'use strict';

const assert = require('node:assert/strict');
const fs = require('node:fs');
const path = require('node:path');
const test = require('node:test');

const ROOT = path.resolve(__dirname, '../..');
const SOURCE = path.join(ROOT, 'tools', 'ps5-kstuff-diagnostics', 'semantic-reader.c');

test('A6 semantic reader scrubs the full snapshot before persistence', () => {
  const source = fs.readFileSync(SOURCE, 'utf8');
  const copy = source.indexOf('*metrics = snapshot.metrics;');
  const scrub = source.indexOf('volatile_scrub(&snapshot, sizeof(snapshot));', copy);
  const write = source.indexOf('write_metrics(&metrics, sample)');
  assert.ok(copy >= 0 && scrub > copy && write > scrub);
  assert.match(source, /volatile unsigned char\* bytes/);
});

test('A6 semantic reader persists only the strict allowlisted schema', () => {
  const source = fs.readFileSync(SOURCE, 'utf8');
  for (const line of [
    'schema=chimera.p15-a6-semantic-metrics.v1',
    'status=attached',
    'core mailbox_fpkg=',
    'syscall[nmount] armed=',
    'fakekeys reg=',
    'crypto req=',
    'fpkg verify=',
    'fpkg_rejects xts_non_fake=',
  ]) assert.ok(source.includes(line), `missing allowlisted line: ${line}`);
  for (const forbidden of [
    'kstuff_debug.log', 'word_log', 'msg_log', 'ioctl_com_table',
    'key_data', 'mailbox-capture', 'log-word', 'decrypt_regs',
  ]) assert.doesNotMatch(source, new RegExp(forbidden, 'i'));
});

test('A6 semantic reader uses an atomic dedicated output file and static failures', () => {
  const source = fs.readFileSync(SOURCE, 'utf8');
  assert.match(source, /chimera_kstuff_a6_semantic\.log\.tmp/);
  assert.match(source, /rename\(OUTPUT_TEMP_PATH, OUTPUT_PATH\)/);
  assert.match(source, /write_static_status\("not-loaded"\)/);
  assert.match(source, /write_static_status\("snapshot-error"\)/);
  assert.doesNotMatch(source, /\bprintf\s*\(/);
});