import { expect, test } from "bun:test";
import { HealthRegistry } from "@wrnexus/core";
import type { Router } from "@wrnexus/router";
import { createHandlers, type RuntimeDeps } from "../src/runtime.ts";

function runtime(health: HealthRegistry) {
  const router: Router = {
    pages: [],
    api: [],
    realtime: [],
    middlewareFiles: [],
    components: [],
    layouts: [],
    stores: [],
    schemas: [],
    matchPage: () => null,
    matchApi: () => null,
    matchRealtime: () => null,
  };
  return createHandlers({
    mode: "production",
    hmr: false,
    router,
    loadModule: async () => ({}),
    getMiddleware: async () => [],
    assets: { serve: async () => null },
    health,
    observability: { enabled: true, sampleRate: 1, exporter: "none" },
  } satisfies RuntimeDeps);
}

const server = { upgrade: () => false };

test("runtime exposes separate liveness and dependency readiness probes", async () => {
  const health = new HealthRegistry();
  health.register("database", () => ({ status: "down", message: "offline" }));
  const handlers = runtime(health);

  const live = await handlers.fetch(new Request("https://example.test/healthz"), server);
  const ready = await handlers.fetch(new Request("https://example.test/readyz"), server);

  expect(live?.status).toBe(200);
  expect(await live?.json()).toEqual({ status: "up" });
  expect(ready?.status).toBe(503);
  expect(await ready?.json()).toEqual({ status: "down" });
});

test("built production responses carry the framework security-header baseline", async () => {
  const handlers = runtime(new HealthRegistry());
  const response = await handlers.fetch(new Request("https://example.test/healthz"), server);
  expect(response?.headers.get("strict-transport-security")).toContain("max-age=");
  expect(response?.headers.get("content-security-policy")).toContain("default-src 'self'");
  expect(response?.headers.get("x-content-type-options")).toBe("nosniff");
  expect(response?.headers.get("referrer-policy")).toBeTruthy();
});