param(
    [Parameter(Mandatory=$true)][string]$SourceDir,
    [Parameter(Mandatory=$true)][string]$OutputRoot
)
$ErrorActionPreference = 'Stop'
$repo = [IO.Path]::GetFullPath($SourceDir)
$valid120 = Join-Path $repo 'Artifacts\V0.12.0\path-test'
$valid125 = Join-Path $repo 'Artifacts\V0.12.5\path-test'
$valid1275 = Join-Path $repo 'Artifacts\V0.12.75\path-test'
$valid130 = Join-Path $repo 'Artifacts\V0.13.0\path-test'
$invalid = [IO.Path]::GetFullPath((Join-Path $repo '..\DeepPluck-Evidence-Escape'))
$invoke = Join-Path $repo 'Tests\InvokeFactoryPresetBuild.ps1'
$audit = Join-Path $repo 'Tests\RunFactoryFinalContentAudit.ps1'
$package = Join-Path $repo 'Tests\PrepareReleaseCandidatePackage.ps1'

function Invoke-ExpectedExit([string]$Script, [string[]]$Arguments, [int]$Expected,
                             [string]$Description) {
    $allArguments = @('-NoProfile','-ExecutionPolicy','Bypass','-File',$Script) + $Arguments
    $quoted = $allArguments | ForEach-Object { '"' + ([string]$_).Replace('"','\"') + '"' }
    $start = [Diagnostics.ProcessStartInfo]::new()
    $start.FileName = 'powershell.exe'
    $start.Arguments = $quoted -join ' '
    $start.UseShellExecute = $false
    $start.CreateNoWindow = $true
    $start.RedirectStandardOutput = $true
    $start.RedirectStandardError = $true
    $process = [Diagnostics.Process]::Start($start)
    $stdout = $process.StandardOutput.ReadToEnd()
    $stderr = $process.StandardError.ReadToEnd()
    $process.WaitForExit()
    if ($process.ExitCode -ne $Expected) {
        throw "$Description returned $($process.ExitCode); expected $Expected. $stdout $stderr"
    }
}

foreach ($path in @($valid120, $valid125, $valid1275, $valid130)) {
    Invoke-ExpectedExit $invoke @('-Mode','configure','-EvidenceRoot',$path,
        '-PathValidationOnly') 0 'build-wrapper allowed path'
    Invoke-ExpectedExit $audit @('-FactoryRoot',(Join-Path $repo 'Presets\Factory'),
        '-OutputRoot',$path,'-Executable',(Join-Path $repo 'missing.exe'),
        '-Configuration','Debug','-PathValidationOnly') 0 'audio-wrapper allowed path'
}
Invoke-ExpectedExit $package @('-SourceDir',$repo,'-BuildDir',(Join-Path $repo 'build'),'-OutputRoot',$valid130,'-ExpectedVersion','0.13.0','-PathValidationOnly') 0 'release-package allowed path'
Invoke-ExpectedExit $package @('-SourceDir',$repo,'-BuildDir',(Join-Path $repo 'build'),'-OutputRoot',$valid1275,'-ExpectedVersion','0.13.0','-PathValidationOnly') 1 'release-package rejected historical evidence path'
Invoke-ExpectedExit $invoke @('-Mode','configure','-EvidenceRoot',$invalid,
    '-PathValidationOnly') 1 'build-wrapper rejected path'
Invoke-ExpectedExit $audit @('-FactoryRoot',(Join-Path $repo 'Presets\Factory'),
    '-OutputRoot',$invalid,'-Executable',(Join-Path $repo 'missing.exe'),
    '-Configuration','Debug','-PathValidationOnly') 1 'audio-wrapper rejected path'
Invoke-ExpectedExit $package @('-SourceDir',$repo,'-BuildDir',(Join-Path $repo 'build'),'-OutputRoot',$invalid,'-ExpectedVersion','0.13.0','-PathValidationOnly') 1 'release-package rejected external path'

if (Test-Path -LiteralPath $invalid) { throw 'Rejected evidence path was created.' }
[void](New-Item -ItemType Directory -Force -Path $OutputRoot)
Write-Host 'PASS: evidence wrappers accept only bounded historical/V0.13.0 roots; RC packaging accepts only V0.13.0.'
