// SPDX-License-Identifier: AGPL-3.0-only
'use strict';

const fs = require('node:fs');
const path = require('node:path');

const root = path.join(__dirname, '..');
const manifest = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
const lock = JSON.parse(fs.readFileSync(path.join(root, 'package-lock.json'), 'utf8'));
if (lock.lockfileVersion !== 3) throw new Error('package-lock must use lockfileVersion 3');

for (const group of ['dependencies', 'devDependencies']) {
  for (const [name, version] of Object.entries(manifest[group] || {})) {
    if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
      throw new Error(`${group} must pin ${name} to an exact version`);
    }
  }
}

const productionLicenses = new Set(['MIT', 'ISC']);
for (const [name, pkg] of Object.entries(lock.packages || {})) {
  if (!name.startsWith('node_modules/')) continue;
  if (!pkg.version || !pkg.integrity || !pkg.resolved?.startsWith('https://registry.npmjs.org/')) {
    throw new Error(`unverifiable registry dependency: ${name}`);
  }
  if (!pkg.dev && !productionLicenses.has(pkg.license)) {
    throw new Error(`unreviewed production dependency license: ${name} (${pkg.license || 'missing'})`);
  }
}

console.log('lockfile integrity, exact direct pins, registry origins, and production licenses verified');