"""Static isolation and security checks for the HUX Wave C vanilla runtime."""

from pathlib import Path


ROOT = Path(__file__).parents[2]
RUNTIME = ROOT / "dockerfiles/hermes-webui-hux/runtime"
SCRIPT = RUNTIME / "wave_c_multimodal_onboarding_release.js"
STYLE = RUNTIME / "wave_c_multimodal_onboarding_release.css"


def test_wave_c_runtime_is_isolated_dependency_free_and_small():
    """The compatibility lane stays inert and can be reviewed as a small pair."""
    source = SCRIPT.read_text()
    style = STYLE.read_text()
    assert len(source.splitlines()) < 500
    assert len(style.splitlines()) < 500
    lowered = (source + style).lower()
    for forbidden in ("react", "tsx", "lucide", "tailwind", "localstorage", "sessionstorage", "indexeddb"):
        assert forbidden not in lowered
    assert "innerHTML" not in source
    assert "fetch(" not in source
    assert "hux-wave-c" in style
    assert "focus-visible" in style
    assert "prefers-reduced-motion" in style


def test_wave_c_routes_are_capability_gated_and_currently_absent():
    """No incomplete card can make an unadvertised backend route callable."""
    source = SCRIPT.read_text()
    for card in ("HUX-07", "HUX-09", "HUX-12"):
        assert card in source
    assert "server route is not available" in source
    assert "Nothing was enabled or changed" in source
    assert "spec.routes.filter((route) => !card.routes.includes(route))" in source
    assert "cache: 'no-store'" not in source  # canonical client owns transport policy
    assert "contract.createCanonicalClient" in source


def test_release_panel_cannot_conflate_pipeline_states_with_live():
    """Only complete live evidence produces a positive deployment claim."""
    source = SCRIPT.read_text()
    for evidence in ("image_digest", "harbor_digest", "pod_digest", "flux_revision", "health_check"):
        assert evidence in source
    assert "raw.state !== 'live_verified'" in source
    assert "health.status !== 'pass'" in source
    assert "Live release evidence could not be verified" in source
    assert "queued" not in source


def test_onboarding_and_multimodal_are_exactly_bound_and_non_automatic():
    """Scoped identity and contextual triggers precede every optional surface."""
    source = SCRIPT.read_text()
    for token in ("sameIdentity", "project_id", "conversation_id", "sessionId", "normalizeTrigger"):
        assert token in source
    assert "Suggestions appear only after an exact app event" in source
    assert "Capture and upload remain approval-gated" in source
    assert "Idempotency-Key" in source
    assert "clicked: true" in source and "'If-Match'" in source