import {test} from 'node:test';
import {strict as assert} from 'node:assert';
import {execFileSync} from 'node:child_process';
import {hash} from 'node:crypto';
import {assertStagingTarget} from './mcp-staging-smoke.mjs';
test('write smoke refuses production and embedded credentials',()=>{
 assert.throws(()=>assertStagingTarget('https://mega.dash.apphub.co.za/api/mcp'));
 assert.throws(()=>assertStagingTarget('https://key:password@staging.test/api/mcp'));
 assert.equal(assertStagingTarget('http://127.0.0.1:6005/api/mcp').hostname,'127.0.0.1');
});
test('generated token has 256 bits and a matching hash',()=>{
 const output=JSON.parse(execFileSync(process.execPath,['scripts/generate-mcp-key.mjs'],{encoding:'utf8'}));
 assert.equal(Buffer.from(output.token,'base64url').length,32);assert.equal(output.tokenHash,hash('sha256',output.token));
});