import { readFile } from "node:fs/promises";
import path from "node:path";
import { fileURLToPath } from "node:url";
import { describe, expect, it } from "vitest";

const packageDirectory = path.dirname(path.dirname(fileURLToPath(import.meta.url)));

/**
 * The host loader runs in a browser too, so it inherits the same rule as the authoring SDK: it must
 * not reach a backend type graph. Its only dependency is the module-author contract (ADR 0024).
 */
describe("module UI host loader stays browser-safe", () => {
  it("declares exactly one runtime dependency: the module UI SDK", async () => {
    const manifest = JSON.parse(
      await readFile(path.join(packageDirectory, "package.json"), "utf8"),
    ) as { dependencies?: Record<string, string>; peerDependencies?: Record<string, string> };

    expect(Object.keys(manifest.dependencies ?? {})).toEqual(["@ekklesia/module-ui-sdk"]);
    expect(Object.keys(manifest.peerDependencies ?? {})).toEqual([]);
  });

  it("imports nothing beyond the module UI SDK in its source", async () => {
    const source = await readFile(path.join(packageDirectory, "src", "load-module-ui.ts"), "utf8");
    const external = [...source.matchAll(/from\s+"([^"]+)"/gmu)]
      .map(([, specifier]) => specifier)
      .filter((specifier) => specifier !== undefined && !specifier.startsWith("."));

    expect([...new Set(external)]).toEqual(["@ekklesia/module-ui-sdk"]);
  });

  it("never names a Node built-in or an Ekklesia URL prefix", async () => {
    const source = await readFile(path.join(packageDirectory, "src", "load-module-ui.ts"), "utf8");

    expect(source).not.toContain('"node:');
    // The loader forwards a host-supplied URL; it must never construct one.
    expect(source).not.toMatch(/["'`]\/api\/v1\//u);
  });
});