#!/usr/bin/env node
import path from 'node:path';
import { fileURLToPath } from 'node:url';
import {
  checkGoosedProxyBoundary,
  formatGoosedBoundaryViolations,
  GOOSED_DIRECT_ALLOWLIST,
  GOOSED_PROXY_ADAPTER_FILE,
  GOOSED_PROXY_GUARDED_FILES,
} from '../goosed-proxy-boundary.mjs';

const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
const violations = checkGoosedProxyBoundary(rootDir);

if (violations.length > 0) {
  console.error('goosed proxy boundary check failed:\n');
  console.error(formatGoosedBoundaryViolations(violations));
  console.error('\nH5 chat must reach goosed only via tkmind-proxy.mjs.');
  console.error(`Allowlist: ${GOOSED_DIRECT_ALLOWLIST.join(', ')}`);
  console.error(`Guarded: ${GOOSED_PROXY_GUARDED_FILES.join(', ')}`);
  process.exit(1);
}

console.log(
  `goosed proxy boundary ok (adapter=${GOOSED_PROXY_ADAPTER_FILE}, allowlist=${GOOSED_DIRECT_ALLOWLIST.length}, guarded=${GOOSED_PROXY_GUARDED_FILES.length})`,
);