import assert from "node:assert/strict";
import { spawnSync } from "node:child_process";
import test from "node:test";
import { readFile } from "node:fs/promises";

interface PackageContract {
  private?: boolean;
  license?: string;
  bin?: Record<string, string>;
  files?: string[];
  scripts?: Record<string, string>;
}

test("npm package contract exposes only the compiled private CLI", async () => {
  const [packageText, sourceEntry, compiledEntry] = await Promise.all([
    readFile(new URL("../../package.json", import.meta.url), "utf8"),
    readFile(new URL("../../src/index.ts", import.meta.url), "utf8"),
    readFile(new URL("../src/index.js", import.meta.url), "utf8"),
  ]);
  const packageJson = JSON.parse(packageText) as PackageContract;

  assert.equal(packageJson.private, true);
  assert.equal(packageJson.license, "UNLICENSED");
  assert.deepEqual(packageJson.bin, { "codex-chief-of-staff": "dist/src/index.js" });
  assert.deepEqual(packageJson.files, ["dist/src", "README.md"]);
  assert.equal(packageJson.scripts?.prepack, "npm test");
  assert.match(sourceEntry, /^#!\/usr\/bin\/env node\n/);
  assert.match(compiledEntry, /^#!\/usr\/bin\/env node\n/);
});

test("packed-artifact verifier rejects a missing tarball argument", () => {
  const verifier = new URL("../../scripts/verify-packed-package.mjs", import.meta.url);
  const result = spawnSync(process.execPath, [verifier.pathname], { encoding: "utf8" });
  assert.notEqual(result.status, 0);
  assert.match(result.stderr, /Packed-package verification failed: usage:/);
});