import { describe, expect, test } from 'bun:test';
import { readFileSync } from 'node:fs';
import { join } from 'node:path';

/**
 * The bake probe waits for HTTPS to VERIFY, so a trust failure and an
 * unfinished issuance both spend the whole budget and both used to print
 * "timed out" — which is why celilo#1365 and celilo#1427 read as timeouts for
 * weeks while `curl -k` returned 200 throughout. They need opposite responses,
 * so the headline must branch on curl's exit code.
 *
 * The explainer lives in a bin script (no import surface), so this gate reads
 * the real source and pins the behaviour that matters: the trust codes and the
 * reach codes are classified, disjointly, and the trust branch says waiting
 * cannot help.
 */
describe('bake probe explains which failure it hit', () => {
  const src = readFileSync(join(import.meta.dir, '..', 'bin', 'e2e-bake-management'), 'utf-8');
  const fn = /function explainProbeFailure\(curlExit: number\): string \{[\s\S]*?\n\}/.exec(src);

  test('the explainer exists', () => {
    expect(fn).not.toBeNull();
  });

  const body = fn?.[0] ?? '';

  test('trust codes and reach codes are classified disjointly', () => {
    const arrays = [...body.matchAll(/\[([\d,\s]+)\]\.includes\(curlExit\)/g)].map((m) =>
      m[1].split(',').map((n) => Number(n.trim())),
    );
    expect(arrays.length).toBe(2);
    const [trust, reach] = arrays;
    // 60 unknown issuer is the dead-root signature; 6 unresolved is the reach one.
    expect(trust).toContain(60);
    expect(reach).toContain(6);
    expect(trust.filter((c) => reach.includes(c))).toEqual([]);
  });

  test('the trust branch says waiting cannot fix it', () => {
    const trustBranch = body.slice(0, body.indexOf('6, 7, 28'));
    expect(trustBranch).toMatch(/waiting longer cannot fix it/i);
  });
});