"""Collect a Phase 13S environment receipt. Read-only; no deploys or migrations."""

from __future__ import annotations

import hashlib
import json
import subprocess
from datetime import UTC, datetime
from pathlib import Path

from src.domain.app_blocks.canonical import CANONICAL_BLOCK_IDS
from src.domain.app_blocks.catalogs import DEFAULT_KNOWN_PACKS
from src.domain.starter_library.catalog import list_contracts

ROOT = Path(__file__).resolve().parents[1]
CLOUD = ROOT.parent / "P2HSCloud"
DASH = ROOT.parent / "P2HS-Dash"
OUT = ROOT / "docs/audits/fixtures/13s_environment_receipt.json"


def git_meta(path: Path) -> dict:
    def run(*args: str) -> str:
        return subprocess.check_output(["git", *args], cwd=path, text=True).strip()

    return {
        "path": str(path),
        "branch": run("rev-parse", "--abbrev-ref", "HEAD"),
        "sha": run("rev-parse", "HEAD"),
        "dirty": bool(run("status", "--porcelain")),
    }


def alembic_heads() -> list[str]:
    text = subprocess.check_output(
        ["python", "-m", "alembic", "heads"],
        cwd=ROOT,
        text=True,
    )
    return [line.split()[0] for line in text.splitlines() if line.strip()]


def main() -> None:
    from scripts.phase13s_isolation_gate import inspect

    isolation = inspect()
    payload = {
        "phase": "13S",
        "generated_at": datetime.now(UTC).isoformat(),
        "status": "isolated_configs_pending_provisioning"
        if isolation["cloud_isolated_from_production"]
        and not isolation["cloud_resources_provisioned"]
        else "blocked",
        "production_deployment_authorized": False,
        "phase_13b_authorized": False,
        "architecture_frozen": True,
        "expected_alembic_head": "145",
        "local_alembic_heads": alembic_heads(),
        "catalog": {
            "app_blocks": len(CANONICAL_BLOCK_IDS),
            "feature_packs": len(DEFAULT_KNOWN_PACKS),
            "starter_contracts": len(list_contracts()),
        },
        "repos": {
            "core": git_meta(ROOT),
            "cloud": git_meta(CLOUD) if (CLOUD / ".git").exists() else None,
            "dash": git_meta(DASH) if (DASH / ".git").exists() else None,
        },
        "declared_staging": {
            "core_api": "https://stag1.piejet.com",
            "dash": "https://devdash.p2hs.com",
            "cloud_gateway": "https://stag-cloudgate.p2hs.com",
            "cloud_public": "https://stag-cloud.p2hs.com",
        },
        "declared_production": {
            "core_api": "https://beapipie.p2hs.com",
            "dash": "https://dashboard.p2hs.com",
            "cloud_gateway": "https://cloudgate.p2hs.com",
        },
        "isolation": isolation,
        "migrations_135_145_applied_on_staging_db": None,
        "notes": [
            "13A measured live DB revision 134 against this Core API host family.",
            "Do not alembic upgrade production. Confirm stag1 is not beapipie before migrating.",
            "Cloud D1/KV/R2/queue IDs on this branch are placeholders until provisioned.",
            "Existing Core staging push still auto-deploys origin/staging, not this branch.",
        ],
        "source_hash": None,
    }
    raw = json.dumps({k: v for k, v in payload.items() if k != "source_hash"}, sort_keys=True)
    payload["source_hash"] = hashlib.sha256(raw.encode("utf-8")).hexdigest()
    OUT.parent.mkdir(parents=True, exist_ok=True)
    OUT.write_text(json.dumps(payload, indent=2) + "\n", encoding="utf-8")
    print(json.dumps({"wrote": str(OUT), "status": payload["status"]}, indent=2))


if __name__ == "__main__":
    main()