"""Narrow installed CLI entry point; rendered by build_release_bundle.py."""
import hashlib
import os
from pathlib import Path
import sys

EXPECTED_HELPER_SHA256 = "@HELPER_SHA256@"


def main():
    prefix = Path(__file__).resolve().parent.parent
    helper = prefix / "libexec" / "secrets-engine-pdp-verify"
    try:
        if helper.is_symlink() or not helper.is_file():
            raise ValueError("missing helper")
        if hashlib.sha256(helper.read_bytes()).hexdigest() != EXPECTED_HELPER_SHA256:
            raise ValueError("changed helper")
    except (OSError, ValueError):
        print("secrets-engine: installed verifier missing or changed", file=sys.stderr)
        return 1
    # The bundle always uses its reviewed helper; ambient overrides do not select
    # another executable. The owner admits runtime trust separately.
    os.environ["SECRETS_ENGINE_PDP_VERIFIER"] = str(helper)
    from secrets_engine.cli import main as cli_main
    return cli_main()


if __name__ == "__main__":
    raise SystemExit(main())