import test from 'node:test';
import assert from 'node:assert/strict';
import { readFile } from 'node:fs/promises';

test('private pilot Compose stack is loopback-bound, isolated, and mock-only', async () => {
  const compose = (await readFile(new URL('../compose.custody-pilot.yaml', import.meta.url), 'utf8')).replaceAll('\r\n', '\n');
  assert.match(compose, /WIKIDECK_NETWORK: pilot/);
  assert.match(compose, /WIKIDECK_PILOT_MODE: private-mock-only/);
  assert.match(compose, /WIKIDECK_PAYMENT_MODE: mock/);
  assert.match(compose, /WIKIDECK_CUSTODY_STORAGE: postgres/);
  assert.match(compose, /WIKIDECK_CUSTODY_MODE: sandbox/);
  assert.match(compose, /WIKIDECK_LOCAL_PG_BOOTSTRAP: sandbox-only/);
  assert.match(compose, /127\.0\.0\.1:\$\{WIKIDECK_PILOT_PORT:-3423\}:3001/);
  assert.match(compose, /financial: \{internal: true\}/);
  assert.match(compose, /pg-runtime:\/secrets\/runtime:ro/);
  assert.doesNotMatch(compose, /POSTGRES_PASSWORD:\s|5432:5432/i);
  assert.doesNotMatch(compose, /^\s+(?:monero|wallet-rpc|observer):/im);
  assert.match(compose, /daemon-check:\n\s+image: wikideck:private-pilot/);
  assert.match(compose, /profiles: \["monero-check"\]/);
  assert.match(compose, /scripts\/monero-daemon-check\.ts/);
  assert.match(compose, /target: \/run\/monero\/daemon\.json\n\s+read_only: true/);
  const database = compose.split('  database:')[1].split('  migrate:')[0];
  assert.doesNotMatch(database, /ports:/);
  const app = compose.split('  wikideck:')[1].split('networks:\n  financial:')[0];
  assert.doesNotMatch(app, /pg-admin:|pg-owner:|pg-tls:/);
});