#!/usr/bin/env python3

import json
import re
import sys
from pathlib import Path


root = Path(sys.argv[1]).resolve()
index = root / "index.html"
manifest = root / ".vite" / "manifest.json"
assets = root / "assets"

errors = []


def require(condition, message):
    if not condition:
        errors.append(message)


require(root.is_dir(), "Build directory is missing.")
require(index.is_file(), "index.html is missing.")
require(manifest.is_file(), "Vite manifest is missing.")
require(assets.is_dir(), "Assets directory is missing.")

javascript = sorted(assets.glob("*.js")) if assets.is_dir() else []
stylesheets = sorted(assets.glob("*.css")) if assets.is_dir() else []
source_maps = sorted(root.rglob("*.map")) if root.is_dir() else []

require(bool(javascript), "JavaScript bundle is missing.")
require(bool(stylesheets), "CSS bundle is missing.")
require(not source_maps, "Production source maps were generated.")

index_text = (
    index.read_text(encoding="utf-8", errors="replace")
    if index.is_file()
    else ""
)

require(
    "/agents/scanforge/assets/" in index_text,
    "Embedded ScanForge asset route is missing from index.html.",
)

require(
    "http://" not in index_text
    and "https://" not in index_text,
    "index.html contains an external HTTP resource.",
)

if manifest.is_file():
    try:
        manifest_data = json.loads(
            manifest.read_text(encoding="utf-8")
        )
        require(
            isinstance(manifest_data, dict)
            and bool(manifest_data),
            "Vite manifest is empty or invalid.",
        )
    except Exception as exc:
        errors.append(f"Vite manifest JSON failed: {exc}")

forbidden = [
    re.compile(r"base44", re.IGNORECASE),
    re.compile(r"api\.base44\.com", re.IGNORECASE),
    re.compile(r"media\.base44\.com", re.IGNORECASE),
    re.compile(r"static\.wixstatic\.com", re.IGNORECASE),
    re.compile(r"@base44/", re.IGNORECASE),
    re.compile(r"base44_access_token", re.IGNORECASE),
    re.compile(r"VITE_BASE44_", re.IGNORECASE),
]

checked_files = []
combined_javascript = []

for path in sorted(root.rglob("*")):
    if (
        not path.is_file()
        or path.suffix.lower()
        not in {".html", ".js", ".css", ".json"}
    ):
        continue

    text = path.read_text(
        encoding="utf-8",
        errors="replace",
    )

    relative = str(path.relative_to(root))
    checked_files.append(relative)

    if path.suffix.lower() == ".js":
        combined_javascript.append(text)

    for pattern in forbidden:
        match = pattern.search(text)

        if not match:
            continue

        start = max(0, match.start() - 100)
        end = min(len(text), match.end() + 100)

        errors.append(
            "Forbidden runtime reference found:\n"
            f"  file: {relative}\n"
            f"  pattern: {pattern.pattern}\n"
            f"  context: {text[start:end]}"
        )

compiled_javascript = "\n".join(combined_javascript)

required_contract = [
    "SHIRE_MODULE",
    "/api/v1/modules/scanforge/context",
    "/api/v1/agents/scanforge/status",
    "/api/v1/agents/scanforge/projects",
    "ScanForge Scanner Agent",
]

for required in required_contract:
    require(
        required in compiled_javascript,
        f"Required SHiRE contract is missing: {required}",
    )

if errors:
    print("SCANFORGE BUNDLE VERIFICATION: FAILED")
    print()

    for number, error in enumerate(errors, start=1):
        print(f"{number}. {error}")

    raise SystemExit(1)

print("SCANFORGE BUNDLE VERIFICATION: PASS")
print("Executable files checked:", len(checked_files))

for name in checked_files:
    print("  PASS:", name)

print("JavaScript bundles:", len(javascript))
print("Stylesheet bundles:", len(stylesheets))
print("Production source maps: ABSENT")
print("Embedded asset route: PASS")
print("External index resources: ABSENT")
print("Base44 runtime references: ABSENT")
print("SHIRE_MODULE contract: PASS")
print("Module context endpoint: PASS")
print("Agent status endpoint: PASS")
print("Local project endpoint: PASS")
print("Dedicated ScanForge identity: PASS")