const assert = require("node:assert/strict");
const Vault = require("./vault.js");

const items = [
    { id: "b", title: "beta", favorite: false, subtitle: "beta-user", origins: ["https://example.net"], searchText: "beta example.net" },
    { id: "a", title: "alpha", favorite: true, subtitle: "alpha-user", origins: ["https://example.com"], searchText: "alpha example.com" },
    { id: "c", title: "charlie", favorite: false, subtitle: "charlie-user", origins: ["https://example.org", "https://example.com"], searchText: "charlie example.com" }
];

assert.deepEqual(Vault.filterItems(items, "", "https://example.com/page").map(item => item.id), ["a", "c", "b"]);
assert.deepEqual(Vault.filterItems(items, "beta", "https://example.com/page").map(item => item.id), ["b"]);
assert.deepEqual(Vault.groups(items).map(group => [group.label, group.items.length]), [["favorites", 1], ["all items", 2]]);
assert.equal(Vault.nextSelection(items, "a", 1), "c");
assert.equal(Vault.nextSelection(items, "a", -1), "b");
assert.equal(Vault.origin("not a url"), "");
// Execute the actual service functions with isolated process/clipboard stubs.
const fs = require("node:fs");
const vm = require("node:vm");
const qml = fs.readFileSync(__dirname + "/Vault.qml", "utf8");
const start = qml.indexOf("    function send(");
const end = qml.indexOf("    onPanelOpenChanged:");
assert.ok(start >= 0 && end > start);
const sent = [];
const connectionRequests = [];
let captureResumed = 0;
let savedConfig = "";
const profile = { name: "personal", serverUrl: "https://vault.example.com", account: "test@example.com", unlockTimeoutSeconds: 900, clipboardTimeoutSeconds: 30 };
const service = {
    status: "unlocked", message: "", lockPending: false, lockGeneration: 0, restoreSyncPending: false,
    items: items.slice(), selectedId: "a", query: "alpha", detail: { id: "a" },
    browserOrigin: "https://example.com", expandedSections: { fields: true },
    revealedFields: { password: true }, faviconPaths: {},
    profile, profileKey: "", cache: {}, feedback: "", repromptError: "", secondFactorProvider: -1, secondFactorDraft: "",
    pendingProfile: null, persistProfile: false, configurationId: 0, setupSaving: false, setupEditing: false,
    restartPending: false, connectionTesting: false, connectionResult: "",
    connectionProcess: { running: false, stdinEnabled: true, write: value => connectionRequests.push(JSON.parse(value)) },
    configLoaded: false, setupUrlDraft: "", setupAccountDraft: "", setupError: "",
    cfgFile: { text: () => savedConfig, setText: value => { savedConfig = value; } },
    resultScrollPosition: 48, detailScrollPosition: 96,
    currentCopyId: 0, VaultData: Vault,
    vaultProcess: { running: true, write: value => sent.push(JSON.parse(value)) },
    clipboardService: {
        pauseForVaultCopy() {},
        resumeAfterVaultCopy() { captureResumed++; },
    },
    feedbackTimer: { restart() {} },
};
Object.defineProperties(service, {
    verificationPending: { get() { return this.status === "second-factor" && this.message === "verifying"; } },
    connectionBusy: { get() { return this.connectionTesting || this.connectionProcess.running; } },
    unlocked: { get() { return ["unlocked", "syncing", "sync-failure", "stale-cache"].includes(this.status); } },
    visibleItems: { get() { return Vault.filterItems(this.items, this.query, this.browserOrigin); } },
});
vm.createContext(service);
vm.runInContext(qml.slice(start, end), service);

service.panelClosed();
assert.equal(service.status, "unlocked", "closing unlocked panel preserves vault access");
assert.equal(service.query, "alpha");
assert.equal(service.selectedId, "a");
assert.equal(service.revealedFields.password, true);
assert.equal(service.lockGeneration, 0, "hiding the panel is not a vault lock");
assert.equal(sent.length, 0);
service.prepareOpen("browser");
assert.equal(sent.at(-2).op, "context");
assert.equal(sent.at(-1).op, "sync");
assert.equal(service.query, "alpha");
assert.equal(service.selectedId, "a");
assert.equal(service.resultScrollPosition, 48);
assert.equal(service.detailScrollPosition, 96);
assert.equal(service.revealedFields.password, true);

const syncsBeforeRestore = sent.filter(request => request.op === "sync").length;
const restoredState = { event: "state", status: "unlocked", items, syncNeeded: true };
service.handleLine(JSON.stringify(restoredState));
service.handleLine(JSON.stringify(restoredState));
assert.equal(sent.filter(request => request.op === "sync").length, syncsBeforeRestore + 1, "restored login queues one sync after local detail access");
service.handleLine(JSON.stringify({ ...restoredState, status: "syncing", syncNeeded: false }));
assert.equal(service.restoreSyncPending, false);

const itemDetail = { event: "detail", id: "a", fields: [{ id: "login.password", value: "synthetic", sensitive: true, kind: "text" }], totp: { current: "123456", remaining: 1 } };
service.handleLine(JSON.stringify(itemDetail));
const retainedFields = service.detail.fields;
service.handleLine(JSON.stringify({ ...itemDetail, totp: { current: "654321", remaining: 30 } }));
assert.equal(service.detail.fields, retainedFields, "TOTP rollover preserves field delegates and focus");
assert.equal(service.detail.totp.current, "654321");
service.handleLine(JSON.stringify({ ...itemDetail, fields: [{ id: "login.password", value: "updated", sensitive: true, kind: "text" }] }));
assert.notEqual(service.detail.fields, retainedFields, "changed fields replace the model");
service.handleLine(JSON.stringify({ ...itemDetail, id: "other" }));
assert.equal(service.detail.fields[0].value, "updated", "stale item details remain ignored");

service.handleLine(JSON.stringify({ event: "copy-ready", id: 42 }));
assert.equal(service.copyPending, true);
service.lock();
assert.equal(service.copyPending, false, "lock prevents late commit-copy");
assert.equal(captureResumed, 0, "capture waits for native clipboard owner termination");
service.handleLine(JSON.stringify({ event: "copy-ended", id: 41 }));
assert.equal(captureResumed, 0, "older copy completion cannot resume capture");
service.handleLine(JSON.stringify({ event: "copy-ended", id: 42 }));
assert.equal(captureResumed, 1);
assert.equal(service.currentCopyId, 0);
service.handleLine(JSON.stringify({ event: "state", status: "locked", items: [] }));

for (const status of ["loading", "second-factor"]) {
    service.status = status;
    const requestsBeforeClose = sent.length;
    service.panelClosed();
    assert.equal(service.status, status, "closing preserves pending authentication");
    assert.equal(sent.length, requestsBeforeClose, "closing must not send a cancellation request");
    service.cancelUnlock();
    assert.equal(sent.at(-1).op, "lock", "explicit cancel still cancels pending authentication");
    assert.equal(service.status, "locked");
    assert.equal(service.items.length, 0);
    assert.equal(service.query, "");
    assert.equal(Object.keys(service.revealedFields).length, 0);
    service.handleLine(JSON.stringify({ event: "state", status: "unlocked", items }));
    assert.equal(service.status, "locked", "stale responses cannot undo pending lock");
    service.handleLine(JSON.stringify({ event: "state", status: "locked", items: [] }));
    assert.equal(service.lockPending, false);
}

service.handleLine(JSON.stringify({
    event: "state", status: "second-factor", items: [],
    challenge: { providers: [{ id: 0, label: "authenticator app", codeSupported: true }, { id: 1, label: "email code", codeSupported: true }] },
}));
assert.equal(service.secondFactorProvider, 0);
assert.equal(service.items.length, 0);
service.selectSecondFactor(1);
assert.match(service.secondFactorHint(), /email code selected; check your inbox/);
service.secondFactorDraft = "123";
const beforeEmailApp = sent.length;
const challengeBeforeClose = JSON.stringify(service.challenge);
service.panelClosed();
assert.equal(sent.length, beforeEmailApp);
assert.equal(service.status, "second-factor");
assert.equal(service.secondFactorProvider, 1);
assert.equal(service.secondFactorDraft, "123");
assert.equal(JSON.stringify(service.challenge), challengeBeforeClose);
service.prepareOpen("email-app");
assert.equal(sent.at(-1).op, "context");
service.handleLine(JSON.stringify({ event: "state", status: "second-factor", challenge: service.challenge, items: [] }));
assert.equal(service.secondFactorProvider, 1);
assert.equal(service.secondFactorDraft, "123");
assert.equal(service.stateJson().includes("secondFactorDraft"), false, "verification drafts never enter diagnostic state output");
service.submitSecondFactor("synthetic-code");
assert.equal(sent.at(-1).op, "second-factor");
assert.equal(sent.at(-1).token, "synthetic-code");
assert.equal(service.status, "second-factor");
assert.equal(service.secondFactorDraft, "", "submitted codes are immediately cleared");
assert.equal(service.verificationPending, true, "verification has immediate visual feedback");
const beforeDuplicate = sent.length;
service.submitSecondFactor("duplicate");
service.selectSecondFactor(0);
service.panelClosed();
assert.equal(sent.length, beforeDuplicate);
assert.equal(service.secondFactorProvider, 1);
assert.equal(service.verificationPending, true, "closing preserves in-flight verification");
service.handleLine(JSON.stringify({ event: "state", status: "second-factor", message: "verification failed", challenge: service.challenge, items: [] }));
assert.equal(service.verificationPending, false, "failed verification allows retry");
service.secondFactorDraft = "456";
service.cancelUnlock();
assert.equal(service.secondFactorDraft, "", "cancel clears verification drafts");
service.handleLine(JSON.stringify({ event: "state", status: "locked", items: [] }));

const generation = service.lockGeneration;
service.handleLine("invalid json");
assert.equal(service.status, "unavailable-vault");
assert.equal(service.lockGeneration, generation + 1, "protocol failures clear credential inputs");
assert.equal(service.items.length, 0);
service.vaultProcess.running = false;
service.send({ op: "hello" });
assert.equal(service.lockGeneration, generation + 2, "process failures clear credential inputs");

function startFreshBoundary() {
    if (service.restartPending) {
        assert.equal(service.vaultProcess.stdinEnabled, false, "close old stdin to lock and exit gracefully");
        service.vaultProcess.running = false;
        service.boundaryExited();
    }
    assert.equal(service.vaultProcess.running, true);
    assert.equal(service.vaultProcess.stdinEnabled, true);
    service.boundaryStarted();
}

// Config changes replace the retained native process before requesting the lock acknowledgement.
service.vaultProcess.running = true;
service.beginSetup();
assert.equal(service.setupEditing, true);
assert.equal(service.setupUrlDraft, profile.serverUrl);
assert.equal(service.setupAccountDraft, profile.account);
assert.equal(service.lockPending, true);
assert.equal(service.items.length, 0);
service.handleLine(JSON.stringify({ event: "state", status: "locked", profile, items: [] }));
service.setupUrlDraft = "  https://other.example.com/  ";
service.setupAccountDraft = "  other@example.com  ";
const beforeRestart = sent.length;
service.saveSetup();
assert.equal(sent.length, beforeRestart, "no new-protocol request reaches the obsolete boundary");
startFreshBoundary();
assert.equal(sent.at(-1).op, "configure-lock");
assert.equal(service.setupSaving, true);
assert.equal(savedConfig, "", "never persist before native validation");
const sentBeforeLockAck = sent.length;
service.unlock("synthetic-master-password");
assert.equal(sent.length, sentBeforeLockAck, "unlock cannot race a profile change");
service.handleLine(JSON.stringify({ event: "state", status: "unlocked", items }));
assert.equal(sent.length, sentBeforeLockAck, "stale unlock cannot advance configuration");
service.handleLine(JSON.stringify({ event: "state", status: "locked", profile, items: [] }));
assert.equal(sent.at(-1).op, "configure-lock", "an old locked state is not configuration acknowledgement");
service.handleLine(JSON.stringify({ event: "configure-ready", id: service.configurationId - 1 }));
assert.equal(sent.at(-1).op, "configure-lock", "old acknowledgements cannot advance a new configuration");
service.handleLine(JSON.stringify({ event: "configure-ready", id: service.configurationId }));
assert.equal(sent.at(-1).op, "configure");
assert.equal(sent.at(-1).profile.serverUrl, "https://other.example.com/");
assert.equal(sent.at(-1).profile.account, "other@example.com");
const configured = { ...profile, serverUrl: "https://other.example.com", account: "other@example.com" };
service.handleLine(JSON.stringify({ event: "configured", profile: configured }));
assert.deepEqual(JSON.parse(savedConfig), configured);
assert.equal(savedConfig.includes("synthetic-master-password"), false);
assert.equal(service.setupSaving, false);
assert.equal(service.setupEditing, false);
service.handleLine(JSON.stringify({ event: "state", status: "locked", profile: configured, items: [], cache: { available: false } }));
assert.equal(service.cache.available, false);

service.beginSetup();
service.handleLine(JSON.stringify({ event: "state", status: "locked", profile: configured, items: [] }));
service.setupAccountDraft = "discard@example.com";
service.cancelSetup();
assert.equal(service.setupAccountDraft, configured.account);
assert.deepEqual(JSON.parse(savedConfig), configured, "cancel leaves saved configuration untouched");

// Reload does not rewrite configuration, malformed files stay in setup without sending anything.
service.loadConfig();
startFreshBoundary();
service.handleLine(JSON.stringify({ event: "state", status: "needs-setup", items: [] }));
service.handleLine(JSON.stringify({ event: "configure-ready", id: service.configurationId }));
assert.equal(sent.at(-1).op, "configure");
assert.equal(service.persistProfile, false);
service.handleLine(JSON.stringify({ event: "configured", profile: configured }));
const sentAfterLoad = sent.length;
service.loadConfig();
assert.equal(sent.length, sentAfterLoad, "FileView write notifications cannot reconfigure the vault");
for (const invalid of ["invalid", "null", "[]", "false"]) {
    service.configLoaded = false;
    savedConfig = invalid;
    service.loadConfig();
    assert.equal(service.setupEditing, true);
    assert.match(service.setupError, /could not be read/);
    assert.equal(sent.length, sentAfterLoad);
}
savedConfig = JSON.stringify(configured);

for (const event of ["configure-failed", "protocol-error"]) {
    service.configureProfile({ ...configured, serverUrl: "http://example.com" }, true);
    startFreshBoundary();
    service.handleLine(JSON.stringify({ event: "state", status: "locked", items: [] }));
    service.handleLine(JSON.stringify({ event: "configure-ready", id: service.configurationId }));
    service.handleLine(JSON.stringify({ event, message: "https required" }));
    assert.equal(service.setupSaving, false);
    assert.equal(service.setupEditing, true);
    assert.equal(service.setupError, "https required");
    assert.deepEqual(JSON.parse(savedConfig), configured, "invalid profiles cannot overwrite saved config");
}

service.configureProfile(configured, true);
startFreshBoundary();
service.handleLine(JSON.stringify({ event: "state", status: "unavailable-vault", message: "boundary unavailable" }));
assert.equal(service.setupSaving, false);
assert.equal(service.lockPending, false);
assert.equal(service.pendingProfile, null);
assert.equal(service.setupError, "boundary unavailable");
service.vaultProcess.running = false;
service.configureProfile(configured, true);
assert.equal(service.vaultProcess.running, true, "saving can restart a stopped boundary");
service.boundaryStarted();
assert.equal(service.lockPending, true);
service.handleLine(JSON.stringify({ event: "protocol-error" }));
assert.equal(service.setupSaving, false, "protocol rejection during pending lock is not swallowed");
assert.equal(service.lockPending, false);
assert.equal(service.pendingProfile, null);
assert.match(service.setupError, /rejected settings/);
service.configureProfile(configured, true);
startFreshBoundary();
service.setupTimedOut();
assert.equal(service.setupSaving, false);
assert.equal(service.lockPending, false);
assert.equal(service.vaultProcess.stdinEnabled, false, "timeout closes the unresponsive boundary");
assert.match(service.setupError, /timed out/);
const beforeLateReply = savedConfig;
service.handleLine(JSON.stringify({ event: "configured", profile: profile }));
assert.equal(savedConfig, beforeLateReply, "late replies after timeout cannot persist configuration");
assert.match(qml, /interval: 5000\s+running: root\.setupSaving\s+onTriggered: root\.setupTimedOut\(\)/);

service.configureProfile(configured, true);
service.lock();
assert.equal(service.setupSaving, false, "an external lock cancels pending configuration");
assert.equal(service.pendingProfile, null);
service.handleLine(JSON.stringify({ event: "state", status: "locked", items: [] }));
service.configureProfile(configured, true);
startFreshBoundary();
service.handleLine(JSON.stringify({ event: "configure-ready", id: service.configurationId }));
service.handleLine(JSON.stringify({ event: "state", status: "locked", items: [] }));
assert.equal(service.setupSaving, false, "suspend during configure cannot leave setup stuck saving");
assert.match(service.setupError, /interrupted/);

// Execute the actual FileView error handlers without touching user settings.
service.root = service;
service.FileViewError = { FileNotFound: 1, PermissionDenied: 2 };
const loadFailed = qml.match(/onLoadFailed: (error => \{[\s\S]*?\n        \})/);
const saveFailed = qml.match(/onSaveFailed: (\{[\s\S]*?\n        \})/);
assert.ok(loadFailed && saveFailed);
service.setupError = "";
vm.runInContext(`(${loadFailed[1]})(FileViewError.FileNotFound)`, service);
assert.equal(service.setupEditing, true);
assert.equal(service.setupError, "", "first launch with no file needs setup, not an error");
vm.runInContext(`(${loadFailed[1]})(FileViewError.PermissionDenied)`, service);
assert.match(service.setupError, /could not be read/);
vm.runInContext(saveFailed[1], service);
assert.match(service.setupError, /could not be saved/);

service.handleLine(JSON.stringify({ event: "state", status: "unlocked", profile: configured, profileKey: "new-profile", items }));
service.handleLine(JSON.stringify({ event: "favicon", profileKey: "old-profile", id: "a", path: "/old/favicon" }));
assert.equal(service.faviconPaths.a, undefined, "late results from another profile are discarded");
service.handleLine(JSON.stringify({ event: "favicon", profileKey: "new-profile", id: "a", path: "/new/favicon" }));
assert.equal(service.faviconPaths.a, "/new/favicon");

// Testing uses the draft in a separate boundary, without saving or changing the active profile.
service.beginSetup();
service.handleLine(JSON.stringify({ event: "state", status: "locked", items: [] }));
service.setupUrlDraft = "draft.example.com";
service.setupAccountDraft = "draft@example.com";
const profileBeforeTest = JSON.stringify(service.profile);
const configBeforeTest = savedConfig;
const mainRequestsBeforeTest = sent.length;
service.testConnection();
assert.equal(service.connectionTesting, true);
assert.equal(service.connectionProcess.running, true);
service.connectionStarted();
assert.equal(connectionRequests.at(-1).op, "test-connection");
assert.equal(connectionRequests.at(-1).profile.serverUrl, "draft.example.com");
assert.equal(connectionRequests.at(-1).profile.account, "draft@example.com");
service.testConnection();
service.saveSetup();
assert.equal(sent.length, mainRequestsBeforeTest, "test and save cannot race");
service.handleConnectionLine(JSON.stringify({ event: "state", status: "needs-setup", profile: {} }));
service.handleConnectionLine(JSON.stringify({ event: "connection-result", success: true, message: "connection successful; account not verified" }));
assert.match(service.connectionResult, /account not verified/);
assert.equal(service.connectionProcess.stdinEnabled, false);
service.connectionProcess.running = false;
service.connectionExited();
assert.equal(service.connectionTesting, false);
assert.equal(JSON.stringify(service.profile), profileBeforeTest);
assert.equal(savedConfig, configBeforeTest);
for (const [reply, message] of [
    [JSON.stringify({ event: "connection-result", success: false, message: "unreachable" }), "unreachable"],
    [JSON.stringify({ event: "protocol-error" }), "native vault rejected connection test"],
    ["not json", "invalid connection test response"],
]) {
    service.testConnection();
    service.connectionStarted();
    service.handleConnectionLine(reply);
    service.connectionProcess.running = false;
    service.connectionExited();
    assert.equal(service.connectionResult, message);
    assert.equal(service.connectionBusy, false);
}
service.testConnection();
service.connectionTimedOut();
assert.equal(service.connectionResult, "connection test timed out");
assert.equal(service.connectionProcess.stdinEnabled, false);
service.connectionProcess.running = false;
service.connectionExited();
assert.equal(service.connectionResult, "connection test timed out");
service.testConnection();
service.cancelSetup();
service.handleConnectionLine(JSON.stringify({ event: "connection-result", message: "late success" }));
assert.equal(service.connectionResult, "", "cancel discards late test replies");
service.connectionProcess.running = false;
service.connectionExited();
assert.equal(savedConfig, configBeforeTest);

const panel = fs.readFileSync(__dirname + "/VaultPanel.qml", "utf8");
const focusStart = panel.indexOf("    function focusPrimary()");
const focusEnd = panel.indexOf("    function fieldEnding(", focusStart);
assert.ok(focusStart >= 0 && focusEnd > focusStart);
const focus = { vaultService: service, setupMode: true, locked: true, detail: {} };
let focused = "";
for (const id of ["serverUrlSetup", "masterPassword", "secondFactorCode", "repromptPassword", "searchField"])
    focus[id] = { input: { forceActiveFocus() { focused = id; } } };
vm.createContext(focus);
vm.runInContext(panel.slice(focusStart, focusEnd), focus);
focus.focusPrimary();
assert.equal(focused, "serverUrlSetup");
focus.setupMode = false;
focus.focusPrimary();
assert.equal(focused, "masterPassword");
assert.match(panel, /onClicked: root\.vaultService\.beginSetup\(\)/);
assert.match(panel, /onClicked: root\.vaultService\.saveSetup\(\)/);
assert.match(panel, /onClicked: root\.vaultService\.testConnection\(\)/);
assert.match(panel, /onClicked: root\.vaultService\.cancelSetup\(\)/);
assert.match(panel, /text: root\.vaultService\.secondFactorDraft/);
assert.match(panel, /onEdited: text => root\.vaultService\.secondFactorDraft = text/);
assert.match(panel, /onPanelOpenChanged\(\)[\s\S]*?root\.clearPasswordInputs\(\)/);
const clearStart = panel.indexOf("    function clearPasswordInputs()");
const clearEnd = panel.indexOf("    function fieldEnding(", clearStart);
const credentialInputs = {
    masterPassword: { text: "synthetic-master" }, repromptPassword: { text: "synthetic-reprompt" },
    showPassword: { checked: true }, showRepromptPassword: { checked: true },
};
vm.createContext(credentialInputs);
vm.runInContext(panel.slice(clearStart, clearEnd), credentialInputs);
credentialInputs.clearPasswordInputs();
assert.equal(credentialInputs.masterPassword.text, "");
assert.equal(credentialInputs.repromptPassword.text, "");
assert.equal(credentialInputs.showPassword.checked, false);
assert.equal(credentialInputs.showRepromptPassword.checked, false);
assert.match(qml, /Quickshell\.statePath\("vault.json"\)/);
assert.equal(fs.existsSync(__dirname + "/vault-native/profile.json"), false);
// Exercise the real JSON-lines boundary with an isolated, synthetic cache directory.
async function checkNativeConfiguration() {
    const { spawn } = require("node:child_process");
    const { once } = require("node:events");
    const { createInterface } = require("node:readline");
    const { createHash } = require("node:crypto");
    const { tmpdir } = require("node:os");
    const { join } = require("node:path");
    const cacheRoot = fs.mkdtempSync(join(tmpdir(), "nuguland-vault-config-test-"));
    const key = value => createHash("sha256").update(value.serverUrl).update("\0").update(value.account).digest("hex");
    const cacheDirectory = join(cacheRoot, "nuguland", "vault");
    fs.mkdirSync(cacheDirectory, { recursive: true });
    // Configuration only stats this fixture; the test never requests unlock or decryption.
    fs.writeFileSync(join(cacheDirectory, key(profile) + ".encrypted.json"), "synthetic cache metadata fixture");
    const child = spawn(__dirname + "/vault-native/target/debug/nuguland-vault", [], {
        env: { ...process.env, XDG_CACHE_HOME: cacheRoot },
        stdio: ["pipe", "pipe", "inherit"],
    });
    const exited = once(child, "close");
    const lines = createInterface({ input: child.stdout })[Symbol.asyncIterator]();
    const timeout = setTimeout(() => child.kill("SIGKILL"), 10_000);
    const writeRequest = request => child.stdin.write(JSON.stringify(request) + "\n");
    async function receive(type, predicate = () => true) {
        for (;;) {
            const next = await lines.next();
            assert.equal(next.done, false, `native boundary ended before ${type}`);
            const event = JSON.parse(next.value);
            if (event.event === type && predicate(event))
                return event;
        }
    }
    try {
        const initial = await receive("state");
        assert.equal(initial.status, "needs-setup");
        assert.equal(initial.profile.serverUrl, "");
        assert.equal(initial.profile.account, "");
        assert.equal(initial.cache.available, false);
        for (const [index, value] of [profile, configured, profile].entries()) {
            writeRequest({ op: "state" });
            writeRequest({ op: "configure-lock", id: index + 1 });
            await receive("configure-ready", event => event.id === index + 1);
            writeRequest({ op: "configure", profile: value });
            const accepted = await receive("configured");
            assert.deepEqual(accepted.profile, value);
            const state = await receive("state", event => event.status === "locked");
            assert.equal(state.profileKey, key(value));
            assert.deepEqual(state.items, []);
            assert.equal(state.cache.available, value === profile, "switching identities isolates cache; returning reuses its own cache");
        }
        writeRequest({ op: "configure", profile: { ...profile, serverUrl: "http://invalid.example.com" } });
        await receive("configure-failed");
        const rejected = await receive("state", event => event.status === "locked");
        assert.deepEqual(rejected.profile, profile, "invalid settings cannot replace the native identity");
        writeRequest({ op: "test-connection", profile: { ...profile, serverUrl: "http://invalid.example.com" } });
        const connectionResult = await receive("connection-result");
        assert.equal(connectionResult.success, false);
        assert.match(connectionResult.message, /https/);
        writeRequest({ op: "state" });
        assert.deepEqual((await receive("state")).profile, profile, "testing cannot change the active profile");
        child.stdin.end();
        const [code] = await exited;
        assert.equal(code, 0);
    } finally {
        clearTimeout(timeout);
        if (child.exitCode === null && child.signalCode === null)
            child.kill("SIGKILL");
        await exited;
        fs.rmSync(cacheRoot, { recursive: true, force: true });
    }
}

checkNativeConfiguration().then(() => {
    console.log("vault.test.js: ok");
}).catch(error => {
    console.error(error);
    process.exitCode = 1;
});