import assert from "node:assert/strict";
import { spawnSync } from "node:child_process";
import { mkdtemp, readFile, rm } from "node:fs/promises";
import os from "node:os";
import path from "node:path";
import test from "node:test";

test("v02 render follows TypeScript runtime checks and does not self-patch bootstrap RBAC", async () => {
  const outDir = await mkdtemp(path.join(os.tmpdir(), "hwlab-v02-render-test-"));
  try {
    const render = spawnSync(process.execPath, [
      "scripts/g14-gitops-render.mjs",
      "--lane", "v02",
      "--catalog-path", "deploy/artifact-catalog.v02.json",
      "--image-tag-mode", "full",
      "--source-branch", "v0.2",
      "--gitops-branch", "v0.2-gitops",
      "--out", outDir,
      "--source-revision", "HEAD"
    ], { cwd: process.cwd(), encoding: "utf8" });
    assert.equal(render.status, 0, render.stderr || render.stdout);

    const pipeline = await readFile(path.join(outDir, "tekton-v02", "pipeline.yaml"), "utf8");
    assert.match(pipeline, /node scripts\/run-bun\.mjs test cmd\/hwlab-codex-api-responses-forwarder\/main\.test\.ts/u);
    assert.doesNotMatch(pipeline, /cmd\/hwlab-codex-api-responses-forwarder\/main\.mjs/u);

    const reconciler = await readFile(path.join(outDir, "tekton-v02", "control-plane-reconciler.yaml"), "utf8");
    assert.match(reconciler, /cross-namespace-rbac-bootstrap-managed/u);
    assert.match(reconciler, /HWLAB_RECONCILE_CROSS_NAMESPACE_RBAC/u);
  } finally {
    await rm(outDir, { recursive: true, force: true });
  }
});