"""cp-docs-token/v1 context: env-only step-docs layer (PLN-CLI-16, D-40, AU-59).

The per-step wfcd_ token and CA file are delivered by the dispatcher. The layer
sets the env contract and ships one context doc; no ESO mount, no init script,
and no reference to the cp-service-token layer.
"""
from __future__ import annotations

from pathlib import Path

import yaml

_LAYER = (
    Path(__file__).resolve().parents[2] / "harnesses" / "contexts" / "cp-docs-token" / "v1"
)


def _doc() -> dict:
    return yaml.safe_load((_LAYER / "harness.yaml").read_text())


def test_cp_docs_token_layer_parses_with_env_keys():
    doc = _doc()
    assert doc["kind"] == "context"
    assert doc["name"] == "cp-docs-token"
    assert doc["version"] == 1
    assert doc["requires"] == []
    assert doc["provides"] == ["cp-docs-token"]
    assert doc["env"] == {
        "CP_DOCS_TOKEN_FILE": "/run/agent/cp-docs/token",
        "CP_DOCS_CA_FILE": "/run/agent/cp-docs/ca.crt",
    }


def test_cp_docs_token_layer_declares_no_secrets_and_no_init():
    doc = _doc()
    assert not doc.get("secrets_required")
    assert not doc.get("scripts")
    assert not (_LAYER / "init.sh").exists()


def test_cp_docs_token_layer_context_file_mapping():
    doc = _doc()
    assert doc["context_files"] == [
        {
            "source": "./CLAUDE.md",
            "target": "/opt/harness/context/cp-docs-token/CLAUDE.md",
        }
    ]
    assert (_LAYER / "CLAUDE.md").is_file()


def test_cp_docs_token_layer_never_mentions_cp_service_token():
    for path in _LAYER.rglob("*"):
        if path.is_file():
            assert "cp-service-token" not in path.read_text(), path