// The flow engine + setup flow, driven end-to-end in Node with a fake io —
// the whole conversation (bubbles, chips, typed answers, photo, validation
// branches, the passkey probe) without a browser. This is the transcript-level
// proof that the flow-as-data refactor preserved setup.js's behaviour, and the
// fixture discipline the Swift interpreter will inherit.
import assert from "node:assert/strict";
import { test } from "node:test";
import { runFlow, renderText, evalCond, cleanNameAnswer, looksLikeEmail, confirmNeeded } from "../web/static/flow.js";
import SETUP_FLOW from "../web/static/setup.flow.js";
import WELCOME_FLOW from "../web/static/welcome.flow.js";

const tick = () => new Promise((r) => setImmediate(r));

// A fake io that mirrors the real engine surface: say dedupes by key||text
// (like eleven.js) but always re-arms chips; verbs return scripted results.
function harness({ verbs = {}, done = {}, enrolled = false, fromHome = false, canEnrol = true, myName = "", homeSignedIn = false, planBook = null, envExtra = {} } = {}) {
  const h = {
    transcript: [], // { text, chips: [labels], extra }
    verbLog: [],
    records: [],
    said: new Set(),
    lastChips: null,
    pendingAsk: null,
    pendingDelays: [],
    doneSteps: { ...done },
    enrolled,
    fromHome,
    canEnrol,
    myName,
    homeSignedIn,
  };
  h.env = {
    threadId: "T",
    respond: () => {},
    typing: null,
    sender: { name: "Eleven", kind: "bot" },
    bridge: {
      myName: () => h.myName,
      enrolled: () => h.enrolled,
      fromHome: () => h.fromHome,
      // Native only: whether this device holds a live Eleven session, which
      // decides whether claiming a space really did push its key anywhere.
      // The web never defines it (undefined reads false), which is why the
      // harness default is false — a web-shaped run must behave as the web
      // does, or every settle that watches this fact fires on the wrong side.
      homeSignedIn: () => h.homeSignedIn,
      // Whether signing in is possible at all (#1377) — false on self-hosted
      // spaces with no home server; the flows skip the un-actionable pitch.
      canEnrol: () => h.canEnrol,
      // The plan step's price book (#1374) — mirrors apps/setup.js's getters;
      // absent (the default) skips the step, like a self-hosted space.
      planPrices: () => !!planBook,
      planTeam: () => !!(planBook && planBook.team),
      planCommunity: () => !!(planBook && planBook.community),
      planFamily: () => !!(planBook && planBook.family),
      planNameTeam: () => (planBook && planBook.team && planBook.team.name) || "",
      planPriceTeam: () => (planBook && planBook.team && planBook.team.price) || "",
      planNameCommunity: () => (planBook && planBook.community && planBook.community.name) || "",
      planPriceCommunity: () => (planBook && planBook.community && planBook.community.price) || "",
      planNameFamily: () => (planBook && planBook.family && planBook.family.name) || "",
      planPriceFamily: () => (planBook && planBook.family && planBook.family.price) || "",
    },
    space: { name: "Old Name", nameSet: false },
    onEnd: () => (h.ended = true),
  };
  Object.assign(h.env, envExtra);
  h.io = {
    say: (env, text, chips, extra) => {
      const key = (extra && extra.key) || text;
      if (!(extra && extra.local) && h.said.has(key)) {
        if (chips) h.lastChips = chips;
        return;
      }
      if (!(extra && extra.local)) h.said.add(key);
      h.transcript.push({ text, chips: (chips || []).map((c) => c.label), extra: extra || {} });
      if (chips) h.lastChips = chips;
    },
    ask: (threadId, cb) => (h.pendingAsk = cb),
    cancelAnswer: () => {
      h.cancelled = (h.cancelled || 0) + 1;
      h.pendingAsk = null;
    },
    verb: (name, args) => {
      h.verbLog.push([name, ...args]);
      const r = verbs[name];
      return typeof r === "function" ? r(...args) : r;
    },
    record: (step, label, value) => {
      h.records.push({ step, label, value });
      h.doneSteps[step] = true;
    },
    done: (step) => !!h.doneSteps[step],
    imgSource: (t) => `IMG(${t})`,
    delay: (ms, fn) => h.pendingDelays.push({ ms, fn }),
  };
  h.answer = async (text, payload) => {
    const cb = h.pendingAsk;
    h.pendingAsk = null;
    cb(text, payload);
    await tick();
    await tick();
  };
  h.tap = async (label) => {
    const chip = (h.lastChips || []).find((c) => c.label === label);
    assert.ok(chip, `chip "${label}" not offered (have: ${(h.lastChips || []).map((c) => c.label).join(", ")})`);
    chip.run();
    await tick();
    await tick();
  };
  h.lastText = () => h.transcript[h.transcript.length - 1].text;
  return h;
}

await test("cleanNameAnswer strips conversational replies down to the name", () => {
  // The exact live failure: the "I'm {name}" chip primes typed replies too.
  assert.equal(cleanNameAnswer("I'm Dermot"), "Dermot");
  assert.equal(cleanNameAnswer("I’m Dermot"), "Dermot"); // iOS smart apostrophe
  assert.equal(cleanNameAnswer("i am dermot"), "dermot"); // case kept as typed
  assert.equal(cleanNameAnswer("My name is Ana."), "Ana");
  assert.equal(cleanNameAnswer("Hi, I'm Dermot!"), "Dermot");
  assert.equal(cleanNameAnswer("hello my name's Bo"), "Bo");
  assert.equal(cleanNameAnswer("you can call me Dermo"), "Dermo");
  assert.equal(cleanNameAnswer("It's Maud"), "Maud");
  assert.equal(cleanNameAnswer("Im Dermot"), "Dermot"); // apostrophe skipped
});

await test("looksLikeEmail: whole-string only — a name with an @ in it is a name", () => {
  for (const yes of ["paul@rslw.com", " Ada@example.co.uk ", "a.b+c@sub.domain.org"]) {
    assert.equal(looksLikeEmail(yes), true, yes);
  }
  for (const no of ["Ada", "Ada @ the shop", "@ada", "ada@", "ada@localhost", "", null, "two@parts@here.com"]) {
    assert.equal(looksLikeEmail(no), false, String(no));
  }
});

await test("confirmNeeded: only a known rule fires, and only with a destination", () => {
  assert.equal(confirmNeeded({ when: "email", goto: "x" }, "a@b.com"), true);
  assert.equal(confirmNeeded({ when: "email", goto: "x" }, "Ada"), false);
  assert.equal(confirmNeeded({ when: "email" }, "a@b.com"), false, "no goto, no jump");
  // Forward compatibility: a rule this build doesn't know must behave as if
  // absent rather than park the conversation on an unreachable step.
  assert.equal(confirmNeeded({ when: "phone", goto: "x" }, "a@b.com"), false);
  assert.equal(confirmNeeded(null, "a@b.com"), false);
});

// An email typed where a name was asked used to become the name the whole
// space sees, silently (Paul, 2026-08-29). Now it is confirmed first — and
// until it is, nothing is recorded and setMyName never runs.
await test("setup: an email answered as a name is confirmed, not swallowed", async () => {
  const h = harness({ verbs: { setMyName: "ok", setGroupName: "ok" } });
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();
  await h.answer("paul@rslw.com");

  assert.match(h.lastText(), /That's an email address/);
  assert.equal(h.verbLog.some((v) => v[0] === "setMyName"), false, "nothing set yet");
  assert.equal(h.records.some((r) => r.step === "name"), false, "nothing recorded yet");

  // Changing your mind re-asks the name, still with nothing recorded.
  await h.tap("Type a different name");
  assert.equal(h.records.some((r) => r.step === "name"), false);
  await h.answer("Paul");
  assert.deepEqual(h.verbLog.find((v) => v[0] === "setMyName"), ["setMyName", "Paul"]);
  assert.equal(h.records.find((r) => r.step === "name").value, "Paul");
  assert.ok(h.transcript.find((t) => t.extra.key === "q-group"), "carried on to the space name");
});

await test("setup: 'Use it anyway' keeps the email as the name, recorded once", async () => {
  const h = harness({ verbs: { setMyName: "ok", setGroupName: "ok" } });
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();
  await h.answer("paul@rslw.com");
  await h.tap("Use it anyway");

  assert.deepEqual(h.verbLog.find((v) => v[0] === "setMyName"), ["setMyName", "paul@rslw.com"]);
  const rec = h.records.filter((r) => r.step === "name");
  assert.equal(rec.length, 1, "the confirm records the NAME step, once");
  assert.equal(rec[0].value, "paul@rslw.com");
  assert.ok(h.transcript.find((t) => t.extra.key === "q-group"), "carried on to the space name");
});

await test("cleanNameAnswer leaves plain names (and lookalikes) alone", () => {
  assert.equal(cleanNameAnswer("Dermot"), "Dermot");
  assert.equal(cleanNameAnswer("  Dermot  "), "Dermot");
  assert.equal(cleanNameAnswer("Hilary"), "Hilary"); // "hi" needs a boundary
  assert.equal(cleanNameAnswer("Ima Jean"), "Ima Jean"); // "im" needs a space
  assert.equal(cleanNameAnswer("Mary-Kate O'Brien"), "Mary-Kate O'Brien");
  // Stripping must never clean a name to nothing — keep the original.
  assert.equal(cleanNameAnswer("I'm"), "I'm");
  assert.equal(cleanNameAnswer(""), "");
});

await test("the name step cleans the typed answer — verb, record, and echo all use it", async () => {
  const h = harness();
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();
  await h.answer("Hi, I'm Dermot!");
  assert.deepEqual(h.verbLog[0], ["setMyName", "Dermot"], "the screen name is the cleaned name");
  assert.deepEqual(h.records[0], { step: "name", label: "noted: you're Dermot", value: "Dermot" });
  const group = h.transcript.find((t) => /Lovely to meet you/.test(t.text));
  assert.match(group.text, /^Lovely to meet you, Dermot! 🤝/, "the echo shows the cleaned name");
});

await test("flows are pure JSON — shippable to native interpreters", () => {
  for (const FLOW of [SETUP_FLOW, WELCOME_FLOW]) {
    assert.deepStrictEqual(JSON.parse(JSON.stringify(FLOW)), FLOW);
    assert.equal(FLOW.schema, 1);
    // Every goto/skipTo/auto/probe/record target names a real step.
    const ids = new Set(FLOW.steps.map((s) => s.id));
    const targets = JSON.stringify(FLOW).match(/"(?:goto|skipTo|auto|step)":"([^"]+)"/g) || [];
    for (const t of targets) {
      const id = t.split(":")[1].replaceAll('"', "");
      assert.ok(ids.has(id), `${FLOW.flow}: dangling target ${id}`);
    }
  }
});

await test("setup: the full first-run transcript, happy path with detours", async () => {
  const h = harness({
    verbs: {
      setGroupName: (name) => (name === "X" ? "invalid" : "ok"),
      setContactEmail: (e) => (e.includes("@") ? "ok" : "invalid"),
      adoptServerPhoto: () => true,
    },
  });
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();

  // Greeting + name question (fresh run: not resumed, no "Welcome back").
  assert.match(h.transcript[0].text, /^Hi — I'm Eleven! 👋/);
  assert.equal(h.transcript[1].extra.label, "Your name:");
  assert.equal(h.transcript[1].extra.hint, "e.g. Finn Wolfhard");
  assert.equal(h.transcript.some((t) => /Welcome back/.test(t.text)), false);

  // Name: 40 chars caps to 32 (the profile-rename cap).
  await h.answer("A".repeat(40));
  assert.deepEqual(h.verbLog[0], ["setMyName", "A".repeat(32)]);
  assert.equal(h.records[0].step, "name");

  // Group: ack folded into the context bubble; no Keep chip (nameSet=false).
  // (lastChips still holds the name step's quick-form chip — a chipless say
  // doesn't reset it — so check the Keep chip's absence, not emptiness.)
  const group = h.transcript.find((t) => t.extra.key === "q-group");
  assert.match(group.text, /^Lovely to meet you, A{32}! 🤝\n\nNext, this space needs a name/);
  assert.equal((h.lastChips || []).some((c) => /^Keep/.test(c.label)), false, "no Keep chip on a fresh instance");

  // Rejected name says the honest error and re-asks; accepted name records.
  await h.answer("X");
  assert.match(h.lastText(), /didn't stick — it needs to be 1–60/);
  await h.answer("Team Awesome");
  assert.equal(h.env.space.name, "Team Awesome");
  assert.deepEqual(h.records[1], { step: "group", label: "named this space “Team Awesome”", value: "Team Awesome" });

  // Email: invalid re-asks in place with the Skip chip still live.
  await h.answer("not-an-email");
  assert.match(h.lastText(), /doesn't look like an email address/);
  assert.ok(h.lastChips.find((c) => c.label === "Skip for now"));
  await h.answer("paul@example.com");
  assert.equal(h.records[2].label, "noted a contact email");

  // Photo: a text-only reply is rejected and the waiter re-arms.
  await h.answer("here you go", { attachments: [] });
  assert.match(h.lastText(), /Send it as a picture/);
  await h.answer("Our logo", { attachments: [{ type: "image/jpeg", id: "img1" }] });
  const adopt = h.verbLog.find((v) => v[0] === "adoptServerPhoto");
  assert.equal(adopt[2], "Our logo", "message text rides as alt text");

  // Preview: alt-text publicity warning verbatim, image bubble, Keep records.
  assert.match(h.lastText(), /“Our logo” — and like the photo itself it's PUBLIC/);
  assert.equal(h.transcript[h.transcript.length - 1].extra.img, "IMG($serverAvatar)");
  await h.tap("Keep this photo");
  assert.deepEqual(h.records[3], { step: "photo", label: "set the space photo", value: "Our logo" });

  // Invites → extras → the AI opt-in → keys: the one-tap common path records
  // and moves on, and AI is always its own explicit question.
  await h.tap("Only me");
  assert.ok(h.verbLog.find((v) => v[0] === "setUserInvites" && v[1] === false));
  assert.ok(h.transcript.find((t) => /comes with a couple of extras/.test(t.text)));
  await h.tap("Keep both on");
  assert.ok(h.records.find((r) => r.step === "extras" && r.value === "all-on"));
  assert.equal(h.verbLog.some((v) => v[0] === "setFeature"), false, "keeping defaults writes nothing");
  assert.ok(h.transcript.find((t) => /read the chats it's invited to/.test(t.text)), "the AI question carries the honest note");
  await h.tap("Bring Eleven in");
  assert.deepEqual(h.verbLog.at(-1), ["setFeature", "ai", true], "opting in writes the gate explicitly");
  assert.ok(h.records.find((r) => r.step === "ai-optin" && r.value === "on"));
  assert.ok(h.transcript.find((t) => /Now the most important thing of all/.test(t.text)));
  await h.tap("Sign in");
  assert.ok(h.verbLog.find((v) => v[0] === "savePasskey"));

  // The probe fires with no enrolment → the stayed-in-place waiting step. (The
  // step also arms a background settle poll; target the probe by its interval.)
  const keysProbe = h.pendingDelays.find((d) => d.ms === 1500);
  assert.ok(keysProbe, "the Sign in probe schedules a 1500ms check");
  keysProbe.fn();
  await tick();
  assert.match(h.lastText(), /I'll wait here while you finish/);

  // They finish the ceremony elsewhere; Continue records the verified label.
  h.enrolled = true;
  await h.tap("Continue");
  assert.deepEqual(h.records.find((r) => r.step === "keys"), { step: "keys", label: "Signed in — your space's key is safe", value: "passkey" });
  assert.deepEqual(h.records.at(-1), { step: "finish", label: "Your space is ready", value: "done" }, "finish persists its completion marker");

  // Finish: complete marked, no reminder deferral (backed up), no nag line.
  assert.ok(h.verbLog.find((v) => v[0] === "markSetupComplete"));
  assert.equal(h.verbLog.some((v) => v[0] === "deferBackupReminders"), false);
  const fin = h.transcript.find((t) => /Team Awesome is ready! 🎉/.test(t.text));
  assert.equal(/One more reminder/.test(fin.text), false);
  await h.tap("Open admin");
  assert.ok(h.verbLog.find((v) => v[0] === "openAdmin"));
  assert.ok(h.ended, "flow signalled completion");
});

await test("setup: a device that already knows the name RECORDS the skip so other clients converge", async () => {
  // The 2026-07-19 web-vs-Mac divergence: a second device joining mid-flow
  // with the member's name already known (an add-device link ships it in the
  // fragment) skipped the name step via a bare skipIf — nothing landed in
  // the log, so a client that did NOT know the name stayed armed on
  // "Your name:" forever while this one moved on. The skip must be a
  // recorded entry: done.name folds to every client.
  const h = harness({ myName: "Paul" });
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();

  // First run with a name: still greeted (resumedIf deliberately ignores
  // bridge.myName — the creator's first run keeps its hello), the name
  // question never asked, and — the fix — the skip is IN THE LOG.
  assert.match(h.transcript[0].text, /^Hi — I'm Eleven!/);
  assert.equal(h.transcript.some((t) => /what should everyone here call you/.test(t.text)), false);
  assert.ok(h.records.find((r) => r.step === "name"), "the known-name skip writes done.name");

  // A nameless client folding that record lands on the same step (group)
  // instead of re-arming the name question.
  const h2 = harness({ done: { name: true } });
  runFlow(SETUP_FLOW, h2.env, h2.io);
  await tick();
  assert.equal(h2.transcript.some((t) => /what should everyone here call you/.test(t.text)), false);
  assert.ok(h2.transcript.find((t) => t.extra.key === "q-group"), "converged on the group step");
});

await test("setup: a reentry re-derive resumes quietly — no 'Welcome back' spam", async () => {
  // env.reentry marks a mid-session restart (the setup host reboots the flow
  // when ANOTHER client answers the parked step). It re-derives position from
  // the folded log like any resume, but must not re-greet: one "Welcome back"
  // per foreign answer would spam the feed.
  const h = harness({ myName: "Paul", done: { name: true, group: true }, envExtra: { reentry: true } });
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();
  assert.equal(h.transcript.some((t) => /^Welcome back/.test(t.text)), false, "no re-greeting");
  // …and it still lands parked on the first unanswered step (email).
  assert.ok(h.transcript.find((t) => /How can people here reach you outside the chat/.test(t.text)));
});

await test("setup: resumed run — skips, Keep chip, skip-everything path", async () => {
  // Resumed = a recorded step (done.name), not merely a set name — a name
  // alone is the native creator's FIRST run and still gets the greeting.
  const h = harness({ myName: "Paul", done: { name: true }, verbs: { setContactEmail: () => "ok" } });
  h.env.space = { name: "Old Name", nameSet: true };
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();

  // Resumed: brief local re-greeting, name step skipped entirely.
  assert.match(h.transcript[0].text, /^Welcome back/);
  assert.equal(h.transcript[0].extra.local, true);
  assert.equal(h.transcript.some((t) => /what should everyone here call you/.test(t.text)), false);

  // Group offers keeping the explicitly-set current name.
  assert.match(h.transcript.find((t) => t.extra.key === "q-group").text, /^Next, this space needs a name/);
  await h.tap("Keep “Old Name”");
  assert.equal(h.verbLog.some((v) => v[0] === "setGroupName"), false, "Keep never re-saves the name");

  await h.tap("Skip for now"); // email
  await h.tap("Skip for now"); // photo — must disarm the waiter
  assert.equal(h.cancelled, 1, "photo skip cancels the pending answer");
  await h.tap("Members can invite people");
  await h.tap("Keep both on");
  await h.tap("Not now"); // the AI opt-in — declining writes an explicit off
  assert.deepEqual(h.verbLog.at(-1), ["setFeature", "ai", false]);

  // Keys: decline twice through the plain-words confirm.
  await h.tap("Not now");
  assert.match(h.lastText(), /I have to be straight with you/);
  await h.tap("I understand the risk");
  assert.deepEqual(h.records.find((r) => r.step === "keys"), { step: "keys", label: "Skipped signing in for now", value: "skipped" });
  assert.deepEqual(h.records.at(-1), { step: "finish", label: "Your space is ready", value: "done" });

  // Finish without a backup: reminders deferred, the nag line present.
  assert.ok(h.verbLog.find((v) => v[0] === "deferBackupReminders"));
  assert.ok(h.verbLog.find((v) => v[0] === "markSetupComplete"));
  assert.ok(h.transcript.find((t) => /One more reminder before you go/.test(t.text)));
  assert.ok(h.transcript.find((t) => /Old Name is ready! 🎉/.test(t.text)));
});

await test("setup: already enrolled — keys short-circuits with the once-only ack", async () => {
  const h = harness({
    myName: "Paul",
    enrolled: true,
    done: { name: true, group: true, email: true, photo: true, invites: true, extras: true, "ai-optin": true },
  });
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();
  assert.deepEqual(h.records[0], { step: "keys", label: "Signed in — your space's key is safe", value: "passkey" });
  assert.ok(h.transcript.find((t) => /your space's key is safe. ✅/.test(t.text)));
  assert.equal(h.verbLog.some((v) => v[0] === "deferBackupReminders"), false);
  assert.ok(h.verbLog.find((v) => v[0] === "markSetupComplete"));

  // Second entry with keys done: no duplicate record, straight to finish.
  const h2 = harness({ myName: "Paul", enrolled: true, done: { name: true, group: true, email: true, photo: true, invites: true, extras: true, "ai-optin": true, keys: true } });
  runFlow(SETUP_FLOW, h2.env, h2.io);
  await tick();
  // No duplicate keys record — only finish stamping its completion marker.
  assert.deepEqual(h2.records, [{ step: "finish", label: "Your space is ready", value: "done" }]);
  assert.equal(h2.transcript.some((t) => /key is safe. ✅/.test(t.text)), false);
});

await test("setup: extras — 'Let me choose' walks the pair, then the AI opt-in", async () => {
  const h = harness({
    myName: "Paul",
    done: { name: true, group: true, email: true, photo: true, invites: true },
  });
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();
  assert.ok(h.transcript.find((t) => /comes with a couple of extras/.test(t.text)));

  await h.tap("Let me choose");
  assert.ok(h.transcript.find((t) => /Bots — helpers/.test(t.text)));
  await h.tap("Enable bots");
  assert.deepEqual(h.verbLog.at(-1), ["setFeature", "bots", true]);
  await h.tap("No apps here");
  assert.deepEqual(h.verbLog.at(-1), ["setFeature", "apps", false]);
  // The AI opt-in follows the granular pair too — never skippable by path.
  assert.ok(h.transcript.find((t) => /read the chats it's invited to/.test(t.text)));
  await h.tap("Not now");
  assert.deepEqual(h.verbLog.at(-1), ["setFeature", "ai", false]);
  assert.ok(h.records.find((r) => r.step === "extras-apps" && r.value === "off"));
  assert.ok(h.records.find((r) => r.step === "ai-optin" && r.value === "off"));
  // The path lands on the keys pitch like the one-tap path.
  assert.ok(h.transcript.find((t) => /Now the most important thing of all/.test(t.text)));

  // Resume after the granular path: the extras entry closes the step out and
  // neither the pair nor the AI question replays.
  const h2 = harness({
    myName: "Paul",
    enrolled: true,
    done: { ...h.doneSteps },
  });
  runFlow(SETUP_FLOW, h2.env, h2.io);
  await tick();
  assert.equal(h2.transcript.some((t) => /read the chats it's invited to/.test(t.text)), false, "answered steps don't replay");
  assert.ok(h2.records.find((r) => r.step === "extras" && r.value === "chosen"), "the entry closes extras");
  assert.ok(h2.records.find((r) => r.step === "keys"), "resume reaches keys");
});

await test("setup: from-home key step + settle auto-detects the enrolment return", async () => {
  const h = harness({
    myName: "Paul",
    fromHome: true, // arrived from the Eleven sign-in page → the keys-home variant
    done: { name: true, group: true, email: true, photo: true, invites: true, extras: true, "ai-optin": true },
  });
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();

  // fromHome routes to keys-home ("add to your passkey"), not the from-scratch pitch.
  assert.ok(h.transcript.find((t) => /Last thing — the key/.test(t.text)), "keys-home shown");
  assert.equal(h.transcript.some((t) => /Now the most important thing of all/.test(t.text)), false);

  // The ceremony returns asynchronously: enrolment lands, and the settle poll —
  // NOT a manual "Continue" tap — carries the flow on to finish.
  const settle = h.pendingDelays.find((d) => d.ms === 700);
  assert.ok(settle, "keys-home arms a settle poll while it waits");
  h.enrolled = true;
  settle.fn();
  await tick();
  await tick();
  assert.deepEqual(h.records.find((r) => r.step === "keys-home"), { step: "keys-home", label: "Signed in — your space's key is safe", value: "passkey" });
  assert.deepEqual(h.records.at(-1), { step: "finish", label: "Your space is ready", value: "done" });
  assert.ok(h.transcript.find((t) => /your space's key is safe. ✅/.test(t.text)));
  assert.ok(h.verbLog.find((v) => v[0] === "markSetupComplete"), "reached finish without a tap");
});

await test("setup: native creator — greeting shows, name pre-set, passkey never pitched, no admin hop", async () => {
  // The native create-space landing: screen name typed in the create UI, the
  // conversation runs in the app-thread's embedded webview with env.native.
  const h = harness({ myName: "Paul", homeSignedIn: true,
                      verbs: { setGroupName: () => "ok", setContactEmail: () => "ok" } });
  h.env.native = true;
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();

  // First run WITH a name: still greeted (not "resumed"), name step skipped.
  assert.match(h.transcript[0].text, /^Hi — I'm Eleven! 👋/);
  assert.equal(h.transcript.some((t) => /Welcome back/.test(t.text)), false);
  assert.equal(h.transcript.some((t) => /what should everyone here call you/.test(t.text)), false);
  assert.ok(h.transcript.find((t) => t.extra.key === "q-group"));

  await h.answer("Team Awesome");
  await h.tap("Skip for now"); // email; photo auto-skips under native
  assert.equal(h.transcript.some((t) => t.extra.key === "q-photo"), false);
  await h.tap("Members can invite people");
  await h.tap("Keep both on");
  await h.tap("Not now"); // the AI opt-in runs under native too

  // Keys: never pitched — recorded as covered by the Eleven account.
  assert.equal(h.transcript.some((t) => /Now the most important thing of all/.test(t.text)), false);
  assert.equal(h.verbLog.some((v) => v[0] === "savePasskey"), false);
  assert.deepEqual(h.records.find((r) => r.step === "keys"), { step: "keys", label: "Your space's key is saved with your Eleven account", value: "native" });

  // Finish: completion marker recorded, complete marked, no backup nag or
  // reminder deferral (the key IS backed up), and no web-only chips (admin
  // hop, tour) — the finish bubble's /admin pointer covers it.
  assert.deepEqual(h.records.at(-1), { step: "finish", label: "Your space is ready", value: "done" });
  assert.ok(h.verbLog.find((v) => v[0] === "markSetupComplete"));
  assert.equal(h.verbLog.some((v) => v[0] === "deferBackupReminders"), false);
  assert.equal(h.transcript.some((t) => /One more reminder/.test(t.text)), false);
  const chipLabels = h.transcript.flatMap((t) => t.chips || []); // harness stores labels
  assert.equal(chipLabels.includes("Take the tour"), false, "the tour stays web-only");
  assert.ok(chipLabels.includes("Open admin"), "native hops to Admin");
});

await test("setup: keys answered-but-not-enrolled resumes to FINISH — never re-pitched (#1377)", async () => {
  // The bug: done.keys with the enrolled flag lost ("Continue" after a
  // detour, "I understand the risk", cleared storage) re-pitched the whole
  // sign-in speech on every resume and never reached markSetupComplete.
  const h = harness({
    myName: "Paul",
    enrolled: false,
    done: { name: true, group: true, email: true, photo: true, invites: true, extras: true, "ai-optin": true, keys: true },
  });
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();
  assert.equal(h.transcript.some((t) => /Now the most important thing of all/.test(t.text)), false, "the pitch never replays");
  assert.deepEqual(h.records, [{ step: "finish", label: "Your space is ready", value: "done" }]);
  assert.ok(h.verbLog.find((v) => v[0] === "markSetupComplete"), "setup completes");
  // Not enrolled in THIS browser: the finish reminder stays, honestly.
  assert.ok(h.transcript.find((t) => /One more reminder before you go/.test(t.text)));
  // And the finish bubble carries its stable dedup key (renames and backup
  // flips must not persist a second copy).
  assert.equal(h.transcript.find((t) => /is ready! 🎉/.test(t.text)).extra.key, "q-finish");
});

await test("setup: no home server — the sign-in pitch vanishes, recorded honestly (#1377)", async () => {
  const h = harness({
    myName: "Paul",
    canEnrol: false,
    done: { name: true, group: true, email: true, photo: true, invites: true, extras: true, "ai-optin": true },
  });
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();
  assert.equal(h.transcript.some((t) => /Now the most important thing of all/.test(t.text)), false, "no un-actionable pitch");
  assert.deepEqual(h.records[0], { step: "keys", label: "This browser holds this space's key", value: "local" });
  assert.ok(h.verbLog.find((v) => v[0] === "markSetupComplete"));
  // No sign-in to nag about, and no dead Sign in chip on the finish line.
  assert.equal(h.transcript.some((t) => /One more reminder before you go/.test(t.text)), false);
  assert.equal(h.transcript.flatMap((t) => t.chips || []).includes("Sign in"), false);
});

await test("welcome: no home server — the access ask vanishes, recorded honestly (#1377)", async () => {
  // Inline env — welcomeEnv() is declared with the welcome section below.
  const h = harness({
    canEnrol: false,
    envExtra: { suggested: "", inviterName: "", adminName: "", hasPendingThread: false, space: { name: "Test Space", nameSet: true } },
  });
  runFlow(WELCOME_FLOW, h.env, h.io);
  await tick();
  assert.equal(h.transcript.some((t) => /make sure you can't lose your way in/.test(t.text)), false, "no un-actionable ask");
  assert.deepEqual(h.records[0], { step: "access", label: "Your access lives in this browser", value: "local" });
  // Straight to the name question instead.
  assert.ok(h.transcript.find((t) => /call you/.test(t.text) || /your name/i.test(t.text)));
});

await test("engine: a re-derive consumes env.reentry — the NEXT resume greets again (#1377)", async () => {
  const h = harness({ myName: "Paul", done: { name: true, group: true }, envExtra: { reentry: true } });
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();
  assert.equal(h.transcript.some((t) => /Welcome back/.test(t.text)), false, "the re-derive itself stays quiet");
  assert.equal(h.env.reentry, false, "consumed — a later genuine resume isn't silenced");
});

await test("setup: the plan step — asked with a price book, priced from it, recorded on 'plan'", async () => {
  // #1374: "who is this space for?" lives in the conversation; the create
  // slider is never pay-gated. Names + prices interpolate from the book.
  const book = {
    team: { key: "business", name: "Business", price: "€11 per person per year" },
    community: { key: "community", name: "Community & Friends", price: "€0.11 per member per year (€11 minimum)" },
    family: { key: "family", name: "Family", price: "€5.50 a year" },
  };
  const h = harness({
    myName: "Paul",
    planBook: book,
    done: { name: true, group: true, email: true, photo: true, invites: true, extras: true, "ai-optin": true },
  });
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();

  const q = h.transcript.find((t) => t.extra.key === "q-plan");
  assert.ok(q, "the plan question is asked");
  assert.match(q.text, /who is this space for\?/);
  assert.deepEqual(q.chips, ["A team", "A community", "Family & friends", "Keep it free"]);

  await h.tap("A team");
  const price = h.transcript.find((t) => t.extra.key === "q-plan-team");
  assert.match(price.text, /Business: €11 per person per year/, "name + price come from the book, not the script");
  await h.tap("Choose Business");
  assert.deepEqual(h.records.find((r) => r.step === "plan"), {
    step: "plan",
    label: "chose the Business plan — payment waits at the finish line",
    value: "team",
  });

  // The keys pitch follows; decline through to finish — which carries the
  // plan note and the payment chip (an action chip, never a side effect).
  await h.tap("Not now");
  await h.tap("I understand the risk");
  assert.ok(h.transcript.find((t) => /the plan you picked — tap below/.test(t.text)));
  await h.tap("Set up your plan");
  assert.ok(h.verbLog.find((v) => v[0] === "openPlanCheckout"), "the chip fires the checkout verb");
  assert.ok(h.verbLog.find((v) => v[0] === "markSetupComplete"), "the flow still completes");
});

await test("setup: the plan step — 'Keep it free' records free; a partial book trims its chips", async () => {
  const h = harness({
    myName: "Paul",
    planBook: { family: { key: "family", name: "Family", price: "€5.50 a year" } },
    done: { name: true, group: true, email: true, photo: true, invites: true, extras: true, "ai-optin": true },
  });
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();
  const q = h.transcript.find((t) => t.extra.key === "q-plan");
  assert.deepEqual(q.chips, ["Family & friends", "Keep it free"], "only tiers the book offers get chips");
  await h.tap("Family & friends");
  await h.tap("Keep it free");
  assert.deepEqual(h.records.find((r) => r.step === "plan"), { step: "plan", label: "kept this space free", value: "free" });
  // No plan chosen → no payment note and no payment chip at the finish.
  await h.tap("Not now");
  await h.tap("I understand the risk");
  assert.equal(h.transcript.some((t) => /the plan you picked/.test(t.text)), false);
  assert.equal(h.transcript.flatMap((t) => t.chips || []).includes("Set up your plan"), false);
});

await test("setup: the plan step vanishes without a price book, on native, and once done", async () => {
  // No book (self-hosted, billing off, unreachable): straight to keys.
  const h = harness({ myName: "Paul", done: { name: true, group: true, email: true, photo: true, invites: true, extras: true, "ai-optin": true } });
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();
  assert.equal(h.transcript.some((t) => t.extra.key === "q-plan"), false);
  assert.ok(h.transcript.find((t) => /Now the most important thing of all/.test(t.text)));

  // Done (answered on another client): never re-asked, even with a book.
  const book = { family: { key: "family", name: "Family", price: "€5.50 a year" } };
  const h2 = harness({
    myName: "Paul",
    planBook: book,
    done: { name: true, group: true, email: true, photo: true, invites: true, extras: true, "ai-optin": true, plan: true },
  });
  runFlow(SETUP_FLOW, h2.env, h2.io);
  await tick();
  assert.equal(h2.transcript.some((t) => t.extra.key === "q-plan"), false);
});

await test("engine: template + condition mini-language", () => {
  const env = { vars: { x: "hi" }, space: { name: "" }, __ack: "A" };
  assert.equal(renderText(env, "{vars.x} {space.name|fallback}"), "hi fallback");
  assert.equal(renderText(env, "{ack?}rest"), "A\n\nrest");
  assert.equal(renderText(env, "{ack?}rest"), "rest", "ack is consumed");
  assert.equal(renderText(env, ["a", { if: "vars.x", text: "-b" }, { if: "vars.missing", text: "-c" }]), "a-b");
  assert.equal(renderText(env, { if: "vars.missing", then: "T", else: "E" }), "E");
  assert.equal(evalCond(env, "!vars.missing"), true);
});

// ---- welcome flow -----------------------------------------------------------

const welcomeEnv = (over = {}) => ({
  suggested: "",
  inviterName: "",
  adminName: "",
  hasPendingThread: false,
  space: { name: "Test Space", nameSet: true },
  ...over,
});

await test("welcome: the joiner's name step confirms an email the same way", async () => {
  // Past the access step (already signed in) so the name question is up.
  const h = harness({ verbs: { setMyName: "ok" }, enrolled: true,
                      done: { access: true }, envExtra: welcomeEnv() });
  h.env.accessBackedUp = () => true;
  runFlow(WELCOME_FLOW, h.env, h.io);
  await tick();
  await h.answer("paul@rslw.com");
  assert.match(h.lastText(), /That's an email address/);
  await h.tap("Use it anyway");
  assert.deepEqual(h.verbLog.find((v) => v[0] === "setMyName"), ["setMyName", "paul@rslw.com"]);
  assert.equal(h.records.filter((r) => r.step === "name").length, 1);
});

// Native, signed OUT of Eleven: claiming a space pushes nothing (HomeSync
// no-ops without a session), so the conversation must not claim an account
// that isn't there (Paul, 2026-08-29).
// A native shell that CAN offer a sign-in (the app wired signInToEleven, so
// canEnrol is true) pitches it like the web does — in the app's own words —
// and settles on the session landing, with no "Continue" tap.
await test("setup: native signed out — pitched in device words, settles on the sign-in", async () => {
  const h = harness({ myName: "Paul", homeSignedIn: false, canEnrol: true,
                      verbs: { setGroupName: () => "ok", setContactEmail: () => "ok" } });
  h.env.native = true;
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();
  await h.answer("Team Awesome");
  await h.tap("Skip for now");
  await h.tap("Members can invite people");
  await h.tap("Keep both on");
  await h.tap("Not now"); // AI opt-in

  const pitch = h.transcript.find((t) => /Now the most important thing of all/.test(t.text));
  assert.ok(pitch, "the key pitch runs");
  assert.match(pitch.text, /this device holds the only key/, "device words, not browser words");
  assert.ok(h.transcript.some((t) => /every device you sign in on can open this space/.test(t.text)));

  await h.tap("Sign in");
  assert.ok(h.verbLog.some((v) => v[0] === "savePasskey"), "the host is asked to open its sign-in");

  // The app signs in; the step's settle poll notices without a tap.
  h.homeSignedIn = true;
  const settle = h.pendingDelays.filter((d) => d.ms === 700).at(-1);
  assert.ok(settle, "the keys step arms a settle poll");
  settle.fn();
  await tick();
  await tick();
  assert.deepEqual(h.records.find((r) => r.step === "keys"),
    { step: "keys", label: "Your space's key is saved with your Eleven account", value: "native" });
  assert.ok(h.verbLog.some((v) => v[0] === "markSetupComplete"), "carried on to finish");
  assert.equal(h.transcript.some((t) => /One more reminder/.test(t.text)), false, "no nag — it's saved");
});

await test("setup: native without an Eleven session says where the key really is", async () => {
  // canEnrol false mirrors the native bridge: a sign-in can't be run from
  // inside the conversation, so the flows must not offer one.
  const h = harness({ myName: "Paul", homeSignedIn: false, canEnrol: false,
                      verbs: { setGroupName: () => "ok", setContactEmail: () => "ok" } });
  h.env.native = true;
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();
  await h.answer("Team Awesome");
  await h.tap("Skip for now");
  await h.tap("Members can invite people");
  await h.tap("Keep both on");
  await h.tap("Not now");

  assert.deepEqual(h.records.find((r) => r.step === "keys"),
    { step: "keys", label: "This device holds this space's key", value: "local" });
  // Still no pitch and no dead chip — signing in lives in the app's own
  // surfaces, not in this conversation.
  assert.equal(h.transcript.some((t) => /Now the most important thing of all/.test(t.text)), false);
  assert.equal(h.verbLog.some((v) => v[0] === "savePasskey"), false);
  assert.equal(h.transcript.flatMap((t) => t.chips).includes("Sign in"), false);
  assert.ok(h.verbLog.some((v) => v[0] === "markSetupComplete"), "still reaches finish");
});

await test("welcome: native without an Eleven session records the device, not an account", async () => {
  const h = harness({ homeSignedIn: false, canEnrol: false, envExtra: welcomeEnv() });
  h.env.native = true;
  h.env.accessBackedUp = () => false;
  runFlow(WELCOME_FLOW, h.env, h.io);
  await tick();
  assert.deepEqual(h.records.find((r) => r.step === "access"),
    { step: "access", label: "Your access lives on this device", value: "local" });
  assert.equal(h.transcript.some((t) => /Before anything else/.test(t.text)), false, "no pitch");
});

// The quick-form fast path: both conversations' FIRST interactive step offers
// a right-aligned "Fill in a form instead" chip whose tap opens the host form
// (the openQuickForm verb) WITHOUT consuming the step — the conversation stays
// answerable while the form is up (Cancel walks away scot-free).
await test("quick form: the trailing fast-path chip on welcome access + setup name", async () => {
  const h = harness({ envExtra: welcomeEnv() });
  runFlow(WELCOME_FLOW, h.env, h.io);
  await tick();
  const chip = (h.lastChips || []).find((c) => c.label === "Fill in a form instead");
  assert.ok(chip, "the welcome access step offers the quick-form chip");
  assert.equal(chip.trailing, true, "flagged trailing — the renderer right-aligns it");
  assert.equal((h.lastChips || []).find((c) => c.label === "Sign in (recommended)").trailing, undefined, "primary chips stay untagged");
  await h.tap("Fill in a form instead");
  assert.ok(h.verbLog.find((v) => v[0] === "openQuickForm"), "the tap fires the openQuickForm verb");
  await h.tap("Sign in (recommended)"); // non-advancing: the step is still live after peeking at the form
  assert.ok(h.verbLog.find((v) => v[0] === "savePasskey"));

  const h2 = harness();
  runFlow(SETUP_FLOW, h2.env, h2.io);
  await tick();
  const chip2 = (h2.lastChips || []).find((c) => c.label === "Fill in a form instead");
  assert.ok(chip2, "the setup name step offers the quick-form chip");
  assert.equal(chip2.trailing, true);
  await h2.tap("Fill in a form instead");
  assert.ok(h2.verbLog.find((v) => v[0] === "openQuickForm"));
  await h2.answer("Paul"); // the typed answer still lands after the chip tap
  assert.deepEqual(h2.verbLog.find((v) => v[0] === "setMyName"), ["setMyName", "Paul"]);
});

await test("welcome: invited fresh join — passkey probe, suggested name, photo nokey retry", async () => {
  let photoTries = 0;
  const h = harness({
    verbs: { adoptProfilePhoto: () => (++photoTries === 1 ? "nokey" : true) },
    envExtra: welcomeEnv({ suggested: "Luan", inviterName: "Ciara", hasPendingThread: true }),
  });
  h.env.accessBackedUp = () => h.enrolled;
  runFlow(WELCOME_FLOW, h.env, h.io);
  await tick();

  // The greeting assumes nothing: inviter named, admin unknown → generic.
  assert.match(h.transcript[0].text, /^Welcome! 👋 I'm Eleven, your guide here\./);
  assert.match(h.transcript[0].text, /Ciara invited you to Test Space/);
  assert.match(h.transcript[0].text, /run by one of its members/);
  assert.match(h.transcript[0].text, /locked with keys only members hold/);

  // Passkey first; the ceremony stays put → probe routes to the waiting step.
  // (The step also arms a background settle poll; target the probe by interval.)
  await h.tap("Sign in (recommended)");
  const accessProbe = h.pendingDelays.find((d) => d.ms === 1500);
  assert.ok(accessProbe, "the Save-my-access probe schedules a 1500ms check");
  accessProbe.fn();
  await tick();
  assert.match(h.lastText(), /I'll wait here while you finish/);
  h.enrolled = true;
  await h.tap("Continue");
  assert.deepEqual(h.records[0], { step: "access", label: "Signed in — your access is safe", value: "passkey" });

  // The ack folds into the name question; the suggested-name chip is offered.
  const nameQ = h.transcript.find((t) => t.extra.key === "q-name");
  assert.match(nameQ.text, /^Perfect — you're all set\. 🔒\n\nFirst things first/);
  await h.tap("I'm Luan");
  assert.deepEqual(h.verbLog.find((v) => v[0] === "setMyName"), ["setMyName", "Luan"]);
  assert.equal(h.records[1].label, "noted: you're Luan");

  // Photo: instance key not here yet → honest nokey line, then a retry works.
  const photoQ = h.transcript.find((t) => t.extra.key === "q-photo");
  assert.match(photoQ.text, /^Lovely to meet you, Luan! 🤝\n\nWant to add a profile photo\?/);
  await h.answer("me on holiday", { attachments: [{ type: "image/png" }] });
  assert.ok(h.transcript.find((t) => /still finishing your secure setup/.test(t.text)));
  assert.match(h.lastText(), /Ready when you are — send that photo again/);
  await h.answer("me on holiday", { attachments: [{ type: "image/png" }] });
  assert.deepEqual(h.verbLog.filter((v) => v[0] === "adoptProfilePhoto").length, 2);

  // Preview is client-only with the round profile image; Keep records "photo".
  assert.equal(h.transcript.at(-1).extra.img, "IMG($myAvatar)");
  assert.equal(h.transcript.at(-1).extra.imgRound, true);
  await h.tap("Keep this photo");
  assert.deepEqual(h.records.find((r) => r.step === "photo"), { step: "photo", label: "set your profile photo", value: "" });
  assert.deepEqual(h.records.at(-1), { step: "finish", label: "You're all set", value: "done" }, "finish persists its completion marker");

  // Finish: welcome marked done, no backup nag (enrolled), inviter chip first.
  assert.ok(h.verbLog.find((v) => v[0] === "markWelcomeDone"));
  const fin = h.transcript.find((t) => t.extra.key === "q-finish");
  assert.match(fin.text, /you're all set\. 🎉 Enjoy Test Space!/);
  assert.equal(/One more reminder/.test(fin.text), false);
  await h.tap("Say hi to Ciara");
  assert.ok(h.verbLog.find((v) => v[0] === "openPendingThread"));
  assert.ok(h.lastChips.find((c) => c.label === "Take the tour"));
  assert.ok(h.ended);
});

await test("welcome: skip everything — nudge acks, photo skip disarms, nag on finish", async () => {
  const h = harness({ envExtra: welcomeEnv({ space: { name: "", nameSet: false } }) });
  h.env.accessBackedUp = () => false;
  runFlow(WELCOME_FLOW, h.env, h.io);
  await tick();

  // No inviter → the generic invitation line, with the space-name fallback.
  assert.match(h.transcript[0].text, /You've been invited to this space/);

  await h.tap("Not now");
  assert.ok(h.verbLog.find((v) => v[0] === "deferBackupReminders"), "declining defers the reminders");
  const nameQ = h.transcript.find((t) => t.extra.key === "q-name");
  assert.match(nameQ.text, /^No problem — I'll nudge you again in a day or so\.\n\nFirst things first/);
  assert.deepEqual(nameQ.chips, [], "no suggested-name chip without a suggestion");

  await h.answer("Paul");
  await h.tap("Skip for now");
  assert.equal(h.cancelled, 1, "photo skip disarms the waiter");

  // Finish: skipped-photo comfort line + the backup nag; no pending-thread chip.
  const fin = h.transcript.find((t) => t.extra.key === "q-finish");
  assert.match(fin.text, /^No problem — you can add one anytime from your profile\./);
  assert.match(fin.text, /One more reminder before you go/);
  assert.deepEqual(h.lastChips.map((c) => c.label), ["Sign in", "Take the tour", "Done for now"],
    "the parting sign-in chip rides the finish, and every finish offers a way to just be done");
  // No open groups in this env — the mention and its chip stay hidden.
  assert.equal(/open groups/.test(fin.text), false);
});

// "Where would you like to start?" used to offer only destinations, so being
// finished had no answer (Paul, 2026-08-29).
await test("both finishes offer 'Done for now', which says you're set", async () => {
  for (const [flow, label] of [[SETUP_FLOW, "setup"], [WELCOME_FLOW, "welcome"]]) {
    const h = harness({ done: { name: true, group: true, email: true, photo: true, invites: true,
                                extras: true, "ai-optin": true, plan: true, keys: true,
                                access: true, nudge: true, tour: true },
                        enrolled: true, envExtra: label === "welcome" ? welcomeEnv() : {} });
    if (label === "welcome") h.env.accessBackedUp = () => true;
    runFlow(flow, h.env, h.io);
    await tick();
    assert.ok(h.lastChips.map((c) => c.label).includes("Done for now"), `${label} offers it`);
    await h.tap("Done for now");
    assert.match(h.lastText(), /^You're all set\. 👍/, `${label} acknowledges it`);
  }
});

await test("welcome: open groups get a finish mention + a Browse chip", async () => {
  const h = harness({ enrolled: true, envExtra: welcomeEnv({ openGroups: true }) });
  h.env.accessBackedUp = () => true;
  runFlow(WELCOME_FLOW, h.env, h.io);
  await tick();
  await h.answer("Paul");
  await h.tap("Skip for now"); // photo
  const fin = h.transcript.find((t) => t.extra.key === "q-finish");
  assert.match(fin.text, /This space also has open groups anyone here can join/);
  await h.tap("Browse open groups");
  assert.ok(h.verbLog.find((v) => v[0] === "openDiscover"), "the chip hands over to the directory");
});

await test("welcome: native embed — passkey step skipped, access secured by the sign-in, finish records completion", async () => {
  // A native shell WITH an Eleven session — what "secured by the sign-in"
  // actually rests on (a signed-out one gets the ask, see below).
  const h = harness({ homeSignedIn: true, envExtra: welcomeEnv({ native: true, inviterName: "Ciara" }) });
  h.env.accessBackedUp = () => true; // native + signed in: secured by that sign-in
  runFlow(WELCOME_FLOW, h.env, h.io);
  await tick();

  // The passkey ask never renders; the access step records the native reason
  // and the conversation goes straight from the greeting to the name.
  assert.equal(h.transcript.some((t) => /Sign in with Eleven and your access is safe/.test(t.text)), false);
  assert.deepEqual(h.records[0], { step: "access", label: "Your access is already secured by your Eleven sign-in", value: "native" });
  const nameQ = h.transcript.find((t) => t.extra.key === "q-name");
  assert.ok(nameQ);
  // The question carries the composer's inset field label + an example hint.
  assert.equal(nameQ.extra.label, "Your name:");
  assert.equal(nameQ.extra.hint, "e.g. Finn Wolfhard");

  // Run it to the end: finish persists its completion marker (what the native
  // embed gates on — no localStorage marker there) and never nags about the
  // access backup.
  await h.answer("Paul");
  // The photo step auto-skips under native (no attachment flow in the
  // conversation composer yet) — finish follows the name directly.
  const fin = h.transcript.find((t) => t.extra.key === "q-finish");
  assert.ok(fin, "finish reached without a photo ask");
  assert.equal(h.transcript.some((t) => t.extra.key === "q-photo"), false);
  assert.equal(/One more reminder/.test(fin.text), false, "no sign-in nag — access is the sign-in");
  assert.ok(h.records.find((r) => r.step === "finish" && r.value === "done"), "finish records the completion marker");
});

await test("welcome: passkey-return leg — richer ack, no generic re-greet, question never re-asked", async () => {
  const h = harness({ enrolled: true, envExtra: welcomeEnv() });
  h.env.accessBackedUp = () => true;
  runFlow(WELCOME_FLOW, h.env, h.io);
  await tick();

  // Not "resumed" (nothing recorded, no name) so no "Welcome back —" line; the
  // access entry supplies the richer ack instead, and the passkey question
  // never renders.
  assert.equal(h.transcript.some((t) => /^Welcome back — let's pick up/.test(t.text)), false);
  assert.ok(h.transcript.find((t) => /^Great — you're signed in/.test(t.text)));
  assert.equal(h.transcript.some((t) => /Sign in with Eleven and your access is safe/.test(t.text)), false);
  assert.deepEqual(h.records[0], { step: "access", label: "Signed in — your access is safe", value: "passkey" });
  assert.ok(h.transcript.find((t) => t.extra.key === "q-name"));

  // A later reload (name set, access recorded): generic re-greet, hello skipped.
  const h2 = harness({ enrolled: true, myName: "Paul", done: { access: true, name: true }, envExtra: welcomeEnv() });
  h2.env.accessBackedUp = () => true;
  runFlow(WELCOME_FLOW, h2.env, h2.io);
  await tick();
  assert.match(h2.transcript[0].text, /^Welcome back — let's pick up/);
  assert.equal(h2.transcript.some((t) => /^Welcome! 👋/.test(t.text)), false, "hello step skipped on resume");
  assert.ok(h2.transcript.find((t) => t.extra.key === "q-photo"), "resumes at the first undone step");
});

// The ceremony can finish in ANOTHER browsing context (iOS home-screen apps run
// it in an in-app overlay; the native wrapper in the system browser) — the
// completion poll flips bridge.enrolled while the flow sits on the WAITING
// step. The waiting step's settle must then carry the flow on, with the access
// step's proper record + ack, and never require the manual "Continue" tap.
await test("welcome: enrolment confirmed while on access-waiting settles through", async () => {
  const h = harness({ envExtra: welcomeEnv() });
  runFlow(WELCOME_FLOW, h.env, h.io);
  await tick();

  await h.tap("Sign in (recommended)"); // fire-and-forget verb; page stays (stay mode)
  const probe = h.pendingDelays.find((d) => d.ms === 1500);
  assert.ok(probe, "the save chip arms its fall-to-waiting probe");
  probe.fn();
  await tick();
  assert.ok(h.transcript.find((t) => /I'll wait here while you finish signing in/.test(t.text)), "fell to access-waiting");

  // The poll confirms; access-waiting's settle re-enters access, whose entry
  // records the backup and acks — no Continue tap.
  h.enrolled = true;
  const settle = h.pendingDelays.filter((d) => d.ms === 700).at(-1);
  assert.ok(settle, "access-waiting arms a settle poll");
  settle.fn();
  await tick();
  await tick();
  assert.deepEqual(h.records.find((r) => r.step === "access"),
    { step: "access", label: "Signed in — your access is safe", value: "passkey" });
  assert.ok(h.transcript.find((t) => /^Great — you're signed in/.test(t.text)));
  assert.ok(h.transcript.find((t) => t.extra.key === "q-name"), "carried on to the name step");
});

await test("setup: enrolment confirmed while on keys-waiting settles through", async () => {
  const h = harness({
    myName: "Paul",
    done: { name: true, group: true, email: true, photo: true, invites: true, extras: true, "ai-optin": true },
  });
  runFlow(SETUP_FLOW, h.env, h.io);
  await tick();
  assert.ok(h.transcript.find((t) => /Now the most important thing of all/.test(t.text)), "keys pitch shown");

  await h.tap("Sign in");
  const probe = h.pendingDelays.find((d) => d.ms === 1500);
  probe.fn();
  await tick();
  assert.ok(h.transcript.find((t) => /I'll wait here while you finish signing in/.test(t.text)), "fell to keys-waiting");

  h.enrolled = true;
  const settle = h.pendingDelays.filter((d) => d.ms === 700).at(-1);
  assert.ok(settle, "keys-waiting arms a settle poll");
  settle.fn();
  await tick();
  await tick();
  assert.deepEqual(h.records.find((r) => r.step === "keys"),
    { step: "keys", label: "Signed in — your space's key is safe", value: "passkey" });
  assert.ok(h.transcript.find((t) => /your space's key is safe. ✅/.test(t.text)));
  assert.ok(h.verbLog.find((v) => v[0] === "markSetupComplete"), "reached finish without a tap");
  // Backed up → the finish bubble must NOT nag about coming back to it.
  assert.equal(h.transcript.some((t) => /One more reminder/.test(t.text)), false);
});

// ---- native bundle drift gate ------------------------------------------------
// The Swift interpreter (ios/.../FlowEngine.swift) runs byte-derived copies of
// these flow documents (Flows/*.json). Regenerate after editing a flow:
//   node -e 'import("./web/static/setup.flow.js").then(async m => { (await import("fs")).writeFileSync("ios/LChatCore/Sources/LChatCore/Flows/setup.json", JSON.stringify(m.default, null, 2) + "\n"); })'
// (and the welcome twin).
import { readFileSync } from "fs";
import { fileURLToPath } from "url";
import { dirname, join } from "path";
const __dir = dirname(fileURLToPath(import.meta.url));
await test("native flow bundles match the canonical flow documents", () => {
  for (const [name, flow] of [["setup", SETUP_FLOW], ["welcome", WELCOME_FLOW]]) {
    const bundled = JSON.parse(readFileSync(join(__dir, "..", "ios", "LChatCore", "Sources", "LChatCore", "Flows", `${name}.json`), "utf8"));
    assert.deepEqual(bundled, flow, `${name}.json drifted — regenerate from ${name}.flow.js (see comment above)`);
  }
});