import assert from "node:assert/strict";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import { createRequire } from "node:module";
import test from "node:test";
import ts from "typescript";

const root = path.resolve(import.meta.dirname, "../../..");
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "script-manifest-budgets-"));
const require = createRequire(import.meta.url);
for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
  const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
  const output = ts.transpileModule(source, {
    compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 },
    fileName: `${name}.ts`,
  }).outputText
    .replace('require("./asset-path")', 'require("./asset-path.cjs")')
    .replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
  fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
}
const protocol = require(path.join(temporary, "scripting-platform.cjs"));
const digest = "a".repeat(64);
const signature = "b".repeat(128);
const script = (id, overrides = {}) => ({
  id,
  name: id,
  entryPath: `scripts/${id}.py`,
  sourceByteLength: 128,
  sourceSha256: digest,
  publisher: "local",
  signature,
  keyId: "key:local",
  permissions: ["READ_MAIN"],
  dependencies: [],
  module: false,
  cpuMs: 1000,
  memoryBytes: 1024 * 1024,
  wallMs: 5000,
  network: false,
  autorun: false,
  driverExpressions: false,
  addonInstall: false,
  ...overrides,
});
const manifest = (scripts = [script("clean")]) => ({ schemaVersion: 1, scripts });

test("M13-02A accepts bounded manifest fields and normalizes project paths", () => {
  const parsed = protocol.parseScriptingManifest(manifest([
    script("base", { entryPath: "//scripts/../scripts/base.py" }),
    script("clean", { dependencies: [{ id: "base", sourceSha256: digest, sourcePath: "//deps/base.py" }] }),
  ]));
  assert.equal(parsed.scripts.length, 2);
  assert.equal(parsed.scripts[0].entryPath, "scripts/base.py");
  assert.equal(parsed.scripts[1].dependencies[0].sourcePath, "deps/base.py");
  assert.equal(parsed.scripts.reduce((total, item) => total + item.sourceByteLength, 0), 256);
  assert.equal(parsed.scripts.every((item) => item.module === false), true);
});

test("M13-02A rejects text count and aggregate source byte budget overflow", () => {
  assert.throws(
    () => protocol.parseScriptingManifest(manifest(Array.from({ length: protocol.SCRIPTING_BUDGET.maxScripts + 1 }, (_, index) => script(`script-${index}`)))),
    /SCRIPT_BUDGET_EXCEEDED/,
  );
  assert.throws(
    () => protocol.parseScriptingManifest(manifest([script("large", { sourceByteLength: protocol.SCRIPTING_BUDGET.maxSourceBytes }), script("overflow", { sourceByteLength: 1 })])),
    /SCRIPT_BUDGET_EXCEEDED/,
  );
  assert.throws(() => protocol.parseScriptingManifest(manifest([script("missing-bytes", { sourceByteLength: undefined })])), /SCRIPT_BUDGET_EXCEEDED/);
});

test("M13-02A rejects module execution, unsafe paths, and malformed dependencies", () => {
  assert.throws(() => protocol.parseScriptingManifest(manifest([script("module", { module: true })])), /SCRIPT_POLICY_DENIED/);
  assert.throws(() => protocol.parseScriptingManifest(manifest([script("escape", { entryPath: "../escape.py" })])), /SCRIPT_MANIFEST_INVALID/);
  assert.throws(() => protocol.parseScriptingManifest(manifest([script("dependency-escape", { dependencies: [{ id: "base", sourceSha256: digest, sourcePath: "//../escape.py" }] }), script("base")])), /SCRIPT_MANIFEST_INVALID/);
  assert.throws(() => protocol.parseScriptingManifest(manifest([script("duplicate-dependency", { dependencies: [{ id: "base", sourceSha256: digest, sourcePath: "deps/a.py" }, { id: "base", sourceSha256: digest, sourcePath: "deps/b.py" }] }), script("base")])), /SCRIPT_MANIFEST_INVALID/);
  assert.throws(() => protocol.parseScriptingManifest(manifest([script("too-many-dependencies", { dependencies: Array.from({ length: protocol.SCRIPTING_BUDGET.maxDependencies + 1 }, (_, index) => ({ id: `dep-${index}`, sourceSha256: digest, sourcePath: `deps/${index}.py` })) })])), /SCRIPT_BUDGET_EXCEEDED/);
});

test("M13-02A rejects unknown or over-budget permissions", () => {
  assert.throws(() => protocol.parseScriptingManifest(manifest([script("unknown-permission", { permissions: ["EXECUTE"] })])), /SCRIPT_POLICY_DENIED/);
  assert.throws(() => protocol.parseScriptingManifest(manifest([script("permission-budget", { permissions: new Array(protocol.SCRIPTING_BUDGET.maxPermissions + 1).fill("READ_MAIN") })])), /SCRIPT_POLICY_DENIED/);
});

test.after(() => fs.rmSync(temporary, { recursive: true, force: true }));