'use strict';

const test = require('node:test');
const assert = require('node:assert/strict');
const {
  createRuntimeIdentity,
  matchCompatibility,
  capabilityState,
  validateJob,
  reconcileRuntimeLoss,
  newRuntimeEpoch,
} = require('../../src/services/etahen-link-contract');

const HASH = 'a'.repeat(64);
const identity = createRuntimeIdentity({ version: '2.5B', binarySha256: HASH, firmware: '8.20', runtimeEpoch: 'epoch_12345678' });

test('unknown etaHEN build exposes only safe baseline capabilities', () => {
  const match = matchCompatibility(identity, []);
  assert.equal(match.level, 'detected-unverified');
  assert.ok(match.capabilities.includes('console.inventory.read'));
  assert.ok(!match.capabilities.includes('package.install.etahen-dpi-v1'));
});

test('verified profile requires exact version, firmware and binary hash', () => {
  const profile = { id: 'etahen-2.5b-820', etahenVersion: '2.5B', binarySha256: HASH, firmwares: ['8.20'], capabilities: ['console.inventory.read', 'package.install.etahen-dpi-v1'] };
  assert.equal(matchCompatibility(identity, [profile]).level, 'verified');
  assert.equal(matchCompatibility({ ...identity, binarySha256: 'b'.repeat(64) }, [profile]).level, 'detected-unverified');
});

test('availability, authorization and health remain independent', () => {
  const compatibility = { level: 'verified', capabilities: ['package.install.etahen-dpi-v1'] };
  assert.deepEqual(capabilityState('package.install.etahen-dpi-v1', { compatibility, authorized: [], healthy: ['package.install.etahen-dpi-v1'] }), {
    name: 'package.install.etahen-dpi-v1', risk: 'mutating', available: true, authorized: false, healthy: true, compatibility: 'verified',
  });
});

test('mutating job needs a healthy capability and fresh runtime-bound confirmation', () => {
  const capabilities = [capabilityState('package.install.etahen-dpi-v1', {
    compatibility: { level: 'verified', capabilities: ['package.install.etahen-dpi-v1'] },
    authorized: ['package.install.etahen-dpi-v1'], healthy: ['package.install.etahen-dpi-v1'],
  })];
  assert.throws(() => validateJob({ jobId: 'job_12345678', type: 'package.install', runtimeEpoch: identity.runtimeEpoch, input: {} }, { runtimeEpoch: identity.runtimeEpoch, capabilities }), /authorization/i);
  assert.equal(validateJob({ jobId: 'job_12345678', type: 'package.install', runtimeEpoch: identity.runtimeEpoch, confirmationEpoch: identity.runtimeEpoch, input: { artifactId: 'artifact_1' } }, { runtimeEpoch: identity.runtimeEpoch, capabilities }).risk, 'mutating');
});

test('raw command, path, URL and ELF fields are rejected recursively', () => {
  const capabilities = [capabilityState('console.inventory.read', { compatibility: { level: 'verified', capabilities: ['console.inventory.read'] }, healthy: ['console.inventory.read'] })];
  for (const input of [{ command: 'raw' }, { nested: { path: '/data' } }, { url: 'http://host' }, { elf: 'payload' }]) {
    assert.throws(() => validateJob({ jobId: 'job_12345678', type: 'inventory.scan', runtimeEpoch: identity.runtimeEpoch, input }, { runtimeEpoch: identity.runtimeEpoch, capabilities }), /Forbidden/);
  }
});

test('runtime loss invalidates confirmation and makes active mutations outcome-unknown', () => {
  assert.deepEqual(reconcileRuntimeLoss({ id: 'j1', status: 'applying', confirmationEpoch: identity.runtimeEpoch }), { id: 'j1', status: 'outcome_unknown', confirmationEpoch: null });
  assert.deepEqual(reconcileRuntimeLoss({ id: 'j2', status: 'confirmed', confirmationEpoch: identity.runtimeEpoch }), { id: 'j2', status: 'paused', confirmationEpoch: null });
  assert.match(newRuntimeEpoch('fixed-seed'), /^[a-f0-9]{32}$/);
});