#!/bin/sh
set -eu

cd "$(dirname "$0")/.."

release=$(cat VERSION)
version=${release#alpha }
old_ifs=$IFS
IFS=.
set -- $version
IFS=$old_ifs
if [ "$#" -ne 4 ]; then
  echo "Cannot derive package version from VERSION" >&2
  exit 1
fi
package_version="$1.$2.$3a0+$4"

for path in \
  packages/jwebot-config/pyproject.toml \
  packages/jwebot-sdk/pyproject.toml \
  packages/jwebot-official-extensions/pyproject.toml \
  packages/jwebot-kernel/pyproject.toml \
  packages/jwebot-extension-host/pyproject.toml
do
  grep -Fq "version = \"$package_version\"" "$path"
done

grep -Fq "__version__ = \"$package_version\"" \
  packages/jwebot-config/src/jwebot_config/__init__.py
grep -Fq "__version__ = \"$package_version\"" \
  packages/jwebot-sdk/src/jwebot_sdk/__init__.py
grep -Fq "__version__ = \"$package_version\"" \
  packages/jwebot-official-extensions/src/jwebot_official_extensions/__init__.py
grep -Fq "__version__ = \"$package_version\"" \
  packages/jwebot-kernel/src/jwebot_kernel/__init__.py
grep -Fq "__version__ = \"$package_version\"" \
  packages/jwebot-extension-host/src/jwebot_extension_host/__init__.py

for package_name in \
  jwebot_config \
  jwebot_sdk \
  jwebot_kernel \
  jwebot_official_extensions
do
  grep -Fq "$package_name" deploy/scripts/install-wechat-health-watch.sh
done

for path in \
  docs/plugin-contract.md \
  docs/capability-catalog.md \
  docs/author-guide.md \
  docs/api-reference.md \
  docs/prompt-for-ai-authors.md \
  docs/extension-host.md
do
  test -f "$path"
done

bytecode_root=$(mktemp -d)
trap 'rm -rf "$bytecode_root"' EXIT HUP INT TERM
PYTHONPYCACHEPREFIX="$bytecode_root" \
  python3 -m compileall -q packages examples/hello-command/src
rm -rf "$bytecode_root"
trap - EXIT HUP INT TERM
./tools/sync-local-extensions.py --check

if command -v rg >/dev/null 2>&1; then
  forbidden=$(
    rg -n '^(from|import) (os|socket|subprocess)([ .]|$)' \
      packages/jwebot-sdk/src || true
  )
else
  forbidden=$(
    find packages/jwebot-sdk/src -type f -name '*.py' \
      -exec grep -nHE \
        '^(from|import) (os|socket|subprocess)([ .]|$)' {} + || true
  )
fi
if [ -n "$forbidden" ]; then
  echo "Public SDK must not expose process, socket, or environment access:" >&2
  echo "$forbidden" >&2
  exit 1
fi

if python3 -c 'import tomllib' >/dev/null 2>&1 ||
   python3 -c 'import tomli' >/dev/null 2>&1
then
  test -x /usr/bin/ssh-keygen
  ./tools/validate-plugin.py examples/hello-command/plugin.toml >/dev/null
  temporary=$(mktemp -d)
  trap 'rm -rf "$temporary"' EXIT HUP INT TERM
  ssh-keygen -q -t ed25519 -N '' -f "$temporary/publisher"
  printf 'test-publisher %s\n' \
    "$(cat "$temporary/publisher.pub")" \
    >"$temporary/allowed_signers"
  ./tools/package-plugin.py examples/hello-command \
    --output "$temporary" \
    --signing-key "$temporary/publisher" \
    --publisher test-publisher >/dev/null
  artifact=$(find "$temporary" -maxdepth 1 -type f -name '*.tar.gz')
  release=$(find "$temporary" -maxdepth 1 -type f -name '*.release.json')
  signature=$(find "$temporary" -maxdepth 1 -type f -name '*.release.sig.json')
  ./tools/verify-release.py "$artifact" "$release" \
    --signature "$signature" \
    --allowed-signers "$temporary/allowed_signers" \
    --publisher test-publisher >/dev/null
  ./tools/activate-release.py "$artifact" "$release" \
    --signature "$signature" \
    --allowed-signers "$temporary/allowed_signers" \
    --publisher test-publisher \
    --skip-health-check-local \
    --state-root "$temporary/state" >/dev/null
  test -L "$temporary/state/current"
  for manifest in extensions/official/*/plugin.toml extensions/jwebot/*/plugin.toml; do
    extension=${manifest%/plugin.toml}
    ./tools/validate-plugin.py "$manifest" >/dev/null
    ./tools/package-plugin.py "$extension" \
      --output "$temporary/local" >/dev/null
  done
  rm -rf "$temporary"
  trap - EXIT HUP INT TERM
else
  echo "notice: skipping TOML file validation; install tomli on Python < 3.11" >&2
fi