'use strict';

const assert = require('node:assert/strict');
const test = require('node:test');
const { P15_R4_KSTUFF_RUNTIME, classifyPs5FpkgKstuffRuntimeIdentity, classifyPs5FpkgKstuffRuntimeObservation } = require('../../src/services/ps5-fpkg-kstuff-runtime-identity');

const HASHES = Object.freeze({ loader: '1'.repeat(64), payload: '2'.repeat(64), reader: '3'.repeat(64), manifest: '4'.repeat(64) });
const REVISION = '3b2ab4a16ba43c8ab38daf7ec83cc297014e0e47';

function identity(semanticOnly = true) {
  return {
    expected: {
      product: 'EchoStretch/kstuff-lite', version: '1.10', revision: REVISION, firmware: '9.60',
      loaderSha256: HASHES.loader, payloadSha256: HASHES.payload, readerSha256: HASHES.reader,
      autoloadManifestSha256: HASHES.manifest, observabilityProfile: 'chimera-p15-fpkg-observe-v1', semanticOnly,
    },
    observed: {
      loaderSha256: HASHES.loader, payloadSha256: HASHES.payload, readerSha256: HASHES.reader,
      processInventoryComplete: true,
      processes: [{ pid: 93, name: 'kstuff.elf' }],
      loadTransition: {
        autoloadManifestSha256: HASHES.manifest, loaderExecuted: true,
        payloadProcessObserved: true, readerExecutedAfterPayload: true,
      },
    },
  };
}

test('exact semantic-only runtime with one complete process observation is trace eligible', () => {
  const result = classifyPs5FpkgKstuffRuntimeIdentity(identity());
  assert.equal(result.status, 'exact');
  assert.equal(result.traceEligible, true);
  assert.equal(result.productionRestorable, false);
});

test('exact raw capture remains trace-ineligible', () => {
  const result = classifyPs5FpkgKstuffRuntimeIdentity(identity(false));
  assert.equal(result.status, 'exact');
  assert.equal(result.traceEligible, false);
  assert.equal(result.ineligibleReason, 'observability-profile-exceeds-semantic-boundary');
});

test('matching files without a proven active load transition remain unproven', () => {
  const input = identity();
  input.observed.loadTransition.loaderExecuted = false;
  const result = classifyPs5FpkgKstuffRuntimeIdentity(input);
  assert.equal(result.status, 'unproven');
  assert.equal(result.traceEligible, false);
});

test('active loader or embedded-payload mismatch is explicit and fail-closed', () => {
  const input = identity();
  input.observed.payloadSha256 = '5'.repeat(64);
  const result = classifyPs5FpkgKstuffRuntimeIdentity(input);
  assert.equal(result.status, 'mismatch');
  assert.equal(result.traceEligible, false);
});

test('duplicate live kstuff processes are ambiguous even with matching artifact evidence', () => {
  const input = identity();
  input.observed.processes = [{ pid: 93, name: 'kstuff.elf' }, { pid: 105, name: 'kstuff.elf' }];
  const result = classifyPs5FpkgKstuffRuntimeIdentity(input);
  assert.equal(result.status, 'ambiguous');
  assert.equal(result.traceEligible, false);
  assert.deepEqual(result.observed.processes.map(process => process.pid), [93, 105]);
});

test('one bounded live kstuff process preserves exact attestation', () => {
  const input = identity();
  input.observed.processes = [{ pid: 93, name: 'kstuff.elf' }];
  assert.equal(classifyPs5FpkgKstuffRuntimeIdentity(input).status, 'exact');
});

test('missing process inventory is unproven and is not represented as a proven empty inventory', () => {
  const input = identity();
  input.observed.processInventoryComplete = false;
  input.observed.processes = [];
  const result = classifyPs5FpkgKstuffRuntimeIdentity(input);
  assert.equal(result.status, 'unproven');
  assert.equal(result.observed.processInventoryComplete, false);
  assert.deepEqual(result.observed.processes, []);
  assert.equal(result.traceEligible, false);
});

test('R4 binds the current reviewed A7 autoload runtime identity', () => {
  assert.deepEqual(P15_R4_KSTUFF_RUNTIME, {
    product: 'EchoStretch/kstuff-lite',
    version: '1.10',
    revision: REVISION,
    firmware: '9.60',
    loaderSha256: '31716863903a887b51785d3dfd2f6ac3980cae1fa2ea0dff73c98d701ae8c5cf',
    payloadSha256: 'ef0705222975cba8f6f953810a014eba29c48c2f6e61147082327e40fce69b86',
    readerSha256: '64ee055db7044407baeba45b5ce6213fbebd451d9346e27e50a12ee3dd45f0a6',
    autoloadManifestSha256: 'f9f5670aaffb9b8dcf457abcfd28ba2fa614c7deca89855dbc7597ff7695481a',
    observabilityProfile: 'chimera-p15-a7-route-selection-v1',
    semanticOnly: true,
  });
});

test('production observation cannot promote unbound syslog claims into execution attestation', () => {
  const input = {
    inventoryComplete: true,
    kstuffProcesses: [{ pid: 71, name: 'kstuff.elf' }],
    syslog: { text: Object.entries(P15_R4_KSTUFF_RUNTIME)
      .filter(([key]) => key.endsWith('Sha256')).map(([key, value]) => `${key}=${value}`)
      .concat('loaderExecuted=true', 'readerExecutedAfterPayload=true').join('\n') },
  };
  const result = classifyPs5FpkgKstuffRuntimeObservation(input);
  assert.equal(result.status, 'unproven');
  assert.equal(result.traceEligible, false);
  assert.equal(result.observed.loaderSha256, null);
  assert.equal(result.observed.payloadSha256, null);
  assert.equal(result.observed.readerSha256, null);
  assert.equal(result.observed.loadTransition.autoloadManifestSha256, null);
  assert.equal(result.observed.loadTransition.loaderExecuted, false);
  assert.equal(result.observed.loadTransition.readerExecutedAfterPayload, false);
  assert.equal(result.observed.loadTransition.payloadProcessObserved, true);
  assert.equal(result.evidenceContract.status, 'unavailable');
  assert.equal(result.evidenceContract.reason, 'kstuff_current_boot_execution_receipt_unavailable');
  assert.equal(result.evidenceContract.cleanRuntimeRequired, false);
});

test('process ambiguity and absent execution producer are reported independently', () => {
  const result = classifyPs5FpkgKstuffRuntimeObservation({
    inventoryComplete: true,
    kstuffProcesses: [{ pid: 71, name: 'kstuff.elf' }, { pid: 83, name: 'kstuff.elf' }],
  });
  assert.equal(result.status, 'ambiguous');
  assert.equal(result.evidenceContract.cleanRuntimeRequired, true);
  assert.equal(result.evidenceContract.status, 'unavailable');
  assert.equal(result.traceEligible, false);
  assert.deepEqual(result.observed.processes.map(process => process.pid), [71, 83]);
  assert.equal(Object.isFrozen(result.evidenceContract), true);
});

test('unavailable inventory remains distinct from a clean single-process runtime', () => {
  const result = classifyPs5FpkgKstuffRuntimeObservation();
  assert.equal(result.status, 'unproven');
  assert.equal(result.observed.processInventoryComplete, false);
  assert.deepEqual(result.observed.processes, []);
  assert.equal(result.evidenceContract.cleanRuntimeRequired, false);
  assert.equal(result.evidenceContract.status, 'unavailable');
});

test('a completeness flag without an actual process array is unavailable, not an empty complete inventory', () => {
  for (const kstuffProcesses of [undefined, null, {}, 'kstuff.elf']) {
    const result = classifyPs5FpkgKstuffRuntimeObservation({ inventoryComplete: true, kstuffProcesses });
    assert.equal(result.observed.processInventoryComplete, false);
    assert.deepEqual(result.observed.processes, []);
    assert.equal(result.observed.loadTransition.payloadProcessObserved, false);
    assert.equal(result.traceEligible, false);
  }
});

test('an explicitly complete empty process array remains distinguishable from missing inventory', () => {
  const result = classifyPs5FpkgKstuffRuntimeObservation({ inventoryComplete: true, kstuffProcesses: [] });
  assert.equal(result.observed.processInventoryComplete, true);
  assert.equal(result.observed.loadTransition.payloadProcessObserved, false);
  assert.equal(result.status, 'unproven');
  assert.equal(result.traceEligible, false);
});