import assert from "node:assert/strict";
import fs from "node:fs";
import os from "node:os";
import path from "node:path";
import { createRequire } from "node:module";
import { pathToFileURL } from "node:url";
import test from "node:test";
import ts from "typescript";

const root = path.resolve(import.meta.dirname, "../../..");
const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "script-policy-codes-"));
const require = createRequire(import.meta.url);
for (const name of ["asset-path", "capability-gates", "scripting-platform"]) {
  const source = fs.readFileSync(path.join(root, `web/protocol/${name}.ts`), "utf8");
  const output = ts.transpileModule(source, { compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget.ES2022 }, fileName: `${name}.ts` }).outputText.replace('require("./asset-path")', 'require("./asset-path.cjs")').replace('require("./capability-gates")', 'require("./capability-gates.cjs")');
  fs.writeFileSync(path.join(temporary, `${name}.cjs`), output);
}
const protocol = require(path.join(temporary, "scripting-platform.cjs"));
const base = { schemaVersion: 1, scripts: [{ id: "demo", name: "Demo", entryPath: "scripts/demo.py", sourceByteLength: 128, sourceSha256: "a".repeat(64), publisher: "local", signature: "b".repeat(128), keyId: "key", permissions: ["READ_MAIN"], dependencies: [], module: false, cpuMs: 1000, memoryBytes: 64 * 1024 * 1024, wallMs: 2000, network: false, autorun: false, driverExpressions: false, addonInstall: false }] };

test("M13-01C returns stable default-deny codes for autorun, driver and add-on execution", () => {
  assert.throws(() => protocol.parseScriptingManifest({ ...base, scripts: [{ ...base.scripts[0], autorun: true }] }), /SCRIPT_POLICY_DENIED/);
  assert.throws(() => protocol.parseScriptingManifest({ ...base, scripts: [{ ...base.scripts[0], driverExpressions: true }] }), /DRIVER_EXECUTION_BLOCKED/);
  assert.throws(() => protocol.parseScriptingManifest({ ...base, scripts: [{ ...base.scripts[0], addonInstall: true }] }), /ADDON_INSTALL_BLOCKED/);
  const gate = protocol.gateScriptExecution(base, "demo", new Set(["key"]));
  assert.equal(gate.status, "BLOCKED");
  assert.equal(gate.issues[0].code, "SCRIPT_SANDBOX_UNAVAILABLE");
});

test.after(() => fs.rmSync(temporary, { recursive: true, force: true }));