import { describe, expect, it } from "vitest";

import initialView from "../../fixtures/player-view/initial.json";

describe("PlayerView security boundary", () => {
  it("does not expose hidden runtime fields", () => {
    const serialized = JSON.stringify(initialView);

    for (const forbidden of [
      '"roll"',
      '"target"',
      '"hidden_facts"',
      '"world_flags"',
      '"checks"',
      '"relationship_states"'
    ]) {
      expect(serialized).not.toContain(forbidden);
    }
  });

  it("shows only qualitative relationship bands", () => {
    for (const [key, value] of Object.entries(initialView.relationship)) {
      if (key === "updatedAtNode") continue;
      expect(typeof value).toBe("string");
    }
  });
});
