// Task 413 — memory-write refuses operator-supplied compiled-truth fields.
//
// The six system-managed keys (compiledTruth{,UpdatedAt,Source} and
// compiledTruthPublic{,UpdatedAt,Source}) can only be written by the
// defaults block on first write (caller-supplied value is undefined) and
// by the rewriter via memory-update. Any caller passing one of them in
// the properties bag is bypassing the audit chain.
import { describe, it, expect, vi } from "vitest";
vi.mock("../../lib/neo4j.js", () => ({
    getSession: () => ({
        run: vi.fn(),
        close: vi.fn().mockResolvedValue(undefined),
    }),
}));
import { memoryWrite } from "../memory-write.js";
const REJECTED_KEYS = [
    "compiledTruth",
    "compiledTruthUpdatedAt",
    "compiledTruthSource",
    "compiledTruthPublic",
    "compiledTruthPublicUpdatedAt",
    "compiledTruthPublicSource",
];
describe("memory-write — system-managed compiled-truth keys (Task 413)", () => {
    for (const key of REJECTED_KEYS) {
        it(`rejects properties.${key}`, async () => {
            await expect(memoryWrite({
                labels: ["Person"],
                properties: { name: "Adam", [key]: "operator wrote this" },
                accountId: "acct-1",
                scope: "admin",
                relationships: [{ targetId: "x", type: "MENTIONS", direction: "outbound" }],
                createdBy: { agent: "test", session: "s1" },
                validator: { schema: { brandVertical: undefined }, recognisedLabels: () => new Set(["Person"]) },
            })).rejects.toThrow(/system-managed-key/);
        });
    }
});
//# sourceMappingURL=memory-write-compiled-truth-rejection.test.js.map