resource_package_test.go

// Copyright 2024-2026 Defense Unicorns
// SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial

package provider

import (
	"bytes"
	"context"
	"crypto/sha1"
	"encoding/json"
	"errors"
	"fmt"
	"math/big"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"runtime"
	"strings"
	"sync/atomic"
	"testing"
	"time"

	"github.com/defenseunicorns/pkg/helpers/v2"
	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
	"github.com/hashicorp/terraform-plugin-framework/attr"
	"github.com/hashicorp/terraform-plugin-framework/diag"
	"github.com/hashicorp/terraform-plugin-framework/resource"
	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
	"github.com/hashicorp/terraform-plugin-framework/resource/schema/defaults"
	"github.com/hashicorp/terraform-plugin-framework/tfsdk"
	"github.com/hashicorp/terraform-plugin-framework/types"
	"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
	"github.com/hashicorp/terraform-plugin-go/tftypes"
	"github.com/hashicorp/terraform-plugin-log/tflogtest"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/mock"
	"github.com/stretchr/testify/require"
	zarfAPI "github.com/zarf-dev/zarf/src/api"
	"github.com/zarf-dev/zarf/src/api/v1alpha1"
	zarfCluster "github.com/zarf-dev/zarf/src/pkg/cluster"
	"github.com/zarf-dev/zarf/src/pkg/packager"
	zarfPackager "github.com/zarf-dev/zarf/src/pkg/packager"
	"github.com/zarf-dev/zarf/src/pkg/packager/filters"
	"github.com/zarf-dev/zarf/src/pkg/packager/layout"
	zarfSigning "github.com/zarf-dev/zarf/src/pkg/signing"
	zarfState "github.com/zarf-dev/zarf/src/pkg/state"
	zarfValue "github.com/zarf-dev/zarf/src/pkg/value"
	"github.com/zarf-dev/zarf/src/pkg/variables"
	zarfZoci "github.com/zarf-dev/zarf/src/pkg/zoci"
	corev1 "k8s.io/api/core/v1"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/client-go/kubernetes/fake"

	"github.com/defenseunicorns/terraform-provider-uds/internal/logging"

	udsPackager "github.com/defenseunicorns/terraform-provider-uds/internal/packager"
)

// testCtx returns a context with a 5-minute deadline, matching the minimum
// lifecycle budget expected by zarfOperationTimeout.
func testCtx(t *testing.T) context.Context {
	t.Helper()
	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
	t.Cleanup(cancel)
	return ctx
}

func testOCISource(rawURL string) string {
	host := strings.TrimPrefix(rawURL, "https://")
	host = strings.TrimPrefix(host, "http://")
	return "oci://" + host + "/packages/test:v1.0.0"
}

func TestPackageResource_GetPackageSourceRemoteOptions(t *testing.T) {
	t.Run("disabled leaves HTTPS default without probing", func(t *testing.T) {
		var requests atomic.Int32
		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
			requests.Add(1)
			w.WriteHeader(http.StatusOK)
		}))
		defer server.Close()

		resource := NewPackageResource(&udsProviderConfig{}, nil, nil, nil).(*PackageResource)
		opts, err := resource.getPackageSourceRemoteOptions(testCtx(t), testOCISource(server.URL))

		require.NoError(t, err)
		assert.False(t, opts.PlainHTTP)
		assert.Zero(t, requests.Load())
	})

	t.Run("HTTP-only source resolves to plain HTTP", func(t *testing.T) {
		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
			w.WriteHeader(http.StatusUnauthorized)
		}))
		defer server.Close()

		resource := NewPackageResource(&udsProviderConfig{InsecureForceHTTP: true}, nil, nil, nil).(*PackageResource)
		opts, err := resource.getPackageSourceRemoteOptions(testCtx(t), testOCISource(server.URL))

		require.NoError(t, err)
		assert.True(t, opts.PlainHTTP)
	})

	t.Run("self-signed HTTPS source remains HTTPS when verification is skipped", func(t *testing.T) {
		server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
			w.WriteHeader(http.StatusUnauthorized)
		}))
		defer server.Close()

		resource := NewPackageResource(&udsProviderConfig{
			InsecureForceHTTP:           true,
			InsecureSkipTLSVerification: true,
		}, nil, nil, nil).(*PackageResource)
		opts, err := resource.getPackageSourceRemoteOptions(testCtx(t), testOCISource(server.URL))

		require.NoError(t, err)
		assert.False(t, opts.PlainHTTP)
		assert.True(t, opts.InsecureSkipTLSVerify)
	})

	t.Run("certificate failure does not downgrade to HTTP", func(t *testing.T) {
		server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
			w.WriteHeader(http.StatusOK)
		}))
		defer server.Close()

		resource := NewPackageResource(&udsProviderConfig{InsecureForceHTTP: true}, nil, nil, nil).(*PackageResource)
		opts, err := resource.getPackageSourceRemoteOptions(testCtx(t), testOCISource(server.URL))

		require.Error(t, err)
		assert.False(t, opts.PlainHTTP)
		assert.Contains(t, err.Error(), "unable to determine transport for package source")
	})

	t.Run("local source does not negotiate", func(t *testing.T) {
		resource := NewPackageResource(&udsProviderConfig{InsecureForceHTTP: true}, nil, nil, nil).(*PackageResource)
		opts, err := resource.getPackageSourceRemoteOptions(testCtx(t), "./zarf-package-test.tar.zst")

		require.NoError(t, err)
		assert.False(t, opts.PlainHTTP)
	})

	t.Run("provider aliases do not share cached failures", func(t *testing.T) {
		server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
			w.WriteHeader(http.StatusOK)
		}))
		defer server.Close()
		source := testOCISource(server.URL)

		strictResource := NewPackageResource(&udsProviderConfig{InsecureForceHTTP: true}, nil, nil, nil).(*PackageResource)
		_, err := strictResource.getPackageSourceRemoteOptions(testCtx(t), source)
		require.Error(t, err)

		skipVerifyResource := NewPackageResource(&udsProviderConfig{
			InsecureForceHTTP:           true,
			InsecureSkipTLSVerification: true,
		}, nil, nil, nil).(*PackageResource)
		opts, err := skipVerifyResource.getPackageSourceRemoteOptions(testCtx(t), source)

		require.NoError(t, err)
		assert.False(t, opts.PlainHTTP)
	})
}

type MockCluster struct {
	mock.Mock
}

func newFakeCluster() *zarfCluster.Cluster {
	return &zarfCluster.Cluster{Clientset: fake.NewSimpleClientset()}
}

// newLifecycleDeployedPackage builds cluster state from pkgLayout with an amd64
// architecture and the supplied deployed components.
func newLifecycleDeployedPackage(pkgLayout *layout.PackageLayout, components ...zarfState.DeployedComponent) zarfState.DeployedPackage {
	data := pkgLayout.AsV1alpha1()
	data.Metadata.Architecture = "amd64"
	return zarfState.DeployedPackage{
		Name:               data.Metadata.Name,
		Data:               data,
		DeployedComponents: components,
	}
}

// newPackageStateSecret serializes pkg into the Secret shape Zarf uses for
// deployed package state.
func newPackageStateSecret(t *testing.T, pkg zarfState.DeployedPackage) *corev1.Secret {
	t.Helper()
	data, err := json.Marshal(pkg)
	require.NoError(t, err)
	return &corev1.Secret{
		ObjectMeta: metav1.ObjectMeta{Name: pkg.GetSecretName(), Namespace: zarfState.ZarfNamespaceName},
		Data:       map[string][]byte{"data": data},
	}
}

// newCreateLifecycleModel builds a Create plan model from options, with known
// empty runtime outputs and unknown metadata as Terraform supplies before Create.
func newCreateLifecycleModel(options ...PackageResourceModelDataOption) PackageResourceModel {
	model := NewTestPackageResourceModel(options...)
	model.SetVariables = types.MapValueMust(types.StringType, map[string]attr.Value{})
	model.ConnectStrings = emptyConnectStringSet()
	model.Metadata = types.ObjectUnknown(packageMetadataAttrTypes)
	return model
}

// runCreateLifecycleTest builds a Terraform plan from model, calls Create, and
// returns the response for lifecycle assertions.
func runCreateLifecycleTest(t *testing.T, packageResource *PackageResource, model PackageResourceModel) resource.CreateResponse {
	t.Helper()
	plan := buildTestPlan(t, packageResource, model)
	resp := resource.CreateResponse{State: tfsdk.State{Schema: plan.Schema}}
	packageResource.Create(context.Background(), resource.CreateRequest{Plan: plan}, &resp)
	return resp
}

// runUpdateLifecycleTest builds Terraform plan and prior state from planModel
// and stateModel, calls Update, and returns the response.
func runUpdateLifecycleTest(t *testing.T, packageResource *PackageResource, planModel, stateModel PackageResourceModel) resource.UpdateResponse {
	t.Helper()
	plan := buildTestPlan(t, packageResource, planModel)
	state := buildTestState(t, packageResource, stateModel)
	resp := resource.UpdateResponse{State: tfsdk.State{Schema: plan.Schema}}
	packageResource.Update(context.Background(), resource.UpdateRequest{Plan: plan, State: state}, &resp)
	return resp
}

// requirePackageState decodes state into a package model and fails the test if
// the framework reports state conversion diagnostics.
func requirePackageState(t *testing.T, state tfsdk.State) PackageResourceModel {
	t.Helper()
	var model PackageResourceModel
	require.False(t, state.Get(context.Background(), &model).HasError())
	return model
}

// assertNoPackageState verifies that state has no readable package resource ID.
func assertNoPackageState(t *testing.T, state tfsdk.State) {
	t.Helper()
	var model PackageResourceModel
	diags := state.Get(context.Background(), &model)
	assert.True(t, diags.HasError() || model.ID.IsNull())
}

// assertPackageMetadata verifies the cluster-derived status, generation, and
// digest values stored in the package metadata object.
func assertPackageMetadata(t *testing.T, metadata types.Object, status string, generation int64, digest string) {
	t.Helper()
	attributes := metadata.Attributes()
	assert.Equal(t, status, attributes["status"].(types.String).ValueString())
	assert.Equal(t, generation, attributes["generation"].(types.Int64).ValueInt64())
	assert.Equal(t, digest, attributes["digest"].(types.String).ValueString())
}

func (m *MockCluster) NewWithWait(ctx context.Context) (*zarfCluster.Cluster, error) {
	args := m.Called(ctx)
	return args.Get(0).(*zarfCluster.Cluster), args.Error(1)
}

type MockPackager struct {
	mock.Mock
}

func (m *MockPackager) Deploy(ctx context.Context, pkgLayout *layout.PackageLayout, opts packager.DeployOptions) (packager.DeployResult, error) {
	args := m.Called(ctx, pkgLayout, opts)
	return args.Get(0).(packager.DeployResult), args.Error(1)
}

func (m *MockPackager) Remove(ctx context.Context, pkg zarfAPI.PackageDefinition, opts packager.RemoveOptions) error {
	args := m.Called(ctx, legacyPackageDefinition(pkg), opts)
	return args.Error(0)
}

func (m *MockPackager) LoadPackage(ctx context.Context, source string, opts packager.LoadOptions) (*layout.PackageLayout, error) {
	args := m.Called(ctx, source, opts)
	return args.Get(0).(*layout.PackageLayout), args.Error(1)
}

func (m *MockPackager) GetPackageFromSourceOrCluster(ctx context.Context, cluster *zarfCluster.Cluster, src string, namespaceOverride string, opts zarfPackager.LoadOptions) (_ zarfAPI.PackageDefinition, err error) {
	args := m.Called(ctx, cluster, src, namespaceOverride, opts)
	if pkg, ok := args.Get(0).(zarfAPI.PackageDefinition); ok {
		return pkg, args.Error(1)
	}
	return zarfAPI.NewPackageDefinitionFromV1alpha1(args.Get(0).(v1alpha1.ZarfPackage)), args.Error(1)
}

// legacyPackageDefinition preserves the v1alpha1 representation used by the
// existing mock fixtures. PackageDefinition conversion fills API defaults that
// were previously absent from those fixtures.
func legacyPackageDefinition(definition zarfAPI.PackageDefinition) v1alpha1.ZarfPackage {
	pkg := definition.AsV1alpha1()
	if pkg.APIVersion == v1alpha1.APIVersion {
		pkg.APIVersion = ""
	}
	if pkg.Kind == v1alpha1.ZarfPackageConfig {
		pkg.Kind = ""
	}
	pkg.Build.SetOriginalAPIVersion("")
	return pkg
}

type MockPackageComponentFilter struct {
	mock.Mock

	packageComponentFilter udsPackager.PackageComponentFilter
}

func (m *MockPackageComponentFilter) ForRemove(optionalComponents []string) filters.ComponentFilterStrategy {
	m.Called(optionalComponents)
	return m.getPackageComponentFilter().ForRemove(optionalComponents)
}

func (m *MockPackageComponentFilter) ForDeploy(optionalComponents []string) filters.ComponentFilterStrategy {
	m.Called(optionalComponents)
	return m.getPackageComponentFilter().ForDeploy(optionalComponents)
}

func (m *MockPackageComponentFilter) getPackageComponentFilter() udsPackager.PackageComponentFilter {
	if m.packageComponentFilter == nil {
		m.packageComponentFilter = udsPackager.NewPackageComponentFilter()
	}
	return m.packageComponentFilter
}

type MockLoadPackageResult struct {
	Layout *layout.PackageLayout
	Error  error
}

type PackageResourceModelDataOption func(*PackageResourceModel)

func WithSource(source string) PackageResourceModelDataOption {
	return func(model *PackageResourceModel) {
		model.Source = types.StringValue(source)
	}
}

func WithArchitecture(arch string) PackageResourceModelDataOption {
	return func(model *PackageResourceModel) {
		model.Architecture = types.StringValue(arch)
	}
}

// newTestSigVerification builds a SignatureVerificationModel for use in tests.
func newTestSigVerification(enabled bool, publicKey string, keyless *KeylessVerificationModel) SignatureVerificationModel {
	pubKeyVal := types.StringNull()
	if publicKey != "" {
		pubKeyVal = types.StringValue(publicKey)
	}
	sig := SignatureVerificationModel{
		Verify:    types.BoolValue(enabled),
		PublicKey: pubKeyVal,
		Keyless:   types.ObjectNull(keylessVerificationAttrTypes),
	}
	if keyless != nil {
		obj, diags := types.ObjectValueFrom(context.Background(), keylessVerificationAttrTypes, *keyless)
		if diags.HasError() {
			panic("newTestSigVerification: failed to build keyless object")
		}
		sig.Keyless = obj
	}
	return sig
}

// withSigVerification sets the signature_verification block from a SignatureVerificationModel.
func withSigVerification(sig SignatureVerificationModel) PackageResourceModelDataOption {
	return func(model *PackageResourceModel) {
		obj, diags := types.ObjectValueFrom(context.Background(), signatureVerificationAttrTypes, sig)
		if diags.HasError() {
			panic("withSigVerification: failed to build object")
		}
		model.SignatureVerification = obj
	}
}

func WithPublicKey(publicKey string) PackageResourceModelDataOption {
	return withSigVerification(newTestSigVerification(true, publicKey, nil))
}

func WithSignatureVerificationEnabled(enabled bool) PackageResourceModelDataOption {
	return withSigVerification(newTestSigVerification(enabled, "", nil))
}

// nullTimeoutsValue returns a timeouts.Value with no durations configured
// so all operations fall back to their code defaults.
func nullTimeoutsValue() timeouts.Value {
	return timeouts.Value{
		Object: types.ObjectNull(map[string]attr.Type{
			"create": types.StringType,
			"read":   types.StringType,
			"update": types.StringType,
			"delete": types.StringType,
		}),
	}
}

// WithTimeout sets all four timeout operations to the same duration string.
func WithTimeout(duration string) PackageResourceModelDataOption {
	return func(model *PackageResourceModel) {
		model.Timeouts = timeouts.Value{
			Object: types.ObjectValueMust(
				map[string]attr.Type{
					"create": types.StringType,
					"read":   types.StringType,
					"update": types.StringType,
					"delete": types.StringType,
				},
				map[string]attr.Value{
					"create": types.StringValue(duration),
					"read":   types.StringValue(duration),
					"update": types.StringValue(duration),
					"delete": types.StringValue(duration),
				},
			),
		}
	}
}

// WithCreateTimeout sets only the create timeout, leaving others null (defaults apply).
func WithCreateTimeout(duration string) PackageResourceModelDataOption {
	return func(model *PackageResourceModel) {
		model.Timeouts = timeouts.Value{
			Object: types.ObjectValueMust(
				map[string]attr.Type{
					"create": types.StringType,
					"read":   types.StringType,
					"update": types.StringType,
					"delete": types.StringType,
				},
				map[string]attr.Value{
					"create": types.StringValue(duration),
					"read":   types.StringNull(),
					"update": types.StringNull(),
					"delete": types.StringNull(),
				},
			),
		}
	}
}

// WithDeployedState populates computed read-only fields to plausible post-deploy values.
// Required when constructing a prior-state tfsdk.State for handler-level Read/Delete tests.
func WithDeployedState() PackageResourceModelDataOption {
	return func(model *PackageResourceModel) {
		model.ID = types.StringValue("test-pkg")
		model.Name = types.StringValue("test-pkg")
		model.Kind = types.StringValue("ZarfPackageConfig")
		model.Version = types.StringValue("1.0.0")
		meta, _ := types.ObjectValue(
			packageMetadataAttrTypes,
			map[string]attr.Value{
				"name":        types.StringValue("test-pkg"),
				"description": types.StringValue("test package"),
				"version":     types.StringValue("1.0.0"),
				"status":      types.StringNull(),
				"generation":  types.Int64Null(),
				"digest":      types.StringNull(),
			},
		)
		model.Metadata = meta
		model.ConnectStrings = emptyConnectStringSet()
		model.SetVariables = types.MapValueMust(types.StringType, map[string]attr.Value{})
	}
}

// buildTestState serializes model into a tfsdk.State using the resource schema.
// Use for handler-level tests that call r.Create/Read/Update/Delete directly.
func buildTestState(t *testing.T, r *PackageResource, model PackageResourceModel) tfsdk.State {
	t.Helper()
	ctx := context.Background()
	var schemaResp resource.SchemaResponse
	r.Schema(ctx, resource.SchemaRequest{}, &schemaResp)
	state := tfsdk.State{Schema: schemaResp.Schema}
	diags := state.Set(ctx, &model)
	require.False(t, diags.HasError(), "buildTestState: %v", diags)
	return state
}

func buildTestPlan(t *testing.T, r *PackageResource, model PackageResourceModel) tfsdk.Plan {
	t.Helper()
	ctx := context.Background()
	var schemaResp resource.SchemaResponse
	r.Schema(ctx, resource.SchemaRequest{}, &schemaResp)
	plan := tfsdk.Plan{Schema: schemaResp.Schema}
	diags := plan.Set(ctx, &model)
	require.False(t, diags.HasError(), "buildTestPlan: %v", diags)
	return plan
}

func buildTestConfig(t *testing.T, r *PackageResource, model PackageResourceModel) tfsdk.Config {
	t.Helper()
	plan := buildTestPlan(t, r, model)
	return tfsdk.Config{Raw: plan.Raw, Schema: plan.Schema}
}

func WithNamespace(namespace string) PackageResourceModelDataOption {
	return func(model *PackageResourceModel) {
		model.Namespace = types.StringValue(namespace)
	}
}

func WithComponents(components []ComponentModel) PackageResourceModelDataOption {
	return func(model *PackageResourceModel) {
		model.Components = componentSliceToSet(components)
	}
}

func WithVars(vars []VariableModel) PackageResourceModelDataOption {
	return func(model *PackageResourceModel) {
		model.Vars = variableSliceToSet(vars)
	}
}

func WithSensitiveVars(sensitiveVars []VariableModel) PackageResourceModelDataOption {
	return func(model *PackageResourceModel) {
		model.SensitiveVars = variableSliceToSet(sensitiveVars)
	}
}

// WithOptionalComponents sets optional_components to an explicit set of names.
// Pass an empty slice to set an empty (non-null) set.
func WithOptionalComponents(names []string) PackageResourceModelDataOption {
	return func(model *PackageResourceModel) {
		vals := make([]attr.Value, len(names))
		for i, name := range names {
			vals[i] = types.StringValue(name)
		}
		model.OptionalComponents = types.SetValueMust(types.StringType, vals)
	}
}

func WithValues(values types.Dynamic) PackageResourceModelDataOption {
	return func(model *PackageResourceModel) {
		model.Values = values
	}
}

func WithSensitiveValues(values types.Dynamic) PackageResourceModelDataOption {
	return func(model *PackageResourceModel) {
		model.SensitiveValues = values
	}
}

// NewTestPackageResourceModel creates a PackageResourceModel with default values and applies data options
func NewTestPackageResourceModel(options ...PackageResourceModelDataOption) PackageResourceModel {
	model := PackageResourceModel{
		Source:                types.StringValue("oci://ghcr.io/defenseunicorns/packages/test:latest"),
		Architecture:          types.StringValue(runtime.GOARCH),
		SignatureVerification: types.ObjectNull(signatureVerificationAttrTypes),
		Timeouts:              nullTimeoutsValue(),
		Namespace:             types.StringValue(""),
		Components:            componentSliceToSet([]ComponentModel{}),
		OptionalComponents:    types.SetNull(types.StringType),
		Vars:                  variableSliceToSet([]VariableModel{}),
		SensitiveVars:         variableSliceToSet([]VariableModel{}),
		Values:                types.DynamicNull(),
		SensitiveValues:       types.DynamicNull(),
	}

	for _, option := range options {
		option(&model)
	}

	return model
}

type ComponentModelDataOption func(*ComponentModel)

func WithComponentOverrides(overrides []ComponentChartValuesModel) ComponentModelDataOption {
	return func(model *ComponentModel) {
		model.Overrides = componentChartValuesSliceToSet(overrides)
	}
}

type ComponentChartValuesModelDataOption func(*ComponentChartValuesModel)

func WithComponentChartName(chartName string) ComponentChartValuesModelDataOption {
	return func(model *ComponentChartValuesModel) {
		model.ChartName = types.StringValue(chartName)
	}
}

func WithComponentChartValues(values []HelmChartPathValueModel) ComponentChartValuesModelDataOption {
	return func(model *ComponentChartValuesModel) {
		model.Values = helmChartPathValueSliceToSet(values)
	}
}

func WithComponentChartSensitiveValues(values []HelmChartPathValueModel) ComponentChartValuesModelDataOption {
	return func(model *ComponentChartValuesModel) {
		model.SensitiveValues = helmChartPathValueSliceToSet(values)
	}
}

// NewTestComponentModel creates a ComponentModel with default values and applies data options
func NewTestComponentModel(name string, options ...ComponentModelDataOption) ComponentModel {
	model := ComponentModel{
		Name: types.StringValue(name),
	}

	for _, option := range options {
		option(&model)
	}

	return model
}

// SetVarEntry is a small helper for defining expected runtime set variables
// in a compact, tabular form for tests.
type SetVarEntry struct {
	Name      string
	Value     string
	Sensitive bool
}

// buildVCFromEntries constructs a *variables.VariableConfig from a slice of SetVarEntry.
func buildVCFromEntries(entries []SetVarEntry) *variables.VariableConfig {
	vc := variables.New("", nil, nil)
	for _, e := range entries {
		vc.SetVariable(e.Name, e.Value, e.Sensitive, false, v1alpha1.RawVariableType)
	}
	return vc
}

// buildVCFromMaps constructs a *variables.VariableConfig from two input maps:
// one marked non-sensitive and one marked sensitive. Keys are provided as they
// come from deploy results (may be mixed case); production code will
// normalize names to lowercase when exporting.
func buildVCFromMaps(nonSensitive map[string]string, sensitive map[string]string) *variables.VariableConfig {
	vc := variables.New("", nil, nil)
	for k, v := range nonSensitive {
		vc.SetVariable(k, v, false, false, v1alpha1.RawVariableType)
	}
	for k, v := range sensitive {
		vc.SetVariable(k, v, true, false, v1alpha1.RawVariableType)
	}
	return vc
}

// DeployedVar is a compact representation of a deployed set variable with its
// value and whether it is sensitive.
type DeployedVar struct {
	Value     string
	Sensitive bool
}

// buildVCFromCondensedMap constructs a *variables.VariableConfig from a
// condensed map of deployed variables where the value includes whether it is
// sensitive. This mirrors the reviewer-suggested table format.
func buildVCFromCondensedMap(in map[string]DeployedVar) *variables.VariableConfig {
	vc := variables.New("", nil, nil)
	for k, v := range in {
		vc.SetVariable(k, v.Value, v.Sensitive, false, v1alpha1.RawVariableType)
	}
	return vc
}

// readStringMap extracts a map[string]string from a Terraform types.Map value.
// It returns an empty map (not nil) when the input is null/unknown/empty to make
// assertions simpler in tests.
func readStringMap(ctx context.Context, m types.Map) (map[string]string, error) {
	out := map[string]string{}
	if m.IsNull() || m.IsUnknown() {
		return out, nil
	}
	diags := m.ElementsAs(ctx, &out, false)
	if diags.HasError() {
		return nil, fmt.Errorf("failed to read types.Map: %v", diags)
	}
	return out, nil
}

// NewTestComponentChartValuesModel creates a ComponentChartValuesModel with default values and applies data options
func NewTestComponentChartValuesModel(chartName string, options ...ComponentChartValuesModelDataOption) ComponentChartValuesModel {
	model := ComponentChartValuesModel{
		ChartName: types.StringValue(chartName),
	}

	for _, option := range options {
		option(&model)
	}

	return model
}

// NewComponentModelsFromNames creates ComponentModel slice from component names
func NewComponentModelsFromNames(componentNames []string) []ComponentModel {
	componentModels := make([]ComponentModel, len(componentNames))
	for i, componentName := range componentNames {
		componentModels[i] = ComponentModel{
			Name: types.StringValue(componentName),
		}
	}
	return componentModels
}

func newErrorLoadPackageResult(err error) MockLoadPackageResult {
	return MockLoadPackageResult{
		Layout: &layout.PackageLayout{
			PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{}),
		},
		Error: err,
	}
}

// Helper function to create fresh MockLoadPackageResult for each test
func newValidLoadPackageResult() MockLoadPackageResult {
	return MockLoadPackageResult{
		Layout: &layout.PackageLayout{
			PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{
				Metadata: v1alpha1.ZarfMetadata{
					Name:        "test-package",
					Description: "Test package",
					Version:     "0.0.1",
				},
				Components: []v1alpha1.ZarfComponent{
					{
						Name:     "test-required-component-0",
						Required: helpers.BoolPtr(true),
						Default:  false,
					},
					{
						Name:     "test-required-component-1",
						Required: helpers.BoolPtr(true),
						Default:  false,
					},
					{
						Name:     "test-optional-default-component-0",
						Required: nil, // Why zarf, why?
						Default:  true,
					},
					{
						Name:     "test-optional-default-component-1",
						Required: helpers.BoolPtr(false),
						Default:  true,
					},
					{
						Name:     "test-optional-non-default-component-0",
						Required: nil,
						Default:  false,
					},
					{
						Name:     "test-optional-non-default-component-1",
						Required: helpers.BoolPtr(false),
						Default:  false,
					},
				},
			}),
		},
		Error: nil,
	}
}

func testPackageIdentity(namespace string) deployedPackageIdentity {
	id := "test-package"
	if namespace != "" {
		id = namespace + ":" + id
	}
	return deployedPackageIdentity{
		ID:        id,
		Name:      "test-package",
		Namespace: namespace,
		Package: zarfState.DeployedPackage{
			Name:              "test-package",
			NamespaceOverride: namespace,
			Data:              v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-package"}},
		},
	}
}

func TestPackageResource_Upsert_VariableModels(t *testing.T) {
	packageLayout := layout.PackageLayout{
		PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{
			Metadata: v1alpha1.ZarfMetadata{
				Name:        "test-package",
				Description: "Test package",
				Version:     "0.0.1",
			},
			Components: []v1alpha1.ZarfComponent{
				{
					Name:     "test-required-component-0",
					Required: helpers.BoolPtr(true),
					Default:  false,
				},
			},
		}),
	}

	tests := []struct {
		name                   string
		vars                   []VariableModel
		sensitiveVars          []VariableModel
		VariableModelMap       types.Map
		expectedVariableModels map[string]string
	}{
		{
			name:          "vars and sensitiveVars",
			vars:          []VariableModel{{Name: types.StringValue("listKey"), Value: types.StringValue("listsValue")}},
			sensitiveVars: []VariableModel{{Name: types.StringValue("sensitive_listKey"), Value: types.StringValue("sensitive listValue")}},
			expectedVariableModels: map[string]string{
				"listKey":           "listsValue",
				"sensitive_listKey": "sensitive listValue",
			},
		},
		{
			name:          "vars only",
			vars:          []VariableModel{{Name: types.StringValue("listKey"), Value: types.StringValue("listsValue")}},
			sensitiveVars: []VariableModel{},
			expectedVariableModels: map[string]string{
				"listKey": "listsValue",
			},
		},
		{
			name:          "sensitiveVars only",
			vars:          []VariableModel{},
			sensitiveVars: []VariableModel{{Name: types.StringValue("sensitive_listKey"), Value: types.StringValue("sensitive listValue")}},
			expectedVariableModels: map[string]string{
				"sensitive_listKey": "sensitive listValue",
			},
		},
		{
			name:                   "no vars at all",
			vars:                   []VariableModel{},
			sensitiveVars:          []VariableModel{},
			expectedVariableModels: map[string]string{},
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			mockPackager := &MockPackager{}
			mockPackageComponentFilter := &MockPackageComponentFilter{}
			mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(
				&packageLayout,
				nil,
			)
			mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)
			mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

			packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)
			testModel := NewTestPackageResourceModel(
				WithVars(tc.vars),
				WithSensitiveVars(tc.sensitiveVars),
			)

			_, err := packageResource.upsert(testCtx(t), testModel)
			assert.NoError(t, err)

			// Check that Deploy was called and the variables map was provided with the correct values
			mockPackageComponentFilter.AssertExpectations(t)
			for _, call := range mockPackager.Calls {
				if call.Method == "Deploy" {
					deployOptions := call.Arguments[2].(zarfPackager.DeployOptions)
					assert.NotNil(t, deployOptions.SetVariables)
					assert.Len(t, deployOptions.SetVariables, len(tc.expectedVariableModels))
					assert.Equal(t, deployOptions.SetVariables, tc.expectedVariableModels)
				}
			}
		})
	}
}

func TestPackageResource_Upsert_ForceHelmSSAConflicts(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout

	tests := []struct {
		name                  string
		forceHelmSSAConflicts bool
	}{
		{
			name:                  "ForceConflicts is false when provider setting is false",
			forceHelmSSAConflicts: false,
		},
		{
			name:                  "ForceConflicts is true when provider setting is true",
			forceHelmSSAConflicts: true,
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			mockPackager := &MockPackager{}
			mockPackageComponentFilter := &MockPackageComponentFilter{}
			mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil)
			mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)
			mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

			providerCfg := &udsProviderConfig{
				ForceHelmSSAConflicts: tc.forceHelmSSAConflicts,
			}
			packageResource := NewPackageResource(providerCfg, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)

			_, err := packageResource.upsert(testCtx(t), NewTestPackageResourceModel())
			assert.NoError(t, err)

			for _, call := range mockPackager.Calls {
				if call.Method == "Deploy" {
					deployOptions := call.Arguments[2].(zarfPackager.DeployOptions)
					assert.Equal(t, tc.forceHelmSSAConflicts, deployOptions.ForceConflicts)
				}
			}
		})
	}
}

func TestPackageResource_UpsertNegotiatesPackageSourceAndPreservesRegistryOptions(t *testing.T) {
	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		w.WriteHeader(http.StatusUnauthorized)
	}))
	defer server.Close()

	mockPackager := &MockPackager{}
	mockPackageComponentFilter := &MockPackageComponentFilter{}
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).
		Return(newValidLoadPackageResult().Layout, nil)
	mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).
		Return(packager.DeployResult{}, nil)
	mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

	providerConfig := &udsProviderConfig{
		InsecureForceHTTP:           true,
		InsecureSkipTLSVerification: true,
	}
	packageResource := NewPackageResource(providerConfig, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)
	model := NewTestPackageResourceModel(WithSource(testOCISource(server.URL)))

	_, err := packageResource.upsert(testCtx(t), model)
	require.NoError(t, err)

	var loadOptions zarfPackager.LoadOptions
	var deployOptions zarfPackager.DeployOptions
	for _, call := range mockPackager.Calls {
		switch call.Method {
		case "LoadPackage":
			loadOptions = call.Arguments[2].(zarfPackager.LoadOptions)
		case "Deploy":
			deployOptions = call.Arguments[2].(zarfPackager.DeployOptions)
		}
	}
	assert.False(t, loadOptions.PlainHTTP, "working HTTPS package source must not be downgraded")
	assert.True(t, loadOptions.InsecureSkipTLSVerify)
	assert.True(t, deployOptions.PlainHTTP, "external HTTP Zarf registry compatibility must be preserved")
	assert.True(t, deployOptions.InsecureSkipTLSVerify)
}

func TestPackageResource_LoadPackageLayoutForInspectionUsesNegotiatedSourceOptions(t *testing.T) {
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		w.WriteHeader(http.StatusUnauthorized)
	}))
	defer server.Close()

	mockPackager := &MockPackager{}
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).
		Return(newValidLoadPackageResult().Layout, nil)
	packageResource := NewPackageResource(
		&udsProviderConfig{InsecureForceHTTP: true},
		mockPackager,
		nil,
		nil,
	).(*PackageResource)

	_, err := packageResource.loadPackageLayoutForInspection(
		testCtx(t),
		NewTestPackageResourceModel(WithSource(testOCISource(server.URL))),
	)
	require.NoError(t, err)

	loadOptions := mockPackager.Calls[0].Arguments[2].(zarfPackager.LoadOptions)
	assert.True(t, loadOptions.PlainHTTP)
}

func TestPackageResource_Upsert_SetVariables(t *testing.T) {
	cases := []struct {
		name                        string
		deployedPackageSetVariables map[string]DeployedVar
		expectedSetVariables        map[string]string
	}{
		{
			name:                        "no deployed package set variables returns empty set_variables map",
			deployedPackageSetVariables: map[string]DeployedVar{},
			expectedSetVariables:        map[string]string{},
		},
		{
			name: "single non-sensitive set variable is exported into set_variables",
			deployedPackageSetVariables: map[string]DeployedVar{
				"OUTPUT": {Value: "output-val", Sensitive: false},
			},
			expectedSetVariables: map[string]string{"output": "output-val"},
		},
		{
			name: "single sensitive set variable is exported into set_variables",
			deployedPackageSetVariables: map[string]DeployedVar{
				"API_KEY": {Value: "s3cr3t", Sensitive: true},
			},
			expectedSetVariables: map[string]string{"api_key": "s3cr3t"},
		},
		{
			name: "variable names normalized to lowercase",
			deployedPackageSetVariables: map[string]DeployedVar{
				"OUTPUT": {Value: "output-val", Sensitive: false},
			},
			expectedSetVariables: map[string]string{"output": "output-val"},
		},
		{
			name: "multiple variables are all exported into set_variables",
			deployedPackageSetVariables: map[string]DeployedVar{
				"OUTPUT":      {Value: "output-val", Sensitive: false},
				"API_KEY":     {Value: "s3cr3t", Sensitive: true},
				"DB_NAME":     {Value: "mydb", Sensitive: false},
				"DB_PASSWORD": {Value: "p@ssw0rd", Sensitive: true},
			},
			expectedSetVariables: map[string]string{
				"output":      "output-val",
				"api_key":     "s3cr3t",
				"db_name":     "mydb",
				"db_password": "p@ssw0rd",
			},
		},
	}

	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			packageLayout := layout.PackageLayout{
				PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{
					Metadata: v1alpha1.ZarfMetadata{
						Name:        "test-package",
						Description: "Test package",
						Version:     "0.0.1",
					},
					Components: []v1alpha1.ZarfComponent{
						{
							Name:     "test-required-component-0",
							Required: helpers.BoolPtr(true),
							Default:  false,
						},
					},
				}),
			}

			mockPackager := &MockPackager{}
			mockPackageComponentFilter := &MockPackageComponentFilter{}

			mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(&packageLayout, nil)

			deployRes := packager.DeployResult{VariableConfig: buildVCFromCondensedMap(tc.deployedPackageSetVariables)}
			mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(deployRes, nil)
			mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

			packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)

			testModel := NewTestPackageResourceModel()

			plan, err := packageResource.upsert(testCtx(t), testModel)
			assert.NoError(t, err)

			gotSetVars, err := readStringMap(context.Background(), plan.SetVariables)
			assert.NoError(t, err)
			assert.Equal(t, tc.expectedSetVariables, gotSetVars)

			mockPackager.AssertExpectations(t)
			mockPackageComponentFilter.AssertExpectations(t)
		})
	}
}

// Ensure provider can export values coming from deployResult.Values
// including structured values which should be YAML-encoded in the exported map.
func TestPackageResource_Upsert_DeployValues_NotPersisted(t *testing.T) {
	packageLayout := layout.PackageLayout{
		PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{
			Metadata: v1alpha1.ZarfMetadata{
				Name:        "test-package",
				Description: "Test package",
				Version:     "0.0.1",
			},
			Components: []v1alpha1.ZarfComponent{{Name: "test-required-component-0", Required: helpers.BoolPtr(true)}},
		}),
	}

	mockPackager := &MockPackager{}
	mockPackageComponentFilter := &MockPackageComponentFilter{}

	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(&packageLayout, nil)

	// Build deploy result with Values containing a plain string and a structured value
	structured := map[string]any{"a": 1, "b": "x"}
	deployRes := packager.DeployResult{
		Values: map[string]any{
			"plain":   "strval",
			"complex": structured,
		},
	}

	mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(deployRes, nil)
	mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)

	testModel := NewTestPackageResourceModel()

	plan, err := packageResource.upsert(testCtx(t), testModel)
	assert.NoError(t, err)

	// Ensure deployResult.Values are not included in set_variables (only SetVariables are persisted)
	setVars := map[string]string{}
	if !plan.SetVariables.IsNull() && !plan.SetVariables.IsUnknown() {
		diags := plan.SetVariables.ElementsAs(context.Background(), &setVars, false)
		assert.False(t, diags.HasError(), "failed to read set_variables: %v", diags)
	}

	// plain and complex should not be present in set_variables
	_, okPlain := setVars["plain"]
	_, okComplex := setVars["complex"]
	assert.False(t, okPlain)
	assert.False(t, okComplex)

	mockPackager.AssertExpectations(t)
	mockPackageComponentFilter.AssertExpectations(t)
}

// Ensure input-provided vars / sensitive_vars are NOT persisted into computed maps
func TestPackageResource_Upsert_InputVars_NotPersisted(t *testing.T) {
	packageLayout := layout.PackageLayout{
		PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{
			Metadata:   v1alpha1.ZarfMetadata{Name: "test-package"},
			Components: []v1alpha1.ZarfComponent{{Name: "test-required-component-0", Required: helpers.BoolPtr(true)}},
		}),
	}

	mockPackager := &MockPackager{}
	mockPackageComponentFilter := &MockPackageComponentFilter{}

	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(&packageLayout, nil)
	// Deploy returns empty result (no runtime set variables)
	mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)
	mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)

	// Provide vars and sensitive_vars in the model inputs
	testModel := NewTestPackageResourceModel(
		WithVars([]VariableModel{{Name: types.StringValue("INP1"), Value: types.StringValue("val1")}}),
		WithSensitiveVars([]VariableModel{{Name: types.StringValue("INP_SECRET"), Value: types.StringValue("val-secret")}}),
	)

	plan, err := packageResource.upsert(testCtx(t), testModel)
	assert.NoError(t, err)

	setVars := map[string]string{}
	if !plan.SetVariables.IsNull() && !plan.SetVariables.IsUnknown() {
		diags := plan.SetVariables.ElementsAs(context.Background(), &setVars, false)
		assert.False(t, diags.HasError(), "failed to read set_variables: %v", diags)
	}
	// input var names should NOT be present in the computed maps
	_, ok1 := setVars["inp1"]
	assert.False(t, ok1)

	setVars = map[string]string{}
	if !plan.SetVariables.IsNull() && !plan.SetVariables.IsUnknown() {
		diags := plan.SetVariables.ElementsAs(context.Background(), &setVars, false)
		assert.False(t, diags.HasError(), "failed to read set_variables: %v", diags)
	}
	_, ok2 := setVars["inp_secret"]
	assert.False(t, ok2)

	mockPackager.AssertExpectations(t)
	mockPackageComponentFilter.AssertExpectations(t)
}

// When no runtime SetVariables are produced, the provider should return an
// empty `set_variables` map (not null) so callers can safely index into it.
func TestPackageResource_Upsert_SetVariables_EmptyAndNull(t *testing.T) {
	packageLayout := layout.PackageLayout{
		PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{
			Metadata:   v1alpha1.ZarfMetadata{Name: "test-package"},
			Components: []v1alpha1.ZarfComponent{{Name: "test-required-component-0", Required: helpers.BoolPtr(true)}},
		}),
	}

	mockPackager := &MockPackager{}
	mockPackageComponentFilter := &MockPackageComponentFilter{}

	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(&packageLayout, nil)
	// Deploy returns an empty result (no VariableConfig)
	mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)
	mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)

	// Case A: No set variables configured and no deploy results
	testModelNull := NewTestPackageResourceModel()
	planNull, err := packageResource.upsert(testCtx(t), testModelNull)
	assert.NoError(t, err)
	exportedNull := map[string]string{}
	diags := planNull.SetVariables.ElementsAs(context.Background(), &exportedNull, false)
	assert.False(t, diags.HasError())
	assert.Len(t, exportedNull, 0)

	// Case B: no runtime set variables (legacy export flag removed)
	testModelEmpty := NewTestPackageResourceModel()
	planEmpty, err := packageResource.upsert(testCtx(t), testModelEmpty)
	assert.NoError(t, err)
	exportedEmpty := map[string]string{}
	diags2 := planEmpty.SetVariables.ElementsAs(context.Background(), &exportedEmpty, false)
	assert.False(t, diags2.HasError())
	assert.Len(t, exportedEmpty, 0)

	mockPackager.AssertExpectations(t)
	mockPackageComponentFilter.AssertExpectations(t)
}

func TestPackageResource_Upsert_PopulatesDeploymentState(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout
	mockCluster := &MockCluster{}
	mockPackager := &MockPackager{}
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil).Once()
	mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{
		DeployedComponents: []zarfState.DeployedComponent{
			{Name: "test-optional-default-component-0", Status: zarfState.ComponentStatusSucceeded, InstalledCharts: []zarfState.InstalledChart{
				{ConnectStrings: zarfState.ConnectStrings{"deploy-service": {Description: "from deploy"}}},
			}},
		},
		VariableConfig: buildVCFromEntries([]SetVarEntry{{Name: "OUTPUT", Value: "output-value"}}),
	}, nil)
	mockPackageComponentFilter := &MockPackageComponentFilter{}
	mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, mockCluster).(*PackageResource)
	plan, err := packageResource.upsert(testCtx(t), NewTestPackageResourceModel(
		WithOptionalComponents([]string{"test-optional-default-component-0"}),
	))
	require.NoError(t, err)

	metadata := plan.Metadata.Attributes()
	assert.NotContains(t, metadata, "zarf")
	assert.Equal(t, "Succeeded", metadata["status"].(types.String).ValueString())
	assert.Equal(t, int64(0), metadata["generation"].(types.Int64).ValueInt64())
	assert.Equal(t, packageLayout.Digest(), metadata["digest"].(types.String).ValueString())

	var connectStrings []struct {
		Name        types.String `tfsdk:"name"`
		Description types.String `tfsdk:"description"`
	}
	diags := plan.ConnectStrings.ElementsAs(context.Background(), &connectStrings, false)
	require.False(t, diags.HasError(), "connect string diagnostics: %v", diags)
	require.Len(t, connectStrings, 1)
	assert.Equal(t, "deploy-service", connectStrings[0].Name.ValueString())
	assert.Equal(t, "from deploy", connectStrings[0].Description.ValueString())

	setVariables, err := readStringMap(context.Background(), plan.SetVariables)
	require.NoError(t, err)
	assert.Equal(t, map[string]string{"output": "output-value"}, setVariables)
	mockCluster.AssertNotCalled(t, "NewWithWait", mock.Anything)
	mockPackager.AssertExpectations(t)
	mockPackageComponentFilter.AssertExpectations(t)
}

func TestPackageResource_CreateRecoveryPreservesState(t *testing.T) {
	tests := []struct {
		name                 string
		deployError          error
		writePackageState    bool
		waitForDeployTimeout bool
		refreshError         error
		recoveryError        error
		expectState          bool
		digest               string
		generation           int
		createTimeout        string
		expectedErrors       []string
	}{
		{
			name:                 "deployment failure recovers package state",
			deployError:          errors.New("deployment failed"),
			writePackageState:    true,
			waitForDeployTimeout: true,
			expectState:          true,
			digest:               "sha256:failed",
			generation:           4,
			createTimeout:        "50ms",
			expectedErrors:       []string{"deployment failed"},
		},
		{
			name:              "post-deployment refresh failure recovers package state",
			refreshError:      errors.New("context deadline exceeded"),
			writePackageState: true,
			expectState:       true,
			digest:            "sha256:recovered",
			generation:        5,
			expectedErrors:    []string{"could not retrieve the deployed package from the cluster"},
		},
		{
			name:           "deployment failure without package state",
			deployError:    errors.New("deployment failed"),
			expectedErrors: []string{"deployment failed"},
		},
		{
			name:           "deployment failure with recovery query error",
			deployError:    errors.New("deployment failed"),
			recoveryError:  errors.New("state query failed"),
			expectedErrors: []string{"deployment failed", "could not retrieve the deployed package from the cluster"},
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			packageLayout := newValidLoadPackageResult().Layout
			deployedPackage := newLifecycleDeployedPackage(packageLayout,
				zarfState.DeployedComponent{Name: "test-required-component-0", Status: zarfState.ComponentStatusFailed},
			)
			deployedPackage.Digest = tc.digest
			deployedPackage.Generation = tc.generation

			emptyCluster := newFakeCluster()
			recoveryClientset := fake.NewSimpleClientset()
			recoveryCluster := &zarfCluster.Cluster{Clientset: recoveryClientset}
			mockCluster := &MockCluster{}
			mockCluster.On("NewWithWait", mock.Anything).Return(emptyCluster, nil).Once()
			if tc.refreshError != nil {
				mockCluster.On("NewWithWait", mock.Anything).Return(&zarfCluster.Cluster{}, tc.refreshError).Once()
			}
			recoveryResult := recoveryCluster
			if tc.recoveryError != nil {
				recoveryResult = &zarfCluster.Cluster{}
			}
			mockCluster.On("NewWithWait", mock.Anything).
				Run(func(args mock.Arguments) {
					recoveryCtx := args.Get(0).(context.Context)
					assert.NoError(t, recoveryCtx.Err(), "recovery must not reuse the expired Create context")
				}).
				Return(recoveryResult, tc.recoveryError).
				Once()

			mockPackager := &MockPackager{}
			mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil).Once()
			deployCall := mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, tc.deployError).Once()
			if tc.writePackageState {
				deployCall.Run(func(args mock.Arguments) {
					if tc.waitForDeployTimeout {
						// Simulate Zarf persisting failed package state after the deployment
						// context expires but before the recovery lookup.
						<-args.Get(0).(context.Context).Done()
					}
					_, err := recoveryCluster.Clientset.CoreV1().Secrets(zarfState.ZarfNamespaceName).Create(
						context.Background(),
						newPackageStateSecret(t, deployedPackage),
						metav1.CreateOptions{},
					)
					require.NoError(t, err)
				})
			}
			mockPackageComponentFilter := &MockPackageComponentFilter{}
			mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything).Once()

			packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, mockCluster).(*PackageResource)
			options := []PackageResourceModelDataOption{WithArchitecture("arm64")}
			if tc.createTimeout != "" {
				options = append(options, WithCreateTimeout(tc.createTimeout))
			}
			planModel := newCreateLifecycleModel(options...)
			planModel.SetVariables = types.MapUnknown(types.StringType)

			resp := runCreateLifecycleTest(t, packageResource, planModel)

			require.True(t, resp.Diagnostics.HasError())
			var diagnosticDetails []string
			for _, diagnostic := range resp.Diagnostics.Errors() {
				diagnosticDetails = append(diagnosticDetails, diagnostic.Detail())
			}
			for _, expectedError := range tc.expectedErrors {
				assert.Contains(t, strings.Join(diagnosticDetails, "\n"), expectedError)
			}

			if !tc.expectState {
				assertNoPackageState(t, resp.State)
				return
			}
			state := requirePackageState(t, resp.State)
			assert.Equal(t, computePackageID("", "test-package"), state.ID.ValueString())
			assert.Equal(t, "amd64", state.Architecture.ValueString())
			assertPackageMetadata(t, state.Metadata, "Failed", int64(tc.generation), tc.digest)
			assert.Equal(t, types.MapValueMust(types.StringType, map[string]attr.Value{}), state.SetVariables)
		})
	}
}

func TestPackageResource_CreateSuccessfulDeploymentRefreshesState(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout
	deployedPackage := newLifecycleDeployedPackage(packageLayout,
		zarfState.DeployedComponent{Name: "test-required-component-0", Status: zarfState.ComponentStatusSucceeded},
		zarfState.DeployedComponent{Name: "test-optional-non-default-component-0", Status: zarfState.ComponentStatusSucceeded},
	)
	deployedPackage.Digest = "sha256:created"
	deployedPackage.Generation = 8
	clientset := fake.NewSimpleClientset()
	mockCluster := &MockCluster{}
	mockCluster.On("NewWithWait", mock.Anything).Return(&zarfCluster.Cluster{Clientset: clientset}, nil).Twice()
	mockPackager := &MockPackager{}
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil).Twice()
	mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Run(func(_ mock.Arguments) {
		_, err := clientset.CoreV1().Secrets(zarfState.ZarfNamespaceName).Create(
			context.Background(),
			newPackageStateSecret(t, deployedPackage),
			metav1.CreateOptions{},
		)
		require.NoError(t, err)
	}).Return(packager.DeployResult{DeployedComponents: []zarfState.DeployedComponent{
		{Name: "test-required-component-0"},
		{Name: "test-optional-default-component-0"},
	}}, nil)
	mockPackageComponentFilter := &MockPackageComponentFilter{}
	mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, mockCluster).(*PackageResource)
	// Conflict with the cluster values above to prove known planned values win.
	planModel := newCreateLifecycleModel(
		WithArchitecture("arm64"),
		WithOptionalComponents([]string{"test-optional-default-component-0"}),
	)

	resp := runCreateLifecycleTest(t, packageResource, planModel)

	require.False(t, resp.Diagnostics.HasError(), "create diagnostics: %v", resp.Diagnostics)
	state := requirePackageState(t, resp.State)
	assert.Equal(t, "arm64", state.Architecture.ValueString())
	assert.Equal(t, []string{"test-optional-default-component-0"}, mustStringSetElements(t, state.OptionalComponents))
	assertPackageMetadata(t, state.Metadata, "Succeeded", 8, "sha256:created")
}

func TestPackageResource_CreatePreflightFailureDoesNotDeployOrPersistState(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout
	mockCluster := &MockCluster{}
	mockCluster.On("NewWithWait", mock.Anything).Return(&zarfCluster.Cluster{}, errors.New("state query failed")).Once()
	mockPackager := &MockPackager{}
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil).Once()
	mockPackageComponentFilter := &MockPackageComponentFilter{}

	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, mockCluster).(*PackageResource)

	resp := runCreateLifecycleTest(t, packageResource, newCreateLifecycleModel())

	require.True(t, resp.Diagnostics.HasError())
	assert.Contains(t, resp.Diagnostics.Errors()[0].Detail(), "failed to check for existing package")
	assertNoPackageState(t, resp.State)
	mockPackager.AssertNotCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
}

func TestPackageResource_CreateSignatureFailureDoesNotAdoptExistingPackage(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout
	packageLayout.PackageDefinition.SetBuildSigned(true)
	existingPackage := newLifecycleDeployedPackage(packageLayout)
	cluster := &zarfCluster.Cluster{
		Clientset: fake.NewSimpleClientset(newPackageStateSecret(t, existingPackage)),
	}
	mockCluster := &MockCluster{}
	mockCluster.On("NewWithWait", mock.Anything).Return(cluster, nil).Maybe()
	mockPackager := &MockPackager{}
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil).Once()
	mockPackageComponentFilter := &MockPackageComponentFilter{}

	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, mockCluster).(*PackageResource)
	packageResource.verifyPackageSignatureFunc = func(context.Context, *layout.PackageLayout, zarfSigning.VerifyBlobOptions) error {
		return errors.New("signature verification failed")
	}

	resp := runCreateLifecycleTest(t, packageResource, newCreateLifecycleModel(WithSignatureVerificationEnabled(true)))

	require.True(t, resp.Diagnostics.HasError())
	assert.Contains(t, resp.Diagnostics.Errors()[0].Detail(), "signature verification failed")
	assertNoPackageState(t, resp.State)
	mockCluster.AssertNotCalled(t, "NewWithWait", mock.Anything)
	mockPackager.AssertNotCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
}

func TestPackageResource_UpsertLoadedPackagePreDeploymentFailureIsNotMarkedAsAttempted(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout
	mockPackager := &MockPackager{}
	packageResource := NewPackageResource(nil, mockPackager, nil, nil).(*PackageResource)
	plan := newCreateLifecycleModel()
	plan.Values = types.DynamicUnknown()

	_, err := packageResource.upsertLoadedPackage(testCtx(t), plan, packageLayout)

	require.ErrorContains(t, err, "values must be known")
	var deploymentErr *deploymentAttemptedError
	assert.False(t, errors.As(err, &deploymentErr))
	mockPackager.AssertNotCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
}

func TestPackageResource_CreateSuccessfulDeploymentWithoutStateSecretRetainsFallbackMetadata(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout
	mockCluster := &MockCluster{}
	mockCluster.On("NewWithWait", mock.Anything).Return(newFakeCluster(), nil).Twice()
	mockPackager := &MockPackager{}
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil).Once()
	mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil).Once()
	mockPackageComponentFilter := &MockPackageComponentFilter{}
	mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything).Once()

	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, mockCluster).(*PackageResource)

	resp := runCreateLifecycleTest(t, packageResource, newCreateLifecycleModel())

	require.False(t, resp.Diagnostics.HasError(), "create diagnostics: %v", resp.Diagnostics)
	state := requirePackageState(t, resp.State)
	metadata := state.Metadata.Attributes()
	assert.Equal(t, packageLayout.AsV1alpha1().Metadata.Name, metadata["name"].(types.String).ValueString())
	assert.Equal(t, packageLayout.AsV1alpha1().Metadata.Description, metadata["description"].(types.String).ValueString())
	assert.Equal(t, packageLayout.AsV1alpha1().Metadata.Version, metadata["version"].(types.String).ValueString())
	assertPackageMetadata(t, state.Metadata, "Succeeded", 0, packageLayout.Digest())
}

func TestPackageResource_CreateDoesNotPersistInconsistentRefreshedOrRecoveredIdentity(t *testing.T) {
	tests := []struct {
		name        string
		deployError error
		mutate      func(*zarfState.DeployedPackage)
	}{
		{name: "refreshed name mismatch", mutate: func(pkg *zarfState.DeployedPackage) { pkg.Name = "other" }},
		{name: "refreshed namespace mismatch", mutate: func(pkg *zarfState.DeployedPackage) { pkg.NamespaceOverride = "other" }},
		{name: "refreshed metadata name mismatch", mutate: func(pkg *zarfState.DeployedPackage) { pkg.Data.Metadata.Name = "other" }},
		{name: "recovered name mismatch", deployError: errors.New("deployment failed"), mutate: func(pkg *zarfState.DeployedPackage) { pkg.Name = "other" }},
		{name: "recovered namespace mismatch", deployError: errors.New("deployment failed"), mutate: func(pkg *zarfState.DeployedPackage) { pkg.NamespaceOverride = "other" }},
		{name: "recovered metadata name mismatch", deployError: errors.New("deployment failed"), mutate: func(pkg *zarfState.DeployedPackage) { pkg.Data.Metadata.Name = "other" }},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			packageLayout := newValidLoadPackageResult().Layout
			expectedPackage := newLifecycleDeployedPackage(packageLayout)
			inconsistentPackage := expectedPackage
			tc.mutate(&inconsistentPackage)
			secret := newPackageStateSecret(t, inconsistentPackage)
			secret.Name = expectedPackage.GetSecretName()
			inconsistentCluster := &zarfCluster.Cluster{Clientset: fake.NewSimpleClientset(secret)}

			cluster := &MockCluster{}
			cluster.On("NewWithWait", mock.Anything).Return(newFakeCluster(), nil).Once()
			cluster.On("NewWithWait", mock.Anything).Return(inconsistentCluster, nil).Once()
			if tc.deployError == nil {
				cluster.On("NewWithWait", mock.Anything).Return(inconsistentCluster, nil).Once()
			}
			mockPackager := &MockPackager{}
			mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil).Once()
			mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, tc.deployError).Once()
			filter := &MockPackageComponentFilter{}
			filter.On("ForDeploy", mock.Anything).Return(mock.Anything).Once()
			packageResource := NewPackageResource(nil, mockPackager, filter, cluster).(*PackageResource)

			resp := runCreateLifecycleTest(t, packageResource, newCreateLifecycleModel())

			require.True(t, resp.Diagnostics.HasError())
			details := make([]string, 0, len(resp.Diagnostics.Errors()))
			for _, diagnostic := range resp.Diagnostics.Errors() {
				details = append(details, diagnostic.Detail())
			}
			assert.Contains(t, strings.Join(details, "\n"), "identity recorded in state")
			assertNoPackageState(t, resp.State)
			mockPackager.AssertExpectations(t)
		})
	}
}

func TestPackageResource_UpdateWithoutStateSecretIsBlocked(t *testing.T) {
	mockCluster := &MockCluster{}
	mockCluster.On("NewWithWait", mock.Anything).Return(newFakeCluster(), nil).Once()
	mockPackager := &MockPackager{}
	mockPackageComponentFilter := &MockPackageComponentFilter{}

	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, mockCluster).(*PackageResource)
	stateModel := NewTestPackageResourceModel(WithTimeout("30m"), WithDeployedState())
	planModel := stateModel
	planModel.Source = types.StringValue("oci://ghcr.io/defenseunicorns/packages/test:updated")

	resp := runUpdateLifecycleTest(t, packageResource, planModel, stateModel)

	require.True(t, resp.Diagnostics.HasError())
	assert.Contains(t, resp.Diagnostics.Errors()[0].Detail(), "no longer exists")
	mockPackager.AssertNotCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
	mockPackager.AssertNotCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
}

func TestPackageResource_UpdateRejectsAliasBeforeMutation(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout
	alias := zarfState.DeployedPackage{
		Name: "test-package-alias",
		Data: v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{
			Name: "test-package-alias",
		}},
	}
	cluster := &MockCluster{}
	cluster.On("NewWithWait", mock.Anything).Return(&zarfCluster.Cluster{
		Clientset: fake.NewSimpleClientset(newPackageStateSecret(t, alias)),
	}, nil).Once()
	packager := &MockPackager{}
	packager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil).Once()
	filter := &MockPackageComponentFilter{}
	resource := NewPackageResource(nil, packager, filter, cluster).(*PackageResource)

	stateModel := NewTestPackageResourceModel(WithTimeout("30m"), WithDeployedState())
	stateModel.ID = types.StringValue(alias.Name)
	stateModel.Name = types.StringValue(alias.Name)
	planModel := stateModel
	planModel.Source = types.StringValue("oci://ghcr.io/defenseunicorns/packages/test:updated")

	resp := runUpdateLifecycleTest(t, resource, planModel, stateModel)

	require.True(t, resp.Diagnostics.HasError())
	assert.Equal(t, "Cannot manage package with non-canonical deployment name", resp.Diagnostics.Errors()[0].Summary())
	assert.Contains(t, resp.Diagnostics.Errors()[0].Detail(), "test-package-alias")
	assert.Contains(t, resp.Diagnostics.Errors()[0].Detail(), "test-package")
	assert.Contains(t, resp.Diagnostics.Errors()[0].Detail(), "tofu state rm")
	assert.True(t, resp.State.Raw.IsNull(), "Update must not write partial state on rejection")
	packager.AssertNotCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
	packager.AssertNotCalled(t, "Remove", mock.Anything, mock.Anything, mock.Anything)
	filter.AssertNotCalled(t, "ForDeploy", mock.Anything)
	filter.AssertNotCalled(t, "ForRemove", mock.Anything)
}

func TestPackageResource_UpdateIdentityAndSourceFailuresBlockAllMutations(t *testing.T) {
	canonical := zarfState.DeployedPackage{
		Name: "test-pkg",
		Data: v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-pkg"}},
	}
	tests := []struct {
		name       string
		pkg        *zarfState.DeployedPackage
		clusterErr error
		loadErr    error
	}{
		{name: "returned name mismatch", pkg: func() *zarfState.DeployedPackage { p := canonical; p.Name = "other"; return &p }()},
		{name: "returned namespace mismatch", pkg: func() *zarfState.DeployedPackage { p := canonical; p.NamespaceOverride = "other"; return &p }()},
		{name: "returned metadata mismatch", pkg: func() *zarfState.DeployedPackage { p := canonical; p.Data.Metadata.Name = "other"; return &p }()},
		{name: "cluster lookup failure", clusterErr: errors.New("sentinel-cluster-secret")},
		{name: "source inspection failure", pkg: &canonical, loadErr: errors.New("sentinel-source-secret")},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			clientset := fake.NewSimpleClientset()
			if tc.pkg != nil {
				secret := newPackageStateSecret(t, *tc.pkg)
				secret.Name = canonical.GetSecretName()
				clientset = fake.NewSimpleClientset(secret)
			}
			cluster := &MockCluster{}
			if tc.clusterErr != nil {
				cluster.On("NewWithWait", mock.Anything).Return((*zarfCluster.Cluster)(nil), tc.clusterErr).Once()
			} else {
				cluster.On("NewWithWait", mock.Anything).Return(&zarfCluster.Cluster{Clientset: clientset}, nil).Once()
			}
			packager := &MockPackager{}
			if tc.loadErr != nil {
				packager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return((*layout.PackageLayout)(nil), tc.loadErr).Once()
			}
			filter := &MockPackageComponentFilter{}
			packageResource := NewPackageResource(nil, packager, filter, cluster).(*PackageResource)
			stateModel := NewTestPackageResourceModel(
				WithTimeout("30m"),
				WithDeployedState(),
				WithComponents(NewComponentModelsFromNames([]string{"legacy"})),
				WithOptionalComponents([]string{"optional"}),
			)
			planModel := stateModel
			planModel.Source = types.StringValue("oci://ghcr.io/defenseunicorns/packages/test:updated")
			WithComponents(NewComponentModelsFromNames(nil))(&planModel)
			WithOptionalComponents([]string{})(&planModel)

			resp := runUpdateLifecycleTest(t, packageResource, planModel, stateModel)

			require.True(t, resp.Diagnostics.HasError())
			assert.True(t, resp.State.Raw.IsNull(), "Update must retain prior state by not writing response state")
			detail := resp.Diagnostics.Errors()[0].Detail()
			assert.NotContains(t, detail, "sentinel-cluster-secret")
			assert.NotContains(t, detail, "sentinel-source-secret")
			filter.AssertNotCalled(t, "ForRemove", mock.Anything)
			filter.AssertNotCalled(t, "ForDeploy", mock.Anything)
			packager.AssertNotCalled(t, "GetPackageFromSourceOrCluster", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything)
			packager.AssertNotCalled(t, "Remove", mock.Anything, mock.Anything, mock.Anything)
			packager.AssertNotCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
		})
	}
}

func TestPackageResource_UpdateRejectsCanonicalNameChangedBeforeDeploy(t *testing.T) {
	canonicalLayout := &layout.PackageLayout{PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{
		Metadata: v1alpha1.ZarfMetadata{Name: "test-pkg"},
	})}
	changedLayout := &layout.PackageLayout{PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{
		Metadata: v1alpha1.ZarfMetadata{Name: "changed-name"},
	})}
	deployed := zarfState.DeployedPackage{
		Name: "test-pkg",
		Data: v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-pkg"}},
	}
	cluster := &MockCluster{}
	cluster.On("NewWithWait", mock.Anything).Return(&zarfCluster.Cluster{
		Clientset: fake.NewSimpleClientset(newPackageStateSecret(t, deployed)),
	}, nil).Once()
	packager := &MockPackager{}
	packager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(canonicalLayout, nil).Once()
	packager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(changedLayout, nil).Once()
	filter := &MockPackageComponentFilter{}
	packageResource := NewPackageResource(nil, packager, filter, cluster).(*PackageResource)
	stateModel := NewTestPackageResourceModel(WithTimeout("30m"), WithDeployedState())
	planModel := stateModel
	planModel.Source = types.StringValue("oci://ghcr.io/defenseunicorns/packages/test:updated")

	resp := runUpdateLifecycleTest(t, packageResource, planModel, stateModel)

	require.True(t, resp.Diagnostics.HasError())
	assert.Equal(t, "Cannot manage package with non-canonical deployment name", resp.Diagnostics.Errors()[0].Summary())
	assert.Contains(t, resp.Diagnostics.Errors()[0].Detail(), "changed-name")
	assert.True(t, resp.State.Raw.IsNull(), "Update must not rewrite state after a late canonical-name mismatch")
	packager.AssertNotCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
	packager.AssertNotCalled(t, "Remove", mock.Anything, mock.Anything, mock.Anything)
	filter.AssertNotCalled(t, "ForDeploy", mock.Anything)
}

func TestPackageResource_CreateDuplicatePackageDoesNotAdoptState(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout
	deployedPackage := newLifecycleDeployedPackage(packageLayout)
	cluster := &zarfCluster.Cluster{
		Clientset: fake.NewSimpleClientset(newPackageStateSecret(t, deployedPackage)),
	}
	mockCluster := &MockCluster{}
	mockCluster.On("NewWithWait", mock.Anything).Return(cluster, nil).Once()
	mockPackager := &MockPackager{}
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil).Twice()
	mockPackageComponentFilter := &MockPackageComponentFilter{}

	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, mockCluster).(*PackageResource)

	resp := runCreateLifecycleTest(t, packageResource, newCreateLifecycleModel())

	require.Len(t, resp.Diagnostics.Errors(), 1)
	assert.Contains(t, resp.Diagnostics.Errors()[0].Detail(), "already exists")
	assertNoPackageState(t, resp.State)
	mockPackager.AssertNotCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
	mockPackager.AssertNotCalled(t, "Remove", mock.Anything, mock.Anything, mock.Anything)
}

func TestPackageResource_Upsert_OptionalComponentInstallation(t *testing.T) {
	tests := []struct {
		name                                      string
		componentNames                            []string
		expectedCallToDeploy                      bool
		expectedOptionalComponentsForDeployFilter []string
		expectedErrorContains                     []string
	}{
		{
			name:                 "package without components deploys required components only",
			componentNames:       []string{},
			expectedCallToDeploy: true,
			expectedOptionalComponentsForDeployFilter: []string{},
			expectedErrorContains:                     []string{},
		},
		{
			name: "package with only required components deploys required components only",
			componentNames: []string{
				"test-required-component-0",
				"test-required-component-1",
			},
			expectedCallToDeploy:                      true,
			expectedOptionalComponentsForDeployFilter: []string{},
			expectedErrorContains:                     []string{},
		},
		{
			name: "package with only optional components deploys each optional component",
			componentNames: []string{
				"test-optional-default-component-0",
				"test-optional-non-default-component-0",
			},
			expectedCallToDeploy:                      true,
			expectedOptionalComponentsForDeployFilter: []string{"test-optional-default-component-0", "test-optional-non-default-component-0"},
			expectedErrorContains:                     []string{},
		},
		{
			name: "package with required and optional components deploys each optional component",
			componentNames: []string{
				"test-required-component-0",
				"test-required-component-1",
				"test-optional-default-component-0",
				"test-optional-non-default-component-0",
			},
			expectedCallToDeploy: true,
			expectedOptionalComponentsForDeployFilter: []string{
				"test-optional-default-component-0",
				"test-optional-non-default-component-0",
			},
			expectedErrorContains: []string{},
		},
		{
			name: "package with unknown components returns error for each unknown component",
			componentNames: []string{
				"test-unknown-component-0",
				"test-unknown-component-1",
			},
			expectedCallToDeploy:                      false,
			expectedOptionalComponentsForDeployFilter: []string{},
			expectedErrorContains: []string{
				"unknown package component test-unknown-component-0",
				"unknown package component test-unknown-component-1",
			},
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			mockPackager := &MockPackager{}
			mockPackageComponentFilter := &MockPackageComponentFilter{}

			validLoadPackageResult := newValidLoadPackageResult()
			mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(
				validLoadPackageResult.Layout,
				validLoadPackageResult.Error,
			)
			if tc.expectedCallToDeploy {
				mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)
				mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)
			}

			packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)
			componentModels := NewComponentModelsFromNames(tc.componentNames)
			testModel := NewTestPackageResourceModel(
				WithComponents(componentModels),
			)
			expectErrors := len(tc.expectedErrorContains) > 0

			_, err := packageResource.upsert(testCtx(t), testModel)

			if expectErrors {
				assert.NotNil(t, err, "Expected error, got none")
				for _, expectedErrorMsg := range tc.expectedErrorContains {
					assert.Contains(t, err.Error(), expectedErrorMsg, "Expected error to contain %q, but got: %v", expectedErrorMsg, err.Error())
				}
			} else {
				assert.Nil(t, err, "Expected no error, got %v", err)
			}
			mockPackager.AssertExpectations(t)
			mockPackageComponentFilter.AssertExpectations(t)

			// Check that ForDeploy was called with expected optional components
			var actualOptionalComponents []string
			for _, call := range mockPackageComponentFilter.Calls {
				if call.Method == "ForDeploy" && len(call.Arguments) > 0 {
					actualOptionalComponents = call.Arguments[0].([]string)
				}
			}
			assert.ElementsMatch(t, tc.expectedOptionalComponentsForDeployFilter, actualOptionalComponents,
				fmt.Sprintf("Optional components selected for deploy do not match: expected: %v, actual: %v", tc.expectedOptionalComponentsForDeployFilter, actualOptionalComponents))
		})
	}
}

func TestGetComponentBlockOptionalComponentsForDeploy_ReturnsDecodeError(t *testing.T) {
	_, err := getComponentBlockOptionalComponentsForDeploy(context.Background(), malformedComponentSet(), []v1alpha1.ZarfComponent{})

	require.Error(t, err)
	assert.Contains(t, err.Error(), "failed to read component blocks")
}

func TestPackageResource_Upsert_ComponentOverrides(t *testing.T) {
	tests := []struct {
		name                    string
		components              []ComponentModel
		expectedValuesOverrides map[string]map[string]map[string]any
		expectedCallToDeploy    bool
		expectedErrorContains   string
	}{
		{
			name:                    "package without component overrides deploys with empty values overrides map",
			components:              []ComponentModel{},
			expectedValuesOverrides: map[string]map[string]map[string]any{},
			expectedCallToDeploy:    true,
			expectedErrorContains:   "",
		},
		{
			name: "package with single required component overrides deploys with single component overrides map",
			components: []ComponentModel{
				NewTestComponentModel(
					"test-required-component-0",
					WithComponentOverrides([]ComponentChartValuesModel{
						NewTestComponentChartValuesModel(
							"chart1",
							WithComponentChartValues([]HelmChartPathValueModel{
								{Path: types.StringValue("replicaCount"), Value: types.StringValue("3")},
								{Path: types.StringValue("ui.color"), Value: types.StringValue("blue")},
							}),
							WithComponentChartSensitiveValues([]HelmChartPathValueModel{
								{Path: types.StringValue("apiKey"), Value: types.StringValue("secret123")},
							}),
						),
					}),
				),
			},
			expectedValuesOverrides: map[string]map[string]map[string]any{
				"test-required-component-0": {
					"chart1": {
						"replicaCount": 3,
						"ui": map[string]any{
							"color": "blue",
						},
						"apiKey": "secret123",
					},
				},
			},
			expectedCallToDeploy:  true,
			expectedErrorContains: "",
		},
		{
			name: "package with single optional component overrides deploys with single component overrides map",
			components: []ComponentModel{
				NewTestComponentModel(
					"test-optional-default-component-0",
					WithComponentOverrides([]ComponentChartValuesModel{
						NewTestComponentChartValuesModel(
							"chart1",
							WithComponentChartValues([]HelmChartPathValueModel{
								{Path: types.StringValue("replicaCount"), Value: types.StringValue("3")},
								{Path: types.StringValue("ui.color"), Value: types.StringValue("blue")},
							}),
							WithComponentChartSensitiveValues([]HelmChartPathValueModel{
								{Path: types.StringValue("apiKey"), Value: types.StringValue("secret123")},
							}),
						),
					}),
				),
			},
			expectedValuesOverrides: map[string]map[string]map[string]any{
				"test-optional-default-component-0": {
					"chart1": {
						"replicaCount": 3,
						"ui": map[string]any{
							"color": "blue",
						},
						"apiKey": "secret123",
					},
				},
			},
			expectedCallToDeploy:  true,
			expectedErrorContains: "",
		},
		{
			name: "package with multiple components and charts passes overrides deploys with all components overrides map",
			components: []ComponentModel{
				NewTestComponentModel(
					"test-required-component-0",
					WithComponentOverrides([]ComponentChartValuesModel{
						NewTestComponentChartValuesModel(
							"chart1",
							WithComponentChartValues([]HelmChartPathValueModel{
								{Path: types.StringValue("replicaCount"), Value: types.StringValue("3")},
								{Path: types.StringValue("ui.color"), Value: types.StringValue("blue")},
							}),
							WithComponentChartSensitiveValues([]HelmChartPathValueModel{
								{Path: types.StringValue("apiKey"), Value: types.StringValue("secret123")},
							}),
						),
					}),
				),
				NewTestComponentModel(
					"test-optional-default-component-0",
					WithComponentOverrides([]ComponentChartValuesModel{
						NewTestComponentChartValuesModel(
							"chart1",
							WithComponentChartValues([]HelmChartPathValueModel{
								{Path: types.StringValue("replicaCount"), Value: types.StringValue("2")},
							}),
						),
						NewTestComponentChartValuesModel(
							"chart2",
							WithComponentChartValues([]HelmChartPathValueModel{
								{Path: types.StringValue("service.port"), Value: types.StringValue("\"8080\"")},
							}),
						),
					}),
				),
				NewTestComponentModel(
					"test-optional-non-default-component-0",
					WithComponentOverrides([]ComponentChartValuesModel{
						NewTestComponentChartValuesModel(
							"chart3",
							WithComponentChartValues([]HelmChartPathValueModel{
								{Path: types.StringValue("image.tag"), Value: types.StringValue("v2.0.0")},
							}),
						),
					}),
				),
			},
			expectedValuesOverrides: map[string]map[string]map[string]any{
				"test-required-component-0": {
					"chart1": {
						"replicaCount": 3,
						"ui": map[string]any{
							"color": "blue",
						},
						"apiKey": "secret123",
					},
				},
				"test-optional-default-component-0": {
					"chart1": {
						"replicaCount": 2,
					},
					"chart2": {
						"service": map[string]any{
							"port": "8080",
						},
					},
				},
				"test-optional-non-default-component-0": {
					"chart3": {
						"image": map[string]any{
							"tag": "v2.0.0",
						},
					},
				},
			},
			expectedCallToDeploy:  true,
			expectedErrorContains: "",
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			mockPackager := &MockPackager{}
			mockPackageComponentFilter := &MockPackageComponentFilter{}

			validLoadPackageResult := newValidLoadPackageResult()
			mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(
				validLoadPackageResult.Layout,
				validLoadPackageResult.Error,
			)

			if tc.expectedCallToDeploy {
				mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)
				mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)
			}

			packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)
			testModel := NewTestPackageResourceModel(
				WithComponents(tc.components),
			)

			_, err := packageResource.upsert(testCtx(t), testModel)

			if tc.expectedErrorContains != "" {
				assert.NotNil(t, err, "Expected error, got none")
				assert.Contains(t, err.Error(), tc.expectedErrorContains, "Expected error to contain %q, but got: %v", tc.expectedErrorContains, err.Error())
			} else {
				assert.Nil(t, err, "Expected no error, got %v", err)
			}

			mockPackager.AssertExpectations(t)
			mockPackageComponentFilter.AssertExpectations(t)

			// Verify that Deploy was called with the expected ValuesOverridesMap
			if tc.expectedCallToDeploy {
				var actualValuesOverrides map[string]map[string]map[string]any
				for _, call := range mockPackager.Calls {
					if call.Method == "Deploy" && len(call.Arguments) >= 3 {
						deployOpts := call.Arguments[2].(zarfPackager.DeployOptions)
						actualValuesOverrides = deployOpts.ValuesOverridesMap
					}
				}
				assert.Equal(t, tc.expectedValuesOverrides, actualValuesOverrides,
					"ValuesOverridesMap passed to Deploy does not match expected")
			}
		})
	}
}

func TestPackageResource_Upsert_ComponentOverrides_ReturnsDecodeError(t *testing.T) {
	mockPackager := &MockPackager{}
	mockPackageComponentFilter := &MockPackageComponentFilter{}

	validLoadPackageResult := newValidLoadPackageResult()
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(
		validLoadPackageResult.Layout,
		validLoadPackageResult.Error,
	)

	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)
	testModel := NewTestPackageResourceModel(WithOptionalComponents([]string{}))
	testModel.Components = malformedComponentSet()

	_, err := packageResource.upsert(testCtx(t), testModel)

	require.Error(t, err)
	assert.Contains(t, err.Error(), "failed to read component blocks")
	mockPackager.AssertExpectations(t)
	mockPackageComponentFilter.AssertExpectations(t)
}

func TestPackageResource_Upsert_Values(t *testing.T) {
	tests := []struct {
		name             string
		values           types.Dynamic
		sensitiveValues  types.Dynamic
		expectedValues   zarfValue.Values
		expectedErrorMsg string
	}{
		{
			name:           "package without values deploys with empty values",
			expectedValues: zarfValue.Values{},
		},
		{
			name: "package with values passes deploy values",
			values: types.DynamicValue(types.ObjectValueMust(
				map[string]attr.Type{
					"pod": types.ObjectType{AttrTypes: map[string]attr.Type{
						"replicaCount": types.NumberType,
					}},
					"logLevel": types.StringType,
				},
				map[string]attr.Value{
					"pod": types.ObjectValueMust(
						map[string]attr.Type{"replicaCount": types.NumberType},
						map[string]attr.Value{"replicaCount": types.NumberValue(big.NewFloat(3))},
					),
					"logLevel": types.StringValue("info"),
				},
			)),
			expectedValues: zarfValue.Values{
				"pod":      map[string]any{"replicaCount": int64(3)},
				"logLevel": "info",
			},
		},
		{
			name: "package with sensitive values deep merges deploy values",
			values: types.DynamicValue(types.ObjectValueMust(
				map[string]attr.Type{
					"db": types.ObjectType{AttrTypes: map[string]attr.Type{
						"hostname": types.StringType,
					}},
				},
				map[string]attr.Value{
					"db": types.ObjectValueMust(
						map[string]attr.Type{"hostname": types.StringType},
						map[string]attr.Value{"hostname": types.StringValue("postgres")},
					),
				},
			)),
			sensitiveValues: types.DynamicValue(types.ObjectValueMust(
				map[string]attr.Type{
					"db": types.ObjectType{AttrTypes: map[string]attr.Type{
						"password": types.StringType,
					}},
				},
				map[string]attr.Value{
					"db": types.ObjectValueMust(
						map[string]attr.Type{"password": types.StringType},
						map[string]attr.Value{"password": types.StringValue("secret")},
					),
				},
			)),
			expectedValues: zarfValue.Values{
				"db": map[string]any{
					"hostname": "postgres",
					"password": "secret",
				},
			},
		},
		{
			name: "package with conflicting sensitive values returns error",
			values: types.DynamicValue(types.ObjectValueMust(
				map[string]attr.Type{
					"db": types.ObjectType{AttrTypes: map[string]attr.Type{
						"password": types.StringType,
					}},
				},
				map[string]attr.Value{
					"db": types.ObjectValueMust(
						map[string]attr.Type{"password": types.StringType},
						map[string]attr.Value{"password": types.StringValue("plain")},
					),
				},
			)),
			sensitiveValues: types.DynamicValue(types.ObjectValueMust(
				map[string]attr.Type{
					"db": types.ObjectType{AttrTypes: map[string]attr.Type{
						"password": types.StringType,
					}},
				},
				map[string]attr.Value{
					"db": types.ObjectValueMust(
						map[string]attr.Type{"password": types.StringType},
						map[string]attr.Value{"password": types.StringValue("secret")},
					),
				},
			)),
			expectedErrorMsg: "db.password",
		},
		{
			name:             "package with root unknown values returns error",
			values:           types.DynamicUnknown(),
			expectedErrorMsg: "invalid package values for apply: values must be known",
		},
		{
			name:             "package with root unknown sensitive values returns error",
			sensitiveValues:  types.DynamicUnknown(),
			expectedErrorMsg: "invalid sensitive package values for apply: sensitive_values must be known",
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			mockPackager := &MockPackager{}
			mockPackageComponentFilter := &MockPackageComponentFilter{}

			validLoadPackageResult := newValidLoadPackageResult()
			mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(
				validLoadPackageResult.Layout,
				validLoadPackageResult.Error,
			)

			if tc.expectedErrorMsg == "" {
				mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)
			}
			mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

			packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)
			testModel := NewTestPackageResourceModel(
				WithValues(tc.values),
				WithSensitiveValues(tc.sensitiveValues),
			)

			_, err := packageResource.upsert(testCtx(t), testModel)

			if tc.expectedErrorMsg != "" {
				assert.Error(t, err)
				assert.Contains(t, err.Error(), tc.expectedErrorMsg)
				return
			}

			assert.NoError(t, err)
			mockPackager.AssertExpectations(t)
			mockPackageComponentFilter.AssertExpectations(t)

			var actualValues zarfValue.Values
			for _, call := range mockPackager.Calls {
				if call.Method == "Deploy" && len(call.Arguments) >= 3 {
					deployOpts := call.Arguments[2].(zarfPackager.DeployOptions)
					actualValues = deployOpts.Values
				}
			}
			assert.Equal(t, tc.expectedValues, actualValues)
		})
	}
}

func TestPackageResource_Upsert_SourceAttribute(t *testing.T) {
	tests := []struct {
		name                      string
		source                    string
		localFilePathExists       bool
		expectedCallToLoadPackage bool
		expectedCallToDeploy      bool
		expectedErrorContains     string
	}{
		{
			name:                      "OCI distribution source with oci:// scheme loads specified source",
			source:                    "oci://ghcr.io/defenseunicornstest/packages/test-package:v1.0.0",
			localFilePathExists:       true,
			expectedCallToLoadPackage: true,
			expectedCallToDeploy:      true,
			expectedErrorContains:     "",
		},
		{
			name:                      "existent local absolute file path loads specified source",
			source:                    "/tmp/absolute/path/to/existenttest-package.tar.zst",
			localFilePathExists:       true,
			expectedCallToLoadPackage: true,
			expectedCallToDeploy:      true,
			expectedErrorContains:     "",
		},
		{
			name:                      "existent local relative file path loads specified source",
			source:                    "./relative/path/to/existenttest-package.tar.zst",
			localFilePathExists:       true,
			expectedCallToLoadPackage: true,
			expectedCallToDeploy:      true,
			expectedErrorContains:     "",
		},
		{
			name:                      "existent file without path loads specified source",
			source:                    "existent-test-package-without-path.tar.zst",
			localFilePathExists:       true,
			expectedCallToLoadPackage: true,
			expectedCallToDeploy:      true,
			expectedErrorContains:     "",
		},
		{
			name:                      "existent uncompressed tarfile loads specified source",
			source:                    "existent-test-package-without-path.tar",
			localFilePathExists:       true,
			expectedCallToLoadPackage: true,
			expectedCallToDeploy:      true,
			expectedErrorContains:     "",
		},
		{
			name:                      "nonexistent local absolute file path returns error",
			source:                    "/tmp/absolute/path/to/nonexistenttest-package.tar.zst",
			localFilePathExists:       false,
			expectedCallToLoadPackage: false,
			expectedCallToDeploy:      false,
			expectedErrorContains:     "no such file or directory",
		},
		{
			name:                      "nonexistent local relative file path returns error",
			source:                    "./relative/path/to/nonexistenttest-package.tar.zst",
			localFilePathExists:       false,
			expectedCallToLoadPackage: false,
			expectedCallToDeploy:      false,
			expectedErrorContains:     "no such file or directory",
		},
		{
			name:                      "nonexistent file without path returns error",
			source:                    "nonexistent-test-package-without-path.tar.zst",
			localFilePathExists:       false,
			expectedCallToLoadPackage: false,
			expectedCallToDeploy:      false,
			expectedErrorContains:     "no such file or directory",
		},
		{
			name:                      "nonexistent uncompressed tarfile loads specified source",
			source:                    "nonexistent-test-package-without-path.tar",
			localFilePathExists:       false,
			expectedCallToLoadPackage: false,
			expectedCallToDeploy:      false,
			expectedErrorContains:     "no such file or directory",
		},
		{
			name:                      "missing oci:// scheme for OCI reference returns error",
			source:                    "ghcr.io/defenseunicornstest/packages/test-package:v1.0.0",
			localFilePathExists:       false,
			expectedCallToLoadPackage: false,
			expectedCallToDeploy:      false,
			expectedErrorContains:     "invalid package source",
		},
		{
			name:                      "http URL returns error",
			source:                    "http://defenseunicornstest.com/test-package.tar.zst",
			localFilePathExists:       false,
			expectedCallToLoadPackage: false,
			expectedCallToDeploy:      false,
			expectedErrorContains:     "invalid package source",
		},
		{
			name:                      "https URL returns error",
			source:                    "https://defenseunicornstest.com/test-package.tar.zst",
			localFilePathExists:       false,
			expectedCallToLoadPackage: false,
			expectedCallToDeploy:      false,
			expectedErrorContains:     "invalid package source",
		},
		{
			name:                      "empty source returns error",
			source:                    "",
			localFilePathExists:       false,
			expectedCallToLoadPackage: false,
			expectedCallToDeploy:      false,
			expectedErrorContains:     "invalid package source",
		},
		{
			name:                      "whitespace source returns error",
			source:                    "     ",
			localFilePathExists:       false,
			expectedCallToLoadPackage: false,
			expectedCallToDeploy:      false,
			expectedErrorContains:     "invalid package source",
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			mockPackager := &MockPackager{}
			mockPackageComponentFilter := &MockPackageComponentFilter{}

			// Create temporary file if test expects local file to exist
			if tc.localFilePathExists && !strings.HasPrefix(tc.source, helpers.OCIURLPrefix) {
				dir := filepath.Dir(tc.source)
				if dir != "." {
					err := os.MkdirAll(dir, 0o755)
					if err != nil {
						t.Fatalf("Failed to create test directory %s: %v", dir, err)
					}
					defer os.RemoveAll(strings.Split(tc.source, "/")[0])
				}

				file, err := os.Create(tc.source)
				if err != nil {
					t.Fatalf("Failed to create test file %s: %v", tc.source, err)
				}
				file.Close()
				defer os.Remove(tc.source)
			}

			if tc.expectedCallToLoadPackage {
				mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(
					newValidLoadPackageResult().Layout,
					newValidLoadPackageResult().Error,
				)
			}

			if tc.expectedCallToDeploy {
				mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)
				mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)
			}

			packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)
			testModel := NewTestPackageResourceModel(WithSource(tc.source))
			expectErrors := len(tc.expectedErrorContains) > 0

			_, err := packageResource.upsert(testCtx(t), testModel)

			if expectErrors {
				assert.NotNil(t, err, "Expected error, got none")
				assert.Contains(t, err.Error(), tc.expectedErrorContains)
			} else {
				assert.Nil(t, err, "Expected no error, got %v", err)
			}
			mockPackager.AssertExpectations(t)
			mockPackageComponentFilter.AssertExpectations(t)

			// Verify that LoadPackage was called with the correct source
			if tc.expectedCallToLoadPackage {
				mockPackager.AssertCalled(t, "LoadPackage", mock.Anything, tc.source, mock.Anything)
			}
		})
	}
}

func TestPackageResource_validateUniqueVarNames(t *testing.T) {
	tests := []struct {
		name               string
		model              PackageResourceModel
		expectedErrorCount int
	}{
		{
			name:               "no vars at all",
			expectedErrorCount: 0,
			model: PackageResourceModel{
				Vars:          variableSliceToSet([]VariableModel{}),
				SensitiveVars: variableSliceToSet([]VariableModel{}),
			},
		},
		{
			name:               "only regular vars, no duplicates",
			expectedErrorCount: 0,
			model: PackageResourceModel{
				Vars: variableSliceToSet([]VariableModel{
					{
						Name:  types.StringValue("variable_1"),
						Value: types.StringValue("value 1"),
					},
				}),
				SensitiveVars: variableSliceToSet([]VariableModel{}),
			},
		},
		{
			name:               "only regular vars, with duplicates",
			expectedErrorCount: 1,
			model: PackageResourceModel{
				Vars: variableSliceToSet([]VariableModel{
					{
						Name:  types.StringValue("variable_1"),
						Value: types.StringValue("value 1"),
					},
					{
						Name:  types.StringValue("variable_1"),
						Value: types.StringValue("duplicate value"),
					},
				}),
				SensitiveVars: variableSliceToSet([]VariableModel{}),
			},
		},
		{
			name:               "only sensitive vars, no duplicates",
			expectedErrorCount: 0,
			model: PackageResourceModel{
				Vars: variableSliceToSet([]VariableModel{}),
				SensitiveVars: variableSliceToSet([]VariableModel{
					{
						Name:  types.StringValue("sensitive variable_1"),
						Value: types.StringValue("sensitive value"),
					},
					{
						Name:  types.StringValue("sensitive variable_2"),
						Value: types.StringValue("sensitive value"),
					},
				}),
			},
		},
		{
			name:               "only sensitive vars, with duplicates",
			expectedErrorCount: 1,
			model: PackageResourceModel{
				Vars: variableSliceToSet([]VariableModel{}),
				SensitiveVars: variableSliceToSet([]VariableModel{
					{
						Name:  types.StringValue("sensitive variable_1"),
						Value: types.StringValue("sensitive value"),
					},
					{
						Name:  types.StringValue("sensitive variable_1"),
						Value: types.StringValue("sensitive value"),
					},
				}),
			},
		},
		{
			name:               "both var types, no duplicates",
			expectedErrorCount: 0,
			model: PackageResourceModel{
				Vars: variableSliceToSet([]VariableModel{
					{
						Name:  types.StringValue("variable_1"),
						Value: types.StringValue("value 1"),
					},
					{
						Name:  types.StringValue("variable_2"),
						Value: types.StringValue("duplicate value"),
					},
				}),
				SensitiveVars: variableSliceToSet([]VariableModel{
					{
						Name:  types.StringValue("sensitive variable_1"),
						Value: types.StringValue("sensitive value"),
					},
					{
						Name:  types.StringValue("sensitive variable_2"),
						Value: types.StringValue("sensitive value"),
					},
				}),
			},
		},
		{
			name:               "both var types, with duplicates",
			expectedErrorCount: 2,
			model: PackageResourceModel{
				Vars: variableSliceToSet([]VariableModel{
					{
						Name:  types.StringValue("variable_1"),
						Value: types.StringValue("value 1"),
					},
					{
						Name:  types.StringValue("variable_2"),
						Value: types.StringValue("duplicate value"),
					},
				}),
				SensitiveVars: variableSliceToSet([]VariableModel{
					{
						Name:  types.StringValue("variable_1"),
						Value: types.StringValue("sensitive value"),
					},
					{
						Name:  types.StringValue("variable_2"),
						Value: types.StringValue("sensitive value"),
					},
				}),
			},
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			resp := resource.ValidateConfigResponse{}
			validateUniqueVarNames(tc.model, &resp)
			assert.Equal(t, tc.expectedErrorCount, resp.Diagnostics.ErrorsCount())
		})
	}
}

func TestPackageResource_Upsert_NamespaceOverride(t *testing.T) {
	packageLayout := layout.PackageLayout{
		PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{
			Metadata: v1alpha1.ZarfMetadata{
				Name:        "test-package",
				Description: "Test package",
				Version:     "0.0.1",
			},
			Components: []v1alpha1.ZarfComponent{
				{
					Name:     "test-required-component-0",
					Required: helpers.BoolPtr(true),
					Default:  false,
				},
			},
		}),
	}

	tests := []struct {
		name                      string
		namespace                 string
		expectedNamespaceOverride string
	}{
		{
			name:                      "no namespace",
			namespace:                 "",
			expectedNamespaceOverride: "",
		},
		{
			name:                      "namespace provided",
			namespace:                 "aBrandNewNamespace",
			expectedNamespaceOverride: "aBrandNewNamespace",
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			mockPackager := &MockPackager{}
			mockPackageComponentFilter := &MockPackageComponentFilter{}
			mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(
				&packageLayout,
				nil,
			)
			mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)
			mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

			packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)
			testModel := NewTestPackageResourceModel(WithNamespace(tc.namespace))

			_, err := packageResource.upsert(testCtx(t), testModel)
			assert.NoError(t, err)

			// Check that Deploy was called and the variables map was provided with the correct values
			mockPackageComponentFilter.AssertExpectations(t)
			for _, call := range mockPackager.Calls {
				if call.Method == "Deploy" {
					deployOptions := call.Arguments[2].(zarfPackager.DeployOptions)
					assert.Equal(t, deployOptions.NamespaceOverride, tc.expectedNamespaceOverride)
				}
			}
		})
	}
}

func TestPackageResource_RunPackagePlanChecks_SignatureVerification(t *testing.T) {
	tests := []struct {
		name              string
		modelOpts         []PackageResourceModelDataOption
		loadPackageError  error
		packageSigned     bool
		expectLoadErr     bool
		expectSigErr      bool
		expectLoadPackage bool
	}{
		{
			name:              "verify=true with load success passes",
			modelOpts:         []PackageResourceModelDataOption{WithPublicKey("some-key")},
			loadPackageError:  nil,
			expectLoadErr:     false,
			expectSigErr:      false,
			expectLoadPackage: true,
		},
		{
			name:              "signed package verification failure returns sigErr",
			modelOpts:         []PackageResourceModelDataOption{WithPublicKey("invalid-key")},
			packageSigned:     true,
			expectLoadErr:     false,
			expectSigErr:      true,
			expectLoadPackage: true,
		},
		{
			name:              "verify=true with load error returns loadErr not sigErr",
			modelOpts:         []PackageResourceModelDataOption{WithPublicKey("some-key")},
			loadPackageError:  fmt.Errorf("network failure loading package"),
			expectLoadErr:     true,
			expectSigErr:      false,
			expectLoadPackage: true,
		},
		{
			name:              "verify=false skips verification entirely",
			modelOpts:         []PackageResourceModelDataOption{WithSignatureVerificationEnabled(false)},
			loadPackageError:  fmt.Errorf("should not be called"),
			expectLoadErr:     false,
			expectSigErr:      false,
			expectLoadPackage: false,
		},
		{
			name: "unknown optional_components defers validation until apply",
			modelOpts: []PackageResourceModelDataOption{
				WithSignatureVerificationEnabled(false),
				func(m *PackageResourceModel) {
					m.OptionalComponents = types.SetUnknown(types.StringType)
				},
			},
			loadPackageError:  fmt.Errorf("should not be called"),
			expectLoadErr:     false,
			expectSigErr:      false,
			expectLoadPackage: false,
		},
		{
			name: "unknown source skips verification",
			modelOpts: []PackageResourceModelDataOption{func(m *PackageResourceModel) {
				m.Source = types.StringUnknown()
			}},
			loadPackageError:  fmt.Errorf("should not be called"),
			expectLoadErr:     false,
			expectSigErr:      false,
			expectLoadPackage: false,
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			mockPackager := &MockPackager{}
			if tc.expectLoadPackage {
				if tc.loadPackageError == nil {
					result := newValidLoadPackageResult()
					if tc.packageSigned {
						result.Layout.PackageDefinition.SetBuildSigned(true)
					}
					mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(result.Layout, result.Error)
				} else {
					result := newErrorLoadPackageResult(tc.loadPackageError)
					mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(result.Layout, result.Error)
				}
			}

			packageResource := NewPackageResource(&udsProviderConfig{ValidatePackagesOnPlan: true}, mockPackager, nil, nil).(*PackageResource)
			model := NewTestPackageResourceModel(tc.modelOpts...)
			result := packageResource.runPackagePlanChecks(context.Background(), model)

			if tc.expectLoadErr {
				assert.NotNil(t, result.LoadErr)
			} else {
				assert.Nil(t, result.LoadErr)
			}
			if tc.expectSigErr {
				assert.NotNil(t, result.SigErr)
			} else {
				assert.Nil(t, result.SigErr)
			}
			if tc.expectLoadPackage {
				mockPackager.AssertCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
			} else {
				mockPackager.AssertNotCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
			}
		})
	}
}

func TestPackageResource_RunPackagePlanChecks_ErrorRouting(t *testing.T) {
	tests := []struct {
		name             string
		modelOpts        []PackageResourceModelDataOption
		loadPackageError error
		expectLoadErr    bool
		expectSigErr     bool
		expectOptErr     bool
	}{
		{
			name: "load failure routes to loadErr not sigErr",
			modelOpts: []PackageResourceModelDataOption{
				WithSignatureVerificationEnabled(false),
				WithOptionalComponents([]string{"test-optional-non-default-component-0"}),
			},
			loadPackageError: fmt.Errorf("connection refused"),
			expectLoadErr:    true,
			expectSigErr:     false,
			expectOptErr:     false,
		},
		{
			name: "verify=false with invalid optional_components validates optionals without sig path",
			modelOpts: []PackageResourceModelDataOption{
				WithSignatureVerificationEnabled(false),
				WithOptionalComponents([]string{"nonexistent-component"}),
			},
			loadPackageError: nil,
			expectLoadErr:    false,
			expectSigErr:     false,
			expectOptErr:     true,
		},
		{
			name: "invalid optional_components routes to optErr not sigErr",
			modelOpts: []PackageResourceModelDataOption{
				WithPublicKey("some-key"),
				WithOptionalComponents([]string{"nonexistent-component"}),
			},
			loadPackageError: nil,
			expectLoadErr:    false,
			expectSigErr:     false,
			expectOptErr:     true,
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			mockPackager := &MockPackager{}
			if tc.loadPackageError == nil {
				result := newValidLoadPackageResult()
				mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(result.Layout, result.Error)
			} else {
				result := newErrorLoadPackageResult(tc.loadPackageError)
				mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(result.Layout, result.Error)
			}

			packageResource := NewPackageResource(&udsProviderConfig{ValidatePackagesOnPlan: true}, mockPackager, nil, nil).(*PackageResource)
			model := NewTestPackageResourceModel(tc.modelOpts...)
			result := packageResource.runPackagePlanChecks(context.Background(), model)

			if tc.expectLoadErr {
				assert.NotNil(t, result.LoadErr, "expected LoadErr")
			} else {
				assert.Nil(t, result.LoadErr, "expected no LoadErr")
			}
			if tc.expectSigErr {
				assert.NotNil(t, result.SigErr, "expected SigErr")
			} else {
				assert.Nil(t, result.SigErr, "expected no SigErr")
			}
			if tc.expectOptErr {
				assert.NotNil(t, result.OptComponentsErr, "expected OptComponentsErr")
			} else {
				assert.Nil(t, result.OptComponentsErr, "expected no OptComponentsErr")
			}

			foundLoadPackageCall := false
			var loadOpts zarfPackager.LoadOptions
			for _, call := range mockPackager.Calls {
				if call.Method == "LoadPackage" {
					loadOpts = call.Arguments[2].(zarfPackager.LoadOptions)
					foundLoadPackageCall = true
					break
				}
			}
			require.True(t, foundLoadPackageCall, "LoadPackage was not called")
			assert.Equal(t, []zarfZoci.LayerType{zarfZoci.MetadataLayers}, loadOpts.LayerTypes,
				"inspection load must request metadata layers only")
		})
	}
}

func TestPackageResource_RunPackagePlanChecks_ReusesOneLoadForCanonicalAndExistingChecks(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout
	packager := &MockPackager{}
	packager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil).Once()
	cluster := &MockCluster{}
	packageResource := NewPackageResource(&udsProviderConfig{ValidatePackagesOnPlan: true}, packager, nil, cluster).(*PackageResource)
	model := NewTestPackageResourceModel(
		WithOptionalComponents([]string{"test-optional-non-default-component-0"}),
		WithValues(types.DynamicValue(types.ObjectValueMust(
			map[string]attr.Type{"example": types.StringType},
			map[string]attr.Value{"example": types.StringValue("value")},
		))),
	)
	identity := &deployedPackageIdentity{ID: "test-package", Name: "test-package"}

	result := packageResource.runPackagePlanChecks(context.Background(), model, identity)

	assert.NoError(t, result.LoadErr)
	assert.NoError(t, result.SigErr)
	assert.NoError(t, result.OptComponentsErr)
	assert.NoError(t, result.ValuesErr)
	assert.NoError(t, result.CanonicalNameErr)
	packager.AssertExpectations(t)
	cluster.AssertNotCalled(t, "NewWithWait", mock.Anything)
}

func TestNormalizeOptionalComponentsPlan(t *testing.T) {
	tests := []struct {
		name     string
		config   PackageResourceModel
		plan     PackageResourceModel // framework pre-populates plan from config for non-null optional_components
		expected types.Set
	}{
		{
			name:     "null optional_components with no component blocks normalizes to empty set",
			config:   NewTestPackageResourceModel(),
			plan:     NewTestPackageResourceModel(),
			expected: types.SetValueMust(types.StringType, []attr.Value{}),
		},
		{
			name:     "null optional_components with component blocks stays null",
			config:   NewTestPackageResourceModel(WithComponents(NewComponentModelsFromNames([]string{"comp-a"}))),
			plan:     NewTestPackageResourceModel(WithComponents(NewComponentModelsFromNames([]string{"comp-a"}))),
			expected: types.SetNull(types.StringType),
		},
		{
			name: "null optional_components with unknown component blocks stays null",
			config: func() PackageResourceModel {
				model := NewTestPackageResourceModel()
				model.Components = types.SetUnknown(model.Components.ElementType(context.Background()))
				return model
			}(),
			plan:     NewTestPackageResourceModel(),
			expected: types.SetNull(types.StringType),
		},
		{
			name:     "explicit empty optional_components unchanged",
			config:   NewTestPackageResourceModel(WithOptionalComponents([]string{})),
			plan:     NewTestPackageResourceModel(WithOptionalComponents([]string{})),
			expected: types.SetValueMust(types.StringType, []attr.Value{}),
		},
		{
			name:     "explicit optional_components unchanged",
			config:   NewTestPackageResourceModel(WithOptionalComponents([]string{"comp-a", "comp-b"})),
			plan:     NewTestPackageResourceModel(WithOptionalComponents([]string{"comp-a", "comp-b"})),
			expected: types.SetValueMust(types.StringType, []attr.Value{types.StringValue("comp-a"), types.StringValue("comp-b")}),
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			result := normalizeOptionalComponentsPlan(tc.config, tc.plan)
			assert.Equal(t, tc.expected, result.OptionalComponents)
		})
	}
}

func TestComponentBlocksMayBePresent(t *testing.T) {
	componentSet := componentSliceToSet(NewComponentModelsFromNames([]string{"comp-a"}))
	tests := []struct {
		name       string
		components types.Set
		expected   bool
	}{
		{
			name:       "null set",
			components: types.SetNull(componentSet.ElementType(context.Background())),
			expected:   false,
		},
		{
			name:       "empty set",
			components: componentSliceToSet([]ComponentModel{}),
			expected:   false,
		},
		{
			name:       "unknown set",
			components: types.SetUnknown(componentSet.ElementType(context.Background())),
			expected:   true,
		},
		{
			name:       "non-empty set",
			components: componentSet,
			expected:   true,
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			assert.Equal(t, tc.expected, componentBlocksMayBePresent(tc.components))
		})
	}
}

func TestPackageResource_LoadPackageLayoutFromSource_LoadsPackageMetadataOnly(t *testing.T) {
	mockPackager := &MockPackager{}
	validLoadPackageResult := newValidLoadPackageResult()
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(
		validLoadPackageResult.Layout,
		validLoadPackageResult.Error,
	)
	packageResource := NewPackageResource(nil, mockPackager, nil, nil).(*PackageResource)
	model := NewTestPackageResourceModel(WithPublicKey("test-public-key"))

	pkgLayout, err := packageResource.loadPackageLayoutFromSource(context.Background(), model)

	assert.NoError(t, err)
	assert.NotNil(t, pkgLayout)
	mockPackager.AssertCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
	loadOptions := mockPackager.Calls[0].Arguments[2].(zarfPackager.LoadOptions)
	assert.Nil(t, loadOptions.VerifyBlobOptions)
	assert.Equal(t, layout.VerifyNever, loadOptions.VerificationStrategy)
}

func TestPackageResource_VerifyPackageSignature_SkipsWhenVerificationDisabled(t *testing.T) {
	packageResource := NewPackageResource(nil, nil, nil, nil).(*PackageResource)
	packageResource.verifyPackageSignatureFunc = func(context.Context, *layout.PackageLayout, zarfSigning.VerifyBlobOptions) error {
		assert.Fail(t, "signature verification should not be called when signature_verification.verify is false")
		return nil
	}
	model := NewTestPackageResourceModel(WithSignatureVerificationEnabled(false))
	pkgLayout := &layout.PackageLayout{
		PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{Build: v1alpha1.ZarfBuildData{Signed: helpers.BoolPtr(true)}}),
	}

	err := packageResource.verifyPackageSignature(context.Background(), model, pkgLayout)

	assert.NoError(t, err)
}

func TestPackageResource_VerifyPackageSignature_CallsVerifierWithPublicKey(t *testing.T) {
	packageResource := NewPackageResource(nil, nil, nil, nil).(*PackageResource)
	var called bool
	var publicKeyContent string
	packageResource.verifyPackageSignatureFunc = func(_ context.Context, _ *layout.PackageLayout, opts zarfSigning.VerifyBlobOptions) error {
		called = true
		keyContent, err := os.ReadFile(opts.Key)
		assert.NoError(t, err)
		publicKeyContent = string(keyContent)
		return nil
	}
	model := NewTestPackageResourceModel(WithPublicKey("test-public-key"))
	pkgLayout := &layout.PackageLayout{
		PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{Build: v1alpha1.ZarfBuildData{Signed: helpers.BoolPtr(true)}}),
	}

	err := packageResource.verifyPackageSignature(context.Background(), model, pkgLayout)

	assert.NoError(t, err)
	assert.True(t, called)
	assert.Equal(t, "test-public-key", publicKeyContent)
}

func TestPackageResource_VerifyPackageSignature_CallsVerifierWithKeylessOptions(t *testing.T) {
	packageResource := NewPackageResource(nil, nil, nil, nil).(*PackageResource)
	var called bool
	var capturedOptions zarfSigning.VerifyBlobOptions
	packageResource.verifyPackageSignatureFunc = func(_ context.Context, _ *layout.PackageLayout, opts zarfSigning.VerifyBlobOptions) error {
		called = true
		capturedOptions = opts
		return nil
	}
	model := NewTestPackageResourceModel(WithKeylessVerification("test@example.com", "https://token.actions.githubusercontent.com"))
	pkgLayout := &layout.PackageLayout{
		PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{Build: v1alpha1.ZarfBuildData{Signed: helpers.BoolPtr(true)}}),
	}

	err := packageResource.verifyPackageSignature(context.Background(), model, pkgLayout)

	assert.NoError(t, err)
	assert.True(t, called)
	assert.Equal(t, "test@example.com", capturedOptions.CertVerify.CertIdentity)
	assert.Equal(t, "https://token.actions.githubusercontent.com", capturedOptions.CertVerify.CertOidcIssuer)
}

func TestPackageResource_Upsert_SkipsSignatureVerificationWhenDisabled(t *testing.T) {
	mockPackager := &MockPackager{}
	mockPackageComponentFilter := &MockPackageComponentFilter{}
	validLoadPackageResult := newValidLoadPackageResult()
	validLoadPackageResult.Layout.PackageDefinition.SetBuildSigned(true)
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(
		validLoadPackageResult.Layout,
		validLoadPackageResult.Error,
	)
	mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)
	mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)
	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)
	model := NewTestPackageResourceModel(WithSignatureVerificationEnabled(false))

	_, err := packageResource.upsert(testCtx(t), model)

	assert.NoError(t, err)
	mockPackageComponentFilter.AssertExpectations(t)
	mockPackager.AssertCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
}

func TestPackageResource_Upsert_DoesNotDeployWhenSignatureVerificationFails(t *testing.T) {
	mockPackager := &MockPackager{}
	validLoadPackageResult := newValidLoadPackageResult()
	validLoadPackageResult.Layout.PackageDefinition.SetBuildSigned(true)
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(
		validLoadPackageResult.Layout,
		validLoadPackageResult.Error,
	)
	packageResource := NewPackageResource(nil, mockPackager, nil, nil).(*PackageResource)
	packageResource.verifyPackageSignatureFunc = func(context.Context, *layout.PackageLayout, zarfSigning.VerifyBlobOptions) error {
		return errors.New("signature verification failed")
	}

	_, err := packageResource.upsert(testCtx(t), NewTestPackageResourceModel())

	assert.Error(t, err)
	assert.Contains(t, err.Error(), "signature verification failed")
	mockPackager.AssertNotCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
}

func TestPackageResource_Upsert_DeploysWhenSignatureVerificationSucceeds(t *testing.T) {
	mockPackager := &MockPackager{}
	mockPackageComponentFilter := &MockPackageComponentFilter{}
	validLoadPackageResult := newValidLoadPackageResult()
	validLoadPackageResult.Layout.PackageDefinition.SetBuildSigned(true)
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(
		validLoadPackageResult.Layout,
		validLoadPackageResult.Error,
	)
	mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)
	mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)
	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)
	var called bool
	packageResource.verifyPackageSignatureFunc = func(context.Context, *layout.PackageLayout, zarfSigning.VerifyBlobOptions) error {
		called = true
		return nil
	}

	_, err := packageResource.upsert(testCtx(t), NewTestPackageResourceModel())

	assert.NoError(t, err)
	assert.True(t, called)
	mockPackageComponentFilter.AssertExpectations(t)
	mockPackager.AssertCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
}

// Unit tests for upsert method architecture attribute
func TestPackageResource_Upsert_Architecture(t *testing.T) {
	tests := []struct {
		name                 string
		modelArchitecture    string // Architecture set in the model (empty string means not set)
		providerArchitecture string // Architecture from provider config
		expectedArchitecture string // Expected architecture passed to LoadPackage
	}{
		{
			name:                 "architecture not specified in package model uses provider default architecture set to amd64",
			modelArchitecture:    "",
			providerArchitecture: "amd64",
			expectedArchitecture: "amd64",
		},
		{
			name:                 "architecture not specified in package model uses provider default architecture set to arm64",
			modelArchitecture:    "",
			providerArchitecture: "arm64",
			expectedArchitecture: "arm64",
		},
		{
			name:                 "architecture specified in package model uses model value",
			modelArchitecture:    "arm64",
			providerArchitecture: "amd64",
			expectedArchitecture: "arm64",
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			mockPackager := &MockPackager{}
			mockPackageComponentFilter := &MockPackageComponentFilter{}

			validLoadPackageResult := newValidLoadPackageResult()
			mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(
				validLoadPackageResult.Layout,
				validLoadPackageResult.Error,
			)
			mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)
			mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

			providerConfig := &udsProviderConfig{
				DefaultArchitecture: tc.providerArchitecture,
			}
			packageResource := NewPackageResource(providerConfig, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)

			var testModel PackageResourceModel
			if tc.modelArchitecture != "" {
				testModel = NewTestPackageResourceModel(WithArchitecture(tc.modelArchitecture))
			} else {
				// Create model without architecture set (null value)
				testModel = NewTestPackageResourceModel()
				testModel.Architecture = types.StringNull()
			}

			_, err := packageResource.upsert(testCtx(t), testModel)
			assert.NoError(t, err)

			// Find the LoadOptions from the LoadPackage call
			loadOptionsArgFound := false
			var loadOptions zarfPackager.LoadOptions
			for _, call := range mockPackager.Calls {
				if call.Method == "LoadPackage" {
					loadOptions = call.Arguments[2].(zarfPackager.LoadOptions)
					loadOptionsArgFound = true
					break
				}
			}

			assert.True(t, loadOptionsArgFound, "Could not find LoadOptions argument in LoadPackage call")
			assert.Equal(t, tc.expectedArchitecture, loadOptions.Architecture,
				"Expected architecture %s but got %s", tc.expectedArchitecture, loadOptions.Architecture)

			mockPackageComponentFilter.AssertExpectations(t)
		})
	}
}

func TestPackageResource_Upsert_ConnectStrings(t *testing.T) {
	packageLayout := layout.PackageLayout{
		PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{
			Metadata: v1alpha1.ZarfMetadata{
				Name:        "test-package",
				Description: "Test package",
				Version:     "0.0.1",
			},
			Components: []v1alpha1.ZarfComponent{
				{
					Name:     "test-component",
					Required: helpers.BoolPtr(true),
					Default:  false,
				},
			},
		}),
	}

	tests := []struct {
		name                       string
		deployResultConnectStrings map[string]zarfState.ConnectString
		expectedConnectStrings     []struct {
			name        string
			description string
		}
	}{
		{
			name:                       "no connect strings results in empty set",
			deployResultConnectStrings: map[string]zarfState.ConnectString{},
			expectedConnectStrings:     []struct{ name, description string }{},
		},
		{
			name: "one connect string results in single entity set",
			deployResultConnectStrings: map[string]zarfState.ConnectString{
				"test-app-1": {
					Description: "Test application 1",
				},
			},
			expectedConnectStrings: []struct{ name, description string }{
				{
					name:        "test-app-1",
					description: "Test application 1",
				},
			},
		},
		{
			name: "multiple connect strings result in multiple entities in set",
			deployResultConnectStrings: map[string]zarfState.ConnectString{
				"test-app-1": {
					Description: "Test application 1",
				},
				"test-app-2": {
					Description: "Test application 2",
				},
				"test-app-3": {
					Description: "Test application 3",
				},
			},
			expectedConnectStrings: []struct{ name, description string }{
				{
					name:        "test-app-1",
					description: "Test application 1",
				},
				{
					name:        "test-app-2",
					description: "Test application 2",
				},
				{
					name:        "test-app-3",
					description: "Test application 3",
				},
			},
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			mockPackager := &MockPackager{}
			mockPackageComponentFilter := &MockPackageComponentFilter{}

			mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(
				&packageLayout,
				nil,
			)

			deployResult := packager.DeployResult{
				DeployedComponents: []zarfState.DeployedComponent{
					{
						Name: "test-component",
						InstalledCharts: []zarfState.InstalledChart{
							{
								Namespace:      "default",
								ChartName:      "test-chart",
								ConnectStrings: tc.deployResultConnectStrings,
							},
						},
					},
				},
			}

			mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(deployResult, nil)
			mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

			packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)
			testModel := NewTestPackageResourceModel()

			result, err := packageResource.upsert(testCtx(t), testModel)
			assert.NoError(t, err)
			assert.False(t, result.ConnectStrings.IsNull(), "ConnectStrings should not be null")

			// Verify connect strings were populated
			expectedConnectStringsCount := len(tc.expectedConnectStrings)
			if expectedConnectStringsCount == 0 {
				assert.True(t, result.ConnectStrings.IsUnknown() || len(result.ConnectStrings.Elements()) == 0, "ConnectStrings should be empty")
			} else {
				assert.Len(t, result.ConnectStrings.Elements(), expectedConnectStringsCount)

				connectStringsMap := make(map[string]string)
				for _, elem := range result.ConnectStrings.Elements() {
					obj := elem.(types.Object)
					attrs := obj.Attributes()
					name := attrs["name"].(types.String).ValueString()
					description := attrs["description"].(types.String).ValueString()
					connectStringsMap[name] = description
				}

				for _, expected := range tc.expectedConnectStrings {
					description, found := connectStringsMap[expected.name]
					assert.True(t, found, "Expected connect string %s not found", expected.name)
					assert.Equal(t, expected.description, description, "Connect string %s has incorrect description", expected.name)
				}
			}
		})
	}
}

func TestPackageResource_Upsert_LogEvents(t *testing.T) {
	packageLayout := &layout.PackageLayout{PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{
		Metadata: v1alpha1.ZarfMetadata{Name: "test-package", Version: "0.0.1"},
		Components: []v1alpha1.ZarfComponent{
			{Name: "required", Required: helpers.BoolPtr(true)},
			{Name: "optional", Required: helpers.BoolPtr(false)},
		},
	})}
	packagerMock := &MockPackager{}
	filterMock := &MockPackageComponentFilter{}
	packagerMock.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil)
	packagerMock.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{
		DeployedComponents: []zarfState.DeployedComponent{{InstalledCharts: []zarfState.InstalledChart{{ConnectStrings: map[string]zarfState.ConnectString{
			"app": {Description: "Open the app"},
		}}}}},
	}, nil)
	filterMock.On("ForDeploy", []string{"optional"}).Return(mock.Anything)

	var output bytes.Buffer
	ctx := tflogtest.RootLogger(context.Background(), &output)
	ctx = logging.WithPackageContext(ctx, "create", "", "demo")
	operationCtx, cancel := context.WithTimeout(ctx, 5*time.Minute)
	t.Cleanup(cancel)
	clusterMock := &MockCluster{}
	clusterMock.On("NewWithWait", mock.Anything).Return(newFakeCluster(), nil).Twice()
	r := NewPackageResource(&udsProviderConfig{DefaultArchitecture: "arm64"}, packagerMock, filterMock, clusterMock).(*PackageResource)
	model := NewTestPackageResourceModel(WithDeployedState(),
		WithArchitecture("arm64"),
		WithNamespace("demo"),
		WithOptionalComponents([]string{"optional"}),
	)
	plan := buildTestPlan(t, r, model)
	resp := &resource.CreateResponse{State: buildTestState(t, r, model)}
	r.Create(operationCtx, resource.CreateRequest{Plan: plan}, resp)
	require.False(t, resp.Diagnostics.HasError(), "%v", resp.Diagnostics)
	assert.Empty(t, resp.Diagnostics, "successful create should not add Zarf output to diagnostics")

	entries, err := tflogtest.MultilineJSONDecode(&output)
	require.NoError(t, err)
	assertLogSequence(t, entries, []string{
		"package started",
		"component selected: required",
		"component selected: optional",
		"package completed",
	})
	for _, entry := range entries {
		for key := range entry {
			if strings.HasPrefix(key, "uds.") {
				assert.Contains(t, []string{"uds.operation", "uds.package", "uds.namespace", "uds.component"}, key)
			}
		}
		for _, forbidden := range []string{
			"vars", "variables", "values", "sensitive_values",
			"credentials", "signature_verification", "public_key", "keyless",
		} {
			assert.NotContains(t, entry, forbidden, "unsafe provider field %q leaked", forbidden)
		}
	}
	assertLogEntry(t, entries, "package started", map[string]interface{}{
		"uds.operation": "create", "uds.package": "test-package", "uds.namespace": "demo",
		"architecture": "arm64", "optional_components": "optional",
	})
	assertLogEntry(t, entries, "package completed", map[string]interface{}{
		"uds.operation": "create", "uds.package": "test-package", "uds.namespace": "demo",
	})
	assertLogEntry(t, entries, "zarf connect app", map[string]interface{}{
		"command": "zarf connect app", "description": "Open the app",
	})
}

func TestPackageResource_Upsert_DoesNotStartPackageBeforeValidation(t *testing.T) {
	packagerMock := &MockPackager{}
	filterMock := &MockPackageComponentFilter{}
	packagerMock.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(newValidLoadPackageResult().Layout, nil)
	filterMock.On("ForDeploy", mock.Anything).Return(mock.Anything)

	r := NewPackageResource(&udsProviderConfig{DefaultArchitecture: "arm64"}, packagerMock, filterMock, nil).(*PackageResource)
	var output bytes.Buffer
	ctx := tflogtest.RootLogger(context.Background(), &output)
	_, err := r.upsert(ctx, NewTestPackageResourceModel(WithValues(types.DynamicUnknown())))
	require.Error(t, err)

	entries, err := tflogtest.MultilineJSONDecode(&output)
	require.NoError(t, err)
	assertNoLogEntry(t, entries, "package started")
}

func TestPackageResource_RemoveComponents_LogEvent(t *testing.T) {
	packagerMock := &MockPackager{}
	filterMock := &MockPackageComponentFilter{}
	clusterMock := &MockCluster{}
	pkg := v1alpha1.ZarfPackage{
		Metadata:   v1alpha1.ZarfMetadata{Name: "test-package"},
		Components: []v1alpha1.ZarfComponent{{Name: "optional"}},
	}
	filterMock.On("ForRemove", []string{"optional"}).Return(mock.Anything)
	clusterMock.On("NewWithWait", mock.Anything).Return((*zarfCluster.Cluster)(nil), nil)
	packagerMock.On("GetPackageFromSourceOrCluster", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(pkg, nil)
	packagerMock.On("Remove", mock.Anything, pkg, mock.Anything).Return(nil)

	var output bytes.Buffer
	ctx := tflogtest.RootLogger(context.Background(), &output)
	ctx = logging.WithPackageContext(ctx, "update", "test-package", "demo")
	r := NewPackageResource(&udsProviderConfig{}, packagerMock, filterMock, clusterMock).(*PackageResource)
	operationCtx, cancel := context.WithTimeout(ctx, 5*time.Minute)
	t.Cleanup(cancel)
	err := r.removeComponents(operationCtx, NewTestPackageResourceModel(WithNamespace("demo")), []string{"optional"}, testPackageIdentity("demo"))
	require.NoError(t, err)

	entries, err := tflogtest.MultilineJSONDecode(&output)
	require.NoError(t, err)
	assertLogEntry(t, entries, "component selected", map[string]interface{}{
		"uds.operation": "update", "uds.package": "test-package", "uds.namespace": "demo", "uds.component": "optional",
	})
}

func TestPackageResource_RemoveComponents_DoesNotLogRequiredComponentAsStarted(t *testing.T) {
	packagerMock := &MockPackager{}
	filterMock := &MockPackageComponentFilter{}
	clusterMock := &MockCluster{}
	required := true
	pkg := v1alpha1.ZarfPackage{
		Metadata:   v1alpha1.ZarfMetadata{Name: "test-package"},
		Components: []v1alpha1.ZarfComponent{{Name: "required", Required: &required}},
	}
	filterMock.On("ForRemove", []string{"required"}).Return(mock.Anything)
	clusterMock.On("NewWithWait", mock.Anything).Return((*zarfCluster.Cluster)(nil), nil)
	packagerMock.On("GetPackageFromSourceOrCluster", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(pkg, nil)

	var output bytes.Buffer
	ctx := tflogtest.RootLogger(context.Background(), &output)
	ctx = logging.WithPackageContext(ctx, "update", "test-package", "demo")
	r := NewPackageResource(&udsProviderConfig{}, packagerMock, filterMock, clusterMock).(*PackageResource)
	operationCtx, cancel := context.WithTimeout(ctx, 5*time.Minute)
	t.Cleanup(cancel)
	err := r.removeComponents(operationCtx, NewTestPackageResourceModel(WithNamespace("demo")), []string{"required"}, testPackageIdentity("demo"))
	require.NoError(t, err)

	entries, err := tflogtest.MultilineJSONDecode(&output)
	require.NoError(t, err)
	for _, entry := range entries {
		require.NotEqual(t, "component selected", entry["@message"])
	}
}

func TestPackageResource_CreateFailure_LogEventAndDiagnostic(t *testing.T) {
	packagerMock := &MockPackager{}
	packagerMock.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(
		&layout.PackageLayout{}, errors.New("load failed"),
	)
	clusterMock := &MockCluster{}
	clusterMock.On("NewWithWait", mock.Anything).Return(newFakeCluster(), nil).Once()
	r := NewPackageResource(nil, packagerMock, nil, clusterMock).(*PackageResource)
	model := NewTestPackageResourceModel(WithDeployedState(), WithNamespace("demo"))
	plan := buildTestPlan(t, r, model)
	var output bytes.Buffer
	ctx := tflogtest.RootLogger(context.Background(), &output)
	resp := &resource.CreateResponse{State: tfsdk.State{Schema: schema.Schema{}}}
	r.Create(ctx, resource.CreateRequest{Plan: plan}, resp)
	require.True(t, resp.Diagnostics.HasError())
	assert.Contains(t, resp.Diagnostics.Errors()[0].Detail(), "load failed")

	entries, err := tflogtest.MultilineJSONDecode(&output)
	require.NoError(t, err)
	assertLogEntry(t, entries, "package failed", map[string]interface{}{
		"uds.operation": "create", "uds.package": "test-pkg", "uds.namespace": "demo",
	})
	assertLogEntryFieldContains(t, entries, "package failed", "error", "load failed")
	var failures int
	for _, entry := range entries {
		if entry["@message"] == "package failed" {
			failures++
		}
	}
	assert.Equal(t, 1, failures)
}

func TestPackageResource_CreateDeployFailure_PreservesPackagerDiagnostic(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout
	packagerMock := &MockPackager{}
	filterMock := &MockPackageComponentFilter{}
	packagerMock.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil)
	packagerMock.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, errors.New(`unable to run component after action: command "kubectl create namespace already-exists" failed after 0 retries

captured Zarf output:
Error from server (AlreadyExists): namespaces "already-exists" already exists`))
	filterMock.On("ForDeploy", mock.Anything).Return(mock.Anything)

	clusterMock := &MockCluster{}
	clusterMock.On("NewWithWait", mock.Anything).Return(newFakeCluster(), nil).Twice()
	r := NewPackageResource(nil, packagerMock, filterMock, clusterMock).(*PackageResource)
	model := NewTestPackageResourceModel(
		WithDeployedState(),
		WithNamespace("demo"),
	)
	plan := buildTestPlan(t, r, model)
	var output bytes.Buffer
	ctx := tflogtest.RootLogger(context.Background(), &output)
	resp := &resource.CreateResponse{State: buildTestState(t, r, model)}
	r.Create(ctx, resource.CreateRequest{Plan: plan}, resp)

	require.True(t, resp.Diagnostics.HasError())
	require.Len(t, resp.Diagnostics.Errors(), 1)
	diagnostic := resp.Diagnostics.Errors()[0]
	assert.Equal(t, "Error creating package", diagnostic.Summary())
	assert.Contains(t, diagnostic.Detail(), `command "kubectl create namespace already-exists" failed after 0 retries`)
	assert.Contains(t, diagnostic.Detail(), `Error from server (AlreadyExists): namespaces "already-exists" already exists`)

	entries, err := tflogtest.MultilineJSONDecode(&output)
	require.NoError(t, err)
	assertLogEntry(t, entries, "package failed", nil)
	assertLogEntryFieldContains(t, entries, "package failed", "error", "captured Zarf output:")
	assertLogEntryFieldContains(t, entries, "package failed", "error", "AlreadyExists")
	assertNoLogEntry(t, entries, "package completed")
	var failures int
	for _, entry := range entries {
		if entry["@message"] == "package failed" {
			failures++
		}
	}
	assert.Equal(t, 1, failures)
}

func TestPackageResource_CreateStateFailure_LogsFailureWithoutCompletion(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout
	packagerMock := &MockPackager{}
	filterMock := &MockPackageComponentFilter{}
	packagerMock.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil)
	packagerMock.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)
	filterMock.On("ForDeploy", mock.Anything).Return(mock.Anything)
	r := NewPackageResource(nil, packagerMock, filterMock, nil).(*PackageResource)
	plan := buildTestPlan(t, r, NewTestPackageResourceModel(WithDeployedState()))
	var schemaResp resource.SchemaResponse
	r.Schema(context.Background(), resource.SchemaRequest{}, &schemaResp)
	badSchema := schemaResp.Schema
	badSchema.Attributes["metadata"] = schema.StringAttribute{Computed: true}
	stateResponse := tfsdk.State{
		Schema: badSchema,
		Raw:    tftypes.NewValue(badSchema.Type().TerraformType(context.Background()), nil),
	}

	var output bytes.Buffer
	ctx := tflogtest.RootLogger(context.Background(), &output)
	resp := &resource.CreateResponse{State: stateResponse}
	r.Create(ctx, resource.CreateRequest{Plan: plan}, resp)

	require.True(t, resp.Diagnostics.HasError())
	entries, err := tflogtest.MultilineJSONDecode(&output)
	require.NoError(t, err)
	assertLogEntry(t, entries, "package failed", nil)
	assertLogEntryFieldNotEmpty(t, entries, "package failed", "error")
	assertNoLogEntry(t, entries, "package completed")
}

func TestPackageResource_UpdateStateOnlySuccess_LogsCompletion(t *testing.T) {
	r := NewPackageResource(nil, nil, nil, nil).(*PackageResource)
	stateModel := NewTestPackageResourceModel(WithDeployedState(), WithTimeout("30m"))
	planModel := stateModel
	WithTimeout("45m")(&planModel)
	plan := buildTestPlan(t, r, planModel)
	state := buildTestState(t, r, stateModel)

	var output bytes.Buffer
	ctx := tflogtest.RootLogger(context.Background(), &output)
	resp := resource.UpdateResponse{State: state}
	r.Update(ctx, resource.UpdateRequest{Plan: plan, State: state}, &resp)

	require.False(t, resp.Diagnostics.HasError(), "%v", resp.Diagnostics)
	entries, err := tflogtest.MultilineJSONDecode(&output)
	require.NoError(t, err)
	assertLogEntry(t, entries, "package completed", nil)
	assertNoLogEntry(t, entries, "package failed")
}

func TestPackageResource_UpdateStateFailure_LogsFailureWithoutCompletion(t *testing.T) {
	r := NewPackageResource(nil, nil, nil, nil).(*PackageResource)
	model := NewTestPackageResourceModel(WithDeployedState())
	plan := buildTestPlan(t, r, model)
	state := buildTestState(t, r, model)
	var schemaResp resource.SchemaResponse
	r.Schema(context.Background(), resource.SchemaRequest{}, &schemaResp)
	badSchema := schemaResp.Schema
	badSchema.Attributes["metadata"] = schema.StringAttribute{Computed: true}
	stateResponse := tfsdk.State{
		Schema: badSchema,
		Raw:    tftypes.NewValue(badSchema.Type().TerraformType(context.Background()), nil),
	}

	var output bytes.Buffer
	ctx := tflogtest.RootLogger(context.Background(), &output)
	resp := &resource.UpdateResponse{State: stateResponse}
	r.Update(ctx, resource.UpdateRequest{Plan: plan, State: state}, resp)

	require.True(t, resp.Diagnostics.HasError())
	entries, err := tflogtest.MultilineJSONDecode(&output)
	require.NoError(t, err)
	assertLogEntry(t, entries, "package failed", nil)
	assertLogEntryFieldNotEmpty(t, entries, "package failed", "error")
	assertNoLogEntry(t, entries, "package completed")
}

func TestPackageResource_ConnectStringsStateShape(t *testing.T) {
	r := NewPackageResource(nil, nil, nil, nil).(*PackageResource)
	var schemaResp resource.SchemaResponse
	r.Schema(context.Background(), resource.SchemaRequest{}, &schemaResp)
	connectStrings, ok := schemaResp.Schema.Attributes["connect_strings"].(schema.SetNestedAttribute)
	require.True(t, ok)
	assert.ElementsMatch(t, []string{"name", "description"}, mapKeys(connectStrings.NestedObject.Attributes))
	assert.NotContains(t, mapKeys(connectStrings.NestedObject.Attributes), "command")
}

func assertLogEntry(t *testing.T, entries []map[string]interface{}, message string, fields map[string]interface{}) {
	t.Helper()
	for _, entry := range entries {
		if entry["@message"] != message {
			continue
		}
		for key, value := range fields {
			assert.Equal(t, value, entry[key], key)
		}
		return
	}
	t.Fatalf("log entry %q not found in %#v", message, entries)
}

func assertLogSequence(t *testing.T, entries []map[string]interface{}, expected []string) {
	t.Helper()
	actual := make([]string, 0)
	for _, entry := range entries {
		switch entry["@message"] {
		case "package started", "package completed":
			actual = append(actual, entry["@message"].(string))
		case "component selected":
			actual = append(actual, fmt.Sprintf("component selected: %s", entry["uds.component"]))
		}
	}
	assert.Equal(t, expected, actual, "lifecycle event sequence")
}

func assertLogEntryFieldContains(t *testing.T, entries []map[string]interface{}, message, field, expected string) {
	t.Helper()
	for _, entry := range entries {
		if entry["@message"] == message {
			assert.Contains(t, entry[field], expected, "field %q in %q: got %#v", field, message, entry[field])
			return
		}
	}
	t.Fatalf("log entry %q not found in %#v", message, entries)
}

func assertLogEntryFieldNotEmpty(t *testing.T, entries []map[string]interface{}, message, field string) {
	t.Helper()
	for _, entry := range entries {
		if entry["@message"] == message {
			assert.NotEmpty(t, entry[field], "field %q in %q should not be empty: got %#v", field, message, entry[field])
			return
		}
	}
	t.Fatalf("log entry %q not found in %#v", message, entries)
}

func assertNoLogEntry(t *testing.T, entries []map[string]interface{}, message string) {
	t.Helper()
	for _, entry := range entries {
		assert.NotEqual(t, message, entry["@message"])
	}
}

func mapKeys[T any](values map[string]T) []string {
	keys := make([]string, 0, len(values))
	for key := range values {
		keys = append(keys, key)
	}
	return keys
}

func TestComputePackageID(t *testing.T) {
	tests := []struct {
		name       string
		namespace  string
		pkgName    string
		expectedID string
	}{
		{
			name:       "No namespace provided",
			namespace:  "",
			pkgName:    "my-package-name",
			expectedID: "my-package-name",
		},
		{
			name:       "namespace provided",
			namespace:  "my-namespace",
			pkgName:    "my-package-name",
			expectedID: "my-namespace:my-package-name",
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			assert.Equal(t, tc.expectedID, computePackageID(tc.namespace, tc.pkgName))
		})
	}
}

func TestValidatePriorStateIdentity(t *testing.T) {
	consistent := NewTestPackageResourceModel(WithDeployedState(), WithNamespace("team-a"))
	consistent.ID = types.StringValue("team-a:test-pkg")

	tests := []struct {
		name     string
		model    PackageResourceModel
		complete bool
		wantErr  bool
	}{
		{name: "consistent namespace qualified identity", model: consistent, complete: true},
		{name: "stale computed name", model: func() PackageResourceModel { m := consistent; m.Name = types.StringValue("old-name"); return m }(), wantErr: true},
		{name: "stale namespace", model: func() PackageResourceModel { m := consistent; m.Namespace = types.StringValue("other"); return m }(), wantErr: true},
		{name: "null import ID defers validation", model: func() PackageResourceModel { m := consistent; m.ID = types.StringNull(); return m }()},
		{name: "incomplete imported state defers validation", model: func() PackageResourceModel { m := consistent; m.Name = types.StringNull(); return m }()},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			identity, complete, err := validatePriorStateIdentity(tc.model)
			assert.Equal(t, tc.complete, complete)
			assert.Equal(t, tc.wantErr, err != nil)
			if tc.complete {
				assert.Equal(t, "team-a:test-pkg", identity.ID)
				assert.Equal(t, "team-a", identity.Namespace)
				assert.Equal(t, "test-pkg", identity.Name)
			}
			if tc.wantErr {
				var stateErr *stateIdentityError
				assert.ErrorAs(t, err, &stateErr)
			}
		})
	}
}

func TestLookupVerifiedDeployedPackage(t *testing.T) {
	canonical := zarfState.DeployedPackage{
		Name:              "test-pkg",
		NamespaceOverride: "team-a",
		Data:              v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-pkg"}},
	}

	tests := []struct {
		name       string
		id         string
		pkg        zarfState.DeployedPackage
		present    bool
		clusterErr error
		wantErr    bool
	}{
		{name: "canonical identity", id: "team-a:test-pkg", pkg: canonical, present: true},
		{name: "returned name mismatch", id: "team-a:test-pkg", pkg: func() zarfState.DeployedPackage { p := canonical; p.Name = "other"; return p }(), present: true, wantErr: true},
		{name: "returned namespace mismatch", id: "team-a:test-pkg", pkg: func() zarfState.DeployedPackage { p := canonical; p.NamespaceOverride = "other"; return p }(), present: true, wantErr: true},
		{name: "returned metadata mismatch", id: "team-a:test-pkg", pkg: func() zarfState.DeployedPackage { p := canonical; p.Data.Metadata.Name = "other"; return p }(), present: true, wantErr: true},
		{name: "not found", id: "team-a:test-pkg"},
		{name: "malformed ID", id: "a:b:c", wantErr: true},
		{name: "cluster error", id: "team-a:test-pkg", clusterErr: errors.New("sentinel-cluster-error"), wantErr: true},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			clientset := fake.NewSimpleClientset()
			if tc.present {
				secret := newPackageStateSecret(t, tc.pkg)
				// Zarf locates state by the requested identity's Secret name; corrupt
				// the serialized payload without changing that lookup key.
				secret.Name = canonical.GetSecretName()
				_, err := clientset.CoreV1().Secrets(zarfState.ZarfNamespaceName).Create(context.Background(), secret, metav1.CreateOptions{})
				require.NoError(t, err)
			}
			cluster := &MockCluster{}
			if tc.clusterErr != nil {
				cluster.On("NewWithWait", mock.Anything).Return((*zarfCluster.Cluster)(nil), tc.clusterErr).Once()
			} else {
				cluster.On("NewWithWait", mock.Anything).Return(&zarfCluster.Cluster{Clientset: clientset}, nil).Once()
			}
			resource := NewPackageResource(nil, nil, nil, cluster).(*PackageResource)

			identity, err := resource.lookupVerifiedDeployedPackage(context.Background(), tc.id)
			assert.Equal(t, tc.wantErr || !tc.present, err != nil)
			if err == nil {
				assert.Equal(t, tc.id, identity.ID)
				assert.Equal(t, "test-pkg", identity.Name)
			}
			if tc.wantErr {
				var remoteErr *remoteIdentityError
				require.ErrorAs(t, err, &remoteErr)
				detail := identityErrorDetail(err)
				assert.Contains(t, detail, remoteErr.Error())
				assert.Contains(t, detail, "No package mutation was performed")
				assert.NotContains(t, detail, "sentinel-cluster-error")
			}
			if !tc.present && !tc.wantErr {
				var absentErr *packageAbsentError
				assert.ErrorAs(t, err, &absentErr)
			}
		})
	}
}

func TestCanonicalIdentityDiagnosticsDoNotExposeDependencyErrors(t *testing.T) {
	const sentinelSecret = "source-token-do-not-disclose"
	packager := &MockPackager{}
	packager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).
		Return((*layout.PackageLayout)(nil), errors.New(sentinelSecret)).Once()
	resource := NewPackageResource(nil, packager, nil, nil).(*PackageResource)
	identity := deployedPackageIdentity{Name: "deployed-name", Namespace: "team-a"}

	err := resource.verifyCanonicalPackageName(context.Background(), NewTestPackageResourceModel(), identity)

	var sourceErr *canonicalSourceError
	require.ErrorAs(t, err, &sourceErr)
	detail := canonicalIdentityDetail(err)
	assert.Contains(t, detail, "No package mutation was performed")
	assert.NotContains(t, detail, sentinelSecret)
	packager.AssertExpectations(t)
}

func TestVerifyCanonicalPackageName(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout

	tests := []struct {
		name     string
		identity deployedPackageIdentity
		wantErr  bool
	}{
		{name: "matching canonical name", identity: deployedPackageIdentity{Name: "test-package", Namespace: "team-a"}},
		{name: "alias differs from canonical name", identity: deployedPackageIdentity{Name: "test-package-alias", Namespace: "team-a"}, wantErr: true},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			packager := &MockPackager{}
			packager.On("LoadPackage", mock.Anything, mock.Anything, mock.MatchedBy(func(opts zarfPackager.LoadOptions) bool {
				return opts.Architecture == "arm64" && len(opts.LayerTypes) == 1 && opts.LayerTypes[0] == zarfZoci.MetadataLayers
			})).Return(packageLayout, nil).Once()
			resource := NewPackageResource(nil, packager, nil, nil).(*PackageResource)

			err := resource.verifyCanonicalPackageName(context.Background(), NewTestPackageResourceModel(WithArchitecture("arm64")), tc.identity)

			assert.Equal(t, tc.wantErr, err != nil)
			if tc.wantErr {
				var mismatch *canonicalNameMismatchError
				assert.ErrorAs(t, err, &mismatch)
			}
			packager.AssertExpectations(t)
		})
	}
}

func TestVerifyCanonicalPackageNameClassifiesTransportFailure(t *testing.T) {
	packager := &MockPackager{}
	resource := NewPackageResource(
		&udsProviderConfig{InsecureForceHTTP: true},
		packager,
		nil,
		nil,
	).(*PackageResource)
	model := NewTestPackageResourceModel(WithSource("oci://not a valid reference"))

	err := resource.verifyCanonicalPackageName(context.Background(), model, deployedPackageIdentity{Name: "test-package"})

	var sourceErr *canonicalSourceError
	require.ErrorAs(t, err, &sourceErr)
	assert.NotContains(t, canonicalIdentityDetail(err), "not a valid reference")
	packager.AssertNotCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
}

func TestVerifyCanonicalPackageNameCleansUpInspectionLayout(t *testing.T) {
	dir := t.TempDir()
	require.NoError(t, os.WriteFile(filepath.Join(dir, "zarf.yaml"), []byte("apiVersion: zarf.dev/v1alpha1\nkind: ZarfPackageConfig\nmetadata:\n  name: test-package\n  version: 1.0.0\n  aggregateChecksum: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\n"), 0o600))
	require.NoError(t, os.WriteFile(filepath.Join(dir, "checksums.txt"), nil, 0o600))
	pkgLayout, err := layout.LoadFromDir(context.Background(), dir, layout.PackageLayoutOptions{})
	require.NoError(t, err)
	packager := &MockPackager{}
	packager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(pkgLayout, nil).Once()
	resource := NewPackageResource(nil, packager, nil, nil).(*PackageResource)

	err = resource.verifyCanonicalPackageName(context.Background(), NewTestPackageResourceModel(), deployedPackageIdentity{Name: "test-package"})

	require.NoError(t, err)
	_, statErr := os.Stat(dir)
	assert.True(t, os.IsNotExist(statErr), "inspection layout directory must be cleaned up")
	packager.AssertExpectations(t)
}

func TestCanonicalMismatchDiagnosticIsActionable(t *testing.T) {
	err := &canonicalNameMismatchError{deployedName: "deployed-name", canonicalName: "canonical-name", namespace: "team-a"}

	detail := canonicalIdentityDetail(err)

	assert.Equal(t, "Cannot manage package with non-canonical deployment name", canonicalIdentitySummary(err))
	assert.Contains(t, detail, "deployed-name")
	assert.Contains(t, detail, "canonical-name")
	assert.Contains(t, detail, "team-a")
	assert.Contains(t, detail, "tofu state rm")
	assert.NotContains(t, detail, "configure the name")
}

func TestPackageResource_ImportStatePreservesSupportedIDsWithoutMutation(t *testing.T) {
	for _, id := range []string{"test-pkg", "team-a:test-pkg"} {
		t.Run(id, func(t *testing.T) {
			cluster := &MockCluster{}
			packager := &MockPackager{}
			packageResource := NewPackageResource(nil, packager, nil, cluster).(*PackageResource)
			var schemaResp resource.SchemaResponse
			packageResource.Schema(context.Background(), resource.SchemaRequest{}, &schemaResp)
			resp := resource.ImportStateResponse{State: tfsdk.State{
				Schema: schemaResp.Schema,
				Raw:    tftypes.NewValue(schemaResp.Schema.Type().TerraformType(context.Background()), nil),
			}}

			packageResource.ImportState(context.Background(), resource.ImportStateRequest{ID: id}, &resp)

			require.False(t, resp.Diagnostics.HasError(), "import diagnostics: %v", resp.Diagnostics)
			var imported PackageResourceModel
			require.False(t, resp.State.Get(context.Background(), &imported).HasError())
			assert.Equal(t, id, imported.ID.ValueString())
			cluster.AssertNotCalled(t, "NewWithWait", mock.Anything)
			packager.AssertNotCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
			packager.AssertNotCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
			packager.AssertNotCalled(t, "Remove", mock.Anything, mock.Anything, mock.Anything)
		})
	}
}

func TestGetOptionalComponentsToRemove(t *testing.T) {
	tests := []struct {
		name                  string
		newPlanComponentNames []string
		oldPlanComponentNames []string
		expectedComponents    []string
	}{
		{
			name: "identifical components returns empty list",
			newPlanComponentNames: []string{
				"component-1",
			},
			oldPlanComponentNames: []string{
				"component-1",
			},
			expectedComponents: []string{},
		},
		{
			name: "single component removed from new plan returns removed components",
			newPlanComponentNames: []string{
				"component-1",
			},
			oldPlanComponentNames: []string{
				"component-1",
				"component-2",
			},
			expectedComponents: []string{"component-2"},
		},
		{
			name: "multiple components removed from new plan returns removed components",
			newPlanComponentNames: []string{
				"component-1",
				"component-2",
			},
			oldPlanComponentNames: []string{
				"component-1",
				"component-2",
				"component-3",
				"component-4",
			},
			expectedComponents: []string{"component-3", "component-4"},
		},
		{
			name: "new plan with additional components without removing any returns an empty list",
			newPlanComponentNames: []string{
				"component-1",
				"component-2",
				"component-3",
				"component-4",
			},
			oldPlanComponentNames: []string{
				"component-1",
				"component-2",
			},
			expectedComponents: []string{},
		},
		{
			name: "new plan with additional components and removed components returns only removed components",
			newPlanComponentNames: []string{
				"component-1",
				"component-3",
				"component-4",
			},
			oldPlanComponentNames: []string{
				"component-1",
				"component-2",
			},
			expectedComponents: []string{"component-2"},
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			newPlan := NewTestPackageResourceModel(
				WithComponents(NewComponentModelsFromNames(tc.newPlanComponentNames)),
			)
			oldPlan := NewTestPackageResourceModel(
				WithComponents(NewComponentModelsFromNames(tc.oldPlanComponentNames)),
			)

			componentsToRemove := getMissingComponents(newPlan, oldPlan)

			assert.Equal(t, len(tc.expectedComponents), len(componentsToRemove))
			for i := range componentsToRemove {
				assert.Equal(t, tc.expectedComponents[i], componentsToRemove[i])
			}
		})
	}
}

func TestGetMissingOptionalComponents(t *testing.T) {
	tests := []struct {
		name     string
		oldPlan  PackageResourceModel
		newPlan  PackageResourceModel
		expected []string
	}{
		{
			name:     "returns old optional for removal when old has one optional and new is empty",
			oldPlan:  NewTestPackageResourceModel(WithOptionalComponents([]string{"metrics"})),
			newPlan:  NewTestPackageResourceModel(WithOptionalComponents([]string{})),
			expected: []string{"metrics"},
		},
		{
			name:     "returns removed optional when old has two optionals and new keeps one",
			oldPlan:  NewTestPackageResourceModel(WithOptionalComponents([]string{"metrics", "logging"})),
			newPlan:  NewTestPackageResourceModel(WithOptionalComponents([]string{"logging"})),
			expected: []string{"metrics"},
		},
		{
			name:     "returns nothing when old and new are identical",
			oldPlan:  NewTestPackageResourceModel(WithOptionalComponents([]string{"metrics"})),
			newPlan:  NewTestPackageResourceModel(WithOptionalComponents([]string{"metrics"})),
			expected: nil,
		},
		{
			name:     "returns nothing when old is null on the legacy path",
			oldPlan:  NewTestPackageResourceModel(),
			newPlan:  NewTestPackageResourceModel(WithOptionalComponents([]string{})),
			expected: nil,
		},
		{
			name:     "returns nothing when new is null on the legacy path",
			oldPlan:  NewTestPackageResourceModel(WithOptionalComponents([]string{"metrics"})),
			newPlan:  NewTestPackageResourceModel(),
			expected: nil,
		},
		{
			name: "returns nothing when old optional_components is unknown",
			oldPlan: func() PackageResourceModel {
				model := NewTestPackageResourceModel()
				model.OptionalComponents = types.SetUnknown(types.StringType)
				return model
			}(),
			newPlan:  NewTestPackageResourceModel(WithOptionalComponents([]string{})),
			expected: nil,
		},
		{
			name:    "returns nothing when new optional_components is unknown",
			oldPlan: NewTestPackageResourceModel(WithOptionalComponents([]string{"metrics"})),
			newPlan: func() PackageResourceModel {
				model := NewTestPackageResourceModel()
				model.OptionalComponents = types.SetUnknown(types.StringType)
				return model
			}(),
			expected: nil,
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			result := getMissingOptionalComponents(tc.newPlan, tc.oldPlan)
			assert.Equal(t, tc.expected, result)
		})
	}
}

func TestUpdate_RemoveComponents(t *testing.T) {
	tests := []struct {
		name               string
		componentsToRemove []string
		removeCalled       bool
	}{
		{
			name:               "remove single component",
			componentsToRemove: []string{"this-is-my-component"},
			removeCalled:       true,
		},
		{
			name:               "remove no components",
			componentsToRemove: []string{},
			removeCalled:       false,
		},
		{
			name:               "remove multiple components",
			componentsToRemove: []string{"this-is-my-component", "this-is-also-a-component"},
			removeCalled:       true,
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			mockPackageComponentFilter := &MockPackageComponentFilter{}
			mockPackageComponentFilter.On("ForRemove", mock.Anything).Return(mock.Anything)

			mockCluster := MockCluster{}
			cluster := zarfCluster.Cluster{}
			mockCluster.On("NewWithWait", mock.Anything).Return(&cluster, nil)

			mockPackager := &MockPackager{}
			zarfPackage := v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-package"}}
			mockPackager.On("GetPackageFromSourceOrCluster", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(zarfPackage, nil)
			mockPackager.On("Remove", mock.Anything, mock.Anything, mock.Anything).Return(nil)

			packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, &mockCluster).(*PackageResource)

			// This is the meat of the test!
			plan := NewTestPackageResourceModel()
			err := packageResource.removeComponents(testCtx(t), plan, tc.componentsToRemove, testPackageIdentity(""))

			// Assertions
			assert.NoError(t, err)

			// Check that Deploy was called and the variables map was provided with the correct values
			for _, call := range mockPackager.Calls {
				if call.Method == "Deploy" {
					deployOptions := call.Arguments[2].(zarfPackager.DeployOptions)
					assert.NotNil(t, deployOptions.SetVariables)
				}
			}

			if tc.removeCalled {
				// Validate that a remove filter was created with the correct inputs
				mockPackageComponentFilter.AssertExpectations(t)
				for _, call := range mockPackageComponentFilter.Calls {
					if call.Method == "ForRemove" {
						forRemoveOptions := call.Arguments[0].([]string)
						assert.Equal(t, len(tc.componentsToRemove), len(forRemoveOptions))
						for i := range forRemoveOptions {
							assert.Equal(t, tc.componentsToRemove[i], forRemoveOptions[i])
						}
					}
				}

				// Validate that the remove function was called
				mockPackager.AssertExpectations(t)
			} else {
				// Verify that functions were not called if we did not expect them to be
				mockPackageComponentFilter.AssertNotCalled(t, "ForRemove")
				mockCluster.AssertNotCalled(t, "NewWithWait")
				mockPackager.AssertNotCalled(t, "GetPackageFromSourceOrCluster")
				mockPackager.AssertNotCalled(t, "Remove")
			}
		})
	}
}

func TestPackageResource_RemoveComponentsUsesNegotiatedSourceOptions(t *testing.T) {
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		w.WriteHeader(http.StatusUnauthorized)
	}))
	defer server.Close()

	mockPackageComponentFilter := &MockPackageComponentFilter{}
	mockPackageComponentFilter.On("ForRemove", mock.Anything).Return(mock.Anything)
	mockCluster := &MockCluster{}
	cluster := zarfCluster.Cluster{}
	mockCluster.On("NewWithWait", mock.Anything).Return(&cluster, nil)
	mockPackager := &MockPackager{}
	mockPackager.On("GetPackageFromSourceOrCluster", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).
		Return(v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-package"}}, nil)
	mockPackager.On("Remove", mock.Anything, mock.Anything, mock.Anything).Return(nil)

	packageResource := NewPackageResource(
		&udsProviderConfig{InsecureForceHTTP: true},
		mockPackager,
		mockPackageComponentFilter,
		mockCluster,
	).(*PackageResource)
	plan := NewTestPackageResourceModel(WithSource(testOCISource(server.URL)))

	err := packageResource.removeComponents(testCtx(t), plan, []string{"component-a"}, testPackageIdentity(""))
	require.NoError(t, err)

	loadOptions := mockPackager.Calls[0].Arguments[4].(zarfPackager.LoadOptions)
	assert.True(t, loadOptions.PlainHTTP)
}

func TestUpdate_TimeoutOnlyChangeSkipsPackageOperations(t *testing.T) {
	mockCluster := &MockCluster{}
	mockPackager := &MockPackager{}
	mockFilter := &MockPackageComponentFilter{}
	r := NewPackageResource(nil, mockPackager, mockFilter, mockCluster).(*PackageResource)

	stateModel := NewTestPackageResourceModel(
		WithTimeout("30m"),
		WithDeployedState(),
		WithOptionalComponents([]string{}),
	)
	planModel := stateModel
	WithTimeout("45m")(&planModel)
	planModel.ID = types.StringUnknown()
	planModel.Name = types.StringUnknown()
	planModel.Kind = types.StringUnknown()
	planModel.Version = types.StringUnknown()
	planModel.Metadata = types.ObjectUnknown(packageMetadataAttrTypes)
	planModel.ConnectStrings = types.SetUnknown(types.ObjectType{AttrTypes: connectStringAttrTypes})
	planModel.SetVariables = types.MapUnknown(types.StringType)

	plan := buildTestPlan(t, r, planModel)
	state := buildTestState(t, r, stateModel)
	resp := resource.UpdateResponse{State: tfsdk.State{Schema: plan.Schema}}
	r.Update(context.Background(), resource.UpdateRequest{Plan: plan, State: state}, &resp)

	require.False(t, resp.Diagnostics.HasError(), "expected no error: %v", resp.Diagnostics)
	mockCluster.AssertNotCalled(t, "NewWithWait")
	mockPackager.AssertNotCalled(t, "LoadPackage")
	mockPackager.AssertNotCalled(t, "GetPackageFromSourceOrCluster")
	mockPackager.AssertNotCalled(t, "Deploy")
	mockPackager.AssertNotCalled(t, "Remove")
	mockFilter.AssertNotCalled(t, "ForDeploy")
	mockFilter.AssertNotCalled(t, "ForRemove")

	var updated PackageResourceModel
	resp.Diagnostics.Append(resp.State.Get(context.Background(), &updated)...)
	require.False(t, resp.Diagnostics.HasError(), "failed to read updated state: %v", resp.Diagnostics)
	assert.True(t, updated.Timeouts.Equal(planModel.Timeouts))
	assert.Equal(t, stateModel.Name, updated.Name)
	assert.Equal(t, stateModel.Metadata, updated.Metadata)
	assert.Equal(t, stateModel.ConnectStrings, updated.ConnectStrings)
	assert.Equal(t, stateModel.SetVariables, updated.SetVariables)
}

func TestPackageResource_UpdateSuccessfulDeploymentRefreshesState(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout
	deployedPackage := newLifecycleDeployedPackage(packageLayout,
		zarfState.DeployedComponent{Name: "test-required-component-0", Status: zarfState.ComponentStatusSucceeded},
		zarfState.DeployedComponent{Name: "test-optional-non-default-component-0", Status: zarfState.ComponentStatusSucceeded},
	)
	deployedPackage.Digest = "sha256:updated"
	deployedPackage.Generation = 10
	deployedPackage.NamespaceOverride = "updated"
	existingPackage := newLifecycleDeployedPackage(packageLayout)
	clientset := fake.NewSimpleClientset(newPackageStateSecret(t, existingPackage))
	mockCluster := &MockCluster{}
	mockCluster.On("NewWithWait", mock.Anything).Return(&zarfCluster.Cluster{Clientset: clientset}, nil).Twice()
	mockPackager := &MockPackager{}
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil).Twice()
	mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Run(func(_ mock.Arguments) {
		_, err := clientset.CoreV1().Secrets(zarfState.ZarfNamespaceName).Create(
			context.Background(),
			newPackageStateSecret(t, deployedPackage),
			metav1.CreateOptions{},
		)
		require.NoError(t, err)
	}).Return(packager.DeployResult{DeployedComponents: []zarfState.DeployedComponent{
		{Name: "test-required-component-0"},
		{Name: "test-optional-default-component-0"},
	}}, nil)
	mockPackageComponentFilter := &MockPackageComponentFilter{}
	mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, mockCluster).(*PackageResource)
	stateModel := NewTestPackageResourceModel(WithTimeout("30m"), WithDeployedState())
	stateModel.ID = types.StringValue(packageLayout.AsV1alpha1().Metadata.Name)
	stateModel.Name = types.StringValue(packageLayout.AsV1alpha1().Metadata.Name)
	planModel := stateModel
	WithNamespace("updated")(&planModel)
	// Conflict with the cluster values above to prove known planned values win.
	WithArchitecture("arm64")(&planModel)
	WithOptionalComponents([]string{"test-optional-default-component-0"})(&planModel)

	resp := runUpdateLifecycleTest(t, packageResource, planModel, stateModel)

	require.False(t, resp.Diagnostics.HasError(), "update diagnostics: %v", resp.Diagnostics)
	updated := requirePackageState(t, resp.State)
	assert.Equal(t, "arm64", updated.Architecture.ValueString())
	assert.Equal(t, []string{"test-optional-default-component-0"}, mustStringSetElements(t, updated.OptionalComponents))
	assertPackageMetadata(t, updated.Metadata, "Succeeded", 10, "sha256:updated")
}

func TestPackageResource_UpdateFailedDeploymentDoesNotReplaceStateOrRemove(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout
	existingPackage := newLifecycleDeployedPackage(packageLayout)
	mockCluster := &MockCluster{}
	mockCluster.On("NewWithWait", mock.Anything).Return(&zarfCluster.Cluster{Clientset: fake.NewSimpleClientset(newPackageStateSecret(t, existingPackage))}, nil).Once()
	mockPackager := &MockPackager{}
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil).Twice()
	mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, errors.New("update deployment failed"))
	mockPackageComponentFilter := &MockPackageComponentFilter{}
	mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, mockCluster).(*PackageResource)
	stateModel := NewTestPackageResourceModel(WithTimeout("30m"), WithDeployedState())
	stateModel.ID = types.StringValue(packageLayout.AsV1alpha1().Metadata.Name)
	stateModel.Name = types.StringValue(packageLayout.AsV1alpha1().Metadata.Name)
	planModel := stateModel
	WithNamespace("updated")(&planModel)

	resp := runUpdateLifecycleTest(t, packageResource, planModel, stateModel)

	require.True(t, resp.Diagnostics.HasError())
	assert.Contains(t, resp.Diagnostics.Errors()[0].Detail(), "update deployment failed")
	assert.True(t, resp.State.Raw.IsNull())
	mockPackager.AssertNotCalled(t, "Remove", mock.Anything, mock.Anything, mock.Anything)
}

func TestModifyPlan_TimeoutOnlyChangePreservesComputedState(t *testing.T) {
	mockPackager := &MockPackager{}
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).
		Return((*layout.PackageLayout)(nil), errors.New("package source unavailable"))
	r := NewPackageResource(
		&udsProviderConfig{ValidatePackagesOnPlan: true},
		mockPackager,
		nil,
		nil,
	).(*PackageResource)
	stateModel := NewTestPackageResourceModel(
		WithTimeout("30m"),
		WithDeployedState(),
		WithOptionalComponents([]string{}),
	)
	planModel := stateModel
	WithTimeout("45m")(&planModel)
	planModel.ID = types.StringUnknown()
	planModel.Name = types.StringUnknown()
	planModel.Kind = types.StringUnknown()
	planModel.Version = types.StringUnknown()
	planModel.Metadata = types.ObjectUnknown(packageMetadataAttrTypes)
	planModel.ConnectStrings = types.SetUnknown(types.ObjectType{AttrTypes: connectStringAttrTypes})
	planModel.SetVariables = types.MapUnknown(types.StringType)

	plan := buildTestPlan(t, r, planModel)
	resp := resource.ModifyPlanResponse{Plan: plan}
	r.ModifyPlan(context.Background(), resource.ModifyPlanRequest{
		Config: buildTestConfig(t, r, planModel),
		Plan:   plan,
		State:  buildTestState(t, r, stateModel),
	}, &resp)

	require.False(t, resp.Diagnostics.HasError(), "expected no error: %v", resp.Diagnostics)
	var updatedPlan PackageResourceModel
	resp.Diagnostics.Append(resp.Plan.Get(context.Background(), &updatedPlan)...)
	require.False(t, resp.Diagnostics.HasError(), "failed to read updated plan: %v", resp.Diagnostics)
	assert.True(t, updatedPlan.Timeouts.Equal(planModel.Timeouts))
	assert.Equal(t, stateModel.ID, updatedPlan.ID)
	assert.Equal(t, stateModel.Name, updatedPlan.Name)
	assert.Equal(t, stateModel.Kind, updatedPlan.Kind)
	assert.Equal(t, stateModel.Version, updatedPlan.Version)
	assert.Equal(t, stateModel.Metadata, updatedPlan.Metadata)
	assert.Equal(t, stateModel.ConnectStrings, updatedPlan.ConnectStrings)
	assert.Equal(t, stateModel.SetVariables, updatedPlan.SetVariables)
	mockPackager.AssertNotCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
}

func TestModifyPlan_RejectsPriorAliasWithoutClusterLookup(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout
	packager := &MockPackager{}
	packager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil).Once()
	cluster := &MockCluster{}
	packageResource := NewPackageResource(
		&udsProviderConfig{ValidatePackagesOnPlan: true},
		packager,
		nil,
		cluster,
	).(*PackageResource)
	stateModel := NewTestPackageResourceModel(WithDeployedState())
	stateModel.ID = types.StringValue("test-package-alias")
	stateModel.Name = types.StringValue("test-package-alias")
	planModel := stateModel
	plan := buildTestPlan(t, packageResource, planModel)
	resp := resource.ModifyPlanResponse{Plan: plan}

	packageResource.ModifyPlan(context.Background(), resource.ModifyPlanRequest{
		Config: buildTestConfig(t, packageResource, planModel),
		Plan:   plan,
		State:  buildTestState(t, packageResource, stateModel),
	}, &resp)

	require.True(t, resp.Diagnostics.HasError())
	assert.Equal(t, "Cannot manage package with non-canonical deployment name", resp.Diagnostics.Errors()[0].Summary())
	assert.Contains(t, resp.Diagnostics.Errors()[0].Detail(), "test-package-alias")
	cluster.AssertNotCalled(t, "NewWithWait", mock.Anything)
	packager.AssertExpectations(t)
}

func TestModifyPlan_DefersPriorAliasWhenPackageValidationIsDisabled(t *testing.T) {
	packager := &MockPackager{}
	cluster := &MockCluster{}
	packageResource := NewPackageResource(
		&udsProviderConfig{ValidatePackagesOnPlan: false},
		packager,
		nil,
		cluster,
	).(*PackageResource)
	stateModel := NewTestPackageResourceModel(WithDeployedState())
	stateModel.ID = types.StringValue("test-package-alias")
	stateModel.Name = types.StringValue("test-package-alias")
	planModel := stateModel
	plan := buildTestPlan(t, packageResource, planModel)
	resp := resource.ModifyPlanResponse{Plan: plan}

	packageResource.ModifyPlan(context.Background(), resource.ModifyPlanRequest{
		Config: buildTestConfig(t, packageResource, planModel),
		Plan:   plan,
		State:  buildTestState(t, packageResource, stateModel),
	}, &resp)

	require.False(t, resp.Diagnostics.HasError(), "plan diagnostics: %v", resp.Diagnostics)
	packager.AssertNotCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
	cluster.AssertNotCalled(t, "NewWithWait", mock.Anything)
}

func TestModifyPlan_UsesPriorIdentityForPlannedNamespaceReplacement(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout
	packager := &MockPackager{}
	packager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil).Once()
	cluster := &MockCluster{}
	packageResource := NewPackageResource(&udsProviderConfig{ValidatePackagesOnPlan: true}, packager, nil, cluster).(*PackageResource)
	stateModel := NewTestPackageResourceModel(WithDeployedState(), WithNamespace("team-a"))
	stateModel.ID = types.StringValue("team-a:test-package")
	stateModel.Name = types.StringValue("test-package")
	planModel := stateModel
	WithNamespace("team-b")(&planModel)
	plan := buildTestPlan(t, packageResource, planModel)
	resp := resource.ModifyPlanResponse{Plan: plan}

	packageResource.ModifyPlan(context.Background(), resource.ModifyPlanRequest{
		Config: buildTestConfig(t, packageResource, planModel),
		Plan:   plan,
		State:  buildTestState(t, packageResource, stateModel),
	}, &resp)

	require.False(t, resp.Diagnostics.HasError(), "plan diagnostics: %v", resp.Diagnostics)
	packager.AssertExpectations(t)
	cluster.AssertNotCalled(t, "NewWithWait", mock.Anything)
}

func TestModifyPlan_RejectsInconsistentPriorStateWithoutPackageOrClusterAccess(t *testing.T) {
	packager := &MockPackager{}
	cluster := &MockCluster{}
	packageResource := NewPackageResource(&udsProviderConfig{ValidatePackagesOnPlan: true}, packager, nil, cluster).(*PackageResource)
	stateModel := NewTestPackageResourceModel(WithDeployedState())
	stateModel.Name = types.StringValue("stale-name")
	planModel := stateModel
	planModel.Source = types.StringValue("oci://ghcr.io/defenseunicorns/packages/test:updated")
	plan := buildTestPlan(t, packageResource, planModel)
	resp := resource.ModifyPlanResponse{Plan: plan}

	packageResource.ModifyPlan(context.Background(), resource.ModifyPlanRequest{
		Config: buildTestConfig(t, packageResource, planModel),
		Plan:   plan,
		State:  buildTestState(t, packageResource, stateModel),
	}, &resp)

	require.True(t, resp.Diagnostics.HasError())
	assert.Equal(t, "Prior package state is inconsistent", resp.Diagnostics.Errors()[0].Summary())
	packager.AssertNotCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
	cluster.AssertNotCalled(t, "NewWithWait", mock.Anything)
}

func TestModifyPlan_DefersCanonicalCheckForUnknownSourceOrIncompletePriorIdentity(t *testing.T) {
	tests := []struct {
		name   string
		config func(*PackageResourceModel, *PackageResourceModel)
	}{
		{name: "unknown source", config: func(plan, _ *PackageResourceModel) { plan.Source = types.StringUnknown() }},
		{name: "incomplete prior identity", config: func(_, state *PackageResourceModel) { state.Name = types.StringNull() }},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			packager := &MockPackager{}
			cluster := &MockCluster{}
			packageResource := NewPackageResource(&udsProviderConfig{ValidatePackagesOnPlan: true}, packager, nil, cluster).(*PackageResource)
			stateModel := NewTestPackageResourceModel(WithDeployedState(), WithSignatureVerificationEnabled(false))
			planModel := stateModel
			planModel.Source = types.StringValue("oci://ghcr.io/defenseunicorns/packages/test:updated")
			tc.config(&planModel, &stateModel)
			plan := buildTestPlan(t, packageResource, planModel)
			resp := resource.ModifyPlanResponse{Plan: plan}

			packageResource.ModifyPlan(context.Background(), resource.ModifyPlanRequest{
				Config: buildTestConfig(t, packageResource, planModel),
				Plan:   plan,
				State:  buildTestState(t, packageResource, stateModel),
			}, &resp)

			require.False(t, resp.Diagnostics.HasError(), "plan diagnostics: %v", resp.Diagnostics)
			packager.AssertNotCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
			cluster.AssertNotCalled(t, "NewWithWait", mock.Anything)
		})
	}
}

func TestModifyPlan_StateOnlyAndPackageChangeRunsPackageChecks(t *testing.T) {
	mockPackager := &MockPackager{}
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).
		Return((*layout.PackageLayout)(nil), errors.New("package source unavailable"))
	r := NewPackageResource(
		&udsProviderConfig{ValidatePackagesOnPlan: true},
		mockPackager,
		nil,
		nil,
	).(*PackageResource)
	stateModel := NewTestPackageResourceModel(
		WithTimeout("30m"),
		WithDeployedState(),
		WithOptionalComponents([]string{}),
	)
	planModel := stateModel
	WithTimeout("45m")(&planModel)
	WithNamespace("changed")(&planModel)

	plan := buildTestPlan(t, r, planModel)
	resp := resource.ModifyPlanResponse{Plan: plan}
	r.ModifyPlan(context.Background(), resource.ModifyPlanRequest{
		Config: buildTestConfig(t, r, planModel),
		Plan:   plan,
		State:  buildTestState(t, r, stateModel),
	}, &resp)

	require.True(t, resp.Diagnostics.HasError())
	assert.Contains(t, resp.Diagnostics.Errors()[0].Summary(), "Cannot verify package canonical name")
	mockPackager.AssertCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
}

func TestIsStateOnlyUpdate_RejectsNonAllowlistedChange(t *testing.T) {
	r := NewPackageResource(nil, nil, nil, nil).(*PackageResource)
	stateModel := NewTestPackageResourceModel(WithTimeout("30m"), WithDeployedState())
	planModel := stateModel
	WithTimeout("45m")(&planModel)
	WithNamespace("changed")(&planModel)

	stateOnly, err := isStateOnlyUpdate(
		buildTestPlan(t, r, planModel),
		buildTestState(t, r, stateModel),
	)

	require.NoError(t, err)
	assert.False(t, stateOnly)
}

func TestValidateOptionalComponentsAgainstPackage(t *testing.T) {
	boolTrue := true
	pkgComponents := []v1alpha1.ZarfComponent{
		{Name: "required-comp", Required: &boolTrue},
		{Name: "optional-a"},
		{Name: "optional-b"},
	}

	tests := []struct {
		name          string
		requested     []string
		pkgComponents []v1alpha1.ZarfComponent
		expectError   bool
		errorContains []string
	}{
		{
			name:          "valid optional component passes",
			requested:     []string{"optional-a"},
			pkgComponents: pkgComponents,
			expectError:   false,
		},
		{
			name:          "unknown name errors and lists valid optionals",
			requested:     []string{"does-not-exist"},
			pkgComponents: pkgComponents,
			expectError:   true,
			errorContains: []string{`"does-not-exist"`, `"optional-a"`, `"optional-b"`},
		},
		{
			name:          "required component name errors and lists valid optionals",
			requested:     []string{"required-comp"},
			pkgComponents: pkgComponents,
			expectError:   true,
			errorContains: []string{`"required-comp"`, `"optional-a"`, `"optional-b"`},
		},
		{
			name:          "multiple invalid names all shown",
			requested:     []string{"bad-one", "bad-two", "optional-a"},
			pkgComponents: pkgComponents,
			expectError:   true,
			errorContains: []string{`"bad-one"`, `"bad-two"`},
		},
		{
			name:          "package with no optionals reports specific message",
			requested:     []string{"anything"},
			pkgComponents: []v1alpha1.ZarfComponent{{Name: "only-required", Required: &boolTrue}},
			expectError:   true,
			errorContains: []string{"no optional components"},
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			err := validateOptionalComponentsAgainstPackage(tc.requested, tc.pkgComponents)
			if tc.expectError {
				assert.NotNil(t, err)
				for _, s := range tc.errorContains {
					assert.Contains(t, err.Error(), s)
				}
			} else {
				assert.Nil(t, err)
			}
		})
	}
}

func TestDeployAsNewOrUpdate_OptionalComponentRemoval(t *testing.T) {
	boolFalse := false
	zarfPkg := v1alpha1.ZarfPackage{
		Metadata: v1alpha1.ZarfMetadata{Name: "test-package"},
		Components: []v1alpha1.ZarfComponent{
			{Name: "metrics", Required: &boolFalse},
		},
	}

	mockCluster := MockCluster{}
	cluster := zarfCluster.Cluster{}
	mockCluster.On("NewWithWait", mock.Anything).Return(&cluster, nil)

	mockPackager := &MockPackager{}
	mockPackager.On("GetPackageFromSourceOrCluster", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(zarfPkg, nil)
	mockPackager.On("Remove", mock.Anything, mock.Anything, mock.Anything).Return(nil)
	validResult := newValidLoadPackageResult()
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(validResult.Layout, nil)
	mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)

	mockPackageComponentFilter := &MockPackageComponentFilter{}
	mockPackageComponentFilter.On("ForRemove", mock.Anything).Return(mock.Anything)
	mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

	oldPlan := NewTestPackageResourceModel(WithOptionalComponents([]string{"metrics"}))
	newPlan := NewTestPackageResourceModel(WithOptionalComponents([]string{}))
	identity := deployedPackageIdentity{
		ID: "test-package", Name: "test-package",
		Package: zarfState.DeployedPackage{Name: "test-package", Data: v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-package"}}},
	}

	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, &mockCluster).(*PackageResource)
	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
	defer cancel()
	_, err := packageResource.deployAsNewOrUpdate(ctx, newPlan, oldPlan, identity)

	assert.NoError(t, err)

	var forRemoveArgs []string
	for _, call := range mockPackageComponentFilter.Calls {
		if call.Method == "ForRemove" {
			forRemoveArgs = call.Arguments[0].([]string)
		}
	}
	assert.Equal(t, []string{"metrics"}, forRemoveArgs, "ForRemove should be called with the removed optional component")
	mockPackager.AssertCalled(t, "Remove", mock.Anything, mock.Anything, mock.Anything)
}

func TestDeployAsNewOrUpdate_RemovalFailureSkipsUpsert(t *testing.T) {
	boolFalse := false
	zarfPkg := v1alpha1.ZarfPackage{
		Metadata: v1alpha1.ZarfMetadata{Name: "test-package"},
		Components: []v1alpha1.ZarfComponent{
			{Name: "metrics", Required: &boolFalse},
		},
	}

	mockCluster := MockCluster{}
	cluster := zarfCluster.Cluster{}
	mockCluster.On("NewWithWait", mock.Anything).Return(&cluster, nil)

	mockPackager := &MockPackager{}
	mockPackager.On("GetPackageFromSourceOrCluster", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return(zarfPkg, nil)
	mockPackager.On("Remove", mock.Anything, mock.Anything, mock.Anything).Return(fmt.Errorf("remove failed"))

	mockPackageComponentFilter := &MockPackageComponentFilter{}
	mockPackageComponentFilter.On("ForRemove", mock.Anything).Return(mock.Anything)

	oldPlan := NewTestPackageResourceModel(WithOptionalComponents([]string{"metrics"}))
	newPlan := NewTestPackageResourceModel(WithOptionalComponents([]string{}))
	identity := deployedPackageIdentity{
		ID: "test-package", Name: "test-package",
		Package: zarfState.DeployedPackage{Name: "test-package", Data: v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-package"}}},
	}

	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, &mockCluster).(*PackageResource)
	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
	defer cancel()
	_, err := packageResource.deployAsNewOrUpdate(ctx, newPlan, oldPlan, identity)

	require.Error(t, err)
	assert.Contains(t, err.Error(), "remove failed")
	mockPackager.AssertNotCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
	mockPackager.AssertNotCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
}

func TestDeployAsNewOrUpdate_RejectsInvalidIdentityBeforeRemovalCalculation(t *testing.T) {
	packager := &MockPackager{}
	filter := &MockPackageComponentFilter{}
	cluster := &MockCluster{}
	packageResource := NewPackageResource(nil, packager, filter, cluster).(*PackageResource)
	oldPlan := NewTestPackageResourceModel(
		WithComponents(NewComponentModelsFromNames([]string{"legacy"})),
		WithOptionalComponents([]string{"optional"}),
	)
	newPlan := NewTestPackageResourceModel(
		WithComponents(NewComponentModelsFromNames(nil)),
		WithOptionalComponents([]string{}),
	)

	_, err := packageResource.deployAsNewOrUpdate(testCtx(t), newPlan, oldPlan, deployedPackageIdentity{})

	var identityErr *remoteIdentityError
	require.ErrorAs(t, err, &identityErr)
	filter.AssertNotCalled(t, "ForRemove", mock.Anything)
	filter.AssertNotCalled(t, "ForDeploy", mock.Anything)
	cluster.AssertNotCalled(t, "NewWithWait", mock.Anything)
	packager.AssertNotCalled(t, "GetPackageFromSourceOrCluster", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything)
	packager.AssertNotCalled(t, "Remove", mock.Anything, mock.Anything, mock.Anything)
	packager.AssertNotCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
	packager.AssertNotCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
}

func TestDeployAsNewOrUpdate_RevalidatesMutationPackageNames(t *testing.T) {
	t.Run("component removal load", func(t *testing.T) {
		cluster := &MockCluster{}
		cluster.On("NewWithWait", mock.Anything).Return(&zarfCluster.Cluster{}, nil).Once()
		packager := &MockPackager{}
		packager.On("GetPackageFromSourceOrCluster", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).
			Return(v1alpha1.ZarfPackage{
				Metadata:   v1alpha1.ZarfMetadata{Name: "changed-name"},
				Components: []v1alpha1.ZarfComponent{{Name: "optional"}},
			}, nil).Once()
		filter := &MockPackageComponentFilter{}
		filter.On("ForRemove", mock.Anything).Return(mock.Anything).Once()
		resource := NewPackageResource(nil, packager, filter, cluster).(*PackageResource)
		oldPlan := NewTestPackageResourceModel(WithOptionalComponents([]string{"optional"}))
		newPlan := NewTestPackageResourceModel(WithOptionalComponents([]string{}))

		result, err := resource.deployAsNewOrUpdate(testCtx(t), newPlan, oldPlan, testPackageIdentity(""))

		var mismatch *canonicalNameMismatchError
		require.ErrorAs(t, err, &mismatch)
		assert.Equal(t, newPlan.Name, result.Name)
		packager.AssertNotCalled(t, "Remove", mock.Anything, mock.Anything, mock.Anything)
		packager.AssertNotCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
		packager.AssertNotCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
	})

	t.Run("required component refilter load", func(t *testing.T) {
		required := true
		cluster := &MockCluster{}
		cluster.On("NewWithWait", mock.Anything).Return(&zarfCluster.Cluster{}, nil).Once()
		packager := &MockPackager{}
		packager.On("GetPackageFromSourceOrCluster", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).
			Return(v1alpha1.ZarfPackage{
				Metadata: v1alpha1.ZarfMetadata{Name: "test-package"},
				Components: []v1alpha1.ZarfComponent{
					{Name: "required", Required: &required},
					{Name: "optional"},
				},
			}, nil).Once()
		packager.On("GetPackageFromSourceOrCluster", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).
			Return(v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "changed-name"}}, nil).Once()
		filter := &MockPackageComponentFilter{}
		filter.On("ForRemove", mock.Anything).Return(mock.Anything).Twice()
		resource := NewPackageResource(nil, packager, filter, cluster).(*PackageResource)
		oldPlan := NewTestPackageResourceModel(WithComponents(NewComponentModelsFromNames([]string{"required", "optional"})))
		newPlan := NewTestPackageResourceModel(WithComponents(NewComponentModelsFromNames(nil)))

		result, err := resource.deployAsNewOrUpdate(testCtx(t), newPlan, oldPlan, testPackageIdentity(""))

		var mismatch *canonicalNameMismatchError
		require.ErrorAs(t, err, &mismatch)
		assert.Equal(t, newPlan.Name, result.Name)
		packager.AssertNotCalled(t, "Remove", mock.Anything, mock.Anything, mock.Anything)
		packager.AssertNotCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
		packager.AssertNotCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
	})

	t.Run("deployment load", func(t *testing.T) {
		packager := &MockPackager{}
		packager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(
			&layout.PackageLayout{PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{
				Metadata: v1alpha1.ZarfMetadata{Name: "changed-name"},
			})}, nil,
		).Once()
		filter := &MockPackageComponentFilter{}
		resource := NewPackageResource(nil, packager, filter, &MockCluster{}).(*PackageResource)
		newPlan := NewTestPackageResourceModel()

		result, err := resource.deployAsNewOrUpdate(testCtx(t), newPlan, newPlan, testPackageIdentity(""))

		var mismatch *canonicalNameMismatchError
		require.ErrorAs(t, err, &mismatch)
		assert.Equal(t, newPlan.Name, result.Name)
		filter.AssertNotCalled(t, "ForDeploy", mock.Anything)
		packager.AssertNotCalled(t, "Remove", mock.Anything, mock.Anything, mock.Anything)
		packager.AssertNotCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
	})
}

// Helper function to convert a slice of HelmChartPathValueModel to types.Set
func helmChartPathValueSliceToSet(values []HelmChartPathValueModel) types.Set {
	if len(values) == 0 {
		return types.SetNull(types.ObjectType{
			AttrTypes: map[string]attr.Type{
				"path":  types.StringType,
				"value": types.StringType,
			},
		})
	}

	elements := make([]attr.Value, len(values))
	for i, v := range values {
		elements[i] = types.ObjectValueMust(
			map[string]attr.Type{
				"path":  types.StringType,
				"value": types.StringType,
			},
			map[string]attr.Value{
				"path":  v.Path,
				"value": v.Value,
			},
		)
	}

	setValue, _ := types.SetValue(
		types.ObjectType{
			AttrTypes: map[string]attr.Type{
				"path":  types.StringType,
				"value": types.StringType,
			},
		},
		elements,
	)
	return setValue
}

// Helper function to convert a slice of ComponentChartValuesModel to types.Set
func componentChartValuesSliceToSet(overrides []ComponentChartValuesModel) types.Set {
	if len(overrides) == 0 {
		return types.SetNull(types.ObjectType{
			AttrTypes: map[string]attr.Type{
				"chart_name":       types.StringType,
				"values":           types.SetType{ElemType: types.ObjectType{AttrTypes: map[string]attr.Type{"path": types.StringType, "value": types.StringType}}},
				"sensitive_values": types.SetType{ElemType: types.ObjectType{AttrTypes: map[string]attr.Type{"path": types.StringType, "value": types.StringType}}},
			},
		})
	}

	elements := make([]attr.Value, len(overrides))
	pathValueSetType := types.SetType{ElemType: types.ObjectType{AttrTypes: map[string]attr.Type{"path": types.StringType, "value": types.StringType}}}

	for i, override := range overrides {
		// Ensure Values and SensitiveValues are properly initialized
		values := override.Values
		if values.IsNull() || values.IsUnknown() {
			values = types.SetNull(pathValueSetType.ElemType.(types.ObjectType))
		}
		sensitiveValues := override.SensitiveValues
		if sensitiveValues.IsNull() || sensitiveValues.IsUnknown() {
			sensitiveValues = types.SetNull(pathValueSetType.ElemType.(types.ObjectType))
		}

		elements[i] = types.ObjectValueMust(
			map[string]attr.Type{
				"chart_name":       types.StringType,
				"values":           pathValueSetType,
				"sensitive_values": pathValueSetType,
			},
			map[string]attr.Value{
				"chart_name":       override.ChartName,
				"values":           values,
				"sensitive_values": sensitiveValues,
			},
		)
	}

	setValue, _ := types.SetValue(
		types.ObjectType{
			AttrTypes: map[string]attr.Type{
				"chart_name":       types.StringType,
				"values":           types.SetType{ElemType: types.ObjectType{AttrTypes: map[string]attr.Type{"path": types.StringType, "value": types.StringType}}},
				"sensitive_values": types.SetType{ElemType: types.ObjectType{AttrTypes: map[string]attr.Type{"path": types.StringType, "value": types.StringType}}},
			},
		},
		elements,
	)
	return setValue
}

// Helper function to convert a slice of ComponentModel to types.Set
func componentSliceToSet(components []ComponentModel) types.Set {
	if len(components) == 0 {
		return types.SetNull(types.ObjectType{
			AttrTypes: map[string]attr.Type{
				"name": types.StringType,
				"override": types.SetType{ElemType: types.ObjectType{AttrTypes: map[string]attr.Type{
					"chart_name":       types.StringType,
					"values":           types.SetType{ElemType: types.ObjectType{AttrTypes: map[string]attr.Type{"path": types.StringType, "value": types.StringType}}},
					"sensitive_values": types.SetType{ElemType: types.ObjectType{AttrTypes: map[string]attr.Type{"path": types.StringType, "value": types.StringType}}},
				}}},
			},
		})
	}

	overrideSetType := types.SetType{ElemType: types.ObjectType{AttrTypes: map[string]attr.Type{
		"chart_name":       types.StringType,
		"values":           types.SetType{ElemType: types.ObjectType{AttrTypes: map[string]attr.Type{"path": types.StringType, "value": types.StringType}}},
		"sensitive_values": types.SetType{ElemType: types.ObjectType{AttrTypes: map[string]attr.Type{"path": types.StringType, "value": types.StringType}}},
	}}}

	elements := make([]attr.Value, len(components))
	for i, component := range components {
		overrides := component.Overrides
		if overrides.IsNull() || overrides.IsUnknown() {
			overrides = types.SetNull(overrideSetType.ElemType.(types.ObjectType))
		}

		elements[i] = types.ObjectValueMust(
			map[string]attr.Type{
				"name":     types.StringType,
				"override": overrideSetType,
			},
			map[string]attr.Value{
				"name":     component.Name,
				"override": overrides,
			},
		)
	}

	setValue, _ := types.SetValue(
		types.ObjectType{
			AttrTypes: map[string]attr.Type{
				"name":     types.StringType,
				"override": overrideSetType,
			},
		},
		elements,
	)
	return setValue
}

func malformedComponentSet() types.Set {
	return types.SetValueMust(types.StringType, []attr.Value{types.StringValue("not-a-component-block")})
}

func dynamicUnknownObjectAtPath(valuePath string) types.Dynamic {
	parts := strings.Split(valuePath, ".")
	value := attr.Value(types.DynamicUnknown())
	valueType := attr.Type(types.DynamicType)

	for i := len(parts) - 1; i >= 0; i-- {
		value = types.ObjectValueMust(
			map[string]attr.Type{parts[i]: valueType},
			map[string]attr.Value{parts[i]: value},
		)
		valueType = types.ObjectType{AttrTypes: map[string]attr.Type{parts[i]: valueType}}
	}

	return types.DynamicValue(value)
}

// Helper function to convert a slice of VariableModel to types.Set
func variableSliceToSet(vars []VariableModel) types.Set {
	if len(vars) == 0 {
		return types.SetNull(types.ObjectType{
			AttrTypes: map[string]attr.Type{
				"name":  types.StringType,
				"value": types.StringType,
			},
		})
	}

	elements := make([]attr.Value, len(vars))
	for i, v := range vars {
		elements[i] = types.ObjectValueMust(
			map[string]attr.Type{
				"name":  types.StringType,
				"value": types.StringType,
			},
			map[string]attr.Value{
				"name":  v.Name,
				"value": v.Value,
			},
		)
	}

	setValue, _ := types.SetValue(
		types.ObjectType{
			AttrTypes: map[string]attr.Type{
				"name":  types.StringType,
				"value": types.StringType,
			},
		},
		elements,
	)
	return setValue
}

// Unit test for flattenComponentOverrides function
func TestFlattenComponentOverrides(t *testing.T) {
	tests := []struct {
		name                  string
		input                 []ComponentModel
		expectedMap           map[string]map[string]map[string]any
		expectedErrorContains string
	}{
		{
			name: "single component without any chart overrides returns empty map",
			input: []ComponentModel{
				{
					Name:      types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{}),
				},
			},
			expectedMap:           map[string]map[string]map[string]any{},
			expectedErrorContains: "",
		},
		{
			name: "single component with single chart overrides block with no values or sensitive values returns empty map",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
						},
					}),
				},
			},
			expectedMap:           map[string]map[string]map[string]any{},
			expectedErrorContains: "",
		},
		{
			name: "single component with single chart overrides block with single simple path value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component1chart1path1Value")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"path1": "component1chart1path1Value",
					},
				},
			},
		},
		{
			name: "single component with single chart overrides block with single nested path value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component1chart1path1nestedPathValue")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"path1": map[string]any{
							"nestedPath": "component1chart1path1nestedPathValue",
						},
					},
				},
			},
		},
		{
			name: "single component with multiple chart overrides blocks each with single simple path value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component1chart1path1Value")},
							}),
						},
						{
							ChartName: types.StringValue("chart2"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component1chart2path1Value")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"path1": "component1chart1path1Value",
					},
					"chart2": {
						"path1": "component1chart2path1Value",
					},
				},
			},
		},
		{
			name: "single component with multiple chart overrides blocks each with single nested path value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component1chart1path1nestedPathValue")},
							}),
						},
						{
							ChartName: types.StringValue("chart2"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component1chart2path1nestedPathValue")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"path1": map[string]any{
							"nestedPath": "component1chart1path1nestedPathValue",
						},
					},
					"chart2": {
						"path1": map[string]any{
							"nestedPath": "component1chart2path1nestedPathValue",
						},
					},
				},
			},
		},
		{
			name: "single component with single chart overrides block with single simple path sensitive value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component1chart1sensitivePath1Value")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"sensitivePath1": "component1chart1sensitivePath1Value",
					},
				},
			},
		},
		{
			name: "single component with single chart overrides block with single nested path sensitive value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1.nestedPath"), Value: types.StringValue("component1chart1sensitivePath1nestedPathValue")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"sensitivePath1": map[string]any{
							"nestedPath": "component1chart1sensitivePath1nestedPathValue",
						},
					},
				},
			},
		},
		{
			name: "single component with multiple chart overrides blocks each with single simple path sensitive value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component1chart1sensitivePath1Value")},
							}),
						},
						{
							ChartName: types.StringValue("chart2"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component1chart2sensitivePath1Value")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"sensitivePath1": "component1chart1sensitivePath1Value",
					},
					"chart2": {
						"sensitivePath1": "component1chart2sensitivePath1Value",
					},
				},
			},
		},
		{
			name: "single component with multiple chart overrides blocks each with single nested path sensitive value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1.nestedPath"), Value: types.StringValue("component1chart1sensitivePath1nestedPathValue")},
							}),
						},
						{
							ChartName: types.StringValue("chart2"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1.nestedPath"), Value: types.StringValue("component1chart2sensitivePath1nestedPathValue")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"sensitivePath1": map[string]any{
							"nestedPath": "component1chart1sensitivePath1nestedPathValue",
						},
					},
					"chart2": {
						"sensitivePath1": map[string]any{
							"nestedPath": "component1chart2sensitivePath1nestedPathValue",
						},
					},
				},
			},
		},
		{
			name: "single component with single chart overrides block with single simple path value and single simple path sensitive value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component1chart1path1Value")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component1chart1sensitivePath1Value")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"path1":          "component1chart1path1Value",
						"sensitivePath1": "component1chart1sensitivePath1Value",
					},
				},
			},
		},
		{
			name: "single component with single chart overrides block with single nested path value and single nested path sensitive value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component1chart1path1nestedPathValue")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1.nestedPath"), Value: types.StringValue("component1chart1sensitivePath1nestedPathValue")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"path1": map[string]any{
							"nestedPath": "component1chart1path1nestedPathValue",
						},
						"sensitivePath1": map[string]any{
							"nestedPath": "component1chart1sensitivePath1nestedPathValue",
						},
					},
				},
			},
		},
		{
			name: "single component with multiple chart overrides blocks with both single simple path value and single simple path sensitive value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component1chart1path1Value")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component1chart1sensitivePath1Value")},
							}),
						},
						{
							ChartName: types.StringValue("chart2"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component1chart2path1Value")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component1chart2sensitivePath1Value")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"path1":          "component1chart1path1Value",
						"sensitivePath1": "component1chart1sensitivePath1Value",
					},
					"chart2": {
						"path1":          "component1chart2path1Value",
						"sensitivePath1": "component1chart2sensitivePath1Value",
					},
				},
			},
		},
		{
			name: "single component with multiple chart overrides blocks with both single nested path value and single nested path sensitive value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component1chart1path1nestedPathValue")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1.nestedPath"), Value: types.StringValue("component1chart1sensitivePath1nestedPathValue")},
							}),
						},
						{
							ChartName: types.StringValue("chart2"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component1chart2path1nestedPathValue")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1.nestedPath"), Value: types.StringValue("component1chart2sensitivePath1nestedPathValue")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"path1": map[string]any{
							"nestedPath": "component1chart1path1nestedPathValue",
						},
						"sensitivePath1": map[string]any{
							"nestedPath": "component1chart1sensitivePath1nestedPathValue",
						},
					},
					"chart2": {
						"path1": map[string]any{
							"nestedPath": "component1chart2path1nestedPathValue",
						},
						"sensitivePath1": map[string]any{
							"nestedPath": "component1chart2sensitivePath1nestedPathValue",
						},
					},
				},
			},
		},

		// MULTIPLE COMPONENTS
		{
			name: "multiple components without any chart overrides returns empty map",
			input: []ComponentModel{
				{
					Name:      types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{}),
				},
				{
					Name:      types.StringValue("component2"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{}),
				},
			},
			expectedMap:           map[string]map[string]map[string]any{},
			expectedErrorContains: "",
		},
		{
			name: "multiple components with single chart overrides block but no values or sensitive values returns empty map",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
						},
					}),
				},
				{
					Name: types.StringValue("component2"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
						},
					}),
				},
			},
			expectedMap:           map[string]map[string]map[string]any{},
			expectedErrorContains: "",
		},
		{
			name: "multiple components with single chart overrides block with single simple path value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component1chart1path1Value")},
							}),
						},
					}),
				},
				{
					Name: types.StringValue("component2"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component2chart1path1Value")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"path1": "component1chart1path1Value",
					},
				},
				"component2": {
					"chart1": {
						"path1": "component2chart1path1Value",
					},
				},
			},
		},
		{
			name: "multiple components with single chart overrides block each with single nested path value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component1chart1path1nestedPathValue")},
							}),
						},
					}),
				},
				{
					Name: types.StringValue("component2"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component2chart1path1nestedPathValue")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"path1": map[string]any{
							"nestedPath": "component1chart1path1nestedPathValue",
						},
					},
				},
				"component2": {
					"chart1": {
						"path1": map[string]any{
							"nestedPath": "component2chart1path1nestedPathValue",
						},
					},
				},
			},
		},
		//nolint:dupl // Test structure is similar to other multi-component tests, but tests specific scenario
		{
			name: "multiple components with multiple chart overrides blocks each with single simple path value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component1chart1path1Value")},
							}),
						},
						{
							ChartName: types.StringValue("chart2"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component1chart2path1Value")},
							}),
						},
					}),
				},
				{
					Name: types.StringValue("component2"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component2chart1path1Value")},
							}),
						},
						{
							ChartName: types.StringValue("chart2"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component2chart2path1Value")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"path1": "component1chart1path1Value",
					},
					"chart2": {
						"path1": "component1chart2path1Value",
					},
				},
				"component2": {
					"chart1": {
						"path1": "component2chart1path1Value",
					},
					"chart2": {
						"path1": "component2chart2path1Value",
					},
				},
			},
		},
		//nolint:dupl // Test structure is similar to other multi-component tests, but tests nested paths
		{
			name: "multiple components with multiple chart overrides blocks each with single nested path value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component1chart1path1nestedPathValue")},
							}),
						},
						{
							ChartName: types.StringValue("chart2"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component1chart2path1nestedPathValue")},
							}),
						},
					}),
				},
				{
					Name: types.StringValue("component2"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component2chart1path1nestedPathValue")},
							}),
						},
						{
							ChartName: types.StringValue("chart2"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component2chart2path1nestedPathValue")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"path1": map[string]any{
							"nestedPath": "component1chart1path1nestedPathValue",
						},
					},
					"chart2": {
						"path1": map[string]any{
							"nestedPath": "component1chart2path1nestedPathValue",
						},
					},
				},
				"component2": {
					"chart1": {
						"path1": map[string]any{
							"nestedPath": "component2chart1path1nestedPathValue",
						},
					},
					"chart2": {
						"path1": map[string]any{
							"nestedPath": "component2chart2path1nestedPathValue",
						},
					},
				},
			},
		},
		{
			name: "multiple components with single chart overrides block with single simple path sensitive value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component1chart1sensitivePath1Value")},
							}),
						},
					}),
				},
				{
					Name: types.StringValue("component2"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component2chart1sensitivePath1Value")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"sensitivePath1": "component1chart1sensitivePath1Value",
					},
				},
				"component2": {
					"chart1": {
						"sensitivePath1": "component2chart1sensitivePath1Value",
					},
				},
			},
		},
		{
			name: "multiple components with single chart overrides block with single nested path sensitive value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1.nestedPath"), Value: types.StringValue("component1chart1sensitivePath1nestedPathValue")},
							}),
						},
					}),
				},
				{
					Name: types.StringValue("component2"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1.nestedPath"), Value: types.StringValue("component2chart1sensitivePath1nestedPathValue")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"sensitivePath1": map[string]any{
							"nestedPath": "component1chart1sensitivePath1nestedPathValue",
						},
					},
				},
				"component2": {
					"chart1": {
						"sensitivePath1": map[string]any{
							"nestedPath": "component2chart1sensitivePath1nestedPathValue",
						},
					},
				},
			},
		},
		//nolint:dupl // Similar structure to regular values test, but tests sensitive values specifically
		{
			name: "multiple components with multiple chart overrides blocks each with single simple path sensitive value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component1chart1sensitivePath1Value")},
							}),
						},
						{
							ChartName: types.StringValue("chart2"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component1chart2sensitivePath1Value")},
							}),
						},
					}),
				},
				{
					Name: types.StringValue("component2"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component2chart1sensitivePath1Value")},
							}),
						},
						{
							ChartName: types.StringValue("chart2"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component2chart2sensitivePath1Value")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"sensitivePath1": "component1chart1sensitivePath1Value",
					},
					"chart2": {
						"sensitivePath1": "component1chart2sensitivePath1Value",
					},
				},
				"component2": {
					"chart1": {
						"sensitivePath1": "component2chart1sensitivePath1Value",
					},
					"chart2": {
						"sensitivePath1": "component2chart2sensitivePath1Value",
					},
				},
			},
		},
		{
			name: "multiple components with single chart overrides block with single simple path value and single simple path sensitive value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component1chart1path1Value")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component1chart1sensitivePath1Value")},
							}),
						},
					}),
				},
				{
					Name: types.StringValue("component2"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component2chart1path1Value")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component2chart1sensitivePath1Value")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"path1":          "component1chart1path1Value",
						"sensitivePath1": "component1chart1sensitivePath1Value",
					},
				},
				"component2": {
					"chart1": {
						"path1":          "component2chart1path1Value",
						"sensitivePath1": "component2chart1sensitivePath1Value",
					},
				},
			},
		},
		{
			name: "multiple components with single chart overrides block with single nested path value and single nested path sensitive value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component1chart1path1nestedPathValue")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1.nestedPath"), Value: types.StringValue("component1chart1sensitivePath1nestedPathValue")},
							}),
						},
					}),
				},
				{
					Name: types.StringValue("component2"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component2chart1path1nestedPathValue")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1.nestedPath"), Value: types.StringValue("component2chart1sensitivePath1nestedPathValue")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"path1": map[string]any{
							"nestedPath": "component1chart1path1nestedPathValue",
						},
						"sensitivePath1": map[string]any{
							"nestedPath": "component1chart1sensitivePath1nestedPathValue",
						},
					},
				},
				"component2": {
					"chart1": {
						"path1": map[string]any{
							"nestedPath": "component2chart1path1nestedPathValue",
						},
						"sensitivePath1": map[string]any{
							"nestedPath": "component2chart1sensitivePath1nestedPathValue",
						},
					},
				},
			},
		},
		//nolint:dupl // Test structure is similar to other multi-component tests, but tests both values and sensitive values with simple paths
		{
			name: "multiple components with multiple chart overrides blocks with both single simple path value and single simple path sensitive value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component1chart1path1Value")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component1chart1sensitivePath1Value")},
							}),
						},
						{
							ChartName: types.StringValue("chart2"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component1chart2path1Value")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component1chart2sensitivePath1Value")},
							}),
						},
					}),
				},
				{
					Name: types.StringValue("component2"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component2chart1path1Value")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component2chart1sensitivePath1Value")},
							}),
						},
						{
							ChartName: types.StringValue("chart2"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("component2chart2path1Value")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("component2chart2sensitivePath1Value")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"path1":          "component1chart1path1Value",
						"sensitivePath1": "component1chart1sensitivePath1Value",
					},
					"chart2": {
						"path1":          "component1chart2path1Value",
						"sensitivePath1": "component1chart2sensitivePath1Value",
					},
				},
				"component2": {
					"chart1": {
						"path1":          "component2chart1path1Value",
						"sensitivePath1": "component2chart1sensitivePath1Value",
					},
					"chart2": {
						"path1":          "component2chart2path1Value",
						"sensitivePath1": "component2chart2sensitivePath1Value",
					},
				},
			},
		},
		//nolint:dupl // Test structure is similar to other multi-component tests, but tests both values and sensitive values with nested paths
		{
			name: "multiple components with multiple chart overrides blocks with both single nested path value and single nested path sensitive value",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component1chart1path1nestedPathValue")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1.nestedPath"), Value: types.StringValue("component1chart1sensitivePath1nestedPathValue")},
							}),
						},
						{
							ChartName: types.StringValue("chart2"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component1chart2path1nestedPathValue")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1.nestedPath"), Value: types.StringValue("component1chart2sensitivePath1nestedPathValue")},
							}),
						},
					}),
				},
				{
					Name: types.StringValue("component2"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component2chart1path1nestedPathValue")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1.nestedPath"), Value: types.StringValue("component2chart1sensitivePath1nestedPathValue")},
							}),
						},
						{
							ChartName: types.StringValue("chart2"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("component2chart2path1nestedPathValue")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1.nestedPath"), Value: types.StringValue("component2chart2sensitivePath1nestedPathValue")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"path1": map[string]any{
							"nestedPath": "component1chart1path1nestedPathValue",
						},
						"sensitivePath1": map[string]any{
							"nestedPath": "component1chart1sensitivePath1nestedPathValue",
						},
					},
					"chart2": {
						"path1": map[string]any{
							"nestedPath": "component1chart2path1nestedPathValue",
						},
						"sensitivePath1": map[string]any{
							"nestedPath": "component1chart2sensitivePath1nestedPathValue",
						},
					},
				},
				"component2": {
					"chart1": {
						"path1": map[string]any{
							"nestedPath": "component2chart1path1nestedPathValue",
						},
						"sensitivePath1": map[string]any{
							"nestedPath": "component2chart1sensitivePath1nestedPathValue",
						},
					},
					"chart2": {
						"path1": map[string]any{
							"nestedPath": "component2chart2path1nestedPathValue",
						},
						"sensitivePath1": map[string]any{
							"nestedPath": "component2chart2sensitivePath1nestedPathValue",
						},
					},
				},
			},
		},
		{
			name: "unescaped integer value is converted to int type",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("replicaCount"), Value: types.StringValue("3")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"replicaCount": 3,
					},
				},
			},
		},
		{
			name: "unescaped float value is converted to float type",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("cpuLimit"), Value: types.StringValue("1.5")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"cpuLimit": 1.5,
					},
				},
			},
		},
		{
			name: "unescaped boolean true value is converted to bool type",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("enabled"), Value: types.StringValue("true")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"enabled": true,
					},
				},
			},
		},
		{
			name: "unescaped boolean false value is converted to bool type",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("debug"), Value: types.StringValue("false")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"debug": false,
					},
				},
			},
		},
		{
			name: "quoted string value remains as string type",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("port"), Value: types.StringValue("\"8080\"")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"port": "8080",
					},
				},
			},
		},
		{
			name: "mixed types with nested paths are properly converted",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("config.replicas"), Value: types.StringValue("5")},
								{Path: types.StringValue("config.enabled"), Value: types.StringValue("true")},
								{Path: types.StringValue("config.name"), Value: types.StringValue("\"my-app\"")},
								{Path: types.StringValue("config.timeout"), Value: types.StringValue("30.5")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"config": map[string]any{
							"replicas": 5,
							"enabled":  true,
							"name":     "my-app",
							"timeout":  30.5,
						},
					},
				},
			},
		},
		{
			name: "sensitive values with unescaped integer are converted to int type",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("secretPort"), Value: types.StringValue("9000")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"secretPort": 9000,
					},
				},
			},
		},
		{
			name: "sensitive values with unescaped boolean are converted to bool type",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("tlsEnabled"), Value: types.StringValue("true")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"tlsEnabled": true,
					},
				},
			},
		},
		{
			name: "sensitive values with quoted strings remain as string type",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("apiKey"), Value: types.StringValue("\"secret123\"")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"apiKey": "secret123",
					},
				},
			},
		},
		{
			name: "mixed regular and sensitive values both get type conversion",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("replicas"), Value: types.StringValue("3")},
								{Path: types.StringValue("enabled"), Value: types.StringValue("true")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("adminPort"), Value: types.StringValue("8443")},
								{Path: types.StringValue("debugMode"), Value: types.StringValue("false")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"replicas":  3,
						"enabled":   true,
						"adminPort": 8443,
						"debugMode": false,
					},
				},
			},
		},
		{
			name: "error when component has overrides with duplicate chart names",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
						},
						{
							ChartName: types.StringValue("chart1"),
						},
					}),
				},
			},
			expectedMap:           map[string]map[string]map[string]any{},
			expectedErrorContains: "chart 'chart1' is defined multiple times in component 'component1",
		},
		{
			name: "error when component overrides values has duplicate simple paths",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("value1")},
								{Path: types.StringValue("path1"), Value: types.StringValue("value2")},
							}),
						},
					}),
				},
			},
			expectedMap:           map[string]map[string]map[string]any{},
			expectedErrorContains: "path 'path1' is defined multiple times in overrides for chart 'chart1' of component 'component1'",
		},
		{
			name: "error when component overrides sensitive values has duplicate simple paths",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("value1")},
								{Path: types.StringValue("sensitivePath1"), Value: types.StringValue("value2")},
							}),
						},
					}),
				},
			},
			expectedMap:           map[string]map[string]map[string]any{},
			expectedErrorContains: "path 'sensitivePath1' is defined multiple times in overrides for chart 'chart1' of component 'component1'",
		},
		{
			name: "error when same simple path exists in both component overrides values and sensitive values",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("value1")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1"), Value: types.StringValue("sensitiveValue1")},
							}),
						},
					}),
				},
			},
			expectedMap:           map[string]map[string]map[string]any{},
			expectedErrorContains: "path 'path1' is defined multiple times in overrides for chart 'chart1' of component 'component1'",
		},
		{
			name: "yaml 1.2 treats yes/no/on/off as strings not booleans",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("enabled"), Value: types.StringValue("yes")},
								{Path: types.StringValue("disabled"), Value: types.StringValue("no")},
								{Path: types.StringValue("on_val"), Value: types.StringValue("on")},
								{Path: types.StringValue("off_val"), Value: types.StringValue("off")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"enabled":  "yes",
						"disabled": "no",
						"on_val":   "on",
						"off_val":  "off",
					},
				},
			},
		},
		{
			name: "integer values are converted to int",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("replicas"), Value: types.StringValue("3")},
								{Path: types.StringValue("port"), Value: types.StringValue("8080")},
								{Path: types.StringValue("negative"), Value: types.StringValue("-1")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"replicas": 3,
						"port":     8080,
						"negative": -1,
					},
				},
			},
		},
		{
			name: "large unsigned integers exceeding max int are preserved as uint64",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("bigval"), Value: types.StringValue("18446744073709551615")},
							}),
						},
					}),
				},
			},
			expectedMap: map[string]map[string]map[string]any{
				"component1": {
					"chart1": {
						"bigval": uint64(18446744073709551615),
					},
				},
			},
		},
		{
			name: "error when component overrides values has duplicate nested paths",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("value1")},
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("value2")},
							}),
						},
					}),
				},
			},
			expectedMap:           map[string]map[string]map[string]any{},
			expectedErrorContains: "path 'path1.nestedPath' is defined multiple times in overrides for chart 'chart1' of component 'component1'",
		},
		{
			name: "error when component overrides sensitive values has duplicate nested paths",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("sensitivePath1.nestedPath"), Value: types.StringValue("value1")},
								{Path: types.StringValue("sensitivePath1.nestedPath"), Value: types.StringValue("value2")},
							}),
						},
					}),
				},
			},
			expectedMap:           map[string]map[string]map[string]any{},
			expectedErrorContains: "path 'sensitivePath1.nestedPath' is defined multiple times in overrides for chart 'chart1' of component 'component1'",
		},
		{
			name: "error when nested path exists in both values and sensitive values arrays",
			input: []ComponentModel{
				{
					Name: types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{
						{
							ChartName: types.StringValue("chart1"),
							Values: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("value1")},
							}),
							SensitiveValues: helmChartPathValueSliceToSet([]HelmChartPathValueModel{
								{Path: types.StringValue("path1.nestedPath"), Value: types.StringValue("sensitiveValue1")},
							}),
						},
					}),
				},
			},
			expectedMap:           map[string]map[string]map[string]any{},
			expectedErrorContains: "path 'path1.nestedPath' is defined multiple times in overrides for chart 'chart1' of component 'component1'",
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			actual, err := flattenComponentOverrides(context.Background(), tc.input)

			if tc.expectedErrorContains != "" {
				assert.ErrorContains(t, err, tc.expectedErrorContains)
			} else {
				assert.Equal(t, tc.expectedMap, actual)
			}
		})
	}
}

// Unit test that an invalid YAML override value is not leaked in the parse error
func TestFlattenComponentOverrides_InvalidYAMLDoesNotLeakValue(t *testing.T) {
	const secret = "sup3rs3cr3tP@ssw0rd"

	tests := []struct {
		name      string
		valueType string
		value     string
	}{
		{name: "sensitive_values syntax error", valueType: "sensitive values", value: secret + ": [oops"},
		{name: "values syntax error", valueType: "values", value: secret + ": [oops"},
		{name: "sensitive_values decode error", valueType: "sensitive values", value: "!!bool " + secret},
		{name: "values decode error", valueType: "values", value: "!!bool " + secret},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			pathValues := helmChartPathValueSliceToSet([]HelmChartPathValueModel{
				{Path: types.StringValue("path1"), Value: types.StringValue(tc.value)},
			})

			chart := ComponentChartValuesModel{ChartName: types.StringValue("chart1")}
			if tc.valueType == "sensitive values" {
				chart.SensitiveValues = pathValues
			} else {
				chart.Values = pathValues
			}

			input := []ComponentModel{
				{
					Name:      types.StringValue("component1"),
					Overrides: componentChartValuesSliceToSet([]ComponentChartValuesModel{chart}),
				},
			}

			_, err := flattenComponentOverrides(context.Background(), input)

			require.Error(t, err)
			assert.NotContains(t, err.Error(), secret)
			assert.Contains(t, err.Error(), tc.valueType)
			assert.Contains(t, err.Error(), "path1")
			assert.Contains(t, err.Error(), "chart1")
			assert.Contains(t, err.Error(), "component1")
		})
	}
}

func TestGetPackageOverrideName(t *testing.T) {
	t.Run("oci source uses full reference", func(t *testing.T) {
		source := "oci://ghcr.io/defenseunicorns/packages/test:latest"
		model := NewTestPackageResourceModel(WithSource(source))

		expectedHash := sha1.Sum([]byte(source))
		expectedName := fmt.Sprintf("zarf-package-%x.tar.zst", expectedHash)

		assert.Equal(t, expectedName, getPackageOverrideName(model))
	})

	t.Run("local path uses base filename", func(t *testing.T) {
		source := filepath.Join("some", "nested", "dir", "custom-package.tar.zst")
		model := NewTestPackageResourceModel(WithSource(source))

		expectedHash := sha1.Sum([]byte(filepath.Base(source)))
		expectedName := fmt.Sprintf("zarf-package-%x.tar.zst", expectedHash)

		assert.Equal(t, expectedName, getPackageOverrideName(model))
	})
}

func TestGetPackageSource_LocalPathOverride(t *testing.T) {
	t.Run("returns override path for oci source when file exists", func(t *testing.T) {
		tempDir := t.TempDir()

		model := NewTestPackageResourceModel()
		overrideFilename := getPackageOverrideName(model)
		overridePath := filepath.Join(tempDir, overrideFilename)

		err := os.WriteFile(overridePath, []byte("test"), 0o600)
		assert.NoError(t, err)
		defer os.Remove(overridePath)

		source, err := getPackageSource(model, udsProviderConfig{LocalPathOverride: tempDir})
		assert.NoError(t, err)
		assert.Equal(t, overridePath, source)
	})

	t.Run("returns error when override file missing", func(t *testing.T) {
		tempDir := t.TempDir()

		model := NewTestPackageResourceModel()
		source, err := getPackageSource(model, udsProviderConfig{LocalPathOverride: tempDir})
		assert.Error(t, err)
		assert.Equal(t, "", source)
	})
}

func TestPackageResource_ValidateConfig_SignatureVerification(t *testing.T) {
	tests := []struct {
		name        string
		configFunc  func() PackageResourceModel
		expectError bool
		errorMsg    string
	}{
		{
			name:        "no error when signature_verification absent",
			configFunc:  func() PackageResourceModel { return NewTestPackageResourceModel() },
			expectError: false,
		},
		{
			name: "no error with enabled=false and no key",
			configFunc: func() PackageResourceModel {
				return NewTestPackageResourceModel(WithSignatureVerificationEnabled(false))
			},
			expectError: false,
		},
		{
			name: "no error with public_key only",
			configFunc: func() PackageResourceModel {
				return NewTestPackageResourceModel(WithPublicKey("some-key"))
			},
			expectError: false,
		},
		{
			name: "no error with valid keyless config",
			configFunc: func() PackageResourceModel {
				return NewTestPackageResourceModel(WithKeylessVerification("user@example.com", "https://accounts.google.com"))
			},
			expectError: false,
		},
		{
			name: "error when public_key and keyless both set",
			configFunc: func() PackageResourceModel {
				return NewTestPackageResourceModel(
					withSigVerification(newTestSigVerification(true, "some-key", &KeylessVerificationModel{
						CertificateIdentity:         types.StringValue("user@example.com"),
						CertificateIdentityRegexp:   types.StringNull(),
						CertificateOIDCIssuer:       types.StringValue("https://accounts.google.com"),
						CertificateOIDCIssuerRegexp: types.StringNull(),
						TrustedRoot:                 types.StringNull(),
						InsecureIgnoreTlog:          types.BoolValue(false),
						UseSignedTimestamps:         types.BoolValue(false),
					})),
				)
			},
			expectError: true,
			errorMsg:    "public_key",
		},
		{
			name: "error when keyless missing identity",
			configFunc: func() PackageResourceModel {
				return NewTestPackageResourceModel(
					withSigVerification(newTestSigVerification(true, "", &KeylessVerificationModel{
						CertificateIdentity:         types.StringNull(),
						CertificateIdentityRegexp:   types.StringNull(),
						CertificateOIDCIssuer:       types.StringValue("https://accounts.google.com"),
						CertificateOIDCIssuerRegexp: types.StringNull(),
						TrustedRoot:                 types.StringNull(),
						InsecureIgnoreTlog:          types.BoolValue(false),
						UseSignedTimestamps:         types.BoolValue(false),
					})),
				)
			},
			expectError: true,
			errorMsg:    "certificate_identity",
		},
		{
			name: "error when keyless missing issuer",
			configFunc: func() PackageResourceModel {
				return NewTestPackageResourceModel(
					withSigVerification(newTestSigVerification(true, "", &KeylessVerificationModel{
						CertificateIdentity:         types.StringValue("user@example.com"),
						CertificateIdentityRegexp:   types.StringNull(),
						CertificateOIDCIssuer:       types.StringNull(),
						CertificateOIDCIssuerRegexp: types.StringNull(),
						TrustedRoot:                 types.StringNull(),
						InsecureIgnoreTlog:          types.BoolValue(false),
						UseSignedTimestamps:         types.BoolValue(false),
					})),
				)
			},
			expectError: true,
			errorMsg:    "certificate_oidc_issuer",
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			model := tc.configFunc()
			resp := &resource.ValidateConfigResponse{Diagnostics: diag.Diagnostics{}}

			validateSignatureVerificationAttributes(context.Background(), model, resp)

			if tc.expectError {
				assert.True(t, resp.Diagnostics.HasError(), "expected error but got none")
				if tc.errorMsg != "" {
					found := false
					for _, d := range resp.Diagnostics.Errors() {
						if strings.Contains(d.Summary()+d.Detail(), tc.errorMsg) {
							found = true
							break
						}
					}
					assert.True(t, found, "expected error containing %q", tc.errorMsg)
				}
			} else {
				assert.False(t, resp.Diagnostics.HasError(), "unexpected error: %v", resp.Diagnostics.Errors())
			}
		})
	}
}

func TestPackageResource_Schema_SignatureVerificationDefault(t *testing.T) {
	packageResource := NewPackageResource(nil, nil, nil, nil).(*PackageResource)
	resp := &resource.SchemaResponse{}

	packageResource.Schema(context.Background(), resource.SchemaRequest{}, resp)
	assert.False(t, resp.Diagnostics.HasError(), "unexpected schema diagnostics: %v", resp.Diagnostics.Errors())

	signatureVerificationAttr, ok := resp.Schema.Attributes["signature_verification"].(schema.SingleNestedAttribute)
	assert.True(t, ok, "signature_verification should be a SingleNestedAttribute")
	assert.True(t, signatureVerificationAttr.Optional)
	assert.True(t, signatureVerificationAttr.Computed)
	assert.NotNil(t, signatureVerificationAttr.Default)

	defaultResp := &defaults.ObjectResponse{}
	signatureVerificationAttr.Default.DefaultObject(context.Background(), defaults.ObjectRequest{}, defaultResp)
	assert.False(t, defaultResp.Diagnostics.HasError(), "unexpected default diagnostics: %v", defaultResp.Diagnostics.Errors())
	assert.True(t, defaultSignatureVerification.Equal(defaultResp.PlanValue))

	var defaultModel SignatureVerificationModel
	diags := defaultResp.PlanValue.As(context.Background(), &defaultModel, basetypes.ObjectAsOptions{})
	assert.False(t, diags.HasError(), "unexpected default conversion diagnostics: %v", diags.Errors())
	assert.True(t, defaultModel.Verify.ValueBool())
	assert.True(t, defaultModel.PublicKey.IsNull())
	assert.True(t, defaultModel.Keyless.IsNull())
}

// WithKeylessVerification sets signature_verification.keyless with exact identity and issuer.
func WithKeylessVerification(identity, issuer string) PackageResourceModelDataOption {
	keyless := &KeylessVerificationModel{
		CertificateIdentity:         types.StringValue(identity),
		CertificateIdentityRegexp:   types.StringNull(),
		CertificateOIDCIssuer:       types.StringValue(issuer),
		CertificateOIDCIssuerRegexp: types.StringNull(),
		TrustedRoot:                 types.StringNull(),
		InsecureIgnoreTlog:          types.BoolValue(false),
		UseSignedTimestamps:         types.BoolValue(false),
	}
	return withSigVerification(newTestSigVerification(true, "", keyless))
}

func TestPackageResource_ValidateConfig_ValuesComponentMutualExclusivity(t *testing.T) {
	emptyDynamicObject := func() types.Dynamic {
		return types.DynamicValue(types.ObjectValueMust(map[string]attr.Type{}, map[string]attr.Value{}))
	}

	tests := []struct {
		name                  string
		model                 PackageResourceModel
		expectedErrorContains []string
	}{
		{
			name: "values without components is allowed",
			model: NewTestPackageResourceModel(
				WithValues(emptyDynamicObject()),
			),
		},
		{
			name: "sensitive_values without components is allowed",
			model: NewTestPackageResourceModel(
				WithSensitiveValues(emptyDynamicObject()),
			),
		},
		{
			name: "null values with components is allowed",
			model: NewTestPackageResourceModel(
				WithComponents(NewComponentModelsFromNames([]string{"test-component"})),
				WithValues(types.DynamicNull()),
				WithSensitiveValues(types.DynamicNull()),
			),
		},
		{
			name: "empty values object conflicts with components",
			model: NewTestPackageResourceModel(
				WithComponents(NewComponentModelsFromNames([]string{"test-component"})),
				WithValues(emptyDynamicObject()),
			),
			expectedErrorContains: []string{"values cannot be specified together with component blocks"},
		},
		{
			name: "empty sensitive_values object conflicts with components",
			model: NewTestPackageResourceModel(
				WithComponents(NewComponentModelsFromNames([]string{"test-component"})),
				WithSensitiveValues(emptyDynamicObject()),
			),
			expectedErrorContains: []string{"sensitive_values cannot be specified together with component blocks"},
		},
		{
			name: "values and sensitive_values both conflict with components",
			model: NewTestPackageResourceModel(
				WithComponents(NewComponentModelsFromNames([]string{"test-component"})),
				WithValues(emptyDynamicObject()),
				WithSensitiveValues(emptyDynamicObject()),
			),
			expectedErrorContains: []string{
				"values cannot be specified together with component blocks",
				"sensitive_values cannot be specified together with component blocks",
			},
		},
		{
			name: "unknown values conflicts with components",
			model: NewTestPackageResourceModel(
				WithComponents(NewComponentModelsFromNames([]string{"test-component"})),
				WithValues(types.DynamicUnknown()),
			),
			expectedErrorContains: []string{"values cannot be specified together with component blocks"},
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			resp := &resource.ValidateConfigResponse{Diagnostics: diag.Diagnostics{}}

			validateValuesComponentMutualExclusivity(tc.model, resp)

			if len(tc.expectedErrorContains) == 0 {
				assert.False(t, resp.Diagnostics.HasError(), "expected no error but got: %v", resp.Diagnostics.Errors())
				return
			}

			assert.True(t, resp.Diagnostics.HasError(), "expected error but got none")
			for _, expected := range tc.expectedErrorContains {
				found := false
				for _, d := range resp.Diagnostics.Errors() {
					if strings.Contains(d.Detail(), expected) {
						found = true
						break
					}
				}
				assert.True(t, found, "expected error containing %q, got: %v", expected, resp.Diagnostics.Errors())
			}
		})
	}
}

func TestDynamicToValues(t *testing.T) {
	oversizedInt, ok := new(big.Int).SetString("9223372036854775809", 10)
	require.True(t, ok)

	objectValue := types.ObjectValueMust(
		map[string]attr.Type{
			"string": types.StringType,
			"bool":   types.BoolType,
			"int":    types.NumberType,
			"float":  types.NumberType,
			"nested": types.ObjectType{AttrTypes: map[string]attr.Type{
				"list": types.ListType{ElemType: types.StringType},
			}},
		},
		map[string]attr.Value{
			"string": types.StringValue("value"),
			"bool":   types.BoolValue(true),
			"int":    types.NumberValue(big.NewFloat(3)),
			"float":  types.NumberValue(big.NewFloat(1.5)),
			"nested": types.ObjectValueMust(
				map[string]attr.Type{"list": types.ListType{ElemType: types.StringType}},
				map[string]attr.Value{
					"list": types.ListValueMust(types.StringType, []attr.Value{
						types.StringValue("one"),
						types.StringValue("two"),
					}),
				},
			),
		},
	)

	tests := []struct {
		name      string
		input     types.Dynamic
		expected  zarfValue.Values
		errorText string
	}{
		{
			name:     "null returns empty values",
			input:    types.DynamicNull(),
			expected: zarfValue.Values{},
		},
		{
			name:      "unknown returns error",
			input:     types.DynamicUnknown(),
			errorText: "values must be known",
		},
		{
			name:  "object converts recursively",
			input: types.DynamicValue(objectValue),
			expected: zarfValue.Values{
				"string": "value",
				"bool":   true,
				"int":    int64(3),
				"float":  1.5,
				"nested": map[string]any{
					"list": []any{"one", "two"},
				},
			},
		},
		{
			name:      "root scalar returns error",
			input:     types.DynamicValue(types.StringValue("nope")),
			errorText: "values must be a map or object",
		},
		{
			name: "oversized integer returns error",
			input: types.DynamicValue(types.ObjectValueMust(
				map[string]attr.Type{"id": types.NumberType},
				map[string]attr.Value{"id": types.NumberValue(new(big.Float).SetInt(oversizedInt))},
			)),
			errorText: "failed to convert values: id: Terraform number 9223372036854775809 cannot be represented as an int64 Zarf/Helm value without precision loss; quote large numeric identifiers as strings",
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			actual, err := dynamicToValues("values", tc.input)

			if tc.errorText != "" {
				assert.Error(t, err)
				assert.Contains(t, err.Error(), tc.errorText)
				return
			}

			assert.NoError(t, err)
			assert.Equal(t, tc.expected, actual)
		})
	}
}

func TestNumberToGoValue(t *testing.T) {
	oversizedInt, ok := new(big.Int).SetString("9223372036854775809", 10)
	require.True(t, ok)

	tests := []struct {
		name      string
		input     *big.Float
		expected  any
		errorText string
	}{
		{
			name:     "nil returns nil",
			expected: nil,
		},
		{
			name:     "integer returns int64",
			input:    big.NewFloat(3),
			expected: int64(3),
		},
		{
			name:     "fractional returns float64",
			input:    big.NewFloat(1.5),
			expected: 1.5,
		},
		{
			name:      "oversized integer returns error",
			input:     new(big.Float).SetInt(oversizedInt),
			errorText: "Terraform number 9223372036854775809 cannot be represented as an int64 Zarf/Helm value without precision loss; quote large numeric identifiers as strings",
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			actual, err := numberToGoValue(tc.input)

			if tc.errorText != "" {
				assert.Error(t, err)
				assert.Contains(t, err.Error(), tc.errorText)
				return
			}

			assert.NoError(t, err)
			assert.Equal(t, tc.expected, actual)
		})
	}
}

func TestDynamicContainsUnknown(t *testing.T) {
	nestedKnownObject := types.DynamicValue(types.ObjectValueMust(
		map[string]attr.Type{
			"pod": types.ObjectType{AttrTypes: map[string]attr.Type{
				"annotations": types.ObjectType{AttrTypes: map[string]attr.Type{
					"pet-name": types.StringType,
				}},
			}},
		},
		map[string]attr.Value{
			"pod": types.ObjectValueMust(
				map[string]attr.Type{
					"annotations": types.ObjectType{AttrTypes: map[string]attr.Type{
						"pet-name": types.StringType,
					}},
				},
				map[string]attr.Value{
					"annotations": types.ObjectValueMust(
						map[string]attr.Type{"pet-name": types.StringType},
						map[string]attr.Value{"pet-name": types.StringValue("fluffy")},
					),
				},
			),
		},
	))
	nestedUnknownObject := types.DynamicValue(types.ObjectValueMust(
		map[string]attr.Type{
			"pod": types.ObjectType{AttrTypes: map[string]attr.Type{
				"annotations": types.ObjectType{AttrTypes: map[string]attr.Type{
					"pet-name": types.StringType,
				}},
			}},
		},
		map[string]attr.Value{
			"pod": types.ObjectValueMust(
				map[string]attr.Type{
					"annotations": types.ObjectType{AttrTypes: map[string]attr.Type{
						"pet-name": types.StringType,
					}},
				},
				map[string]attr.Value{
					"annotations": types.ObjectValueMust(
						map[string]attr.Type{"pet-name": types.StringType},
						map[string]attr.Value{"pet-name": types.StringUnknown()},
					),
				},
			),
		},
	))
	listWithUnknown := types.DynamicValue(types.ObjectValueMust(
		map[string]attr.Type{
			"items": types.ListType{ElemType: types.StringType},
		},
		map[string]attr.Value{
			"items": types.ListValueMust(types.StringType, []attr.Value{
				types.StringValue("known"),
				types.StringUnknown(),
			}),
		},
	))

	tests := []struct {
		name     string
		input    types.Dynamic
		expected bool
	}{
		{name: "null does not contain unknown", input: types.DynamicNull(), expected: false},
		{name: "top-level unknown contains unknown", input: types.DynamicUnknown(), expected: true},
		{name: "known nested object does not contain unknown", input: nestedKnownObject, expected: false},
		{name: "nested object contains unknown", input: nestedUnknownObject, expected: true},
		{name: "list contains unknown", input: listWithUnknown, expected: true},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			assert.Equal(t, tc.expected, dynamicContainsUnknown(tc.input))
		})
	}
}

func TestValidateConfiguredPackageValueConflicts(t *testing.T) {
	unknownDuplicateModel := NewTestPackageResourceModel(
		WithValues(types.DynamicValue(types.ObjectValueMust(
			map[string]attr.Type{
				"config": types.ObjectType{AttrTypes: map[string]attr.Type{
					"settings": types.ObjectType{AttrTypes: map[string]attr.Type{"message": types.StringType}},
				}},
				"pod": types.ObjectType{AttrTypes: map[string]attr.Type{
					"annotations": types.ObjectType{AttrTypes: map[string]attr.Type{"dynamic": types.StringType}},
				}},
			},
			map[string]attr.Value{
				"config": types.ObjectValueMust(
					map[string]attr.Type{"settings": types.ObjectType{AttrTypes: map[string]attr.Type{"message": types.StringType}}},
					map[string]attr.Value{"settings": types.ObjectValueMust(
						map[string]attr.Type{"message": types.StringType},
						map[string]attr.Value{"message": types.StringValue("plain")},
					)},
				),
				"pod": types.ObjectValueMust(
					map[string]attr.Type{"annotations": types.ObjectType{AttrTypes: map[string]attr.Type{"dynamic": types.StringType}}},
					map[string]attr.Value{"annotations": types.ObjectValueMust(
						map[string]attr.Type{"dynamic": types.StringType},
						map[string]attr.Value{"dynamic": types.StringUnknown()},
					)},
				),
			},
		))),
		WithSensitiveValues(types.DynamicValue(types.ObjectValueMust(
			map[string]attr.Type{
				"config": types.ObjectType{AttrTypes: map[string]attr.Type{
					"settings": types.ObjectType{AttrTypes: map[string]attr.Type{"message": types.StringType}},
				}},
			},
			map[string]attr.Value{
				"config": types.ObjectValueMust(
					map[string]attr.Type{"settings": types.ObjectType{AttrTypes: map[string]attr.Type{"message": types.StringType}}},
					map[string]attr.Value{"settings": types.ObjectValueMust(
						map[string]attr.Type{"message": types.StringType},
						map[string]attr.Value{"message": types.StringValue("secret")},
					)},
				),
			},
		))),
	)
	emptyMapSiblingModel := NewTestPackageResourceModel(
		WithValues(types.DynamicValue(types.ObjectValueMust(
			map[string]attr.Type{
				"config": types.ObjectType{AttrTypes: map[string]attr.Type{}},
				"pod": types.ObjectType{AttrTypes: map[string]attr.Type{
					"annotations": types.ObjectType{AttrTypes: map[string]attr.Type{"dynamic": types.StringType}},
				}},
			},
			map[string]attr.Value{
				"config": types.ObjectValueMust(map[string]attr.Type{}, map[string]attr.Value{}),
				"pod": types.ObjectValueMust(
					map[string]attr.Type{"annotations": types.ObjectType{AttrTypes: map[string]attr.Type{"dynamic": types.StringType}}},
					map[string]attr.Value{"annotations": types.ObjectValueMust(
						map[string]attr.Type{"dynamic": types.StringType},
						map[string]attr.Value{"dynamic": types.StringUnknown()},
					)},
				),
			},
		))),
		WithSensitiveValues(types.DynamicValue(types.ObjectValueMust(
			map[string]attr.Type{
				"config": types.ObjectType{AttrTypes: map[string]attr.Type{"secret": types.StringType}},
			},
			map[string]attr.Value{
				"config": types.ObjectValueMust(
					map[string]attr.Type{"secret": types.StringType},
					map[string]attr.Value{"secret": types.StringValue("redacted")},
				),
			},
		))),
	)

	tests := []struct {
		name            string
		model           PackageResourceModel
		expectedErrText string
	}{
		{
			name:            "unknown sibling fails known duplicate path",
			model:           unknownDuplicateModel,
			expectedErrText: "config.settings.message",
		},
		{
			name:  "unknown sibling allows empty map with sensitive child",
			model: emptyMapSiblingModel,
		},
		{
			name:  "root unknown defers",
			model: NewTestPackageResourceModel(WithValues(types.DynamicUnknown())),
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			resp := &resource.ModifyPlanResponse{Diagnostics: diag.Diagnostics{}}

			validateConfiguredPackageValueConflicts(tc.model, resp)

			if tc.expectedErrText == "" {
				assert.False(t, resp.Diagnostics.HasError(), "expected no conflict diagnostics, got: %v", resp.Diagnostics.Errors())
				return
			}
			require.True(t, resp.Diagnostics.HasError())
			assert.Contains(t, resp.Diagnostics.Errors()[0].Detail(), tc.expectedErrText)
		})
	}
}

func TestModifyPlan_ConfigValuesFailKnownConflictsWhenPlanValuesAreUnknown(t *testing.T) {
	r := NewPackageResource(
		&udsProviderConfig{ValidatePackagesOnPlan: true},
		&MockPackager{},
		nil,
		nil,
	).(*PackageResource)
	configModel := NewTestPackageResourceModel(
		WithSignatureVerificationEnabled(false),
		WithValues(types.DynamicValue(types.ObjectValueMust(
			map[string]attr.Type{
				"logLevel": types.StringType,
				"pod": types.ObjectType{AttrTypes: map[string]attr.Type{
					"annotations": types.ObjectType{AttrTypes: map[string]attr.Type{
						"dynamic": types.StringType,
					}},
				}},
			},
			map[string]attr.Value{
				"logLevel": types.StringValue("debug"),
				"pod": types.ObjectValueMust(
					map[string]attr.Type{"annotations": types.ObjectType{AttrTypes: map[string]attr.Type{"dynamic": types.StringType}}},
					map[string]attr.Value{"annotations": types.ObjectValueMust(
						map[string]attr.Type{"dynamic": types.StringType},
						map[string]attr.Value{"dynamic": types.StringUnknown()},
					)},
				),
			},
		))),
		WithSensitiveValues(types.DynamicValue(types.ObjectValueMust(
			map[string]attr.Type{"logLevel": types.StringType},
			map[string]attr.Value{"logLevel": types.StringValue("info")},
		))),
	)
	configModel.Metadata = types.ObjectUnknown(packageMetadataAttrTypes)
	configModel.ConnectStrings = types.SetUnknown(types.ObjectType{AttrTypes: connectStringAttrTypes})
	configModel.SetVariables = types.MapUnknown(types.StringType)
	planModel := configModel
	planModel.Values = types.DynamicUnknown()
	planModel.SensitiveValues = types.DynamicUnknown()
	planModel.Metadata = types.ObjectUnknown(packageMetadataAttrTypes)
	planModel.ConnectStrings = types.SetUnknown(types.ObjectType{AttrTypes: connectStringAttrTypes})
	planModel.SetVariables = types.MapUnknown(types.StringType)
	plan := buildTestPlan(t, r, planModel)
	resp := resource.ModifyPlanResponse{Plan: plan}

	r.ModifyPlan(context.Background(), resource.ModifyPlanRequest{
		Config: buildTestConfig(t, r, configModel),
		Plan:   plan,
	}, &resp)

	require.True(t, resp.Diagnostics.HasError(), "expected config values to fail known conflicts when plan values are unknown")
	assert.Contains(t, resp.Diagnostics.Errors()[0].Detail(), "logLevel")
}

func TestPackageResource_RunPackagePlanChecks_SchemaRejectsUnrecognizedValuePath(t *testing.T) {
	dir := t.TempDir()
	require.NoError(t, os.WriteFile(filepath.Join(dir, layout.ValuesYAML), []byte("config:\n  enabled: false\n"), 0o600))
	require.NoError(t, os.WriteFile(filepath.Join(dir, layout.ValuesSchema), []byte(`{
  "type": "object",
  "properties": {
    "config": {"type": "object", "properties": {"enabled": {"type": "boolean"}}}
  },
  "additionalProperties": false
}`), 0o600))

	valuesHash, err := helpers.GetSHA256OfFile(filepath.Join(dir, layout.ValuesYAML))
	require.NoError(t, err)
	schemaHash, err := helpers.GetSHA256OfFile(filepath.Join(dir, layout.ValuesSchema))
	require.NoError(t, err)
	checksums := fmt.Sprintf("%s %s\n%s %s\n", valuesHash, layout.ValuesYAML, schemaHash, layout.ValuesSchema)
	require.NoError(t, os.WriteFile(filepath.Join(dir, layout.Checksums), []byte(checksums), 0o600))
	aggregateChecksum, err := helpers.GetSHA256OfFile(filepath.Join(dir, layout.Checksums))
	require.NoError(t, err)
	require.NoError(t, os.WriteFile(filepath.Join(dir, layout.ZarfYAML), []byte(fmt.Sprintf(`
apiVersion: zarf.dev/v1alpha1
kind: ZarfPackageConfig
metadata:
  name: warning-test
  version: 1.0.0
  aggregateChecksum: %s
values:
  files:
    - values.yaml
  schema: values.schema.json
components:
  - name: required-component
    required: true
    charts:
      - name: chart
        values:
          - sourcePath: .config.enabled
            targetPath: .config.enabled
`, aggregateChecksum)), 0o600))

	pkgLayout, err := layout.LoadFromDir(context.Background(), dir, layout.PackageLayoutOptions{
		VerificationStrategy: layout.VerifyNever,
	})
	require.NoError(t, err)

	model := NewTestPackageResourceModel(
		WithValues(types.DynamicValue(types.ObjectValueMust(
			map[string]attr.Type{"foo": types.BoolType, "computed": types.StringType},
			map[string]attr.Value{"foo": types.BoolValue(true), "computed": types.StringUnknown()},
		))),
	)
	model.OptionalComponents = types.SetUnknown(types.StringType)
	mockPackager := &MockPackager{}
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(pkgLayout, nil)
	r := NewPackageResource(&udsProviderConfig{ValidatePackagesOnPlan: true}, mockPackager, nil, nil).(*PackageResource)
	result := r.runPackagePlanChecks(context.Background(), model)

	require.Error(t, result.ValuesErr)
	assert.Contains(t, result.ValuesErr.Error(), "foo")
}

func TestModifyPlan_SchemaChecksKnownConfigurationValuesWhenPlanIsUnknown(t *testing.T) {
	dir := t.TempDir()
	require.NoError(t, os.WriteFile(filepath.Join(dir, layout.ValuesYAML), []byte("global:\n  domain: example.test\n"), 0o600))
	require.NoError(t, os.WriteFile(filepath.Join(dir, layout.ValuesSchema), []byte(`{
  "type": "object",
  "properties": {
    "global": {"type": "object", "properties": {"domain": {"type": "string"}}}
  },
  "additionalProperties": false
}`), 0o600))

	valuesHash, err := helpers.GetSHA256OfFile(filepath.Join(dir, layout.ValuesYAML))
	require.NoError(t, err)
	schemaHash, err := helpers.GetSHA256OfFile(filepath.Join(dir, layout.ValuesSchema))
	require.NoError(t, err)
	checksums := fmt.Sprintf("%s %s\n%s %s\n", valuesHash, layout.ValuesYAML, schemaHash, layout.ValuesSchema)
	require.NoError(t, os.WriteFile(filepath.Join(dir, layout.Checksums), []byte(checksums), 0o600))
	aggregateChecksum, err := helpers.GetSHA256OfFile(filepath.Join(dir, layout.Checksums))
	require.NoError(t, err)
	require.NoError(t, os.WriteFile(filepath.Join(dir, layout.ZarfYAML), []byte(fmt.Sprintf(`
apiVersion: zarf.dev/v1alpha1
kind: ZarfPackageConfig
metadata:
  name: plan-test
  version: 1.0.0
  aggregateChecksum: %s
values:
  files:
    - values.yaml
  schema: values.schema.json
components:
  - name: required-component
    required: true
`, aggregateChecksum)), 0o600))

	pkgLayout, err := layout.LoadFromDir(context.Background(), dir, layout.PackageLayoutOptions{
		VerificationStrategy: layout.VerifyNever,
	})
	require.NoError(t, err)

	configModel := NewTestPackageResourceModel(
		WithValues(types.DynamicValue(types.ObjectValueMust(
			map[string]attr.Type{
				"foo":      types.BoolType,
				"computed": types.StringType,
			},
			map[string]attr.Value{
				"foo":      types.BoolValue(true),
				"computed": types.StringUnknown(),
			},
		))),
	)
	setUnknownComputedPackageState := func(model *PackageResourceModel) {
		model.Metadata = types.ObjectUnknown(packageMetadataAttrTypes)
		model.ConnectStrings = types.SetUnknown(types.ObjectType{AttrTypes: connectStringAttrTypes})
		model.SetVariables = types.MapUnknown(types.StringType)
	}
	setUnknownComputedPackageState(&configModel)
	planModel := configModel
	planModel.Values = types.DynamicUnknown()
	setUnknownComputedPackageState(&planModel)

	mockPackager := &MockPackager{}
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(pkgLayout, nil)
	r := NewPackageResource(&udsProviderConfig{ValidatePackagesOnPlan: true}, mockPackager, nil, nil).(*PackageResource)
	plan := buildTestPlan(t, r, planModel)
	resp := resource.ModifyPlanResponse{Plan: plan}
	r.ModifyPlan(context.Background(), resource.ModifyPlanRequest{
		Config: buildTestConfig(t, r, configModel),
		Plan:   plan,
	}, &resp)

	require.True(t, resp.Diagnostics.HasError(), "expected known foo value to fail schema validation")
	assert.Contains(t, resp.Diagnostics.Errors()[0].Detail(), "foo")
	mockPackager.AssertCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
}

func TestPackageResource_RunPackagePlanChecks_ReturnsLoadErrWhenValuesRequirePackageLoad(t *testing.T) {
	mockPackager := &MockPackager{}
	model := NewTestPackageResourceModel(
		WithOptionalComponents([]string{}),
		WithValues(types.DynamicValue(types.ObjectValueMust(
			map[string]attr.Type{
				"pod": types.ObjectType{AttrTypes: map[string]attr.Type{
					"annotations": types.ObjectType{AttrTypes: map[string]attr.Type{
						"test": types.StringType,
					}},
				}},
			},
			map[string]attr.Value{
				"pod": types.ObjectValueMust(
					map[string]attr.Type{
						"annotations": types.ObjectType{AttrTypes: map[string]attr.Type{
							"test": types.StringType,
						}},
					},
					map[string]attr.Value{
						"annotations": types.ObjectValueMust(
							map[string]attr.Type{"test": types.StringType},
							map[string]attr.Value{"test": types.StringValue("value")},
						),
					},
				),
			},
		))),
	)
	mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(
		&layout.PackageLayout{PackageDefinition: zarfAPI.NewPackageDefinitionFromV1alpha1(v1alpha1.ZarfPackage{})},
		fmt.Errorf("package metadata unavailable"),
	)
	packageResource := NewPackageResource(&udsProviderConfig{ValidatePackagesOnPlan: true}, mockPackager, nil, nil).(*PackageResource)

	result := packageResource.runPackagePlanChecks(context.Background(), model)

	assert.NotNil(t, result.LoadErr)
	assert.Contains(t, result.LoadErr.Error(), "package metadata unavailable")
	mockPackager.AssertCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
}

func TestValidateNoValueConflicts(t *testing.T) {
	tests := []struct {
		name            string
		values          zarfValue.Values
		sensitiveValues zarfValue.Values
		errorText       string
	}{
		{
			name:   "disjoint top-level keys are allowed",
			values: zarfValue.Values{"replicaCount": 2},
			sensitiveValues: zarfValue.Values{
				"token": "secret",
			},
		},
		{
			name: "sibling nested keys are allowed",
			values: zarfValue.Values{
				"db": map[string]any{"hostname": "postgres"},
			},
			sensitiveValues: zarfValue.Values{
				"db": map[string]any{"password": "secret"},
			},
		},
		{
			name: "duplicate leaf path conflicts",
			values: zarfValue.Values{
				"db": map[string]any{"password": "plain"},
			},
			sensitiveValues: zarfValue.Values{
				"db": map[string]any{"password": "secret"},
			},
			errorText: "db.password",
		},
		{
			name: "scalar and object conflict",
			values: zarfValue.Values{
				"db": "postgres",
			},
			sensitiveValues: zarfValue.Values{
				"db": map[string]any{"password": "secret"},
			},
			errorText: "db",
		},
		{
			name: "list and list conflict",
			values: zarfValue.Values{
				"tolerations": []any{"a"},
			},
			sensitiveValues: zarfValue.Values{
				"tolerations": []any{"b"},
			},
			errorText: "tolerations",
		},
		{
			name: "null and object conflict",
			values: zarfValue.Values{
				"db": nil,
			},
			sensitiveValues: zarfValue.Values{
				"db": map[string]any{"password": "secret"},
			},
			errorText: "db",
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			err := validateNoValueConflicts(tc.values, tc.sensitiveValues)

			if tc.errorText != "" {
				assert.Error(t, err)
				assert.Contains(t, err.Error(), tc.errorText)
				return
			}

			assert.NoError(t, err)
		})
	}
}

func TestMergePackageValues(t *testing.T) {
	merged, err := mergePackageValues(
		zarfValue.Values{
			"db": map[string]any{
				"hostname": "postgres",
			},
			"replicaCount": 2,
		},
		zarfValue.Values{
			"db": map[string]any{
				"password": "secret",
			},
		},
	)

	assert.NoError(t, err)
	assert.Equal(t, zarfValue.Values{
		"db": map[string]any{
			"hostname": "postgres",
			"password": "secret",
		},
		"replicaCount": 2,
	}, merged)
}

func TestBuildVerifyBlobOptions(t *testing.T) {
	tests := []struct {
		name                string
		setupModel          func() PackageResourceModel
		wantNil             bool
		wantKey             bool
		wantCertIdentity    string
		wantOIDCIssuer      string
		checkIgnoreTlog     bool
		wantIgnoreTlog      bool
		wantTrustedRootFile bool
	}{
		{
			name: "no verification config returns nil",
			setupModel: func() PackageResourceModel {
				return NewTestPackageResourceModel()
			},
			wantNil: true,
		},
		{
			name: "public key sets Key on options and writes key file",
			setupModel: func() PackageResourceModel {
				return NewTestPackageResourceModel(WithPublicKey("test-public-key-content"))
			},
			wantKey: true,
		},
		{
			name: "keyless sets cert identity and issuer, IgnoreTlog defaults false",
			setupModel: func() PackageResourceModel {
				return NewTestPackageResourceModel(
					WithKeylessVerification("test@example.com", "https://token.actions.githubusercontent.com"),
				)
			},
			wantCertIdentity: "test@example.com",
			wantOIDCIssuer:   "https://token.actions.githubusercontent.com",
			checkIgnoreTlog:  true,
			wantIgnoreTlog:   false,
		},
		{
			name: "keyless insecure_ignore_tlog=true sets IgnoreTlog=true",
			setupModel: func() PackageResourceModel {
				return NewTestPackageResourceModel(withSigVerification(newTestSigVerification(true, "", &KeylessVerificationModel{
					CertificateIdentity:         types.StringValue("test@example.com"),
					CertificateIdentityRegexp:   types.StringNull(),
					CertificateOIDCIssuer:       types.StringValue("https://token.actions.githubusercontent.com"),
					CertificateOIDCIssuerRegexp: types.StringNull(),
					TrustedRoot:                 types.StringNull(),
					InsecureIgnoreTlog:          types.BoolValue(true),
					UseSignedTimestamps:         types.BoolValue(false),
				})))
			},
			wantCertIdentity: "test@example.com",
			wantOIDCIssuer:   "https://token.actions.githubusercontent.com",
			checkIgnoreTlog:  true,
			wantIgnoreTlog:   true,
		},
		{
			name: "keyless with trusted_root writes file and sets TrustedRootPath",
			setupModel: func() PackageResourceModel {
				return NewTestPackageResourceModel(withSigVerification(newTestSigVerification(true, "", &KeylessVerificationModel{
					CertificateIdentity:         types.StringValue("test@example.com"),
					CertificateIdentityRegexp:   types.StringNull(),
					CertificateOIDCIssuer:       types.StringValue("https://token.actions.githubusercontent.com"),
					CertificateOIDCIssuerRegexp: types.StringNull(),
					TrustedRoot:                 types.StringValue(`{"mediaType":"application/vnd.dev.sigstore.trustedroot+json;version=0.1"}`),
					InsecureIgnoreTlog:          types.BoolValue(false),
					UseSignedTimestamps:         types.BoolValue(false),
				})))
			},
			wantCertIdentity:    "test@example.com",
			wantTrustedRootFile: true,
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			tmpDir := t.TempDir()
			model := tc.setupModel()

			opts, err := buildVerifyBlobOptions(context.Background(), model, tmpDir)
			assert.NoError(t, err)

			if tc.wantNil {
				assert.Nil(t, opts)
				return
			}

			assert.NotNil(t, opts)
			if tc.wantKey {
				assert.NotEmpty(t, opts.Key, "expected Key to be set")
				assert.FileExists(t, opts.Key)
			}
			if tc.wantCertIdentity != "" {
				assert.Equal(t, tc.wantCertIdentity, opts.CertVerify.CertIdentity)
			}
			if tc.wantOIDCIssuer != "" {
				assert.Equal(t, tc.wantOIDCIssuer, opts.CertVerify.CertOidcIssuer)
			}
			if tc.checkIgnoreTlog {
				assert.Equal(t, tc.wantIgnoreTlog, opts.CommonVerifyOptions.IgnoreTlog)
			}
			if tc.wantTrustedRootFile {
				assert.NotEmpty(t, opts.CommonVerifyOptions.TrustedRootPath)
				assert.FileExists(t, opts.CommonVerifyOptions.TrustedRootPath)
			}
		})
	}
}

func TestPackageResource_GetEffectiveSignatureVerification(t *testing.T) {
	tests := []struct {
		name       string
		setupModel func() PackageResourceModel
		expected   bool
	}{
		{
			name:       "absent signature_verification block returns true",
			setupModel: func() PackageResourceModel { return NewTestPackageResourceModel() },
			expected:   true,
		},
		{
			name: "signature_verification with enabled=true returns true",
			setupModel: func() PackageResourceModel {
				return NewTestPackageResourceModel(WithSignatureVerificationEnabled(true))
			},
			expected: true,
		},
		{
			name: "signature_verification with enabled=false returns false",
			setupModel: func() PackageResourceModel {
				return NewTestPackageResourceModel(WithSignatureVerificationEnabled(false))
			},
			expected: false,
		},
		{
			name: "signature_verification block present without explicit enabled defaults to true",
			setupModel: func() PackageResourceModel {
				sig := SignatureVerificationModel{
					Verify:    types.BoolNull(),
					PublicKey: types.StringNull(),
					Keyless:   types.ObjectNull(keylessVerificationAttrTypes),
				}
				return NewTestPackageResourceModel(withSigVerification(sig))
			},
			expected: true,
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			model := tc.setupModel()
			result := getEffectiveSignatureVerification(context.Background(), model)
			assert.Equal(t, tc.expected, result)
		})
	}
}

func TestHandleVerifyResult(t *testing.T) {
	someErr := errors.New("signature check failed")

	tests := []struct {
		name     string
		err      error
		isSigned bool
		enforce  bool
		wantErr  bool
	}{
		{
			name:     "no error returns nil",
			err:      nil,
			isSigned: true,
			enforce:  true,
			wantErr:  false,
		},
		{
			name:     "unsigned package warns and returns nil",
			err:      someErr,
			isSigned: false,
			enforce:  true,
			wantErr:  false,
		},
		{
			name:     "signed package with enforce=true returns error",
			err:      someErr,
			isSigned: true,
			enforce:  true,
			wantErr:  true,
		},
		{
			name:     "signed package with enforce=false warns and returns nil",
			err:      someErr,
			isSigned: true,
			enforce:  false,
			wantErr:  false,
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			result := handleVerifyResult(context.Background(), tc.err, tc.isSigned, tc.enforce)
			if tc.wantErr {
				assert.Error(t, result)
				assert.Equal(t, tc.err, result)
			} else {
				assert.NoError(t, result)
			}
		})
	}
}

func TestValidateComponentBlockOptionalComponentsMutualExclusivity(t *testing.T) {
	componentSet := componentSliceToSet([]ComponentModel{
		{Name: types.StringValue("some-component")},
	})
	emptyComponents := componentSliceToSet([]ComponentModel{})

	optionalWithNames := types.SetValueMust(types.StringType, []attr.Value{types.StringValue("metrics")})
	emptyOptional := types.SetValueMust(types.StringType, []attr.Value{})

	tests := []struct {
		name               string
		optionalComponents types.Set
		components         types.Set
		expectError        bool
	}{
		{
			name:               "allows null optional_components with component blocks",
			optionalComponents: types.SetNull(types.StringType),
			components:         componentSet,
			expectError:        false,
		},
		{
			name:               "allows null optional_components without component blocks",
			optionalComponents: types.SetNull(types.StringType),
			components:         emptyComponents,
			expectError:        false,
		},
		{
			name:               "allows non-empty optional_components without component blocks",
			optionalComponents: optionalWithNames,
			components:         emptyComponents,
			expectError:        false,
		},
		{
			name:               "allows empty optional_components without component blocks",
			optionalComponents: emptyOptional,
			components:         emptyComponents,
			expectError:        false,
		},
		{
			name:               "errors on empty optional_components with component blocks",
			optionalComponents: emptyOptional,
			components:         componentSet,
			expectError:        true,
		},
		{
			name:               "errors on non-empty optional_components with component blocks",
			optionalComponents: optionalWithNames,
			components:         componentSet,
			expectError:        true,
		},
		{
			name:               "errors on unknown optional_components with component blocks",
			optionalComponents: types.SetUnknown(types.StringType),
			components:         componentSet,
			expectError:        true,
		},
		{
			name:               "errors on optional_components with unknown component blocks",
			optionalComponents: optionalWithNames,
			components:         types.SetUnknown(componentSet.ElementType(context.Background())),
			expectError:        true,
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			model := PackageResourceModel{
				OptionalComponents: tc.optionalComponents,
				Components:         tc.components,
			}
			resp := &resource.ValidateConfigResponse{}
			validateComponentBlockOptionalComponentsMutualExclusivity(model, resp)
			if tc.expectError {
				assert.True(t, resp.Diagnostics.HasError(), "expected error but got none")
			} else {
				assert.False(t, resp.Diagnostics.HasError(), "expected no error but got: %v", resp.Diagnostics)
			}
		})
	}
}

func TestWithStateRecoveryTimeoutPreservesParentCancellation(t *testing.T) {
	operationCtx, cancelOperation := context.WithCancel(context.Background())
	recoveryCtx, cancelRecovery := withStateRecoveryTimeout(operationCtx)
	defer cancelRecovery()

	recoveryDeadline, hasDeadline := recoveryCtx.Deadline()
	require.True(t, hasDeadline)
	assert.Greater(t, time.Until(recoveryDeadline), time.Minute)
	require.NoError(t, recoveryCtx.Err())

	cancelOperation()
	require.ErrorIs(t, recoveryCtx.Err(), context.Canceled)
}

func TestPreservePlannedPackageAttributesNullAndUnknown(t *testing.T) {
	plan := NewTestPackageResourceModel()
	refreshed := NewTestPackageResourceModel(
		WithArchitecture("amd64"),
		WithOptionalComponents([]string{"logging"}),
	)

	plan.Architecture = types.StringUnknown()
	plan.OptionalComponents = types.SetUnknown(types.StringType)
	preservePlannedPackageAttributes(&refreshed, &plan)
	assert.Equal(t, "amd64", refreshed.Architecture.ValueString())
	assert.Equal(t, []string{"logging"}, mustStringSetElements(t, refreshed.OptionalComponents))

	plan.Architecture = types.StringNull()
	plan.OptionalComponents = types.SetNull(types.StringType)
	preservePlannedPackageAttributes(&refreshed, &plan)
	assert.True(t, refreshed.Architecture.IsNull())
	assert.True(t, refreshed.OptionalComponents.IsNull())
}

func mustStringSetElements(t *testing.T, value types.Set) []string {
	t.Helper()
	var result []string
	diags := value.ElementsAs(context.Background(), &result, false)
	require.False(t, diags.HasError(), "%v", diags)
	return result
}

func TestZarfOperationTimeout(t *testing.T) {
	tests := []struct {
		name             string
		makeCtx          func() (context.Context, context.CancelFunc)
		wantErr          bool
		wantSeconds      float64
		toleranceSeconds float64
	}{
		{
			name:    "no deadline returns error",
			makeCtx: func() (context.Context, context.CancelFunc) { return context.Background(), func() {} },
			wantErr: true,
		},
		{
			name: "deadline already past returns error",
			makeCtx: func() (context.Context, context.CancelFunc) {
				return context.WithDeadline(context.Background(), time.Now().Add(-time.Second))
			},
			wantErr: true,
		},
		{
			name: "canceled context with future deadline returns error",
			makeCtx: func() (context.Context, context.CancelFunc) {
				ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(5*time.Minute))
				cancel() // cancel immediately — deadline is still in the future
				return ctx, func() {}
			},
			wantErr: true,
		},
		{
			name: "remaining 2s returns full remaining duration",
			makeCtx: func() (context.Context, context.CancelFunc) {
				return context.WithDeadline(context.Background(), time.Now().Add(2*time.Second))
			},
			wantSeconds:      (2 * time.Second).Seconds(),
			toleranceSeconds: 0.5,
		},
		{
			name: "remaining 60s returns full remaining duration",
			makeCtx: func() (context.Context, context.CancelFunc) {
				return context.WithDeadline(context.Background(), time.Now().Add(60*time.Second))
			},
			wantSeconds:      60,
			toleranceSeconds: 0.5,
		},
		{
			name: "remaining 20m returns full remaining duration",
			makeCtx: func() (context.Context, context.CancelFunc) {
				return context.WithDeadline(context.Background(), time.Now().Add(20*time.Minute))
			},
			wantSeconds:      (20 * time.Minute).Seconds(),
			toleranceSeconds: 0.5,
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			ctx, cancel := tc.makeCtx()
			defer cancel()

			d, err := zarfOperationTimeout(ctx)
			if tc.wantErr {
				assert.Error(t, err)
				return
			}
			require.NoError(t, err)
			if tc.toleranceSeconds == 0 {
				assert.Equal(t, tc.wantSeconds, d.Seconds())
			} else {
				assert.InDelta(t, tc.wantSeconds, d.Seconds(), tc.toleranceSeconds)
			}
		})
	}
}

func TestPackageResource_Upsert_OptionalComponents(t *testing.T) {
	tests := []struct {
		name                  string
		optionalComponents    *[]string // nil = null (component block path)
		components            []ComponentModel
		expectedFilteredNames []string
	}{
		{
			name:                  "uses component block path with no selected optionals when optional_components is null",
			optionalComponents:    nil,
			components:            []ComponentModel{},
			expectedFilteredNames: []string{},
		},
		{
			name:                  "calls filter with no optional components when optional_components is empty",
			optionalComponents:    &[]string{},
			components:            []ComponentModel{},
			expectedFilteredNames: []string{},
		},
		{
			name:                  "calls filter with the selected single optional component",
			optionalComponents:    &[]string{"test-optional-non-default-component-0"},
			components:            []ComponentModel{},
			expectedFilteredNames: []string{"test-optional-non-default-component-0"},
		},
		{
			name:                  "calls filter with all selected optional components",
			optionalComponents:    &[]string{"test-optional-non-default-component-0", "test-optional-non-default-component-1"},
			components:            []ComponentModel{},
			expectedFilteredNames: []string{"test-optional-non-default-component-0", "test-optional-non-default-component-1"},
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			validLoadPackageResult := newValidLoadPackageResult()
			mockPackager := &MockPackager{}
			mockPackageComponentFilter := &MockPackageComponentFilter{}
			mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(validLoadPackageResult.Layout, nil)
			mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)
			mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

			packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)

			opts := []PackageResourceModelDataOption{WithComponents(tc.components)}
			if tc.optionalComponents != nil {
				opts = append(opts, WithOptionalComponents(*tc.optionalComponents))
			}

			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
			defer cancel()
			_, err := packageResource.upsert(ctx, NewTestPackageResourceModel(opts...))
			assert.NoError(t, err)

			mockPackageComponentFilter.AssertCalled(t, "ForDeploy", mock.Anything)
			for _, call := range mockPackageComponentFilter.Calls {
				if call.Method == "ForDeploy" {
					got, _ := call.Arguments[0].([]string)
					assert.ElementsMatch(t, tc.expectedFilteredNames, got)
				}
			}
		})
	}
}

func TestPackageResource_Upsert_UnknownOptionalComponents(t *testing.T) {
	mockPackager := &MockPackager{}
	mockPackageComponentFilter := &MockPackageComponentFilter{}

	packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)
	model := NewTestPackageResourceModel(func(model *PackageResourceModel) {
		model.OptionalComponents = types.SetUnknown(types.StringType)
	})

	_, err := packageResource.upsert(testCtx(t), model)
	require.EqualError(t, err, "optional_components must be known before apply")
	mockPackager.AssertNotCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
	mockPackageComponentFilter.AssertNotCalled(t, "ForDeploy", mock.Anything)
	mockPackager.AssertNotCalled(t, "Deploy", mock.Anything, mock.Anything, mock.Anything)
}

func TestDeployedOptionalComponents(t *testing.T) {
	boolTrue := true
	boolFalse := false

	pkgComponents := []v1alpha1.ZarfComponent{
		{Name: "required-a", Required: &boolTrue},
		{Name: "required-b", Required: &boolTrue},
		{Name: "optional-nil-required", Required: nil},
		{Name: "optional-false-required", Required: &boolFalse},
	}

	tests := []struct {
		name               string
		deployedComponents []zarfState.DeployedComponent
		expected           []string
	}{
		{
			name: "returns empty when only required components are deployed",
			deployedComponents: []zarfState.DeployedComponent{
				{Name: "required-a"},
				{Name: "required-b"},
			},
			expected: []string{},
		},
		{
			name: "returns only optional components when required and optional components are deployed",
			deployedComponents: []zarfState.DeployedComponent{
				{Name: "required-a"},
				{Name: "required-b"},
				{Name: "optional-nil-required"},
			},
			expected: []string{"optional-nil-required"},
		},
		{
			name: "multiple optional components deployed",
			deployedComponents: []zarfState.DeployedComponent{
				{Name: "required-a"},
				{Name: "optional-nil-required"},
				{Name: "optional-false-required"},
			},
			expected: []string{"optional-nil-required", "optional-false-required"},
		},
		{
			name: "excludes deployed components that are not in the package definition",
			deployedComponents: []zarfState.DeployedComponent{
				{Name: "required-a"},
				{Name: "unknown-component"},
			},
			expected: []string{},
		},
		{
			name:               "returns empty when no components are deployed",
			deployedComponents: []zarfState.DeployedComponent{},
			expected:           []string{},
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			result := deployedOptionalComponents(tc.deployedComponents, pkgComponents)
			assert.ElementsMatch(t, tc.expected, result)
		})
	}
}

func TestRefreshOptionalComponentsFromDeployedPackage(t *testing.T) {
	boolTrue := true
	boolFalse := false

	deployedPkg := zarfState.DeployedPackage{
		DeployedComponents: []zarfState.DeployedComponent{
			{Name: "required-a"},
			{Name: "optional-nil-required"},
		},
		Data: v1alpha1.ZarfPackage{
			Components: []v1alpha1.ZarfComponent{
				{Name: "required-a", Required: &boolTrue},
				{Name: "optional-nil-required", Required: nil},
				{Name: "optional-false-required", Required: &boolFalse},
			},
		},
	}

	t.Run("null current returns null unchanged", func(t *testing.T) {
		current := types.SetNull(types.StringType)
		result, diags := refreshOptionalComponentsFromDeployedPackage(deployedPkg, current)
		assert.False(t, diags.HasError())
		assert.True(t, result.IsNull())
	})

	t.Run("unknown current resolves deployed optional components", func(t *testing.T) {
		current := types.SetUnknown(types.StringType)
		result, diags := refreshOptionalComponentsFromDeployedPackage(deployedPkg, current)
		assert.False(t, diags.HasError())
		var names []string
		result.ElementsAs(context.Background(), &names, false)
		assert.ElementsMatch(t, []string{"optional-nil-required"}, names)
	})

	t.Run("returns deployed optional components from package metadata", func(t *testing.T) {
		current := types.SetValueMust(types.StringType, []attr.Value{types.StringValue("optional-nil-required")})
		result, diags := refreshOptionalComponentsFromDeployedPackage(deployedPkg, current)
		assert.False(t, diags.HasError())
		var names []string
		result.ElementsAs(context.Background(), &names, false)
		assert.ElementsMatch(t, []string{"optional-nil-required"}, names)
	})

	t.Run("no deployed optionals returns empty set", func(t *testing.T) {
		pkgNoOptionals := zarfState.DeployedPackage{
			DeployedComponents: []zarfState.DeployedComponent{{Name: "required-a"}},
			Data:               v1alpha1.ZarfPackage{Components: []v1alpha1.ZarfComponent{{Name: "required-a", Required: &boolTrue}}},
		}
		current := types.SetValueMust(types.StringType, []attr.Value{})
		result, diags := refreshOptionalComponentsFromDeployedPackage(pkgNoOptionals, current)
		assert.False(t, diags.HasError())
		assert.Equal(t, 0, len(result.Elements()))
	})
}

func TestDeployedPackageStatus(t *testing.T) {
	tests := []struct {
		name     string
		pkg      zarfState.DeployedPackage
		expected string
	}{
		{
			name: "failed component wins",
			pkg: zarfState.DeployedPackage{DeployedComponents: []zarfState.DeployedComponent{
				{Status: zarfState.ComponentStatusSucceeded},
				{Status: zarfState.ComponentStatusFailed},
			}},
			expected: "Failed",
		},
		{
			name: "failed chart wins",
			pkg: zarfState.DeployedPackage{DeployedComponents: []zarfState.DeployedComponent{
				{Status: zarfState.ComponentStatusSucceeded, InstalledCharts: []zarfState.InstalledChart{
					{Status: zarfState.ChartStatusFailed},
				}},
			}},
			expected: "Failed",
		},
		{
			name: "later failure wins over earlier removing component",
			pkg: zarfState.DeployedPackage{DeployedComponents: []zarfState.DeployedComponent{
				{Status: zarfState.ComponentStatusRemoving},
				{Status: zarfState.ComponentStatusFailed},
			}},
			expected: "Failed",
		},
		{
			name: "deploying when no failure exists",
			pkg: zarfState.DeployedPackage{DeployedComponents: []zarfState.DeployedComponent{
				{Status: zarfState.ComponentStatusDeploying},
			}},
			expected: "Deploying",
		},
		{
			name: "succeeded when all recorded state succeeds",
			pkg: zarfState.DeployedPackage{DeployedComponents: []zarfState.DeployedComponent{
				{Status: zarfState.ComponentStatusSucceeded, InstalledCharts: []zarfState.InstalledChart{
					{Status: zarfState.ChartStatusSucceeded},
				}},
			}},
			expected: "Succeeded",
		},
		{
			name:     "unknown with no recorded state",
			pkg:      zarfState.DeployedPackage{},
			expected: "Unknown",
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			assert.Equal(t, tc.expected, deployedPackageStatus(tc.pkg))
		})
	}
}

func TestPopulateStateFromDeployedPackage(t *testing.T) {
	boolFalse := false
	data := NewTestPackageResourceModel(
		WithOptionalComponents([]string{"old-optional"}),
	)
	pkg := zarfState.DeployedPackage{
		Name:              "deployed-package",
		Digest:            "sha256:abc123",
		Generation:        7,
		NamespaceOverride: "custom-namespace",
		Data: v1alpha1.ZarfPackage{
			Kind: v1alpha1.ZarfPackageConfig,
			Metadata: v1alpha1.ZarfMetadata{
				Name:         "deployed-package",
				Description:  "deployed description",
				Version:      "2.0.0",
				Architecture: "arm64",
			},
			Components: []v1alpha1.ZarfComponent{
				{Name: "required", Required: &boolFalse},
			},
		},
		DeployedComponents: []zarfState.DeployedComponent{
			{Name: "required", Status: zarfState.ComponentStatusSucceeded},
		},
		ConnectStrings: zarfState.ConnectStrings{
			"service": {Description: "service description"},
		},
	}

	diags := populateStateFromDeployedPackage(&data, pkg)
	require.False(t, diags.HasError(), "populate state diagnostics: %v", diags)
	assert.Equal(t, "deployed-package", data.Name.ValueString())
	assert.Equal(t, "2.0.0", data.Version.ValueString())
	assert.Equal(t, "ZarfPackageConfig", data.Kind.ValueString())
	assert.Equal(t, "arm64", data.Architecture.ValueString())
	assert.Equal(t, "custom-namespace", data.Namespace.ValueString())
	assert.Equal(t, []string{"required"}, mustStringSetElements(t, data.OptionalComponents))

	metadata := data.Metadata.Attributes()
	assert.Equal(t, "deployed-package", metadata["name"].(types.String).ValueString())
	assert.Equal(t, "deployed description", metadata["description"].(types.String).ValueString())
	assert.Equal(t, "2.0.0", metadata["version"].(types.String).ValueString())
	assert.Equal(t, "Succeeded", metadata["status"].(types.String).ValueString())
	assert.Equal(t, int64(7), metadata["generation"].(types.Int64).ValueInt64())
	assert.Equal(t, "sha256:abc123", metadata["digest"].(types.String).ValueString())

	var connectStrings []struct {
		Name        types.String `tfsdk:"name"`
		Description types.String `tfsdk:"description"`
	}
	diags = data.ConnectStrings.ElementsAs(context.Background(), &connectStrings, false)
	require.False(t, diags.HasError(), "connect string diagnostics: %v", diags)
	require.Len(t, connectStrings, 1)
	assert.Equal(t, "service", connectStrings[0].Name.ValueString())
	assert.Equal(t, "service description", connectStrings[0].Description.ValueString())
}

func TestPackageResource_Schema_Timeouts(t *testing.T) {
	ctx := context.Background()

	r := NewPackageResource(nil, nil, nil, nil).(*PackageResource)
	var schemaResp resource.SchemaResponse
	r.Schema(ctx, resource.SchemaRequest{}, &schemaResp)
	attrs := schemaResp.Schema.Attributes

	_, hasTimeouts := attrs["timeouts"]
	assert.True(t, hasTimeouts, "schema must contain 'timeouts' attribute")

	_, hasOldTimeout := attrs["timeout"]
	assert.False(t, hasOldTimeout, "schema must not contain legacy 'timeout' attribute")

	// null timeouts.Value falls back to code defaults
	tv := nullTimeoutsValue()

	d, diags := tv.Create(ctx, 30*time.Minute)
	assert.False(t, diags.HasError())
	assert.Equal(t, 30*time.Minute, d, "create default must be 30m")

	d, diags = tv.Read(ctx, 5*time.Minute)
	assert.False(t, diags.HasError())
	assert.Equal(t, 5*time.Minute, d, "read default must be 5m")

	d, diags = tv.Update(ctx, 30*time.Minute)
	assert.False(t, diags.HasError())
	assert.Equal(t, 30*time.Minute, d, "update default must be 30m")

	d, diags = tv.Delete(ctx, 30*time.Minute)
	assert.False(t, diags.HasError())
	assert.Equal(t, 30*time.Minute, d, "delete default must be 30m")

	// Explicit timeout overrides default for each operation independently
	var configured PackageResourceModel
	WithTimeout("45m")(&configured)
	d, diags = configured.Timeouts.Create(ctx, 30*time.Minute)
	assert.False(t, diags.HasError())
	assert.Equal(t, 45*time.Minute, d, "configured create timeout must override default")

	d, diags = configured.Timeouts.Read(ctx, 5*time.Minute)
	assert.False(t, diags.HasError())
	assert.Equal(t, 45*time.Minute, d, "configured read timeout must override default")

	d, diags = configured.Timeouts.Update(ctx, 30*time.Minute)
	assert.False(t, diags.HasError())
	assert.Equal(t, 45*time.Minute, d, "configured update timeout must override default")

	d, diags = configured.Timeouts.Delete(ctx, 30*time.Minute)
	assert.False(t, diags.HasError())
	assert.Equal(t, 45*time.Minute, d, "configured delete timeout must override default")

	// Operation independence: overriding create must not affect read default
	var createOnly PackageResourceModel
	WithCreateTimeout("60m")(&createOnly)
	d, diags = createOnly.Timeouts.Create(ctx, 30*time.Minute)
	assert.False(t, diags.HasError())
	assert.Equal(t, 60*time.Minute, d, "create-only override must apply to create")

	d, diags = createOnly.Timeouts.Read(ctx, 5*time.Minute)
	assert.False(t, diags.HasError())
	assert.Equal(t, 5*time.Minute, d, "create-only override must not affect read default")

	d, diags = createOnly.Timeouts.Update(ctx, 30*time.Minute)
	assert.False(t, diags.HasError())
	assert.Equal(t, 30*time.Minute, d, "create-only override must not affect update default")

	d, diags = createOnly.Timeouts.Delete(ctx, 30*time.Minute)
	assert.False(t, diags.HasError())
	assert.Equal(t, 30*time.Minute, d, "create-only override must not affect delete default")
}

func TestPackageResource_Schema_ComponentBlocksDeprecated(t *testing.T) {
	r := NewPackageResource(nil, nil, nil, nil).(*PackageResource)
	var schemaResp resource.SchemaResponse
	r.Schema(context.Background(), resource.SchemaRequest{}, &schemaResp)

	componentBlock, ok := schemaResp.Schema.Blocks["component"].(schema.SetNestedBlock)
	require.True(t, ok)
	assert.Equal(t, componentBlockDeprecationMessage, componentBlock.DeprecationMessage)

	overrideBlock, ok := componentBlock.NestedObject.Blocks["override"].(schema.SetNestedBlock)
	require.True(t, ok)
	assert.Equal(t, componentOverrideBlockDeprecationMessage, overrideBlock.DeprecationMessage)
}

func TestPackageResource_Upsert_ZarfReceivesRemainingBudget(t *testing.T) {
	packageLayout := newValidLoadPackageResult().Layout

	t.Run("operationTimeout is remaining budget not fixed 15m", func(t *testing.T) {
		mockPackager := &MockPackager{}
		mockPackageComponentFilter := &MockPackageComponentFilter{}
		mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil)
		mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)
		mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

		packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)

		lifecycleBudget := 5 * time.Minute
		ctx, cancel := context.WithTimeout(context.Background(), lifecycleBudget)
		defer cancel()

		_, err := packageResource.upsert(ctx, NewTestPackageResourceModel())
		require.NoError(t, err)

		for _, call := range mockPackager.Calls {
			if call.Method == "Deploy" {
				deployOpts := call.Arguments[2].(zarfPackager.DeployOptions)
				assert.Positive(t, deployOpts.Timeout, "Zarf timeout must be positive")
				assert.LessOrEqual(t, deployOpts.Timeout, lifecycleBudget,
					"Zarf timeout must not exceed the lifecycle budget")
				assert.InDelta(t, lifecycleBudget.Seconds(), deployOpts.Timeout.Seconds(), 1,
					"Zarf timeout must be close to the full remaining lifecycle budget")
			}
		}
	})

	t.Run("exhausted budget before upsert returns error", func(t *testing.T) {
		mockPackager := &MockPackager{}
		mockPackageComponentFilter := &MockPackageComponentFilter{}
		mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil)
		mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

		packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, nil).(*PackageResource)

		ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(-time.Second))
		defer cancel()

		_, err := packageResource.upsert(ctx, NewTestPackageResourceModel())
		require.Error(t, err)
		assert.Contains(t, err.Error(), "insufficient time remaining")
		mockPackager.AssertNotCalled(t, "Deploy")
	})
}

func TestRemoveComponents_ZarfReceivesRemainingBudget(t *testing.T) {
	t.Run("operationTimeout is remaining budget not fixed value", func(t *testing.T) {
		mockPackager := &MockPackager{}
		mockPackageComponentFilter := &MockPackageComponentFilter{}
		mockCluster := &MockCluster{}
		cluster := zarfCluster.Cluster{}
		mockCluster.On("NewWithWait", mock.Anything).Return(&cluster, nil)
		mockPackager.On("GetPackageFromSourceOrCluster", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).
			Return(v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-package"}}, nil)
		mockPackager.On("Remove", mock.Anything, mock.Anything, mock.Anything).Return(nil)
		mockPackageComponentFilter.On("ForRemove", mock.Anything).Return(mock.Anything)

		packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, mockCluster).(*PackageResource)

		lifecycleBudget := 5 * time.Minute
		ctx, cancel := context.WithTimeout(context.Background(), lifecycleBudget)
		defer cancel()

		err := packageResource.removeComponents(ctx, NewTestPackageResourceModel(), []string{"component-a"}, testPackageIdentity(""))
		require.NoError(t, err)

		for _, call := range mockPackager.Calls {
			if call.Method == "Remove" {
				removeOpts := call.Arguments[2].(zarfPackager.RemoveOptions)
				assert.Positive(t, removeOpts.Timeout, "Zarf timeout must be positive")
				assert.LessOrEqual(t, removeOpts.Timeout, lifecycleBudget,
					"Zarf timeout must not exceed the lifecycle budget")
				assert.InDelta(t, lifecycleBudget.Seconds(), removeOpts.Timeout.Seconds(), 1,
					"Zarf timeout must be close to the full remaining lifecycle budget")
			}
		}
	})

	t.Run("deploy budget recalculates after removal", func(t *testing.T) {
		packageLayout := newValidLoadPackageResult().Layout
		mockPackager := &MockPackager{}
		mockPackageComponentFilter := &MockPackageComponentFilter{}
		mockCluster := &MockCluster{}
		cluster := zarfCluster.Cluster{}
		mockCluster.On("NewWithWait", mock.Anything).Return(&cluster, nil)
		mockPackager.On("GetPackageFromSourceOrCluster", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything).
			Return(v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-package"}}, nil)
		// Sleep during Remove to consume real budget, proving Deploy recalculates from the shared deadline.
		mockPackager.On("Remove", mock.Anything, mock.Anything, mock.Anything).
			Run(func(_ mock.Arguments) { time.Sleep(50 * time.Millisecond) }).
			Return(nil)
		mockPackager.On("LoadPackage", mock.Anything, mock.Anything, mock.Anything).Return(packageLayout, nil)
		mockPackager.On("Deploy", mock.Anything, mock.Anything, mock.Anything).Return(packager.DeployResult{}, nil)
		mockPackageComponentFilter.On("ForRemove", mock.Anything).Return(mock.Anything)
		mockPackageComponentFilter.On("ForDeploy", mock.Anything).Return(mock.Anything)

		packageResource := NewPackageResource(nil, mockPackager, mockPackageComponentFilter, mockCluster).(*PackageResource)

		// oldPlan has a component the newPlan lacks, triggering removeComponents before upsert
		oldPlan := NewTestPackageResourceModel(WithComponents([]ComponentModel{
			NewTestComponentModel("component-a"),
		}))
		newPlan := NewTestPackageResourceModel()
		identity := deployedPackageIdentity{
			ID: "test-package", Name: "test-package",
			Package: zarfState.DeployedPackage{Name: "test-package", Data: v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-package"}}},
		}

		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
		defer cancel()

		_, err := packageResource.deployAsNewOrUpdate(ctx, newPlan, oldPlan, identity)
		require.NoError(t, err)

		var removeTimeout, deployTimeout time.Duration
		for _, call := range mockPackager.Calls {
			if call.Method == "Remove" {
				removeTimeout = call.Arguments[2].(zarfPackager.RemoveOptions).Timeout
			}
			if call.Method == "Deploy" {
				deployTimeout = call.Arguments[2].(zarfPackager.DeployOptions).Timeout
			}
		}
		assert.Greater(t, removeTimeout, 0*time.Second, "remove must receive positive budget")
		assert.Greater(t, deployTimeout, 0*time.Second, "deploy must receive positive budget")
		// both < lifecycle budget, confirming deadline-derived (not fixed) calculation
		assert.Less(t, removeTimeout, 5*time.Minute)
		assert.Less(t, deployTimeout, 5*time.Minute)
		// deploy runs after remove so its budget is strictly less (50 ms consumed by Remove mock)
		assert.Less(t, deployTimeout, removeTimeout,
			"deploy budget must be strictly less than remove budget, proving per-call recalculation from shared deadline")
	})
}

func TestTimeoutPositiveValidator(t *testing.T) {
	ctx := context.Background()
	r := NewPackageResource(nil, nil, nil, nil).(*PackageResource)

	var schemaResp resource.SchemaResponse
	r.Schema(ctx, resource.SchemaRequest{}, &schemaResp)

	schemaTFType := schemaResp.Schema.Type().TerraformType(ctx).(tftypes.Object)
	timeoutsType := schemaTFType.AttributeTypes["timeouts"].(tftypes.Object)

	buildConfig := func(field, value string) tfsdk.Config {
		// all schema attributes null except timeouts, which has one field set
		vals := make(map[string]tftypes.Value, len(schemaTFType.AttributeTypes))
		for name, typ := range schemaTFType.AttributeTypes {
			vals[name] = tftypes.NewValue(typ, nil)
		}
		tVals := make(map[string]tftypes.Value, len(timeoutsType.AttributeTypes))
		for name := range timeoutsType.AttributeTypes {
			if name == field {
				tVals[name] = tftypes.NewValue(tftypes.String, value)
			} else {
				tVals[name] = tftypes.NewValue(tftypes.String, nil)
			}
		}
		vals["timeouts"] = tftypes.NewValue(timeoutsType, tVals)
		return tfsdk.Config{Raw: tftypes.NewValue(schemaTFType, vals), Schema: schemaResp.Schema}
	}

	v := timeoutPositiveValidator{}

	for _, field := range []string{"create", "read", "update", "delete"} {
		t.Run("rejects non-positive "+field, func(t *testing.T) {
			var resp resource.ValidateConfigResponse
			v.ValidateResource(ctx, resource.ValidateConfigRequest{Config: buildConfig(field, "-1m")}, &resp)
			assert.True(t, resp.Diagnostics.HasError(), "field %q with -1m must fail validation", field)
		})
		t.Run("accepts positive "+field, func(t *testing.T) {
			var resp resource.ValidateConfigResponse
			v.ValidateResource(ctx, resource.ValidateConfigRequest{Config: buildConfig(field, "30m")}, &resp)
			assert.False(t, resp.Diagnostics.HasError(), "field %q with 30m must pass validation", field)
		})
	}

	// confirm ConfigValidators returns the positive-duration validator
	assert.NotEmpty(t, r.ConfigValidators(ctx))
}

// TestDelete_ClusterContextCappedAt5Minutes verifies that the cluster connection
// sub-context is capped at 5 m even when the configured delete timeout is much longer.
func TestDelete_ClusterContextCappedAt5Minutes(t *testing.T) {
	mockCluster := &MockCluster{}
	mockPackager := &MockPackager{}
	mockFilter := &MockPackageComponentFilter{}

	var capturedClusterCtx context.Context
	mockCluster.On("NewWithWait", mock.Anything).
		Run(func(args mock.Arguments) { capturedClusterCtx = args.Get(0).(context.Context) }).
		Return((*zarfCluster.Cluster)(nil), errors.New("cluster unavailable"))

	r := NewPackageResource(nil, mockPackager, mockFilter, mockCluster).(*PackageResource)
	model := NewTestPackageResourceModel(WithTimeout("60m"), WithDeployedState())
	state := buildTestState(t, r, model)

	var resp resource.DeleteResponse
	r.Delete(context.Background(), resource.DeleteRequest{State: state}, &resp)

	require.True(t, resp.Diagnostics.HasError())
	require.NotNil(t, capturedClusterCtx, "cluster.NewWithWait must have been called")

	deadline, ok := capturedClusterCtx.Deadline()
	require.True(t, ok, "cluster context must have a deadline")
	remaining := time.Until(deadline)
	assert.LessOrEqual(t, remaining.Seconds(), (5*time.Minute + 5*time.Second).Seconds(),
		"cluster context must be capped at 5m regardless of configured delete timeout")
}

func TestDelete_LoadsNamespacedPackageFromClusterAndDoesNotSetRemoteOptions(t *testing.T) {
	mockCluster := &MockCluster{}
	mockPackager := &MockPackager{}
	mockFilter := &MockPackageComponentFilter{}

	deployedPackage := zarfState.DeployedPackage{
		Name:              "test-pkg",
		NamespaceOverride: "package-namespace",
		Data:              v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-pkg"}},
	}
	cluster := &zarfCluster.Cluster{Clientset: fake.NewSimpleClientset(newPackageStateSecret(t, deployedPackage))}
	mockCluster.On("NewWithWait", mock.Anything).Return(cluster, nil).Twice()
	mockPackager.On("Remove", mock.Anything, mock.Anything, mock.Anything).
		Run(func(args mock.Arguments) {
			removeOpts := args.Get(2).(zarfPackager.RemoveOptions)
			assert.Equal(t, "package-namespace", removeOpts.NamespaceOverride)
		}).
		Return(nil)

	r := NewPackageResource(
		&udsProviderConfig{InsecureForceHTTP: true, InsecureSkipTLSVerification: true},
		mockPackager,
		mockFilter,
		mockCluster,
	).(*PackageResource)
	model := NewTestPackageResourceModel(WithDeployedState(), WithNamespace("package-namespace"))
	model.ID = types.StringValue("package-namespace:test-pkg")
	state := buildTestState(t, r, model)

	var output bytes.Buffer
	ctx := tflogtest.RootLogger(context.Background(), &output)
	var resp resource.DeleteResponse
	r.Delete(ctx, resource.DeleteRequest{State: state}, &resp)

	require.False(t, resp.Diagnostics.HasError(), "expected no error: %v", resp.Diagnostics)
	entries, err := tflogtest.MultilineJSONDecode(&output)
	require.NoError(t, err)
	assertLogEntry(t, entries, "package completed", nil)
	assertNoLogEntry(t, entries, "package failed")
	mockPackager.AssertExpectations(t)
	mockFilter.AssertNotCalled(t, "ForRemove", mock.Anything)
}

// TestDelete_ZarfHandoffUsesRemainingBudget verifies that RemoveOptions.Timeout is
// derived from the remaining lifecycle budget via zarfOperationTimeout, not a fixed value.
func TestDelete_ZarfHandoffUsesRemainingBudget(t *testing.T) {
	mockCluster := &MockCluster{}
	mockPackager := &MockPackager{}
	mockFilter := &MockPackageComponentFilter{}

	deployedPackage := zarfState.DeployedPackage{Name: "test-pkg", Data: v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-pkg"}}}
	cluster := &zarfCluster.Cluster{Clientset: fake.NewSimpleClientset(newPackageStateSecret(t, deployedPackage))}
	mockCluster.On("NewWithWait", mock.Anything).Return(cluster, nil).Twice()
	mockPackager.On("Remove", mock.Anything, mock.Anything, mock.Anything).Return(nil)

	r := NewPackageResource(nil, mockPackager, mockFilter, mockCluster).(*PackageResource)
	model := NewTestPackageResourceModel(WithTimeout("10m"), WithDeployedState())
	state := buildTestState(t, r, model)

	var resp resource.DeleteResponse
	r.Delete(context.Background(), resource.DeleteRequest{State: state}, &resp)

	require.False(t, resp.Diagnostics.HasError(), "expected no error: %v", resp.Diagnostics)

	for _, call := range mockPackager.Calls {
		if call.Method == "Remove" {
			removeOpts := call.Arguments[2].(zarfPackager.RemoveOptions)
			lifecycleBudget := 10 * time.Minute
			assert.Positive(t, removeOpts.Timeout, "Zarf timeout must be positive")
			assert.LessOrEqual(t, removeOpts.Timeout, lifecycleBudget,
				"Zarf timeout must not exceed the lifecycle budget")
			assert.InDelta(t, lifecycleBudget.Seconds(), removeOpts.Timeout.Seconds(), 1,
				"Zarf timeout must be close to the full remaining lifecycle budget")
		}
	}
	mockFilter.AssertNotCalled(t, "ForRemove", mock.Anything)
}

func TestDelete_ExhaustedBudgetSkipsPackageRemoval(t *testing.T) {
	mockCluster := &MockCluster{}
	mockPackager := &MockPackager{}
	mockFilter := &MockPackageComponentFilter{}

	deployedPackage := zarfState.DeployedPackage{Name: "test-pkg", Data: v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-pkg"}}}
	cluster := &zarfCluster.Cluster{Clientset: fake.NewSimpleClientset(newPackageStateSecret(t, deployedPackage))}
	mockCluster.On("NewWithWait", mock.Anything).Return(cluster, nil).Once()
	mockCluster.On("NewWithWait", mock.Anything).
		Run(func(args mock.Arguments) { <-args.Get(0).(context.Context).Done() }).
		Return(cluster, nil).Once()

	r := NewPackageResource(nil, mockPackager, mockFilter, mockCluster).(*PackageResource)
	model := NewTestPackageResourceModel(WithTimeout("10ms"), WithDeployedState())
	state := buildTestState(t, r, model)

	var output bytes.Buffer
	ctx := tflogtest.RootLogger(context.Background(), &output)
	var resp resource.DeleteResponse
	r.Delete(ctx, resource.DeleteRequest{State: state}, &resp)

	require.True(t, resp.Diagnostics.HasError())
	assert.Equal(t, "Package removal could not start", resp.Diagnostics[0].Summary())
	mockPackager.AssertNotCalled(t, "Remove")
	entries, err := tflogtest.MultilineJSONDecode(&output)
	require.NoError(t, err)
	assertLogEntry(t, entries, "package failed", nil)
	assertLogEntryFieldNotEmpty(t, entries, "package failed", "error")
	assertNoLogEntry(t, entries, "package completed")
}

// TestRead_DirectDeadlinePropagatedToCluster verifies that Read passes its full readTimeout
// context to getDeployedPackage without a child cap (unlike Delete's 5m cluster sub-context).
func TestRead_DirectDeadlinePropagatedToCluster(t *testing.T) {
	mockCluster := &MockCluster{}
	mockPackager := &MockPackager{}
	mockFilter := &MockPackageComponentFilter{}

	var capturedClusterCtx context.Context
	mockCluster.On("NewWithWait", mock.Anything).
		Run(func(args mock.Arguments) { capturedClusterCtx = args.Get(0).(context.Context) }).
		Return((*zarfCluster.Cluster)(nil), errors.New("cluster unavailable"))

	r := NewPackageResource(nil, mockPackager, mockFilter, mockCluster).(*PackageResource)
	// ID = "test-pkg" (set by WithDeployedState) is valid for parsePackageID.
	model := NewTestPackageResourceModel(WithTimeout("10m"), WithDeployedState())
	state := buildTestState(t, r, model)

	var resp resource.ReadResponse
	r.Read(context.Background(), resource.ReadRequest{State: state}, &resp)

	require.True(t, resp.Diagnostics.HasError())
	require.NotNil(t, capturedClusterCtx, "cluster.NewWithWait must have been called")

	deadline, ok := capturedClusterCtx.Deadline()
	require.True(t, ok, "cluster context must have a deadline")
	remaining := time.Until(deadline)
	// Read passes the full readTimeout directly — no 5m child cap.
	assert.Greater(t, remaining.Seconds(), (9 * time.Minute).Seconds(),
		"Read cluster context must carry the full readTimeout, not a 5m sub-cap")
	assert.LessOrEqual(t, remaining.Seconds(), (10*time.Minute + 5*time.Second).Seconds())
}

func TestPackageResource_ReadVerifiesIdentityBeforeWritingState(t *testing.T) {
	stateModel := NewTestPackageResourceModel(WithDeployedState())
	canonical := zarfState.DeployedPackage{
		Name: "test-pkg",
		Data: v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{
			Name:        "test-pkg",
			Description: "refreshed description",
			Version:     "2.0.0",
		}},
	}

	tests := []struct {
		name       string
		pkg        *zarfState.DeployedPackage
		clusterErr error
		wantError  bool
		wantAbsent bool
	}{
		{name: "canonical refresh", pkg: &canonical},
		{name: "metadata mismatch", pkg: func() *zarfState.DeployedPackage { p := canonical; p.Data.Metadata.Name = "other"; return &p }(), wantError: true},
		{name: "cluster error", clusterErr: errors.New("sentinel-cluster-error"), wantError: true},
		{name: "confirmed absence", wantAbsent: true},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			clientset := fake.NewSimpleClientset()
			if tc.pkg != nil {
				_, err := clientset.CoreV1().Secrets(zarfState.ZarfNamespaceName).Create(context.Background(), newPackageStateSecret(t, *tc.pkg), metav1.CreateOptions{})
				require.NoError(t, err)
			}
			cluster := &MockCluster{}
			if tc.clusterErr != nil {
				cluster.On("NewWithWait", mock.Anything).Return((*zarfCluster.Cluster)(nil), tc.clusterErr).Once()
			} else {
				cluster.On("NewWithWait", mock.Anything).Return(&zarfCluster.Cluster{Clientset: clientset}, nil).Once()
			}
			packageResource := NewPackageResource(nil, nil, nil, cluster).(*PackageResource)
			state := buildTestState(t, packageResource, stateModel)
			resp := resource.ReadResponse{State: tfsdk.State{Schema: state.Schema}}

			packageResource.Read(context.Background(), resource.ReadRequest{State: state}, &resp)

			assert.Equal(t, tc.wantError, resp.Diagnostics.HasError())
			if tc.wantError || tc.wantAbsent {
				assert.True(t, resp.State.Raw.IsNull(), "Read must not write state after an identity error or confirmed absence")
				return
			}
			refreshed := requirePackageState(t, resp.State)
			assert.Equal(t, "test-pkg", refreshed.Name.ValueString())
			assert.Equal(t, "2.0.0", refreshed.Version.ValueString())
		})
	}
}

func TestPackageResource_ReadRefreshesProvisionalAliasWithoutSourceAccess(t *testing.T) {
	alias := zarfState.DeployedPackage{
		Name:              "test-pkg-alias",
		NamespaceOverride: "team-a",
		Data:              v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-pkg-alias", Version: "2.0.0"}},
	}
	cluster := &MockCluster{}
	cluster.On("NewWithWait", mock.Anything).Return(&zarfCluster.Cluster{Clientset: fake.NewSimpleClientset(newPackageStateSecret(t, alias))}, nil).Once()
	packageResource := NewPackageResource(nil, nil, nil, cluster).(*PackageResource)
	stateModel := NewTestPackageResourceModel(WithDeployedState(), WithNamespace(alias.NamespaceOverride))
	stateModel.ID = types.StringValue(computePackageID(alias.NamespaceOverride, alias.Name))
	stateModel.Name = types.StringValue(alias.Name)
	state := buildTestState(t, packageResource, stateModel)
	resp := resource.ReadResponse{State: tfsdk.State{Schema: state.Schema}}

	packageResource.Read(context.Background(), resource.ReadRequest{State: state}, &resp)

	require.False(t, resp.Diagnostics.HasError(), "read diagnostics: %v", resp.Diagnostics)
	refreshed := requirePackageState(t, resp.State)
	assert.Equal(t, alias.Name, refreshed.Name.ValueString())
	assert.Equal(t, alias.NamespaceOverride, refreshed.Namespace.ValueString())
}

func TestPackageResource_DeleteRemovesVerifiedAliasWithoutSourceAccess(t *testing.T) {
	alias := zarfState.DeployedPackage{
		Name:              "test-pkg-alias",
		NamespaceOverride: "team-a",
		Data: v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{
			Name: "test-pkg-alias",
		}},
	}
	cluster := &MockCluster{}
	client := &zarfCluster.Cluster{Clientset: fake.NewSimpleClientset(newPackageStateSecret(t, alias))}
	cluster.On("NewWithWait", mock.Anything).Return(client, nil).Twice()
	packager := &MockPackager{}
	packager.On("Remove", mock.Anything, mock.MatchedBy(func(pkg v1alpha1.ZarfPackage) bool {
		return pkg.Metadata.Name == alias.Name
	}), mock.MatchedBy(func(opts zarfPackager.RemoveOptions) bool {
		return opts.NamespaceOverride == alias.NamespaceOverride
	})).Return(nil).Once()
	packageResource := NewPackageResource(nil, packager, nil, cluster).(*PackageResource)
	stateModel := NewTestPackageResourceModel(WithDeployedState(), WithNamespace(alias.NamespaceOverride))
	stateModel.ID = types.StringValue(computePackageID(alias.NamespaceOverride, alias.Name))
	stateModel.Name = types.StringValue(alias.Name)
	state := buildTestState(t, packageResource, stateModel)

	var resp resource.DeleteResponse
	packageResource.Delete(context.Background(), resource.DeleteRequest{State: state}, &resp)

	require.False(t, resp.Diagnostics.HasError(), "delete diagnostics: %v", resp.Diagnostics)
	packager.AssertExpectations(t)
	packager.AssertNotCalled(t, "LoadPackage", mock.Anything, mock.Anything, mock.Anything)
	packager.AssertNotCalled(t, "GetPackageFromSourceOrCluster", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything)
}

func TestPackageResource_DeleteAlreadyAbsentSucceedsWithoutRemove(t *testing.T) {
	cluster := &MockCluster{}
	cluster.On("NewWithWait", mock.Anything).Return(newFakeCluster(), nil).Once()
	packager := &MockPackager{}
	packageResource := NewPackageResource(nil, packager, nil, cluster).(*PackageResource)
	state := buildTestState(t, packageResource, NewTestPackageResourceModel(WithDeployedState()))

	var resp resource.DeleteResponse
	packageResource.Delete(context.Background(), resource.DeleteRequest{State: state}, &resp)

	require.False(t, resp.Diagnostics.HasError(), "delete diagnostics: %v", resp.Diagnostics)
	packager.AssertNotCalled(t, "Remove", mock.Anything, mock.Anything, mock.Anything)
	cluster.AssertExpectations(t)
}

func TestPackageResource_DeleteLookupAndIdentityFailuresBlockRemoval(t *testing.T) {
	canonical := zarfState.DeployedPackage{
		Name: "test-pkg",
		Data: v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-pkg"}},
	}
	tests := []struct {
		name       string
		pkg        zarfState.DeployedPackage
		clusterErr error
	}{
		{name: "returned name mismatch", pkg: func() zarfState.DeployedPackage { p := canonical; p.Name = "other"; return p }()},
		{name: "returned namespace mismatch", pkg: func() zarfState.DeployedPackage { p := canonical; p.NamespaceOverride = "other"; return p }()},
		{name: "returned metadata mismatch", pkg: func() zarfState.DeployedPackage { p := canonical; p.Data.Metadata.Name = "other"; return p }()},
		{name: "cluster lookup failure", clusterErr: errors.New("sentinel-cluster-secret")},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			cluster := &MockCluster{}
			if tc.clusterErr != nil {
				cluster.On("NewWithWait", mock.Anything).Return((*zarfCluster.Cluster)(nil), tc.clusterErr).Once()
			} else {
				secret := newPackageStateSecret(t, tc.pkg)
				secret.Name = canonical.GetSecretName()
				cluster.On("NewWithWait", mock.Anything).Return(&zarfCluster.Cluster{Clientset: fake.NewSimpleClientset(secret)}, nil).Once()
			}
			packager := &MockPackager{}
			packageResource := NewPackageResource(nil, packager, nil, cluster).(*PackageResource)
			state := buildTestState(t, packageResource, NewTestPackageResourceModel(WithDeployedState()))

			var resp resource.DeleteResponse
			packageResource.Delete(context.Background(), resource.DeleteRequest{State: state}, &resp)

			require.True(t, resp.Diagnostics.HasError())
			assert.NotContains(t, resp.Diagnostics.Errors()[0].Detail(), "sentinel-cluster-secret")
			packager.AssertNotCalled(t, "Remove", mock.Anything, mock.Anything, mock.Anything)
		})
	}
}

func TestPackageResource_DeleteRemoveFailureIsRetriable(t *testing.T) {
	deployedPackage := zarfState.DeployedPackage{
		Name: "test-pkg",
		Data: v1alpha1.ZarfPackage{Metadata: v1alpha1.ZarfMetadata{Name: "test-pkg"}},
	}
	client := &zarfCluster.Cluster{Clientset: fake.NewSimpleClientset(newPackageStateSecret(t, deployedPackage))}
	cluster := &MockCluster{}
	cluster.On("NewWithWait", mock.Anything).Return(client, nil).Twice()
	packager := &MockPackager{}
	packager.On("Remove", mock.Anything, mock.Anything, mock.Anything).Return(errors.New("remove failed")).Once()
	packageResource := NewPackageResource(nil, packager, nil, cluster).(*PackageResource)
	state := buildTestState(t, packageResource, NewTestPackageResourceModel(WithDeployedState()))

	var resp resource.DeleteResponse
	packageResource.Delete(context.Background(), resource.DeleteRequest{State: state}, &resp)

	require.True(t, resp.Diagnostics.HasError())
	assert.Contains(t, resp.Diagnostics.Errors()[0].Detail(), "remove failed")
	packager.AssertExpectations(t)
}