#!/usr/bin/env node
/*
 * CI guard: fail if @dadosfera/protospack-v2 is consumed from a LOCAL ref
 * (file:/link:/git/relative path/bare tarball) instead of the CodeArtifact
 * registry.
 *
 * Only local consumption is blocked. Versions published to CodeArtifact —
 * including alpha/beta/rc prereleases produced by the alpha/beta branches —
 * are fine; those resolve to a registry URL in the lockfile. The thing that
 * must NOT reach beta (staging) or main (prod) is a dependency wired to a
 * local `npm pack` tarball / overlay. Runs in the PR test workflow for PRs
 * targeting beta/main and exits non-zero on any local ref.
 */
const fs = require('fs');
const path = require('path');

const PKG = '@dadosfera/protospack-v2';
const root = path.resolve(__dirname, '..');
const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));

const problems = [];

// A dependency SPEC is local if it's a filesystem path, symlink, git ref, or a
// bare tarball path. A plain semver (incl. prereleases like 3.35.0-beta.1)
// resolves from the registry and is allowed.
function isLocalSpec(spec) {
  return /^(file:|link:|git[:+]|\.\.?\/|\/|~\/)/.test(spec) || spec.endsWith('.tgz');
}

const spec =
  (pkg.dependencies && pkg.dependencies[PKG]) ||
  (pkg.devDependencies && pkg.devDependencies[PKG]);

if (!spec) {
  problems.push(`${PKG} is not listed as a dependency at all.`);
} else if (isLocalSpec(spec)) {
  problems.push(`${PKG} points at a local path/tarball/git ref: "${spec}".`);
}

// Also catch a lockfile resolved to a LOCAL ref even if package.json looks
// clean. A registry URL (https://.../-/*.tgz) is the normal published
// resolution and is fine — only file: refs and bare local tarball paths
// (no http host) are blocked. Prerelease VERSIONS are not flagged: an
// alpha/beta/rc published to CodeArtifact resolves to a registry URL.
const lockPath = path.join(root, 'package-lock.json');
if (fs.existsSync(lockPath)) {
  const lock = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
  const nodes = { ...(lock.packages || {}), ...(lock.dependencies || {}) };
  for (const [name, node] of Object.entries(nodes)) {
    if (!name.includes('protospack-v2') || !node) continue;
    const resolved = node.resolved || '';
    const isLocal =
      resolved.startsWith('file:') ||
      (resolved.endsWith('.tgz') && !/^https?:\/\//.test(resolved));
    if (isLocal) {
      problems.push(
        `package-lock.json resolves ${PKG} to a local ref: "${resolved}".`,
      );
    }
  }
}

if (problems.length) {
  console.error('✗ protospack-v2 dependency guard FAILED:');
  for (const p of problems) console.error('  - ' + p);
  console.error(
    '\nMerging to beta/main requires ' +
      PKG +
      ' to come from CodeArtifact, not a local tarball/overlay. Publish ' +
      'protospack-v2 (a beta prerelease is fine for the beta branch) and ' +
      'repoint this dependency before merging.',
  );
  process.exit(1);
}

console.log(`✓ ${PKG} is consumed from the registry: "${spec}"`);