// The Emergency Kit, rendered and read back.
//
// The matrix being right (test/qr.test.mjs) does not mean the document is
// right. Between a correct matrix and a scannable page sit the coordinate
// flip, the module size, the quiet zone, and whether the squares land on the
// same grid — and every one of those can be wrong in a document whose matrix
// is perfect. So this renders the actual PDF and scans it.
//
// Needs python3 with pymupdf, zxing-cpp, pypdf, pillow and numpy. A HARD
// gate: a skip here is indistinguishable from a pass, on the one artifact
// that has to work years from now with nothing else left.

import { test } from "node:test";
import assert from "node:assert/strict";
import { fileURLToPath } from "node:url";
import { dirname, join } from "node:path";
import { run as runOracle } from "./oracle.mjs";

const here = dirname(fileURLToPath(import.meta.url));
const mod = (name) => join(here, "..", "internal", "contra", "static", "crypto", name);

const { accountKeyCard, recoverySheet, handle } = await import(mod("kit.js"));
const { formatCode, TAG_ACCOUNT_KEY, TAG_RECOVERY } = await import(mod("code.js"));
const { fromHex } = await import(mod("bytes.js"));

// Generated fixtures, from the golden vector file. Nothing here is real.
const ACCOUNT_ID = "b22c6a5eae1be9d6a773f474fd0532b0";
const ACCOUNT_KEY = fromHex("f60fb281e8c72f6725add4cbd40e7b08");
const RECOVERY = fromHex("70da5ffc983510bba4672030946b9eed");
const WHEN = new Date(Date.UTC(2026, 8, 2));

function ask(cases) {
  return JSON.parse(runOracle("pdforacle.py", cases));
}

const b64 = (bytes) => Buffer.from(bytes).toString("base64");

test("both documents render, scan, and read back", async () => {
  const cardCode = await formatCode(TAG_ACCOUNT_KEY, ACCOUNT_KEY);
  const sheetCode = await formatCode(TAG_RECOVERY, RECOVERY);

  const verdicts = ask([
    {
      name: "Account Key card",
      pdf_base64: b64(accountKeyCard(ACCOUNT_ID, cardCode, WHEN)),
      expect_code: cardCode,
      expect_text: [
        "Store somewhere safe.",
        "Opens nothing without your passphrase.",
        `Account ${handle(ACCOUNT_ID)}`,
        "Do not photograph this.",
      ],
    },
    {
      name: "Recovery sheet",
      pdf_base64: b64(recoverySheet(ACCOUNT_ID, sheetCode, WHEN)),
      expect_code: sheetCode,
      expect_text: [
        "Store securely.",
        "This sheet alone can open your vault.",
        "Nobody can reissue it.",
        `Account ${handle(ACCOUNT_ID)}`,
        "Printed 2026-09-02",
      ],
    },
  ]);

  for (const v of verdicts) {
    assert.ok(v.qr_scans,
      `${v.name}: the QR in the rendered page did not scan (found ${JSON.stringify(v.scanned)})`);
    assert.ok(v.one_qr, `${v.name}: expected exactly one QR, found ${v.scanned.length}`);
    assert.ok(v.code_in_text, `${v.name}: the code is not in the extractable text`);
    assert.deepEqual(v.missing_text, [], `${v.name}: missing copy`);
    assert.equal(v.pages, 1, `${v.name}: should be a single page`);
  }
});

// The two documents exist to be two files. If either ever carried the other's
// secret, the whole reason for splitting them would be gone — so it is
// checked rather than assumed.
test("neither document carries the other's secret", async () => {
  const cardCode = await formatCode(TAG_ACCOUNT_KEY, ACCOUNT_KEY);
  const sheetCode = await formatCode(TAG_RECOVERY, RECOVERY);

  const card = Buffer.from(accountKeyCard(ACCOUNT_ID, cardCode, WHEN)).toString("latin1");
  const sheet = Buffer.from(recoverySheet(ACCOUNT_ID, sheetCode, WHEN)).toString("latin1");

  assert.ok(card.includes(cardCode), "the card does not contain its own code");
  assert.ok(sheet.includes(sheetCode), "the sheet does not contain its own code");
  assert.ok(!card.includes(sheetCode), "the Account Key card carries the recovery code");
  assert.ok(!sheet.includes(cardCode), "the Recovery sheet carries the Account Key");
});

// The base-14 fonts have no glyph for a curly quote in this encoding, so the
// writer refuses one rather than drawing a wrong character into the document
// somebody is reading at the worst moment of their year.
test("the writer refuses characters it cannot draw", async () => {
  const { Page } = await import(mod("pdf.js"));
  assert.throws(() => new Page().text(10, 10, "don’t"), /cannot draw/);
  assert.throws(() => new Page().wrap(10, 10, 200, "an em — dash"), /cannot draw/);
  // And the copy that ships is already clean, which is the point of the check.
  assert.doesNotThrow(() => new Page().text(10, 10, "Keep it where you'd keep a passport"));
});