#!/usr/bin/env node
import { readFile } from 'node:fs/promises'
import path from 'node:path'

const root = process.cwd()

/** @type {Array<{ file:string, mustInclude:string, note:string }>} */
const checks = [
  {
    file: 'packages/bare-os-booter/lib/p2p/bare-os-peer-admission.js',
    mustInclude: 'BARE_OS_PEER_ALLOW_ALL',
    note: 'peer admission explicit allow-all override'
  },
  {
    file: 'packages/bare-os-booter/lib/p2p/bare-os-peer-admission.js',
    mustInclude: "reason: 'peer_allowlist_empty'",
    note: 'empty allowlist fail-closed reason'
  },
  {
    file: 'packages/bare-os-booter/lib/security/bare-os-path-capability.js',
    mustInclude: 'BARE_OS_PATH_CAPABILITY_REQUIRE_TRUSTED_SIGNER',
    note: 'trusted signer enforcement hook'
  },
  {
    file: 'packages/bare-os-booter/lib/host/host-delegate-registry.js',
    mustInclude: 'BARE_OS_ZERO_TRUST_PROFILE',
    note: 'delegate strict-profile default deny'
  }
]

let failures = 0
for (const c of checks) {
  const p = path.join(root, c.file)
  const txt = await readFile(p, 'utf8')
  if (!txt.includes(c.mustInclude)) {
    failures++
    console.error(`missing gate: ${c.note} (${c.file})`)
  }
}

if (failures > 0) process.exit(1)
console.log('verify-zero-trust-gates: ok')