#Requires -Version 5.1
Set-StrictMode -Version Latest
$ErrorActionPreference='Stop'
$root=[IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..'))
Import-Module (Join-Path $root 'src/Wind.Network.psm1') -Force
$script:passed=0
function Assert-Capture([bool]$Condition,[string]$Message){if(-not$Condition){throw $Message};$script:passed++}
$state=Join-Path ([IO.Path]::GetTempPath()) ('ms-private-capture-test-'+[guid]::NewGuid().ToString('N'))
try{
    $candidate=Join-Path $state 'capture-one'
    $resolved=Resolve-WindCaptureDirectory -Path $candidate -StateRoot $state
    Assert-Capture ($resolved-eq$candidate-and-not(Test-Path -LiteralPath $candidate)) 'Capture resolution created a directory or changed the target.'
    foreach($invalid in @($state,($state+'-sibling\capture'),(Join-Path $state '..\outside'),'relative\capture','C:relative','\relative','\\server\share',($candidate+':stream'))){
        $threw=$false;try{Resolve-WindCaptureDirectory -Path $invalid -StateRoot $state|Out-Null}catch{$threw=$true}
        Assert-Capture $threw "Unsafe capture path accepted: $invalid"
    }
    [IO.Directory]::CreateDirectory($state)|Out-Null
    $file=Join-Path $state 'file';[IO.File]::WriteAllText($file,'test')
    $threw=$false;try{Resolve-WindCaptureDirectory -Path (Join-Path $file 'child') -StateRoot $state|Out-Null}catch{$threw=$true}
    Assert-Capture $threw 'Capture path crossed an existing file.'

    $calls=[Collections.Generic.List[string]]::new()
    $runner={param($NativeArguments)$calls.Add(($NativeArguments-join'|'));0}.GetNewClosure()
    Invoke-WindPacketMonitor -ArgumentList @('start','--file-name','path with spaces\capture.etl') -Runner $runner
    Assert-Capture ($calls.Count-eq1-and$calls[0]-eq'start|--file-name|path with spaces\capture.etl') 'Packet monitor changed native argument boundaries.'
    $threw=$false;try{Invoke-WindPacketMonitor -ArgumentList @('start') -Runner {23}}catch{$threw=$_.Exception.Message-match'exit code 23'}
    Assert-Capture $threw 'Packet monitor failure was reported as success.'
    $threw=$false;try{Invoke-WindPacketMonitor -ArgumentList @('stop') -Runner {}}catch{$threw=$true}
    Assert-Capture $threw 'Missing packet monitor exit code was reported as success.'

    # Real entry points must return before privilege checks, directory creation or native commands.
    $preview=Join-Path ([Environment]::GetFolderPath('LocalApplicationData')) ('MsPrivate\network\preview-test-'+[guid]::NewGuid().ToString('N'))
    & (Join-Path $root 'Network.ps1') -Mode CaptureStart -CaptureDirectory $preview -WhatIf
    & (Join-Path $root 'Network.ps1') -Mode CaptureStop -CaptureDirectory $preview -WhatIf
    Assert-Capture (-not(Test-Path -LiteralPath $preview)) 'Capture preview created state on disk.'
}finally{
    $full=[IO.Path]::GetFullPath($state);$temp=[IO.Path]::GetFullPath([IO.Path]::GetTempPath()).TrimEnd('\')+'\'
    if(-not$full.StartsWith($temp,[StringComparison]::OrdinalIgnoreCase)){throw 'Unsafe test cleanup path.'}
    if([IO.Directory]::Exists($full)){[IO.Directory]::Delete($full,$true)}
}
Write-Output "$script:passed capture tests passed. No packet capture or firewall change was performed."