"""Static and executable gates for vanilla HUX-05/HUX-10 renderers."""

from __future__ import annotations

import subprocess
from pathlib import Path


ROOT = Path(__file__).resolve().parents[2]
RUNTIME = ROOT / "dockerfiles" / "hermes-webui-hux" / "runtime"


def test_runtime_autonomy_privacy_node_suite_and_coverage():
    result = subprocess.run(
        [
            "node",
            "--test",
            "--experimental-test-coverage",
            "--test-coverage-lines=95",
            "--test-coverage-functions=95",
            "--test-coverage-branches=95",
            "--test-coverage-include=dockerfiles/hermes-webui-hux/runtime/autonomy-privacy.js",
            "testing/tests/test_hermes_hux_runtime_autonomy_privacy_node.js",
            "testing/tests/test_hermes_hux_runtime_stop_node.js",
        ],
        cwd=ROOT,
        check=False,
        capture_output=True,
        text=True,
        timeout=30,
    )
    assert result.returncode == 0, result.stdout + result.stderr
    report = next(
        line for line in result.stdout.splitlines() if "autonomy-privacy.js" in line
    )
    assert min(float(value) for value in report.split("|")[1:4]) >= 95.0


def test_runtime_pair_is_scoped_dependency_free_and_inert():
    js = (RUNTIME / "autonomy-privacy.js").read_text(encoding="utf-8")
    css = (RUNTIME / "autonomy-privacy.css").read_text(encoding="utf-8")
    assert "require('./wave_a_contract.js')" in js
    assert "require('../shell.js')" in js
    assert "HermesHuxAutonomyPrivacy" in js
    assert "autonomyExtension" in js and "privacyExtension" in js
    assert "hux.autonomy" in js and "hux.privacy" in js
    assert all(token not in js for token in ("React", "lucide", "tailwind", "localStorage", "sessionStorage", "indexedDB"))
    assert "dangerouslySetInnerHTML" not in js and ".innerHTML" not in js
    assert 'credentials: \'same-origin\'' in js and "cache: 'no-store'" in js
    assert "'If-Match'" in js and "'Idempotency-Key'" in js
    assert "Stop receipt" in js and "GENERIC_NOTICE" in js
    assert ".hux-runtime" in css and "body" not in css and ":root" not in css
    assert "focus-visible" in css and "prefers-reduced-motion" in css
    assert len(js.splitlines()) < 500 and len(css.splitlines()) < 500
    dockerfile = (ROOT / "dockerfiles/Dockerfile.hermes-webui").read_text(encoding="utf-8")
    assert "COPY dockerfiles/hermes-webui-hux/runtime/autonomy-privacy.js" in dockerfile
    bootstrap = (ROOT / "dockerfiles/hermes-webui-hux/bootstrap.js").read_text(encoding="utf-8")
    assert "HermesHuxAutonomyPrivacy" in bootstrap
    assert "createAutonomyPrivacyRuntime" in bootstrap
    assert "governance: ['HUX-05', 'HUX-10']" in bootstrap
    assert "tenantSlot" in js and "userRef" in js and "trust" in js
    assert "tenantRef" not in js
    assert "S.session" in bootstrap and "value.hux_context" in bootstrap


def test_runtime_uses_canonical_backend_routes_and_explicit_safety_language():
    js = (RUNTIME / "autonomy-privacy.js").read_text(encoding="utf-8")
    for route in (
        "/policy?scope=conversation&scope_id=",
        "/approvals?status=pending",
        "/approvals/",
        "/runs/",
        "/privacy/policy",
        "/privacy/notices",
        "/conversations/",
        "/privacy/audit",
    ):
        assert route in js
    assert "Pending approvals" in js
    assert "Allow once" in js and "Always allow" in js and "Deny" in js
    assert "prior sensitive details are not repeated" in js
    assert "process_registry_empty: false" in js