"""Refresh app/native code on an approved cached base; no package download or SDK change."""
import json
import os
from pathlib import Path
import shutil
import subprocess
import sys

STAGE=Path('/storage/contextra/deploy/ai2-20261006-r01')
SOURCE=Path('/workspace/contextra/source/4f0bd4e')
SITE=Path('/storage/contextra/site/ai2-20261006-r01')
sys.path.insert(0,str(SOURCE))
from deployment_kit.core import atomic_write,sha256,write_json

def cmd(args,timeout=30):
    return subprocess.check_output(args,text=True,stderr=subprocess.STDOUT,timeout=timeout)

def main():
    os.umask(0o077)
    assert cmd(['hostname']).strip()=='icertirnd-ai'
    assert shutil.disk_usage('/').free>=15*1024**3
    images=json.loads((STAGE/'images-resolved.json').read_text())
    result=STAGE/'runtime-images-built.json'
    assert not result.exists()
    context=STAGE/'runtime-image-build';context.mkdir(mode=0o700)
    for name in ('app','control_sidecar','native'):
        shutil.copytree(SOURCE/name,context/name,ignore=shutil.ignore_patterns('__pycache__','*.pyc'))
    shutil.copyfile(SOURCE/'docker/entrypoint.sh',context/'entrypoint.sh')
    analytics='''FROM {base}
USER root
COPY native/frame_metadata /tmp/ai2-frame
COPY native/provider_branch /tmp/ai2-provider
COPY native/nvinferserver_rfdetr /tmp/ai2-rfdetr
RUN make -C /tmp/ai2-frame BUILD_DIR=/tmp/ai2-frame-build /tmp/ai2-frame-build/libcontextra_rtp_time.so && \
    make -C /tmp/ai2-provider BUILD_DIR=/tmp/ai2-provider-build && \
    make -C /tmp/ai2-rfdetr BUILD_DIR=/tmp/ai2-rfdetr-build -j2 all check && \
    install -m 0555 /tmp/ai2-frame-build/libcontextra_rtp_time.so /opt/nvidia/deepstream/deepstream/lib/gst-plugins/ && \
    install -m 0555 /tmp/ai2-provider-build/libgstcontextraflight.so /opt/contextra/lib/ && \
    install -m 0555 /tmp/ai2-rfdetr-build/libcontextra_nvinferserver_rfdetr.so /tmp/ai2-rfdetr-build/libcontextra_medium_preprocess.so /tmp/ai2-rfdetr-build/libcontextra_crowd_preprocess.so /opt/contextra/lib/
COPY app /opt/contextra/app
COPY entrypoint.sh /usr/local/bin/entrypoint.sh
RUN chmod 0755 /usr/local/bin/entrypoint.sh && python3 -B -c "from PIL import Image; import cv2,numpy; print('BASE_IMPORT_CONTRACT_PASS')"
'''.format(base=images['analytics'])
    sidecar='FROM '+images['ai-control-sidecar']+'\nCOPY control_sidecar /opt/bridge/control_sidecar\n'
    receipts={}
    for role,dockerfile in [('analytics',analytics),('ai-control-sidecar',sidecar)]:
        f=context/(role+'.Dockerfile');f.write_text(dockerfile)
        tag='contextra-'+role+':ai2-4f0bd4e-20261006-r01'
        with (STAGE/('build-'+role+'.log')).open('x') as log:
            subprocess.run(['timeout','--kill-after=15s','600s','docker','build','--pull=false','--network=none','--memory=3g',
                '--cpu-period=100000','--cpu-quota=200000','-f',str(f),'-t',tag,str(context)],
                stdout=log,stderr=log,check=True,timeout=630,env=dict(os.environ,DOCKER_BUILDKIT='0'))
        ident=json.loads(cmd(['docker','image','inspect',tag]))[0]['Id']
        receipts[role]={'base':images[role],'image':ident,'tag':tag,'source_head':'4f0bd4eddd5b6e600b947eee5444fd34e7ee8a54'}
        print('CURRENT_IMAGE_BUILT '+role,flush=True)
    # Update only our not-yet-created stack inputs; no live or historic image is replaced.
    env=SITE/'runtime.env';raw=env.read_text()
    for role,keys in [('analytics',('CONTEXTRA_IMAGE','CONTEXTRA_SECURE_ANALYTICS_IMAGE')),
                      ('ai-control-sidecar',('CONTEXTRA_SIDECAR_IMAGE','CONTEXTRA_SIDECAR_BASE_IMAGE'))]:
        for key in keys:
            before=key+'='+images[role];assert before in raw
            raw=raw.replace(before,key+'='+receipts[role]['image'])
        images[role]=receipts[role]['image']
    atomic_write(env,raw,mode=0o600)
    write_json(STAGE/'images-resolved.json',images)
    write_json(result,receipts,new=True)
    print('CURRENT_SOURCE_NATIVE_IMAGES_READY',flush=True)

if __name__=='__main__':main()