#!/usr/bin/env node
// Does frontend/node_modules hold exactly what frontend/package-lock.json pins?
//
// The local gate's frontend lanes run against the HOST's node_modules, and nothing tied that tree to
// the lock: a `git pull` that bumped a dependency, or an `npm install` that was never committed, left
// tsc/eslint/vitest judging the code against packages the build image (`npm ci`) does not use — a
// green that proves nothing about what ships, in either direction. The image build is immune (it
// runs `npm ci`); this makes the local lanes say so instead of quietly differing.
//
// Checks every package the lock places under node_modules/: present, at the pinned version. A package
// marked `optional` may be absent (a platform binary for another OS). Exit 1 with the list and the
// one command that fixes it.
import { existsSync, readFileSync } from "node:fs";
import { dirname, join } from "node:path";
import { fileURLToPath } from "node:url";

const FRONTEND = join(dirname(fileURLToPath(import.meta.url)), "..", "frontend");
const lock = JSON.parse(readFileSync(join(FRONTEND, "package-lock.json"), "utf8"));

const problems = [];
for (const [path, entry] of Object.entries(lock.packages ?? {})) {
  if (!path.startsWith("node_modules/") || entry.link) continue;
  const manifest = join(FRONTEND, path, "package.json");
  if (!existsSync(manifest)) {
    if (!entry.optional) problems.push(`missing   ${path.slice(13)}@${entry.version}`);
    continue;
  }
  const installed = JSON.parse(readFileSync(manifest, "utf8")).version;
  if (installed !== entry.version)
    problems.push(
      `mismatch  ${path.slice(13)}: installed ${installed}, lock pins ${entry.version}`,
    );
}

if (problems.length) {
  console.error(`frontend/node_modules does not match package-lock.json (${problems.length}):`);
  for (const p of problems.slice(0, 20)) console.error(`  ${p}`);
  if (problems.length > 20) console.error(`  … and ${problems.length - 20} more`);
  console.error("Fix: cd frontend && npm ci");
  process.exit(1);
}
console.log(
  `node_modules matches package-lock.json (${Object.keys(lock.packages).length - 1} entries)`,
);