import assert from 'node:assert/strict';
import { readFileSync } from 'node:fs';

const read = (path) => readFileSync(path, 'utf8');
const compose = read('infrastructure/docker-compose.prod.yml');
const restore = read('infrastructure/scripts/restore.sh');
const smoke = read('infrastructure/scripts/smoke-test.sh');
const envTs = read('miniapp/env.ts');
const envJs = read('miniapp/env.js');
const matchmakerLogin = read('miniapp/pages/matchmaker-login/matchmaker-login.js');

assert.doesNotMatch(compose, /\$\{ENCRYPTION_KEY:(?![-?])/, 'Compose 不能使用无效的冒号插值语法');
assert.match(compose, /SPRING_CONFIG_IMPORT:\s*configtree:\/run\/secrets\//, '后端必须通过 Spring configtree 读取数据库密码');
assert.match(compose, /target:\s*spring\.datasource\.password/, '数据库 secret 必须映射为 Spring 配置键');
assert.match(restore, /--set\s+ON_ERROR_STOP=on/, '恢复脚本必须在首个 SQL 错误时停止');
assert.doesNotMatch(smoke, /check "HTTPS生效" "https:\/\//, '冒烟测试不能把绝对 URL 再拼到 BASE_URL');
assert.doesNotMatch(envTs + envJs, /example\.com/, '小程序生产地址不能保留示例域名');
assert.match(matchmakerLogin, /API_BASE_URL/, '红娘登录必须复用统一 API 地址');
assert.doesNotMatch(matchmakerLogin, /localhost:8085/, '红娘登录不能硬编码开发机地址');

console.log('生产就绪静态契约检查通过');