/**
 * Every finding ID printed in shipped prose must name a declared check.
 *
 * README, CLAUDE.md, the command files and the scanner header comments are a
 * second copy of the registry, and two copies of one table drift (#57/C2). This
 * is the direction that matters to a user: a documented `CA-PLH-016` that no
 * check emits sends them to write a suppression that can never match.
 */

import { describe, it } from 'node:test';
import assert from 'node:assert/strict';
import { readFile, readdir } from 'node:fs/promises';
import { resolve } from 'node:path';
import { fileURLToPath } from 'node:url';
import { allFindingIds } from '../../scanners/lib/finding-codes.mjs';

const ROOT = resolve(fileURLToPath(new URL('.', import.meta.url)), '../..');
const ID_RE = /CA-[A-Z]{2,4}-\d{3}/g;

async function documentedFiles() {
  const files = ['README.md', 'CLAUDE.md'];
  for (const dir of ['commands', 'scanners', 'scanners/lib']) {
    const entries = await readdir(resolve(ROOT, dir));
    for (const e of entries) {
      if (e.endsWith('.md') || e.endsWith('.mjs')) files.push(`${dir}/${e}`);
    }
  }
  return files;
}

describe('documented finding IDs', () => {
  it('all resolve to a declared check', async () => {
    const ids = allFindingIds();
    const dangling = [];

    for (const rel of await documentedFiles()) {
      let src;
      try {
        src = await readFile(resolve(ROOT, rel), 'utf-8');
      } catch {
        continue;
      }
      for (const [id] of src.matchAll(ID_RE)) {
        if (!ids.has(id)) dangling.push(`${rel}: ${id}`);
      }
    }

    assert.deepEqual([...new Set(dangling)], [], 'documented ID names no declared check');
  });
});