#!/usr/bin/env node
import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
import { join } from "node:path";

const DEFAULT_REPORT_ROOT = "artifacts/qa-flow";
const DEFAULT_TEST_USERID = "HRWDTEST-20260517214548";
const HCLT_LIVE_VERIFIED_MARKER = "HRWDTEST-20260517214548";
const HCLT_LIVE_VERIFIED_REPORT = "artifacts/qa-flow/hrwd-contact-live-test-20260517T134548Z/summary.json";
const WECOM_API_BASE = "https://qyapi.weixin.qq.com";

const CAPABILITY_STATUSES = new Set([
  "CAN_REUSE_NOW",
  "NEEDS_CONFIG",
  "NEEDS_API_POC",
  "KEEP_OA_PRIMARY",
  "NOT_SUPPORTED_BY_API",
]);

const FINAL_CONCLUSIONS = new Set([
  "GO_TO_HR_MASTER_SYNC",
  "PAUSE_FOR_CONFIG",
  "PAUSE_FOR_API_POC",
  "NO_GO_REVISE_ROADMAP",
]);

const ENV_WHITELIST = new Set([
  "WECOM_CORP_ID",
  "WECOM_AGENT_ID",
  "WECOM_AGENT_SECRET",
  "WECOM_CHECKIN_SYNC_ENABLED",
  "WECOM_CHECKIN_SECRET",
  "WECOM_CONTACT_SYNC_ENABLED",
  "WECOM_CONTACT_SECRET",
  "WECOM_CONTACT_DEFAULT_DEPARTMENT_ID",
  "WECOM_OAUTH_ENABLED",
  "WECOM_REDIRECT_URI",
  "WECOM_ALLOWED_RETURN_HOSTS",
  "WECOM_HR_ASSISTANT_SECRET",
  "WECOM_APPROVAL_SECRET",
  "WECOM_APPROVAL_TEMPLATE_ID",
  "WECOM_APPROVAL_TEMPLATE_IDS",
  "WECOM_APPROVAL_INSTANCE_ID",
  "WECOM_APPROVAL_SP_NO",
  "WECOM_APPROVAL_CALLBACK_URL",
  "WECOM_CALLBACK_URL",
  "WECOM_CALLBACK_TOKEN",
  "WECOM_CALLBACK_AES_KEY",
  "WECOM_CAPABILITY_POC_LIVE_READ",
  "WECOM_CAPABILITY_POC_TEST_USERID",
  "WECOM_CAPABILITY_POC_DAYS",
  "WECOM_CAPABILITY_POC_JSON",
]);

const DOC_REFERENCES = Object.freeze({
  contactCreate: "https://developer.work.weixin.qq.com/document/path/90195",
  checkinOverview: "https://developer.work.weixin.qq.com/document/path/90261",
  checkinData: "https://developer.work.weixin.qq.com/document/path/90262",
  checkinRule: "https://developer.work.weixin.qq.com/document/path/90263",
  approvalOverview: "https://developer.work.weixin.qq.com/document/path/91854",
  approvalSubmit: "https://developer.work.weixin.qq.com/document/path/91853",
  approvalTemplate: "https://developer.work.weixin.qq.com/document/path/91982",
  approvalDetail: "https://developer.work.weixin.qq.com/document/path/91983",
  hrOverview: "https://developer.work.weixin.qq.com/document/path/99130",
  hrFields: "https://developer.work.weixin.qq.com/document/path/99131",
  hrStaffRead: "https://developer.work.weixin.qq.com/document/path/99132",
  hrStaffUpdate: "https://developer.work.weixin.qq.com/document/path/99133",
});

function parseArgs(argv) {
  const options = {
    envFile: "",
    json: process.env.WECOM_CAPABILITY_POC_JSON === "1",
    liveRead: process.env.WECOM_CAPABILITY_POC_LIVE_READ === "1",
    days: Number(process.env.WECOM_CAPABILITY_POC_DAYS || 1),
    testUserId: process.env.WECOM_CAPABILITY_POC_TEST_USERID || DEFAULT_TEST_USERID,
    issueId: process.env.QA_ISSUE_ID || "WCP1",
    reportDir: process.env.WECOM_CAPABILITY_POC_REPORT_DIR || "",
  };

  for (let index = 0; index < argv.length; index += 1) {
    const arg = argv[index];
    if (arg === "--json") {
      options.json = true;
    } else if (arg === "--live-read") {
      options.liveRead = true;
    } else if (arg === "--no-live-read") {
      options.liveRead = false;
    } else if (arg === "--env-file" || arg === "--poc-env-file") {
      options.envFile = argv[index + 1] || "";
      index += 1;
    } else if (arg.startsWith("--env-file=")) {
      options.envFile = arg.slice("--env-file=".length);
    } else if (arg.startsWith("--poc-env-file=")) {
      options.envFile = arg.slice("--poc-env-file=".length);
    } else if (arg === "--test-userid") {
      options.testUserId = argv[index + 1] || "";
      index += 1;
    } else if (arg.startsWith("--test-userid=")) {
      options.testUserId = arg.slice("--test-userid=".length);
    } else if (arg === "--days") {
      options.days = Number(argv[index + 1] || 1);
      index += 1;
    } else if (arg.startsWith("--days=")) {
      options.days = Number(arg.slice("--days=".length));
    } else if (arg.startsWith("--report-dir=")) {
      options.reportDir = arg.slice("--report-dir=".length);
    }
  }

  options.days = Number.isFinite(options.days) ? Math.max(1, Math.min(7, Math.floor(options.days))) : 1;
  options.testUserId = String(options.testUserId || "").trim();
  if (!options.reportDir) {
    const stamp = new Date().toISOString().replace(/[-:]/g, "").replace(/\.\d{3}Z$/, "Z");
    options.reportDir = join(DEFAULT_REPORT_ROOT, `wecom-capability-poc-${stamp}`);
  }
  return options;
}

function unquoteEnvValue(value) {
  const trimmed = String(value ?? "").trim();
  if (
    (trimmed.startsWith('"') && trimmed.endsWith('"'))
    || (trimmed.startsWith("'") && trimmed.endsWith("'"))
  ) {
    return trimmed.slice(1, -1);
  }
  return trimmed;
}

function loadEnvFile(filePath) {
  if (!filePath) return { loaded: false, path: null, keys: [] };
  if (!existsSync(filePath)) {
    throw new Error(`env file not found: ${filePath}`);
  }
  const loadedKeys = [];
  const text = readFileSync(filePath, "utf8");
  for (const rawLine of text.split(/\r?\n/)) {
    const line = rawLine.trim();
    if (!line || line.startsWith("#")) continue;
    const match = line.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
    if (!match) continue;
    const [, key, rawValue] = match;
    if (!ENV_WHITELIST.has(key)) continue;
    if (process.env[key] == null) {
      process.env[key] = unquoteEnvValue(rawValue);
      loadedKeys.push(key);
    }
  }
  return { loaded: true, path: filePath, keys: loadedKeys.sort() };
}

function envFlag(name) {
  return process.env[name] === "true" || process.env[name] === "1";
}

function envValue(name) {
  return String(process.env[name] || "").trim();
}

function maskId(value) {
  const raw = String(value ?? "").trim();
  if (!raw) return null;
  if (raw.length <= 6) return `${raw.slice(0, 2)}***`;
  return `${raw.slice(0, Math.min(8, raw.length))}***`;
}

function maskHostLike(value) {
  const raw = String(value ?? "").trim();
  if (!raw) return null;
  try {
    const url = new URL(raw);
    return `${url.protocol}//${url.host}${url.pathname ? "/..." : ""}`;
  } catch {
    return raw.length > 32 ? `${raw.slice(0, 16)}...` : raw;
  }
}

function safeMessage(value) {
  return String(value ?? "")
    .replace(/[A-Za-z0-9_-]{24,}/g, "***")
    .replace(/access_token=[^&\s]+/gi, "access_token=***")
    .slice(0, 160);
}

function sanitizeWecomPayload(payload) {
  if (!payload || typeof payload !== "object") return null;
  const result = {};
  for (const key of ["errcode", "errmsg", "invaliduser", "invalidparty", "invalidtag"]) {
    if (payload[key] != null) {
      result[key] = key === "errmsg" ? safeMessage(payload[key]) : payload[key];
    }
  }
  if (Array.isArray(payload.department)) result.departmentCount = payload.department.length;
  if (Array.isArray(payload.checkindata)) result.checkindataCount = payload.checkindata.length;
  if (Array.isArray(payload.fields)) result.fieldsCount = payload.fields.length;
  if (Array.isArray(payload.field_info)) result.fieldsCount = payload.field_info.length;
  if (Array.isArray(payload.info)) result.infoCount = payload.info.length;
  if (Array.isArray(payload.staff_info)) result.staffInfoCount = payload.staff_info.length;
  if (Array.isArray(payload.vacation_quota_list)) result.vacationQuotaCount = payload.vacation_quota_list.length;
  if (payload.userid != null) result.useridPrefix = maskId(payload.userid);
  if (payload.enable != null) result.enable = payload.enable;
  return Object.keys(result).length ? result : null;
}

function capability(input) {
  if (!CAPABILITY_STATUSES.has(input.status)) {
    throw new Error(`invalid capability status for ${input.id}: ${input.status}`);
  }
  return {
    id: input.id,
    domain: input.domain,
    status: input.status,
    reason: input.reason,
    evidence: input.evidence || {},
    readOnly: input.readOnly !== false,
    blockingForHrMasterSync: Boolean(input.blockingForHrMasterSync),
    docs: input.docs || [],
  };
}

function classifyApiError(apiResult, defaultStatus = "NEEDS_CONFIG") {
  if (apiResult.networkError) {
    return {
      status: "NEEDS_API_POC",
      reason: apiResult.timeout ? "api_timeout_or_network_unstable" : "api_network_error",
    };
  }
  const errcode = Number(apiResult.payload?.errcode);
  if ([48002, 48003, 48004, 60011, 60020, 301002, 40001, 40014, 40029, 60111, 60121, 60203].includes(errcode)) {
    return { status: "NEEDS_CONFIG", reason: `wecom_errcode_${errcode}` };
  }
  if (apiResult.httpStatus >= 500 || apiResult.httpStatus === 429) {
    return { status: "NEEDS_API_POC", reason: `wecom_http_${apiResult.httpStatus}` };
  }
  if (Number.isFinite(errcode)) {
    return { status: defaultStatus, reason: `wecom_errcode_${errcode}` };
  }
  return { status: "NEEDS_API_POC", reason: "missing_or_unexpected_wecom_response" };
}

function isWecomApiOk(result) {
  return Boolean(result?.ok && result.payload && Number(result.payload.errcode ?? 0) === 0);
}

function isWecomErrcode(result, errcode) {
  return Number(result?.payload?.errcode) === errcode;
}

async function fetchJson(url, init = {}) {
  try {
    const response = await fetch(url, {
      ...init,
      signal: AbortSignal.timeout(18_000),
    });
    const text = await response.text();
    let payload = null;
    try {
      payload = text ? JSON.parse(text) : null;
    } catch {
      payload = null;
    }
    return { ok: response.ok, httpStatus: response.status, payload };
  } catch (error) {
    return {
      ok: false,
      httpStatus: null,
      payload: null,
      networkError: true,
      timeout: error?.name === "AbortError",
      errorMessage: safeMessage(error?.message || error),
    };
  }
}

async function getWecomToken({ corpId, secret, label }) {
  if (!corpId || !secret) {
    return {
      ok: false,
      code: "missing_config",
      reason: `missing_${label}_token_config`,
      response: null,
      token: null,
    };
  }
  const url = new URL(`${WECOM_API_BASE}/cgi-bin/gettoken`);
  url.searchParams.set("corpid", corpId);
  url.searchParams.set("corpsecret", secret);
  const result = await fetchJson(url);
  const errcode = Number(result.payload?.errcode ?? 0);
  if (!result.ok || !result.payload || errcode !== 0 || typeof result.payload.access_token !== "string") {
    const classified = classifyApiError(result);
    return {
      ok: false,
      code: "token_failed",
      reason: classified.reason,
      response: sanitizeWecomPayload(result.payload),
      token: null,
    };
  }
  return {
    ok: true,
    code: "token_fetched",
    reason: null,
    response: { errcode: 0, expiresIn: Number(result.payload.expires_in ?? 0) || null },
    token: result.payload.access_token,
  };
}

async function wecomGet(pathName, token, query = {}) {
  const url = new URL(`${WECOM_API_BASE}${pathName}`);
  url.searchParams.set("access_token", token);
  for (const [key, value] of Object.entries(query)) {
    if (value != null && value !== "") url.searchParams.set(key, String(value));
  }
  return fetchJson(url);
}

async function wecomPost(pathName, token, body = {}) {
  const url = new URL(`${WECOM_API_BASE}${pathName}`);
  url.searchParams.set("access_token", token);
  return fetchJson(url, {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify(body),
  });
}

function toUnixSeconds(date) {
  return Math.floor(date.getTime() / 1000);
}

function shanghaiDateAt(dateString, endOfDay = false) {
  return new Date(`${dateString}T${endOfDay ? "23:59:59" : "00:00:00"}+08:00`);
}

function shanghaiDateString(date) {
  return new Intl.DateTimeFormat("en-CA", {
    timeZone: "Asia/Shanghai",
    year: "numeric",
    month: "2-digit",
    day: "2-digit",
  }).format(date);
}

function resolveWindow(days) {
  const end = new Date();
  const start = new Date(end.getTime() - (days - 1) * 24 * 60 * 60 * 1000);
  return {
    startDate: shanghaiDateString(start),
    endDate: shanghaiDateString(end),
  };
}

function firstCsvValue(value) {
  return String(value || "")
    .split(",")
    .map((item) => item.trim())
    .find(Boolean) || "";
}

function addTokenCapability(capabilities, { id, domain, tokenResult, secretPresent, docs, blockingForHrMasterSync = false }) {
  if (tokenResult.ok) {
    capabilities.push(capability({
      id,
      domain,
      status: "CAN_REUSE_NOW",
      reason: "access_token_fetch_ok",
      evidence: tokenResult.response,
      docs,
      blockingForHrMasterSync,
    }));
    return;
  }
  capabilities.push(capability({
    id,
    domain,
    status: secretPresent ? "NEEDS_CONFIG" : "NEEDS_CONFIG",
    reason: tokenResult.reason,
    evidence: tokenResult.response || { missingSecret: !secretPresent },
    docs,
    blockingForHrMasterSync,
  }));
}

function addApiCapability(capabilities, input) {
  const errcode = Number(input.result.payload?.errcode ?? 0);
  if (input.result.ok && input.result.payload && errcode === 0) {
    capabilities.push(capability({
      id: input.id,
      domain: input.domain,
      status: "CAN_REUSE_NOW",
      reason: input.successReason,
      evidence: {
        endpoint: input.endpoint,
        ...input.successEvidence,
        response: sanitizeWecomPayload(input.result.payload),
      },
      docs: input.docs,
      blockingForHrMasterSync: input.blockingForHrMasterSync,
    }));
    return;
  }
  const classified = classifyApiError(input.result, input.defaultStatus);
  capabilities.push(capability({
    id: input.id,
    domain: input.domain,
    status: classified.status,
    reason: classified.reason,
    evidence: {
      endpoint: input.endpoint,
      response: sanitizeWecomPayload(input.result.payload),
      httpStatus: input.result.httpStatus,
      networkError: Boolean(input.result.networkError),
    },
    docs: input.docs,
    blockingForHrMasterSync: input.blockingForHrMasterSync,
  }));
}

function addLiveReadDisabled(capabilities, id, domain, docs = [], blockingForHrMasterSync = false) {
  capabilities.push(capability({
    id,
    domain,
    status: "NEEDS_API_POC",
    reason: "live_read_disabled",
    evidence: { runWith: "WECOM_CAPABILITY_POC_LIVE_READ=1" },
    docs,
    blockingForHrMasterSync,
  }));
}

function addMissingConfig(capabilities, input) {
  capabilities.push(capability({
    id: input.id,
    domain: input.domain,
    status: "NEEDS_CONFIG",
    reason: input.reason,
    evidence: input.evidence || {},
    docs: input.docs || [],
    blockingForHrMasterSync: Boolean(input.blockingForHrMasterSync),
  }));
}

async function probeContact(capabilities, options, config) {
  const docs = [DOC_REFERENCES.contactCreate];
  const hcltPath = HCLT_LIVE_VERIFIED_REPORT;
  if (existsSync(hcltPath)) {
    const hclt = JSON.parse(readFileSync(hcltPath, "utf8"));
    capabilities.push(capability({
      id: "contact.hclt_create_update_disable",
      domain: "contact",
      status: hclt.status === "PASS" ? "CAN_REUSE_NOW" : "NEEDS_API_POC",
      reason: hclt.status === "PASS" ? "hclt_live_verified" : "hclt_evidence_not_pass",
      evidence: {
        marker: hclt.marker,
        status: hclt.status,
        report: hcltPath,
        finalPolicy: hclt.finalPolicy,
      },
      docs,
      blockingForHrMasterSync: true,
    }));
  } else {
    capabilities.push(capability({
      id: "contact.hclt_create_update_disable",
      domain: "contact",
      status: "CAN_REUSE_NOW",
      reason: "documented_hclt_live_verified",
      evidence: {
        marker: HCLT_LIVE_VERIFIED_MARKER,
        expectedReport: hcltPath,
        artifactUnavailableInRuntime: true,
        note: "HCLT evidence is a project fact; local repo keeps the full artifact.",
      },
      docs,
      blockingForHrMasterSync: true,
    }));
  }

  if (!options.liveRead) {
    addLiveReadDisabled(capabilities, "contact.department_read", "contact", docs, true);
    addLiveReadDisabled(capabilities, "contact.member_read", "contact", docs, true);
    return;
  }

  const tokenResult = await getWecomToken({
    corpId: config.corpId,
    secret: config.contactSecret,
    label: "contact",
  });
  addTokenCapability(capabilities, {
    id: "contact.token",
    domain: "contact",
    tokenResult,
    secretPresent: Boolean(config.contactSecret),
    docs,
    blockingForHrMasterSync: true,
  });
  if (!tokenResult.ok) {
    addMissingConfig(capabilities, {
      id: "contact.department_read",
      domain: "contact",
      reason: "contact_token_unavailable",
      evidence: { missingSecret: !config.contactSecret },
      docs,
      blockingForHrMasterSync: true,
    });
    addMissingConfig(capabilities, {
      id: "contact.member_read",
      domain: "contact",
      reason: "contact_token_unavailable",
      evidence: { missingTestUserId: !options.testUserId },
      docs,
      blockingForHrMasterSync: true,
    });
    return;
  }

  let agentFallbackToken = null;
  async function getAgentFallbackToken() {
    if (agentFallbackToken) return agentFallbackToken;
    if (!config.agentSecret) return null;
    const fallback = await getWecomToken({
      corpId: config.corpId,
      secret: config.agentSecret,
      label: "contact_agent_fallback",
    });
    agentFallbackToken = fallback.ok ? fallback.token : null;
    return agentFallbackToken;
  }

  let department = await wecomGet("/cgi-bin/department/list", tokenResult.token);
  let departmentEvidence = {};
  if (!isWecomApiOk(department) && isWecomErrcode(department, 48009)) {
    const fallbackToken = await getAgentFallbackToken();
    if (fallbackToken) {
      const fallbackDepartment = await wecomGet("/cgi-bin/department/list", fallbackToken);
      if (isWecomApiOk(fallbackDepartment)) {
        department = fallbackDepartment;
        departmentEvidence = { tokenSource: "WECOM_AGENT_SECRET_FALLBACK" };
      }
    }
  }
  addApiCapability(capabilities, {
    id: "contact.department_read",
    domain: "contact",
    result: department,
    endpoint: "/cgi-bin/department/list",
    successReason: "department_list_read_ok",
    successEvidence: departmentEvidence,
    docs,
    blockingForHrMasterSync: true,
  });

  if (!options.testUserId) {
    addMissingConfig(capabilities, {
      id: "contact.member_read",
      domain: "contact",
      reason: "missing_test_userid",
      docs,
      blockingForHrMasterSync: true,
    });
    return;
  }
  let member = await wecomGet("/cgi-bin/user/get", tokenResult.token, { userid: options.testUserId });
  let memberEvidence = { testUserIdPrefix: maskId(options.testUserId) };
  if (!isWecomApiOk(member) && isWecomErrcode(member, 48009)) {
    const fallbackToken = await getAgentFallbackToken();
    if (fallbackToken) {
      const fallbackMember = await wecomGet("/cgi-bin/user/get", fallbackToken, { userid: options.testUserId });
      if (isWecomApiOk(fallbackMember)) {
        member = fallbackMember;
        memberEvidence = { ...memberEvidence, tokenSource: "WECOM_AGENT_SECRET_FALLBACK" };
      }
    }
  }
  addApiCapability(capabilities, {
    id: "contact.member_read",
    domain: "contact",
    result: member,
    endpoint: "/cgi-bin/user/get",
    successReason: "test_member_read_ok",
    successEvidence: memberEvidence,
    docs,
    blockingForHrMasterSync: true,
  });
}

async function probeHrAssistant(capabilities, options, config) {
  const docs = [DOC_REFERENCES.hrOverview, DOC_REFERENCES.hrFields, DOC_REFERENCES.hrStaffRead, DOC_REFERENCES.hrStaffUpdate];
  if (!options.liveRead) {
    addLiveReadDisabled(capabilities, "hr.fields_read", "hr_assistant", docs, true);
    addLiveReadDisabled(capabilities, "hr.staff_read", "hr_assistant", docs, true);
    capabilities.push(capability({
      id: "hr.staff_update_classification",
      domain: "hr_assistant",
      status: "NEEDS_API_POC",
      reason: "write_api_requires_separate_approval",
      evidence: { endpoint: "/cgi-bin/hr/update_staff_info", readOnlyPoc: true },
      docs,
    }));
    return;
  }

  const hrSecret = config.hrAssistantSecret || config.agentSecret;
  const tokenResult = await getWecomToken({
    corpId: config.corpId,
    secret: hrSecret,
    label: "hr_assistant",
  });
  addTokenCapability(capabilities, {
    id: "hr.token",
    domain: "hr_assistant",
    tokenResult,
    secretPresent: Boolean(hrSecret),
    docs,
    blockingForHrMasterSync: true,
  });
  if (!tokenResult.ok) {
    addMissingConfig(capabilities, {
      id: "hr.fields_read",
      domain: "hr_assistant",
      reason: "hr_token_unavailable",
      evidence: { missingSecret: !hrSecret },
      docs,
      blockingForHrMasterSync: true,
    });
    addMissingConfig(capabilities, {
      id: "hr.staff_read",
      domain: "hr_assistant",
      reason: "hr_token_unavailable",
      evidence: { missingTestUserId: !options.testUserId },
      docs,
      blockingForHrMasterSync: true,
    });
  } else {
    const fields = await wecomGet("/cgi-bin/hr/get_fields", tokenResult.token);
    addApiCapability(capabilities, {
      id: "hr.fields_read",
      domain: "hr_assistant",
      result: fields,
      endpoint: "/cgi-bin/hr/get_fields",
      successReason: "hr_fields_read_ok",
      successEvidence: { tokenSource: config.hrAssistantSecret ? "WECOM_HR_ASSISTANT_SECRET" : "WECOM_AGENT_SECRET" },
      docs,
      blockingForHrMasterSync: true,
    });

    if (!options.testUserId) {
      addMissingConfig(capabilities, {
        id: "hr.staff_read",
        domain: "hr_assistant",
        reason: "missing_test_userid",
        docs,
        blockingForHrMasterSync: true,
      });
    } else {
      const staff = await wecomPost("/cgi-bin/hr/get_staff_info", tokenResult.token, {
        userid: options.testUserId,
        get_all: true,
      });
      addApiCapability(capabilities, {
        id: "hr.staff_read",
        domain: "hr_assistant",
        result: staff,
        endpoint: "/cgi-bin/hr/get_staff_info",
        successReason: "hr_staff_read_ok",
        successEvidence: { testUserIdPrefix: maskId(options.testUserId) },
        docs,
        blockingForHrMasterSync: true,
      });
    }
  }

  capabilities.push(capability({
    id: "hr.staff_update_classification",
    domain: "hr_assistant",
    status: "NEEDS_API_POC",
    reason: "write_api_requires_separate_approval",
    evidence: { endpoint: "/cgi-bin/hr/update_staff_info", readOnlyPoc: true },
    docs,
  }));
}

async function probeCheckin(capabilities, options, config) {
  const docs = [DOC_REFERENCES.checkinOverview, DOC_REFERENCES.checkinData, DOC_REFERENCES.checkinRule];
  if (!options.liveRead) {
    addLiveReadDisabled(capabilities, "checkin.records_read", "checkin", docs);
    addLiveReadDisabled(capabilities, "checkin.rules_read", "checkin", docs);
    return;
  }

  if (!config.checkinSyncEnabled) {
    addMissingConfig(capabilities, {
      id: "checkin.records_read",
      domain: "checkin",
      reason: "wecom_checkin_sync_disabled",
      evidence: { env: "WECOM_CHECKIN_SYNC_ENABLED" },
      docs,
    });
    addMissingConfig(capabilities, {
      id: "checkin.rules_read",
      domain: "checkin",
      reason: "wecom_checkin_sync_disabled",
      evidence: { env: "WECOM_CHECKIN_SYNC_ENABLED" },
      docs,
    });
    return;
  }

  const checkinSecret = config.checkinSecret || config.agentSecret;
  const tokenResult = await getWecomToken({
    corpId: config.corpId,
    secret: checkinSecret,
    label: "checkin",
  });
  addTokenCapability(capabilities, {
    id: "checkin.token",
    domain: "checkin",
    tokenResult,
    secretPresent: Boolean(checkinSecret),
    docs,
  });
  if (!tokenResult.ok || !options.testUserId) {
    addMissingConfig(capabilities, {
      id: "checkin.records_read",
      domain: "checkin",
      reason: !tokenResult.ok ? "checkin_token_unavailable" : "missing_test_userid",
      evidence: { missingSecret: !checkinSecret, missingTestUserId: !options.testUserId },
      docs,
    });
    addMissingConfig(capabilities, {
      id: "checkin.rules_read",
      domain: "checkin",
      reason: !tokenResult.ok ? "checkin_token_unavailable" : "missing_test_userid",
      evidence: { missingSecret: !checkinSecret, missingTestUserId: !options.testUserId },
      docs,
    });
    return;
  }

  const window = resolveWindow(options.days);
  const records = await wecomPost("/cgi-bin/checkin/getcheckindata", tokenResult.token, {
    opencheckindatatype: 3,
    starttime: toUnixSeconds(shanghaiDateAt(window.startDate, false)),
    endtime: toUnixSeconds(shanghaiDateAt(window.endDate, true)),
    useridlist: [options.testUserId],
  });
  addApiCapability(capabilities, {
    id: "checkin.records_read",
    domain: "checkin",
    result: records,
    endpoint: "/cgi-bin/checkin/getcheckindata",
    successReason: "checkin_short_window_read_ok",
    successEvidence: {
      window,
      testUserIdPrefix: maskId(options.testUserId),
      emptyDataAllowed: true,
    },
    docs,
  });

  const rules = await wecomPost("/cgi-bin/checkin/getcheckinoption", tokenResult.token, {
    datetime: toUnixSeconds(shanghaiDateAt(window.endDate, false)),
    useridlist: [options.testUserId],
  });
  addApiCapability(capabilities, {
    id: "checkin.rules_read",
    domain: "checkin",
    result: rules,
    endpoint: "/cgi-bin/checkin/getcheckinoption",
    successReason: "checkin_rule_read_ok",
    successEvidence: {
      window,
      testUserIdPrefix: maskId(options.testUserId),
    },
    docs,
  });
}

async function probeApprovalAndVacation(capabilities, options, config) {
  const docs = [
    DOC_REFERENCES.approvalOverview,
    DOC_REFERENCES.approvalSubmit,
    DOC_REFERENCES.approvalTemplate,
    DOC_REFERENCES.approvalDetail,
  ];
  const approvalSecret = config.approvalSecret || config.agentSecret;

  if (!options.liveRead) {
    addLiveReadDisabled(capabilities, "approval.template_detail", "approval", docs);
    addLiveReadDisabled(capabilities, "approval.instance_detail", "approval", docs);
    addLiveReadDisabled(capabilities, "approval.vacation_quota", "approval", docs);
  } else {
    const tokenResult = await getWecomToken({
      corpId: config.corpId,
      secret: approvalSecret,
      label: "approval",
    });
    addTokenCapability(capabilities, {
      id: "approval.token",
      domain: "approval",
      tokenResult,
      secretPresent: Boolean(approvalSecret),
      docs,
    });

    if (!tokenResult.ok) {
      for (const id of ["approval.template_detail", "approval.instance_detail", "approval.vacation_quota"]) {
        addMissingConfig(capabilities, {
          id,
          domain: "approval",
          reason: "approval_token_unavailable",
          evidence: { missingSecret: !approvalSecret },
          docs,
        });
      }
    } else {
      const templateId = config.approvalTemplateId;
      if (!templateId) {
        addMissingConfig(capabilities, {
          id: "approval.template_detail",
          domain: "approval",
          reason: "missing_approval_template_id",
          evidence: { env: "WECOM_APPROVAL_TEMPLATE_ID" },
          docs,
        });
      } else {
        const template = await wecomPost("/cgi-bin/oa/gettemplatedetail", tokenResult.token, {
          template_id: templateId,
        });
        addApiCapability(capabilities, {
          id: "approval.template_detail",
          domain: "approval",
          result: template,
          endpoint: "/cgi-bin/oa/gettemplatedetail",
          successReason: "approval_template_read_ok",
          successEvidence: { templateIdPrefix: maskId(templateId) },
          docs,
        });
      }

      const spNo = config.approvalInstanceId;
      if (!spNo) {
        addMissingConfig(capabilities, {
          id: "approval.instance_detail",
          domain: "approval",
          reason: "missing_approval_instance_id",
          evidence: { env: "WECOM_APPROVAL_INSTANCE_ID or WECOM_APPROVAL_SP_NO" },
          docs,
        });
      } else {
        const detail = await wecomPost("/cgi-bin/oa/getapprovaldetail", tokenResult.token, { sp_no: spNo });
        addApiCapability(capabilities, {
          id: "approval.instance_detail",
          domain: "approval",
          result: detail,
          endpoint: "/cgi-bin/oa/getapprovaldetail",
          successReason: "approval_instance_read_ok",
          successEvidence: { spNoPrefix: maskId(spNo) },
          docs,
        });
      }

      if (!options.testUserId) {
        addMissingConfig(capabilities, {
          id: "approval.vacation_quota",
          domain: "approval",
          reason: "missing_test_userid",
          docs,
        });
      } else {
        const vacation = await wecomPost("/cgi-bin/oa/vacation/getuservacationquota", tokenResult.token, {
          userid: options.testUserId,
        });
        addApiCapability(capabilities, {
          id: "approval.vacation_quota",
          domain: "approval",
          result: vacation,
          endpoint: "/cgi-bin/oa/vacation/getuservacationquota",
          successReason: "vacation_quota_read_ok",
          successEvidence: { testUserIdPrefix: maskId(options.testUserId) },
          docs,
        });
      }
    }
  }

  const callbackReady = Boolean(config.callbackUrl && config.callbackToken && config.callbackAesKey);
  capabilities.push(capability({
    id: "callback.config",
    domain: "callback",
    status: callbackReady ? "CAN_REUSE_NOW" : "NEEDS_CONFIG",
    reason: callbackReady ? "callback_config_present" : "callback_config_missing_or_manual_only",
    evidence: {
      callbackUrl: maskHostLike(config.callbackUrl),
      hasCallbackToken: Boolean(config.callbackToken),
      hasCallbackAesKey: Boolean(config.callbackAesKey),
      note: "callback endpoint reachability must be verified in later mirror contract",
    },
    docs,
  }));

  capabilities.push(capability({
    id: "approval.oa_primary_sensitive_domains",
    domain: "approval",
    status: "KEEP_OA_PRIMARY",
    reason: "procurement_contract_reimbursement_finance_remain_oa_primary",
    evidence: {
      sensitiveDomains: ["reimbursement", "procurement", "contract", "project", "payment_batch", "ap", "accounting_handoff"],
      wecomUsage: "dehydrated_message_and_oa_deeplink_only",
    },
    docs,
  }));
}

async function probeWorkbenchAndPermissions(capabilities, options, config) {
  const docs = [DOC_REFERENCES.approvalOverview, DOC_REFERENCES.contactCreate];
  if (!options.liveRead) {
    addLiveReadDisabled(capabilities, "workbench.app_token", "workbench", docs);
  } else {
    const tokenResult = await getWecomToken({
      corpId: config.corpId,
      secret: config.agentSecret,
      label: "workbench",
    });
    addTokenCapability(capabilities, {
      id: "workbench.app_token",
      domain: "workbench",
      tokenResult,
      secretPresent: Boolean(config.agentSecret),
      docs,
    });
  }

  capabilities.push(capability({
    id: "permissions.config_presence",
    domain: "permissions",
    status: config.corpId && (config.agentSecret || config.contactSecret) ? "CAN_REUSE_NOW" : "NEEDS_CONFIG",
    reason: config.corpId && (config.agentSecret || config.contactSecret)
      ? "core_wecom_config_present"
      : "core_wecom_config_missing",
    evidence: {
      hasCorpId: Boolean(config.corpId),
      hasAgentId: Boolean(config.agentId),
      hasAgentSecret: Boolean(config.agentSecret),
      hasContactSecret: Boolean(config.contactSecret),
      hasCheckinSecretOrAgentFallback: Boolean(config.checkinSecret || config.agentSecret),
      oauthEnabled: config.oauthEnabled,
      redirectUri: maskHostLike(config.redirectUri),
    },
    docs,
  }));
}

function deriveConclusion(capabilities) {
  const notSupported = capabilities.filter((item) => item.blockingForHrMasterSync && item.status === "NOT_SUPPORTED_BY_API");
  if (notSupported.length) {
    return "NO_GO_REVISE_ROADMAP";
  }
  const critical = capabilities.filter((item) => item.blockingForHrMasterSync);
  if (critical.some((item) => item.status === "NEEDS_CONFIG")) {
    return "PAUSE_FOR_CONFIG";
  }
  if (critical.some((item) => item.status === "NEEDS_API_POC")) {
    return "PAUSE_FOR_API_POC";
  }
  return "GO_TO_HR_MASTER_SYNC";
}

function statusCounts(capabilities) {
  const counts = {};
  for (const status of CAPABILITY_STATUSES) counts[status] = 0;
  for (const item of capabilities) counts[item.status] = (counts[item.status] || 0) + 1;
  return counts;
}

function buildConfig() {
  return {
    corpId: envValue("WECOM_CORP_ID"),
    agentId: envValue("WECOM_AGENT_ID"),
    agentSecret: envValue("WECOM_AGENT_SECRET"),
    contactSyncEnabled: envFlag("WECOM_CONTACT_SYNC_ENABLED"),
    contactSecret: envValue("WECOM_CONTACT_SECRET"),
    contactDefaultDepartmentId: envValue("WECOM_CONTACT_DEFAULT_DEPARTMENT_ID"),
    checkinSyncEnabled: envFlag("WECOM_CHECKIN_SYNC_ENABLED"),
    checkinSecret: envValue("WECOM_CHECKIN_SECRET"),
    oauthEnabled: envFlag("WECOM_OAUTH_ENABLED"),
    redirectUri: envValue("WECOM_REDIRECT_URI"),
    allowedReturnHosts: envValue("WECOM_ALLOWED_RETURN_HOSTS"),
    hrAssistantSecret: envValue("WECOM_HR_ASSISTANT_SECRET"),
    approvalSecret: envValue("WECOM_APPROVAL_SECRET"),
    approvalTemplateId: envValue("WECOM_APPROVAL_TEMPLATE_ID") || firstCsvValue(envValue("WECOM_APPROVAL_TEMPLATE_IDS")),
    approvalInstanceId: envValue("WECOM_APPROVAL_INSTANCE_ID") || envValue("WECOM_APPROVAL_SP_NO"),
    callbackUrl: envValue("WECOM_APPROVAL_CALLBACK_URL") || envValue("WECOM_CALLBACK_URL"),
    callbackToken: envValue("WECOM_CALLBACK_TOKEN"),
    callbackAesKey: envValue("WECOM_CALLBACK_AES_KEY"),
  };
}

async function buildReport(options, envLoadResult) {
  const config = buildConfig();
  const capabilities = [];

  capabilities.push(capability({
    id: "poc.scope",
    domain: "poc",
    status: "CAN_REUSE_NOW",
    reason: "qa_only_read_only_scope",
    evidence: {
      liveRead: options.liveRead,
      days: options.days,
      testUserIdPrefix: maskId(options.testUserId),
      noProductionWrites: true,
    },
    docs: Object.values(DOC_REFERENCES),
  }));

  await probeWorkbenchAndPermissions(capabilities, options, config);
  await probeContact(capabilities, options, config);
  await probeHrAssistant(capabilities, options, config);
  await probeCheckin(capabilities, options, config);
  await probeApprovalAndVacation(capabilities, options, config);

  const conclusion = deriveConclusion(capabilities);
  if (!FINAL_CONCLUSIONS.has(conclusion)) {
    throw new Error(`invalid conclusion: ${conclusion}`);
  }

  const blockingCapabilities = capabilities
    .filter((item) => item.blockingForHrMasterSync && item.status !== "CAN_REUSE_NOW")
    .map((item) => ({ id: item.id, status: item.status, reason: item.reason }));

  return {
    checkedAt: new Date().toISOString(),
    issueId: options.issueId,
    status: "PASS",
    conclusion,
    liveRead: options.liveRead,
    readOnly: true,
    noProductionWrites: true,
    days: options.days,
    testUserIdPrefix: maskId(options.testUserId),
    envFile: envLoadResult.loaded
      ? {
          loaded: true,
          keyCount: envLoadResult.keys.length,
          // 不输出 env 文件路径，避免暴露部署目录结构以外的信息。
        }
      : { loaded: false },
    statusCounts: statusCounts(capabilities),
    blockingCapabilities,
    nextStageAllowed: conclusion === "GO_TO_HR_MASTER_SYNC",
    nonBlockingNote: "Approval, checkin, callback, recovery writeback and RuleOps still require their own later contracts even when HR master sync can proceed.",
    docReferences: DOC_REFERENCES,
    capabilities,
  };
}

function printHuman(summary) {
  console.log(`[wecom-capability-poc] status=${summary.status} conclusion=${summary.conclusion} liveRead=${summary.liveRead}`);
  console.log(`[wecom-capability-poc] reportDir=${summary.reportDir}`);
  for (const item of summary.capabilities) {
    console.log(`[wecom-capability-poc] ${item.id} status=${item.status} reason=${item.reason}`);
  }
}

async function main() {
  const options = parseArgs(process.argv.slice(2));
  const envLoadResult = loadEnvFile(options.envFile);
  mkdirSync(options.reportDir, { recursive: true });

  const summary = await buildReport(options, envLoadResult);
  summary.reportDir = options.reportDir;
  const summaryPath = join(options.reportDir, "summary.json");
  writeFileSync(summaryPath, `${JSON.stringify(summary, null, 2)}\n`);
  writeFileSync(join(options.reportDir, "capability-matrix.json"), `${JSON.stringify(summary.capabilities, null, 2)}\n`);

  if (options.json) {
    console.log(JSON.stringify({
      status: summary.status,
      conclusion: summary.conclusion,
      reportDir: options.reportDir,
      statusCounts: summary.statusCounts,
      blockingCapabilities: summary.blockingCapabilities,
      nextStageAllowed: summary.nextStageAllowed,
    }, null, 2));
  } else {
    printHuman(summary);
  }
}

main().catch((error) => {
  console.error(`[wecom-capability-poc][ERROR] ${safeMessage(error instanceof Error ? error.message : String(error))}`);
  process.exit(1);
});