"""Run only after the source commit is explicitly approved; no Git or Runtime mutation."""
import argparse
import hashlib
import json
from pathlib import Path
import shutil
import subprocess
import sys

ROOT = Path(__file__).resolve().parent.parent
REPO = Path('/workspace/contextra-analytics-runtime-lifecycle-refactor')
sys.path.insert(0, str(REPO))
from deployment_kit import bundle
from deployment_kit.core import KitError, require, sha256, write_json
from deployment_kit.offline import package


def main():
    parser=argparse.ArgumentParser(description=__doc__)
    parser.add_argument('--apply',action='store_true')
    args=parser.parse_args()
    inputs=json.loads((ROOT/'reports/package-inputs.json').read_bytes())
    hashes=json.loads((ROOT/'reports/source-lock.json').read_bytes())
    commit=subprocess.check_output(['git','-C',str(REPO),'rev-parse','HEAD'],text=True).strip()
    tracked=bundle.committed_files(REPO,commit)
    for name in inputs['source_paths']:
        require(sha256(REPO/name)==hashes[name],'SOURCE_CHANGED','검증 뒤 source가 바뀌었습니다. 재검토하세요.')
        require(name in tracked,'SOURCE_UNCOMMITTED','도구 source commit 승인이 필요합니다.')
        bundle.checked_source(REPO,name,tracked[name])
    total=sum(Path(v['source']).stat().st_size for v in inputs['assets'].values())
    require(shutil.disk_usage(ROOT).free>total+15*1024**3,'PACKAGE_OUTPUT_SPACE','봉인 복사 공간이 부족합니다.')
    print(json.dumps(dict(gate='SOURCE_COMMITTED',source_commit=commit,archives=len(inputs['assets']),apply=args.apply)))
    if not args.apply:
        return
    spec=dict(inputs['spec'],source_commit=commit)
    output=ROOT/'Contextra_Offline_Test_20261103_Sealed'
    digest=package.create(REPO,output,spec,inputs['source_paths'],inputs['assets'])
    raw=(output/'package.json').read_bytes()
    require(hashlib.sha256(raw).hexdigest()==digest,'SEALED_MANIFEST_DRIFT','봉인 manifest가 바뀌었습니다.')
    manifest=package.validate(json.loads(raw))  # create already read back every payload byte.
    require(all(manifest['files'][n]['sha256']==h for n,h in hashes.items()),
            'SEALED_SOURCE_DRIFT','봉인 중 source가 바뀌었습니다. 이 결과는 사용하지 마세요.')
    require(all(manifest['files'][n]['sha256']==v['sha256'] for n,v in inputs['assets'].items()),
            'SEALED_ASSET_DRIFT','봉인 중 archive가 바뀌었습니다. 이 결과는 사용하지 마세요.')
    write_json(ROOT/'reports/sealed-package.json',dict(path=str(output),sha256=digest,source_commit=commit),new=True)
    print(json.dumps(dict(package=str(output),sha256=digest,installed=False)))


if __name__ == '__main__':
    try:
        main()
    except KitError as exc:
        print(json.dumps(dict(gate='BLOCKED',code=exc.code,message=exc.message),ensure_ascii=False))
        raise SystemExit(2)