import assert from "node:assert/strict";
import fs from "node:fs";
import path from "node:path";
import test from "node:test";
import { fileURLToPath } from "node:url";

const directory = path.dirname(fileURLToPath(import.meta.url));
const registry = JSON.parse(fs.readFileSync(path.join(directory, "trusted-domain-manifest-signers.json"), "utf8"));
const anchor = JSON.parse(fs.readFileSync(path.join(directory, "public-navigation-anchor.json"), "utf8"));

test("the public trusted-signer registry starts with zero production signers", () => {
  assert.deepEqual(Object.keys(registry), ["schema", "registryId", "version", "state", "signers"]);
  assert.equal(registry.schema, "gh-aios.trusted-domain-manifest-signers/v1");
  assert.equal(registry.registryId, "GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001");
  assert.equal(registry.version, "1.0.0");
  assert.equal(registry.state, "CURRENT");
  assert.deepEqual(registry.signers, []);
  assert.doesNotMatch(JSON.stringify(registry), /PRIVATE KEY|password|token|secret/i);
});

test("the canonical public anchor declares the exact registry path", () => {
  assert.deepEqual(anchor.maps.trusted_domain_manifest_signers, {
    path: "routing/trusted-domain-manifest-signers.json",
    id: "GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001",
    version: "1.0.0"
  });
});