// Row 125 (#1619, REQ-LIMIT-3): token limits in the organization file. The schema, the writer's
// `since` stamp, and the reset, which moves `since` to now and is logged with its actor.
import test,{after} from 'node:test';
import assert from 'node:assert/strict';
import {readFileSync,rmSync} from 'node:fs';
import {join} from 'node:path';
import {businessDoc,rolesCopy,tmp as makeRoot,writeJson} from './helpers.mjs';
import {validateBusinessDocument} from '../src/organization-config.mjs';
import {launchSettings} from '../src/launch-settings.mjs';

const roots=[];after(()=>roots.forEach(root=>rmSync(root,{recursive:true,force:true})));
const T0='2026-10-18T07:00:00.000Z',T1='2026-10-18T08:00:00.000Z',T2='2026-10-18T09:00:00.000Z';
// keyLineage, when given, is the writer's lineage lookup (row 333 R4); without it the writer's default refuses.
function fixture(keyLineage){
 const root=makeRoot();roots.push(root);const rolesDir=rolesCopy(root),doc=businessDoc(root,'acme');
 for(const r of Object.values(doc.roles))r.vars={...r.vars,model:'sonnet'};
 doc.launch={by:'chief',instances:['coder','reviewer'],models:{sonnet:{provider:'anthropic',model:'claude-sonnet-5-5'}},limits:{}};
 const file=join(root,'businesses/acme.json');writeJson(file,doc);
 const system={environment:'development',dataRoot:join(root,'data'),'execution.backend':'docker','execution.provider':'anthropic','execution.model':'sonnet','execution.adapter':'pi'};
 let clock=T0;const settings=launchSettings({dir:root,rolesDir,system,now:()=>clock,...(keyLineage?{keyLineage}:{})});
 return {root,rolesDir,doc,file,settings,tick:at=>{clock=at;}};
}
const stored=f=>JSON.parse(readFileSync(f.file,'utf8')).launch.limits.tokens;
const lastLog=f=>JSON.parse(readFileSync(f.settings.writer.logFile('acme'),'utf8').trim().split('\n').at(-1));

test('REQ-LIMIT-3 schema: each subject kind, limit 0 and no ceiling are accepted; bad limits, times, keys and undeclared instances refuse',()=>{
 const f=fixture(),check=tokens=>{const d=structuredClone(f.doc);d.launch.limits={tokens};return validateBusinessDocument(d,f.file,{rolesDir:f.rolesDir}).launch.limits.tokens;};
 const leaf={limit:0,since:T0},big={limit:Number.MAX_SAFE_INTEGER,since:T0};
 const all={instances:{coder:leaf},providers:{anthropic:big},models:{anthropic:{'claude-sonnet-5-5':leaf}},keys:{k1:leaf}};
 assert.deepEqual(check(all),all);
 assert.deepEqual(check({}),{});
 for(const bad of [
  {instances:{coder:{limit:-1,since:T0}}},{instances:{coder:{limit:1.5,since:T0}}},{instances:{coder:{limit:'5',since:T0}}},
  {instances:{coder:{limit:5}}},{instances:{coder:{limit:5,since:'2026-10-18'}}},{instances:{coder:{limit:5,since:'2026-10-18T07:00:00Z'}}},
  {instances:{coder:{limit:5,since:'2026-02-30T07:00:00.000Z'}}},{instances:{coder:{limit:5,since:T0,extra:1}}},
  {accounts:{}},{models:{anthropic:{limit:5,since:T0}}},{instances:[]},{instances:{ghost:{limit:5,since:T0}}},
 ])assert.throws(()=>check(bad),JSON.stringify(bad));
});

test('REQ-LIMIT-3 the writer stamps since: a new limit gets now, a changed one keeps its time, a different time is refused',()=>{
 const f=fixture();
 let view=f.settings.read('acme');
 view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{instances:{coder:{limit:100}}}}},'jason');
 assert.deepEqual(stored(f),{instances:{coder:{limit:100,since:T0}}});
 // A changed limit keeps its since, and a new one beside it gets the new now.
 f.tick(T1);
 view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{instances:{coder:{limit:50}},providers:{anthropic:{limit:9}}}}},'jason');
 assert.deepEqual(stored(f),{instances:{coder:{limit:50,since:T0}},providers:{anthropic:{limit:9,since:T1}}});
 // A since equal to the stored one is accepted; any other is refused and changes nothing.
 view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{instances:{coder:{limit:50,since:T0}},providers:{anthropic:{limit:9}}}}},'jason');
 const bytes=readFileSync(f.file,'utf8');
 assert.throws(()=>f.settings.set('acme',{revision:view.revision,limits:{tokens:{instances:{coder:{limit:50,since:T2}}}}},'jason'),{code:'invalid-request'});
 assert.throws(()=>f.settings.set('acme',{revision:view.revision,limits:{tokens:{keys:{k1:{limit:1,since:T2}}}}},'jason'),{code:'invalid-request'});
 assert.equal(readFileSync(f.file,'utf8'),bytes);
 // A limit removed and set again starts from now.
 f.tick(T2);
 view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{providers:{anthropic:{limit:9}}}}},'jason');
 view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{instances:{coder:{limit:50}},providers:{anthropic:{limit:9}}}}},'jason');
 assert.equal(stored(f).instances.coder.since,T2);
});

test('REQ-LIMIT-3 only tokens.* at schema depth holds token limits: agent limits named `limit` save as sent, and a token limit named `limit` is stamped and reset',()=>{
 const f=fixture(),full=()=>JSON.parse(readFileSync(f.file,'utf8')).launch.limits;
 let view=f.settings.read('acme');
 // Agent (concurrency) limits that 19fe85c3e saves (Filbert, row 125 r1 change 1).
 for(const limits of [{providers:{anthropic:3}},{providers:{limit:3}},{models:{limit:{m:2}}},{models:{anthropic:{limit:2}}}]){
  view=f.settings.set('acme',{revision:view.revision,limits},'jason');
  assert.deepEqual(full(),limits,JSON.stringify(limits));
 }
 // Token limits whose provider, model or key is named `limit`, beside agent limits named the same.
 const agents={providers:{limit:3},models:{limit:{limit:2}}};
 view=f.settings.set('acme',{revision:view.revision,limits:{...agents,tokens:{providers:{limit:{limit:5}},models:{limit:{limit:{limit:6}}},keys:{limit:{limit:7}}}}},'jason');
 assert.deepEqual(full(),{...agents,tokens:{providers:{limit:{limit:5,since:T0}},models:{limit:{limit:{limit:6,since:T0}}},keys:{limit:{limit:7,since:T0}}}});
 f.tick(T1);
 view=f.settings.set('acme',{revision:view.revision,reset:[['tokens','providers','limit'],['tokens','models','limit','limit']]},'chief');
 assert.deepEqual(full(),{...agents,tokens:{providers:{limit:{limit:5,since:T1}},models:{limit:{limit:{limit:6,since:T1}}},keys:{limit:{limit:7,since:T0}}}});
 // An agent limit, or a path above a token limit, is never reset.
 const bytes=readFileSync(f.file,'utf8');
 for(const reset of [[['providers','limit']],[['models','limit','limit']],[['tokens','models','limit']],[['tokens','providers']]])
  assert.throws(()=>f.settings.set('acme',{revision:view.revision,reset},'jason'),{code:'invalid-request'},JSON.stringify(reset));
 assert.equal(readFileSync(f.file,'utf8'),bytes);
});

test('REQ-LIMIT-3 a reset moves since to now, is logged with its actor, and refuses a path that is not a limit',()=>{
 const f=fixture();
 let view=f.settings.read('acme');
 view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{instances:{coder:{limit:100}},models:{anthropic:{'claude-sonnet-5-5':{limit:7}}}}}},'jason');
 f.tick(T1);
 view=f.settings.set('acme',{revision:view.revision,reset:[['tokens','models','anthropic','claude-sonnet-5-5']]},'chief');
 assert.deepEqual(stored(f),{instances:{coder:{limit:100,since:T0}},models:{anthropic:{'claude-sonnet-5-5':{limit:7,since:T1}}}});
 const log=lastLog(f);
 assert.equal(log.actor,'chief');
 assert.ok(log.changes.some(c=>c.path==='launch.limits.tokens.models.anthropic.claude-sonnet-5-5.since'&&c.old===T0&&c.new===T1),JSON.stringify(log.changes));
 // A user reset of two limits at once, both to the same now.
 f.tick(T2);
 view=f.settings.set('acme',{revision:view.revision,reset:[['tokens','instances','coder'],['tokens','models','anthropic','claude-sonnet-5-5']]},'jason');
 assert.equal(stored(f).instances.coder.since,T2);
 assert.equal(stored(f).models.anthropic['claude-sonnet-5-5'].since,T2);
 assert.equal(lastLog(f).actor,'jason');
 const bytes=readFileSync(f.file,'utf8');
 for(const reset of [[],[[]],[['tokens','instances']],[['tokens','instances','ghost']],[['tokens','instances',1]],'tokens',[['tokens','instances','coder','limit']]])
  assert.throws(()=>f.settings.set('acme',{revision:view.revision,reset},'jason'),{code:'invalid-request'},JSON.stringify(reset));
 assert.equal(readFileSync(f.file,'utf8'),bytes);
});

// Row 126 (#1620, REQ-LIMIT-2): launch.account and tokens.daily.<account>.
const ACCOUNT={name:'max',credential:'CLAUDE_CODE_OAUTH_TOKEN'};
const DAILY={limit:40,since:T0,reset:'05:00',timeZone:'America/Chicago'};
test('REQ-LIMIT-2 schema: launch.account names a credential set; a daily quota needs a reset and an IANA zone and names the account',()=>{
 const f=fixture(),read=(launch)=>{const d=structuredClone(f.doc);Object.assign(d.launch,launch);return validateBusinessDocument(d,f.file,{rolesDir:f.rolesDir}).launch;};
 // No account: the launch reads as before, with no account key.
 assert.equal(Object.hasOwn(read({}),'account'),false);
 for(const credential of ['CLAUDE_CODE_OAUTH_TOKEN','ANTHROPIC_API_KEY','ANTHROPIC_AUTH_TOKEN+ANTHROPIC_BASE_URL'])
  assert.deepEqual(read({account:{name:'max',credential}}).account,{name:'max',credential});
 const ok=read({account:ACCOUNT,limits:{tokens:{daily:{max:DAILY}}}});
 assert.deepEqual(ok.limits.tokens.daily,{max:DAILY});
 for(const timeZone of ['UTC','Etc/GMT+5','America/Argentina/Buenos_Aires'])
  assert.equal(read({account:ACCOUNT,limits:{tokens:{daily:{max:{...DAILY,timeZone}}}}}).limits.tokens.daily.max.timeZone,timeZone);
 const bad=[
  {account:{name:'max'}},{account:{credential:'ANTHROPIC_API_KEY'}},{account:{name:'Max Account',credential:'ANTHROPIC_API_KEY'}},
  {account:{name:'max',credential:'anthropic_api_key'}},{account:{name:'max',credential:'sk-ant-api03-abc'}},
  {account:{name:'max',credential:'ANTHROPIC_API_KEY+'}},{account:{name:'max',credential:'ANTHROPIC_API_KEY',key:'x'}},{account:'max'},
 ];
 for(const reset of ['5:00','24:00','05:60','05:00:00','',undefined,500])bad.push({account:ACCOUNT,limits:{tokens:{daily:{max:{...DAILY,reset}}}}});
 for(const timeZone of ['Chicago time','+05:00','-0600','Mars/Phobos','America/Chicago ','',undefined,5])bad.push({account:ACCOUNT,limits:{tokens:{daily:{max:{...DAILY,timeZone}}}}});
 bad.push({account:ACCOUNT,limits:{tokens:{daily:{max:{...DAILY,limit:-1}}}}},{account:ACCOUNT,limits:{tokens:{daily:{max:{...DAILY,since:'2026-10-18'}}}}},
  {account:ACCOUNT,limits:{tokens:{daily:{max:{...DAILY,extra:1}}}}},{account:ACCOUNT,limits:{tokens:{daily:{max:{limit:40,since:T0}}}}});
 // A daily quota for another account, or with no account at all, would count nothing.
 bad.push({account:ACCOUNT,limits:{tokens:{daily:{other:DAILY}}}},{limits:{tokens:{daily:{max:DAILY}}}});
 for(const launch of bad)assert.throws(()=>read(launch),JSON.stringify(launch));
 // The credential check's refusal names the field, never the value given.
 assert.throws(()=>read({account:{name:'max',credential:'sk-ant-api03-abc'}}),e=>/launch\.account\.credential/.test(e.message)&&!e.message.includes('sk-ant'));
 assert.throws(()=>read({account:ACCOUNT,limits:{tokens:{daily:{other:DAILY}}}}),/daily names other/);
});

test('REQ-LIMIT-2 the writer stamps a daily quota\'s since, keeps its reset and zone, and a reset moves since',()=>{
 const f=fixture();
 f.doc.launch.account=ACCOUNT;writeJson(f.file,f.doc);
 let view=f.settings.read('acme');
 view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{daily:{max:{limit:40,reset:'05:00',timeZone:'America/Chicago'}}}}},'jason');
 assert.deepEqual(stored(f),{daily:{max:{limit:40,reset:'05:00',timeZone:'America/Chicago',since:T0}}});
 f.tick(T1);
 view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{daily:{max:{limit:30,reset:'06:00',timeZone:'UTC'}}}}},'jason');
 assert.deepEqual(stored(f),{daily:{max:{limit:30,reset:'06:00',timeZone:'UTC',since:T0}}});
 assert.throws(()=>f.settings.set('acme',{revision:view.revision,limits:{tokens:{daily:{max:{limit:30,reset:'06:00',timeZone:'UTC',since:T2}}}}},'jason'),{code:'invalid-request'});
 f.tick(T2);
 view=f.settings.set('acme',{revision:view.revision,reset:[['tokens','daily','max']]},'chief');
 assert.equal(stored(f).daily.max.since,T2);
 assert.equal(lastLog(f).actor,'chief');
 assert.throws(()=>f.settings.set('acme',{revision:view.revision,reset:[['tokens','daily']]},'jason'),{code:'invalid-request'});
 // The account itself stays a hand edit: the file's account is untouched by the writes.
 assert.deepEqual(JSON.parse(readFileSync(f.file,'utf8')).launch.account,ACCOUNT);
});

test('P5 per-model-key quotas are unset by default, accept digit-leading IDs and only the human changes or resets them', () => {
 const f=fixture(()=>[]),key='012345abcdef'; let view=f.settings.read('acme');
 assert.equal(view.limits.tokens,undefined);
 const limits={tokens:{keys:{[key]:{limit:20,reset:'05:00',timeZone:'America/Chicago'}}}};
 view=f.settings.set('acme',{revision:view.revision,limits},'jason');
 assert.deepEqual(stored(f).keys[key],{...limits.tokens.keys[key],since:T0});
 const bytes=readFileSync(f.file,'utf8');f.tick(T1);
 for(const actor of ['chief','tester','coder']) {
  assert.throws(()=>f.settings.set('acme',{revision:view.revision,limits:{tokens:{keys:{}}}},actor),{code:'organization-model-quota-human-only'});
  assert.throws(()=>f.settings.set('acme',{revision:view.revision,reset:[['tokens','keys',key]]},actor),{code:'organization-model-quota-human-only'});
 }
 assert.equal(readFileSync(f.file,'utf8'),bytes);
 f.tick(T1);view=f.settings.set('acme',{revision:view.revision,reset:[['tokens','keys',key]]},'jason');
 assert.equal(stored(f).keys[key].since,T1);
 view=f.settings.set('acme',{revision:view.revision,limits:{}},'jason');
 assert.equal(view.limits.tokens,undefined);
});

// Row 333 R4 (#1831): a new daily key quota takes the earliest since of the old document's daily key
// quotas in its key's lineage. A, B and C are one agent's keys, oldest first; X is no agent's.
const A='aaaaaaaaaaa1',B='bbbbbbbbbbb2',C='ccccccccccc3',X='ddddddddddd4',T3='2026-10-18T10:00:00.000Z';
const daily=(limit=20)=>({limit,reset:'05:00',timeZone:'America/Chicago'});
const lineageOf=(business,id)=>{assert.equal(business,'acme');return [C,B,A].includes(id)?[C,B,A]:[];};
test('R4 a moved daily key quota keeps the earliest since in its lineage; a reset, a new key and a re-add get now; a caller time refuses',()=>{
 const f=fixture(lineageOf);let view=f.settings.read('acme');
 view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{keys:{[A]:daily()}}}},'jason');
 assert.equal(stored(f).keys[A].since,T0);
 // B joins while A stays: it carries A's time. Then B alone is reset, so A and B differ.
 f.tick(T1);view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{keys:{[A]:daily(),[B]:daily(30)}}}},'jason');
 assert.equal(stored(f).keys[B].since,T0);
 view=f.settings.set('acme',{revision:view.revision,reset:[['tokens','keys',B]]},'jason');
 assert.deepEqual([stored(f).keys[A].since,stored(f).keys[B].since],[T0,T1]);
 // The move to C drops both: C takes the earlier of the two, not the later. X matches no agent: now.
 f.tick(T2);view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{keys:{[C]:daily(),[X]:daily()}}}},'jason');
 assert.deepEqual(stored(f).keys,{[C]:{...daily(),since:T0},[X]:{...daily(),since:T2}});
 // A caller-supplied since refuses, on a moved leaf too, even when it is the time the writer would carry.
 const bytes=readFileSync(f.file,'utf8');
 for(const keys of [{[C]:daily(),[X]:daily(),[B]:{...daily(),since:T0}},{[C]:daily(),[X]:daily(),[A]:{...daily(),since:T2}},{[C]:{...daily(),since:T1},[X]:daily()}])
  assert.throws(()=>f.settings.set('acme',{revision:view.revision,limits:{tokens:{keys}}},'jason'),{code:'invalid-request'},JSON.stringify(keys));
 assert.equal(readFileSync(f.file,'utf8'),bytes);
 // An explicit reset after the move sets now, in the same write as a move or in its own.
 f.tick(T3);view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{keys:{[B]:daily(),[X]:daily()}}},reset:[['tokens','keys',B]]},'jason');
 assert.equal(stored(f).keys[B].since,T3);
 // Removed in one write and added back in a later one: a new quota, so now.
 view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{keys:{[X]:daily()}}}},'jason');
 f.tick('2026-10-18T11:00:00.000Z');view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{keys:{[X]:daily(),[A]:daily()}}}},'jason');
 assert.equal(stored(f).keys[A].since,'2026-10-18T11:00:00.000Z');
});

test('R4 the writer asks the lineage only for a new daily key quota, and a lookup that fails or answers malformed refuses',()=>{
 let asked=[];const answer={value:null};
 const f=fixture((business,id)=>{asked.push(id);if(answer.value instanceof Error)throw answer.value;return answer.value??lineageOf(business,id);});
 let view=f.settings.read('acme');
 // Writes adding no new daily key quota never ask: account limits, a hex-named legacy limit, a changed quota.
 view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{instances:{coder:{limit:5}},keys:{k1:{limit:5},[X]:{limit:5}}}}},'jason');
 assert.deepEqual(asked,[]);
 view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{keys:{[A]:daily()}}}},'jason');
 assert.deepEqual(asked,[A]);
 f.tick(T1);view=f.settings.set('acme',{revision:view.revision,limits:{tokens:{keys:{[A]:daily(99)}}}},'jason');
 view=f.settings.set('acme',{revision:view.revision,reset:[['tokens','keys',A]]},'jason');
 assert.deepEqual(asked,[A]);
 const bytes=readFileSync(f.file,'utf8');
 for(const bad of [Object.assign(new Error('records unreadable'),{code:'credential-format'}),new Error('plain'),'nope',[42],['ABCDEFABCDEF'],[A],{0:B}]){
  answer.value=bad;
  assert.throws(()=>f.settings.set('acme',{revision:view.revision,limits:{tokens:{keys:{[A]:daily(99),[B]:daily()}}}},'jason'),{code:'proxy-key-refused'},String(bad));
 }
 assert.equal(readFileSync(f.file,'utf8'),bytes);
 // Without a lookup, the default refuses a new daily key quota and nothing else.
 const g=fixture();let gv=g.settings.read('acme');
 gv=g.settings.set('acme',{revision:gv.revision,limits:{tokens:{instances:{coder:{limit:5}},keys:{[X]:{limit:5}}}}},'jason');
 assert.throws(()=>g.settings.set('acme',{revision:gv.revision,limits:{tokens:{keys:{[X]:{limit:5},[A]:daily()}}}},'jason'),{code:'proxy-key-refused'});
});