#!/usr/bin/env node
/*
 * rollout.test.mjs — the D-01 rollout locks as structural pins (RO1–RO2).
 * -----------------------------------------------------------------------------
 * Plan 08-03 task 2: the ARG2 migration is "rebuild the binary, re-upload the
 * SAME key" — nothing else. These pins make the locks MECHANICAL: the upload
 * script can never grow format awareness and the Worker can never grow a
 * version branch without failing the suite (T-08-08 — enforced, not
 * customary). Grep mechanics are A8's exact shape (comment stripping, assert
 * on stripped code) so a doc-comment mention can never satisfy a pin.
 *
 *   RO1 upload-format-agnostic — upload-road-graph.mjs keeps the storage
 *                                contract (KEY + BUCKET) and its
 *                                comment-stripped code contains ZERO format
 *                                tokens (no landmark/encode/decode/magic/
 *                                GRAPH_VERSION): byte-shipping of the same
 *                                key is the whole migration, forever
 *   RO2 one decode path        — worker-router.ts keeps GRAPH_KEY unchanged
 *                                and exactly ONE decodeGraph call inside the
 *                                loadGraph flow, with NO version-conditional
 *                                branch (an undecodable binary flows to the
 *                                existing null -> router-pending path)
 *
 * NOT duplicated here: RP1a (bot/test/route-privacy.test.mjs) already pins
 * the router's claim-bound identity and never-fetch law — RO2 pins the
 * FORMAT-agnostic law, RP pins the identity/no-fetch law.
 *
 * Run:  npm run routing:test   (exit 0 = all green)
 */
import { strict as assert } from "node:assert";
import { readFileSync } from "node:fs";
import path from "node:path";
import { fileURLToPath } from "node:url";
import { test } from "./harness.mjs";

const here = path.dirname(fileURLToPath(import.meta.url)); // routing/test

/** A8's comment-strip shape: block comments first, then line comments
 *  (the ([^:\\]) guard keeps "://" URLs intact). Assert on STRIPPED code —
 *  a doc-comment mention can never satisfy a pin. */
function stripComments(src) {
  return src
    .replace(/\/\*[\s\S]*?\*\//g, " ")
    .replace(/(^|[^:\\])\/\/[^\n]*/g, "$1");
}

test("RO1 upload-format-agnostic — the upload path is byte-shipping, never format-aware", () => {
  const src = readFileSync(
    path.join(here, "..", "scripts", "upload-road-graph.mjs"),
    "utf8",
  );
  // The storage contract: must agree with worker-router.ts's GRAPH_KEY and
  // bot/wrangler.jsonc's ROAD_GRAPH binding bucket_name (the header's fork
  // contract — your graph, YOUR bucket, same key path).
  assert.ok(src.includes('KEY = "kl-roadgraph.v1.bin"'), "the R2 object key is pinned (renaming it is prohibited — D-01)");
  assert.ok(src.includes('BUCKET = "araharah-graphs"'), "the R2 bucket is pinned");
  // ZERO format awareness in CODE (comment-stripped): the script ships
  // bytes; the binary's header is the only format authority. A fork's
  // upload path stays layout-agnostic forever — it can never grow a
  // landmark/codec/version fork of its own.
  const code = stripComments(src);
  for (const token of [
    "landmark",
    "encodeGraph",
    "decodeGraph",
    "0x41524731", // ARG1 magic
    "0x41524732", // ARG2 magic
    "GRAPH_VERSION",
  ]) {
    assert.ok(!code.includes(token), `upload code must never reference ${token} (the migration is byte-shipping — D-01)`);
  }
});

test("RO2 one decode path at the Worker — the router never branches on format", () => {
  const src = readFileSync(
    path.join(here, "..", "..", "bot", "src", "routing", "worker-router.ts"),
    "utf8",
  );
  const code = stripComments(src);
  // The storage NAME is unchanged ("v1" is a storage name; the binary header
  // is the format truth — documented law, never "fixed" in this phase).
  assert.ok(
    code.includes('GRAPH_KEY = "kl-roadgraph.v1.bin"'),
    "GRAPH_KEY unchanged (the upload key must keep agreeing)",
  );
  // Exactly ONE decodeGraph CALL — the loadGraph flow's single decode path.
  // An undecodable binary flows to the existing null -> router-pending
  // 200-null path (D-01's one-path law at the consumer); a second decode
  // branch (v1 fallback, per-version paths) would fail this pin.
  const calls = code.match(/decodeGraph\(/g) ?? [];
  assert.equal(calls.length, 1, "exactly one decodeGraph call site — the ONE decode path");
  // NO version-conditional branch against the graph bytes: no version
  // constant import/compare, no magic, no `=== 2` anywhere in the file.
  for (const token of ["GRAPH_VERSION", "0x41524731", "0x41524732", "=== 2"]) {
    assert.ok(!code.includes(token), `the router must never branch on format (${token})`);
  }
});