#!/usr/bin/env python3
"""Validate and describe the complete cross-platform Preview asset set."""

from __future__ import annotations

import argparse
import hashlib
import json
import os
from pathlib import Path
import re
import sys


MIN_ASSET_SIZE = 1024 * 1024
VERSION_PATTERN = re.compile(
    r"^[0-9]+\.[0-9]+\.[0-9]+(?:-[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*)?"
    r"(?:\+[0-9A-Za-z]+(?:[.-][0-9A-Za-z]+)*)?$"
)
PREVIEW_PATTERN = re.compile(r"^[0-9A-Za-z][0-9A-Za-z.-]{0,31}$")
CHECKSUM_PLACEHOLDER = "<!-- PREVIEW_SHA256 -->"
PACKAGE_VERSION_PATTERN = re.compile(r'^version\s*=\s*"([^"]+)"\s*(?:#.*)?$')
RUNTIME_REPORTS = {
    "windows-report.json": "windows-x86_64",
    "linux-appimage-report.json": "linux-x86_64-appimage",
    "linux-appimage-wayland-report.json": "linux-x86_64-appimage-wayland",
    "linux-deb-report.json": "linux-x86_64-deb",
    "macos-aarch64-report.json": "macos-aarch64",
    "macos-x86_64-report.json": "macos-x86_64",
}


class ManifestError(ValueError):
    """The Preview asset set is incomplete or unsafe to publish."""


def verify_binary_freshness(binary: Path, repo: Path) -> None:
    sources = [repo / name for name in ("Cargo.toml", "Cargo.lock", "rust-toolchain.toml", "CHANGELOG.md")]
    for name in ("nebula_app", "nebula_terminal", "nebula_config", "nebula_config_derive",
                 "nebula_settings", "nebula_split", "nebula-completions", "assets", "extra", "third_party"):
        root = repo / name
        if root.is_dir():
            sources.extend(path for path in root.rglob("*") if path.is_file())
    timestamp = binary.stat().st_mtime_ns
    stale = next((path for path in sources if path.is_file() and path.stat().st_mtime_ns > timestamp), None)
    if stale:
        raise ManifestError(f"binary is older than {stale.relative_to(repo)}; rebuild GPUI before packaging")


def validate_evidence(directory: Path, commit: str, *, windows_arm64: bool = False) -> None:
    root = str(Path(__file__).resolve().parents[1])
    if root not in sys.path:
        sys.path.insert(0, root)
    from scripts.conformance.harness import compare_reports, validate_common

    golden = Path(__file__).resolve().parent / "conformance/golden"
    reports = []
    required_reports = dict(RUNTIME_REPORTS)
    if windows_arm64:
        required_reports["windows-arm64-report.json"] = "windows-aarch64"
    for name, platform in required_reports.items():
        report = json.loads((directory / name).read_text(encoding="utf-8"))
        if report.get("platform") != platform or report.get("build", {}).get("commit") != commit:
            raise ManifestError(f"wrong platform or source commit in {name}")
        cases = report.get("cases", {})
        if (report.get("schema_version") != 1 or len(cases) != report.get("summary", {}).get("total")
                or any(case.get("status") not in {"passed", "skipped"} for case in cases.values())):
            raise ManifestError(f"failed or incomplete conformance report: {name}")
        errors = validate_common(report, golden)
        if errors:
            raise ManifestError(f"{name}: {'; '.join(errors)}")
        reports.append(report)
    errors = compare_reports(reports, golden)
    if errors:
        raise ManifestError("cross-platform mismatch: " + "; ".join(errors))
    for architecture in ("aarch64", "x86_64"):
        name = f"macos-{architecture}-launch.json"
        report = json.loads((directory / name).read_text(encoding="utf-8"))
        if (report.get("status") != "passed" or report.get("commit") != commit
                or report.get("architecture") != architecture
                or report.get("launch_method") != "launchservices"
                or report.get("utf8_locale") is not True or report.get("home_cwd") is not True
                or report.get("screenshot") != "captured" or report.get("rendered_text") is not True):
            raise ManifestError(f"installed macOS application did not pass LaunchServices smoke test: {name}")


def verify_release(metadata: dict, directory: Path, version: str, preview_id: str,
                   commit: str, tag_commit: str) -> None:
    expected_title = f"Pebrel {version} Preview {preview_id}"
    expected_tag = f"preview-v{version}-{preview_id}"
    if (metadata.get("name") != expected_title or metadata.get("tag_name") != expected_tag
            or metadata.get("prerelease") is not True or metadata.get("draft") is not False
            or tag_commit != commit):
        raise ManifestError("remote Preview title, tag, commit, or prerelease state differs")
    notes = (directory / "PREVIEW_NOTES.md").read_text(encoding="utf-8")
    if (metadata.get("body") or "").strip() != notes.strip():
        raise ManifestError("remote Preview notes differ from the verified local notes")
    names = set(expected_asset_names(version, preview_id)) | {"SHA256SUMS"}
    assets = metadata.get("assets") or []
    if len(assets) != len(names) or {asset.get("name") for asset in assets} != names:
        raise ManifestError("remote Preview asset names differ")
    for asset in assets:
        path = directory / asset["name"]
        if (asset.get("label") not in (None, "") or asset.get("state") != "uploaded"
                or asset.get("size") != path.stat().st_size
                or asset.get("digest") != f"sha256:{sha256(path)}"):
            raise ManifestError(f"remote asset label, state, size, or SHA256 differs: {path.name}")


def validate_labels(version: str, preview_id: str) -> None:
    if not VERSION_PATTERN.fullmatch(version):
        raise ManifestError(f"invalid Cargo package version: {version!r}")
    if not PREVIEW_PATTERN.fullmatch(preview_id):
        raise ManifestError(f"invalid Preview id: {preview_id!r}")


def read_cargo_package_version(manifest: Path) -> str:
    """Read only the top-level [package].version from one Cargo manifest."""
    in_package = False
    for raw_line in manifest.read_text(encoding="utf-8").splitlines():
        line = raw_line.strip()
        if line == "[package]":
            in_package = True
            continue
        if in_package and line.startswith("["):
            break
        if in_package:
            match = PACKAGE_VERSION_PATTERN.fullmatch(line)
            if match:
                version = match.group(1)
                if not VERSION_PATTERN.fullmatch(version):
                    raise ManifestError(
                        f"invalid [package].version in {manifest}: {version!r}"
                    )
                return version
    raise ManifestError(f"Cargo manifest has no [package].version: {manifest}")


def asset_version(version: str, preview_id: str) -> str:
    validate_labels(version, preview_id)
    return f"{version}-preview.{preview_id}"


def reviewed_notes(repo: Path, version: str, preview_id: str, macos_signing: str) -> str:
    release = asset_version(version, preview_id)
    source = repo / "docs" / "release-notes" / f"v{release}.md"
    notes = source.read_text(encoding="utf-8").strip()
    if not notes.startswith(f"# Pebrel {version} Preview {preview_id}\n"):
        raise ManifestError("reviewed Preview notes have the wrong release title")
    for heading in ("## English", "## 中文", "## Contributors", "## SHA256"):
        if notes.splitlines().count(heading) != 1:
            raise ManifestError(f"reviewed Preview notes require one {heading} section")
    body, _, checksum_section = notes.rpartition("\n## SHA256\n")
    if checksum_section.strip() != CHECKSUM_PLACEHOLDER or notes.count(CHECKSUM_PLACEHOLDER) != 1:
        raise ManifestError("reviewed notes require the SHA256 placeholder, not stale checksums")
    signing_line = f"macOS signing / macOS 签名: `{macos_signing}`"
    if signing_line not in body.splitlines():
        raise ManifestError("reviewed notes do not match the requested macOS signing mode")
    english_start = body.index("\n## English\n") + 1
    chinese_start = body.index("\n## 中文\n") + 1
    contributors_start = body.index("\n## Contributors\n") + 1
    if not english_start < chinese_start < contributors_start:
        raise ManifestError("reviewed notes must order English, 中文, then Contributors")
    english = body[english_start:chinese_start]
    chinese = body[chinese_start:contributors_start]
    pairs = (("Added", "新增"), ("Fixed", "修复"), ("Improved", "改进"))
    categories = 0
    for first, second in pairs:
        present = f"### {first}" in english.splitlines()
        if present != (f"### {second}" in chinese.splitlines()):
            raise ManifestError("reviewed Preview change categories must be bilingual")
        categories += present
    if not categories:
        raise ManifestError("reviewed Preview notes have no Added, Fixed, or Improved changes")
    changelog = (repo / "CHANGELOG.md").read_text(encoding="utf-8")
    heading = re.search(rf"(?m)^## {re.escape(release)}(?: - [^\n]*)?\n", changelog)
    if heading is None:
        raise ManifestError(f"CHANGELOG.md is missing the {release} entry")
    entry = re.split(r"(?m)^## ", changelog[heading.end():], maxsplit=1)[0].strip()
    entry = re.sub(r"(?m)^#(?=##)", "", entry)
    if entry != body[english_start:contributors_start].strip():
        raise ManifestError("CHANGELOG.md and reviewed Preview notes describe different changes")
    return notes + "\n"


def expected_asset_names(version: str, preview_id: str) -> tuple[str, ...]:
    release = asset_version(version, preview_id)
    return (
        f"Pebrel-v{release}-linux-x86_64.AppImage",
        f"Pebrel-v{release}-linux-x86_64.deb",
        f"Pebrel-v{release}-linux-x86_64.tar.gz",
        f"Pebrel-v{release}-macos-aarch64.dmg",
        f"Pebrel-v{release}-macos-x86_64.dmg",
    )


def _check_magic(path: Path) -> None:
    with path.open("rb") as stream:
        header = stream.read(8)
        if path.suffix == ".dmg":
            stream.seek(-512, os.SEEK_END)
            trailer = stream.read(4)
        else:
            trailer = b""

    if path.name.endswith(".AppImage") and not header.startswith(b"\x7fELF"):
        raise ManifestError(f"AppImage is not an ELF executable: {path.name}")
    if path.suffix == ".deb" and header != b"!<arch>\n":
        raise ManifestError(f"Debian package has an invalid ar header: {path.name}")
    if path.name.endswith(".tar.gz") and not header.startswith(b"\x1f\x8b"):
        raise ManifestError(f"tar.gz has an invalid gzip header: {path.name}")
    if path.suffix == ".dmg" and trailer != b"koly":
        raise ManifestError(f"DMG has no UDIF trailer: {path.name}")


def validate_assets(directory: Path, version: str, preview_id: str) -> list[Path]:
    expected = set(expected_asset_names(version, preview_id))
    generated = {"SHA256SUMS", "PREVIEW_NOTES.md"}
    if not directory.is_dir():
        raise ManifestError(f"asset directory does not exist: {directory}")

    actual = {path.name for path in directory.iterdir() if path.name not in generated}
    missing = sorted(expected - actual)
    unexpected = sorted(actual - expected)
    if missing or unexpected:
        details: list[str] = []
        if missing:
            details.append(f"missing: {', '.join(missing)}")
        if unexpected:
            details.append(f"unexpected: {', '.join(unexpected)}")
        raise ManifestError("Preview asset manifest differs: " + "; ".join(details))

    assets = [directory / name for name in sorted(expected)]
    for path in assets:
        if not path.is_file() or path.is_symlink():
            raise ManifestError(f"asset is not a regular file: {path.name}")
        size = path.stat().st_size
        if size < MIN_ASSET_SIZE:
            raise ManifestError(
                f"asset is unexpectedly small ({size} bytes): {path.name}"
            )
        _check_magic(path)
    return assets


def sha256(path: Path) -> str:
    digest = hashlib.sha256()
    with path.open("rb") as stream:
        for chunk in iter(lambda: stream.read(1024 * 1024), b""):
            digest.update(chunk)
    return digest.hexdigest()


def write_atomic(path: Path, content: str) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    temporary = path.with_name(f".{path.name}.{os.getpid()}.tmp")
    try:
        temporary.write_text(content, encoding="utf-8", newline="\n")
        temporary.replace(path)
    finally:
        temporary.unlink(missing_ok=True)


def checksum_text(assets: list[Path]) -> str:
    return "".join(f"{sha256(path)}  {path.name}\n" for path in assets)


def preview_notes(
    version: str,
    preview_id: str,
    repository: str,
    commit: str,
    checksums: str,
    macos_signing: str = "adhoc",
) -> str:
    short_commit = commit[:12]
    commit_url = f"https://github.com/{repository}/commit/{commit}"
    title = f"Pebrel {version} Preview {preview_id}"
    signing_en = (
        "The macOS applications use ad-hoc signatures and are not Apple-notarized. Only open a verified, trusted download via System Settings > Privacy & Security > Open Anyway."
        if macos_signing == "adhoc" else
        "The macOS applications use Developer ID signatures; the final DMGs were accepted by Apple notarization and have stapled tickets."
    )
    signing_zh = (
        "macOS 应用仅使用 ad-hoc 签名，尚未经过 Apple 公证；仅对已核验且可信的下载在系统设置 → 隐私与安全性中选择“仍要打开”。"
        if macos_signing == "adhoc" else
        "macOS 应用使用 Developer ID 签名；最终 DMG 已获 Apple 公证接受并附加公证票据。"
    )
    return f"""# {title}

## English

### Added

- Added automated Preview packages for Linux x86_64: AppImage, Debian package, and portable tar archive.
- Added native macOS Preview disk images for Apple Silicon and Intel.

### Verification

- Every package was built on a native GitHub-hosted runner from commit [`{short_commit}`]({commit_url}).
- Linux conformance ran against both the final AppImage and the installed Debian package.
- macOS conformance ran against the application from each final disk image, including a separate installed-copy LaunchServices startup check.
- Runtime reports were compared with a Windows build of the same commit. This does not certify native IME, display scaling, or interactive SSH authentication.

### Preview limitations

- These packages are for cross-platform testing and are not a stable release.
- {signing_en}
- Linux/macOS automatic update installation and platform-specific integrations remain outside this Preview.

## 中文

### 新增

- 新增由 CI 自动构建的 Linux x86_64 Preview 包：AppImage、Debian 安装包和便携 tar 归档。
- 新增 Apple Silicon 和 Intel 两种原生 macOS Preview 磁盘映像。

### 验证

- 所有安装包均由 GitHub 原生 runner 从提交 [`{short_commit}`]({commit_url}) 构建。
- Linux conformance 分别针对最终 AppImage 和已安装的 Debian 包运行。
- macOS conformance 针对每个最终 DMG 中的应用运行，并单独检查安装副本通过 LaunchServices 启动。
- Runtime 报告与同一提交的 Windows 构建进行了比较；这不代表原生输入法、显示缩放或交互式 SSH 认证已通过验收。

### Preview 限制

- 这些产物用于跨平台测试，不是稳定版本。
- {signing_zh}
- Linux/macOS 自动安装更新和平台专属集成功能不在本次 Preview 范围内。

## Contributors

- See the commit history for this Preview build / 本 Preview 的贡献者以提交历史为准。

---

## SHA256

```text
{checksums.rstrip()}
```
"""


def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("directory", nargs="?", type=Path)
    parser.add_argument("--version")
    parser.add_argument("--preview-id")
    parser.add_argument("--write-checksums", type=Path)
    parser.add_argument("--write-notes", type=Path)
    parser.add_argument("--repository")
    parser.add_argument("--commit")
    parser.add_argument("--print-package-version", type=Path)
    parser.add_argument("--check-binary", type=Path)
    parser.add_argument("--check-reviewed-notes", action="store_true")
    parser.add_argument("--use-reviewed-notes", action="store_true")
    parser.add_argument("--evidence-dir", type=Path)
    parser.add_argument("--macos-signing", choices=("adhoc", "developer-id"), default="adhoc")
    parser.add_argument("--verify-release", type=Path)
    parser.add_argument("--tag-commit")
    return parser.parse_args(argv)


def main(argv: list[str] | None = None) -> int:
    args = parse_args(argv)
    try:
        if args.print_package_version:
            print(read_cargo_package_version(args.print_package_version.resolve()))
            return 0
        if args.check_binary:
            verify_binary_freshness(args.check_binary.resolve(), Path(__file__).resolve().parents[1])
            return 0
        source_notes = None
        if args.check_reviewed_notes or args.use_reviewed_notes:
            if not args.version or not args.preview_id:
                raise ManifestError("reviewed notes require --version and --preview-id")
            source_notes = reviewed_notes(Path(__file__).resolve().parents[1], args.version,
                                          args.preview_id, args.macos_signing)
            if args.check_reviewed_notes:
                return 0
        if args.evidence_dir:
            if not args.commit:
                raise ManifestError("--evidence-dir requires --commit")
            validate_evidence(args.evidence_dir.resolve(), args.commit)
        if args.directory is None or not args.version or not args.preview_id:
            raise ManifestError(
                "asset validation requires directory, --version, and --preview-id"
            )
        assets = validate_assets(args.directory.resolve(), args.version, args.preview_id)
        if args.verify_release:
            if not args.commit or not args.tag_commit:
                raise ManifestError("--verify-release requires --commit and --tag-commit")
            verify_release(json.loads(args.verify_release.read_text(encoding="utf-8")),
                           args.directory.resolve(), args.version, args.preview_id, args.commit, args.tag_commit)
        checksums = checksum_text(assets)
        if args.write_checksums:
            write_atomic(args.write_checksums.resolve(), checksums)
        if args.write_notes:
            if not args.repository or not args.commit or not args.evidence_dir:
                raise ManifestError(
                    "--write-notes requires --repository, --commit, and validated --evidence-dir"
                )
            if source_notes is not None:
                notes = source_notes.replace(CHECKSUM_PLACEHOLDER, f"```text\n{checksums.rstrip()}\n```")
            else:
                notes = preview_notes(
                    args.version,
                    args.preview_id,
                    args.repository,
                    args.commit,
                    checksums,
                    args.macos_signing,
                )
            write_atomic(args.write_notes.resolve(), notes)
    except (ManifestError, OSError, json.JSONDecodeError) as error:
        print(f"preview manifest error: {error}", file=sys.stderr)
        return 1

    for path in assets:
        print(f"{sha256(path)}  {path.name}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())