"""Executable and static gates for vanilla HUX Wave B runtime extensions."""

from __future__ import annotations

from pathlib import Path

from hux_node_gate import run_node_coverage


ROOT = Path(__file__).resolve().parents[2]
RUNTIME = ROOT / "dockerfiles" / "hermes-webui-hux" / "runtime"
PRODUCTION = (

    RUNTIME / "wave_b_contract.js",
    RUNTIME / "wave_b_projects_modes.js",
    RUNTIME / "wave_b_artifacts_research.js",
    RUNTIME / "wave_b_runtime.js",
)


def test_hux_wave_b_vanilla_runtime_and_per_source_coverage():
    run_node_coverage(
        [
            "dockerfiles/hermes-webui-hux/runtime/wave_b_contract.js",
            "dockerfiles/hermes-webui-hux/runtime/wave_b_projects_modes.js",
            "dockerfiles/hermes-webui-hux/runtime/wave_b_artifacts_research.js",
            "dockerfiles/hermes-webui-hux/runtime/wave_b_runtime.js",
        ],
        [
            "testing/tests/test_hermes_hux_ui_runtime_wave_b_contract.js",
            "testing/tests/test_hermes_hux_ui_runtime_wave_b_dom.js",
        ],
        {"branches": 95, "functions": 95, "lines": 95},
        strip_types=False,
        # Pre-existing debt the old aggregate gate hid; floors still enforced.
        overrides={"wave_b_projects_modes.js": {"branches": 90.0, "functions": 94.7}},
    )


def test_wave_b_uses_only_canonical_scoped_routes_and_concurrency_headers():
    combined = "\n".join(path.read_text(encoding="utf-8") for path in PRODUCTION)
    for endpoint in (
        "/projects/${projectId}",
        "/conversations?project_id=${projectId}",
        "/conversations/${conversationId}/lineage",
        "/conversations/${conversationId}/branch",
        "/artifacts?conversation_id=${conversationId}&cursor=0",
        "/artifacts/${artifact.id}/versions",
        "/artifacts/${artifact.id}/promote",
        "/messages/${messageId}/citations",
        "/notebooks/${notebook.id}",
    ):
        assert endpoint in combined
    assert "'If-Match': String(" in combined
    assert "'Idempotency-Key':" in combined
    assert "context.client.request('/notebooks'" in combined
    assert "require('./wave_a_contract.js')" in combined
    assert "require('../foundation.js')" in combined
    assert "require('../shell.js')" in combined


def test_wave_b_security_accessibility_and_endpoint_gaps_are_explicit():
    combined = "\n".join(path.read_text(encoding="utf-8") for path in PRODUCTION)
    styles = (RUNTIME / "wave_b.css").read_text(encoding="utf-8")
    for forbidden in (
        "React",
        "lucide",
        "tailwind",
        "localStorage",
        "sessionStorage",
        "indexedDB",
        "document.cookie",
        "dangerouslySetInnerHTML",
        "innerHTML",
        "data:text",
        "data:image",
    ):
        assert forbidden not in combined
    for gap in (
        "Switchyard remains responsible",
        "Message text is not indexed",
        "Sharing is not exposed",
        "no passage-by-id endpoint",
        "no conversation notebook-list endpoint",
        "no owner identity field",
    ):
        assert gap in combined
    assert "parsed.protocol !== 'https:'" in combined
    assert "noopener noreferrer" in combined
    assert "role: 'radiogroup'" in combined
    assert "role: alert ? 'alert' : 'status'" in combined
    assert "aria-live': 'polite'" in combined
    assert "tabindex: '0'" in combined
    assert ".hux-wave-b" in styles
    assert "prefers-reduced-motion" in styles
    assert "body" not in styles and ":root" not in styles


def test_wave_b_files_are_isolated_bounded_and_not_live_wired():
    ours = {
        *PRODUCTION,
        RUNTIME / "wave_b.css",
        ROOT / "testing" / "tests" / "test_hermes_hux_ui_runtime_wave_b_contract.js",
        ROOT / "testing" / "tests" / "test_hermes_hux_ui_runtime_wave_b_dom.js",
    }
    assert all(path.is_file() for path in ours)
    for path in ours:
        assert len(path.read_text(encoding="utf-8").splitlines()) <= 500
    dockerfile = (ROOT / "dockerfiles/Dockerfile.hermes-webui").read_text(encoding="utf-8")
    for path in PRODUCTION:
        assert f"COPY {path.relative_to(ROOT)}" in dockerfile
    bootstrap = (ROOT / "dockerfiles/hermes-webui-hux/bootstrap.js").read_text(encoding="utf-8")
    assert "root.HermesHuxWaveBRuntime.createWaveBRuntime" in bootstrap
    for manifest in (ROOT / "services").rglob("*.yaml"):
        assert "hermes-webui-hux/runtime/wave_b" not in manifest.read_text(encoding="utf-8")