc:ef53').status).toBe(0)
    expect(runHost('9abc:ef53', '9abc:ef53').status).not.toBe(0)
    expect(runContainer('a1b2:2fc12fc1', 'a1b2:2fc12fc1').status).toBe(0)
    expect(runContainer('a1b2:2fc12fc1', 'ffff:2fc12fc1').status).not.toBe(0)
  })

  test('宿主门禁先于所有容器/流量动作，候选严格 create→inspect→UPLOAD_DIR→start→statfs→health→复验→切流', () => {
    const hostGate = script.indexOf('if ! verify_host_uploads_mount; then')
    const firstContainerDiscovery = script.indexOf('RUNNING_CONTAINER_METADATA="$(docker ps --format', hostGate)
    const firstLegacyInspect = script.indexOf('LEGACY_IMAGE="$(docker inspect', hostGate)
    const drainLoop = script.indexOf('for TRANSCODE_DRAIN_SOURCE in $TRANSCODE_DRAIN_SOURCES; do', firstLegacyInspect)
    const existingStorage = script.indexOf('verify_container_uploads_storage "$TRANSCODE_DRAIN_SOURCE"', drainLoop)
    const existingDrain = script.indexOf('request_video_transcode_drain "$TRANSCODE_DRAIN_SOURCE"', existingStorage)
    const create = script.indexOf('create_container "$NEXT_CONTAINER" "$REGISTRY_COMMIT"')
    const mountInspect = script.indexOf('verify_container_uploads_mount_metadata "$NEXT_CONTAINER"', create)
    const uploadDirInspect = script.indexOf('verify_container_upload_dir_config "$NEXT_CONTAINER" 1', mountInspect)
    const start = script.indexOf('docker start "$NEXT_CONTAINER"', uploadDirInspect)
    const statfs = script.indexOf('verify_container_uploads_statfs "$NEXT_CONTAINER"', start)
    const uploadDirRuntime = script.indexOf('verify_container_upload_dir_runtime "$NEXT_CONTAINER" 1', statfs)
    const health = script.indexOf('wait_for_container_health "$NEXT_CONTAINER"', uploadDirRuntime)
    const writeProxy = script.indexOf('write_proxy_config "${NEXT_IP}:3000" "$NEXT_CONTAINER"', health)
    const finalStorage = script.indexOf('verify_container_uploads_storage "$NEXT_CONTAINER"', writeProxy)
    const switchTraffic = script.indexOf('if ! switch_proxy; then', finalStorage)

    expect(hostGate).toBeGreaterThan(0)
    expect(firstContainerDiscovery).toBeGreaterThan(hostGate)
    expect(firstLegacyInspect).toBeGreaterThan(hostGate)
    expect(existingStorage).toBeGreaterThan(drainLoop)
    expect(existingDrain).toBeGreaterThan(existingStorage)
    expect(create).toBeGreaterThan(existingDrain)
    expect(mountInspect).toBeGreaterThan(create)
    expect(uploadDirInspect).toBeGreaterThan(mountInspect)
    expect(start).toBeGreaterThan(uploadDirInspect)
    expect(statfs).toBeGreaterThan(start)
    expect(uploadDirRuntime).toBeGreaterThan(statfs)
    expect(health).toBeGreaterThan(uploadDirRuntime)
    expect(finalStorage).toBeGreaterThan(writeProxy)
    expect(switchTraffic).toBeGreaterThan(finalStorage)

    for (const name of [
      'uploads_findmnt_metadata_is_trusted',
      'host_statfs_signature_is_trusted',
      'statfs_signatures_match',
      'uploads_container_mount_metadata_is_trusted',
      'verify_host_uploads_mount',
      'verify_container_uploads_mount_metadata',
      'verify_container_uploads_statfs',
      'verify_container_upload_dir_config',
      'verify_container_upload_dir_runtime',
      'restore_unreloaded_proxy_config',
    ]) {
      expect(extractBashFunction(script, name)).not.toContain('|| true')
    }
    const rejectCandidate = extractBashFunction(script, 'fail_candidate_before_traffic')
    expect(rejectCandidate).not.toContain('|| true')
    expect(rejectCandidate.indexOf('restore_unreloaded_proxy_config')).toBeLessThan(
      rejectCandidate.indexOf('remove_video_container_safely "$NEXT_CONTAINER"'),
    )
  })

  test('应用上传根目录必须由容器参数钉死到已验证的 /app/uploads', () => {
    const createContainer = extractBashFunction(script, 'create_container')
    const verifyConfig = extractBashFunction(script, 'verify_container_upload_dir_config')
    const verifyRuntime = extractBashFunction(script, 'verify_container_upload_dir_runtime')

    expect(createContainer.indexOf('--env-file "$ENV_FILE_PATH"')).toBeLessThan(
      createContainer.indexOf('-e "UPLOAD_DIR=/app/uploads"'),
    )
    expect(verifyConfig).toContain('Container ${name} must declare exactly UPLOAD_DIR=/app/uploads')
    expect(verifyConfig).toContain('Existing container ${name} has an unsafe UPLOAD_DIR override')
    expect(verifyRuntime).toContain('if (resolved !== "/app/uploads") process.exit(1)')
    expect(script).toContain('verify_container_uploads_storage "$NEXT_CONTAINER" 1')
  })

  test('上传路径关闭请求缓冲，并按 128MiB 上传与 20MiB 分片设置独立余量', () => {
    const exactStart = script.indexOf('location = /api/materials/upload {')
    const chunkStart = script.indexOf('location = /api/materials/upload/chunk {', exactStart)
    const uploadPrefixStart = script.indexOf('location ^~ /api/materials/upload/ {', chunkStart)
    const fallbackStart = script.indexOf('location / {', uploadPrefixStart)
    const exactLocation = script.slice(exactStart, chunkStart)
    const chunkLocation = script.slice(chunkStart, uploadPrefixStart)
    const uploadPrefixLocation = script.slice(uploadPrefixStart, fallbackStart)
    const globalLimitMatch = script.match(/http \{[\s\S]*?client_max_body_size (\d+)m;/)
    const exactLimitMatch = exactLocation.match(/client_max_body_size (\d+)m;/)
    const chunkLimitMatch = chunkLocation.match(/client_max_body_size (\d+)m;/)
    const uploadPrefixLimitMatch = uploadPrefixLocation.match(/client_max_body_size (\d+)m;/)

    expect(exactStart).toBeGreaterThan(0)
    expect(chunkStart).toBeGreaterThan(exactStart)
    expect(uploadPrefixStart).toBeGreaterThan(chunkStart)
    expect(fallbackStart).toBeGreaterThan(uploadPrefixStart)
    expect(exactLocation).toContain('proxy_request_buffering off;')
    expect(chunkLocation).toContain('proxy_request_buffering off;')
    expect(uploadPrefixLocation).toContain('proxy_request_buffering off;')
    expect(Number(exactLimitMatch?.[1])).toBe(129)
    expect(Number(chunkLimitMatch?.[1])).toBe(21)
    expect(Number(uploadPrefixLimitMatch?.[1])).toBe(2)
    expect(Number(globalLimitMatch?.[1])).toBe(16)
  })

  test('公开钉钉免登入口在代理层限制为 64KiB', () => {
    const loginStart = script.indexOf('location = /api/dingtalk/h5-login {')
    const nextLocation = script.indexOf('location = /api/materials/upload {', loginStart)
    const loginLocation = script.slice(loginStart, nextLocation)

    expect(loginStart).toBeGreaterThan(0)
    expect(nextLocation).toBeGreaterThan(loginStart)
    expect(loginLocation).toContain('client_max_body_size 64k;')
    expect(loginLocation).toContain('proxy_request_buffering off;')
  })

  test('候选切流前必须同时验证健康依赖和精确部署提交', () => {
    const readiness = script.indexOf('health_payload_is_ready() {')
    const candidateHealth = script.indexOf('wait_for_container_health "$NEXT_CONTAINER" "$COMMIT_SHA"')
    const firstSwitch = script.indexOf('switch_proxy; then', candidateHealth)

    expect(readiness).toBeGreaterThan(0)
    expect(candidateHealth).toBeGreaterThan(readiness)
    expect(firstSwitch).toBeGreaterThan(candidateHealth)
    expect(script).toContain("grep -Fq -- '\"status\":\"healthy\"'")
    expect(script).toContain("grep -Fq -- '\"database\":{\"status\":\"ok\"'")
    expect(script).toContain("grep -Fq -- '\"redis\":{\"status\":\"ok\"'")
    expect(script).toContain('"\\"deploymentCommit\\":\\"${expected_commit}\\""')
    expect(script).toContain('verify_proxy_target "$NEXT_CONTAINER" "$COMMIT_SHA"')
    expect(script).toContain('container_healthy "$NEXT_CONTAINER" "$COMMIT_SHA"')
    expect(script).toContain('listen [::]:${PORT} ipv6only=on;')
    expect(script).toContain('runtime_proxy_container_at_url "http://[::1]:${PORT}/api/health"')
    expect(script).toContain("curl --noproxy '*' -g -fsS --max-time 8 \"http://[::1]:${PORT}/api/health\"")
  })

  test('公网验收必须证明候选、精确提交、健康依赖、S3 与两张 Logo', () => {
    const publicProbe = script.indexOf('Checking public FRP, authenticated S3, and Logo decode acceptance under the deployment lock')
    const committedTarget = script.indexOf('COMMITTED_PUBLIC_TARGET="$(tr -d', publicProbe)
    const payloadGate = script.indexOf('health_payload_is_ready /tmp/git-deploy-public-health.json "$COMMIT_SHA"', committedTarget)
    const targetGate = script.indexOf('[ "$public_target_count" = "1" ] && [ "$public_target" = "$COMMITTED_PUBLIC_TARGET" ]', payloadGate)
    const s3Gate = script.indexOf('https://s3.jiansun.vip/minio/health/live', targetGate)
    const settings = script.indexOf('$PUBLIC_APP_URL/api/system-settings', s3Gate)
    const configuredLogoValidation = script.indexOf("settings.headerLogoUrl, settings.loginLogoUrl", settings)
    const configuredLogoFetch = script.indexOf('done </tmp/git-deploy-public-logo-urls.txt', configuredLogoValidation)
    const fallbackLogos = script.indexOf('for fallback_logo in header-logo.png login-logo.png', configuredLogoFetch)

    expect(publicProbe).toBeGreaterThan(0)
    expect(committedTarget).toBeGreaterThan(publicProbe)
    expect(payloadGate).toBeGreaterThan(committedTarget)
    expect(targetGate).toBeGreaterThan(payloadGate)
    expect(s3Gate).toBeGreaterThan(targetGate)
    expect(settings).toBeGreaterThan(s3Gate)
    expect(configuredLogoValidation).toBeGreaterThan(settings)
    expect(configuredLogoFetch).toBeGreaterThan(configuredLogoValidation)
    expect(fallbackLogos).toBeGreaterThan(configuredLogoFetch)
    expect(script).toContain('Public application endpoint does not prove the expected commit and healthy database/Redis')
    expect(script).toContain('abort_after_uncertain_switch "Public S3 endpoint is unhealthy after cutover"')
    expect(script).toContain('did not return an image Content-Type')
    expect(script).not.toContain('[ "$public_target" = "$NEXT_CONTAINER" ]')
    expect(script).not.toContain('Public S3 endpoint is unhealthy; application deployment succeeded')
  })

  test('候选必须在切流前验证数据库身份、S3 认证及全部品牌图解码', () => {
    const candidateHealth = script.indexOf('wait_for_container_health "$NEXT_CONTAINER" "$COMMIT_SHA"')
    const databaseIdentity = script.indexOf('verify_candidate_database_identity "$NEXT_CONTAINER"', candidateHealth)
    const brandAndStorage = script.indexOf('verify_candidate_brand_and_storage_dependencies "$NEXT_CONTAINER" "$NEXT_IP"', databaseIdentity)
    const capability = script.indexOf('verify_video_transcode_capability "$NEXT_CONTAINER"', brandAndStorage)
    const switchTraffic = script.indexOf('if ! switch_proxy; then', capability)

    expect(candidateHealth).toBeGreaterThan(0)
    expect(databaseIdentity).toBeGreaterThan(candidateHealth)
    expect(brandAndStorage).toBeGreaterThan(databaseIdentity)
    expect(capability).toBeGreaterThan(brandAndStorage)
    expect(switchTraffic).toBeGreaterThan(capability)
    expect(script).toContain('new HeadBucketCommand({ Bucket: process.env.S3_BUCKET })')
    expect(script).toContain('verify_candidate_baked_brand_assets "$name"')
    expect(script).toContain('verify_candidate_configured_brand_assets "$name" "$candidate_ip"')
  })

  test('构建机在任何拉代码或发布动作前必须证明 Node 可用', () => {
    const preflight = script.indexOf('start_remote_step "Preflight"')
    const requireNode = script.indexOf('require_cmd node', preflight)
    const gitSync = script.indexOf('start_remote_step "Git Sync"', requireNode)

    expect(preflight).toBeGreaterThan(0)
    expect(requireNode).toBeGreaterThan(preflight)
    expect(gitSync).toBeGreaterThan(requireNode)
  })

  test('生产镜像来源绑定 exact SHA，运行时环境变量不能冒充新代码', () => {
    const dockerfile = readFileSync(path.join(process.cwd(), 'Dockerfile'), 'utf8')
    const buildArg = script.indexOf('--build-arg "VCS_REF=$COMMIT_SHA"')
    const productionLabel = script.indexOf('Production image revision label matches $COMMIT_SHA')
    const candidateLabel = script.indexOf('verify_image_revision_label "$REGISTRY_COMMIT" "$COMMIT_SHA"')
    const candidateFile = script.indexOf('verify_container_baked_revision "$NEXT_CONTAINER" "$COMMIT_SHA"')
    const candidateHealth = script.indexOf('wait_for_container_health "$NEXT_CONTAINER" "$COMMIT_SHA"')

    expect(script).toContain('Production deployment requires a freshly built and pushed exact-SHA image')
    expect(buildArg).toBeGreaterThan(0)
    expect(productionLabel).toBeGreaterThan(buildArg)
    expect(candidateLabel).toBeGreaterThan(productionLabel)
    expect(candidateFile).toBeGreaterThan(candidateLabel)
    expect(candidateHealth).toBeGreaterThan(candidateFile)
    expect(dockerfile).toContain('LABEL org.opencontainers.image.revision=$VCS_REF')
    expect(dockerfile).toContain('/app/DEPLOYMENT_COMMIT')
    expect(dockerfile).toContain('chmod 0444 /app/DEPLOYMENT_COMMIT')
  })

  test('HTTP Gitea 只允许固定仓库和精确提交，SSH 通道禁止明文凭据与盲信主机', () => {
    expect(script).toContain("[string]$RepoUrl = 'http://git.1080p.hk/WuYongJie/gongxiangp2.git'")
    expect(script).toContain('Inline Git credentials are forbidden')
    expect(script).toContain("$trustedRepoUrl = 'http://git.1080p.hk/WuYongJie/gongxiangp2.git'")
    expect(script).toContain("if (-not $DryRun -and $Commit -cnotmatch '^[0-9a-f]{40}$')")
    expect(script).toContain('HTTP Git transport requires -Commit with the exact 40-character lowercase SHA')
    expect(script).toContain("[ \"$REPO_URL\" = 'http://git.1080p.hk/WuYongJie/gongxiangp2.git' ]")
    expect(script).not.toContain('https://git.1080p.hk')
    expect(script).toContain("-c 'http.lowSpeedLimit=1'")
    expect(script).toContain("-c 'http.lowSpeedTime=30'")
    expect(script).toContain('-c http.lowSpeedLimit=1')
    expect(script).toContain('-c http.lowSpeedTime=30')
    expect(script).toContain('StrictHostKeyChecking=yes')
    expect(script).toContain('-hostkey $BuildServerHostKey')
    expect(script).toContain("awk '!/^#/ { print $2 \" \" $3 }' | ssh-keygen -lf - -E sha256")
    expect(script).toContain('Production host key fingerprint does not match the pinned value')
    expect(script).not.toContain('StrictHostKeyChecking=no')
    expect(script).not.toContain('http.extraHeader')
    expect(script).not.toContain('__GIT_AUTH_HEADER__')
    expect(script).toContain('mkdir -m 700')
    expect(script).toContain("chmod 600 '$remoteTemp'")
    expect(script).toContain("test ! -L '$remoteTemp'")
    expect(script).toContain("test -O '$remoteTemp'")
  })

  test('远端构建目录只能使用已验证的专用仓库，绝不删除未知目录', () => {
    expect(script).toContain("$trustedRemoteBuildDir = '/root/youyidian-3d-git-build'")
    expect(script).toContain('[ "$REMOTE_BUILD_DIR" = \'/root/youyidian-3d-git-build\' ]')
    expect(script).toContain('Pinned build directory is not the expected Git worktree; refusing destructive cleanup')
    expect(script).toContain('[ "$(realpath -e "$REMOTE_BUILD_DIR")" = "$REMOTE_BUILD_DIR" ]')
    expect(script).toContain('[ "$existing_origin" = "$REPO_URL" ]')
    expect(script).not.toContain('rm -rf "$REMOTE_BUILD_DIR"')
    expect(script).not.toContain('git remote set-url origin "$REPO_URL"')
  })

  test('生产按不可变 manifest 拉取并用平台 config digest 跨 Docker 版本核对镜像', () => {
    const captureDigest = script.indexOf('EXPECTED_MANIFEST_DIGEST="$(curl -fsSI')
    const capturePlatform = script.indexOf('EXPECTED_PLATFORM_MANIFEST_DIGEST="$(printf', captureDigest)
    const captureId = script.indexOf('EXPECTED_IMAGE_ID="$(printf', capturePlatform)
    const immutableReference = script.indexOf('REGISTRY_COMMIT="${BUILD_SERVER_IP}:${REGISTRY_PORT}/${IMAGE_NAME}@${EXPECTED_MANIFEST_DIGEST}"', captureId)
    const remoteCompare = script.indexOf('ACTUAL_PROD_IMAGE_ID="$(prod_ssh', immutableReference)
    const payloadCompare = script.indexOf('ACTUAL_IMAGE_ID="$(docker image inspect', remoteCompare)
    const createCandidate = script.indexOf('create_container "$NEXT_CONTAINER" "$REGISTRY_COMMIT"', payloadCompare)

    expect(captureDigest).toBeGreaterThan(0)
    expect(capturePlatform).toBeGreaterThan(captureDigest)
    expect(captureId).toBeGreaterThan(capturePlatform)
    expect(script).toContain('application/vnd.oci.image.index.v1+json')
    expect(script).toContain('tolower($1) == "docker-content-digest:" { print $2 }')
    expect(script).not.toContain("awk -F ': *' 'tolower($1) == \"docker-content-digest\"")
    expect(script).toContain('entry.platform.os === "linux"')
    expect(script).toContain('entry.platform.architecture === "amd64"')
    expect(script).toContain('document.config && document.config.digest')
    expect(immutableReference).toBeGreaterThan(captureDigest)
    expect(remoteCompare).toBeGreaterThan(immutableReference)
    expect(payloadCompare).toBeGreaterThan(remoteCompare)
    expect(createCandidate).toBeGreaterThan(payloadCompare)
    expect(script).toContain('Production image ID differs from the image built on the pinned build server')
    expect(script).toContain('[ "$image_id" = "$EXPECTED_IMAGE_ID" ]')
  })

  test('Docker 构建保留 Sharp/SWC optional 平台包且迁移 SQL 位于最终 context allowlist', () => {
    const dockerfile = readFileSync(path.join(process.cwd(), 'Dockerfile'), 'utf8')
    const dockerignore = readFileSync(path.join(process.cwd(), '.dockerignore'), 'utf8')
    const finalSqlIgnore = dockerignore.lastIndexOf('*.sql')
    const finalMigrationInclude = dockerignore.lastIndexOf('!prisma/migrations/**')

    expect(dockerfile).toContain('npm ci --prefer-offline')
    expect(dockerfile).toContain(
      'npm_config_build_from_source=canvas npm_config_nodedir=/usr/local npm ci',
    )
    expect(dockerfile).not.toContain('--omit=optional')
    expect(dockerfile).toContain("grep -Eq '^[0-9a-f]{40}$'")
    expect(dockerfile).toContain("const sharp=require('sharp')")
    expect(dockerfile).toContain('runner brand image decode smoke passed')
    expect(dockerfile).toContain("['header-logo.png','login-logo.png','favicon.png']")
    expect(finalMigrationInclude).toBeGreaterThan(finalSqlIgnore)
  })

  ;(process.platform === 'win32' ? test : test.skip)(
    'Target=shadow 在任何 Git 扫描或远程操作前 fail-closed',
    () => {
      const deployScript = path.join(process.cwd(), 'scripts', 'git-incremental-deploy.ps1')
      const powershell = path.join(
        process.env.SystemRoot || 'C:\\Windows',
        'System32',
        'WindowsPowerShell',
        'v1.0',
        'powershell.exe',
      )
      const deploy = spawnSync(powershell, [
        '-NoProfile',
        '-ExecutionPolicy', 'Bypass',
        '-File', deployScript,
        '-Target', 'shadow',
        '-DryRun',
      ], { cwd: process.cwd(), encoding: 'utf8', timeout: 30_000 })
      const output = `${deploy.stdout}\n${deploy.stderr}`

      expect(deploy.status).not.toBe(0)
      expect(output).toContain('Target=shadow is disabled fail-closed')
      expect(output).toContain('uploads/runtime/Redis isolation')
      expect(output).not.toContain('Resolving and scanning the exact Git tree')
      expect(output).not.toContain('Connecting to build server')
    },
    35_000,
  )

  ;(process.platform === 'win32' ? test : test.skip)(
    'HTTP Gitea 正式发布未提供完整提交 SHA 时在任何远程操作前 fail-closed',
    () => {
      const deployScript = path.join(process.cwd(), 'scripts', 'git-incremental-deploy.ps1')
      const powershell = path.join(
        process.env.SystemRoot || 'C:\\Windows',
        'System32',
        'WindowsPowerShell',
        'v1.0',
        'powershell.exe',
      )
      const deploy = spawnSync(powershell, [
        '-NoProfile',
        '-ExecutionPolicy', 'Bypass',
        '-File', deployScript,
      ], { cwd: process.cwd(), encoding: 'utf8', timeout: 30_000 })
      const output = `${deploy.stdout}\n${deploy.stderr}`

      expect(deploy.status).not.toBe(0)
      expect(output).toContain('HTTP Git transport requires -Commit with the exact 40-character lowercase SHA')
      expect(output).not.toContain('Resolving and scanning the exact Git tree')
      expect(output).not.toContain('Connecting to build server')
    },
    35_000,
  )

  test('旧镜像不能证明协议能力时 fail-closed，候选容器不会启动', () => {
    expect(script).toContain("grep -Fqx -- 'VIDEO_TRANSCODE_DRAIN_PROTOCOL_V1'")
    expect(script).toContain('-e "VIDEO_TRANSCODE_INSTANCE_ID=$transcode_instance_id"')
    expect(script).toContain('grep -Fqx -- "instanceId=$instance_id"')
    expect(script).toContain('if ! verify_video_transcode_capability "$NEXT_CONTAINER"; then')
    expect(script).toContain('candidate was not started (first rollout fails closed)')
    expect(script).toContain('apply the additive Prisma migration before deployment')
  })

  test('即使没有旧容器，候选容器也必须独立验证租约字段后才能切流', () => {
    const candidateSchema = script.indexOf('verify_transcode_lease_schema "$NEXT_CONTAINER"')
    const switchTraffic = script.indexOf('write_proxy_config "${NEXT_IP}:3000" "$NEXT_CONTAINER"')

    expect(candidateSchema).toBeGreaterThan(0)
    expect(switchTraffic).toBeGreaterThan(candidateSchema)
    expect(script).toContain('materials_transcode_lease_idx')
    expect(script).toContain('20260811_add_video_transcode_lease')
    expect(script).toContain('finished_at IS NOT NULL AND rolled_back_at IS NULL')
    expect(script).toContain('transcode_lease_token");')
    expect(script).toContain('token.data_type === "text" && token.is_nullable === "YES"')
    expect(script).toContain('expires.data_type === "timestamp without time zone" && expires.is_nullable === "YES"')
    expect(script).toContain('String(migrations[0].checksum || "") === sourceChecksum')
    expect(script).toContain('readFileSync(migrationPath, "utf8").replace(/\\r\\n/g, "\\n")')
    expect(script).toContain('!/\\bUNIQUE\\b|\\bWHERE\\b\/i.test(indexDefinition)')
    expect(script).toContain('!columnsOk || !indexOk || !migrationOk')
    expect(script).toContain('traffic was not switched')
  })

  test('旧域名扫描绑定精确目标 SHA，并将同一 SHA 固定给远程构建', () => {
    const resolveRemote = script.indexOf("'ls-remote', '--heads', $RepositoryUrl, \"refs/heads/$TargetBranch\"")
    const localObjectReuse = script.indexOf("'clone', '--no-checkout', '--shared', $localRepository, $targetCheckout", resolveRemote)
    const fetchFallback = script.indexOf('"+refs/heads/${TargetBranch}:refs/preflight/branch"', localObjectReuse)
    const checkoutFallback = script.indexOf("'worktree', 'add', '--detach', $targetCheckout, $targetCommit", fetchFallback)
    const scanTarget = script.indexOf('& $nodeCommand.Source $scannerPath', checkoutFallback)
    const preflight = script.indexOf("Write-Info 'Resolving and scanning the exact Git tree that will be deployed...'")
    const bindCommit = script.indexOf("$tokens['__COMMIT__'] = ConvertTo-ShellSingleQuoted $resolvedTargetCommit")
    const renderRemote = script.indexOf('$remoteScript = $remoteTemplate')
    const remoteDeploy = script.indexOf('$exitCode = Invoke-BuildServerScript -ScriptText $remoteScript')
    const remoteTemplateStart = script.indexOf("$remoteTemplate = @'")
    const remoteTemplateEnd = script.indexOf("\n'@", remoteTemplateStart)
    const remoteTemplate = script.slice(remoteTemplateStart, remoteTemplateEnd)

    expect(script).toContain("Join-Path $PSScriptRoot 'check-legacy-storage-boundaries.mjs'")
    expect(script).toContain('Get-Command node -ErrorAction SilentlyContinue')
    expect(script).toContain('Legacy storage boundary preflight failed for target $targetCommit with exit code')
    expect(resolveRemote).toBeGreaterThan(0)
    expect(localObjectReuse).toBeGreaterThan(resolveRemote)
    expect(fetchFallback).toBeGreaterThan(localObjectReuse)
    expect(checkoutFallback).toBeGreaterThan(fetchFallback)
    expect(scanTarget).toBeGreaterThan(checkoutFallback)
    expect(preflight).toBeGreaterThan(0)
    expect(bindCommit).toBeGreaterThan(preflight)
    expect(renderRemote).toBeGreaterThan(bindCommit)
    expect(remoteDeploy).toBeGreaterThan(renderRemote)
    expect(remoteTemplate).not.toContain('Invoke-LegacyStorageBoundaryPreflight')
    expect(script.indexOf('function Invoke-LegacyStorageBoundaryPreflight')).toBeLessThan(remoteTemplateStart)
    expect(remoteTemplate).toContain('TARGET_REF="$COMMIT_INPUT"')
    expect(remoteTemplate).toContain('[ "$COMMIT_SHA" = "$COMMIT_INPUT" ]')
  })

  ;(process.platform === 'win32' ? test : test.skip)(
    '分支最新树通过时，-Commit 指向含旧域名的旧提交仍会在远程操作前拒绝',
    async () => {
      const tempRoot = await mkdtemp(path.join(os.tmpdir(), 'video-deploy-target-test-'))
      const repository = path.join(tempRoot, 'repository')
      const badSource = path.join(repository, 'app', 'deploy-target.ts')
      const scanner = path.join(process.cwd(), 'scripts', 'check-legacy-storage-boundaries.mjs')
      const deployScript = path.join(process.cwd(), 'scripts', 'git-incremental-deploy.ps1')
      const powershell = path.join(
        process.env.SystemRoot || 'C:\\Windows',
        'System32',
        'WindowsPowerShell',
        'v1.0',
        'powershell.exe',
      )
      const runGit = (...args: string[]) => {
        const result = spawnSync('git', args, { cwd: repository, encoding: 'utf8' })
        if (result.status !== 0) {
          throw new Error(`git ${args.join(' ')} failed: ${result.stdout}\n${result.stderr}`)
        }
        return result.stdout.trim()
      }

      try {
        await mkdir(path.dirname(badSource), { recursive: true })
        runGit('init')
        runGit('config', 'user.name', 'Codex Test')
        runGit('config', 'user.email', 'codex-test@example.invalid')
        await writeFile(badSource, "export const unsafeLogo = 'https://s3.1080p.hk/bucket/logo.png'\n", 'utf8')
        runGit('add', '.')
        runGit('-c', 'commit.gpgsign=false', 'commit', '-m', 'unsafe old target')
        const oldCommit = runGit('rev-parse', 'HEAD')

        await writeFile(badSource, "export const safeLogo = '/brand/header-logo.png'\n", 'utf8')
        runGit('add', '.')
        runGit('-c', 'commit.gpgsign=false', 'commit', '-m', 'safe branch head')
        runGit('branch', '-M', 'main')

        const latestScan = spawnSync(process.execPath, [scanner], { cwd: repository, encoding: 'utf8' })
        expect(latestScan.status).toBe(0)

        const deploy = spawnSync(powershell, [
          '-NoProfile',
          '-ExecutionPolicy', 'Bypass',
          '-File', deployScript,
          '-RepoUrl', repository,
          '-Branch', 'main',
          '-Commit', oldCommit,
          '-DryRun',
          '-BuildServerPassword', 'local-test-only',
          '-BuildServerProxyCommand', 'must-not-run',
        ], { cwd: process.cwd(), encoding: 'utf8', timeout: 60_000 })
        const output = `${deploy.stdout}\n${deploy.stderr}`

        expect(deploy.status).not.toBe(0)
        expect(output).toContain('app/deploy-target.ts')
        expect(output).toContain('Legacy storage boundary preflight failed for target')
        expect(output).not.toContain('Cannot find plink.exe')
      }
      finally {
        await rm(tempRoot, { recursive: true, force: true })
      }
    },
    70_000,
  )

  test('候选容器切流前必须验证品牌与上传幂等数据库门禁', () => {
    const dockerfile = readFileSync(path.join(process.cwd(), 'Dockerfile'), 'utf8')
    const leaseSchema = script.indexOf('verify_transcode_lease_schema "$NEXT_CONTAINER"')
    const brandDefaults = script.indexOf('verify_brand_logo_defaults "$NEXT_CONTAINER"')
    const uploadIdempotency = script.indexOf('verify_material_upload_idempotency_schema "$NEXT_CONTAINER"')
    const switchTraffic = script.indexOf('write_proxy_config "${NEXT_IP}:3000" "$NEXT_CONTAINER"')

    expect(brandDefaults).toBeGreaterThan(leaseSchema)
    expect(uploadIdempotency).toBeGreaterThan(brandDefaults)
    expect(switchTraffic).toBeGreaterThan(uploadIdempotency)
    expect(script).toContain('normalize(defaults.get("headerLogoUrl")) === "/brand/header-logo.png"')
    expect(script).toContain('normalize(defaults.get("loginLogoUrl")) === "/brand/login-logo.png"')
    expect(script).toContain('!defaults.has("logoUrl") || normalize(defaults.get("logoUrl")) === "/brand/header-logo.png"')
    expect(script).toContain('SELECT id, \\"headerLogoUrl\\", \\"loginLogoUrl\\" FROM \\"system_settings\\" ORDER BY id')
    expect(script).toContain('parsed.hostname === "s3.jiansun.vip"')
    expect(script).toContain('parsed.pathname.startsWith("/gongxiangpan/")')
    expect(script).toContain('const rowsOk = brandRows.every')
    expect(script).toContain('!migrationOk || !rowsOk')
    expect(script).toContain('20260811_update_brand_logo_defaults')
    expect(script).toContain('20251118000000_add_upload_id_to_materials')
    expect(script).toContain('materials_uploadId_key')
    expect(script).toContain('column.data_type === "text"')
    expect(script).toContain('column.is_nullable === "YES"')
    expect(script).toContain('index.access_method === "btree"')
    expect(script).toContain('Number(index.indnkeyatts) === 1')
    expect(script).toContain('keyColumns.length === 1 && keyColumns[0] === "uploadId"')
    expect(script).toContain('normalizedPredicate === "uploadidisnotnullanddeletedatisnull"')
    expect(script).toContain('migrationByName.get(historicalMigrationName) === historicalSourceChecksum')
    expect(script).toContain('migrationByName.get(normalizationMigrationName) === normalizationSourceChecksum')
    expect(script).toContain('20260812_align_material_upload_idempotency_index')
    expect(script).toContain('20260813_add_material_custody_department')
    expect(script).toContain('20260813_add_organization_units_and_employment_state')
    expect(script).toContain('20260813_add_user_employee_binding')
    expect(dockerfile).toContain('/app/prisma/migrations/20251118000000_add_upload_id_to_materials/migration.sql')
    expect(dockerfile).toContain('COPY --from=builder --chown=root:root /app/prisma/migrations/20251118000000_add_upload_id_to_materials')
    expect(script).toContain('finished_at IS NOT NULL AND rolled_back_at IS NULL')
    expect(script).toContain('traffic was not switched')
  })

  test('候选容器带预置 drain 启动，全部门禁和稳定切流后才恢复 worker', () => {
    const preDrain = script.indexOf(': > "$(transcode_drain_file "$NEXT_CONTAINER")"')
    const preTaskDetailDrain = script.indexOf(': > "$(task_detail_drain_file "$NEXT_CONTAINER")"', preDrain)
    const createCandidate = script.indexOf('create_container "$NEXT_CONTAINER" "$REGISTRY_COMMIT"')
    const inspectCandidate = script.indexOf('verify_container_uploads_mount_metadata "$NEXT_CONTAINER"', createCandidate)
    const startCandidate = script.indexOf('docker start "$NEXT_CONTAINER"', inspectCandidate)
    const health = script.indexOf('wait_for_container_health "$NEXT_CONTAINER"', startCandidate)
    const lease = script.indexOf('verify_transcode_lease_schema "$NEXT_CONTAINER"', health)
    const taskDetailLease = script.indexOf('verify_task_detail_upload_lease_schema "$NEXT_CONTAINER"', lease)
    const brand = script.indexOf('verify_brand_logo_defaults "$NEXT_CONTAINER"', taskDetailLease)
    const uploadIdempotency = script.indexOf('verify_material_upload_idempotency_schema "$NEXT_CONTAINER"', brand)
    const capability = script.indexOf('verify_video_transcode_capability "$NEXT_CONTAINER"', uploadIdempotency)
    const taskDetailCapability = script.indexOf('verify_task_detail_upload_capability "$NEXT_CONTAINER"', capability)
    const taskDetailInactive = script.indexOf('wait_for_task_detail_upload_drain "$NEXT_CONTAINER" 2', taskDetailCapability)
    const proxyConfig = script.indexOf('write_proxy_config "${NEXT_IP}:3000" "$NEXT_CONTAINER"', taskDetailInactive)
    const resumeCandidate = script.indexOf('resume_video_transcode "$NEXT_CONTAINER"', proxyConfig)
    const resumeTaskDetail = script.indexOf('resume_task_detail_upload "$NEXT_CONTAINER"', resumeCandidate)
    const workerCommit = script.indexOf('BACKGROUND_WORKERS_COMMITTED=1', resumeTaskDetail)
    const oldStop = script.indexOf('docker stop --time 30 "$CURRENT_CONTAINER"', workerCommit)

    expect(preDrain).toBeGreaterThan(0)
    expect(preTaskDetailDrain).toBeGreaterThan(preDrain)
    expect(createCandidate).toBeGreaterThan(preTaskDetailDrain)
    expect(inspectCandidate).toBeGreaterThan(createCandidate)
    expect(startCandidate).toBeGreaterThan(inspectCandidate)
    expect(health).toBeGreaterThan(startCandidate)
    expect(lease).toBeGreaterThan(health)
    expect(taskDetailLease).toBeGreaterThan(lease)
    expect(brand).toBeGreaterThan(taskDetailLease)
    expect(uploadIdempotency).toBeGreaterThan(brand)
    expect(capability).toBeGreaterThan(uploadIdempotency)
    expect(taskDetailCapability).toBeGreaterThan(capability)
    expect(taskDetailInactive).toBeGreaterThan(taskDetailCapability)
    expect(proxyConfig).toBeGreaterThan(taskDetailInactive)
    expect(resumeCandidate).toBeGreaterThan(proxyConfig)
    expect(resumeTaskDetail).toBeGreaterThan(resumeCandidate)
    expect(workerCommit).toBeGreaterThan(resumeTaskDetail)
    expect(oldStop).toBeGreaterThan(workerCommit)
    expect(script).toContain('remove_video_container_safely "$NEXT_CONTAINER"')
    expect(script).not.toContain('docker rm -f "$NEXT_CONTAINER"')
  })

  test('worker 提交后任何晚期失败都不会解除旧槽 drain', () => {
    const trap = script.slice(
      script.indexOf('resume_transcode_after_failed_deploy() {'),
      script.indexOf('trap resume_transcode_after_failed_deploy EXIT'),
    )

    expect(trap).toContain('[ "$BACKGROUND_WORKERS_COMMITTED" != "1" ]')
    expect(trap).toContain('for target in $TRANSCODE_DRAIN_TARGETS')
    expect(trap).toContain('for target in $TASK_DETAIL_DRAIN_TARGETS')
    expect(trap).toContain('previous background-worker drain markers remain enabled')
    expect(script.indexOf('BACKGROUND_WORKERS_COMMITTED=1')).toBeLessThan(
      script.indexOf('systemctl start "$PROXY_RECONCILE_SERVICE"'),
    )
    const switchBlock = script.indexOf('SWITCH_REPORTED_FAILURE=0')
    const trafficMaySwitch = script.indexOf('BACKGROUND_WORKERS_COMMITTED=1', switchBlock)
    const switchTraffic = script.indexOf('if ! switch_proxy; then', trafficMaySwitch)
    expect(trafficMaySwitch).toBeGreaterThan(switchBlock)
    expect(switchTraffic).toBeGreaterThan(trafficMaySwitch)
    const abortStart = script.indexOf('abort_after_uncertain_switch() {')
    const abortEnd = script.indexOf('# The historical shadow topology', abortStart)
    const abort = script.slice(abortStart, abortEnd)
    expect(abort).toContain('if [ "${PROXY_LOCK_HELD:-0}" != "1" ]')
    expect(abort).toContain('flock -w 30 8')
    expect(script).toContain('abort_after_uncertain_switch "Proxy reconciler failed its post-deployment verification"')
  })

  test('普通发布与首次 bootstrap 共用全局锁并只消费当前未消费 handoff', () => {
    const lock = script.indexOf('flock -w 30 9')
    const handoffGate = script.indexOf('verify_bootstrap_handoff_if_present')
    const candidate = script.indexOf('create_container "$NEXT_CONTAINER" "$REGISTRY_COMMIT"', handoffGate)
    const consume = script.indexOf('mv -- "$READY_BOOTSTRAP_HANDOFF/handoff.ready" "$READY_BOOTSTRAP_HANDOFF/consumed"', candidate)

    expect(lock).toBeGreaterThan(0)
    expect(handoffGate).toBeGreaterThan(lock)
    expect(candidate).toBeGreaterThan(handoffGate)
    expect(consume).toBeGreaterThan(candidate)
    expect(script).toContain('[ ! -e "$handoff/consumed" ] || continue')
    expect(script).toContain('The maintenance entry requires exactly one unconsumed bootstrap handoff')
    expect(script).toContain('A normal blue-green entry cannot consume a stale bootstrap handoff')
    expect(script).toContain('verify_ready_bootstrap_handoff_evidence "$READY_BOOTSTRAP_HANDOFF"')
    expect(script).toContain('maintenance_entry_is_ready_after_restore || fail "Bootstrap maintenance entry is not an exact dual-stack 503 handoff"')
    expect(script).toContain('Preserved legacy container is not the exact stopped handoff identity')
    expect(script).toContain('uploads_container_mount_metadata_is_trusted "$UPLOADS_MOUNT" "$mount_metadata"')
  })

  test('maintenance 缺 handoff 会拒绝，已消费的旧 SHA 不阻塞后续蓝绿发布', async () => {
    const bash = findBash()
    if (!bash) return
    const root = await mkdtemp(path.join(os.tmpdir(), 'deploy-handoff-test-'))
    const attempt = path.join(root, 'attempt-1')
    const exactSha = 'a'.repeat(40)
    const nextSha = 'b'.repeat(40)
    const legacyId = '1'.repeat(64)
    const imageId = `sha256:${'2'.repeat(64)}`
    const repoDigest = `registry.example/app@sha256:${'3'.repeat(64)}`
    const preserved = `youyidian-3d-material-legacy-${exactSha.slice(0, 12)}-${legacyId.slice(0, 12)}`
    const uploadsSignature = 'abcd:1234'
    const support = `
fail() { printf '%s\\n' "$*" >&2; exit 91; }
runtime_proxy_container() { printf '%s\\n' "\${MOCK_RUNTIME_TARGET:-}"; }
is_proxy_running() { [ "\${MOCK_PROXY_RUNNING:-0}" = "1" ]; }
maintenance_entry_is_ready_after_restore() { [ "\${MOCK_MAINTENANCE_READY:-0}" = "1" ]; }
stat() {
  if [ "$1" = "-c" ] && [ "$2" = "%a" ]; then
    if [ "$3" = "\${MOCK_HANDOFF_DIR}" ]; then printf '700\\n'; else printf '600\\n'; fi
    return 0
  fi
  command stat "$@"
}
docker() {
  if [ "$1" = "inspect" ] && [ "$2" = "--format" ]; then
    case "$3" in
      *Mounts*) printf '/app/uploads\\tbind\\t%s\\ttrue\\n' "\${MOCK_MOUNT_SOURCE}" ;;
      *) printf '%s\\t%s\\t%s\\t%s\\t%s\\n' "\${MOCK_CONTAINER_ID}" "\${MOCK_IMAGE_ID}" "\${MOCK_STATUS}" "\${MOCK_RUNNING}" "\${MOCK_PAUSED}" ;;
    esac
    return 0
  fi
  if [ "$1" = "image" ] && [ "$2" = "inspect" ]; then
    printf '%s\\n' "\${MOCK_REPO_DIGEST}"
    return 0
  fi
  if [ "$1" = "port" ]; then
    printf '0.0.0.0:%s\\n[::]:%s\\n' "\${PORT}" "\${PORT}"
    return 0
  fi
  return 97
}
`
    const functions = [
      support,
      extractBashFunction(script, 'container_uploads_mount_metadata'),
      extractBashFunction(script, 'uploads_container_mount_metadata_is_trusted'),
      extractBashFunction(script, 'verify_ready_bootstrap_handoff_evidence'),
      extractBashFunction(script, 'verify_bootstrap_handoff_if_present'),
    ].join('\n')
    const baseVariables = {
      TARGET: 'production', BOOTSTRAP_ROOT: toBashPath(root), COMMIT_SHA: exactSha,
      READY_BOOTSTRAP_HANDOFF: '', MOCK_PROXY_RUNNING: '1', MOCK_RUNTIME_TARGET: '',
      MOCK_MAINTENANCE_READY: '1', MOCK_CONTAINER_ID: legacyId, MOCK_IMAGE_ID: imageId,
      MOCK_STATUS: 'exited', MOCK_RUNNING: 'false', MOCK_PAUSED: 'false',
      MOCK_REPO_DIGEST: repoDigest, MOCK_MOUNT_SOURCE: '/mnt/PoolOne/youyidian-uploads',
      CONTAINER_NAME: 'youyidian-3d-material', HOST_UPLOADS_STATFS_SIGNATURE: uploadsSignature,
      UPLOADS_MOUNT: '/mnt/PoolOne/youyidian-uploads', PORT: '4320',
      MOCK_HANDOFF_DIR: toBashPath(attempt),
    }

    try {
      const missing = runBashGate(bash, functions, 'verify_bootstrap_handoff_if_present', {
        ...baseVariables, BOOTSTRAP_ROOT: toBashPath(path.join(root, 'missing')),
      })
      expect(missing.status).not.toBe(0)

      await mkdir(attempt, { recursive: true })
      const evidence = {
        'target-commit': exactSha,
        'legacy-container-id': legacyId,
        'legacy-image-id': imageId,
        'legacy-image-repo-digest': repoDigest,
        'legacy-upstream': '172.18.0.4:3000',
        'uploads-statfs-signature': uploadsSignature,
        'preserved-container': preserved,
        'handoff.ready': 'ready',
      }
      for (const [name, value] of Object.entries(evidence)) {
        await writeFile(path.join(attempt, name), `${value}\n`, 'utf8')
      }
      const ready = runBashGate(bash, functions, 'verify_bootstrap_handoff_if_present; printf "%s" "$READY_BOOTSTRAP_HANDOFF"', {
        ...baseVariables,
      })
      expect(ready.status).toBe(0)
      expect(ready.stdout).toContain('attempt-1')

      for (const overrides of [
        { MOCK_MAINTENANCE_READY: '0' },
        { MOCK_STATUS: 'running', MOCK_RUNNING: 'true' },
        { MOCK_PAUSED: 'true' },
        { MOCK_CONTAINER_ID: '4'.repeat(64) },
        { MOCK_IMAGE_ID: `sha256:${'5'.repeat(64)}` },
        { MOCK_REPO_DIGEST: `registry.example/app@sha256:${'6'.repeat(64)}` },
        { MOCK_MOUNT_SOURCE: '/wrong/uploads' },
      ]) {
        const rejected = runBashGate(bash, functions, 'verify_bootstrap_handoff_if_present', {
          ...baseVariables, ...overrides,
        })
        expect(rejected.status).not.toBe(0)
      }

      await rm(path.join(attempt, 'legacy-upstream'))
      const incomplete = runBashGate(bash, functions, 'verify_bootstrap_handoff_if_present', baseVariables)
      expect(incomplete.status).not.toBe(0)
      await writeFile(path.join(attempt, 'legacy-upstream'), '172.18.0.4:3000\n', 'utf8')

      await rm(path.join(attempt, 'handoff.ready'))
      await writeFile(path.join(attempt, 'consumed'), 'ready\n', 'utf8')
      const later = runBashGate(bash, functions, 'verify_bootstrap_handoff_if_present; printf "%s" "$READY_BOOTSTRAP_HANDOFF"', {
        ...baseVariables, COMMIT_SHA: nextSha, MOCK_RUNTIME_TARGET: 'youyidian-3d-material-blue',
      })
      expect(later.status).toBe(0)
      expect(later.stdout).toBe('')
    } finally {
      await rm(root, { recursive: true, force: true })
    }
  }, 30_000)

  test('迁移审计仅在显式迁移批次启用，并在候选创建前绑定数据库实际身份', () => {
    const audit = script.indexOf('verify_migration_audit_evidence')
    const optIn = script.indexOf('[switch]$RequireMigrationAudit')
    const rootParser = script.indexOf('--read-only --user 0:0 --cap-drop ALL --security-opt no-new-privileges', audit)
    const identity = script.indexOf('verify_candidate_database_identity "$NEXT_CONTAINER"', rootParser)
    const switchTraffic = script.indexOf('if ! switch_proxy; then', identity)

    expect(audit).toBeGreaterThan(0)
    expect(optIn).toBeGreaterThan(0)
    expect(rootParser).toBeGreaterThan(audit)
    expect(identity).toBeGreaterThan(rootParser)
    expect(switchTraffic).toBeGreaterThan(identity)
    expect(script).toContain('for await (const chunk of process.stdin)')
    expect(script).not.toContain('process.stdin.on("end", async () => {')
  })

  test('只有显式迁移批次才校验审计来源提交与 Prisma 定义', () => {
    const gitSync = script.indexOf('COMMIT_SHA="$(git rev-parse HEAD)"')
    const ancestor = script.indexOf('git merge-base --is-ancestor "$MIGRATION_AUDIT_SOURCE_COMMIT" "$COMMIT_SHA"', gitSync)
    const schemaDiff = script.indexOf('git diff --quiet "$MIGRATION_AUDIT_SOURCE_COMMIT" "$COMMIT_SHA" -- prisma/schema.prisma prisma/migrations', ancestor)
    const build = script.indexOf('start_remote_step "Docker Build"', schemaDiff)

    expect(gitSync).toBeGreaterThan(0)
    expect(ancestor).toBeGreaterThan(gitSync)
    expect(schemaDiff).toBeGreaterThan(ancestor)
    expect(build).toBeGreaterThan(schemaDiff)
    expect(script).toContain('if [ "$REQUIRE_MIGRATION_AUDIT" = "1" ] && [ "$SKIP_DEPLOY" != "1" ]; then')
    expect(script).toContain('Database schema or migrations changed after the approved audit; create a fresh verified migration audit')
  })

  test('日常应用发布默认不消费迁移审计，也不会因此进入迁移流程', () => {
    expect(script).toContain("'__REQUIRE_MIGRATION_AUDIT__'")
    expect(script).toContain('REQUIRE_MIGRATION_AUDIT=__REQUIRE_MIGRATION_AUDIT__')
    expect(script).toContain('if [ "$REQUIRE_MIGRATION_AUDIT" != "1" ]; then')
    expect(script).toContain('Migration audit is not required for this normal application release')
    expect(script).toContain('[ "$REQUIRE_MIGRATION_AUDIT" = "1" ] || return 0')
  })

  test('迁移凭证仅在显式迁移批次绑定审计源提交', () => {
    expect(script).toContain('if ($RequireMigrationAudit -and [string]::IsNullOrWhiteSpace($MigrationAuditSourceCommit))')
    expect(script).toContain('-e MIGRATION_AUDIT_SOURCE_COMMIT="$MIGRATION_AUDIT_SOURCE_COMMIT"')
    expect(script).toContain('audit.sourceCommit !== process.env.MIGRATION_AUDIT_SOURCE_COMMIT')
    expect(script).not.toContain('audit.sourceCommit !== process.env.COMMIT_SHA')
  })

  test('候选数据库身份 Node 门禁能消费有效 stdin，坏 JSON 必须失败', () => {
    const functionStart = script.indexOf('verify_candidate_database_identity() {')
    const nodeStartMarker = "node -e '\n"
    const nodeStart = script.indexOf(nodeStartMarker, functionStart) + nodeStartMarker.length
    const nodeEnd = script.indexOf("\n' < \"$MIGRATION_AUDIT_FILE\"", nodeStart)
    const nodeSource = script.slice(nodeStart, nodeEnd)
    const prismaMock = `
const Module = require('module');
const originalLoad = Module._load;
Module._load = function(request, parent, isMain) {
  if (request === '@prisma/client') return { PrismaClient: class {
    async $queryRawUnsafe() { return [{ database: 'prod', user: 'app', server_address: '10.0.0.8', server_port: '5432' }]; }
    async $disconnect() {}
  } };
  return originalLoad.call(this, request, parent, isMain);
};
`
    const audit = JSON.stringify({ database: {
      configuredHost: 'db.internal', configuredPort: '5432', configuredDatabase: 'prod', configuredUser: 'app',
      actualDatabase: 'prod', actualUser: 'app', serverAddress: '10.0.0.8', serverPort: '5432',
    } })
    const env = { ...process.env, DATABASE_URL: 'postgresql://app:secret@db.internal:5432/prod' }
    const valid = spawnSync(process.execPath, ['-e', `${prismaMock}\n${nodeSource}`], { input: audit, encoding: 'utf8', env })
    const invalid = spawnSync(process.execPath, ['-e', `${prismaMock}\n${nodeSource}`], { input: '{bad', encoding: 'utf8', env })

    expect(functionStart).toBeGreaterThan(0)
    expect(nodeEnd).toBeGreaterThan(nodeStart)
    expect(valid.status).toBe(0)
    expect(invalid.status).not.toBe(0)
  })

  test('Logo 解码 Node 门禁接受真实 PNG，损坏输入必须失败', () => {
    const functionStart = script.indexOf('decode_image_stream_with_candidate() {')
    const nodeStartMarker = "node -e '\n"
    const nodeStart = script.indexOf(nodeStartMarker, functionStart) + nodeStartMarker.length
    const nodeEnd = script.indexOf("\n'\n}", nodeStart)
    const nodeSource = script.slice(nodeStart, nodeEnd)
    const validPng = readFileSync(path.join(process.cwd(), 'public', 'brand', 'header-logo.png'))
    const valid = spawnSync(process.execPath, ['-e', nodeSource], { input: validPng, encoding: 'buffer' })
    const invalid = spawnSync(process.execPath, ['-e', nodeSource], { input: Buffer.from('not-an-image'), encoding: 'buffer' })

    expect(functionStart).toBeGreaterThan(0)
    expect(nodeEnd).toBeGreaterThan(nodeStart)
    expect(valid.status).toBe(0)
    expect(invalid.status).not.toBe(0)
  })

  test('部署失败会恢复旧容器 drain，停止旧容器前再次核对 active 标记', () => {
    expect(script).toContain('trap resume_transcode_after_failed_deploy EXIT')
    expect(script).toContain('for target in $TRANSCODE_DRAIN_TARGETS')
    expect(script).toContain('resume_video_transcode "$target"')
    expect(script).toContain('for target in $TASK_DETAIL_DRAIN_TARGETS')
    expect(script).toContain('resume_task_detail_upload "$target"')
    const videoIdle = script.indexOf('wait_for_video_transcode_drain "$CURRENT_CONTAINER" 2 &&')
    const taskDetailIdle = script.indexOf('wait_for_task_detail_upload_drain "$CURRENT_CONTAINER" 2 &&', videoIdle)
    const stop = script.indexOf('docker stop --time 30 "$CURRENT_CONTAINER"', taskDetailIdle)
    expect(videoIdle).toBeGreaterThan(0)
    expect(taskDetailIdle).toBeGreaterThan(videoIdle)
    expect(stop).toBeGreaterThan(taskDetailIdle)
  })

  test('stable proxy 缺失且存在 legacy direct 时，在任何容器或流量动作前 fail-closed', () => {
    const topologyGate = script.indexOf('# This general deployment entry must never perform the one-time direct-to-proxy')
    const inspectLegacy = script.indexOf('LEGACY_IMAGE="$(docker inspect', topologyGate)
    const checkProxy = script.indexOf('if is_proxy_running; then', inspectLegacy)
    const failClosed = script.indexOf('Use the controlled one-time direct-to-proxy migration SOP', checkProxy)
    const proxyMutation = script.indexOf('mkdir -p "$PROXY_ROOT"', failClosed)
    const drainExisting = script.indexOf('request_video_transcode_drain "$TRANSCODE_DRAIN_SOURCE"', proxyMutation)
    const removeInactiveSlot = script.indexOf('remove_video_container_safely "$NEXT_CONTAINER"', drainExisting)
    const startCandidate = script.indexOf('create_container "$NEXT_CONTAINER" "$REGISTRY_COMMIT"', removeInactiveSlot)
    const switchTraffic = script.indexOf('if ! switch_proxy; then', startCandidate)
    const stopPrevious = script.indexOf('docker stop --time 30 "$CURRENT_CONTAINER"', switchTraffic)

    expect(topologyGate).toBeGreaterThan(0)
    expect(inspectLegacy).toBeGreaterThan(topologyGate)
    expect(checkProxy).toBeGreaterThan(inspectLegacy)
    expect(failClosed).toBeGreaterThan(checkProxy)
    expect(proxyMutation).toBeGreaterThan(failClosed)
    expect(drainExisting).toBeGreaterThan(proxyMutation)
    expect(removeInactiveSlot).toBeGreaterThan(drainExisting)
    expect(startCandidate).toBeGreaterThan(removeInactiveSlot)
    expect(switchTraffic).toBeGreaterThan(startCandidate)
    expect(stopPrevious).toBeGreaterThan(switchTraffic)
    expect(script).toContain('no container or traffic was changed')
  })

  test('通用脚本不包含 automatic direct→proxy migration 或 direct rollback', () => {
    const rollbackStart = script.indexOf('rollback_to_previous_entry() {')
    const rollbackEnd = script.indexOf('abort_after_uncertain_switch() {', rollbackStart)
    const rollback = script.slice(rollbackStart, rollbackEnd)
    const operationalStart = script.indexOf('# This general deployment entry must never perform the one-time direct-to-proxy')
    const operational = script.slice(operationalStart)

    expect(rollback).toContain('[ "$PROXY_WAS_RUNNING" = "1" ]')
    expect(rollback).not.toContain('[ "$PROXY_WAS_RUNNING" != "1" ]')
    expect(rollback).not.toContain('create_container "$CONTAINER_NAME"')
    expect(rollback).not.toContain('stop_proxy')
    expect(operational).not.toContain('migrating public entry from direct container to proxy')
    expect(operational).not.toContain('proxy migration was not attempted')
  })
})