import fs from 'node:fs'
import path from 'node:path'

const root = path.resolve(import.meta.dirname, '..')
const artifact = path.join(root, 'release/server-artifact')
const update = JSON.parse(fs.readFileSync(path.join(root, 'protocol/update-authority.json'), 'utf8'))
const profile = JSON.parse(fs.readFileSync(path.join(root, 'protocol/deployment-profile.json'), 'utf8'))
const failures = []

if (update.controlMode !== 'GUANGHU_IS_PRIMARY_UPSTREAM') failures.push('GUANGHU_NOT_PRIMARY_UPSTREAM')
if (update.upstreamSync !== 'DISABLED') failures.push('UPSTREAM_SYNC_NOT_DISABLED')
if (update.automaticUpstreamFetch || update.automaticUpstreamMerge || update.automaticComponentUpdate) failures.push('AUTOMATIC_UPSTREAM_PATH_ENABLED')
if (update.serverSourceCheckout || update.serverSourcePresence !== 'FORBIDDEN') failures.push('SERVER_SOURCE_POLICY_INVALID')
if (profile.sourceCodeOnServer !== false) failures.push('SOURCE_CODE_ALLOWED_BY_PROFILE')
if (profile.nodeId === 'PENDING_LIGHTHOUSE_REGISTRATION') failures.push('TARGET_NODE_NOT_REGISTERED')
if (profile.nodeId !== 'XX-GZ-001') failures.push('TARGET_NODE_MISMATCH')
if (!profile.lighthouseSourceCommit || !profile.expectedDmiInstanceUuid) failures.push('TARGET_IDENTITY_EVIDENCE_MISSING')
if (!fs.existsSync(artifact)) failures.push('SERVER_ARTIFACT_MISSING')

const forbiddenNames = new Set(['src', '.git', 'node_modules', 'Cargo.toml', 'Cargo.lock', 'package.json', 'pnpm-lock.yaml', 'package-lock.json', 'vite.config.ts', 'tsconfig.json'])
const forbiddenExtensions = new Set(['.ts', '.tsx', '.rs', '.map'])
function scan(directory) {
  if (!fs.existsSync(directory)) return
  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
    const absolute = path.join(directory, entry.name)
    if (forbiddenNames.has(entry.name) || (!entry.isDirectory() && forbiddenExtensions.has(path.extname(entry.name)))) failures.push(`FORBIDDEN_SOURCE_PAYLOAD:${path.relative(artifact, absolute)}`)
    if (entry.isDirectory()) scan(absolute)
  }
}
scan(artifact)

if (failures.length) {
  process.stderr.write(`${JSON.stringify({ state: 'BLOCK_0', gate: 'GH-EDU-SERVER-ARTIFACT-ONLY-001', failures }, null, 2)}\n`)
  process.exit(1)
}
process.stdout.write(`${JSON.stringify({ state: 'PASS_100', gate: 'GH-EDU-SERVER-ARTIFACT-ONLY-001', upstreamSync: 'DISABLED', sourceIncluded: false, nodeId: profile.nodeId }, null, 2)}\n`)