[private]
default:
    @just --list

[doc("Remove generated runtime artifacts (cache, logs, Results, zig-out)")]
[group("conformance")]
clean:
    rm -rf cache logs Results_* zig-out zig-pkg keyfile.log

[doc("Format conformance code")]
[group("conformance")]
fmt: fmt-python fmt-zig fmt-just

[doc("Lint conformance code")]
[group("conformance")]
lint: lint-python lint-zig lint-just

[doc("Format Python code")]
[group("conformance")]
fmt-python:
    uv run ruff format .
    uv run ruff check --fix .

[doc("Lint Python code")]
[group("conformance")]
lint-python:
    uv run ruff format --check .
    uv run ruff check .
    uv run ty check .

[doc("Format Zig harness code")]
[group("conformance")]
fmt-zig:
    zig fmt build.zig src/

[doc("Lint Zig harness code")]
[group("conformance")]
lint-zig:
    zig fmt --check build.zig src/
    ziglint build.zig src/

[doc("Format Justfile")]
[group("conformance")]
fmt-just:
    just --fmt --unstable --justfile justfile

[doc("Lint Justfile")]
[group("conformance")]
lint-just:
    just --check --fmt --unstable --justfile justfile

[private]
build:
    zig build

[doc("Run tlsfuzzer TLS 1.3 conformance smoke tests")]
[group("conformance")]
tlsfuzzer *ARGS: build
    uv run pytest {{ ARGS }}

[doc("Run all CI gates")]
[group("conformance")]
ci:
    zig build test
    just tlsfuzzer -v
    just anvil-report-test
    just anvil-adapter-test
    just anvil-server-test
    just anvil-client-test
    just anvil-chain-patch-test

[doc("Run TLS-Anvil server tests against the tls server harness")]
[group("conformance")]
anvil-server *ARGS: build
    uv run python scripts/anvil_server.py {{ ARGS }}

[doc("Run TLS-Anvil server with CI-safe sequential defaults")]
[group("conformance")]
anvil-ci-server RUN_DIR TIMEOUT_SECS="5400": build
    uv run python scripts/anvil_server.py --output-folder {{ RUN_DIR }} --timeout {{ TIMEOUT_SECS }} --strength 1 --parallel-tests 1 --parallel-handshakes 1

[doc("Adapt a TLS-Anvil output directory to report.normalized.json")]
[group("conformance")]
anvil-adapter RUN_DIR *ARGS:
    uv run python scripts/anvil_adapter.py {{ RUN_DIR }} {{ ARGS }}

[doc("Audit a real TLS-Anvil output directory against the adapter heuristics")]
[group("conformance")]
anvil-adapter-audit RUN_DIR:
    #!/usr/bin/env bash
    set -euo pipefail
    report="{{ RUN_DIR }}/report.normalized.audit.json"
    # --allow-partial is for local debug captures; do not use this recipe as acceptance evidence.
    uv run python scripts/anvil_adapter.py {{ RUN_DIR }} --output "$report" --allow-partial
    uv run python - "$report" <<'PY'
    import json
    import sys

    with open(sys.argv[1]) as f:
        data = json.load(f)
    tests = data.get("tests", [])
    known = [test for test in tests if test.get("feature") != "unknown"]
    assert tests, "adapter produced no tests"
    assert known, "adapter produced only unknown feature buckets"
    PY

[doc("Normalize TLS-Anvil results: apply skip-list and emit summary.json / summary.txt")]
[group("conformance")]
anvil-report RESULTS_JSON *ARGS:
    uv run python scripts/anvil_report.py {{ RESULTS_JSON }} {{ ARGS }}

[doc("Adapt and normalize a TLS-Anvil output directory")]
[group("conformance")]
anvil-report-dir RUN_DIR *ARGS:
    uv run python scripts/anvil_adapter.py {{ RUN_DIR }}
    uv run python scripts/anvil_report.py {{ RUN_DIR }}/report.normalized.json --output-dir {{ RUN_DIR }} {{ ARGS }}

[doc("Run synthetic TLS-Anvil report parser tests")]
[group("conformance")]
anvil-report-test:
    uv run pytest -q tests/test_anvil_report.py

[doc("Run TLS-Anvil output adapter tests")]
[group("conformance")]
anvil-adapter-test:
    uv run pytest -q tests/test_anvil_adapter.py

[doc("Run TLS-Anvil server wrapper helper tests")]
[group("conformance")]
anvil-server-test:
    uv run pytest -q tests/test_anvil_server.py

[doc("Lint the skip list against known TLS-Anvil feature names")]
[group("conformance")]
anvil-report-skip-list:
    @echo "TODO: real-run skip-list audit not yet automated."
    @echo "Run 'just anvil-report <real-results> --output-dir <run-dir>' and review unmatched_skip_patterns in the summary."

[doc("Run TLS-Anvil client tests against the tls client harness")]
[group("conformance")]
anvil-client *ARGS: build
    uv run python scripts/anvil_client.py {{ ARGS }}

[doc("Run TLS-Anvil client with CI-safe sequential defaults")]
[group("conformance")]
anvil-ci-client RUN_DIR TIMEOUT_SECS="5400": build
    uv run python scripts/anvil_client.py --output-folder {{ RUN_DIR }} --timeout {{ TIMEOUT_SECS }} --strength 1 --parallel-tests 1 --parallel-handshakes 1

[doc("Run TLS-Anvil client wrapper helper tests")]
[group("conformance")]
anvil-client-test:
    uv run pytest -q tests/test_anvil_client.py

[doc("Verify the patched TLS-Anvil jars: conforming CA roots and preserved validity")]
[group("conformance")]
anvil-chain-patch-test: build
    bash scripts/anvil-chain-provider-patch/probe.sh
