//! A repository on disk: the `.oxy` directory, one workspace, the operation
//! log, and the working-copy change (spec §12, §13.1).
//!
//! Not yet implemented from the spec: seals, attestations and trust policy,
//! packs, checkpoints, multiple workspaces, and remotes. Changes are signed individually when `core.sign` is
//! `change`; the default `seal` leaves them unsigned until push exists.

use crate::diff::{ranges, split_lines, text_edits};
use crate::hash::{hash_object, ChangeHash, KeyId, ObjectRef, ObjectType};
use crate::identity::{self, Domain, Identity, SecretKey, Signature};
use crate::ids::{ChangeId, NodeId, WorkspaceId};
use crate::objects::{Blob, Change, ChangeKind, Edit, Hlc, Mode, NodeKind, OpRef, TreeOp};
use crate::oplog::{Op, View, SNAPSHOT_SUFFIX};
use crate::state::{FileContent, Snapshot, State};
use crate::store::{Store, StoreError};
use crate::tree::OpKey;
use std::collections::{BTreeMap, BTreeSet, HashMap};
use std::fs;
use std::io::Write;
use std::path::{Path, PathBuf};

pub const OXY_DIR: &str = ".oxy";
pub const FORMAT_LINE: &str = "oxy repository format 1\n";
const BINARY_SNIFF: usize = 8 * 1024;

#[derive(Debug, thiserror::Error)]
pub enum RepoError {
    #[error("io: {0}")]
    Io(#[from] std::io::Error),
    #[error(transparent)]
    Store(#[from] StoreError),
    #[error(transparent)]
    Object(#[from] crate::objects::ObjectError),
    #[error(transparent)]
    State(#[from] crate::state::StateError),
    #[error("{0}")]
    Msg(String),
}

pub type Result<T> = std::result::Result<T, RepoError>;

fn fail<T>(s: impl Into<String>) -> Result<T> {
    Err(RepoError::Msg(s.into()))
}

/// Repository-local settings (`.oxy/config`, `key = value` lines).
#[derive(Clone, Debug, PartialEq, Eq)]
pub struct Config {
    pub author_name: String,
    pub author_email: String,
    /// The KeyId of the author's identity, once `create_identity` has run.
    pub author_key: Option<KeyId>,
    /// `core.sign`: sign every change at commit (`true`) or leave signing to
    /// push-time seals (`false`, the spec default).
    pub sign_changes: bool,
    pub bookmark: String,
}

impl Config {
    fn default_for_user() -> Config {
        let user = std::env::var("USER").unwrap_or_else(|_| "unknown".into());
        Config {
            author_name: std::env::var("OXY_AUTHOR_NAME").unwrap_or_else(|_| user.clone()),
            author_email: std::env::var("OXY_AUTHOR_EMAIL").unwrap_or_else(|_| format!("{user}@localhost")),
            author_key: None,
            sign_changes: false,
            bookmark: "main".into(),
        }
    }

    /// Set a key as `oxy config` does; returns false for unknown keys.
    pub fn set(&mut self, key: &str, value: &str) -> Result<()> {
        match key {
            "author.name" => self.author_name = value.into(),
            "author.email" => self.author_email = value.into(),
            "author.key" => {
                self.author_key = if value.is_empty() {
                    None
                } else {
                    Some(KeyId::from_hex(value).ok_or_else(|| RepoError::Msg("author.key must be a 64-character hex KeyId".into()))?)
                }
            }
            "core.sign" => {
                self.sign_changes = match value {
                    "change" => true,
                    "seal" => false,
                    _ => return fail("core.sign must be \"change\" or \"seal\""),
                }
            }
            "workspace.bookmark" => self.bookmark = value.into(),
            _ => return fail(format!("unknown configuration key {key:?}")),
        }
        Ok(())
    }

    fn load(path: &Path) -> Result<Config> {
        let mut c = Config::default_for_user();
        for line in fs::read_to_string(path)?.lines() {
            let line = line.trim();
            if line.is_empty() || line.starts_with('#') {
                continue;
            }
            let Some((k, v)) = line.split_once('=') else { continue };
            let v = v.trim().trim_matches('"').to_string();
            let _ = c.set(k.trim(), &v);
        }
        Ok(c)
    }

    fn save(&self, path: &Path) -> Result<()> {
        let text = format!(
            "author.name = \"{}\"\nauthor.email = \"{}\"\nauthor.key = \"{}\"\ncore.sign = \"{}\"\nworkspace.bookmark = \"{}\"\n",
            self.author_name,
            self.author_email,
            self.author_key.map(|k| k.to_hex()).unwrap_or_default(),
            if self.sign_changes { "change" } else { "seal" },
            self.bookmark
        );
        write_atomic(path, text.as_bytes())
    }
}

fn write_atomic(path: &Path, data: &[u8]) -> Result<()> {
    let tmp = path.with_extension("tmp");
    {
        let mut f = fs::File::create(&tmp)?;
        f.write_all(data)?;
        f.sync_all()?;
    }
    fs::rename(&tmp, path)?;
    Ok(())
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum ChangeStatus {
    Added,
    Modified,
    Removed,
    ModeChanged,
    /// The file is conflicted in the base state and still contains conflict markers.
    ConflictEdited,
    /// The file was conflicted in the base state and the working copy resolves it.
    Resolved,
}

/// Lines that mark a conflict region in a materialized file (spec §9.5).
pub fn has_conflict_markers(content: &[u8]) -> bool {
    split_lines(content).iter().any(|l| {
        l.starts_with(b"<<<<<<< oxy conflict") || l.starts_with(b"======= oxy conflict") || l.starts_with(b">>>>>>> oxy conflict")
    })
}

#[derive(Clone, Debug, PartialEq, Eq)]
pub struct PathStatus {
    pub path: String,
    pub status: ChangeStatus,
}

/// Result of snapshotting the working copy.
pub struct SnapshotResult {
    pub wc_hash: ChangeHash,
    pub wc: Change,
    /// The base state (closure of the working-copy change's dependencies).
    pub base: State,
    pub base_snapshot: Snapshot,
    pub statuses: Vec<PathStatus>,
    /// Whether the snapshot rewrote the working-copy change.
    pub changed: bool,
    /// Whether the working copy resolves conflicts of its base (spec §9.6).
    pub resolves: bool,
}

pub struct LogEntry {
    pub hash: ChangeHash,
    pub change: Change,
    pub is_working_copy: bool,
    pub is_head: bool,
}

struct FsEntry {
    kind: NodeKind,
    exec: bool,
    content: Vec<u8>,
}

pub struct Repo {
    root: PathBuf,
    oxy: PathBuf,
    store: Store,
    workspace: WorkspaceId,
    keys_dir: PathBuf,
    pub config: Config,
}

/// Where secret keys live: `$OXY_HOME/keys`, else `$XDG_CONFIG_HOME/oxy/keys`,
/// else `~/.config/oxy/keys`.
pub fn default_keys_dir() -> PathBuf {
    if let Ok(h) = std::env::var("OXY_HOME") {
        return PathBuf::from(h).join("keys");
    }
    if let Ok(x) = std::env::var("XDG_CONFIG_HOME") {
        return PathBuf::from(x).join("oxy").join("keys");
    }
    let home = std::env::var("HOME").unwrap_or_else(|_| ".".into());
    PathBuf::from(home).join(".config").join("oxy").join("keys")
}

/// Outcome of verifying the signatures on a change (spec §14.3, §14.4).
#[derive(Clone, Debug, PartialEq, Eq)]
pub enum SignatureStatus {
    Unsigned,
    Valid { key: KeyId, name: String, email: String },
    Invalid(String),
}

pub fn is_binary(content: &[u8]) -> bool {
    content[..content.len().min(BINARY_SNIFF)].contains(&0)
}

impl Repo {
    // ------------------------------------------------------------ lifecycle

    pub fn init(root: &Path) -> Result<Repo> {
        let root = root.canonicalize().unwrap_or_else(|_| root.to_path_buf());
        let oxy = root.join(OXY_DIR);
        if oxy.exists() {
            return fail(format!("{} is already an oxy repository", root.display()));
        }
        fs::create_dir_all(oxy.join("ops"))?;
        write_atomic(&oxy.join("format"), FORMAT_LINE.as_bytes())?;
        let config = Config::default_for_user();
        config.save(&oxy.join("config"))?;
        let workspace = WorkspaceId::random();
        write_atomic(&oxy.join("workspace"), workspace.to_hex().as_bytes())?;
        let store = Store::open(oxy.join("objects"))?;
        let repo = Repo { root, oxy, store, workspace, keys_dir: default_keys_dir(), config };

        let wc = repo.new_working_copy(vec![], "");
        let wc_hash = repo.store.put_change(&wc)?;
        let mut view = View::default();
        view.bookmarks.insert(repo.config.bookmark.clone(), vec![]);
        view.workspaces.insert(workspace, wc_hash);
        repo.record_op(&[], "oxy init", view)?;
        Ok(repo)
    }

    /// Open the repository containing `start` (searching upwards).
    pub fn open(start: &Path) -> Result<Repo> {
        let start = start.canonicalize()?;
        let mut dir: Option<&Path> = Some(&start);
        while let Some(d) = dir {
            let oxy = d.join(OXY_DIR);
            if oxy.is_dir() {
                let format = fs::read_to_string(oxy.join("format"))?;
                if format != FORMAT_LINE {
                    return fail(format!("unsupported repository format: {}", format.trim()));
                }
                let config = Config::load(&oxy.join("config"))?;
                let workspace = WorkspaceId::from_hex(fs::read_to_string(oxy.join("workspace"))?.trim())
                    .ok_or_else(|| RepoError::Msg("corrupt .oxy/workspace".into()))?;
                let store = Store::open(oxy.join("objects"))?;
                return Ok(Repo { root: d.to_path_buf(), oxy, store, workspace, keys_dir: default_keys_dir(), config });
            }
            dir = d.parent();
        }
        fail(format!("no oxy repository found at or above {}", start.display()))
    }

    pub fn root(&self) -> &Path {
        &self.root
    }
    pub fn store(&self) -> &Store {
        &self.store
    }
    pub fn workspace(&self) -> WorkspaceId {
        self.workspace
    }

    /// Use a different secret key directory (tests, or `--keys-dir`).
    pub fn with_keys_dir(mut self, dir: impl Into<PathBuf>) -> Repo {
        self.keys_dir = dir.into();
        self
    }

    pub fn save_config(&self) -> Result<()> {
        self.config.save(&self.oxy.join("config"))
    }

    fn author(&self) -> KeyId {
        self.config.author_key.unwrap_or(ObjectRef::ZERO)
    }

    // ------------------------------------------------------------ identity

    /// Generate a composite key pair, store its identity object, keep the
    /// secret in the key directory, and make it this repository's author.
    pub fn create_identity(&mut self, name: &str, email: &str) -> Result<(KeyId, Identity)> {
        let sk = SecretKey::generate();
        let id = sk.identity(name, email, Hlc::now().wall_ms);
        let key = self.store.put_identity(&id)?;
        fs::create_dir_all(&self.keys_dir)?;
        let path = self.keys_dir.join(format!("{}.secret", key.to_hex()));
        write_atomic(&path, &sk.encode(&key))?;
        #[cfg(unix)]
        {
            use std::os::unix::fs::PermissionsExt;
            fs::set_permissions(&path, fs::Permissions::from_mode(0o600))?;
        }
        self.config.author_name = name.into();
        self.config.author_email = email.into();
        self.config.author_key = Some(key);
        self.save_config()?;
        Ok((key, id))
    }

    /// The secret key for `author.key`, if configured and present on disk.
    pub fn secret_key(&self) -> Result<Option<(KeyId, SecretKey)>> {
        let Some(key) = self.config.author_key else { return Ok(None) };
        let path = self.keys_dir.join(format!("{}.secret", key.to_hex()));
        match fs::read(&path) {
            Ok(b) => {
                let (k, sk) = SecretKey::decode(&b)?;
                if k != key {
                    return fail(format!("{} holds a different key than its name", path.display()));
                }
                Ok(Some((k, sk)))
            }
            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
            Err(e) => Err(e.into()),
        }
    }

    pub fn identity(&self, key: &KeyId) -> Result<Identity> {
        Ok(self.store.get_identity(key)?)
    }

    /// Sign a stored change with the configured secret key.
    pub fn sign_change(&self, hash: &ChangeHash) -> Result<Signature> {
        let Some((key, sk)) = self.secret_key()? else {
            return fail("no secret key: run `oxy identity create` first");
        };
        let sig = sk.sign(Domain::Change, &key, hash);
        self.store.put_signature(hash, &sig)?;
        Ok(sig)
    }

    /// Check the signatures on a change against the author-or-delegate rule.
    pub fn verify_change(&self, hash: &ChangeHash) -> Result<SignatureStatus> {
        let change = self.store.get_change(hash)?;
        let sigs = self.store.signatures(hash)?;
        if sigs.is_empty() {
            return Ok(SignatureStatus::Unsigned);
        }
        let mut last_err = String::new();
        for sig in &sigs {
            let id = match self.store.get_identity(&sig.key) {
                Ok(id) => id,
                Err(_) => {
                    last_err = format!("unknown key {}", sig.key.short(12));
                    continue;
                }
            };
            let authorised = sig.key == change.author
                || self.store.get_identity(&change.author).map(|a| a.delegates.contains(&sig.key)).unwrap_or(false);
            if !authorised {
                last_err = format!("key {} is neither the author nor a delegate", sig.key.short(12));
                continue;
            }
            match identity::verify(&id, sig, Domain::Change, hash) {
                Ok(()) => return Ok(SignatureStatus::Valid { key: sig.key, name: id.name, email: id.email }),
                Err(e) => last_err = e.to_string(),
            }
        }
        Ok(SignatureStatus::Invalid(last_err))
    }

    fn new_working_copy(&self, deps: Vec<ChangeHash>, message: &str) -> Change {
        let mut c = Change {
            change_id: ChangeId::random(),
            deps,
            author: self.author(),
            hlc: Hlc::now(),
            message: message.into(),
            tree_ops: vec![],
            edits: vec![],
            kind: ChangeKind::WorkingCopy,
        };
        c.normalize();
        c
    }

    // ------------------------------------------------------------ operation log

    pub fn head_op(&self) -> Result<(ObjectRef, Op)> {
        let hex = fs::read_to_string(self.oxy.join("ops").join("head"))?;
        let r = ObjectRef::from_hex(hex.trim()).ok_or_else(|| RepoError::Msg("corrupt .oxy/ops/head".into()))?;
        let op = Op::decode(&self.store.get_typed(&r, ObjectType::Op)?)?;
        Ok((r, op))
    }

    pub fn view(&self) -> Result<View> {
        Ok(self.head_op()?.1.view)
    }

    fn record_op(&self, parents: &[ObjectRef], command: &str, view: View) -> Result<ObjectRef> {
        let op = Op { parents: parents.to_vec(), hlc: Hlc::now(), command: command.into(), view };
        let r = self.store.put(ObjectType::Op, &op.encode())?;
        write_atomic(&self.oxy.join("ops").join("head"), r.to_hex().as_bytes())?;
        Ok(r)
    }

    pub fn op_log(&self) -> Result<Vec<(ObjectRef, Op)>> {
        let mut out = Vec::new();
        let (mut r, mut op) = self.head_op()?;
        loop {
            let next = op.parents.first().copied();
            out.push((r, op));
            match next {
                Some(p) => {
                    r = p;
                    op = Op::decode(&self.store.get_typed(&r, ObjectType::Op)?)?;
                }
                None => break,
            }
        }
        Ok(out)
    }

    /// Undo the last user command (spec §12.1). Operations that only recorded
    /// a working-copy snapshot are skipped, since the files are still on disk
    /// and the next snapshot recreates them.
    pub fn undo(&self) -> Result<Op> {
        let (_, mut op) = self.head_op()?;
        while op.is_snapshot() {
            let Some(parent) = op.parents.first() else { break };
            op = Op::decode(&self.store.get_typed(parent, ObjectType::Op)?)?;
        }
        let Some(parent) = op.parents.first() else {
            return fail("nothing to undo");
        };
        let parent_op = Op::decode(&self.store.get_typed(parent, ObjectType::Op)?)?;
        write_atomic(&self.oxy.join("ops").join("head"), parent.to_hex().as_bytes())?;
        Ok(parent_op)
    }

    /// The last operation that was not a snapshot.
    pub fn last_command(&self) -> Result<Op> {
        let (_, mut op) = self.head_op()?;
        while op.is_snapshot() {
            let Some(parent) = op.parents.first() else { break };
            op = Op::decode(&self.store.get_typed(parent, ObjectType::Op)?)?;
        }
        Ok(op)
    }

    // ------------------------------------------------------------ states

    /// Load the dependency closure of `heads` from the store.
    pub fn load_state(&self, heads: &[ChangeHash]) -> Result<State> {
        let mut state = State::new();
        let mut stack: Vec<ChangeHash> = heads.to_vec();
        let mut seen: BTreeSet<ChangeHash> = BTreeSet::new();
        while let Some(h) = stack.pop() {
            if !seen.insert(h) {
                continue;
            }
            let c = self.store.get_change(&h)?;
            stack.extend(c.deps.iter().copied());
            state.add_unchecked(c);
        }
        state.validate()?;
        Ok(state)
    }

    pub fn working_copy(&self) -> Result<(ChangeHash, Change)> {
        let view = self.view()?;
        let h = *view
            .workspaces
            .get(&self.workspace)
            .ok_or_else(|| RepoError::Msg("this workspace is not in the current view".into()))?;
        Ok((h, self.store.get_change(&h)?))
    }

    pub fn bookmark_heads(&self) -> Result<Vec<ChangeHash>> {
        Ok(self.view()?.bookmarks.get(&self.config.bookmark).cloned().unwrap_or_default())
    }

    // ------------------------------------------------------------ blobs

    fn blob_for(content: &[u8]) -> Blob {
        Blob {
            length: content.len() as u64,
            chunks: crate::chunk::chunks(content).into_iter().map(|c| hash_object(ObjectType::Chunk, c)).collect(),
        }
    }

    pub fn blob_ref(content: &[u8]) -> ObjectRef {
        Self::blob_for(content).hash()
    }

    pub fn store_blob(&self, content: &[u8]) -> Result<ObjectRef> {
        for c in crate::chunk::chunks(content) {
            self.store.put_chunk(c)?;
        }
        Ok(self.store.put(ObjectType::Blob, &Self::blob_for(content).encode())?)
    }

    pub fn read_blob(&self, r: &ObjectRef) -> Result<Vec<u8>> {
        let blob = Blob::decode(&self.store.get_typed(r, ObjectType::Blob)?)?;
        let mut out = Vec::with_capacity(blob.length as usize);
        for c in &blob.chunks {
            out.extend(self.store.get_typed(c, ObjectType::Chunk)?);
        }
        Ok(out)
    }

    // ------------------------------------------------------------ working copy

    fn walk_working_copy(&self) -> Result<BTreeMap<String, FsEntry>> {
        let mut wb = ignore::WalkBuilder::new(&self.root);
        wb.hidden(false)
            .git_ignore(false)
            .git_global(false)
            .git_exclude(false)
            .require_git(false)
            .follow_links(false)
            .add_custom_ignore_filename(".oxyignore");
        wb.filter_entry(|e| e.file_name() != OXY_DIR);
        let mut out = BTreeMap::new();
        for entry in wb.build() {
            let entry = entry.map_err(|e| RepoError::Msg(e.to_string()))?;
            let path = entry.path();
            if path == self.root {
                continue;
            }
            let rel = path.strip_prefix(&self.root).unwrap();
            let rel: String = rel.components().map(|c| c.as_os_str().to_string_lossy().to_string()).collect::<Vec<_>>().join("/");
            let Some(ft) = entry.file_type() else { continue };
            if ft.is_dir() {
                continue;
            }
            if ft.is_symlink() {
                let target = fs::read_link(path)?;
                out.insert(rel, FsEntry { kind: NodeKind::Symlink, exec: false, content: target.to_string_lossy().as_bytes().to_vec() });
            } else if ft.is_file() {
                let exec = is_executable(&entry.metadata().map_err(|e| RepoError::Msg(e.to_string()))?);
                out.insert(rel, FsEntry { kind: NodeKind::File, exec, content: fs::read(path)? });
            }
        }
        Ok(out)
    }

    /// Snapshot the working copy into the working-copy change (spec §12.3).
    pub fn snapshot(&self, command: &str) -> Result<SnapshotResult> {
        let (op_ref, op) = self.head_op()?;
        let (old_hash, old_wc) = self.working_copy()?;
        let base = self.load_state(&old_wc.deps)?;
        let base_snapshot = base.materialize();
        let fs_entries = self.walk_working_copy()?;

        // Reuse the NodeIds the previous working-copy version assigned to new
        // paths, so an unchanged working copy hashes identically (spec §12.3).
        let reuse = added_node_paths(&old_wc, &base_snapshot);
        let mut b = ChangeBuilder::new(&base, &base_snapshot, reuse);
        for (path, fs_entry) in &fs_entries {
            match base_snapshot.files.get(path) {
                None => b.add_path(self, path, fs_entry)?,
                Some(expected) => b.update_path(self, path, fs_entry, expected)?,
            }
        }
        for (path, expected) in &base_snapshot.files {
            if fs_entries.contains_key(path) {
                continue;
            }
            let still_needed = expected.kind == NodeKind::Dir && fs_entries.keys().any(|p| p.starts_with(&format!("{path}/")));
            if !still_needed {
                b.remove_path(path, expected);
            }
        }

        let mut wc = Change {
            change_id: old_wc.change_id,
            deps: vec![],
            author: self.author(),
            hlc: old_wc.hlc,
            message: old_wc.message.clone(),
            tree_ops: b.tree_ops,
            edits: b.edits,
            kind: ChangeKind::WorkingCopy,
        };
        let base_heads = base.maximal(&old_wc.deps);
        let mut deps: BTreeSet<ChangeHash> = base_heads.into_iter().collect();
        deps.extend(referenced_changes(&wc, &base));
        deps.extend(b.contributors.iter().copied());
        wc.deps = deps.into_iter().collect();
        wc.normalize();
        let resolves = b.resolves;

        let mut statuses = b.statuses;
        statuses.sort_by(|a, b| a.path.cmp(&b.path));
        // Empty snapshot: hash the candidate before storing; only record an op on change.
        let new_hash = wc.hash();
        let changed = new_hash != old_hash;
        if changed {
            self.store.put_change(&wc)?;
            let mut view = op.view.clone();
            view.workspaces.insert(self.workspace, new_hash);
            self.record_op(&[op_ref], &format!("{command}{SNAPSHOT_SUFFIX}"), view)?;
        }
        Ok(SnapshotResult { wc_hash: new_hash, wc, base, base_snapshot, statuses, changed, resolves })
    }

    /// Turn the working-copy change into a normal change on the bookmark (spec §12.3).
    pub fn commit(&self, message: &str, extra_deps: &[ChangeHash]) -> Result<ChangeHash> {
        let snap = self.snapshot("oxy commit")?;
        if snap.wc.tree_ops.is_empty() && snap.wc.edits.is_empty() {
            return fail("nothing to commit: the working copy matches its base");
        }
        if let Some(s) = snap.statuses.iter().find(|s| s.status == ChangeStatus::ConflictEdited) {
            return fail(format!("{} still contains conflict markers", s.path));
        }
        if message.trim().is_empty() {
            return fail("a commit message is required");
        }
        let (op_ref, op) = self.head_op()?;
        let mut deps: BTreeSet<ChangeHash> = referenced_changes(&snap.wc, &snap.base);
        if snap.resolves {
            // A resolution depends on every change that contributed to the
            // conflict (spec §8.1); those are already among the working copy's
            // dependencies, so keep every one that is not merely a base head.
            let heads: BTreeSet<ChangeHash> = snap.base.maximal(&snap.wc.deps).into_iter().collect();
            deps.extend(snap.wc.deps.iter().filter(|d| !heads.contains(d) || touches_conflict(&snap)).copied());
        }
        for d in extra_deps {
            if !snap.base.contains(d) {
                return fail(format!("--depends-on {d}: not in the working copy's base state"));
            }
            deps.insert(*d);
        }
        if self.config.sign_changes && self.secret_key()?.is_none() {
            return fail("core.sign is \"change\" but no secret key is available for author.key");
        }
        let mut change = Change {
            change_id: snap.wc.change_id,
            deps: deps.into_iter().collect(),
            author: self.author(),
            hlc: Hlc::now(),
            message: message.trim_end().to_string(),
            tree_ops: snap.wc.tree_ops.clone(),
            edits: snap.wc.edits.clone(),
            kind: if snap.resolves { ChangeKind::Resolution } else { ChangeKind::Normal },
        };
        change.normalize();
        let hash = self.store.put_change(&change)?;
        if self.config.sign_changes {
            self.sign_change(&hash)?;
        }

        // New bookmark heads: maximal elements of old heads plus the new change.
        // The working copy continues on its own base plus the new change, which
        // is exactly what the files on disk contain; the bookmark may hold
        // other heads (and conflicts) the working copy has not checked out.
        let old_heads = op.view.bookmarks.get(&self.config.bookmark).cloned().unwrap_or_default();
        let old_base = snap.base.maximal(&snap.wc.deps);
        let mut all: Vec<ChangeHash> = old_heads.clone();
        all.extend(old_base.iter().copied());
        all.push(hash);
        let mut st = self.load_state(&all)?;
        st.add(change)?;
        let mut with_new = old_heads.clone();
        with_new.push(hash);
        let new_heads = st.maximal(&with_new);
        let mut wc_base = old_base.clone();
        wc_base.push(hash);
        let wc_base = st.maximal(&wc_base);

        let wc = self.new_working_copy(wc_base, "");
        let wc_hash = self.store.put_change(&wc)?;
        let mut view = op.view.clone();
        view.bookmarks.insert(self.config.bookmark.clone(), new_heads);
        view.workspaces.insert(self.workspace, wc_hash);
        self.record_op(&[op_ref], &format!("oxy commit -m {message:?}"), view)?;
        Ok(hash)
    }

    /// Move the working copy to the state whose heads are `heads` (spec §12.3):
    /// the working directory is rewritten to that state and a fresh
    /// working-copy change is started on it. The bookmark does not move.
    pub fn checkout(&self, heads: &[ChangeHash], discard: bool, command: &str) -> Result<CheckoutReport> {
        let snap = self.snapshot(command)?;
        if !discard && (!snap.wc.tree_ops.is_empty() || !snap.wc.edits.is_empty()) {
            return fail("the working copy has changes; commit them first or pass --discard");
        }
        let target_state = self.load_state(heads)?;
        let heads = target_state.maximal(heads);
        let target = target_state.materialize();
        let current = self.walk_working_copy()?;
        let mut report = CheckoutReport::default();

        // Remove tracked paths that the target does not have.
        let mut dirs_to_prune: BTreeSet<PathBuf> = BTreeSet::new();
        for path in current.keys() {
            if !target.files.contains_key(path) {
                let full = self.safe_path(path)?;
                fs::remove_file(&full)?;
                report.removed += 1;
                if let Some(parent) = full.parent() {
                    dirs_to_prune.insert(parent.to_path_buf());
                }
            }
        }
        // Write target files that differ.
        for (path, f) in &target.files {
            match &f.content {
                FileContent::Dir => continue,
                FileContent::Text { bytes, .. } => {
                    let same = current.get(path).is_some_and(|c| c.kind == NodeKind::File && &c.content == bytes && c.exec == f.mode.exec);
                    if !same {
                        self.write_file(path, bytes, f.mode.exec)?;
                        report.written += 1;
                    }
                }
                FileContent::Opaque { blobs } => {
                    let Some(blob) = blobs.first() else { continue };
                    let bytes = self.read_blob(blob)?;
                    if f.kind == NodeKind::Symlink {
                        let same = current.get(path).is_some_and(|c| c.kind == NodeKind::Symlink && c.content == bytes);
                        if !same {
                            self.write_symlink(path, &bytes)?;
                            report.written += 1;
                        }
                    } else {
                        let same = current.get(path).is_some_and(|c| c.kind == NodeKind::File && c.content == bytes && c.exec == f.mode.exec);
                        if !same {
                            self.write_file(path, &bytes, f.mode.exec)?;
                            report.written += 1;
                        }
                    }
                    if blobs.len() > 1 {
                        for (i, b) in blobs.iter().enumerate().skip(1) {
                            self.write_file(&format!("{path}.oxy-conflict-{}", i + 1), &self.read_blob(b)?, f.mode.exec)?;
                        }
                    }
                }
            }
        }
        // Prune directories left empty, deepest first.
        for d in dirs_to_prune.iter().rev() {
            let mut d = d.clone();
            while d != self.root && fs::read_dir(&d).map(|mut i| i.next().is_none()).unwrap_or(false) {
                fs::remove_dir(&d)?;
                let Some(p) = d.parent() else { break };
                d = p.to_path_buf();
            }
        }

        let (op_ref, op) = self.head_op()?;
        let wc = self.new_working_copy(heads, "");
        let wc_hash = self.store.put_change(&wc)?;
        let mut view = op.view.clone();
        view.workspaces.insert(self.workspace, wc_hash);
        self.record_op(&[op_ref], command, view)?;
        report.conflicted = target.is_conflicted();
        Ok(report)
    }

    /// The absolute path for a repository path, refusing anything that would
    /// escape the workspace or write through a symlink (spec §7.7).
    fn safe_path(&self, rel: &str) -> Result<PathBuf> {
        let mut full = self.root.clone();
        let comps: Vec<&str> = rel.split('/').collect();
        for (i, comp) in comps.iter().enumerate() {
            if comp.is_empty() || *comp == "." || *comp == ".." || comp.contains('\\') {
                return fail(format!("refusing unsafe path {rel:?}"));
            }
            if i == 0 && *comp == OXY_DIR {
                return fail(format!("refusing to write inside {OXY_DIR}: {rel:?}"));
            }
            if i + 1 < comps.len() {
                full.push(comp);
                if let Ok(m) = fs::symlink_metadata(&full) {
                    if m.file_type().is_symlink() {
                        return fail(format!("refusing to write through symlink {}", full.display()));
                    }
                }
            } else {
                full.push(comp);
            }
        }
        Ok(full)
    }

    fn write_file(&self, rel: &str, bytes: &[u8], exec: bool) -> Result<()> {
        let full = self.safe_path(rel)?;
        if let Some(parent) = full.parent() {
            fs::create_dir_all(parent)?;
        }
        if fs::symlink_metadata(&full).is_ok_and(|m| m.file_type().is_symlink() || m.is_dir()) {
            remove_any(&full)?;
        }
        fs::write(&full, bytes)?;
        set_executable(&full, exec)?;
        Ok(())
    }

    fn write_symlink(&self, rel: &str, target: &[u8]) -> Result<()> {
        let full = self.safe_path(rel)?;
        if let Some(parent) = full.parent() {
            fs::create_dir_all(parent)?;
        }
        if fs::symlink_metadata(&full).is_ok() {
            remove_any(&full)?;
        }
        #[cfg(unix)]
        {
            std::os::unix::fs::symlink(String::from_utf8_lossy(target).as_ref(), &full)?;
            Ok(())
        }
        #[cfg(not(unix))]
        {
            // Spec §7.7: without symlink support, write the target as a plain file.
            fs::write(&full, target)?;
            Ok(())
        }
    }

    /// Changes reachable from the bookmark and the working copy, newest first.
    pub fn log(&self) -> Result<Vec<LogEntry>> {
        let (wc_hash, _) = self.working_copy()?;
        let mut heads = self.bookmark_heads()?;
        heads.push(wc_hash);
        let state = self.load_state(&heads)?;
        let head_set: BTreeSet<ChangeHash> = self.bookmark_heads()?.into_iter().collect();
        let mut entries: Vec<LogEntry> = state
            .changes()
            .map(|(h, c)| LogEntry { hash: *h, change: c.clone(), is_working_copy: *h == wc_hash, is_head: head_set.contains(h) })
            .collect();
        entries.sort_by(|a, b| b.is_working_copy.cmp(&a.is_working_copy).then(b.change.hlc.cmp(&a.change.hlc)).then(b.hash.cmp(&a.hash)));
        Ok(entries)
    }

    /// Resolve a change by ChangeId prefix, `#hash` prefix, `@` (working copy), or bookmark.
    pub fn resolve_change(&self, spec: &str) -> Result<ChangeHash> {
        if spec == "@" {
            return Ok(self.working_copy()?.0);
        }
        if spec.is_empty() || spec == "#" {
            return fail("empty change specifier");
        }
        let entries = self.log()?;
        let matches: Vec<&LogEntry> = if let Some(hp) = spec.strip_prefix('#') {
            entries.iter().filter(|e| e.hash.starts_with_hex(hp)).collect()
        } else {
            entries.iter().filter(|e| e.change.change_id.starts_with_hex(spec)).collect()
        };
        match matches.len() {
            1 => Ok(matches[0].hash),
            0 => fail(format!("no change matches {spec:?}")),
            _ => {
                let ids: BTreeSet<ChangeId> = matches.iter().map(|e| e.change.change_id).collect();
                if ids.len() == 1 {
                    fail(format!("change {spec} is divergent: {} variants", matches.len()))
                } else {
                    fail(format!("{spec:?} is ambiguous"))
                }
            }
        }
    }

    /// Human-readable description of what a change does, with line content.
    pub fn describe_change(&self, hash: &ChangeHash) -> Result<String> {
        let change = self.store.get_change(hash)?;
        let base = self.load_state(&change.deps)?;
        let base_snapshot = base.materialize();
        Ok(render_change(&change, &base, &base_snapshot))
    }
}

#[derive(Debug, Default, Clone, PartialEq, Eq)]
pub struct CheckoutReport {
    pub written: usize,
    pub removed: usize,
    pub conflicted: bool,
}

fn remove_any(path: &Path) -> std::io::Result<()> {
    let m = fs::symlink_metadata(path)?;
    if m.is_dir() { fs::remove_dir_all(path) } else { fs::remove_file(path) }
}

#[cfg(unix)]
fn set_executable(path: &Path, exec: bool) -> std::io::Result<()> {
    use std::os::unix::fs::PermissionsExt;
    let mut perms = fs::metadata(path)?.permissions();
    let mode = perms.mode();
    let want = if exec { mode | 0o111 } else { mode & !0o111 };
    if want != mode {
        perms.set_mode(want);
        fs::set_permissions(path, perms)?;
    }
    Ok(())
}
#[cfg(not(unix))]
fn set_executable(_path: &Path, _exec: bool) -> std::io::Result<()> {
    Ok(())
}

#[cfg(unix)]
fn is_executable(m: &fs::Metadata) -> bool {
    use std::os::unix::fs::PermissionsExt;
    m.permissions().mode() & 0o111 != 0
}
#[cfg(not(unix))]
fn is_executable(_m: &fs::Metadata) -> bool {
    false
}

fn op_ref(k: OpKey) -> OpRef {
    OpRef { change: k.0, index: k.1 }
}

fn split_path(path: &str) -> (&str, &str) {
    match path.rfind('/') {
        Some(i) => (&path[..i], &path[i + 1..]),
        None => ("", path),
    }
}

/// Builds the tree ops and edits of a working-copy change against a base.
struct ChangeBuilder<'a> {
    base: &'a State,
    base_snapshot: &'a Snapshot,
    tree_ops: Vec<TreeOp>,
    edits: Vec<Edit>,
    statuses: Vec<PathStatus>,
    dir_nodes: HashMap<String, NodeId>,
    reuse: HashMap<String, (NodeId, NodeKind)>,
    /// Changes that contributed to conflicts this working copy resolves.
    contributors: BTreeSet<ChangeHash>,
    resolves: bool,
}

impl<'a> ChangeBuilder<'a> {
    fn new(base: &'a State, base_snapshot: &'a Snapshot, reuse: HashMap<String, (NodeId, NodeKind)>) -> Self {
        let mut dir_nodes: HashMap<String, NodeId> = HashMap::new();
        dir_nodes.insert(String::new(), NodeId::ROOT);
        for (p, f) in &base_snapshot.files {
            if f.kind == NodeKind::Dir {
                dir_nodes.insert(p.clone(), f.node);
            }
        }
        ChangeBuilder { base, base_snapshot, tree_ops: vec![], edits: vec![], statuses: vec![], dir_nodes, reuse, contributors: BTreeSet::new(), resolves: false }
    }

    fn reused_node(&self, path: &str, kind: NodeKind) -> Option<NodeId> {
        self.reuse.get(path).filter(|(_, k)| *k == kind).map(|(n, _)| *n)
    }

    fn ensure_dir(&mut self, path: &str) -> NodeId {
        if let Some(n) = self.dir_nodes.get(path) {
            return *n;
        }
        let mut parent = NodeId::ROOT;
        let mut prefix = String::new();
        for comp in path.split('/') {
            if !prefix.is_empty() {
                prefix.push('/');
            }
            prefix.push_str(comp);
            parent = match self.dir_nodes.get(&prefix) {
                Some(n) => *n,
                None => {
                    let node = self.reused_node(&prefix, NodeKind::Dir).unwrap_or_else(NodeId::random);
                    self.tree_ops.push(TreeOp::AddNode { node, kind: NodeKind::Dir, mode: Mode::default(), parent, name: comp.to_string() });
                    self.dir_nodes.insert(prefix.clone(), node);
                    node
                }
            };
        }
        parent
    }

    fn add_path(&mut self, repo: &Repo, path: &str, e: &FsEntry) -> Result<()> {
        let (dir, name) = split_path(path);
        let parent = self.ensure_dir(dir);
        let node = self.reused_node(path, e.kind).unwrap_or_else(NodeId::random);
        let opaque = e.kind == NodeKind::Symlink || is_binary(&e.content);
        self.tree_ops.push(TreeOp::AddNode { node, kind: e.kind, mode: Mode { exec: e.exec, opaque }, parent, name: name.to_string() });
        if opaque {
            let blob = repo.store_blob(&e.content)?;
            self.edits.push(Edit::Replace { node, old: None, new: Some(blob) });
        } else if !e.content.is_empty() {
            self.edits.push(Edit::Insert {
                node,
                after: crate::objects::AtomRef::Start,
                before: crate::objects::AtomRef::End,
                lines: split_lines(&e.content).iter().map(|l| l.to_vec()).collect(),
            });
        }
        self.statuses.push(PathStatus { path: path.to_string(), status: ChangeStatus::Added });
        Ok(())
    }

    fn remove_path(&mut self, path: &str, expected: &crate::state::FileState) {
        let entry = &self.base_snapshot.tree.entries[path];
        self.tree_ops.push(TreeOp::RemoveNode { node: expected.node, placement: op_ref(entry.placement) });
        if path.contains(".oxy-conflict-") || expected.is_conflicted() {
            self.resolves = true;
        }
        self.statuses.push(PathStatus { path: path.to_string(), status: ChangeStatus::Removed });
    }

    fn update_path(&mut self, repo: &Repo, path: &str, e: &FsEntry, expected: &crate::state::FileState) -> Result<()> {
        if expected.kind != e.kind {
            self.remove_path(path, expected);
            self.statuses.pop();
            self.add_path(repo, path, e)?;
            self.statuses.pop();
            self.statuses.push(PathStatus { path: path.to_string(), status: ChangeStatus::Modified });
            return Ok(());
        }
        let entry = &self.base_snapshot.tree.entries[path];
        let node = expected.node;
        let mode_atom = entry.mode_atom.map(op_ref);
        let mut status: Option<ChangeStatus> = None;
        match &expected.content {
            FileContent::Dir => {}
            FileContent::Text { bytes, materialized } => {
                if materialized.is_conflicted() {
                    if bytes == &e.content {
                        return Ok(());
                    }
                    if has_conflict_markers(&e.content) {
                        self.statuses.push(PathStatus { path: path.to_string(), status: ChangeStatus::ConflictEdited });
                        return Ok(());
                    }
                    // Resolution (spec §9.6): diff against the unconflicted lines
                    // with each region as a gap, then retire every region atom.
                    // Whatever the author kept from a region is re-inserted as
                    // new atoms, which leaves the graph totally ordered.
                    let regions = self.base.conflict_regions(&node);
                    let mut edits = text_edits(node, &regions.plain, &e.content);
                    if !regions.region_atoms.is_empty() {
                        edits.insert(0, Edit::Delete { node, atoms: ranges(&regions.region_atoms) });
                    }
                    self.edits.extend(edits);
                    self.contributors.extend(regions.contributors);
                    self.resolves = true;
                    if e.exec != expected.mode.exec {
                        if let Some(old) = mode_atom {
                            self.tree_ops.push(TreeOp::SetMode { node, old, mode: Mode { exec: e.exec, opaque: false } });
                        }
                    }
                    self.statuses.push(PathStatus { path: path.to_string(), status: ChangeStatus::Resolved });
                    return Ok(());
                }
                if bytes != &e.content {
                    if is_binary(&e.content) {
                        // Text → opaque (spec §7.5).
                        if let Some(old) = mode_atom {
                            self.tree_ops.push(TreeOp::SetMode { node, old, mode: Mode { exec: e.exec, opaque: true } });
                        }
                        let live: Vec<_> = repo_live_keys(self.base, &node);
                        if !live.is_empty() {
                            self.edits.push(Edit::Delete { node, atoms: ranges(&live) });
                        }
                        let blob = repo.store_blob(&e.content)?;
                        self.edits.push(Edit::Replace { node, old: None, new: Some(blob) });
                        status = Some(ChangeStatus::Modified);
                    } else {
                        let old = self.base.live_lines(&node);
                        let edits = text_edits(node, &old, &e.content);
                        if !edits.is_empty() {
                            self.edits.extend(edits);
                            status = Some(ChangeStatus::Modified);
                        }
                    }
                }
                let switched_to_opaque = status == Some(ChangeStatus::Modified) && is_binary(&e.content);
                if !switched_to_opaque && e.exec != expected.mode.exec {
                    if let Some(old) = mode_atom {
                        self.tree_ops.push(TreeOp::SetMode { node, old, mode: Mode { exec: e.exec, opaque: false } });
                        status.get_or_insert(ChangeStatus::ModeChanged);
                    }
                }
            }
            FileContent::Opaque { blobs } => {
                let new_ref = Repo::blob_ref(&e.content);
                if blobs.len() > 1 {
                    if !blobs.contains(&new_ref) {
                        self.statuses.push(PathStatus { path: path.to_string(), status: ChangeStatus::ConflictEdited });
                    }
                    return Ok(());
                }
                let current = blobs.first().copied();
                if current != Some(new_ref) {
                    if e.kind == NodeKind::File && !is_binary(&e.content) {
                        // Opaque → text (spec §7.5).
                        if let Some(old) = mode_atom {
                            self.tree_ops.push(TreeOp::SetMode { node, old, mode: Mode { exec: e.exec, opaque: false } });
                        }
                        self.edits.push(Edit::Replace { node, old: current, new: None });
                        if !e.content.is_empty() {
                            self.edits.push(Edit::Insert {
                                node,
                                after: crate::objects::AtomRef::Start,
                                before: crate::objects::AtomRef::End,
                                lines: split_lines(&e.content).iter().map(|l| l.to_vec()).collect(),
                            });
                        }
                    } else {
                        let blob = repo.store_blob(&e.content)?;
                        self.edits.push(Edit::Replace { node, old: current, new: Some(blob) });
                    }
                    status = Some(ChangeStatus::Modified);
                } else if e.kind == NodeKind::File && e.exec != expected.mode.exec {
                    if let Some(old) = mode_atom {
                        self.tree_ops.push(TreeOp::SetMode { node, old, mode: Mode { exec: e.exec, opaque: true } });
                        status = Some(ChangeStatus::ModeChanged);
                    }
                }
            }
        }
        if let Some(s) = status {
            self.statuses.push(PathStatus { path: path.to_string(), status: s });
        }
        Ok(())
    }
}

/// Whether a working copy touches a node that is conflicted in its base.
fn touches_conflict(snap: &SnapshotResult) -> bool {
    let conflicted: BTreeSet<NodeId> = snap.base_snapshot.files.values().filter(|f| f.is_conflicted()).map(|f| f.node).collect();
    snap.wc.tree_ops.iter().any(|op| conflicted.contains(&op.node())) || snap.wc.edits.iter().any(|e| conflicted.contains(&e.node()))
}

fn repo_live_keys(base: &State, node: &NodeId) -> Vec<crate::graph::AtomKey> {
    base.live_lines(node).into_iter().map(|(k, _)| k).collect()
}

/// The changes a change's scope references (spec §8.1): introducers of every
/// atom, placement, and mode it touches, and of every node it operates on.
pub fn referenced_changes(change: &Change, base: &State) -> BTreeSet<ChangeHash> {
    let mut out = BTreeSet::new();
    let opref = |r: &OpRef, out: &mut BTreeSet<ChangeHash>| {
        if !r.change.is_zero() {
            out.insert(r.change);
        }
    };
    let mut nodes: Vec<NodeId> = Vec::new();
    for op in &change.tree_ops {
        match op {
            TreeOp::AddNode { parent, .. } => nodes.push(*parent),
            TreeOp::RemoveNode { node, placement } => {
                nodes.push(*node);
                opref(placement, &mut out);
            }
            TreeOp::Move { node, old, parent, .. } => {
                nodes.push(*node);
                nodes.push(*parent);
                opref(old, &mut out);
            }
            TreeOp::SetMode { node, old, .. } => {
                nodes.push(*node);
                opref(old, &mut out);
            }
        }
    }
    for e in &change.edits {
        nodes.push(e.node());
        match e {
            Edit::Insert { after, before, .. } => {
                for r in [after, before] {
                    if let crate::objects::AtomRef::Atom { change, .. } = r {
                        if !change.is_zero() {
                            out.insert(*change);
                        }
                    }
                }
            }
            Edit::Delete { atoms, .. } => {
                for r in atoms {
                    if !r.change.is_zero() {
                        out.insert(r.change);
                    }
                }
            }
            Edit::Replace { .. } => {}
        }
    }
    for n in nodes {
        if let Some(h) = base.tree().introducer(&n) {
            out.insert(h);
        }
    }
    out
}

/// Paths of the nodes a change adds on top of `base_snapshot`.
pub fn added_node_paths(change: &Change, base_snapshot: &Snapshot) -> HashMap<String, (NodeId, NodeKind)> {
    let by_node = base_snapshot.tree.by_node();
    let mut new_names: HashMap<NodeId, (NodeId, String, NodeKind)> = HashMap::new();
    for op in &change.tree_ops {
        if let TreeOp::AddNode { node, parent, name, kind, .. } = op {
            new_names.insert(*node, (*parent, name.clone(), *kind));
        }
    }
    let mut out = HashMap::new();
    for (node, (_, _, kind)) in &new_names {
        if let Some(path) = path_of_node(node, &by_node, &new_names) {
            out.insert(path, (*node, *kind));
        }
    }
    out
}

fn path_of_node(
    n: &NodeId,
    by_node: &HashMap<NodeId, &crate::tree::TreeEntry>,
    new_names: &HashMap<NodeId, (NodeId, String, NodeKind)>,
) -> Option<String> {
    if let Some(e) = by_node.get(n) {
        return Some(e.path.clone());
    }
    let mut parts = Vec::new();
    let mut cur = *n;
    loop {
        if cur.is_root() {
            break;
        }
        if let Some(e) = by_node.get(&cur) {
            if !e.path.is_empty() {
                parts.push(e.path.clone());
            }
            break;
        }
        let (parent, name, _) = new_names.get(&cur)?;
        parts.push(name.clone());
        cur = *parent;
    }
    parts.reverse();
    Some(parts.join("/"))
}

/// Render a change's operations with line content, using `base` for deleted lines.
pub fn render_change(change: &Change, base: &State, base_snapshot: &Snapshot) -> String {
    let by_node = base_snapshot.tree.by_node();
    let mut new_names: HashMap<NodeId, (NodeId, String, NodeKind)> = HashMap::new();
    for op in &change.tree_ops {
        if let TreeOp::AddNode { node, parent, name, kind, .. } = op {
            new_names.insert(*node, (*parent, name.clone(), *kind));
        }
    }
    let path_of = |n: &NodeId| -> String { path_of_node(n, &by_node, &new_names).unwrap_or_else(|| format!("<node {}>", n.short(8))) };

    let mut out = String::new();
    for op in &change.tree_ops {
        match op {
            TreeOp::AddNode { node, kind, mode, .. } => {
                out.push_str(&format!("A {} ({:?}{}{})\n", path_of(node), kind, if mode.exec { ", exec" } else { "" }, if mode.opaque { ", opaque" } else { "" }));
            }
            TreeOp::RemoveNode { node, .. } => out.push_str(&format!("D {}\n", path_of(node))),
            TreeOp::Move { node, name, .. } => out.push_str(&format!("R {} -> {}\n", path_of(node), name)),
            TreeOp::SetMode { node, mode, .. } => {
                out.push_str(&format!("M {} mode: exec={} opaque={}\n", path_of(node), mode.exec, mode.opaque));
            }
        }
    }
    let mut last_node: Option<NodeId> = None;
    for e in &change.edits {
        let n = e.node();
        if last_node != Some(n) {
            out.push_str(&format!("--- {}\n", path_of(&n)));
            last_node = Some(n);
        }
        match e {
            Edit::Insert { lines, .. } => {
                for l in lines {
                    out.push('+');
                    out.push_str(&String::from_utf8_lossy(l));
                    if !l.ends_with(b"\n") {
                        out.push('\n');
                    }
                }
            }
            Edit::Delete { atoms, .. } => {
                for r in atoms {
                    for i in r.from..r.to {
                        let content = base.file(&n).and_then(|g| g.content(&(r.change, i))).unwrap_or(b"<unknown>\n");
                        out.push('-');
                        out.push_str(&String::from_utf8_lossy(content));
                        if !content.ends_with(b"\n") {
                            out.push('\n');
                        }
                    }
                }
            }
            Edit::Replace { old, new, .. } => {
                out.push_str(&format!(
                    "  opaque content {} -> {}\n",
                    old.map(|o| o.short(12)).unwrap_or_else(|| "none".into()),
                    new.map(|o| o.short(12)).unwrap_or_else(|| "none".into())
                ));
            }
        }
    }
    out
}

#[cfg(test)]
mod tests {
    use super::*;

    fn write(root: &Path, rel: &str, content: &[u8]) {
        let p = root.join(rel);
        fs::create_dir_all(p.parent().unwrap()).unwrap();
        fs::write(p, content).unwrap();
    }

    fn statuses(s: &SnapshotResult) -> Vec<(String, ChangeStatus)> {
        s.statuses.iter().map(|p| (p.path.clone(), p.status)).collect()
    }

    #[test]
    fn init_snapshot_commit_log_undo() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let repo = Repo::init(root).unwrap();
        assert!(Repo::init(root).is_err());
        let ops = repo.op_log().unwrap();
        assert_eq!(ops.len(), 1);
        assert_eq!(ops[0].1.command, "oxy init");

        // Empty working copy: snapshot records no operation (spec §12.3).
        let s = repo.snapshot("oxy status").unwrap();
        assert!(!s.changed);
        assert_eq!(repo.op_log().unwrap().len(), 1);

        write(root, "src/main.rs", b"fn main() {}\n");
        write(root, "README.md", b"# Hello\n");
        write(root, ".oxyignore", b"/target\n");
        write(root, "target/junk.o", b"\0\0\0");
        let s = repo.snapshot("oxy status").unwrap();
        assert!(s.changed);
        assert_eq!(
            statuses(&s),
            vec![
                (".oxyignore".into(), ChangeStatus::Added),
                ("README.md".into(), ChangeStatus::Added),
                ("src/main.rs".into(), ChangeStatus::Added),
            ]
        );
        assert_eq!(repo.op_log().unwrap().len(), 2);
        // Snapshotting again with nothing changed records no op.
        let s2 = repo.snapshot("oxy status").unwrap();
        assert!(!s2.changed);
        assert_eq!(s2.wc_hash, s.wc_hash);
        assert_eq!(repo.op_log().unwrap().len(), 2);

        let h1 = repo.commit("Initial import", &[]).unwrap();
        let c1 = repo.store().get_change(&h1).unwrap();
        assert_eq!(c1.kind, ChangeKind::Normal);
        assert!(c1.deps.is_empty(), "first change has nothing to depend on");
        assert_eq!(repo.bookmark_heads().unwrap(), vec![h1]);
        let (wc_hash, wc) = repo.working_copy().unwrap();
        assert_eq!(wc.deps, vec![h1]);
        assert!(wc.edits.is_empty());
        assert!(repo.commit("nothing", &[]).is_err());

        // Modify one file, remove another, add a binary file.
        write(root, "src/main.rs", b"fn main() {\n    println!(\"hi\");\n}\n");
        fs::remove_file(root.join("README.md")).unwrap();
        write(root, "logo.png", b"\x89PNG\0\0\x01");
        let s = repo.snapshot("oxy status").unwrap();
        assert_eq!(
            statuses(&s),
            vec![
                ("README.md".into(), ChangeStatus::Removed),
                ("logo.png".into(), ChangeStatus::Added),
                ("src/main.rs".into(), ChangeStatus::Modified),
            ]
        );
        assert_ne!(s.wc_hash, wc_hash);
        // The rewritten working copy keeps its ChangeId and depends on h1.
        assert_eq!(s.wc.change_id, wc.change_id);
        assert!(s.wc.deps.contains(&h1));

        let h2 = repo.commit("Second", &[]).unwrap();
        let c2 = repo.store().get_change(&h2).unwrap();
        assert_eq!(c2.deps, vec![h1], "everything it touches was introduced by h1");
        assert_eq!(repo.bookmark_heads().unwrap(), vec![h2]);

        // The materialized head state matches the working copy.
        let st = repo.load_state(&[h2]).unwrap();
        let snap = st.materialize();
        assert!(!snap.is_conflicted());
        assert_eq!(snap.files.keys().cloned().collect::<Vec<_>>(), [".oxyignore", "logo.png", "src", "src/main.rs"]);
        assert!(matches!(&snap.files["src/main.rs"].content, FileContent::Text { bytes, .. } if bytes == b"fn main() {\n    println!(\"hi\");\n}\n"));
        assert!(snap.files["logo.png"].mode.opaque);
        if let FileContent::Opaque { blobs } = &snap.files["logo.png"].content {
            assert_eq!(repo.read_blob(&blobs[0]).unwrap(), b"\x89PNG\0\0\x01");
        } else {
            panic!("logo should be opaque");
        }

        // Log: newest first, working copy included.
        let log = repo.log().unwrap();
        assert_eq!(log.len(), 3);
        assert!(log[0].is_working_copy);
        assert_eq!(log[1].hash, h2);
        assert!(log[1].is_head);
        assert_eq!(log[2].hash, h1);
        let d = repo.describe_change(&h2).unwrap();
        assert!(d.contains("D README.md"), "{d}");
        assert!(d.contains("+    println!(\"hi\");"), "{d}");
        assert!(d.contains("-fn main() {}"), "{d}");

        // Resolution by prefix.
        assert_eq!(repo.resolve_change(&c2.change_id.short(6)).unwrap(), h2);
        assert_eq!(repo.resolve_change(&format!("#{}", h1.short(8))).unwrap(), h1);
        assert!(repo.resolve_change("zzzz").is_err());

        // Undo the commit: bookmark and working copy go back.
        repo.undo().unwrap();
        assert_eq!(repo.bookmark_heads().unwrap(), vec![h1]);
        let s = repo.snapshot("oxy status").unwrap();
        assert!(!s.changed, "files on disk still match the pre-commit working copy");
        assert_eq!(s.statuses.len(), 3);
    }

    /// Make `main` conflicted: two commits on the same base that edit the same line.
    fn conflicted_repo() -> (tempfile::TempDir, Repo, ChangeHash, ChangeHash, ChangeHash) {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let repo = Repo::init(root).unwrap();
        write(root, "f.txt", b"a\nb\nc\n");
        let h1 = repo.commit("base", &[]).unwrap();
        write(root, "f.txt", b"a\nB\nc\n");
        let h2 = repo.commit("upper", &[]).unwrap();
        repo.checkout(&[h1], false, "checkout").unwrap();
        write(root, "f.txt", b"a\nX\nc\n");
        let h3 = repo.commit("ex", &[]).unwrap();
        (dir, repo, h1, h2, h3)
    }

    #[test]
    fn concurrent_edits_conflict_and_can_be_resolved() {
        let (dir, repo, h1, h2, h3) = conflicted_repo();
        let root = dir.path();
        let heads: BTreeSet<_> = repo.bookmark_heads().unwrap().into_iter().collect();
        assert_eq!(heads, [h2, h3].into_iter().collect());
        let st = repo.load_state(&[h2, h3]).unwrap();
        assert!(st.materialize().is_conflicted());

        // Checking out main writes markers.
        let r = repo.checkout(&repo.bookmark_heads().unwrap(), false, "checkout main").unwrap();
        assert!(r.conflicted);
        let marked = fs::read_to_string(root.join("f.txt")).unwrap();
        assert!(marked.starts_with("a\n<<<<<<< oxy conflict 1 of 1"), "{marked}");
        assert!(marked.contains("B\n") && marked.contains("X\n") && marked.ends_with("end\nc\n"), "{marked}");
        assert!(has_conflict_markers(marked.as_bytes()));
        // Untouched markers: clean working copy; commit has nothing to do.
        let s = repo.snapshot("status").unwrap();
        assert!(s.statuses.is_empty());
        assert!(!s.resolves);

        // Partially edited file that still has markers cannot be committed.
        write(root, "f.txt", marked.replace("B\n", "BB\n").as_bytes());
        let s = repo.snapshot("status").unwrap();
        assert_eq!(statuses(&s), vec![("f.txt".into(), ChangeStatus::ConflictEdited)]);
        assert!(repo.commit("no", &[]).is_err());

        // Resolve by keeping one side and adding a line elsewhere.
        write(root, "f.txt", b"a\nX\nc\nd\n");
        let s = repo.snapshot("status").unwrap();
        assert_eq!(statuses(&s), vec![("f.txt".into(), ChangeStatus::Resolved)]);
        assert!(s.resolves);
        let h4 = repo.commit("resolve", &[]).unwrap();
        let c4 = repo.store().get_change(&h4).unwrap();
        assert_eq!(c4.kind, ChangeKind::Resolution);
        assert!(c4.deps.contains(&h2) && c4.deps.contains(&h3) && c4.deps.contains(&h1), "{:?}", c4.deps);
        assert_eq!(repo.bookmark_heads().unwrap(), vec![h4]);
        let snap = repo.load_state(&[h4]).unwrap().materialize();
        assert!(!snap.is_conflicted());
        assert!(matches!(&snap.files["f.txt"].content, FileContent::Text { bytes, .. } if bytes == b"a\nX\nc\nd\n"));
        assert!(!repo.snapshot("status").unwrap().changed);
        // A peer holding only h2 and h3 and receiving h4 sees the same result,
        // whatever order the changes arrive in.
        let mut st = State::new();
        for h in [h4, h3, h1, h2] {
            st.add_unchecked(repo.store().get_change(&h).unwrap());
        }
        st.validate().unwrap();
        assert!(matches!(&st.materialize().files["f.txt"].content, FileContent::Text { bytes, .. } if bytes == b"a\nX\nc\nd\n"));
    }

    #[test]
    fn resolution_may_keep_both_sides_or_neither() {
        let (dir, repo, _h1, _h2, _h3) = conflicted_repo();
        let root = dir.path();
        repo.checkout(&repo.bookmark_heads().unwrap(), false, "checkout main").unwrap();
        // Keep both sides in a chosen order.
        write(root, "f.txt", b"a\nX\nB\nc\n");
        let h = repo.commit("both", &[]).unwrap();
        let snap = repo.load_state(&[h]).unwrap().materialize();
        assert!(!snap.is_conflicted());
        assert!(matches!(&snap.files["f.txt"].content, FileContent::Text { bytes, .. } if bytes == b"a\nX\nB\nc\n"));
        // Undo and instead drop the whole region.
        repo.undo().unwrap();
        write(root, "f.txt", b"a\nc\n");
        let h = repo.commit("neither", &[]).unwrap();
        let snap = repo.load_state(&[h]).unwrap().materialize();
        assert!(!snap.is_conflicted());
        assert!(matches!(&snap.files["f.txt"].content, FileContent::Text { bytes, .. } if bytes == b"a\nc\n"));
    }

    #[test]
    fn name_conflict_resolved_by_removing_a_candidate() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let repo = Repo::init(root).unwrap();
        write(root, "keep.txt", b"k\n");
        let h1 = repo.commit("base", &[]).unwrap();
        write(root, "new.txt", b"one\n");
        repo.commit("one", &[]).unwrap();
        repo.checkout(&[h1], false, "checkout").unwrap();
        write(root, "new.txt", b"two\n");
        repo.commit("two", &[]).unwrap();
        let r = repo.checkout(&repo.bookmark_heads().unwrap(), false, "checkout main").unwrap();
        assert!(r.conflicted);
        assert!(root.join("new.txt.oxy-conflict-1").exists() && root.join("new.txt.oxy-conflict-2").exists());
        assert!(!root.join("new.txt").exists());
        // Keep candidate 2 under the real name.
        fs::remove_file(root.join("new.txt.oxy-conflict-1")).unwrap();
        fs::rename(root.join("new.txt.oxy-conflict-2"), root.join("new.txt")).unwrap();
        let h = repo.commit("pick two", &[]).unwrap();
        assert_eq!(repo.store().get_change(&h).unwrap().kind, ChangeKind::Resolution);
        // The resolution does not touch keep.txt, so it does not depend on h1;
        // the bookmark keeps both as heads and their union is the state.
        let heads: BTreeSet<_> = repo.bookmark_heads().unwrap().into_iter().collect();
        assert_eq!(heads, [h1, h].into_iter().collect());
        let snap = repo.load_state(&repo.bookmark_heads().unwrap()).unwrap().materialize();
        assert!(!snap.is_conflicted(), "{:?}", snap.tree.conflicts);
        assert_eq!(snap.files.keys().cloned().collect::<Vec<_>>(), ["keep.txt", "new.txt"]);
        assert!(matches!(&snap.files["new.txt"].content, FileContent::Text { bytes, .. } if bytes == b"two\n"));
    }

    #[test]
    fn identities_and_signed_commits() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let mut repo = Repo::init(root).unwrap().with_keys_dir(root.join("keys"));
        write(root, "a.txt", b"a\n");
        let h0 = repo.commit("unsigned", &[]).unwrap();
        assert_eq!(repo.verify_change(&h0).unwrap(), SignatureStatus::Unsigned);
        assert_eq!(repo.store().get_change(&h0).unwrap().author, ObjectRef::ZERO);

        let (key, id) = repo.create_identity("Ada", "ada@example.org").unwrap();
        assert_eq!(id.hash(), key);
        assert_eq!(repo.config.author_key, Some(key));
        // Config survives reopen; the secret key is found again.
        let reopened = Repo::open(root).unwrap().with_keys_dir(root.join("keys"));
        assert_eq!(reopened.config.author_key, Some(key));
        assert_eq!(reopened.secret_key().unwrap().unwrap().0, key);

        // Default core.sign = seal: commits carry the author but no signature.
        write(root, "a.txt", b"a\nb\n");
        let h1 = repo.commit("authored", &[]).unwrap();
        assert_eq!(repo.store().get_change(&h1).unwrap().author, key);
        assert_eq!(repo.verify_change(&h1).unwrap(), SignatureStatus::Unsigned);
        // Signing later works too.
        repo.sign_change(&h1).unwrap();
        assert!(matches!(repo.verify_change(&h1).unwrap(), SignatureStatus::Valid { key: k, .. } if k == key));

        repo.config.set("core.sign", "change").unwrap();
        repo.save_config().unwrap();
        write(root, "a.txt", b"a\nb\nc\n");
        let h2 = repo.commit("signed", &[]).unwrap();
        assert_eq!(repo.verify_change(&h2).unwrap(), SignatureStatus::Valid { key, name: "Ada".into(), email: "ada@example.org".into() });

        // A signature by a key that is not the author or a delegate is rejected.
        let other = SecretKey::generate();
        let other_id = other.identity("Mallory", "m@example.org", 0);
        let other_key = repo.store().put_identity(&other_id).unwrap();
        let forged = other.sign(Domain::Change, &other_key, &h0);
        repo.store().put_signature(&h0, &forged).unwrap();
        assert!(matches!(repo.verify_change(&h0).unwrap(), SignatureStatus::Invalid(m) if m.contains("neither the author")));

        // Tampering with the stored signature invalidates it.
        let mut sig = repo.store().signatures(&h2).unwrap().remove(0);
        sig.ed[0] ^= 1;
        repo.store().put_signature(&h2, &sig).unwrap();
        assert!(matches!(repo.verify_change(&h2).unwrap(), SignatureStatus::Invalid(_)));

        // Without the secret key, signing at commit fails cleanly.
        let no_keys = Repo::open(root).unwrap().with_keys_dir(root.join("nowhere"));
        write(root, "a.txt", b"z\n");
        assert!(no_keys.commit("cannot sign", &[]).is_err());
    }

    #[test]
    fn checkout_moves_the_working_copy() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let repo = Repo::init(root).unwrap();
        write(root, "a.txt", b"one\n");
        write(root, "sub/deep/b.txt", b"b\n");
        let h1 = repo.commit("first", &[]).unwrap();
        write(root, "a.txt", b"two\n");
        fs::remove_file(root.join("sub/deep/b.txt")).unwrap();
        write(root, "bin.dat", &[0, 1, 2, 3]);
        let h2 = repo.commit("second", &[]).unwrap();

        let r = repo.checkout(&[h1], false, "oxy checkout").unwrap();
        assert_eq!(r, CheckoutReport { written: 2, removed: 1, conflicted: false });
        assert_eq!(fs::read(root.join("a.txt")).unwrap(), b"one\n");
        assert_eq!(fs::read(root.join("sub/deep/b.txt")).unwrap(), b"b\n");
        assert!(!root.join("bin.dat").exists());
        let (_, wc) = repo.working_copy().unwrap();
        assert_eq!(wc.deps, vec![h1]);
        assert!(!repo.snapshot("status").unwrap().changed, "checkout leaves a clean working copy");
        // The bookmark still points at h2.
        assert_eq!(repo.bookmark_heads().unwrap(), vec![h2]);

        // Dirty working copy refuses without --discard.
        write(root, "a.txt", b"dirty\n");
        assert!(repo.checkout(&[h2], false, "oxy checkout").is_err());
        let r = repo.checkout(&[h2], true, "oxy checkout --discard").unwrap();
        assert_eq!(fs::read(root.join("a.txt")).unwrap(), b"two\n");
        assert_eq!(fs::read(root.join("bin.dat")).unwrap(), [0, 1, 2, 3]);
        assert!(!root.join("sub").exists(), "empty directories are pruned");
        assert_eq!(r.removed, 1);
        assert!(!repo.snapshot("status").unwrap().changed);

        // Refuses to write through a symlinked directory.
        #[cfg(unix)]
        {
            fs::remove_dir_all(root.join("sub")).ok();
            std::os::unix::fs::symlink("/tmp", root.join("sub")).unwrap();
            assert!(repo.checkout(&[h1], true, "oxy checkout").is_err());
        }
    }

    #[test]
    fn large_files_are_chunked_and_read_back() {
        let dir = tempfile::tempdir().unwrap();
        let repo = Repo::init(dir.path()).unwrap();
        let mut big = vec![0u8; 700 * 1024];
        for (i, b) in big.iter_mut().enumerate() {
            *b = (i as u32).wrapping_mul(2654435761).to_le_bytes()[0];
        }
        let r = repo.store_blob(&big).unwrap();
        let blob = Blob::decode(&repo.store().get_typed(&r, ObjectType::Blob).unwrap()).unwrap();
        assert!(blob.chunks.len() >= 3, "{}", blob.chunks.len());
        assert_eq!(repo.read_blob(&r).unwrap(), big);
        assert_eq!(Repo::blob_ref(&big), r);
    }

    #[test]
    fn undo_skips_snapshot_operations() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let repo = Repo::init(root).unwrap();
        write(root, "a.txt", b"a\n");
        let h1 = repo.commit("a", &[]).unwrap();
        // A later command snapshots new edits on top of the commit.
        write(root, "b.txt", b"b\n");
        let s = repo.snapshot("oxy status").unwrap();
        assert!(s.changed);
        assert!(repo.head_op().unwrap().1.is_snapshot());
        assert_eq!(repo.last_command().unwrap().command, "oxy commit -m \"a\"");
        // Undo must undo the commit, not the snapshot.
        repo.undo().unwrap();
        assert_eq!(repo.bookmark_heads().unwrap(), vec![]);
        let s = repo.snapshot("oxy status").unwrap();
        let paths: Vec<_> = s.statuses.iter().map(|p| p.path.as_str()).collect();
        assert_eq!(paths, ["a.txt", "b.txt"], "both files are back in the working copy");
        assert!(repo.store().get_change(&h1).unwrap().deps.is_empty());
        // Only snapshots remain above `init`, so there is nothing left to undo.
        assert_eq!(repo.last_command().unwrap().command, "oxy init");
        assert!(repo.undo().is_err());
    }

    #[test]
    fn independent_changes_commute_and_make_multiple_heads() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let repo = Repo::init(root).unwrap();
        write(root, "a.txt", b"a\n");
        let h1 = repo.commit("a", &[]).unwrap();
        write(root, "b.txt", b"b\n");
        let h2 = repo.commit("b", &[]).unwrap();
        let c2 = repo.store().get_change(&h2).unwrap();
        assert!(c2.deps.is_empty(), "b.txt touches nothing from h1");
        let mut heads = repo.bookmark_heads().unwrap();
        heads.sort();
        let mut want = vec![h1, h2];
        want.sort();
        assert_eq!(heads, want);
        // Editing a.txt depends on h1 only.
        write(root, "a.txt", b"a\na2\n");
        let h3 = repo.commit("a2", &[]).unwrap();
        assert_eq!(repo.store().get_change(&h3).unwrap().deps, vec![h1]);
        let heads: BTreeSet<_> = repo.bookmark_heads().unwrap().into_iter().collect();
        assert_eq!(heads, [h2, h3].into_iter().collect());
        // Explicit dependency.
        write(root, "c.txt", b"c\n");
        let h4 = repo.commit("c", &[h2]).unwrap();
        assert_eq!(repo.store().get_change(&h4).unwrap().deps, vec![h2]);
    }

    #[test]
    fn mode_change_and_text_binary_switch() {
        let dir = tempfile::tempdir().unwrap();
        let root = dir.path();
        let repo = Repo::init(root).unwrap();
        write(root, "run.sh", b"#!/bin/sh\n");
        repo.commit("add script", &[]).unwrap();
        #[cfg(unix)]
        {
            use std::os::unix::fs::PermissionsExt;
            fs::set_permissions(root.join("run.sh"), fs::Permissions::from_mode(0o755)).unwrap();
            let s = repo.snapshot("status").unwrap();
            assert_eq!(statuses(&s), vec![("run.sh".into(), ChangeStatus::ModeChanged)]);
            let h = repo.commit("exec", &[]).unwrap();
            let snap = repo.load_state(&[h]).unwrap().materialize();
            assert!(snap.files["run.sh"].mode.exec);
        }
        // Text → binary → text.
        write(root, "run.sh", b"\0binary");
        let h = repo.commit("binary", &[]).unwrap();
        let snap = repo.load_state(&[h]).unwrap().materialize();
        assert!(snap.files["run.sh"].mode.opaque);
        write(root, "run.sh", b"text again\n");
        let h = repo.commit("text", &[]).unwrap();
        let snap = repo.load_state(&[h]).unwrap().materialize();
        assert!(!snap.files["run.sh"].mode.opaque);
        assert!(matches!(&snap.files["run.sh"].content, FileContent::Text { bytes, .. } if bytes == b"text again\n"));
        assert!(!snap.is_conflicted());
    }
}