"""Governed scaffolding for rapp-* managed workload packages."""

from __future__ import annotations

import argparse
import json
import re
import subprocess
from pathlib import Path
from typing import Any

PACKAGE_TYPES = (
    "helm-managed-platform-service",
    "manifest-managed-platform-service",
    "knative-managed-service",
    "grouped-composition",
)
RAILS = ("rail-kubernetes", "rail-knative")
CLASSIFICATIONS = ("public", "internal", "confidential", "restricted")
CRITICALITIES = ("low", "medium", "high", "critical")
SLUG = re.compile(r"^[a-z0-9]+(-[a-z0-9]+)*$")
DIGEST = re.compile(r"^sha256:[0-9a-f]{64}$")

_FAMILY_VALIDATOR = Path.home() / "railiance-master" / "tools" / "validate-family-declarations.py"


def _refuse(message: str) -> dict[str, Any]:
    return {"ok": False, "error": message}


def _write(path: Path, content: str) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text(content if content.endswith("\n") else content + "\n")


def init(
    path: Path,
    *,
    app: str,
    ownership_repo: str,
    rail: str = "rail-kubernetes",
    classification: str = "confidential",
    criticality: str = "high",
    package_type: str = "manifest-managed-platform-service",
    purpose: str | None = None,
    force: bool = False,
) -> dict[str, Any]:
    if not SLUG.match(app) or app.startswith("rapp-"):
        return _refuse("app must be a workload slug without the rapp- prefix")
    if rail not in RAILS:
        return _refuse(f"unknown rail {rail!r}; allowed: {', '.join(RAILS)}")
    if package_type not in PACKAGE_TYPES:
        return _refuse(f"unknown package_type {package_type!r}")
    if classification not in CLASSIFICATIONS:
        return _refuse(f"unknown classification {classification!r}")
    if criticality not in CRITICALITIES:
        return _refuse(f"unknown criticality {criticality!r}")
    if not SLUG.match(ownership_repo) or ownership_repo.startswith("rapp-"):
        return _refuse("ownership_repo must be an app or layer slug, not the rapp itself")

    rapp_id = f"rapp-{app}"
    dest = path.expanduser().resolve()
    dest.mkdir(parents=True, exist_ok=True)
    declaration = dest / "declarations" / "rapp.yaml"
    if declaration.is_file() and not force:
        return _refuse(f"{declaration} already exists; refuse to overwrite a live contract")

    purpose_text = purpose or f"Package and operate the {app} service on Railiance."
    files = {
        ".repo-classification.yaml": (
            "repo_classification:\n"
            '  standard: Repo Classification Standard\n'
            '  version: "1.0"\n'
            "  classified_by: repo-manager\n"
            "  category: project\n"
            "  domain: infotech\n"
        ),
        "README.md": f"# {rapp_id}\n\nManaged runtime package for `{app}`.\n",
        "INTENT.md": (
            f"# Intent\n\nProvide the managed Railiance runtime package for `{app}`.\n"
        ),
        "SCOPE.md": (
            "# Scope\n\n## In scope\n\n- packaging, smoke, rollback, and the family declaration\n\n"
            "## Out of scope\n\n- application domain ownership\n- credential values\n"
        ),
        "AGENTS.md": (
            f"# Repository agent guide\n\nWorkplans use the prefix "
            f"`{rapp_id.upper()}-WP-`.\n"
        ),
        "CLAUDE.md": f"# {rapp_id}\n\n@SCOPE.md\n@AGENTS.md\n",
        "Makefile": (
            "SHELL := /bin/bash\n\n.PHONY: check\n\ncheck:\n"
            "\tpython3 -m unittest discover -s tests -v\n"
        ),
        ".gitignore": ".rendered/\n__pycache__/\n",
        "declarations/rapp.yaml": _declaration(
            rapp_id=rapp_id,
            app=app,
            ownership_repo=ownership_repo,
            rail=rail,
            classification=classification,
            criticality=criticality,
            package_type=package_type,
            purpose=purpose_text,
        ),
        f"workplans/{rapp_id.upper()}-WP-0001-bootstrap.md": (
            f"---\nid: {rapp_id.upper()}-WP-0001\ntype: workplan\n"
            f'title: "Bootstrap {rapp_id}"\nstatus: proposed\n---\n\n'
            f"# Bootstrap {rapp_id}\n"
        ),
    }
    written = []
    for rel, content in files.items():
        _write(dest / rel, content)
        written.append(rel)
    (dest / "workplans" / "archived").mkdir(exist_ok=True)
    return {"ok": True, "path": str(dest), "rapp_id": rapp_id, "written": written}


def _declaration(
    *,
    rapp_id: str,
    app: str,
    ownership_repo: str,
    rail: str,
    classification: str,
    criticality: str,
    package_type: str,
    purpose: str,
) -> str:
    return (
        "kind: managed-workload-package\n"
        "repo_family: rapp\n"
        f"rapp_id: {rapp_id}\n"
        f"repo: {rapp_id}\n"
        f"ownership_repo: {ownership_repo}\n"
        "contract_version: 1.0.0\n"
        "readiness_state: draft\n"
        "workload_identity:\n"
        f"  name: {app}\n"
        f"  package_type: {package_type}\n"
        f"data_classification: {classification}\n"
        f"criticality: {criticality}\n"
        f"primary_rail: {rail}\n"
        "supported_rails:\n"
        f"  - {rail}\n"
        "bound_reefs: []\n"
        "runtime_dependencies:\n"
        "  - kubernetes-api\n"
        "composition:\n"
        f"  purpose: {purpose}\n"
        "  member_repos:\n"
        f"    - repo: {rapp_id}\n"
        "      role: managed runtime package\n"
        "      deployables:\n"
        f"        - {app}\n"
        "rollout_contract:\n"
        "  default_mode: kubectl-server-side-apply\n"
        "smoke_contract:\n"
        "  required:\n"
        "    - healthz-ok\n"
        "rollback_contract:\n"
        "  order:\n"
        "    - apply-reviewed-git-revision\n"
    )


def validate(path: Path, *, family_root: Path | None = None) -> dict[str, Any]:
    dest = path.expanduser().resolve()
    declaration = dest / "declarations" / "rapp.yaml"
    if not declaration.is_file():
        return _refuse(f"missing {declaration}")
    missing = [
        name
        for name in (
            "README.md",
            "INTENT.md",
            "SCOPE.md",
            "AGENTS.md",
            ".repo-classification.yaml",
        )
        if not (dest / name).is_file()
    ]
    if missing:
        return _refuse(f"missing bootstrap files: {', '.join(missing)}")

    if _FAMILY_VALIDATOR.is_file():
        import tempfile

        search_root = (family_root or dest.parent).resolve()
        with tempfile.TemporaryDirectory(prefix="rmgr-rapp-") as tmp:
            tmp_root = Path(tmp)
            (tmp_root / dest.name).symlink_to(dest)
            for sibling in ("rail-kubernetes", "rail-knative", "reef-railiance"):
                candidate = search_root / sibling
                if candidate.is_dir():
                    (tmp_root / sibling).symlink_to(candidate)
            proc = subprocess.run(
                ["python3", str(_FAMILY_VALIDATOR), "--root", str(tmp_root)],
                check=False,
                capture_output=True,
                text=True,
            )
        return {
            "ok": proc.returncode == 0,
            "path": str(dest),
            "validator": str(_FAMILY_VALIDATOR),
            "stdout": proc.stdout.strip(),
            "stderr": proc.stderr.strip(),
            "exit_code": proc.returncode,
        }

    text = declaration.read_text()
    required = (
        "kind: managed-workload-package",
        "repo_family: rapp",
        "ownership_repo:",
        "primary_rail:",
        "composition:",
    )
    absent = [item for item in required if item not in text]
    if absent:
        return _refuse(f"declaration missing {absent}")
    return {"ok": True, "path": str(dest), "validator": None}


def pin_image(path: Path, digest: str) -> dict[str, Any]:
    if not DIGEST.fullmatch(digest):
        return _refuse("digest must be sha256:<64 lowercase hex>")
    dest = path.expanduser().resolve()
    runtime = dest / "manifests" / "runtime.yaml"
    if not runtime.is_file():
        return _refuse(f"missing {runtime}")
    text = runtime.read_text()
    updated, n = re.subn(
        r"(forgejo\.coulomb\.social/coulomb/user-engine@)sha256:[0-9a-f]{64}",
        rf"\g<1>{digest}",
        text,
    )
    if n == 0:
        return _refuse("no user-engine digest pin found in manifests/runtime.yaml")
    runtime.write_text(updated)
    binding = dest / "bindings" / "reef-railiance.yaml"
    if binding.is_file():
        binding.write_text(
            re.sub(r"sha256:[0-9a-f]{64}", digest, binding.read_text(), count=1)
        )
    declaration = dest / "declarations" / "rapp.yaml"
    if declaration.is_file():
        declaration.write_text(
            re.sub(
                r"(source: forgejo\.coulomb\.social/coulomb/user-engine\n      version: )sha256:[0-9a-f]{64}",
                rf"\g<1>{digest}",
                declaration.read_text(),
            )
        )
    return {"ok": True, "path": str(dest), "digest": digest, "rewritten": n}


def add_rapp_parser(sub: argparse._SubParsersAction) -> None:
    rapp = sub.add_parser("rapp", help="Scaffold or validate a rapp-* package")
    rapp_sub = rapp.add_subparsers(dest="rapp_command", required=True)

    p_init = rapp_sub.add_parser("init", help="Create a draft rapp-* baseline")
    p_init.add_argument("--path", required=True, help="Destination checkout")
    p_init.add_argument("--app", required=True, help="Workload name (no rapp- prefix)")
    p_init.add_argument("--ownership-repo", required=True)
    p_init.add_argument("--rail", default="rail-kubernetes", choices=RAILS)
    p_init.add_argument("--classification", default="confidential", choices=CLASSIFICATIONS)
    p_init.add_argument("--criticality", default="high", choices=CRITICALITIES)
    p_init.add_argument("--package-type", default="manifest-managed-platform-service", choices=PACKAGE_TYPES)
    p_init.add_argument("--purpose", default=None)
    p_init.add_argument("--force", action="store_true")

    p_val = rapp_sub.add_parser("validate", help="Validate a rapp-* checkout")
    p_val.add_argument("--path", required=True)
    p_val.add_argument("--family-root", default=None)

    p_pin = rapp_sub.add_parser("pin-image", help="Rewrite the user-engine digest pin")
    p_pin.add_argument("--path", required=True)
    p_pin.add_argument("--digest", required=True)