import { describe, expect, it, vi } from "vitest";
import { computeVaultId } from "./sync-identity";
import {
  grantAdoption,
  isAdoptGrant,
  requestAdoption,
  sendFrame,
  sendVaultSnapshot,
  receiveVaultSnapshot,
  type AdoptRequest,
  type AdoptionReceiverDeps,
  type AdoptionSourceDeps,
} from "./vault-adopt";
import type { PairingTransport } from "./pairing-handshake";

function memoryPair(): [PairingTransport, PairingTransport] {
  const a: Uint8Array[] = [];
  const b: Uint8Array[] = [];
  const ar: Array<(v: Uint8Array) => void> = [];
  const br: Array<(v: Uint8Array) => void> = [];
  function make(
    inbox: Uint8Array[],
    outbox: Uint8Array[],
    readers: Array<(v: Uint8Array) => void>,
    outReaders: Array<(v: Uint8Array) => void>,
  ): PairingTransport {
    return {
      async send(msg) {
        const reader = outReaders.shift();
        if (reader) reader(msg);
        else outbox.push(msg);
      },
      receive() {
        const msg = inbox.shift();
        if (msg) return Promise.resolve(msg);
        return new Promise((resolve) => readers.push(resolve));
      },
    };
  }
  return [make(a, b, ar, br), make(b, a, br, ar)];
}

function identity(name: string) {
  return {
    deviceId: `${name}-id`,
    deviceName: name,
    deviceType: "extension" as const,
    longTermPublicKeyHex: "ab".repeat(32),
    signingPublicKeyHex: "cd".repeat(32),
  };
}

describe("vault adoption sub-protocol", () => {
  it("T-A10: completes ADOPT_REQUEST through mutual completion acknowledgements", async () => {
    const [receiverChannel, sourceChannel] = memoryPair();
    const rootKeyHex = "11".repeat(32);
    const vaultId = await computeVaultId(Uint8Array.from(Buffer.from(rootKeyHex, "hex")));
    const sourceUpsert = vi.fn();
    const receiverUpsert = vi.fn();
    const pairState = {
      rendezvousSecretHex: "42".repeat(32),
      relayUrl: "wss://relay.example.test",
    };
    const receiverDeps: AdoptionReceiverDeps = {
      deviceName: "Receiver",
      generateDeviceId: () => "receiver-ephemeral",
      confirmSas: vi.fn(async () => true),
      createVaultFromRootKey: vi.fn(async () => ({ vaultId })),
      deriveLocalIdentity: vi.fn(async () => identity("receiver")),
      upsertPairedDevice: receiverUpsert,
      applyLicense: vi.fn(),
      pairState,
      onError: vi.fn(),
    };
    const sourceDeps: AdoptionSourceDeps = {
      sourceIdentity: identity("source"),
      rootKeyHex: vi.fn(async () => rootKeyHex),
      vaultId: vi.fn(async () => vaultId),
      license: vi.fn(async () => "PPK-test"),
      onConsent: vi.fn(async () => true),
      upsertPairedDevice: sourceUpsert,
      pairState,
    };

    await Promise.all([
      requestAdoption(receiverChannel, receiverDeps),
      (async () => {
        const request = JSON.parse(new TextDecoder().decode(await sourceChannel.receive())) as AdoptRequest;
        await grantAdoption(sourceChannel, request, sourceDeps);
      })(),
    ]);

    expect(receiverDeps.createVaultFromRootKey).toHaveBeenCalledWith(rootKeyHex);
    expect(receiverUpsert).toHaveBeenCalledWith(expect.objectContaining({
      deviceId: "source-id",
      ...pairState,
    }));
    expect(sourceUpsert).toHaveBeenCalledWith(expect.objectContaining({
      deviceId: "receiver-id",
      ...pairState,
    }));
    expect(receiverDeps.applyLicense).toHaveBeenCalledWith("PPK-test");
  });

  it("T-A10b: rejects without creating or pairing when neither peer has Pro", async () => {
    const [receiverChannel, sourceChannel] = memoryPair();
    const rootKeyHex = "12".repeat(32);
    const vaultId = await computeVaultId(Uint8Array.from(Buffer.from(rootKeyHex, "hex")));
    const createVault = vi.fn();
    const receiverUpsert = vi.fn();
    const sourceUpsert = vi.fn();
    const onError = vi.fn();

    const receiver = requestAdoption(receiverChannel, {
      deviceName: "Free receiver",
      generateDeviceId: () => "free-receiver",
      confirmSas: vi.fn(async () => true),
      license: vi.fn(async () => undefined),
      createVaultFromRootKey: createVault,
      deriveLocalIdentity: vi.fn(),
      upsertPairedDevice: receiverUpsert,
      onError,
    });
    const request = JSON.parse(
      new TextDecoder().decode(await sourceChannel.receive()),
    ) as AdoptRequest;
    const source = grantAdoption(sourceChannel, request, {
      sourceIdentity: identity("free-source"),
      rootKeyHex: vi.fn(async () => rootKeyHex),
      vaultId: vi.fn(async () => vaultId),
      license: vi.fn(async () => undefined),
      onConsent: vi.fn(async () => true),
      upsertPairedDevice: sourceUpsert,
    });

    await expect(receiver).resolves.toBeNull();
    await expect(source).rejects.toThrow("ADOPT_PRO_REQUIRED");
    expect(onError).toHaveBeenCalledWith("ADOPT_PRO_REQUIRED");
    expect(createVault).not.toHaveBeenCalled();
    expect(receiverUpsert).not.toHaveBeenCalled();
    expect(sourceUpsert).not.toHaveBeenCalled();
  });

  it("T-A10c: accepts and transfers a Pro license offered by the receiver", async () => {
    const [receiverChannel, sourceChannel] = memoryPair();
    const rootKeyHex = "13".repeat(32);
    const vaultId = await computeVaultId(Uint8Array.from(Buffer.from(rootKeyHex, "hex")));
    let sourceLicense: string | undefined;
    const sourceApply = vi.fn(async (license: string) => {
      sourceLicense = license;
    });

    const receiver = requestAdoption(receiverChannel, {
      deviceName: "Pro receiver",
      generateDeviceId: () => "pro-receiver",
      confirmSas: vi.fn(async () => true),
      license: vi.fn(async () => "PPK-receiver"),
      createVaultFromRootKey: vi.fn(async () => ({ vaultId })),
      deriveLocalIdentity: vi.fn(async () => identity("receiver")),
      upsertPairedDevice: vi.fn(),
      applyLicense: vi.fn(),
      onError: vi.fn(),
    });
    const request = JSON.parse(
      new TextDecoder().decode(await sourceChannel.receive()),
    ) as AdoptRequest;
    const source = grantAdoption(sourceChannel, request, {
      sourceIdentity: identity("free-source"),
      rootKeyHex: vi.fn(async () => rootKeyHex),
      vaultId: vi.fn(async () => vaultId),
      license: vi.fn(async () => sourceLicense),
      applyLicense: sourceApply,
      onConsent: vi.fn(async () => true),
      upsertPairedDevice: vi.fn(),
    });

    await expect(Promise.all([receiver, source])).resolves.toEqual([
      { device: expect.objectContaining({ deviceId: "free-source-id" }), snapshotCapable: true },
      expect.objectContaining({ deviceId: "receiver-id" }),
    ]);
    expect(sourceApply).toHaveBeenCalledWith("PPK-receiver");
  });

  it("T-A11: SAS reject aborts before ADOPT_GRANT", async () => {
    const [receiverChannel, sourceChannel] = memoryPair();
    const rootKeyHex = vi.fn(async () => "11".repeat(32));
    const createVaultFromRootKey = vi.fn();
    const receiver = requestAdoption(receiverChannel, {
      deviceName: "Receiver",
      generateDeviceId: () => "receiver-ephemeral",
      confirmSas: vi.fn(async () => false),
      createVaultFromRootKey,
      deriveLocalIdentity: vi.fn(),
      upsertPairedDevice: vi.fn(),
      onError: vi.fn(),
    });
    const request = JSON.parse(
      new TextDecoder().decode(await sourceChannel.receive()),
    ) as AdoptRequest;
    const source = grantAdoption(sourceChannel, request, {
      sourceIdentity: identity("source"),
      rootKeyHex,
      vaultId: vi.fn(),
      onConsent: vi.fn(async () => true),
      upsertPairedDevice: vi.fn(),
    });

    await expect(receiver).resolves.toBeNull();
    await expect(source).resolves.toBeNull();
    expect(rootKeyHex).not.toHaveBeenCalled();
    expect(createVaultFromRootKey).not.toHaveBeenCalled();
  });

  it("T-A12: consent reject aborts before ADOPT_GRANT and receiver remains vault-less", async () => {
    const [receiverChannel, sourceChannel] = memoryPair();
    const createVaultFromRootKey = vi.fn();
    const errors: string[] = [];
    const receiver = requestAdoption(receiverChannel, {
      deviceName: "Receiver",
      generateDeviceId: () => "receiver-ephemeral",
      confirmSas: vi.fn(async () => true),
      createVaultFromRootKey,
      deriveLocalIdentity: vi.fn(),
      upsertPairedDevice: vi.fn(),
      onError: (err) => errors.push(err),
    });
    const request = JSON.parse(new TextDecoder().decode(await sourceChannel.receive())) as AdoptRequest;
    await grantAdoption(sourceChannel, request, {
      sourceIdentity: identity("source"),
      rootKeyHex: vi.fn(),
      vaultId: vi.fn(),
      onConsent: vi.fn(async () => false),
      upsertPairedDevice: vi.fn(),
    });
    await Promise.race([receiver, Promise.resolve()]);

    expect(createVaultFromRootKey).not.toHaveBeenCalled();
    expect(errors).toEqual([]);
  });

  it("T-A13: invalid root_key_hex aborts gracefully", async () => {
    const [receiverChannel, sourceChannel] = memoryPair();
    const onError = vi.fn();
    const createVaultFromRootKey = vi.fn();
    const receiver = requestAdoption(receiverChannel, {
      deviceName: "Receiver",
      generateDeviceId: () => "receiver-ephemeral",
      confirmSas: vi.fn(async () => true),
      createVaultFromRootKey,
      deriveLocalIdentity: vi.fn(),
      upsertPairedDevice: vi.fn(),
      onError,
    });
    await sourceChannel.receive();
    await sendFrame(sourceChannel, {
      type: "ADOPT_GRANT",
      root_key_hex: "bad",
      vault_id: "00".repeat(32),
      source: { device_id: "source", device_name: "Source", device_type: "extension", long_term_public_key_hex: "ab".repeat(32) },
    } as never);
    await receiver;

    expect(onError).toHaveBeenCalledWith("ADOPT_UNEXPECTED_FRAME");
    expect(createVaultFromRootKey).not.toHaveBeenCalled();
  });

  it("T-A14: vault_id mismatch aborts before vault creation", async () => {
    const [receiverChannel, sourceChannel] = memoryPair();
    const onError = vi.fn();
    const createVaultFromRootKey = vi.fn();
    const receiver = requestAdoption(receiverChannel, {
      deviceName: "Receiver",
      generateDeviceId: () => "receiver-ephemeral",
      confirmSas: vi.fn(async () => true),
      createVaultFromRootKey,
      deriveLocalIdentity: vi.fn(),
      upsertPairedDevice: vi.fn(),
      onError,
    });
    await sourceChannel.receive();
    await sendFrame(sourceChannel, {
      type: "ADOPT_GRANT",
      root_key_hex: "22".repeat(32),
      vault_id: "00".repeat(32),
      source: { device_id: "source", device_name: "Source", device_type: "extension", long_term_public_key_hex: "ab".repeat(32) },
    });
    await receiver;

    expect(onError).toHaveBeenCalledWith("ADOPT_VAULT_ID_MISMATCH");
    expect(createVaultFromRootKey).not.toHaveBeenCalled();
  });

  it("T-A15: source does not persist receiver until ADOPT_IDENTITY arrives", async () => {
    const [receiverChannel, sourceChannel] = memoryPair();
    const upsert = vi.fn();
    const promise = grantAdoption(sourceChannel, {
      type: "ADOPT_REQUEST",
      device_id: "receiver-ephemeral",
      device_name: "Receiver",
      device_type: "extension",
    }, {
      sourceIdentity: identity("source"),
      rootKeyHex: vi.fn(async () => "33".repeat(32)),
      vaultId: vi.fn(async () => await computeVaultId(Uint8Array.from(Buffer.from("33".repeat(32), "hex")))),
      license: vi.fn(async () => "PPK-test"),
      onConsent: vi.fn(async () => true),
      upsertPairedDevice: upsert,
    });
    await sendFrame(receiverChannel, {
      type: "ADOPT_CONFIRM",
      confirmed: true,
    });

    await Promise.race([promise, Promise.resolve()]);
    expect(upsert).not.toHaveBeenCalled();
  });

  it("T-A16: receiver does not persist source without ADOPT_COMPLETE", async () => {
    const [receiverChannel, sourceChannel] = memoryPair();
    const rootKeyHex = "66".repeat(32);
    const vaultId = await computeVaultId(Uint8Array.from(Buffer.from(rootKeyHex, "hex")));
    const receiverUpsert = vi.fn();
    const onError = vi.fn();
    const receiver = requestAdoption(receiverChannel, {
      deviceName: "Receiver",
      generateDeviceId: () => "receiver-ephemeral",
      confirmSas: vi.fn(async () => true),
      license: vi.fn(async () => "PPK-local"),
      createVaultFromRootKey: vi.fn(async () => ({ vaultId })),
      deriveLocalIdentity: vi.fn(async () => identity("receiver")),
      upsertPairedDevice: receiverUpsert,
      onError,
    });

    await sourceChannel.receive(); // ADOPT_REQUEST
    await sourceChannel.receive(); // ADOPT_CONFIRM
    await sendFrame(sourceChannel, {
      type: "ADOPT_GRANT",
      root_key_hex: rootKeyHex,
      vault_id: vaultId,
      source: {
        device_id: "source-id",
        device_name: "Source",
        device_type: "extension",
        long_term_public_key_hex: "ab".repeat(32),
      },
    });
    await sourceChannel.receive(); // ADOPT_IDENTITY
    await sendFrame(sourceChannel, { type: "ADOPT_CONFIRM", confirmed: true });

    await expect(receiver).resolves.toBeNull();
    expect(onError).toHaveBeenCalledWith("ADOPT_COMPLETION_MISSING");
    expect(receiverUpsert).not.toHaveBeenCalled();
  });

  it("T-A17: receiver safety policy runs before vault creation", async () => {
    const [receiverChannel, sourceChannel] = memoryPair();
    const rootKeyHex = "77".repeat(32);
    const vaultId = await computeVaultId(Uint8Array.from(Buffer.from(rootKeyHex, "hex")));
    const createVaultFromRootKey = vi.fn();
    const receiver = requestAdoption(receiverChannel, {
      deviceName: "Receiver",
      generateDeviceId: () => "receiver-ephemeral",
      confirmSas: vi.fn(async () => true),
      license: vi.fn(async () => "PPK-local"),
      validateSource: vi.fn(async () => {
        throw new Error("JOIN_POPULATED_VAULT_BLOCKED");
      }),
      createVaultFromRootKey,
      deriveLocalIdentity: vi.fn(),
      upsertPairedDevice: vi.fn(),
      onError: vi.fn(),
    });

    await sourceChannel.receive(); // ADOPT_REQUEST
    await sourceChannel.receive(); // ADOPT_CONFIRM
    await sendFrame(sourceChannel, {
      type: "ADOPT_GRANT",
      root_key_hex: rootKeyHex,
      vault_id: vaultId,
      source: {
        device_id: "new-source",
        device_name: "Source",
        device_type: "extension",
        long_term_public_key_hex: "ab".repeat(32),
      },
    });

    await expect(receiver).rejects.toThrow("JOIN_POPULATED_VAULT_BLOCKED");
    expect(createVaultFromRootKey).not.toHaveBeenCalled();
  });

  it("T-A31: does not apply a license if vault creation fails", async () => {
    const [receiverChannel, sourceChannel] = memoryPair();
    const rootKeyHex = "44".repeat(32);
    const vaultId = await computeVaultId(Uint8Array.from(Buffer.from(rootKeyHex, "hex")));
    const applyLicense = vi.fn();
    const receiver = requestAdoption(receiverChannel, {
      deviceName: "Receiver",
      generateDeviceId: () => "receiver-ephemeral",
      confirmSas: vi.fn(async () => true),
      createVaultFromRootKey: vi.fn(async () => {
        throw new Error("commit_failed");
      }),
      deriveLocalIdentity: vi.fn(),
      upsertPairedDevice: vi.fn(),
      applyLicense,
      onError: vi.fn(),
    });
    await sourceChannel.receive();
    await sendFrame(sourceChannel, {
      type: "ADOPT_GRANT",
      root_key_hex: rootKeyHex,
      vault_id: vaultId,
      license: "PPK-test",
      source: { device_id: "source", device_name: "Source", device_type: "extension", long_term_public_key_hex: "ab".repeat(32) },
    });

    await expect(receiver).rejects.toThrow("commit_failed");
    expect(applyLicense).not.toHaveBeenCalled();
  });

  it("T-A32: never creates a vault when the grant vault_id mismatches the root key", async () => {
    const [receiverChannel, sourceChannel] = memoryPair();
    const createVaultFromRootKey = vi.fn();
    const receiver = requestAdoption(receiverChannel, {
      deviceName: "Receiver",
      generateDeviceId: () => "receiver-ephemeral",
      confirmSas: vi.fn(async () => true),
      createVaultFromRootKey,
      deriveLocalIdentity: vi.fn(),
      upsertPairedDevice: vi.fn(),
      applyLicense: vi.fn(),
      onError: vi.fn(),
    });
    await sourceChannel.receive();
    await sendFrame(sourceChannel, {
      type: "ADOPT_GRANT",
      root_key_hex: "55".repeat(32),
      vault_id: "99".repeat(32),
      license: "PPK-test",
      source: { device_id: "source", device_name: "Source", device_type: "extension", long_term_public_key_hex: "ab".repeat(32) },
    });

    await receiver;
    expect(createVaultFromRootKey).not.toHaveBeenCalled();
  });
});

describe("snapshot_capable echo on ADOPT_GRANT", () => {
  function validGrant() {
    return {
      type: "ADOPT_GRANT" as const,
      root_key_hex: "11".repeat(32),
      vault_id: "22".repeat(32),
      license: "PPK-test",
      source: {
        device_id: "src-id",
        device_name: "Source",
        device_type: "extension" as const,
        long_term_public_key_hex: "ab".repeat(32),
      },
    };
  }

  it("isAdoptGrant accepts a grant without snapshot_capable (pre-C source)", () => {
    expect(isAdoptGrant(validGrant())).toBe(true);
  });

  it("isAdoptGrant accepts snapshot_capable: true", () => {
    expect(isAdoptGrant({ ...validGrant(), snapshot_capable: true })).toBe(true);
  });

  it("isAdoptGrant accepts snapshot_capable: false", () => {
    expect(isAdoptGrant({ ...validGrant(), snapshot_capable: false })).toBe(true);
  });

  it("isAdoptGrant rejects snapshot_capable with wrong type", () => {
    expect(isAdoptGrant({ ...validGrant(), snapshot_capable: "yes" })).toBe(false);
  });

  it("grantAdoption echoes snapshot_capable: true when request had it", async () => {
    const [receiverChannel, sourceChannel] = memoryPair();
    const rootKeyHex = "33".repeat(32);
    const vaultId = await computeVaultId(Uint8Array.from(Buffer.from(rootKeyHex, "hex")));
    const sourceDeps: AdoptionSourceDeps = {
      sourceIdentity: identity("source"),
      rootKeyHex: vi.fn(async () => rootKeyHex),
      vaultId: vi.fn(async () => vaultId),
      license: vi.fn(async () => "PPK-test"),
      onConsent: vi.fn(async () => true),
      upsertPairedDevice: vi.fn(),
    };

    // Run grantAdoption concurrently with the test driver that feeds protocol frames.
    const grantPromise = grantAdoption(sourceChannel, {
      type: "ADOPT_REQUEST",
      device_id: "recv-id",
      device_name: "Receiver",
      device_type: "extension",
      snapshot_capable: true,
    }, sourceDeps);

    // grantAdoption: consent=true → reads ADOPT_CONFIRM → sends ADOPT_GRANT → reads ADOPT_IDENTITY
    await sendFrame(receiverChannel, { type: "ADOPT_CONFIRM", confirmed: true });
    const grantBytes = await receiverChannel.receive();
    const grantFrame = JSON.parse(new TextDecoder().decode(grantBytes));
    expect(grantFrame.type).toBe("ADOPT_GRANT");
    expect(grantFrame.snapshot_capable).toBe(true);

    // Let grantAdoption complete: send ADOPT_IDENTITY, read ADOPT_COMPLETE, send ADOPT_APPLIED.
    await sendFrame(receiverChannel, {
      type: "ADOPT_IDENTITY",
      device_id: "recv-id",
      device_name: "Receiver",
      device_type: "extension",
      long_term_public_key_hex: "ab".repeat(32),
    });
    await receiverChannel.receive(); // ADOPT_COMPLETE
    await sendFrame(receiverChannel, { type: "ADOPT_APPLIED" });
    await grantPromise;
  });

  it("grantAdoption sets snapshot_capable: false when request lacked it", async () => {
    const [receiverChannel, sourceChannel] = memoryPair();
    const rootKeyHex = "44".repeat(32);
    const vaultId = await computeVaultId(Uint8Array.from(Buffer.from(rootKeyHex, "hex")));
    const sourceDeps: AdoptionSourceDeps = {
      sourceIdentity: identity("source"),
      rootKeyHex: vi.fn(async () => rootKeyHex),
      vaultId: vi.fn(async () => vaultId),
      license: vi.fn(async () => "PPK-test"),
      onConsent: vi.fn(async () => true),
      upsertPairedDevice: vi.fn(),
    };

    const grantPromise = grantAdoption(sourceChannel, {
      type: "ADOPT_REQUEST",
      device_id: "recv-id",
      device_name: "Receiver",
      device_type: "extension",
      // NO snapshot_capable
    }, sourceDeps);

    await sendFrame(receiverChannel, { type: "ADOPT_CONFIRM", confirmed: true });
    const grantBytes = await receiverChannel.receive();
    const grantFrame = JSON.parse(new TextDecoder().decode(grantBytes));
    expect(grantFrame.type).toBe("ADOPT_GRANT");
    expect(grantFrame.snapshot_capable).toBe(false);

    await sendFrame(receiverChannel, {
      type: "ADOPT_IDENTITY",
      device_id: "recv-id",
      device_name: "Receiver",
      device_type: "extension",
      long_term_public_key_hex: "ab".repeat(32),
    });
    await receiverChannel.receive(); // ADOPT_COMPLETE
    await sendFrame(receiverChannel, { type: "ADOPT_APPLIED" });
    await grantPromise;
  });

  it("requestAdoption returns snapshotCapable: true when grant echoes it", async () => {
    const [receiverChannel, sourceChannel] = memoryPair();
    const rootKeyHex = "55".repeat(32);
    const vaultId = await computeVaultId(Uint8Array.from(Buffer.from(rootKeyHex, "hex")));
    const deps: AdoptionReceiverDeps = {
      deviceName: "recv",
      generateDeviceId: () => "recv-id",
      async confirmSas() { return true; },
      async createVaultFromRootKey() { return { vaultId }; },
      async deriveLocalIdentity() {
        return { deviceId: "recv-id", deviceName: "recv", deviceType: "extension" as const, longTermPublicKeyHex: "ab".repeat(32) };
      },
      async upsertPairedDevice() {},
      onError() {},
    };

    const receiverPromise = requestAdoption(receiverChannel, deps);
    // requestAdoption sends: ADOPT_REQUEST, ADOPT_CONFIRM (after SAS auto-accept)
    // Then reads: ADOPT_GRANT, sends: ADOPT_IDENTITY, reads: ADOPT_COMPLETE, sends: ADOPT_APPLIED
    await sourceChannel.receive(); // ADOPT_REQUEST
    await sourceChannel.receive(); // ADOPT_CONFIRM
    await sendFrame(sourceChannel, {
      type: "ADOPT_GRANT",
      root_key_hex: rootKeyHex,
      vault_id: vaultId,
      license: "PPK-test",
      source: { device_id: "src-id", device_name: "Source", device_type: "extension", long_term_public_key_hex: "ab".repeat(32) },
      snapshot_capable: true,
    });
    await sourceChannel.receive(); // ADOPT_IDENTITY
    await sendFrame(sourceChannel, { type: "ADOPT_COMPLETE" });
    await sourceChannel.receive(); // ADOPT_APPLIED

    const result = await receiverPromise;
    expect(result).not.toBeNull();
    expect(result!.snapshotCapable).toBe(true);
  });

  it("requestAdoption returns snapshotCapable: false when grant lacks the field", async () => {
    const [receiverChannel, sourceChannel] = memoryPair();
    const rootKeyHex = "66".repeat(32);
    const vaultId = await computeVaultId(Uint8Array.from(Buffer.from(rootKeyHex, "hex")));
    const deps: AdoptionReceiverDeps = {
      deviceName: "recv",
      generateDeviceId: () => "recv-id",
      async confirmSas() { return true; },
      async createVaultFromRootKey() { return { vaultId }; },
      async deriveLocalIdentity() {
        return { deviceId: "recv-id", deviceName: "recv", deviceType: "extension" as const, longTermPublicKeyHex: "ab".repeat(32) };
      },
      async upsertPairedDevice() {},
      onError() {},
    };

    const receiverPromise = requestAdoption(receiverChannel, deps);
    await sourceChannel.receive(); // ADOPT_REQUEST
    await sourceChannel.receive(); // ADOPT_CONFIRM
    await sendFrame(sourceChannel, {
      type: "ADOPT_GRANT",
      root_key_hex: rootKeyHex,
      vault_id: vaultId,
      license: "PPK-test",
      source: { device_id: "src-id", device_name: "Source", device_type: "extension", long_term_public_key_hex: "ab".repeat(32) },
      // NO snapshot_capable (pre-C source)
    });
    await sourceChannel.receive(); // ADOPT_IDENTITY
    await sendFrame(sourceChannel, { type: "ADOPT_COMPLETE" });
    await sourceChannel.receive(); // ADOPT_APPLIED

    const result = await receiverPromise;
    expect(result).not.toBeNull();
    expect(result!.snapshotCapable).toBe(false);
  });

  // T-A33: regression for the SNAPSHOT_FRAME_WIRE_CEILING (768 KiB) bug.
  // Today duress rides the final entries chunk, so an entry + duress whose
  // combined raw exceeds 768 KiB throws ADOPT_SNAPSHOT_CHUNK_TOO_LARGE on
  // receive. The v4.6.4 frame-ceiling fix separates duress from the entries
  // frame; this test proves that root-cause change rather than just a new
  // frame type. Currently fails until the fix lands.
  it("T-A33: >768 KiB snapshot (entry + duress) succeeds because duress no longer counts against the entries frame", async () => {
    const [source, receiver] = memoryPair();
    const entries: Record<string, string> = { "id-0": "x".repeat(450 * 1024) };
    const tombstones: Record<string, number> = { "dead-0": 1 };
    // ~320 KiB sealed duress: 450 KiB entry + ~320 KiB duress + JSON envelope
    // and tombstone map crosses the 768 KiB SNAPSHOT_FRAME_WIRE_CEILING when
    // duress rides the entries chunk.
    const duressJson = JSON.stringify({
      version: 1,
      salt: "aa".repeat(16),
      nonce: "bb".repeat(12),
      ciphertext: "cc".repeat(320 * 1024),
      tag: "dd".repeat(16),
    });

    const [result] = await Promise.all([
      receiveVaultSnapshot(receiver),
      sendVaultSnapshot(source, entries, tombstones, duressJson),
    ]);

    expect(result.entries).toEqual(entries);
    expect(result.tombstones).toEqual(tombstones);
    expect(result.duressSlot).toBe(duressJson);
  });
});