import * as NodeChildProcess from "node:child_process";import * as NodeFS from "node:fs";import * as NodeOS from "node:os";import * as NodePath from "node:path";import * as NodeURL from "node:url";import { afterAll, beforeAll, describe, expect, it } from "vite-plus/test"; // oxlint-disable-next-line t3code/no-global-process-runtime -- The native compiler targets the actual host; this script has no Effect runtime.const hostArch = process.arch;// oxlint-disable-next-line t3code/no-global-process-runtime -- Native compilation only runs on the actual Linux host.const hostPlatform = process.platform; describe.skipIf(hostPlatform !== "linux")("bundled libsecret helper", () => {  let directory;  let executable;  beforeAll(() => {    directory = NodeFS.mkdtempSync(NodePath.join(NodeOS.tmpdir(), "t3-browser-secret-test-"));    executable = NodePath.join(directory, "t3-browser-secret");    const root = NodeURL.fileURLToPath(new URL("../../../native/browser-secret/", import.meta.url));    const flags = NodeChildProcess.execFileSync(      "pkg-config",      ["--cflags", "--libs", "libsecret-1"],      {        encoding: "utf8",      },    )      .trim()      .split(/\s+/);    NodeChildProcess.execFileSync(      process.env.CC || "cc",      [        "-std=c11",        "-Wall",        "-Wextra",        "-Werror",        NodePath.join(root, "main.c"),        NodePath.join(root, "test.c"),        "-Wl,--wrap=secret_service_search_sync",        "-Wl,--wrap=secret_item_get_locked",        "-Wl,--wrap=secret_item_get_secret",        "-o",        executable,        ...flags,      ],      { stdio: "pipe" },    );  });  afterAll(() => {    if (directory) NodeFS.rmSync(directory, { recursive: true, force: true });  });   const run = (args) =>    NodeChildProcess.spawnSync(executable, args, {      env: { ...process.env, DBUS_SESSION_BUS_ADDRESS: "unix:path=/unused-test-bus" },    });   it("builds an executable for the requested architecture into a staged resource directory", () => {    const output = NodePath.join(directory, "resources", "browser-secret", "t3-browser-secret");    NodeChildProcess.execFileSync(process.execPath, [      NodeURL.fileURLToPath(new URL("./build-browser-secret.mjs", import.meta.url)),      "--arch",      hostArch,      "--output",      output,    ]);    const header = NodeFS.readFileSync(output).subarray(0, 20);    expect(header.toString("hex", 0, 6)).toBe("7f454c460201");    expect(header.readUInt16LE(18)).toBe({ x64: 62, arm64: 183 }[hostArch]);    expect(NodeFS.statSync(output).mode & 0o111).not.toBe(0);    // Invalid arguments exit before the real executable could contact a keyring.    expect(NodeChildProcess.spawnSync(output, []).status).toBe(64);  });   it("preserves the exact secret bytes with no added or removed delimiter", () => {    const result = run(["success"]);    expect(result.status).toBe(0);    expect(result.stdout).toEqual(Buffer.from("secret\0with whitespace \t\r\n"));    expect(result.stderr.length).toBe(0);  });   for (const [scenario, code] of [    ["missing", 2],    ["empty", 2],    ["locked", 3],    ["cancelled", 3],    ["denied", 3],    ["unavailable", 4],    ["unloaded", 4],  ]) {    it(`reports ${scenario} without emitting a secret`, () => {      const result = run([scenario]);      expect(result.status).toBe(code);      expect(result.stdout.length).toBe(0);    });  }  it("rejects invalid arguments before accessing the keyring", () => {    for (const args of [[], [""], ["chrome", "extra"]]) {      const result = run(args);      expect(result.status).toBe(64);      expect(result.stdout.length).toBe(0);    }  });});