// Static dev server. The header policy (COOP/COEP, CORP, CSP, Service-Worker-Allowed) is
// src/node/server.ts's, the same the package ships; this file only decides which repo
// paths get what. demo/no-coi.html is served WITHOUT COOP/COEP: it exists to prove
// boot() refuses.
import { createServer } from "node:http";
import { readFile } from "node:fs/promises";
import { extname, join, normalize, resolve } from "node:path";
import { fileURLToPath } from "node:url";
import { contentSecurityPolicy, headersFor } from "../src/node/server.ts";

const ROOT = resolve(fileURLToPath(new URL("..", import.meta.url)));
const PORT = Number(process.env.PORT ?? 8931);

const MIME = {
  ".html": "text/html; charset=utf-8",
  ".js": "text/javascript; charset=utf-8",
  ".mjs": "text/javascript; charset=utf-8",
  ".cjs": "text/javascript; charset=utf-8",
  ".css": "text/css; charset=utf-8",
  ".txt": "text/plain; charset=utf-8",
  ".json": "application/json",
  ".wasm": "application/wasm",
};

// Demo pages keep an inline <script type="importmap"> (import maps must be inline),
// so script-src carries 'unsafe-inline' for the demo only. Page logic itself lives in
// external module files. Embedders must allow 'unsafe-eval' (CJS wrappers) and
// 'wasm-unsafe-eval' (residue module) — see DESIGN.md §Tradeoffs accepted.
//
// (slopbox, the only page that ever needed style-src 'unsafe-inline' for xterm's runtime
// CSS, moved to examples/slopbox and serves itself — see that package's serve.mjs.)
//
// The runtime SW registers with scope "/" (it must intercept /~/ at the origin root);
// Service-Worker-Allowed lifts the /dist/runtime/ default scope limit. The conflict and
// compose fixtures' workers stand in for a site's own worker at that scope.
const HEADERS = {
  isolate: (path) => !path.endsWith("no-coi.html"),
  csp: () => contentSecurityPolicy({ inlineScripts: true, registry: true }),
  serviceWorkerAllowed: (path) =>
    path === "/dist/runtime/sw.js" || /^\/tests\/fixtures\/(conflict|compose|compose-update)\/sw\.js$/.test(path),
};

const server = createServer(async (req, res) => {
  const url = new URL(req.url ?? "/", `http://localhost:${PORT}`);
  let path = decodeURIComponent(url.pathname);
  if (path === "/") path = "/demo/index.html";
  else if (path.endsWith("/")) path += "index.html";

  // TEST-ONLY aliases for tests/relocated.spec.ts: serve dist/runtime/ from a layout unlike the
  // repo's, a versioned directory plus a root Service Worker, to prove boot() assumes
  // no /dist/. /nib-sw.js sits at the origin root, so scope "/" needs no
  // Service-Worker-Allowed header and none is sent.
  let disk = path;
  if (path.startsWith("/__nib/0.0.0/")) disk = "/dist/runtime/" + path.slice("/__nib/0.0.0/".length);
  else if (path === "/nib-sw.js") disk = "/dist/runtime/sw.js";

  const file = normalize(join(ROOT, disk));
  if (!file.startsWith(ROOT)) {
    res.writeHead(403).end("forbidden");
    return;
  }
  try {
    const data = await readFile(file);
    const headers = { "Content-Type": MIME[extname(file)] ?? "application/octet-stream", ...headersFor(path, HEADERS) };
    res.writeHead(200, headers).end(data);
  } catch {
    res.writeHead(404).end("not found");
  }
});

server.listen(PORT, () => {
  console.log(`@nibling/kernel dev server → http://localhost:${PORT}/demo/index.html`);
});