// Acceptance gate for the founder-side `--entitlement-base64 <b64>` installer
// flag (Task 240). Pure-module coverage: base64 round-trip validation, mode
// rejection, decoded-payload non-emptiness, path resolution. Live entitlement
// delivery to a Pi is exercised by manual install per task verification §4.
import test from "node:test";
import assert from "node:assert/strict";
import { validateEntitlementBase64, entitlementPath, } from "../tier-flag.js";
// A small but realistic envelope shape — looks like what
// platform/scripts/generate-entitlement-fixture.mjs sign produces.
const SAMPLE_PAYLOAD = JSON.stringify({
    payload: { accountId: "x", tier: "family" },
    signature: "deadbeef",
});
const SAMPLE_B64 = Buffer.from(SAMPLE_PAYLOAD, "utf-8").toString("base64");
test("validateEntitlementBase64 accepts a well-formed payload when commercialMode is true", () => {
    const decoded = validateEntitlementBase64(SAMPLE_B64, true);
    assert.equal(decoded.toString("utf-8"), SAMPLE_PAYLOAD);
});
test("validateEntitlementBase64 tolerates embedded whitespace (newlines, tabs, spaces)", () => {
    // SSH transit and operator-side paste can introduce \r, \n, or stray spaces.
    // The stripper must normalise them before the round-trip check fires.
    const noisy = SAMPLE_B64.slice(0, 8) + "\n" + SAMPLE_B64.slice(8, 16) + " \t" + SAMPLE_B64.slice(16);
    const decoded = validateEntitlementBase64(noisy, true);
    assert.equal(decoded.toString("utf-8"), SAMPLE_PAYLOAD);
});
test("validateEntitlementBase64 rejects garbage characters", () => {
    assert.throws(() => validateEntitlementBase64("not-valid-base64@#$", true), /not valid base64/);
});
test("validateEntitlementBase64 rejects empty value and flag-shaped value", () => {
    assert.throws(() => validateEntitlementBase64(undefined, true), /requires a base64-encoded value/);
    assert.throws(() => validateEntitlementBase64("", true), /requires a base64-encoded value/);
    assert.throws(() => validateEntitlementBase64("--port", true), /requires a base64-encoded value/);
});
test("validateEntitlementBase64 rejects whitespace-only value", () => {
    assert.throws(() => validateEntitlementBase64("   \n\t  ", true), /empty after whitespace stripping/);
});
test("validateEntitlementBase64 rejects --entitlement-base64 when brand is personal-mode", () => {
    assert.throws(() => validateEntitlementBase64(SAMPLE_B64, false), /Personal mode — use --tier <enum>/);
});
test("entitlementPath joins homeDir + configDir + entitlement.json", () => {
    assert.equal(entitlementPath("/home/admin", ".realagent-code"), "/home/admin/.realagent-code/entitlement.json");
    assert.equal(entitlementPath("/home/me", ".maxy-code"), "/home/me/.maxy-code/entitlement.json");
});
