#Requires -Version 7.4

function Test-vSEALConfiguration {
    <#
    .SYNOPSIS
    Orchestrates validation of framework and plugin configuration schemas.

    .DESCRIPTION
    Validates the entire vSEAL configuration by:
    1. Validating framework sections ([vseal], [logging], [storage])
    2. Discovering all plugins and verifying config references
    3. Validating [plugins.{id}] sections reference known plugins

    Plugin configuration format:
    - New format: [plugins.{id}] where {id} is the plugin name from TOML
    - Old format [category.plugin] is no longer supported (treated as unknown section)

    .PARAMETER Config
    The configuration object (OrderedDictionary) returned from Import-vSEALConfiguration.

    .PARAMETER BuiltInPluginPath
    The path to the built-in plugin directory (e.g., "$PSScriptRoot\..\Plugins").

    .PARAMETER LocalPluginPath
    Optional path to local plugins (e.g., "plugins-custom/").

    .PARAMETER SharedPluginPath
    Optional path to shared plugins (e.g., "$env:ProgramData\vSEAL\plugins").

    .EXAMPLE
    Test-vSEALConfiguration -Config $config -BuiltInPluginPath $builtInPluginPath

    .EXAMPLE
    # Config with plugin section
    # [plugins.defender]
    # enabled = true
    # real_time_protection = false

    Test-vSEALConfiguration -Config $config -BuiltInPluginPath $builtInPluginPath

    .NOTES
    - Runs framework validation before plugin validation
    - Plugin config sections are optional (plugins work without config)
    - References to unknown plugins throw errors
    - Plugins with Status=Error in registry also throw errors
    #>
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)]
        [System.Collections.Specialized.OrderedDictionary]$Config,

        [Parameter(Mandatory)]
        [string]$BuiltInPluginPath,

        [Parameter()]
        [string]$LocalPluginPath,

        [Parameter()]
        [string]$SharedPluginPath
    )

    # Stage 1: Validate framework schema
    Write-vSEALLog "Validating framework configuration schema..." -Level 'DEBUG'
    try {
        Test-FrameworkSchema -Config $Config
    }
    catch {
        # Re-throw with context
        throw "Framework configuration validation failed: $($_.Exception.Message)"
    }

    # Stage 2: Discover plugins
    Write-vSEALLog "Discovering plugins for configuration validation..." -Level 'DEBUG'
    $registry = Get-vSEALPluginRegistry -BuiltInPath $BuiltInPluginPath -LocalPath $LocalPluginPath -SharedPath $SharedPluginPath

    # Stage 3: Validate [plugins] section references
    if ($Config.Contains('plugins') -and $null -ne $Config['plugins']) {
        $pluginsSection = $Config['plugins']

        foreach ($pluginId in $pluginsSection.Keys) {
            Write-vSEALLog "Validating plugin config: [plugins.$pluginId]" -Level 'DEBUG'

            # Check plugin exists in registry
            if (-not $registry.ContainsKey($pluginId)) {
                throw "Configuration error: [plugins.$pluginId] references unknown plugin '$pluginId'"
            }

            # Check plugin is usable (Valid or Skipped are OK, Error is not)
            $pluginEntry = $registry[$pluginId]
            if ($pluginEntry.Status -eq 'Error') {
                throw "Configuration error: [plugins.$pluginId] references plugin with error: $($pluginEntry.ErrorMessage)"
            }

            # Plugin config section is valid - no schema validation in v2
            # (Schema validation happens via plugin.toml constraints, not runtime PS1 functions)
        }
    }

    Write-vSEALLog "Configuration validation passed" -Level 'DEBUG'
}
