/* === Form data & routing logic === */

const BRAND_NAME = (window.BRAND && window.BRAND.name) || "Cythera";
const STEPS = [
  {
    id: "concern",
    tag: "Primary need",
    title: "What's the main thing you'd like help with?",
    sub: "Pick the option that best describes where you are right now. We'll tailor the recommendation to match.",
    type: "single",
    options: [
      { value: "monitoring", label: "24/7 monitoring & threat detection", desc: "Eyes on your environment around the clock", route: "mdr" },
      { value: "ransomware", label: "Ransomware & phishing defense", desc: "Reduce exposure to email and endpoint attacks", route: "mdr" },
      { value: "cloud_m365", label: "Cloud & Microsoft 365 security", desc: "Harden your cloud workloads and identities", route: "mdr" },
      { value: "compliance", label: "Compliance, governance or board reporting", desc: "ISO 27001, Essential 8, audits, board packs", route: "compliance" },
      { value: "pentest", label: "Penetration testing or security assessment", desc: "Validate your defenses against real techniques", route: "pentest" },
      { value: "strategy", label: "Long-term security strategy & roadmap", desc: "Build a multi-year plan with executive buy-in", route: "vciso" },
      { value: "unsure", label: "I'm not sure, I want to talk it through", desc: "We'll help scope it from a quick discovery call", route: "unsure" },
    ],
  },
  {
    id: "size",
    tag: "Organisation",
    title: "How big is your team?",
    sub: "Helps us match you with the right level of engagement.",
    type: "single",
    options: [
      { value: "0-50", label: "Up to 50 people", desc: "Small team, lean IT" },
      { value: "51-200", label: "51 – 200 people", desc: "Growing, multiple departments" },
      { value: "201-1000", label: "201 – 1,000 people", desc: "Mid-market, dedicated IT function" },
      { value: "1000+", label: "1,000+ people", desc: "Enterprise, multi-site or regulated" },
    ],
  },
  {
    id: "posture",
    tag: "Current state",
    title: "What does your security setup look like today?",
    sub: "An honest answer here makes the recommendation much better. There's no wrong one.",
    type: "single",
    options: [
      { value: "nothing", label: "Nothing formal yet", desc: "We know we need to do something" },
      { value: "tools", label: "Some tools, no dedicated owner", desc: "Antivirus, MFA, maybe a firewall" },
      { value: "it_team", label: "Our IT team handles security", desc: "No dedicated security headcount" },
      { value: "security_team", label: "We have a security team or lead", desc: "Looking to extend capability or capacity" },
      { value: "unsure", label: "I'm not sure", desc: "Someone else looks after this" },
    ],
  },
  {
    id: "outcomes",
    tag: "Desired outcomes",
    title: "What outcomes matter most to you?",
    sub: "Pick all that apply. Minimum one, no maximum.",
    type: "multi",
    options: [
      { value: "detect", label: "Detect threats faster", desc: "Cut dwell time, reduce blast radius", route: "mdr" },
      { value: "audit", label: "Pass an audit or certification", desc: "ISO 27001, SOC 2, Essential 8", route: "compliance" },
      { value: "board", label: "Get board-level reporting & governance", desc: "Risk in language the board understands", route: "vciso" },
      { value: "validate", label: "Validate our defenses with real testing", desc: "Find weaknesses before attackers do", route: "pentest" },
      { value: "reduce_risk", label: "Reduce overall cyber risk", desc: "Broad uplift across the environment" },
      { value: "roadmap", label: "Build a long-term security roadmap", desc: "Multi-year, budgeted, sequenced", route: "vciso" },
      { value: "ransomware_ready", label: "Be ready for ransomware", desc: "Containment, backups, runbooks", route: "mdr" },
      { value: "unsure", label: "I'm not sure yet", desc: "We're still scoping" },
    ],
  },
  {
    id: "timeframe",
    tag: "Timeframe",
    title: "When do you need this in place?",
    sub: "Be honest, we'll match urgency in our response.",
    type: "single",
    options: [
      { value: "asap", label: "As soon as possible", desc: "Within the next few weeks" },
      { value: "quarter", label: "This quarter", desc: "Active project, kicking off soon" },
      { value: "year", label: "Within 6 – 12 months", desc: "Planning ahead, budget being scoped" },
      { value: "exploring", label: "Just exploring", desc: "Doing research, no firm date yet" },
    ],
  },
  {
    id: "contact",
    tag: "Your details",
    title: "Where should we send the recommendation?",
    sub: `We'll send a copy by email and a ${BRAND_NAME} advisor will reach out within one business day.`,
    type: "contact",
  },
];

const PATHWAYS = {
  incident: {
    name: "Incident Response",
    code: "IR",
    title: "Incident Response",
    why: `You indicated you may have an active issue. ${BRAND_NAME}'s IR team can engage immediately to contain, investigate and remediate. Every minute counts when an incident is live.`,
    urgency: { level: "critical", label: "Critical", text: "Engage within hours, not days." },
    cta: "Talk to an IR responder",
  },
  mdr: {
    name: "Managed Detection and Response",
    code: "MDR",
    title: "Managed Detection and Response",
    why: "Based on your focus on monitoring, ransomware exposure or cloud workloads, MDR gives you a 24/7 SOC watching your environment with proven containment playbooks, without hiring a team.",
    urgency: { level: "high", label: "High", text: "Recommend onboarding within 4–6 weeks." },
    cta: "Talk to an expert",
  },
  vciso: {
    name: "vCISO / Security Advisory",
    code: "vCISO",
    title: "vCISO / Security Advisory",
    why: "Your priorities point to leadership-level guidance: strategy, roadmap and board reporting. A virtual CISO embeds with your team, owns the program, and translates risk into business language.",
    urgency: { level: "medium", label: "Medium", text: "Engage on a monthly retainer cadence." },
    cta: "Talk to an expert",
  },
  pentest: {
    name: "Penetration Testing / Security Assessment",
    code: "PENTEST",
    title: "Penetration Testing & Security Assessment",
    why: "You want to validate your defenses with real-world techniques. A scoped pen test or maturity assessment gives you a prioritised, evidence-backed view of where to invest next.",
    urgency: { level: "medium", label: "Medium", text: "Typical engagement: 2–6 weeks." },
    cta: "Talk to an expert",
  },
  compliance: {
    name: "Cyber Maturity / Compliance Support",
    code: "MATURITY",
    title: "Cyber Maturity & Compliance Support",
    why: "Your goals include certification, audit-readiness or framework alignment. We'll close gaps against ISO 27001, Essential 8 or SOC 2, and give you the artefacts auditors actually accept.",
    urgency: { level: "medium", label: "Medium", text: "Typical lead time: 1–3 months." },
    cta: "Talk to an expert",
  },
  discovery: {
    name: "General Discovery Call",
    code: "DISCOVERY",
    title: "Discovery Call",
    why: `It sounds like you're still scoping. A 30-minute discovery call with a ${BRAND_NAME} advisor is the fastest way to clarify what you actually need. No obligation, no pitch.`,
    urgency: { level: "low", label: "Low", text: "Book at your convenience." },
    cta: "Book a discovery call",
  },
};

/* === Routing logic ===
   Priority:
   1. Urgent pre-flight → Incident Response
   2. 2+ "unsure" answers → General Discovery
   3. Compliance/board outcomes → Compliance or vCISO
   4. Pen test concern or validate outcome → Pen Testing
   5. Monitoring/ransomware/cloud concern or detect/ransomware-ready outcomes → MDR
   6. Strategy/roadmap → vCISO
   7. Default → Discovery
*/

function recommendPathway(state) {
  if (state.urgent) return "incident";

  const unsureCount =
    (state.answers.concern === "unsure" ? 1 : 0) +
    (state.answers.posture === "unsure" ? 1 : 0) +
    ((state.answers.outcomes || []).includes("unsure") ? 1 : 0);

  if (unsureCount >= 2) return "discovery";

  const outcomes = state.answers.outcomes || [];
  const concern = state.answers.concern;

  // Compliance / governance / board
  if (concern === "compliance") {
    // If they also want strategy/board reporting → vCISO; otherwise compliance support
    if (outcomes.includes("board") || outcomes.includes("roadmap")) return "vciso";
    return "compliance";
  }
  if (outcomes.includes("audit") && !outcomes.includes("board")) return "compliance";
  if (outcomes.includes("board")) return "vciso";

  // Pen testing
  if (concern === "pentest" || outcomes.includes("validate")) return "pentest";

  // MDR
  if (["monitoring", "ransomware", "cloud_m365"].includes(concern)) return "mdr";
  if (outcomes.includes("detect") || outcomes.includes("ransomware_ready")) return "mdr";

  // Strategy
  if (concern === "strategy" || outcomes.includes("roadmap")) return "vciso";

  // Fallback
  return "discovery";
}

function readableAnswer(stepId, value) {
  const step = STEPS.find((s) => s.id === stepId);
  if (!step || !step.options) return value;
  if (Array.isArray(value)) {
    return value.map((v) => step.options.find((o) => o.value === v)?.label || v);
  }
  return step.options.find((o) => o.value === value)?.label || value;
}

window.STEPS = STEPS;
window.PATHWAYS = PATHWAYS;
window.recommendPathway = recommendPathway;
window.readableAnswer = readableAnswer;