Made of little things.

import { detailedReport } from './report-fixture.mjs';
import assert from 'node:assert/strict';
import { createRequire } from 'node:module';
import { randomBytes, createHash } from 'node:crypto';
import { Client } from '@modelcontextprotocol/sdk/client/index.js';
import { NostrClientTransport, PrivateKeySigner, ApplesauceRelayPool, EncryptionMode } from '@contextvm/sdk';
import { startBridge } from '../bridge/server.mjs';
const require = createRequire(import.meta.resolve('@contextvm/sdk'));
const { WebSocketServer } = require('ws');
const relay = new WebSocketServer({ host: '127.0.0.1', port: 0 });
await new Promise((resolve, reject) => { relay.once('listening', resolve); relay.once('error', reject); });
const events = [], subscriptions = new Map();
function matches(event, filter) {
  if (filter.kinds && !filter.kinds.includes(event.kind)) return false;
  if (filter.authors && !filter.authors.includes(event.pubkey)) return false;
  if (filter.ids && !filter.ids.includes(event.id)) return false;
  if (filter.since && event.created_at < filter.since) return false;
  for (const [key, values] of Object.entries(filter)) if (key.startsWith('#') && !event.tags.some(t => t[0] === key.slice(1) && values.includes(t[1]))) return false;
  return true;
}
relay.on('connection', socket => {
  const subs = new Map(); subscriptions.set(socket, subs);
  socket.on('close', () => subscriptions.delete(socket));
  socket.on('message', raw => {
    const [type, id, ...rest] = JSON.parse(raw.toString());
    if (type === 'REQ') {
      subs.set(id, rest);
      for (const event of events) if (rest.some(f => matches(event, f))) socket.send(JSON.stringify(['EVENT', id, event]));
      socket.send(JSON.stringify(['EOSE', id]));
    }
    if (type === 'CLOSE') subs.delete(id);
    if (type === 'EVENT') {
      events.push(id); socket.send(JSON.stringify(['OK', id.id, true, '']));
      for (const [peer, items] of subscriptions) for (const [sub, filters] of items) if (filters.some(f => matches(id, f))) peer.send(JSON.stringify(['EVENT', sub, id]));
    }
  });
});
const relays = [`ws://127.0.0.1:${relay.address().port}`];
const photo='data:image/png;base64,iVBORw0KGgo'+ 'A'.repeat(30001);
let bridge, pool, client, outsiderPool, outsider; let vendorCalls = 0;
try {
  bridge = await startBridge({ secretKey: randomBytes(32).toString('hex'), relays, fetchImpl: async (_url, init) => {
    vendorCalls++; assert.equal(init.headers.Authorization, 'Bearer dummy-encrypted-key');
    if(init.method==='GET'){assert.equal(init.body,undefined);return new Response(JSON.stringify({data:[{id:'test-model'}]}));}
    const body=JSON.parse(init.body);let output={ok:true};
    if(body.messages.length===2){
      assert.equal(body.messages[1].content[2].image_url.url,photo);assert.match(body.messages[1].content[1].text,/PATIENT PHOTO/);
      output=detailedReport();
    }
    return new Response(JSON.stringify({ model: 'test-model', choices: [{ finish_reason: 'stop', message: { content: JSON.stringify(output), reasoning_content:'Synthetic reasoning only. '+('x'.repeat(5000))+' dummy-encrypted-key' } }] }));
  } });
  pool = new ApplesauceRelayPool(relays);
  const transport = new NostrClientTransport({ signer: new PrivateKeySigner(randomBytes(32).toString('hex')), relayHandler: pool, serverPubkey: bridge.pubkey, encryptionMode: EncryptionMode.REQUIRED, logLevel: 'silent', oversizedTransfer: { enabled: false }, openStream: { enabled: false } });
  client = new Client({ name: 'body-journal-test', version: '1' });
  await client.connect(transport, { timeout: 5000 });
  const info = await client.callTool({ name: 'body_journal_info', arguments: {} }, undefined, { timeout: 5000 });
  assert.equal(info.structuredContent.encryptionRequired, true);assert.equal(info.structuredContent.protocolVersion,4);assert.equal(info.structuredContent.modelDiscovery,true);
  const request = { requestId: 'transport-test-request', provider: 'openai', model: 'gpt-5.4', apiKey: 'dummy-encrypted-key' };
  const started = await client.callTool({ name: 'body_journal_test', arguments: request }, undefined, { timeout: 5000 });
  assert.equal(started.structuredContent.ok, true);
  const result = await client.callTool({ name: 'body_journal_result', arguments: { requestId: request.requestId } }, undefined, { timeout: 5000 });
  assert.equal(result.structuredContent.result.ok, true); assert.equal(vendorCalls, 1);
  await client.callTool({ name: 'body_journal_test', arguments: request }, undefined, { timeout: 5000 });
  assert.equal(vendorCalls, 1, 'Repeated start ID does not repeat a paid request');
  const collision = await client.callTool({ name: 'body_journal_test', arguments: { ...request, model: 'different-model' } }, undefined, { timeout: 5000 });
  assert.equal(collision.structuredContent.ok, false); assert.equal(vendorCalls, 1);
  outsiderPool = new ApplesauceRelayPool(relays);
  outsider = new Client({ name: 'other-session', version: '1' });
  await outsider.connect(new NostrClientTransport({ signer: new PrivateKeySigner(randomBytes(32).toString('hex')), relayHandler: outsiderPool, serverPubkey: bridge.pubkey, encryptionMode: EncryptionMode.REQUIRED, logLevel: 'silent' }), { timeout: 5000 });
  const privateResult = await outsider.callTool({ name: 'body_journal_result', arguments: { requestId: request.requestId } }, undefined, { timeout: 5000 });
  assert.equal(privateResult.structuredContent.code, 'expired', 'A different transport actor cannot read a result even knowing its ID');
  const sha256=createHash('sha256').update(photo).digest('hex'),id='transport-image-1';
  for(let index=0;index<2;index++){
    const uploaded=await client.callTool({name:'body_journal_image',arguments:{id,sha256,index,total:2,chunk:photo.slice(index*24000,(index+1)*24000)}},undefined,{timeout:5000});
    assert.equal(uploaded.structuredContent.complete,index===1);
  }
  const caseText=JSON.stringify({version:1,profile:{ageYears:34},concerns:[{id:1,patientDescription:'Synthetic only'}]});
  const analysis={...request,requestId:'transport-analysis-1',caseText,images:[{id,sha256,concernId:null,kind:'patient-photo',attachmentId:'photo-'+'a'.repeat(24),caption:'Synthetic photo fixture'}]};
  const denied=await outsider.callTool({name:'body_journal_analyze',arguments:analysis},undefined,{timeout:5000});
  assert.equal(denied.structuredContent.code,'images-expired');assert.equal(vendorCalls,1);
  const accepted=await client.callTool({name:'body_journal_analyze',arguments:analysis},undefined,{timeout:5000});assert.equal(accepted.structuredContent.ok,true);
  const final=await client.callTool({name:'body_journal_result',arguments:{requestId:analysis.requestId}},undefined,{timeout:5000});
  assert.equal(final.structuredContent.result.report.summary,detailedReport().summary);assert.equal(vendorCalls,2);
  let text='',thinking='',offset=0,reasoningOffset=0;
  for(let n=0;n<12;n++){
    const next=await client.callTool({name:'body_journal_result',arguments:{requestId:analysis.requestId,outputOffset:offset,reasoningOffset}},undefined,{timeout:5000});
    const d=next.structuredContent.diagnostics;assert.equal(d.stage,'complete');text+=d.output;thinking+=d.reasoning;offset+=d.output.length;reasoningOffset+=d.reasoning.length;
    if(offset===d.outputTotal && reasoningOffset===d.reasoningTotal)break;
  }
  assert.equal(JSON.parse(text).version,2);assert.match(thinking,/REDACTED/);assert.doesNotMatch(thinking,/dummy-encrypted-key/);
  const privateDiagnostics=await outsider.callTool({name:'body_journal_result',arguments:{requestId:analysis.requestId}},undefined,{timeout:5000});assert.equal(privateDiagnostics.structuredContent.code,'expired');assert.equal(privateDiagnostics.structuredContent.diagnostics,undefined);
  const modelRequest={requestId:'transport-model-list',provider:request.provider,apiKey:request.apiKey};
  await client.callTool({name:'body_journal_models',arguments:modelRequest},undefined,{timeout:5000});
  const models=await client.callTool({name:'body_journal_result',arguments:{requestId:modelRequest.requestId}},undefined,{timeout:5000});assert.deepEqual(models.structuredContent.result.models,['test-model']);assert.equal(vendorCalls,3);
  await client.callTool({name:'body_journal_models',arguments:modelRequest},undefined,{timeout:5000});assert.equal(vendorCalls,3);
  const visionRequest={...request,requestId:'transport-text-and-vision',challenge:{image:photo,answer:'ABC234'}};
  await client.callTool({name:'body_journal_test',arguments:visionRequest},undefined,{timeout:5000});
  const visionResult=await client.callTool({name:'body_journal_result',arguments:{requestId:visionRequest.requestId}},undefined,{timeout:5000});assert.equal(visionResult.structuredContent.result.ok,true);assert.equal(visionResult.structuredContent.diagnostics,undefined,'Connection-test phases do not reuse analysis stream cursors');assert.equal(vendorCalls,5);
  assert.ok(events.length > 1); assert.ok(events.every(e => [1059,21059].includes(e.kind)), 'Every relay event must be an encrypted gift wrap');
  assert.doesNotMatch(JSON.stringify(events), /dummy-encrypted-key|body_journal_test|chat\/completions/);
  console.log('PASS: real encrypted ContextVM handshake, asynchronous job, paged redacted diagnostics, model discovery and idempotent start through a loopback relay; synthetic vendor response; no plaintext key/tool payload on relay.');
} finally {
  await client?.close(); await pool?.disconnect(); await outsider?.close(); await outsiderPool?.disconnect(); await bridge?.close();
  for (const peer of relay.clients) peer.terminate();
  await new Promise(resolve => relay.close(resolve));
}