import { expect, test } from 'bun:test';
import { mkdtemp, rm } from 'node:fs/promises';
import { tmpdir } from 'node:os';
import { join } from 'node:path';
import { ReferenceCompiler, readReferenceManifest } from '../src/lib/server/reference/compiler';
import { fixtureSources } from '../src/lib/server/reference/sources';
test('opaque source fingerprints cannot become cache filesystem paths', async () => {
  const directory = await mkdtemp(join(tmpdir(), 'eve-reference-path-'));
  try {
    const sources = fixtureSources(); const source = sources['reference-data']!;
    sources['reference-data'] = {
      source: 'reference-data',
      async check() { return { ...await source.check(), fingerprint: '../unexpected/nested-validator' }; },
      async load(check) { return { ...await source.load(await source.check()), check }; }
    };
    const result = await new ReferenceCompiler({ directory, profile: 'fixture', sources }).compile();
    expect(result.status).toBe('success');
    const manifest = await readReferenceManifest(directory);
    const cache = manifest.active?.sourceInputs?.['reference-data']?.cacheFile;
    if (!cache) throw new Error('Promoted artifact must name its source cache');
    expect(cache).toMatch(/^sources\/reference-data\/[a-f0-9]{64}-[a-f0-9]{16}\.json$/);
    expect(cache).not.toContain('..');
  } finally { await rm(directory, { recursive: true, force: true }); }
});