'use strict';

const assert = require('node:assert/strict');
const crypto = require('node:crypto');
const fs = require('node:fs');
const path = require('node:path');
const test = require('node:test');

const ROOT = path.resolve(__dirname, '../..');
const PATCH = path.join(ROOT, 'tools', 'ps5-kstuff-diagnostics', 'route-selection-observability.patch');
const READER = path.join(ROOT, 'tools', 'ps5-kstuff-diagnostics', 'route-selection-reader.c');
const MAKEFILE = path.join(ROOT, 'tools', 'ps5-kstuff-diagnostics', 'route-selection-reader.mk');
const BUILD_SCRIPT = path.join(ROOT, 'scripts', 'autonomous', 'p15-a7-build-route-selection.sh');
const DOCKERFILE = path.join(ROOT, 'tools', 'ps5-kstuff-diagnostics', 'Dockerfile.route-selection');
const BUILD_EVIDENCE = path.join(ROOT, 'docs', 'autonomous', 'evidence', 'P15_A7_ROUTE_SELECTION_BUILD_2026-08-25.json');
const PLAN = path.join(ROOT, 'docs', 'autonomous', 'evidence', 'P15_A7_ROUTE_SELECTION_PLAN.json');

function sha256Text(file) {
  const canonical = fs.readFileSync(file, 'utf8').replace(/\r\n/g, '\n');
  return crypto.createHash('sha256').update(canonical, 'utf8').digest('hex');
}

test('A7 runtime patch changes observability plumbing only', () => {
  const patch = fs.readFileSync(PATCH, 'utf8');
  for (const file of ['uelf/shared_area.h', 'uelf/log.h', 'uelf/log.c', 'uelf/utils.c']) {
    assert.match(patch, new RegExp(`diff --git a/ps5-kstuff/${file.replaceAll('/', '\\/')}`));
  }
  for (const forbiddenFile of ['fpkg.c', 'pfs_crypto.c', 'fakekeys.c', 'mailbox.c', 'fself.c', 'npdrm.c']) {
    assert.doesNotMatch(patch, new RegExp(`diff --git a/ps5-kstuff/uelf/${forbiddenFile.replace('.', '\\.')}`));
  }
  const additions = patch.split(/\r?\n/).filter(line => /^\+(?!\+\+)/.test(line)).join('\n');
  for (const forbidden of ['DMEM', 'copy_to_kernel', 'key_data', 'eekpfs', 'crypt_seed', 'mailboxBuffer', 'log_word', 'log_msg']) {
    assert.doesNotMatch(additions, new RegExp(forbidden, 'i'));
  }
  assert.match(additions, /debug_register_arm_successes/);
  assert.match(additions, /debug_register_finish_restore_failures/);
});

test('A7 reader exports only bounded counters and scrubs the source snapshot', () => {
  const source = fs.readFileSync(READER, 'utf8');
  assert.match(source, /schema=chimera\.p15-a7-route-selection-metrics\.v1/);
  assert.match(source, /volatile_scrub\(&snapshot, sizeof\(snapshot\)\)/);
  assert.match(source, /route nmount_dispatch=/);
  assert.match(source, /dbgarm attempt=/);
  assert.match(source, /mailbox total=/);
  assert.match(source, /fpkg verify=/);
  for (const forbidden of ['word_log', 'msg_log', 'ioctl_com_table', 'key_data', 'mailbox-capture', 'decrypt_regs']) {
    assert.doesNotMatch(source, new RegExp(forbidden, 'i'));
  }
});

test('A7 toolchain pins the loader dependency and artifact builds remain offline', () => {
  const dockerfile = fs.readFileSync(DOCKERFILE, 'utf8');
  const evidence = JSON.parse(fs.readFileSync(BUILD_EVIDENCE, 'utf8'));
  assert.match(dockerfile, /releases\/download\/v0\.39\/ps5-payload-dev\.tar\.gz/);
  assert.match(dockerfile, /14ac4113523ed61bc1d42a0d0b7b8981b2bc6aac35a68949c169b0ed0aaf5cdb/);
  assert.doesNotMatch(dockerfile, /releases\/latest/);
  assert.equal(evidence.toolchain.networkDuringArtifactBuild, 'none');
  assert.equal(evidence.toolchain.containerRootFilesystem, 'read-only');
  assert.equal(evidence.reproducibility.runs, 2);
  assert.equal(evidence.reproducibility.exactMatch, true);
  assert.equal(evidence.artifacts.loader.embeddedPayloadOccurrences, 1);
  assert.equal(evidence.artifacts.loader.embeddedPayloadExactMatch, true);
});

test('A7 plan is host-qualified but grants no live action', () => {
  const plan = JSON.parse(fs.readFileSync(PLAN, 'utf8'));
  assert.equal(plan.status, 'host_qualified_live_blocked');
  assert.equal(plan.liveBudget.used, 0);
  assert.equal(plan.liveBudget.stagingAllowedByThisArtifact, false);
  assert.equal(plan.liveBudget.loadingAllowedByThisArtifact, false);
  assert.equal(plan.liveBudget.launchAllowedByThisArtifact, false);
  assert.equal(plan.gates.explicitExactConfirmationRecorded, false);
});

test('A7 committed evidence records both host build runs without requiring ignored binaries', () => {
  const evidence = JSON.parse(fs.readFileSync(BUILD_EVIDENCE, 'utf8'));
  assert.equal(evidence.retention.artifactsCommitted, false);
  assert.equal(evidence.retention.repositoryCiReopensHostArtifacts, false);
  assert.equal(evidence.retention.artifactIntegritySource, 'recorded-host-qualification-hashes');
  assert.equal(sha256Text(PATCH), evidence.source.observabilityPatch.sha256);
  assert.equal(sha256Text(READER), evidence.reader.sourceSha256);
  assert.equal(sha256Text(MAKEFILE), evidence.reader.makefileSha256);
  assert.equal(sha256Text(BUILD_SCRIPT), evidence.toolchain.buildScriptSha256);
  assert.equal(sha256Text(DOCKERFILE), evidence.toolchain.dockerfileSha256);
  for (const artifact of Object.values(evidence.artifacts)) {
    assert.ok(Number.isSafeInteger(artifact.size) && artifact.size > 0);
    assert.match(artifact.sha256, /^[a-f0-9]{64}$/);
  }
  assert.equal(evidence.artifacts.loader.embeddedPayloadOffset, 1214114);
  assert.equal(evidence.artifacts.loader.embeddedPayloadOccurrences, 1);
  assert.equal(evidence.artifacts.loader.embeddedPayloadExactMatch, true);
});