import assert from "node:assert/strict";
import crypto from "node:crypto";
import fs from "node:fs";
import path from "node:path";
import { fileURLToPath } from "node:url";

const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
const roots = [path.join(root, "web/app/src/app"), path.join(root, "web/app/src/workers"), path.join(root, "web/protocol")];
const manifestPath = path.join(root, "tests/golden/M13-01D/manifest.json");
const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
assert.deepEqual({ schemaVersion: manifest.schemaVersion, task: manifest.task, parentTask: manifest.parentTask, nextTask: manifest.nextTask }, { schemaVersion: 1, task: "M13-01D", parentTask: "M13-01C", nextTask: "M13-01E" });
const files = [];
function walk(directory) { for (const entry of fs.readdirSync(directory, { withFileTypes: true })) { const file = path.join(directory, entry.name); if (entry.isDirectory()) walk(file); else if (/\.(ts|tsx)$/.test(entry.name)) files.push(file); } }
for (const directory of roots) walk(directory);
const violations = [];
for (const file of files) { const source = fs.readFileSync(file, "utf8"); if (/\beval\s*\(|\bnew\s+Function\s*\(/.test(source)) violations.push(path.relative(root, file)); }
assert.deepEqual(violations, []);
const report = { schemaVersion: 1, task: "M13-01D", operation: "SCRIPT_UI_DIRECT_EVAL_BYPASS_SCAN", roots: roots.map((value) => path.relative(root, value)), scannedFiles: files.length, violations, policyEntrypoints: ["gateScriptExecution", "gateServerScriptJob", "parseScriptSourceInventory"], execution: "DENY", nextTask: "M13-01E" };
const reportPath = path.join(root, "tests/golden/M13-01D/ui-bypass-report.json"); fs.mkdirSync(path.dirname(reportPath), { recursive: true }); fs.writeFileSync(reportPath, JSON.stringify(report, null, 2) + "\n");
for (const artifact of Object.values(manifest.artifacts)) assert.equal(crypto.createHash("sha256").update(fs.readFileSync(path.join(root, artifact.path))).digest("hex"), artifact.sha256, `artifact hash mismatch ${artifact.path}`);
const digest = crypto.createHash("sha256").update(JSON.stringify(report)).digest("hex");
process.stdout.write(`script-ui-bypass-ok scanned=${files.length} violations=0 policyEntrypoints=3 report=${digest} next=${report.nextTask}\n`);