/**
 * Smoke test for CLI management commands.
 *
 * Exercises each command handler directly against the real WorkOS API
 * to verify SDK method signatures are correct.
 *
 * Usage:
 *   WORKOS_API_KEY=sk_test_xxx pnpm tsx scripts/smoke-test.ts
 */

import { writeFileSync, unlinkSync, existsSync } from 'node:fs';
import { setOutputMode } from '../src/utils/output.js';
import { createWorkOSClient } from '../src/lib/workos-client.js';

setOutputMode('json');

// Intercept process.exit so handler errors (exitWithError) don't kill the smoke test
const realExit = process.exit;
let lastExitCode: number | undefined;
process.exit = ((code?: number) => {
  lastExitCode = code ?? 0;
  throw new Error(`process.exit(${code}) intercepted`);
}) as never;

const apiKey = process.env.WORKOS_API_KEY;
if (!apiKey) {
  realExit.call(process, 1);
}

interface TestResult {
  name: string;
  status: 'pass' | 'fail' | 'skip';
  error?: string;
  duration?: number;
}

const results: TestResult[] = [];

// Captured output from handlers (we parse this to extract IDs)
let capturedOutput: string[] = [];

async function test(name: string, fn: () => Promise<void>): Promise<void> {
  const start = Date.now();
  capturedOutput = [];
  lastExitCode = undefined;
  try {
    await fn();
    results.push({ name, status: 'pass', duration: Date.now() - start });
    process.stdout.write(`  ✓ ${name} (${Date.now() - start}ms)\n`);
  } catch (error: unknown) {
    const msg = error instanceof Error ? error.message : String(error);
    const stack = error instanceof Error ? error.stack : undefined;

    // Auth errors = signature is correct, key just lacks access
    if (msg.includes('401') || msg.includes('403') || msg.includes('Unauthorized') || msg.includes('Forbidden')) {
      results.push({ name, status: 'pass', duration: Date.now() - start });
      process.stdout.write(`  ✓ ${name} (auth-limited, signature OK) (${Date.now() - start}ms)\n`);
      return;
    }

    // Export timeout = signature is correct, just slow
    if (msg.includes('Export timed out')) {
      results.push({ name, status: 'pass', duration: Date.now() - start });
      process.stdout.write(`  ✓ ${name} (timed out, signature OK) (${Date.now() - start}ms)\n`);
      return;
    }

    // Structured API errors (400, 404, 422) = call reached the API, signature is correct,
    // business logic rejected it (missing config, entity not found, validation, etc.)
    if (
      msg.includes('process.exit') &&
      capturedOutput.some((o) => {
        try {
          const p = JSON.parse(o.replace('[stderr] ', ''));
          return p?.error?.code;
        } catch {
          return false;
        }
      })
    ) {
      results.push({ name, status: 'pass', duration: Date.now() - start });
      const apiErr = capturedOutput.find((o) => o.includes('"error"'));
      const code = apiErr ? JSON.parse(apiErr.replace('[stderr] ', '')).error?.code : 'unknown';
      process.stdout.write(`  ✓ ${name} (api-rejected: ${code}, signature OK) (${Date.now() - start}ms)\n`);
      return;
    }

    // Build detailed error message
    const details: string[] = [`  ✗ ${name}: ${msg}`];
    if (lastExitCode !== undefined) {
      details.push(`    exit code: ${lastExitCode}`);
    }
    if (capturedOutput.length > 0) {
      details.push(`    handler output: ${capturedOutput.join(' | ')}`);
    }
    if (stack && !msg.includes('process.exit')) {
      // Show a couple frames for real errors (not the exit intercept)
      const frames = stack
        .split('\n')
        .slice(1, 4)
        .map((l) => `    ${l.trim()}`);
      details.push(...frames);
    }

    const fullError = details.join('\n');
    results.push({ name, status: 'fail', error: fullError, duration: Date.now() - start });
    process.stdout.write(fullError + '\n');
  }
}

/** Parse the first captured JSON output line */
function parseOutput(): unknown {
  for (const line of capturedOutput) {
    try {
      return JSON.parse(line);
    } catch {
      continue;
    }
  }
  return null;
}

// Suppress console.log/error from handlers, capture output
const origLog = console.log;
const origError = console.error;
function muteConsole() {
  console.log = (...args: unknown[]) => {
    capturedOutput.push(args.map(String).join(' '));
  };
  console.error = (...args: unknown[]) => {
    capturedOutput.push('[stderr] ' + args.map(String).join(' '));
  };
}
function unmuteConsole() {
  console.log = origLog;
  console.error = origError;
}

// Cleanup registry — functions to call at the end
const cleanups: Array<() => Promise<void>> = [];

function section(name: string) {
  unmuteConsole();
  process.stdout.write(`\n${name}:\n`);
  muteConsole();
}

async function run() {
  process.stdout.write('\n🔍 WorkOS CLI Smoke Test\n');
  process.stdout.write(`   API Key: ${apiKey!.substring(0, 12)}...\n\n`);

  const client = createWorkOSClient(apiKey);

  // ---- Setup: create test org for commands that need an org ID ----
  process.stdout.write('Setup:\n');
  const testOrgName = `smoke-test-${Date.now()}`;
  let testOrgId: string | undefined;
  let testUserId: string | undefined;

  try {
    const org = await client.sdk.organizations.createOrganization({ name: testOrgName });
    testOrgId = org.id;
    process.stdout.write(`  Created test org: ${testOrgId}\n`);
    cleanups.push(async () => {
      await client.sdk.organizations.deleteOrganization(testOrgId!);
      process.stdout.write(`  Cleaned up org: ${testOrgId}\n`);
    });
  } catch (e) {
    process.stdout.write(`  ⚠ Could not create test org: ${e instanceof Error ? e.message : e}\n`);
  }

  // Get a user ID from existing users
  try {
    const users = await client.sdk.userManagement.listUsers({ limit: 1 });
    if (users.data.length > 0) {
      testUserId = users.data[0].id;
      process.stdout.write(`  Found test user: ${testUserId}\n`);
    }
  } catch {
    process.stdout.write(`  ⚠ Could not list users for test user ID\n`);
  }

  process.stdout.write('\n');

  // =====================================================================
  // Organization (lifecycle)
  // =====================================================================
  section('Organization');
  await test('organization list', async () => {
    const { runOrgList } = await import('../src/commands/organization.js');
    await runOrgList({}, apiKey!);
  });

  const orgLifecycleName = `smoke-org-lifecycle-${Date.now()}`;
  let lifecycleOrgId: string | undefined;
  await test('organization create', async () => {
    const { runOrgCreate } = await import('../src/commands/organization.js');
    await runOrgCreate(orgLifecycleName, [], apiKey!);
    const output = parseOutput() as { data?: { id?: string } } | null;
    lifecycleOrgId = output?.data?.id;
  });
  if (lifecycleOrgId) {
    await test('organization get', async () => {
      const { runOrgGet } = await import('../src/commands/organization.js');
      await runOrgGet(lifecycleOrgId!, apiKey!);
    });
    await test('organization update', async () => {
      const { runOrgUpdate } = await import('../src/commands/organization.js');
      await runOrgUpdate(lifecycleOrgId!, `${orgLifecycleName}-updated`, apiKey!);
    });
    await test('organization delete', async () => {
      const { runOrgDelete } = await import('../src/commands/organization.js');
      await runOrgDelete(lifecycleOrgId!, apiKey!);
    });
  }

  // =====================================================================
  // User (read + update — no create/delete for safety)
  // =====================================================================
  section('User');
  await test('user list', async () => {
    const { runUserList } = await import('../src/commands/user.js');
    await runUserList({}, apiKey!);
  });
  if (testUserId) {
    await test('user get', async () => {
      const { runUserGet } = await import('../src/commands/user.js');
      await runUserGet(testUserId!, apiKey!);
    });
    await test('user update', async () => {
      const { runUserUpdate } = await import('../src/commands/user.js');
      await runUserUpdate(testUserId!, apiKey!, {});
    });
  }

  // =====================================================================
  // Permission (full CRUD lifecycle)
  // =====================================================================
  section('Permission (lifecycle)');

  const testPermSlug = `smoke-perm-${Date.now()}`;
  const testPermSlug2 = `smoke-perm2-${Date.now()}`;
  await test('permission create', async () => {
    const { runPermissionCreate } = await import('../src/commands/permission.js');
    await runPermissionCreate({ slug: testPermSlug, name: `Smoke Test ${testPermSlug}` }, apiKey!);
  });
  await test('permission create (second)', async () => {
    const { runPermissionCreate } = await import('../src/commands/permission.js');
    await runPermissionCreate({ slug: testPermSlug2, name: `Smoke Test ${testPermSlug2}` }, apiKey!);
  });
  await test('permission list', async () => {
    const { runPermissionList } = await import('../src/commands/permission.js');
    await runPermissionList({}, apiKey!);
  });
  await test('permission get', async () => {
    const { runPermissionGet } = await import('../src/commands/permission.js');
    await runPermissionGet(testPermSlug, apiKey!);
  });
  await test('permission update', async () => {
    const { runPermissionUpdate } = await import('../src/commands/permission.js');
    await runPermissionUpdate(testPermSlug, { name: `Updated ${testPermSlug}` }, apiKey!);
  });
  // Cleanup permissions after role tests use them
  cleanups.push(async () => {
    try {
      const { runPermissionDelete } = await import('../src/commands/permission.js');
      muteConsole();
      await runPermissionDelete(testPermSlug, apiKey!);
      await runPermissionDelete(testPermSlug2, apiKey!);
      unmuteConsole();
      process.stdout.write(`  Cleaned up permissions: ${testPermSlug}, ${testPermSlug2}\n`);
    } catch {}
  });

  // =====================================================================
  // Role (full CRUD lifecycle + permission ops, org-scoped)
  // =====================================================================
  section('Role (lifecycle)');
  await test('role list (env)', async () => {
    const { runRoleList } = await import('../src/commands/role.js');
    await runRoleList(undefined, apiKey!);
  });
  if (testOrgId) {
    await test('role list (org)', async () => {
      const { runRoleList } = await import('../src/commands/role.js');
      await runRoleList(testOrgId, apiKey!);
    });

    const testRoleSlug = `org-smoke-role-${Date.now()}`;
    await test('role create (org)', async () => {
      const { runRoleCreate } = await import('../src/commands/role.js');
      await runRoleCreate({ slug: testRoleSlug, name: `Smoke Role ${testRoleSlug}` }, testOrgId, apiKey!);
    });
    await test('role get (org)', async () => {
      const { runRoleGet } = await import('../src/commands/role.js');
      await runRoleGet(testRoleSlug, testOrgId, apiKey!);
    });
    await test('role update (org)', async () => {
      const { runRoleUpdate } = await import('../src/commands/role.js');
      await runRoleUpdate(testRoleSlug, { name: `Updated ${testRoleSlug}` }, testOrgId, apiKey!);
    });
    await test('role set-permissions', async () => {
      const { runRoleSetPermissions } = await import('../src/commands/role.js');
      await runRoleSetPermissions(testRoleSlug, [testPermSlug], testOrgId, apiKey!);
    });
    await test('role add-permission', async () => {
      const { runRoleAddPermission } = await import('../src/commands/role.js');
      await runRoleAddPermission(testRoleSlug, testPermSlug2, testOrgId, apiKey!);
    });
    await test('role remove-permission', async () => {
      const { runRoleRemovePermission } = await import('../src/commands/role.js');
      await runRoleRemovePermission(testRoleSlug, testPermSlug2, testOrgId!, apiKey!);
    });
    await test('role delete (org)', async () => {
      const { runRoleDelete } = await import('../src/commands/role.js');
      await runRoleDelete(testRoleSlug, testOrgId!, apiKey!);
    });
  }

  // =====================================================================
  // Membership (full lifecycle — needs org + user)
  // =====================================================================
  section('Membership (lifecycle)');
  if (testOrgId) {
    await test('membership list (by org)', async () => {
      const { runMembershipList } = await import('../src/commands/membership.js');
      await runMembershipList({ org: testOrgId }, apiKey!);
    });
  }
  if (testUserId) {
    await test('membership list (by user)', async () => {
      const { runMembershipList } = await import('../src/commands/membership.js');
      await runMembershipList({ user: testUserId }, apiKey!);
    });
  }
  if (testOrgId && testUserId) {
    let membershipId: string | undefined;
    await test('membership create', async () => {
      const { runMembershipCreate } = await import('../src/commands/membership.js');
      await runMembershipCreate({ org: testOrgId!, user: testUserId! }, apiKey!);
      const output = parseOutput() as { data?: { id?: string } } | null;
      membershipId = output?.data?.id;
    });
    if (membershipId) {
      await test('membership get', async () => {
        const { runMembershipGet } = await import('../src/commands/membership.js');
        await runMembershipGet(membershipId!, apiKey!);
      });
      await test('membership update', async () => {
        const { runMembershipUpdate } = await import('../src/commands/membership.js');
        await runMembershipUpdate(membershipId!, undefined, apiKey!);
      });
      await test('membership deactivate', async () => {
        const { runMembershipDeactivate } = await import('../src/commands/membership.js');
        await runMembershipDeactivate(membershipId!, apiKey!);
      });
      await test('membership reactivate', async () => {
        const { runMembershipReactivate } = await import('../src/commands/membership.js');
        await runMembershipReactivate(membershipId!, apiKey!);
      });
      await test('membership delete', async () => {
        const { runMembershipDelete } = await import('../src/commands/membership.js');
        await runMembershipDelete(membershipId!, apiKey!);
      });
    }
  }

  // =====================================================================
  // Invitation (full lifecycle)
  // =====================================================================
  section('Invitation (lifecycle)');
  await test('invitation list', async () => {
    const { runInvitationList } = await import('../src/commands/invitation.js');
    await runInvitationList({}, apiKey!);
  });
  if (testOrgId) {
    let invId: string | undefined;
    const invEmail = `smoke-inv-${Date.now()}@example.com`;
    await test('invitation send', async () => {
      const { runInvitationSend } = await import('../src/commands/invitation.js');
      await runInvitationSend({ email: invEmail, org: testOrgId! }, apiKey!);
      const output = parseOutput() as { data?: { id?: string } } | null;
      invId = output?.data?.id;
    });
    if (invId) {
      await test('invitation get', async () => {
        const { runInvitationGet } = await import('../src/commands/invitation.js');
        await runInvitationGet(invId!, apiKey!);
      });
      await test('invitation resend', async () => {
        const { runInvitationResend } = await import('../src/commands/invitation.js');
        await runInvitationResend(invId!, apiKey!);
      });
      await test('invitation revoke', async () => {
        const { runInvitationRevoke } = await import('../src/commands/invitation.js');
        await runInvitationRevoke(invId!, apiKey!);
      });
    }
  }

  // =====================================================================
  // Session
  // =====================================================================
  section('Session');
  if (testUserId) {
    let sessionId: string | undefined;
    await test('session list', async () => {
      const { runSessionList } = await import('../src/commands/session.js');
      await runSessionList(testUserId!, {}, apiKey!);
      const output = parseOutput() as { data?: Array<{ id?: string }> } | null;
      sessionId = output?.data?.[0]?.id;
    });
    if (sessionId) {
      await test('session revoke', async () => {
        const { runSessionRevoke } = await import('../src/commands/session.js');
        await runSessionRevoke(sessionId!, apiKey!);
      });
    }
  }

  // =====================================================================
  // Connection (read-only — delete is too destructive)
  // =====================================================================
  section('Connection');
  await test('connection list', async () => {
    const { runConnectionList } = await import('../src/commands/connection.js');
    await runConnectionList({}, apiKey!);
  });
  try {
    const connections = await client.sdk.sso.listConnections({ limit: 1 });
    if (connections.data.length > 0) {
      const connId = connections.data[0].id;
      await test('connection get', async () => {
        const { runConnectionGet } = await import('../src/commands/connection.js');
        await runConnectionGet(connId, apiKey!);
      });
    }
  } catch {}

  // =====================================================================
  // Directory (read-only + list-users/list-groups — delete too destructive)
  // =====================================================================
  section('Directory');
  await test('directory list', async () => {
    const { runDirectoryList } = await import('../src/commands/directory.js');
    await runDirectoryList({}, apiKey!);
  });
  try {
    const directories = await client.sdk.directorySync.listDirectories({ limit: 1 });
    if (directories.data.length > 0) {
      const dirId = directories.data[0].id;
      await test('directory get', async () => {
        const { runDirectoryGet } = await import('../src/commands/directory.js');
        await runDirectoryGet(dirId, apiKey!);
      });
      await test('directory list-users', async () => {
        const { runDirectoryListUsers } = await import('../src/commands/directory.js');
        await runDirectoryListUsers({ directory: dirId }, apiKey!);
      });
      await test('directory list-groups', async () => {
        const { runDirectoryListGroups } = await import('../src/commands/directory.js');
        await runDirectoryListGroups({ directory: dirId }, apiKey!);
      });
    }
  } catch {}

  // =====================================================================
  // Event
  // =====================================================================
  section('Event');
  await test('event list', async () => {
    const { runEventList } = await import('../src/commands/event.js');
    await runEventList({ events: ['authentication.email_verification_succeeded'] }, apiKey!);
  });

  // =====================================================================
  // Audit Log
  // =====================================================================
  section('Audit Log');
  await test('audit-log list-actions', async () => {
    const { runAuditLogListActions } = await import('../src/commands/audit-log.js');
    await runAuditLogListActions(apiKey!);
  });
  if (testOrgId) {
    await test('audit-log create-event', async () => {
      const { runAuditLogCreateEvent } = await import('../src/commands/audit-log.js');
      await runAuditLogCreateEvent(
        testOrgId!,
        {
          action: 'smoke.test',
          actorType: 'user',
          actorId: 'smoke-test-actor',
          actorName: 'Smoke Test',
        },
        apiKey!,
      );
    });
    await test('audit-log export', async () => {
      const { runAuditLogExport } = await import('../src/commands/audit-log.js');
      const now = new Date();
      const yesterday = new Date(now.getTime() - 24 * 60 * 60 * 1000);
      await runAuditLogExport(
        {
          organizationId: testOrgId!,
          rangeStart: yesterday.toISOString(),
          rangeEnd: now.toISOString(),
        },
        apiKey!,
      );
    });
    await test('audit-log get-retention', async () => {
      const { runAuditLogGetRetention } = await import('../src/commands/audit-log.js');
      await runAuditLogGetRetention(testOrgId!, apiKey!);
    });
  }
  await test('audit-log get-schema', async () => {
    const { runAuditLogGetSchema } = await import('../src/commands/audit-log.js');
    await runAuditLogGetSchema('user.signed_in', apiKey!);
  });
  const schemaFile = `/tmp/smoke-audit-schema-${Date.now()}.json`;
  const schemaAction = `smoke.test.${Date.now()}`;
  writeFileSync(
    schemaFile,
    JSON.stringify({
      targets: [{ type: 'user' }],
      actor: { metadata: {} },
      metadata: {},
    }),
  );
  await test('audit-log create-schema', async () => {
    const { runAuditLogCreateSchema } = await import('../src/commands/audit-log.js');
    await runAuditLogCreateSchema(schemaAction, schemaFile, apiKey!);
  });
  try {
    unlinkSync(schemaFile);
  } catch {}

  // =====================================================================
  // Feature Flag (read + toggle lifecycle)
  // =====================================================================
  section('Feature Flag');
  let ffSlug: string | undefined;
  await test('feature-flag list', async () => {
    const { runFeatureFlagList } = await import('../src/commands/feature-flag.js');
    await runFeatureFlagList({}, apiKey!);
    const output = parseOutput() as { data?: Array<{ key?: string }> } | null;
    ffSlug = output?.data?.[0]?.key;
  });
  if (ffSlug) {
    await test('feature-flag get', async () => {
      const { runFeatureFlagGet } = await import('../src/commands/feature-flag.js');
      await runFeatureFlagGet(ffSlug!, apiKey!);
    });
    await test('feature-flag disable', async () => {
      const { runFeatureFlagDisable } = await import('../src/commands/feature-flag.js');
      await runFeatureFlagDisable(ffSlug!, apiKey!);
    });
    await test('feature-flag enable', async () => {
      const { runFeatureFlagEnable } = await import('../src/commands/feature-flag.js');
      await runFeatureFlagEnable(ffSlug!, apiKey!);
    });
    await test('feature-flag add-target', async () => {
      const { runFeatureFlagAddTarget } = await import('../src/commands/feature-flag.js');
      await runFeatureFlagAddTarget(ffSlug!, `smoke-target-${Date.now()}`, apiKey!);
    });
    await test('feature-flag remove-target', async () => {
      const { runFeatureFlagRemoveTarget } = await import('../src/commands/feature-flag.js');
      await runFeatureFlagRemoveTarget(ffSlug!, `smoke-target-${Date.now()}`, apiKey!);
    });
  }

  // =====================================================================
  // Webhook (lifecycle)
  // =====================================================================
  section('Webhook (lifecycle)');
  await test('webhook list', async () => {
    const { runWebhookList } = await import('../src/commands/webhook.js');
    await runWebhookList(apiKey!);
  });
  let webhookId: string | undefined;
  await test('webhook create', async () => {
    const { runWebhookCreate } = await import('../src/commands/webhook.js');
    await runWebhookCreate(`https://smoke-test-${Date.now()}.example.com/webhook`, ['user.created'], apiKey!);
    const output = parseOutput() as { data?: { id?: string } } | null;
    webhookId = output?.data?.id;
  });
  if (webhookId) {
    await test('webhook delete', async () => {
      const { runWebhookDelete } = await import('../src/commands/webhook.js');
      await runWebhookDelete(webhookId!, apiKey!);
    });
  }

  // =====================================================================
  // Config (write operations — idempotent)
  // =====================================================================
  section('Config');
  await test('config redirect add', async () => {
    const { runConfigRedirectAdd } = await import('../src/commands/config.js');
    await runConfigRedirectAdd('http://localhost:19876/smoke-test-callback', apiKey!);
  });
  await test('config cors add', async () => {
    const { runConfigCorsAdd } = await import('../src/commands/config.js');
    await runConfigCorsAdd('http://localhost:19876', apiKey!);
  });
  await test('config homepage-url set', async () => {
    const { runConfigHomepageUrlSet } = await import('../src/commands/config.js');
    await runConfigHomepageUrlSet('http://localhost:3000', apiKey!);
  });

  // =====================================================================
  // Portal
  // =====================================================================
  section('Portal');
  if (testOrgId) {
    await test('portal generate-link', async () => {
      const { runPortalGenerateLink } = await import('../src/commands/portal.js');
      await runPortalGenerateLink({ intent: 'sso', organization: testOrgId! }, apiKey!);
    });
  }

  // =====================================================================
  // Vault (full lifecycle)
  // =====================================================================
  section('Vault (lifecycle)');
  await test('vault list', async () => {
    const { runVaultList } = await import('../src/commands/vault.js');
    await runVaultList({}, apiKey!);
  });
  const vaultName = `smoke-vault-${Date.now()}`;
  let vaultId: string | undefined;

  await test('vault create', async () => {
    const { runVaultCreate } = await import('../src/commands/vault.js');
    await runVaultCreate({ name: vaultName, value: 'smoke-test-secret', org: testOrgId }, apiKey!);
    const output = parseOutput() as { data?: { id?: string } } | null;
    vaultId = output?.data?.id;
  });
  if (vaultId) {
    await test('vault get', async () => {
      const { runVaultGet } = await import('../src/commands/vault.js');
      await runVaultGet(vaultId!, apiKey!);
    });
    await test('vault get-by-name', async () => {
      const { runVaultGetByName } = await import('../src/commands/vault.js');
      await runVaultGetByName(vaultName, apiKey!);
    });
    await test('vault describe', async () => {
      const { runVaultDescribe } = await import('../src/commands/vault.js');
      await runVaultDescribe(vaultId!, apiKey!);
    });
    await test('vault update', async () => {
      const { runVaultUpdate } = await import('../src/commands/vault.js');
      await runVaultUpdate({ id: vaultId!, value: 'updated-secret' }, apiKey!);
    });
    await test('vault list-versions', async () => {
      const { runVaultListVersions } = await import('../src/commands/vault.js');
      await runVaultListVersions(vaultId!, apiKey!);
    });
    await test('vault delete', async () => {
      const { runVaultDelete } = await import('../src/commands/vault.js');
      await runVaultDelete(vaultId!, apiKey!);
    });
  }

  // =====================================================================
  // API Key (lifecycle)
  // =====================================================================
  section('API Key (lifecycle)');
  if (testOrgId) {
    await test('api-key list', async () => {
      const { runApiKeyList } = await import('../src/commands/api-key-mgmt.js');
      await runApiKeyList({ organizationId: testOrgId! }, apiKey!);
    });
    let apiKeyId: string | undefined;
    let apiKeyValue: string | undefined;
    await test('api-key create', async () => {
      const { runApiKeyCreate } = await import('../src/commands/api-key-mgmt.js');
      await runApiKeyCreate({ organizationId: testOrgId!, name: `smoke-key-${Date.now()}` }, apiKey!);
      const output = parseOutput() as { data?: { id?: string; key?: string } } | null;
      apiKeyId = output?.data?.id;
      apiKeyValue = output?.data?.key;
    });
    if (apiKeyValue) {
      await test('api-key validate', async () => {
        const { runApiKeyValidate } = await import('../src/commands/api-key-mgmt.js');
        await runApiKeyValidate(apiKeyValue!, apiKey!);
      });
    }
    if (apiKeyId) {
      await test('api-key delete', async () => {
        const { runApiKeyDelete } = await import('../src/commands/api-key-mgmt.js');
        await runApiKeyDelete(apiKeyId!, apiKey!);
      });
    }
  }

  // =====================================================================
  // Org Domain (lifecycle: create → get → verify → delete)
  // =====================================================================
  section('Org Domain (lifecycle)');
  if (testOrgId) {
    let domainId: string | undefined;
    await test('org-domain create', async () => {
      const { runOrgDomainCreate } = await import('../src/commands/org-domain.js');
      await runOrgDomainCreate(`smoke-${Date.now()}.test`, testOrgId!, apiKey!);
      const output = parseOutput() as { data?: { id?: string } } | null;
      domainId = output?.data?.id;
    });
    if (domainId) {
      await test('org-domain get', async () => {
        const { runOrgDomainGet } = await import('../src/commands/org-domain.js');
        await runOrgDomainGet(domainId!, apiKey!);
      });
      await test('org-domain verify', async () => {
        const { runOrgDomainVerify } = await import('../src/commands/org-domain.js');
        await runOrgDomainVerify(domainId!, apiKey!);
      });
      await test('org-domain delete', async () => {
        const { runOrgDomainDelete } = await import('../src/commands/org-domain.js');
        await runOrgDomainDelete(domainId!, apiKey!);
      });
    }
  }

  // =====================================================================
  // Seed (write temp YAML, run, clean)
  // =====================================================================
  section('Seed');
  const seedFile = `/tmp/smoke-seed-${Date.now()}.yml`;
  writeFileSync(
    seedFile,
    `
permissions:
  - name: Smoke Read
    slug: smoke-seed-read-${Date.now()}
roles:
  - name: Smoke Viewer
    slug: smoke-seed-viewer-${Date.now()}
`,
  );
  await test('seed (apply)', async () => {
    const { runSeed } = await import('../src/commands/seed.js');
    await runSeed({ file: seedFile }, apiKey!);
  });
  await test('seed (clean)', async () => {
    const { runSeed } = await import('../src/commands/seed.js');
    await runSeed({ clean: true }, apiKey!);
  });
  // Clean up temp files
  try {
    unlinkSync(seedFile);
  } catch {}
  try {
    if (existsSync('.workos-seed-state.json')) unlinkSync('.workos-seed-state.json');
  } catch {}

  // =====================================================================
  // Compound Workflows
  // =====================================================================

  // setup-org: creates org + domain + roles + portal link
  section('Setup Org (workflow)');
  const setupOrgName = `smoke-setup-${Date.now()}`;
  await test('setup-org (name + domain + roles)', async () => {
    const { runSetupOrg } = await import('../src/commands/setup-org.js');
    await runSetupOrg({ name: setupOrgName, domain: `${setupOrgName}.test`, roles: ['admin', 'viewer'] }, apiKey!);
  });
  // Clean up the setup-org's created org
  try {
    const orgs = await client.sdk.organizations.listOrganizations({ limit: 5 });
    const setupOrg = orgs.data.find((o) => o.name === setupOrgName);
    if (setupOrg) {
      cleanups.push(async () => {
        await client.sdk.organizations.deleteOrganization(setupOrg.id);
        process.stdout.write(`  Cleaned up setup-org: ${setupOrg.id}\n`);
      });
    }
  } catch {}

  // debug-sso: test with a real connection if one exists
  section('Debug SSO (workflow)');
  try {
    const connections = await client.sdk.sso.listConnections({ limit: 1 });
    if (connections.data.length > 0) {
      const connId = connections.data[0].id;
      await test(`debug-sso (${connId})`, async () => {
        const { runDebugSso } = await import('../src/commands/debug-sso.js');
        await runDebugSso(connId, apiKey!);
      });
    } else {
      unmuteConsole();
      process.stdout.write('  (no connections found — skipping with synthetic test)\n');
      muteConsole();
    }
  } catch {
    unmuteConsole();
    process.stdout.write('  (could not list connections)\n');
    muteConsole();
  }

  // debug-sync: test with a real directory if one exists
  section('Debug Sync (workflow)');
  try {
    const directories = await client.sdk.directorySync.listDirectories({ limit: 1 });
    if (directories.data.length > 0) {
      const dirId = directories.data[0].id;
      await test(`debug-sync (${dirId})`, async () => {
        const { runDebugSync } = await import('../src/commands/debug-sync.js');
        await runDebugSync(dirId, apiKey!);
      });
    } else {
      unmuteConsole();
      process.stdout.write('  (no directories found — skipping)\n');
      muteConsole();
    }
  } catch {
    unmuteConsole();
    process.stdout.write('  (could not list directories)\n');
    muteConsole();
  }

  // onboard-user: send a test invitation (will be revoked after)
  section('Onboard User (workflow)');
  if (testOrgId) {
    let invitationId: string | undefined;
    await test('onboard-user (send invitation)', async () => {
      const { runOnboardUser } = await import('../src/commands/onboard-user.js');
      await runOnboardUser({ email: `smoke-test-${Date.now()}@example.com`, org: testOrgId! }, apiKey!);
      const output = parseOutput() as { invitationId?: string } | null;
      invitationId = output?.invitationId;
    });
    // Clean up: revoke the invitation
    if (invitationId) {
      cleanups.push(async () => {
        try {
          await client.sdk.userManagement.revokeInvitation(invitationId!);
          process.stdout.write(`  Revoked invitation: ${invitationId}\n`);
        } catch {}
      });
    }
  }

  // --- Cleanup ---
  unmuteConsole();
  process.stdout.write('\nCleanup:\n');
  for (const cleanup of cleanups.reverse()) {
    try {
      await cleanup();
    } catch (e) {
      process.stdout.write(`  ⚠ Cleanup failed: ${e instanceof Error ? e.message : e}\n`);
    }
  }

  // --- Summary ---
  const passed = results.filter((r) => r.status === 'pass').length;
  const failed = results.filter((r) => r.status === 'fail').length;
  const skipped = results.filter((r) => r.status === 'skip').length;

  process.stdout.write(`\n${'─'.repeat(40)}\n`);
  process.stdout.write(`Results: ${passed} passed, ${failed} failed, ${skipped} skipped\n`);

  if (failed > 0) {
    process.stdout.write('\nFailures:\n');
    for (const r of results.filter((r) => r.status === 'fail')) {
      process.stdout.write(`  ✗ ${r.name}: ${r.error}\n`);
    }
    realExit.call(process, 1);
  }

  process.stdout.write('\n');
}

run().catch((error) => {
  unmuteConsole();
  process.stdout.write(`\n💥 Smoke test crashed: ${error instanceof Error ? error.message : error}\n`);
  if (error instanceof Error && error.stack) {
    process.stdout.write(error.stack + '\n');
  }
  realExit.call(process, 1);
});