#!/usr/bin/env bash
set -euo pipefail

require_repo_layout() {
  [ -d "orchestrator/src" ] || fail "missing orchestrator/src"
  [ -f "orchestrator/package.json" ] || fail "missing orchestrator/package.json"
  [ -f "orchestrator/bun.lock" ] || fail "missing orchestrator/bun.lock"
  [ -f "package/install.sh" ] || fail "missing package/install.sh"
  [ -d "package/templates" ] || fail "missing package/templates"
  [ -f "package/config/hy2xs.env" ] || fail "missing package/config/hy2xs.env"
  [ -f "package/templates/env/post-install.env.tpl" ] || fail "missing package/templates/env/post-install.env.tpl"
  [ -d "package/systemd" ] || fail "missing package/systemd"
  [ -d "apps" ] || fail "missing apps HY2XS admin source"
  [ -f "apps/go.mod" ] || fail "missing apps/go.mod"
  [ -f "apps/go.sum" ] || fail "missing apps/go.sum"
  [ -f "apps/frontend/package.json" ] || fail "missing apps/frontend/package.json"
  [ -f "apps/frontend/pnpm-lock.yaml" ] || fail "missing apps/frontend/pnpm-lock.yaml"
}

verify_source_tree_policy() {
  local allow_dirty="${ALLOW_DIRTY_BUILD:-false}"
  local dirty="false"

  if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
    fail "build must run inside git work tree"
  fi

  if [ -n "$(git status --porcelain 2>/dev/null || true)" ]; then
    dirty="true"
  fi

  if [ "$dirty" = "true" ] && [ "$allow_dirty" != "true" ]; then
    fail "dirty git tree is not allowed for production build; set ALLOW_DIRTY_BUILD=true to override"
  fi
}

verify_archive() {
  local version="$1"
  local archive="dist/hy2xs-install-${version}.tar.gz"

  [ -f "$archive" ] || fail "archive was not created: $archive"

  local listing
  listing="$(tar -tzf "$archive")"

  printf '%s\n' "$listing" | grep -q '^hy2xs-install/install.sh$' || fail "archive missing install.sh"
  printf '%s\n' "$listing" | grep -q '^hy2xs-install/orchestrator/hy2xs-orchestrator$' || fail "archive missing orchestrator artifact"
  printf '%s\n' "$listing" | grep -q '^hy2xs-install/ui/hy2xs-admin/hy2xs-admin$' || fail "archive missing bundled UI binary"
  printf '%s\n' "$listing" | grep -q '^hy2xs-install/systemd/hysteria-server.service$' || fail "archive missing hysteria systemd unit"
  printf '%s\n' "$listing" | grep -q '^hy2xs-install/systemd/hy2xs-admin.service$' || fail "archive missing admin systemd unit"
  printf '%s\n' "$listing" | grep -q '^hy2xs-install/templates/hysteria/config.yaml.tpl$' || fail "archive missing Hysteria config template"
  printf '%s\n' "$listing" | grep -q '^hy2xs-install/config/hy2xs.env$' || fail "archive missing canonical runtime config"
  printf '%s\n' "$listing" | grep -q '^hy2xs-install/templates/env/post-install.env.tpl$' || fail "archive missing post-install env template"
  printf '%s\n' "$listing" | grep -q '^hy2xs-install/metadata/checksums.txt$' || fail "archive missing checksums"

  local env_content
  env_content="$(tar -xOzf "$archive" hy2xs-install/config/hy2xs.env)"
  printf '%s\n' "$env_content" | grep -q 'replace-with-your-domain.example' && fail "packaged hy2xs.env contains placeholder domain"
  printf '%s\n' "$env_content" | grep -q 'replace-with-your-email@example.com' && fail "packaged hy2xs.env contains placeholder email"

  local tmp
  tmp="$(mktemp -d)"
  tar -xzf "$archive" -C "$tmp"
  [ -x "$tmp/hy2xs-install/install.sh" ] || fail "install.sh is not executable"
  [ -x "$tmp/hy2xs-install/orchestrator/hy2xs-orchestrator" ] || fail "orchestrator is not executable"
  [ -x "$tmp/hy2xs-install/ui/hy2xs-admin/hy2xs-admin" ] || fail "hy2xs-admin is not executable"

  "$tmp/hy2xs-install/orchestrator/hy2xs-orchestrator" status --package-dir "$tmp/hy2xs-install" >/dev/null 2>&1 || true

  local meta
  meta="$(cat "$tmp/hy2xs-install/metadata/package.env")"
  printf '%s\n' "$meta" | grep -q '^source_git_commit=' || fail "metadata missing source_git_commit"
  printf '%s\n' "$meta" | grep -q '^dirty_tree=' || fail "metadata missing dirty_tree"
  printf '%s\n' "$meta" | grep -q '^build_profile=production$' || fail "metadata missing build_profile=production"

  if declare -F run_fix20_acceptance_subset >/dev/null 2>&1; then
    run_fix20_acceptance_subset "$tmp/hy2xs-install"
  fi

  rm -rf "$tmp"
}