// S1 has no live enforcement: the source must not reach the filesystem, a
// process, the network or the clock. This reads the package's own source text.
import { test } from "node:test";
import assert from "node:assert/strict";
import fs from "node:fs";
import path from "node:path";

const SRC = path.join(import.meta.dirname, "..", "src");
const FORBIDDEN = [
  /\bfrom\s+["'](node:)?(fs|fs\/promises|child_process|net|http|https|dgram|tls|worker_threads|os)["']/,
  /\bimport\s*\(/,
  /\brequire\s*\(/,
  /\bprocess\./,
  /\bDate\.now\b/,
  /\bnew Date\b/,
  /\bperformance\.now\b/,
  /\bset(Timeout|Interval|Immediate)\b/,
];

test("src reads no file, process, network or clock", () => {
  const files = fs.readdirSync(SRC).filter((f) => f.endsWith(".mjs"));
  assert.deepEqual(files.sort(), ["errors.mjs", "index.mjs", "pressure.mjs", "rules.mjs"]);
  for (const f of files) {
    const body = fs.readFileSync(path.join(SRC, f), "utf8");
    for (const re of FORBIDDEN) assert.doesNotMatch(body, re, `${f} matches ${re}`);
    for (const m of body.matchAll(/\bfrom\s+["']([^"']+)["']/g)) assert.match(m[1], /^\.\/[a-z]+\.mjs$/, `${f} imports ${m[1]}`);
  }
});