ignition-cli 1.4.1

//! Golden-file contract tests for `ign project` (03-01, PROJ-01/02) —
//! wiremock fixtures shaped after the official 83-api schemas, harness
//! inherited from `contract_sessions.rs` (02-03): isolated
//! `IGNITION_CLI_CONFIG`, `stdout_for_golden`, programmatic envelopes
//! where the `endpoint` embeds the random mock URI.
//!
//! The crown pins:
//! - `project delete` WITHOUT `--yes` exits 2 with the
//!   `confirmation_required` envelope and profile null — the guard
//!   fires BEFORE any resolution (no mock even exists);
//! - `project delete --yes` drives the gateway-side DELETE with
//!   `confirm=true` on the wire (both guard layers, Pitfall 8);
//! - `project set --title` PUTs EXACTLY `{"title":"T"}` (the
//!   body_json matcher only fires on the exact body).

use std::path::{Path, PathBuf};

use assert_cmd::Command;
use serde_json::Value;

/// Isolated config dir + the config path inside it (file need not exist).
fn isolated_config() -> (tempfile::TempDir, PathBuf) {
    let dir = tempfile::tempdir().expect("tempdir");
    let path = dir.path().join("config.toml");
    (dir, path)
}

/// Write the one-profile dev config whose URL points at `url` and whose
/// token comes from `IGNITION_TOKEN`.
fn write_profile_config(config: &Path, url: &str) {
    std::fs::write(
        config,
        format!(
            "active = \"dev\"\n\n[profiles.dev]\nurl = \"{url}\"\nauth = {{ token_env = \"IGNITION_TOKEN\" }}\n"
        ),
    )
    .expect("write config");
}

/// Spawn `ign` with an isolated config, the mock token in the env, and args.
fn ign(config: &Path, url: &str, args: &[&str]) -> std::process::Output {
    let mut command = Command::cargo_bin("ign").expect("binary 'ign' not found");
    command
        .env("IGNITION_CLI_CONFIG", config)
        .env("IGNITION_TOKEN", "mock:name-key")
        .env("IGNITION_URL", url);
    command.args(args).output().expect("spawn ign")
}

/// stdout minus the single trailing newline `println!` appends.
fn stdout_for_golden(out: &std::process::Output) -> &str {
    let stdout = std::str::from_utf8(&out.stdout).expect("utf-8 stdout");
    stdout.strip_suffix('\n').unwrap_or(stdout)
}

/// stderr's JSON envelope starting at the first `{` (log-tolerant parse).
fn stderr_envelope(out: &std::process::Output) -> String {
    let stderr = String::from_utf8_lossy(&out.stderr);
    let start = stderr.find('{').unwrap_or(0);
    stderr[start..].to_string()
}

/// The projects list fixture: a child (full inheritance info +
/// passthrough extras) and a bare root project.
async fn mount_projects_list(server: &wiremock::MockServer) {
    wiremock::Mock::given(wiremock::matchers::method("GET"))
        .and(wiremock::matchers::path("/data/api/v1/projects/list"))
        .respond_with(
            wiremock::ResponseTemplate::new(200).set_body_json(serde_json::json!({
                "items": [
                    {
                        "name": "PlantFloor",
                        "title": "Plant Floor",
                        "description": "Line control screens",
                        "enabled": true,
                        "parent": "Base",
                        "inheritable": true,
                        "defaultDb": "MyPostgres",
                        "runtimeUsageFlags": 0
                    },
                    {
                        "name": "Base",
                        "enabled": true
                    }
                ],
                "metadata": {"total": 2, "matching": 2, "limit": -1, "offset": 0}
            })),
        )
        .expect(1..)
        .mount(server)
        .await;
}

/// `ign project list` goldens in all three modes: human table rows,
/// pretty JSON, compact — every value fixture-pinned. The agent shape
/// carries ALL six keys per project (null when absent — agents never
/// key-hunt); the passthrough extras (`defaultDb`, …) stay at the
/// client seam.
#[tokio::test]
async fn project_list_render_modes_golden() {
    let server = wiremock::MockServer::start().await;
    mount_projects_list(&server).await;

    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");

    // Pretty JSON.
    let out = ign(&config, &server.uri(), &["project", "list", "--json"]);
    assert!(
        out.status.success(),
        "stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"
{
  "ok": true,
  "profile": "dev",
  "data": {
    "projects": [
      {
        "name": "PlantFloor",
        "title": "Plant Floor",
        "description": "Line control screens",
        "enabled": true,
        "parent": "Base",
        "inheritable": true
      },
      {
        "name": "Base",
        "title": null,
        "description": null,
        "enabled": true,
        "parent": null,
        "inheritable": null
      }
    ]
  }
}
"#]],
    );

    // Human: the webpage's project list as terminal rows.
    let out = ign(&config, &server.uri(), &["project", "list"]);
    assert!(
        out.status.success(),
        "stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"
[profile: dev]
PlantFloor  Plant Floor  true  Base  true
Base  -  true  -  -
"#]],
    );

    // Compact: one line, same shape.
    let out = ign(&config, &server.uri(), &["project", "list", "--compact"]);
    assert!(out.status.success());
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"{"ok":true,"profile":"dev","data":{"projects":[{"name":"PlantFloor","title":"Plant Floor","description":"Line control screens","enabled":true,"parent":"Base","inheritable":true},{"name":"Base","title":null,"description":null,"enabled":true,"parent":null,"inheritable":null}]}}"#]],
    );
}

/// `ign project new` goldens: create fires, then the find read-back
/// fills the result — human confirmation line (with the parent) and
/// the flat JSON record.
#[tokio::test]
async fn project_new_success_golden() {
    let server = wiremock::MockServer::start().await;
    // The create mock only fires when the body carries the provided
    // fields (and never an empty-string parent — Pitfall 5).
    wiremock::Mock::given(wiremock::matchers::method("POST"))
        .and(wiremock::matchers::path("/data/api/v1/projects"))
        .and(wiremock::matchers::body_json(serde_json::json!({
            "name": "child", "enabled": true, "title": "Child", "parent": "Base"
        })))
        .respond_with(wiremock::ResponseTemplate::new(200))
        .expect(1..)
        .mount(&server)
        .await;
    wiremock::Mock::given(wiremock::matchers::method("GET"))
        .and(wiremock::matchers::path("/data/api/v1/projects/find/child"))
        .respond_with(
            wiremock::ResponseTemplate::new(200).set_body_json(serde_json::json!({
                "name": "child", "title": "Child", "enabled": true,
                "parent": "Base", "inheritable": false
            })),
        )
        .expect(1..)
        .mount(&server)
        .await;

    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");

    let out = ign(
        &config,
        &server.uri(),
        &[
            "project", "new", "child", "--title", "Child", "--parent", "Base",
        ],
    );
    assert!(
        out.status.success(),
        "stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"
[profile: dev]
created child (parent Base)
"#]],
    );

    let out = ign(
        &config,
        &server.uri(),
        &[
            "project",
            "new",
            "child",
            "--title",
            "Child",
            "--parent",
            "Base",
            "--compact",
        ],
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"{"ok":true,"profile":"dev","data":{"name":"child","title":"Child","description":null,"enabled":true,"parent":"Base","inheritable":false}}"#]],
    );
}

/// `ign project set --title`: the PUT mock's `body_json` matcher only
/// fires on the EXACT body `{"title":"T"}` — the only-provided-fields
/// proof at the binary level — and the human line names the field.
#[tokio::test]
async fn project_set_title_success_golden() {
    let server = wiremock::MockServer::start().await;
    wiremock::Mock::given(wiremock::matchers::method("PUT"))
        .and(wiremock::matchers::path("/data/api/v1/projects/x"))
        .and(wiremock::matchers::body_json(
            serde_json::json!({"title": "T"}),
        ))
        .respond_with(wiremock::ResponseTemplate::new(200))
        .expect(1..)
        .mount(&server)
        .await;
    wiremock::Mock::given(wiremock::matchers::method("GET"))
        .and(wiremock::matchers::path("/data/api/v1/projects/find/x"))
        .respond_with(
            wiremock::ResponseTemplate::new(200).set_body_json(serde_json::json!({
                "name": "x", "title": "T", "enabled": true
            })),
        )
        .expect(1..)
        .mount(&server)
        .await;

    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");

    let out = ign(
        &config,
        &server.uri(),
        &["project", "set", "x", "--title", "T"],
    );
    assert!(
        out.status.success(),
        "stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"
[profile: dev]
set title on x
"#]],
    );

    // `set` with NO field flags is a clap usage error (the ArgGroup
    // requires at least one) — exit 2, never a wasted round-trip.
    let out = ign(&config, &server.uri(), &["project", "set", "x"]);
    assert_eq!(out.status.code(), Some(2));
}

/// Copy + rename dispatch arms (non-destructive — no --yes): human
/// confirmation lines; wire shapes pinned in the core contract suite.
#[tokio::test]
async fn project_copy_and_rename_human_lines() {
    let server = wiremock::MockServer::start().await;
    wiremock::Mock::given(wiremock::matchers::method("POST"))
        .and(wiremock::matchers::path("/data/api/v1/projects/copy"))
        .respond_with(wiremock::ResponseTemplate::new(200))
        .expect(1..)
        .mount(&server)
        .await;
    wiremock::Mock::given(wiremock::matchers::method("POST"))
        .and(wiremock::matchers::path("/data/api/v1/projects/rename/Old"))
        .respond_with(wiremock::ResponseTemplate::new(200))
        .expect(1..)
        .mount(&server)
        .await;
    for name in ["dst", "New"] {
        wiremock::Mock::given(wiremock::matchers::method("GET"))
            .and(wiremock::matchers::path(format!(
                "/data/api/v1/projects/find/{name}"
            )))
            .respond_with(
                wiremock::ResponseTemplate::new(200).set_body_json(serde_json::json!({
                    "name": name, "enabled": true, "parent": "Base"
                })),
            )
            .expect(1)
            .mount(&server)
            .await;
    }

    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");

    let out = ign(&config, &server.uri(), &["project", "copy", "src", "dst"]);
    assert!(
        out.status.success(),
        "stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"
[profile: dev]
copied src → dst
"#]],
    );

    let out = ign(&config, &server.uri(), &["project", "rename", "Old", "New"]);
    assert!(
        out.status.success(),
        "stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"
[profile: dev]
renamed Old → New
"#]],
    );
}

/// THE crown pin: `project delete` WITHOUT `--yes` exits 2 with the
/// `confirmation_required` envelope and profile NULL — fully static
/// content (the guard fires before any API construction — no mock, no
/// network, the config points at a dead URL and it does not matter).
#[tokio::test]
async fn project_delete_without_yes_exits_2_golden() {
    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");

    let out = ign(
        &config,
        "http://127.0.0.1:1",
        &["project", "delete", "x", "--compact"],
    );
    assert_eq!(out.status.code(), Some(2), "usage class");
    assert!(out.stdout.is_empty(), "errors never touch stdout");
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stderr_envelope(&out),
        snapbox::str![[r#"
{"ok":false,"profile":null,"error":{"code":"confirmation_required","message":"project delete is destructive; rerun with --yes to confirm","endpoint":null,"hint":"this operation is destructive; re-run with --yes or set IGNITION_YES=1"}}

"#]],
    );

    // Human mode: the message + hint on stderr.
    let out = ign(&config, "http://127.0.0.1:1", &["project", "delete", "x"]);
    assert_eq!(out.status.code(), Some(2));
    let stderr = String::from_utf8_lossy(&out.stderr);
    assert!(
        stderr.contains("project delete"),
        "human message names the operation: {stderr}"
    );
    assert!(stderr.contains("--yes"), "human hint names --yes: {stderr}");
}

/// Delete WITH `--yes`: the gateway-side DELETE fires carrying
/// `confirm=true` as a QUERY param with an empty body (Pitfall 8's
/// wire half — the matcher only fires when the param matches), and
/// the success line golden-pins.
#[tokio::test]
async fn project_delete_with_yes_proves_confirm_true_on_wire() {
    let server = wiremock::MockServer::start().await;
    let guard = wiremock::Mock::given(wiremock::matchers::method("DELETE"))
        .and(wiremock::matchers::path("/data/api/v1/projects/x"))
        .and(wiremock::matchers::query_param("confirm", "true"))
        .respond_with(wiremock::ResponseTemplate::new(200))
        .expect(1..)
        .mount_as_scoped(&server)
        .await;

    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");

    let out = ign(&config, &server.uri(), &["project", "delete", "x", "--yes"]);
    assert!(
        out.status.success(),
        "stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"
[profile: dev]
deleted x
"#]],
    );

    let out = ign(
        &config,
        &server.uri(),
        &["project", "delete", "x", "--yes", "--compact"],
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"{"ok":true,"profile":"dev","data":{"deleted":"x"}}"#]],
    );

    let requests = guard.received_requests().await;
    assert_eq!(requests.len(), 2, "one DELETE per invocation");
    for request in &requests {
        let query = request.url.query().expect("query present");
        assert!(
            query.contains("confirm=true"),
            "the server's own guard rode the wire: {query}"
        );
        assert!(request.body.is_empty(), "the DELETE carries no body");
    }
}

/// Spawn `ign` with an isolated config, the mock token in the env, args,
/// and a working directory (export's default naming writes to the CWD).
fn ign_in(dir: &Path, config: &Path, url: &str, args: &[&str]) -> std::process::Output {
    let mut command = Command::cargo_bin("ign").expect("binary 'ign' not found");
    command
        .env("IGNITION_CLI_CONFIG", config)
        .env("IGNITION_TOKEN", "mock:name-key")
        .env("IGNITION_URL", url)
        .current_dir(dir);
    command.args(args).output().expect("spawn ign")
}

/// Spawn `ign` reading `stdin` fully (the `--file -` import path).
fn ign_stdin(config: &Path, url: &str, args: &[&str], stdin: &[u8]) -> std::process::Output {
    let mut command = Command::cargo_bin("ign").expect("binary 'ign' not found");
    command
        .env("IGNITION_CLI_CONFIG", config)
        .env("IGNITION_TOKEN", "mock:name-key")
        .env("IGNITION_URL", url);
    command
        .args(args)
        .write_stdin(stdin)
        .output()
        .expect("spawn ign")
}

/// The binary-level ZIP fixture — a REAL minimal archive (one
/// `project.json` member) since 05-07's full-structure import
/// validation: magic-bytes-plus-junk refuses as `invalid_import_file`
/// (correctly — the gateway would silently wipe the target on
/// overwrite). The byte count is `[..]`-elided in the goldens (it is
/// writer-deterministic but meaningless to pin).
fn zip_fixture() -> Vec<u8> {
    use std::io::Write as _;
    let mut writer = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
    let options = zip::write::SimpleFileOptions::default();
    writer
        .start_file("project.json", options)
        .expect("fixture member starts");
    writer
        .write_all(br#"{"title":"fixture"}"#)
        .expect("fixture member writes");
    writer.finish().expect("fixture finalizes").into_inner()
}

/// `ign project export` goldens (PROJ-03): the ZIP streams to the
/// CWD under the SANITIZED `Content-Disposition` name — human lines
/// (artifact + scope summary) and the compact JSON carrying
/// `{project, file, bytes, scope}` with BOTH scope arrays.
#[tokio::test]
async fn project_export_success_golden() {
    let server = wiremock::MockServer::start().await;
    wiremock::Mock::given(wiremock::matchers::method("GET"))
        .and(wiremock::matchers::path(
            "/data/api/v1/projects/export/My%20Proj",
        ))
        .respond_with(
            wiremock::ResponseTemplate::new(200)
                // set_body_raw: set_body_string would force text/plain
                .set_body_raw(zip_fixture(), "application/zip")
                .insert_header(
                    "Content-Disposition",
                    "attachment; filename=\"MyProj-export.zip\"",
                ),
        )
        .expect(1..)
        .mount(&server)
        .await;

    let workdir = tempfile::tempdir().expect("workdir");
    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");

    // Human: artifact line + the scope summary.
    let out = ign_in(
        workdir.path(),
        &config,
        &server.uri(),
        &["project", "export", "My Proj"],
    );
    assert!(
        out.status.success(),
        "stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"
[profile: dev]
exported My Proj → MyProj-export.zip ([..] bytes)
scope: includes views/scripts/named-queries/vision-windows/perspective-themes-styles/reporting/alarm-notification-profiles/webdev-routes/translations/sfc-charts · excludes tag-providers/tags/udts/gateway-config/database-connections/users-roles/alarm-journal/certificates
"#]],
    );
    // The artifact landed byte-for-byte under the disposition name.
    assert_eq!(
        std::fs::read(workdir.path().join("MyProj-export.zip")).expect("file written"),
        zip_fixture()
    );
    // No .part remnant survived the atomic rename.
    assert!(
        !workdir.path().join("My Proj.zip.part").exists()
            && !workdir.path().join("MyProj-export.zip.part").exists(),
        "the .part temp is gone"
    );

    // Compact: the full agent shape incl. both scope arrays.
    let out = ign_in(
        workdir.path(),
        &config,
        &server.uri(),
        &["project", "export", "My Proj", "--compact"],
    );
    assert!(out.status.success());
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"{"ok":true,"profile":"dev","data":{"project":"My Proj","file":"MyProj-export.zip","bytes":[..],"scope":{"includes":["views","scripts","named-queries","vision-windows","perspective-themes-styles","reporting","alarm-notification-profiles","webdev-routes","translations","sfc-charts"],"excludes":["tag-providers","tags","udts","gateway-config","database-connections","users-roles","alarm-journal","certificates"]}}}"#]],
    );
}

/// `project export -o FILE`: the bytes land at EXACTLY the given path
/// (no disposition renaming) and the data carries that path.
#[tokio::test]
async fn project_export_explicit_output_golden() {
    let server = wiremock::MockServer::start().await;
    wiremock::Mock::given(wiremock::matchers::method("GET"))
        .and(wiremock::matchers::path("/data/api/v1/projects/export/x"))
        .respond_with(
            wiremock::ResponseTemplate::new(200)
                .set_body_raw(zip_fixture(), "application/zip")
                .insert_header(
                    "Content-Disposition",
                    "attachment; filename=\"ignored-by-o.zip\"",
                ),
        )
        .expect(1..)
        .mount(&server)
        .await;

    let workdir = tempfile::tempdir().expect("workdir");
    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");

    let out = ign_in(
        workdir.path(),
        &config,
        &server.uri(),
        &["project", "export", "x", "-o", "out.zip", "--compact"],
    );
    assert!(out.status.success());
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"{"ok":true,"profile":"dev","data":{"project":"x","file":"out.zip","bytes":[..],"scope":{"includes":["views","scripts","named-queries","vision-windows","perspective-themes-styles","reporting","alarm-notification-profiles","webdev-routes","translations","sfc-charts"],"excludes":["tag-providers","tags","udts","gateway-config","database-connections","users-roles","alarm-journal","certificates"]}}}"#]],
    );
    assert_eq!(
        std::fs::read(workdir.path().join("out.zip")).expect("file written"),
        zip_fixture()
    );
    assert!(
        !workdir.path().join("ignored-by-o.zip").exists(),
        "-o wins over the disposition name"
    );
}

/// THE collision golden: abort-policy import over an EXISTING project
/// exits 6 `project_exists` with the overwrite-naming hint — and the
/// import mock (expect 0) proves ZERO uploads reached the gateway.
#[tokio::test]
async fn project_import_abort_collision_exits_6_golden() {
    let server = wiremock::MockServer::start().await;
    let import_guard = wiremock::Mock::given(wiremock::matchers::method("POST"))
        .and(wiremock::matchers::path("/data/api/v1/projects/import/x"))
        .respond_with(wiremock::ResponseTemplate::new(200))
        .expect(0)
        .mount_as_scoped(&server)
        .await;
    wiremock::Mock::given(wiremock::matchers::method("GET"))
        .and(wiremock::matchers::path("/data/api/v1/projects/find/x"))
        .respond_with(
            wiremock::ResponseTemplate::new(200)
                .set_body_json(serde_json::json!({"name": "x", "enabled": true})),
        )
        .expect(1..)
        .mount(&server)
        .await;

    let zip_dir = tempfile::tempdir().expect("zipdir");
    let zip_path = zip_dir.path().join("proj.zip");
    std::fs::write(&zip_path, zip_fixture()).expect("write fixture");

    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");
    let out = ign(
        &config,
        &server.uri(),
        &[
            "project",
            "import",
            "x",
            "--file",
            zip_path.to_str().unwrap(),
            "--compact",
        ],
    );
    assert_eq!(out.status.code(), Some(6), "target-state class");
    assert!(out.stdout.is_empty(), "errors never touch stdout");
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stderr_envelope(&out),
        snapbox::str![[r#"
{"ok":false,"profile":"dev","error":{"code":"project_exists","message":"project x already exists on the gateway","endpoint":null,"hint":"the default collision policy refuses to overwrite; re-run with --collision-policy overwrite to replace it — overwrite REPLACES the ENTIRE project (resources absent from the ZIP are deleted; merge is Designer-only)"}}

"#]],
    );
    assert!(
        import_guard.received_requests().await.is_empty(),
        "the refusal happened BEFORE any upload"
    );
}

/// THE guard golden: overwrite-policy import WITHOUT `--yes` exits 2
/// with the `confirmation_required` envelope and profile NULL — the
/// guard fires before any resolution (dead URL, no mocks, no matter).
#[tokio::test]
async fn project_import_overwrite_without_yes_exits_2_golden() {
    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");

    let out = ign(
        &config,
        "http://127.0.0.1:1",
        &[
            "project",
            "import",
            "x",
            "--file",
            "whatever.zip",
            "--collision-policy",
            "overwrite",
            "--compact",
        ],
    );
    assert_eq!(out.status.code(), Some(2), "usage class");
    assert!(out.stdout.is_empty(), "errors never touch stdout");
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stderr_envelope(&out),
        snapbox::str![[r#"
{"ok":false,"profile":null,"error":{"code":"confirmation_required","message":"project import --collision-policy overwrite is destructive; rerun with --yes to confirm","endpoint":null,"hint":"this operation is destructive; re-run with --yes or set IGNITION_YES=1"}}

"#]],
    );
}

/// Overwrite WITH `--yes`: the upload fires carrying
/// `overwrite=true`, the exact ZIP bytes, and
/// `Content-Type: application/zip` — and the find mock (expect 0)
/// proves overwrite performs NO pre-check (the server is the
/// authority).
#[tokio::test]
async fn project_import_overwrite_with_yes_uploads() {
    let server = wiremock::MockServer::start().await;
    let import_guard = wiremock::Mock::given(wiremock::matchers::method("POST"))
        .and(wiremock::matchers::path("/data/api/v1/projects/import/x"))
        .and(wiremock::matchers::query_param("overwrite", "true"))
        .respond_with(
            wiremock::ResponseTemplate::new(200)
                .set_body_json(serde_json::json!({"status": "imported"})),
        )
        .expect(1..)
        .mount_as_scoped(&server)
        .await;
    wiremock::Mock::given(wiremock::matchers::method("GET"))
        .and(wiremock::matchers::path("/data/api/v1/projects/find/x"))
        .respond_with(wiremock::ResponseTemplate::new(200))
        .expect(0)
        .mount(&server)
        .await;

    let zip_dir = tempfile::tempdir().expect("zipdir");
    let zip_path = zip_dir.path().join("proj.zip");
    std::fs::write(&zip_path, zip_fixture()).expect("write fixture");

    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");
    let out = ign(
        &config,
        &server.uri(),
        &[
            "project",
            "import",
            "x",
            "--file",
            zip_path.to_str().unwrap(),
            "--collision-policy",
            "overwrite",
            "--yes",
        ],
    );
    assert!(
        out.status.success(),
        "stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"
[profile: dev]
imported x ([..] bytes, policy overwrite)
"#]],
    );

    let requests = import_guard.received_requests().await;
    assert!(!requests.is_empty(), "the upload fired");
    for request in &requests {
        let query = request.url.query().expect("query present");
        assert_eq!(query, "overwrite=true", "the policy rode the wire: {query}");
        assert_eq!(request.body, zip_fixture(), "the exact ZIP bytes");
        assert_eq!(
            request
                .headers
                .get("content-type")
                .and_then(|value| value.to_str().ok()),
            Some("application/zip")
        );
    }
}

/// THE import-denial seam pin (05-07): the gateway refusing an
/// overwrite import over HTTP 200 (`{success:false, problem}` — the
/// live-witnessed 8.3 shape) surfaces as exit 6 `import_denied`, the
/// problem text verbatim in the message — the 03-02 verb shares the
/// ONE `project_import` seam with resource put/delete and webdev
/// deploy (endpoint embeds the dynamic mock URI — programmatic
/// envelope assertions, the delete-nonexistent pattern).
#[tokio::test]
async fn project_import_denial_exits_6_golden() {
    let server = wiremock::MockServer::start().await;
    let _import_guard = wiremock::Mock::given(wiremock::matchers::method("POST"))
        .and(wiremock::matchers::path("/data/api/v1/projects/import/x"))
        .and(wiremock::matchers::query_param("overwrite", "true"))
        .respond_with(wiremock::ResponseTemplate::new(200).set_body_json(
            serde_json::json!({
                "success": false,
                "problem": "resource already exists: ResourceId{resourcePath=com.example, collectionName=views}"
            }),
        ))
        .expect(1)
        .mount_as_scoped(&server)
        .await;
    // Overwrite performs NO pre-check (the server is the authority) —
    // the refusal below is the gateway's own answer.
    wiremock::Mock::given(wiremock::matchers::method("GET"))
        .and(wiremock::matchers::path("/data/api/v1/projects/find/x"))
        .respond_with(wiremock::ResponseTemplate::new(200))
        .expect(0)
        .mount(&server)
        .await;

    let zip_dir = tempfile::tempdir().expect("zipdir");
    let zip_path = zip_dir.path().join("proj.zip");
    std::fs::write(&zip_path, zip_fixture()).expect("write fixture");

    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");
    let out = ign(
        &config,
        &server.uri(),
        &[
            "project",
            "import",
            "x",
            "--file",
            zip_path.to_str().unwrap(),
            "--collision-policy",
            "overwrite",
            "--yes",
            "--compact",
        ],
    );
    assert_eq!(out.status.code(), Some(6), "target-state class");
    assert!(out.stdout.is_empty(), "errors never touch stdout");

    let envelope: Value = serde_json::from_str(&stderr_envelope(&out))
        .unwrap_or_else(|err| panic!("stderr envelope parses: {err}"));
    assert_eq!(
        envelope["error"]["code"],
        Value::String("import_denied".into()),
        "the denial slug: {envelope}"
    );
    assert!(
        envelope["error"]["message"]
            .as_str()
            .unwrap_or_default()
            .contains("resource already exists"),
        "the gateway's problem text rides the message: {envelope}"
    );
    let endpoint = envelope["error"]["endpoint"].as_str().unwrap_or_default();
    assert!(
        endpoint.starts_with(&server.uri()) && endpoint.contains("/projects/import/x"),
        "the endpoint names the import request: {endpoint}"
    );
}

/// Stdin import (`--file -`): piped bytes ride the same guards and
/// the abort policy's find pre-check (404 = name free) precedes the
/// `overwrite=false` upload.
#[tokio::test]
async fn project_import_stdin_golden() {
    let server = wiremock::MockServer::start().await;
    let import_guard = wiremock::Mock::given(wiremock::matchers::method("POST"))
        .and(wiremock::matchers::path(
            "/data/api/v1/projects/import/piped",
        ))
        .and(wiremock::matchers::query_param("overwrite", "false"))
        .respond_with(wiremock::ResponseTemplate::new(200))
        .expect(1)
        .mount_as_scoped(&server)
        .await;
    wiremock::Mock::given(wiremock::matchers::method("GET"))
        .and(wiremock::matchers::path("/data/api/v1/projects/find/piped"))
        .respond_with(
            wiremock::ResponseTemplate::new(404)
                .set_body_json(serde_json::json!({"message": "Project not found"})),
        )
        .expect(1)
        .mount(&server)
        .await;

    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");
    let out = ign_stdin(
        &config,
        &server.uri(),
        &["project", "import", "piped", "--file", "-", "--compact"],
        &zip_fixture(),
    );
    assert!(
        out.status.success(),
        "stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"{"ok":true,"profile":"dev","data":{"name":"piped","collision_policy":"abort","bytes":[..],"scope":{"includes":["views","scripts","named-queries","vision-windows","perspective-themes-styles","reporting","alarm-notification-profiles","webdev-routes","translations","sfc-charts"],"excludes":["tag-providers","tags","udts","gateway-config","database-connections","users-roles","alarm-journal","certificates"]},"outcome":{"status":"success"}}}"#]],
    );
    let requests = import_guard.received_requests().await;
    assert_eq!(requests.len(), 1);
    assert_eq!(requests[0].body, zip_fixture(), "the piped bytes uploaded");
}

/// A non-ZIP file refuses with exit 2 `invalid_import_file` BEFORE
/// any network I/O — the config points at a DEAD URL and no mock
/// exists; if any HTTP had been attempted the command would exit 4.
#[tokio::test]
async fn project_import_non_zip_exits_2_golden() {
    let bad_dir = tempfile::tempdir().expect("bad dir");
    let bad_path = bad_dir.path().join("not-a-zip.txt");
    std::fs::write(&bad_path, b"definitely not a zip").expect("write junk");

    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");
    let out = ign(
        &config,
        "http://127.0.0.1:1",
        &[
            "project",
            "import",
            "x",
            "--file",
            bad_path.to_str().unwrap(),
            "--compact",
        ],
    );
    assert_eq!(out.status.code(), Some(2), "usage class, zero network");
    assert!(out.stdout.is_empty(), "errors never touch stdout");
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stderr_envelope(&out),
        // NOTE: snapbox's `str!` normalizes backslashes in the ACTUAL
        // output to forward slashes (cross-platform path handling) —
        // the wire text is `PK\\x03\\x04` (JSON-escaped literal
        // backslash), which the golden spells `PK//x03//x04`.
        snapbox::str![[r#"
{"ok":false,"profile":"dev","error":{"code":"invalid_import_file","message":"invalid import file: missing ZIP magic (PK//x03//x04) — not a project export archive","endpoint":null,"hint":"import expects a project-export ZIP (PK//x03//x04 magic) of at most 512 MB — pass a file produced by `ign project export` via --file (or `-` to pipe one on stdin)"}}

"#]],
    );
}

/// THE truncated-zip guard (05-07, Rule 2): a TRUNCATED archive —
/// valid magic, broken tail — refuses exit 2 `invalid_import_file`
/// BEFORE any upload. Live-witnessed on 8.3.3: the gateway accepts
/// exactly this shape with `{"success":true,"changes":[]}` and, on
/// overwrite, REPLACES the project with the partial contents — data
/// loss wearing a success face. Zero network: dead URL, no mock.
#[tokio::test]
async fn project_import_truncated_zip_exits_2_golden() {
    let truncated = {
        let full = zip_fixture();
        full[..full.len() - 10].to_vec()
    };
    let bad_dir = tempfile::tempdir().expect("bad dir");
    let bad_path = bad_dir.path().join("truncated.zip");
    std::fs::write(&bad_path, truncated).expect("write truncated zip");

    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");
    let out = ign(
        &config,
        "http://127.0.0.1:1",
        &[
            "project",
            "import",
            "x",
            "--file",
            bad_path.to_str().unwrap(),
            "--collision-policy",
            "overwrite",
            "--yes",
            "--compact",
        ],
    );
    assert_eq!(out.status.code(), Some(2), "usage class, zero network");
    assert!(out.stdout.is_empty(), "errors never touch stdout");
    let envelope: Value = serde_json::from_str(&stderr_envelope(&out))
        .unwrap_or_else(|err| panic!("stderr envelope parses: {err}"));
    assert_eq!(
        envelope["error"]["code"],
        Value::String("invalid_import_file".into()),
        "the structure guard names the caller's file: {envelope}"
    );
}

/// Deleting a nonexistent project: the gateway answers 404 → exit 6,
/// `not_found` (endpoint embeds the dynamic mock URI — programmatic
/// envelope assertions, the version_gateway_contract pattern).
#[tokio::test]
async fn project_delete_nonexistent_exits_6() {
    let server = wiremock::MockServer::start().await;
    wiremock::Mock::given(wiremock::matchers::method("DELETE"))
        .and(wiremock::matchers::path("/data/api/v1/projects/nope"))
        .and(wiremock::matchers::query_param("confirm", "true"))
        .respond_with(
            wiremock::ResponseTemplate::new(404).set_body_json(serde_json::json!({
                "message": "Project not found"
            })),
        )
        .expect(1)
        .mount(&server)
        .await;

    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");
    let out = ign(
        &config,
        &server.uri(),
        &["project", "delete", "nope", "--yes", "--compact"],
    );
    assert_eq!(out.status.code(), Some(6), "target-state class");
    assert!(out.stdout.is_empty(), "errors never touch stdout");

    let body: Value = serde_json::from_str(&stderr_envelope(&out))
        .unwrap_or_else(|err| panic!("stderr envelope parses: {err}"));
    assert_eq!(body["ok"], Value::Bool(false));
    assert_eq!(body["profile"], Value::String("dev".into()));
    assert_eq!(
        body["error"]["code"],
        Value::String("not_found".into()),
        "full envelope: {}",
        stderr_envelope(&out)
    );
    assert_eq!(
        body["error"]["endpoint"],
        Value::String(format!("{}/data/api/v1/projects/nope", server.uri()))
    );
}

// ---- Cross-gateway diff goldens (07-01, SYNC-01) ----

/// Write the TWO-profile config the cross-gateway verbs ride: `dev`
/// is ACTIVE and points (via the `IGNITION_URL` env overlay the
/// harness always sets) at side A's mock; `other` carries side B's
/// URL directly in the file.
fn write_two_profile_config(config: &Path, url_b: &str) {
    std::fs::write(
        config,
        format!(
            "active = \"dev\"\n\n[profiles.dev]\nurl = \"http://ignored-a.example.com\"\nauth = {{ token_env = \"IGNITION_TOKEN\" }}\n\n[profiles.other]\nurl = \"{url_b}\"\nauth = {{ token_env = \"IGNITION_TOKEN\" }}\n"
        ),
    )
    .expect("write config");
}

/// The diff-side export fixture: a real zip with a volatile
/// descriptor, a script, and (per side) an extra view member.
fn diff_export_zip(project_json: &[u8], members: &[(&str, &[u8])]) -> Vec<u8> {
    use std::io::Write as _;
    let mut writer = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
    let options = zip::write::SimpleFileOptions::default();
    writer
        .start_file("project.json", options)
        .expect("project.json starts");
    writer.write_all(project_json).expect("project.json writes");
    for (name, bytes) in members {
        writer.start_file(*name, options).expect("member starts");
        writer.write_all(bytes).expect("member writes");
    }
    writer.finish().expect("zip finalizes").into_inner()
}

/// A live-shaped descriptor with the two volatility fields (the
/// normalization proof's fixture).
fn volatile_descriptor(timestamp: &str) -> Vec<u8> {
    format!(
        r#"{{"scope":"G","version":1,"files":["script.py"],"attributes":{{"lastModification":{{"actor":"a","timestamp":"{timestamp}"}},"lastModificationSignature":"sig-{timestamp}"}}}}"#
    )
    .into_bytes()
}

/// `ign project diff dev other --project p` goldens in all three
/// modes: the human grouped sections + summary line, and the JSON
/// agent shape with `scope`/`profile_a`/`profile_b` and every
/// summary key ALWAYS present. The envelope's profile is the ACTIVE
/// profile (`dev`) — the two sides ride the data. Volatility proof:
/// the differing-attribute descriptor reports `same`.
#[tokio::test]
async fn project_diff_render_modes_golden() {
    let server_a = wiremock::MockServer::start().await;
    let server_b = wiremock::MockServer::start().await;
    let zip_a = diff_export_zip(
        br#"{"title":"Old","enabled":true}"#,
        &[
            (
                "ignition/resources/script-python/uat/resource.json",
                volatile_descriptor("2026-08-28T10:00:00Z").as_slice(),
            ),
            (
                "ignition/resources/script-python/uat/script.py",
                b"print('old')",
            ),
        ],
    );
    let zip_b = diff_export_zip(
        br#"{"title":"New","enabled":true}"#,
        &[
            (
                "ignition/resources/script-python/uat/resource.json",
                volatile_descriptor("2026-08-28T11:30:00Z").as_slice(),
            ),
            (
                "ignition/resources/script-python/uat/script.py",
                b"print('new')",
            ),
            (
                "com.example/resources/views/Fresh/view.json",
                br#"{"scope":"G"}"#.as_slice(),
            ),
        ],
    );
    for (server, zip) in [(&server_a, zip_a), (&server_b, zip_b)] {
        wiremock::Mock::given(wiremock::matchers::method("GET"))
            .and(wiremock::matchers::path("/data/api/v1/projects/export/p"))
            .respond_with(wiremock::ResponseTemplate::new(200).set_body_raw(zip, "application/zip"))
            .expect(1..)
            .mount(server)
            .await;
        wiremock::Mock::given(wiremock::matchers::method("POST"))
            .and(wiremock::matchers::path("/data/api/v1/projects/import/p"))
            .respond_with(wiremock::ResponseTemplate::new(200))
            .expect(0)
            .mount(server)
            .await;
    }

    let (_dir, config) = isolated_config();
    write_two_profile_config(&config, &server_b.uri());

    // Human: direction header, meta delta, grouped sections, summary.
    let out = ign(
        &config,
        &server_a.uri(),
        &["project", "diff", "dev", "other", "--project", "p"],
    );
    assert!(
        out.status.success(),
        "stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"
[profile: dev]
project p · dev → other · statuses are B-relative-to-A (scope project)
project.json title: Old → New
ADDED (1)
  com.example/views/Fresh/view.json
REMOVED (0)
CHANGED (1)
  ignition/script-python/uat/script.py
1 same, 1 added, 0 removed, 1 changed
"#]],
    );

    // Compact: the full agent shape — scope/profile_a/profile_b and
    // every summary key always present, entries path-sorted.
    let out = ign(
        &config,
        &server_a.uri(),
        &[
            "project",
            "diff",
            "dev",
            "other",
            "--project",
            "p",
            "--compact",
        ],
    );
    assert!(out.status.success());
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"{"ok":true,"profile":"dev","data":{"scope":"project","profile_a":"dev","profile_b":"other","project":"p","project_meta":[{"field":"title","a":"Old","b":"New"}],"summary":{"same":1,"added":1,"removed":0,"changed":1},"entries":[{"path":"com.example/views/Fresh/view.json","status":"added"},{"path":"ignition/script-python/uat/resource.json","status":"same"},{"path":"ignition/script-python/uat/script.py","status":"changed"}]}}"#]],
    );
}

/// The same-profile refusal: exit 2 `invalid_input` — the check
/// fires inside the ACTION (after active-profile resolution, before
/// any export), so the envelope honestly echoes the active profile
/// while ZERO network fired (dead URL, no mocks).
#[tokio::test]
async fn project_diff_same_profile_exits_2_golden() {
    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");

    let out = ign(
        &config,
        "http://127.0.0.1:1",
        &[
            "project",
            "diff",
            "dev",
            "dev",
            "--project",
            "p",
            "--compact",
        ],
    );
    assert_eq!(out.status.code(), Some(2), "usage class");
    assert!(out.stdout.is_empty(), "errors never touch stdout");
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stderr_envelope(&out),
        snapbox::str![[r#"
{"ok":false,"profile":"dev","error":{"code":"invalid_input","message":"invalid input: diffing a profile against itself is a no-op — name two different profiles","endpoint":null,"hint":"fix the input source — a readable file path via --file, or `-` to pipe the content on stdin"}}

"#]],
    );
}

/// An unknown side-profile name is the standard profile_not_found
/// refusal (exit 3) BEFORE any export fires.
#[tokio::test]
async fn project_diff_unknown_side_profile_exits_3() {
    let server_a = wiremock::MockServer::start().await;
    wiremock::Mock::given(wiremock::matchers::method("GET"))
        .and(wiremock::matchers::path("/data/api/v1/projects/export/p"))
        .respond_with(wiremock::ResponseTemplate::new(200))
        .expect(0)
        .mount(&server_a)
        .await;

    let (_dir, config) = isolated_config();
    write_two_profile_config(&config, &server_a.uri());
    let out = ign(
        &config,
        &server_a.uri(),
        &[
            "project",
            "diff",
            "dev",
            "ghost",
            "--project",
            "p",
            "--compact",
        ],
    );
    assert_eq!(out.status.code(), Some(3), "config class");
    assert!(out.stdout.is_empty());
    let envelope: Value = serde_json::from_str(&stderr_envelope(&out))
        .unwrap_or_else(|err| panic!("stderr envelope parses: {err}"));
    assert_eq!(
        envelope["error"]["code"],
        Value::String("profile_not_found".into()),
        "full envelope: {}",
        stderr_envelope(&out)
    );
}

// ---- Cross-gateway sync goldens (07-01, SYNC-02) ----

/// THE guard golden: sync without `--yes` exits 2 with the
/// `confirmation_required` envelope and profile NULL — and ZERO HTTP
/// requests of any kind (both mock servers expect nothing; the guard
/// fires before either client resolves).
#[tokio::test]
async fn project_sync_without_yes_exits_2_zero_requests_golden() {
    let server_a = wiremock::MockServer::start().await;
    let server_b = wiremock::MockServer::start().await;
    for server in [&server_a, &server_b] {
        wiremock::Mock::given(wiremock::matchers::method("GET"))
            .respond_with(wiremock::ResponseTemplate::new(200))
            .expect(0)
            .named("no export may ride the wire on refusal")
            .mount(server)
            .await;
        wiremock::Mock::given(wiremock::matchers::method("POST"))
            .respond_with(wiremock::ResponseTemplate::new(200))
            .expect(0)
            .named("no import may ride the wire on refusal")
            .mount(server)
            .await;
    }

    let (_dir, config) = isolated_config();
    write_two_profile_config(&config, &server_b.uri());
    let out = ign(
        &config,
        &server_a.uri(),
        &[
            "project",
            "sync",
            "dev",
            "other",
            "--project",
            "p",
            "--all-changed",
            "--compact",
        ],
    );
    assert_eq!(out.status.code(), Some(2), "usage class");
    assert!(out.stdout.is_empty(), "errors never touch stdout");
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stderr_envelope(&out),
        snapbox::str![[r#"
{"ok":false,"profile":null,"error":{"code":"confirmation_required","message":"project sync (overwrite-import the whole project on other — replaces concurrent Designer edits) is destructive; rerun with --yes to confirm","endpoint":null,"hint":"this operation is destructive; re-run with --yes or set IGNITION_YES=1"}}

"#]],
    );
    assert!(
        server_a
            .received_requests()
            .await
            .unwrap_or_default()
            .is_empty()
            && server_b
                .received_requests()
                .await
                .unwrap_or_default()
                .is_empty(),
        "the refusal performed ZERO requests on either side"
    );
}

/// The selection-less refusal: neither `--resource` nor
/// `--all-changed` exits 2 `invalid_input` with profile null BEFORE
/// the guard (usage-class errors lead — the resource-put precedent).
#[tokio::test]
async fn project_sync_selection_less_exits_2_golden() {
    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");

    let out = ign(
        &config,
        "http://127.0.0.1:1",
        &[
            "project",
            "sync",
            "dev",
            "other",
            "--project",
            "p",
            "--yes",
            "--compact",
        ],
    );
    assert_eq!(out.status.code(), Some(2), "usage class");
    assert!(out.stdout.is_empty());
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stderr_envelope(&out),
        snapbox::str![[r#"
{"ok":false,"profile":null,"error":{"code":"invalid_input","message":"invalid input: sync needs a selection — pass --resource PATH (repeatable) and/or --all-changed","endpoint":null,"hint":"fix the input source — a readable file path via --file, or `-` to pipe the content on stdin"}}

"#]],
    );
}

/// The success golden: `sync --resource --yes` promotes A's member
/// into B (the import body round-trips through the public helpers
/// carrying A's bytes), and the compact JSON pins the flat agent
/// shape `{scope, profile_a, profile_b, project, synced, removed}`.
#[tokio::test]
async fn project_sync_success_golden() {
    let server_a = wiremock::MockServer::start().await;
    let server_b = wiremock::MockServer::start().await;
    let zip_a = diff_export_zip(
        br#"{"title":"T"}"#,
        &[(
            "ignition/resources/script-python/uat/script.py",
            b"print('new')",
        )],
    );
    let zip_b = diff_export_zip(
        br#"{"title":"T"}"#,
        &[(
            "ignition/resources/script-python/uat/script.py",
            b"print('old')",
        )],
    );
    wiremock::Mock::given(wiremock::matchers::method("GET"))
        .and(wiremock::matchers::path("/data/api/v1/projects/export/p"))
        .respond_with(wiremock::ResponseTemplate::new(200).set_body_raw(zip_a, "application/zip"))
        .expect(1..)
        .mount(&server_a)
        .await;
    let import_guard = wiremock::Mock::given(wiremock::matchers::method("POST"))
        .and(wiremock::matchers::path("/data/api/v1/projects/import/p"))
        .and(wiremock::matchers::query_param("overwrite", "true"))
        .and(wiremock::matchers::header(
            "content-type",
            "application/zip",
        ))
        .respond_with(
            wiremock::ResponseTemplate::new(200)
                .set_body_json(serde_json::json!({"success": true})),
        )
        .expect(1..)
        .mount_as_scoped(&server_b)
        .await;
    wiremock::Mock::given(wiremock::matchers::method("GET"))
        .and(wiremock::matchers::path("/data/api/v1/projects/export/p"))
        .respond_with(wiremock::ResponseTemplate::new(200).set_body_raw(zip_b, "application/zip"))
        .expect(1..)
        .mount(&server_b)
        .await;

    let (_dir, config) = isolated_config();
    write_two_profile_config(&config, &server_b.uri());
    let out = ign(
        &config,
        &server_a.uri(),
        &[
            "project",
            "sync",
            "dev",
            "other",
            "--project",
            "p",
            "--resource",
            "ignition/script-python/uat/script.py",
            "--yes",
            "--compact",
        ],
    );
    assert!(
        out.status.success(),
        "stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"{"ok":true,"profile":"dev","data":{"scope":"project","profile_a":"dev","profile_b":"other","project":"p","synced":["ignition/script-python/uat/script.py"],"removed":[]}}"#]],
    );

    // Human mode: the direction header + the promoted path.
    let out = ign(
        &config,
        &server_a.uri(),
        &[
            "project",
            "sync",
            "dev",
            "other",
            "--project",
            "p",
            "--resource",
            "ignition/script-python/uat/script.py",
            "--yes",
        ],
    );
    assert!(out.status.success());
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"
[profile: dev]
synced 1 resource(s) dev → other · project p (scope project)
  + ignition/script-python/uat/script.py
"#]],
    );

    // Member-level honesty on the import body (the 05-02 lesson):
    // A's bytes landed, exactly ONE import per run.
    let requests = import_guard.received_requests().await;
    assert_eq!(requests.len(), 2, "one import per invocation");
    for request in &requests {
        assert_eq!(
            ignition_core::client::resources::read_member(
                &request.body,
                "ignition/script-python/uat/script.py"
            )
            .expect("surgical body re-reads"),
            b"print('new')".to_vec(),
            "A's member bytes ride every import"
        );
    }
}

// ---- export --decode-scripts / import --encode-scripts (07-04, INTR-01) ----

/// A script-bearing export fixture (gateway-image escapes): the view
/// member carries TWO embedded scripts + an expression that passes
/// through; a plain script-python member never decodes.
fn script_zip_fixture() -> Vec<u8> {
    use std::io::Write as _;
    let view: &[u8] = br#"{
  "scope" : "G",
  "children" : [ {
    "type" : "ia.display.label",
    "eventScripts" : {
      "actionPerformed" : {
        "config" : {
          "script" : "\tprint \u0027clicked\u0027\n\tprint \u0027done\u0027"
        }
      }
    }
  }, {
    "type" : "ia.chart",
    "transform" : {
      "script" : "\t\tfor i in range(3):\n\t\t\tprint i\n\t\tprint \u0027end\u0027"
    },
    "props" : {
      "expression" : "toStr({view.args.x} * 2)"
    }
  } ]
}"#;
    let mut writer = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
    let options = zip::write::SimpleFileOptions::default()
        .compression_method(zip::CompressionMethod::Deflated);
    let members: &[(&str, &[u8])] = &[
        ("project.json", br#"{"title":"Fixture"}"#),
        ("c/resources/views/Dash/view.json", view),
        ("c/resources/views/Dash/resource.json", br#"{"scope":"G"}"#),
        ("ignition/resources/scratch", b"print('plain')"),
    ];
    for (name, bytes) in members {
        writer.start_file(*name, options).expect("starts");
        writer.write_all(bytes).expect("writes");
    }
    writer.finish().expect("finalize").into_inner()
}

/// The decode-export HUMAN golden (the plan-locked artifact line +
/// scope + the re-import pointer) over a wiremock export serving the
/// script-bearing zip — plus the on-disk tree shape proof.
#[tokio::test]
async fn project_export_decode_scripts_human_golden() {
    let server = wiremock::MockServer::start().await;
    wiremock::Mock::given(wiremock::matchers::method("GET"))
        .and(wiremock::matchers::path(
            "/data/api/v1/projects/export/MyProj",
        ))
        .respond_with(
            wiremock::ResponseTemplate::new(200)
                .set_body_raw(script_zip_fixture(), "application/zip")
                .insert_header(
                    "Content-Disposition",
                    "attachment; filename=\"MyProj-export.zip\"",
                ),
        )
        .expect(1)
        .mount(&server)
        .await;

    let workdir = tempfile::tempdir().expect("workdir");
    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");
    let out = ign_in(
        workdir.path(),
        &config,
        &server.uri(),
        &["project", "export", "MyProj", "--decode-scripts"],
    );
    assert!(
        out.status.success(),
        "stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"
[profile: dev]
Exported 4 members, 2 scripts decoded to MyProj-export
scope: includes views/scripts/named-queries/vision-windows/perspective-themes-styles/reporting/alarm-notification-profiles/webdev-routes/translations/sfc-charts · excludes tag-providers/tags/udts/gateway-config/database-connections/users-roles/alarm-journal/certificates
edit the <member>.<n>.py sidecars, then re-import with `--encode-scripts --file MyProj-export`
"#]],
    );
    // The tree landed in the CWD (the default <name>-export/ dir).
    let root = workdir.path().join("MyProj-export");
    assert!(root.join("c/resources/views/Dash/view.json.1.py").is_file());
    assert!(root.join("c/resources/views/Dash/view.json.2.py").is_file());
    assert!(
        root.join(ignition_core::client::scripts_codec::MANIFEST_NAME)
            .is_file()
    );
}

/// The decode-export COMPACT JSON golden: all keys, declaration
/// order, `-o DIR` honored.
#[tokio::test]
async fn project_export_decode_scripts_json_golden() {
    let server = wiremock::MockServer::start().await;
    wiremock::Mock::given(wiremock::matchers::method("GET"))
        .and(wiremock::matchers::path(
            "/data/api/v1/projects/export/MyProj",
        ))
        .respond_with(
            wiremock::ResponseTemplate::new(200)
                .set_body_raw(script_zip_fixture(), "application/zip"),
        )
        .expect(1)
        .mount(&server)
        .await;

    let workdir = tempfile::tempdir().expect("workdir");
    let out_dir = workdir.path().join("decoded");
    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");
    let out = ign_in(
        workdir.path(),
        &config,
        &server.uri(),
        &[
            "project",
            "export",
            "MyProj",
            "--decode-scripts",
            "-o",
            out_dir.to_str().unwrap(),
            "--compact",
        ],
    );
    assert!(
        out.status.success(),
        "stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"{"ok":true,"profile":"dev","data":{"project":"MyProj","dir":"[..]decoded","members":4,"scripts_decoded":2,"bytes":[..],"scope":{"includes":["views","scripts","named-queries","vision-windows","perspective-themes-styles","reporting","alarm-notification-profiles","webdev-routes","translations","sfc-charts"],"excludes":["tag-providers","tags","udts","gateway-config","database-connections","users-roles","alarm-journal","certificates"]}}}"#]],
    );
}

/// Import `--encode-scripts` success REUSES the standard import
/// golden shape (the re-zip rides the same path verbatim) — and the
/// UPLOADED body round-trips the fixture's members byte-exactly
/// (unedited sidecars; the manifest and sidecars stripped).
#[tokio::test]
async fn project_import_encode_scripts_success_golden() {
    let server = wiremock::MockServer::start().await;
    let import_guard = wiremock::Mock::given(wiremock::matchers::method("POST"))
        .and(wiremock::matchers::path(
            "/data/api/v1/projects/import/roundtrip",
        ))
        .and(wiremock::matchers::query_param("overwrite", "false"))
        .respond_with(wiremock::ResponseTemplate::new(200))
        .expect(1)
        .mount_as_scoped(&server)
        .await;
    wiremock::Mock::given(wiremock::matchers::method("GET"))
        .and(wiremock::matchers::path(
            "/data/api/v1/projects/find/roundtrip",
        ))
        .respond_with(
            wiremock::ResponseTemplate::new(404)
                .set_body_json(serde_json::json!({"message": "Project not found"})),
        )
        .expect(1)
        .mount(&server)
        .await;

    // Build the decoded tree with the PURE helper (what
    // `export --decode-scripts` writes).
    let tree = tempfile::tempdir().expect("tree dir");
    ignition_core::client::scripts_codec::decode_export_tree(&script_zip_fixture(), tree.path())
        .expect("decode fixture");

    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");
    let out = ign(
        &config,
        &server.uri(),
        &[
            "project",
            "import",
            "roundtrip",
            "--file",
            tree.path().to_str().unwrap(),
            "--encode-scripts",
            "--compact",
        ],
    );
    assert!(
        out.status.success(),
        "stderr: {}",
        String::from_utf8_lossy(&out.stderr)
    );
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stdout_for_golden(&out),
        snapbox::str![[r#"{"ok":true,"profile":"dev","data":{"name":"roundtrip","collision_policy":"abort","bytes":[..],"scope":{"includes":["views","scripts","named-queries","vision-windows","perspective-themes-styles","reporting","alarm-notification-profiles","webdev-routes","translations","sfc-charts"],"excludes":["tag-providers","tags","udts","gateway-config","database-connections","users-roles","alarm-journal","certificates"]},"outcome":{"status":"success"}}}"#]],
    );

    // THE member-level honesty: the uploaded body carries every
    // original member byte-exactly (unedited round-trip through the
    // BINARY), and the manifest/sidecars never ride. Read members by
    // their EXACT zip names (read_member's user-path mapping does
    // not apply to project.json — it is not a resource).
    let requests = import_guard.received_requests().await;
    assert_eq!(requests.len(), 1);
    let body = &requests[0].body;
    let mut archive =
        zip::ZipArchive::new(std::io::Cursor::new(body.as_slice())).expect("walkable zip");
    use std::io::Read as _;
    for name in [
        "project.json",
        "c/resources/views/Dash/view.json",
        "c/resources/views/Dash/resource.json",
        "ignition/resources/scratch",
    ] {
        let mut member = archive.by_name(name).expect("member present");
        let mut bytes = Vec::new();
        member.read_to_end(&mut bytes).expect("member reads");
        let original = script_zip_fixture();
        let mut original_archive =
            zip::ZipArchive::new(std::io::Cursor::new(original.as_slice())).expect("fixture zip");
        let mut original_member = original_archive.by_name(name).expect("fixture member");
        let mut original_bytes = Vec::new();
        original_member
            .read_to_end(&mut original_bytes)
            .expect("fixture reads");
        assert_eq!(bytes, original_bytes, "{name} byte-identical in the upload");
    }
    assert!(
        archive
            .by_name(ignition_core::client::scripts_codec::MANIFEST_NAME)
            .is_err(),
        "the manifest never rides an upload"
    );
}

/// `--encode-scripts --file -` refuses usage-class pre-resolution
/// (stdin cannot carry a directory) — dead URL, no mocks, zero HTTP.
#[tokio::test]
async fn project_import_encode_scripts_stdin_refuses() {
    let (_dir, config) = isolated_config();
    write_profile_config(&config, "http://ignored.example.com");
    let out = ign(
        &config,
        "http://127.0.0.1:1",
        &[
            "project",
            "import",
            "x",
            "--file",
            "-",
            "--encode-scripts",
            "--compact",
        ],
    );
    assert_eq!(out.status.code(), Some(2), "usage class, zero network");
    assert!(out.stdout.is_empty(), "errors never touch stdout");
    snapbox::Assert::new().action_env("SNAPSHOTS").eq(
        stderr_envelope(&out),
        snapbox::str![[r#"
{"ok":false,"profile":null,"error":{"code":"invalid_input","message":"invalid input: --encode-scripts needs the decoded export DIRECTORY via --file (stdin cannot carry one)","endpoint":null,"hint":"fix the input source — a readable file path via --file, or `-` to pipe the content on stdin"}}

"#]],
    );
}