#!/usr/bin/env bash
set -euo pipefail

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
VERSION="$(sed -n 's/^version = "\([^"]*\)"/\1/p' "$ROOT_DIR/Cargo.toml" | head -1)"
TAG="v${VERSION}"

grep -Fq "BOT_FORGE_RELEASE_TAG:-${TAG}" "$ROOT_DIR/install.sh"
grep -Fq 'BOT_FORGE_CHECKSUMS_SHA256' "$ROOT_DIR/install.sh" "$ROOT_DIR/install.ps1" "$ROOT_DIR/README.md"
grep -Fq "'${TAG}'" "$ROOT_DIR/install.ps1"
grep -Fq 'DEFAULT_CONFIG_DIR="$HOME/Library/Application Support/bot-forge/config"' "$ROOT_DIR/install.sh"
grep -Fq 'DEFAULT_DATA_DIR="$HOME/Library/Application Support/bot-forge"' "$ROOT_DIR/install.sh"
grep -Fq 'DEFAULT_BIN_DIR="$DEFAULT_DATA_DIR/bin"' "$ROOT_DIR/install.sh"
grep -Fq '$env:BOT_FORGE_CONFIG_DIR' "$ROOT_DIR/install.ps1"
grep -Fq "Join-Path \$roamingAppData 'bot-forge'" "$ROOT_DIR/install.ps1"
RELEASE_DOC="$ROOT_DIR/docs/manual/11-quality-and-release.md"
grep -Fq 'PLATFORM="${OS}-${ARCH}"' "$ROOT_DIR/install.sh"
grep -Fq 'linux-x86_64-bot-forge' "$RELEASE_DOC" "$ROOT_DIR/.github/workflows/release.yml"
grep -Fq 'linux-aarch64-bot-forge' "$RELEASE_DOC" "$ROOT_DIR/.github/workflows/release.yml"
grep -Fq 'macos-x86_64-bot-forge' "$RELEASE_DOC" "$ROOT_DIR/.github/workflows/release.yml"
grep -Fq 'macos-aarch64-bot-forge' "$RELEASE_DOC" "$ROOT_DIR/.github/workflows/release.yml"
grep -Fq 'windows-x86_64-bot-forge.exe' "$ROOT_DIR/install.ps1" "$RELEASE_DOC"
grep -Fq 'windows-aarch64-bot-forge.exe' "$ROOT_DIR/install.ps1" "$RELEASE_DOC"
grep -Eq 'taiki-e/install-action@[0-9a-f]{40}' "$ROOT_DIR/.github/workflows/release.yml"
grep -Fq 'tool: cargo-cyclonedx' "$ROOT_DIR/.github/workflows/release.yml"
grep -Fq 'tool: cargo-deny' "$ROOT_DIR/.github/workflows/ci.yml"
if rg -q 'uses: [^#[:space:]]+@(v[0-9]+|stable|main|master|cargo-)' "$ROOT_DIR/.github/workflows"; then
    printf 'GitHub Actions must be pinned to immutable commit SHAs.\n' >&2
    exit 1
fi
grep -Eq 'rust-toolchain@[0-9a-f]{40}' "$ROOT_DIR/.github/workflows/ci.yml"
grep -Fq 'toolchain: stable' "$ROOT_DIR/.github/workflows/ci.yml" "$ROOT_DIR/.github/workflows/release.yml"
if grep -Fq 'rust-version' "$ROOT_DIR/Cargo.toml"; then
    printf 'Cargo.toml must not pin bot-forge compilation to a fixed MSRV.\n' >&2
    exit 1
fi
grep -Fq 'versions = { rust = "1.89.0" }' "$ROOT_DIR/catalogs/rust-dev.toml"
grep -Fq 'release/${{ matrix.asset }}.cdx.json' "$ROOT_DIR/.github/workflows/release.yml"
grep -Fq '*.cdx.json' "$ROOT_DIR/.github/workflows/release.yml"
grep -Fq 'sha256sum' "$ROOT_DIR/.github/workflows/release.yml"
grep -Fq 'sha256sum SHA256SUMS > SHA256SUMS.sha256' "$ROOT_DIR/.github/workflows/release.yml"
grep -Fq 'bot-forge.toml release/' "$ROOT_DIR/.github/workflows/release.yml"
grep -Fq 'rust-dev.catalog.toml#' "$ROOT_DIR/.github/workflows/release.yml"
grep -Fxq 'catalog = "rust-dev"' "$ROOT_DIR/bot-forge.toml"
grep -Fq '[[ ! -e "$CONFIG_PATH" ]]' "$ROOT_DIR/install.sh"
grep -Fq 'if (-not (Test-Path -LiteralPath $configPath))' "$ROOT_DIR/install.ps1"
python3 -m json.tool "$ROOT_DIR/schema/config.json" >/dev/null
python3 -m json.tool "$ROOT_DIR/schema/registry.json" >/dev/null
jq -e '.required == ["catalog"] and .properties.catalog.const == "rust-dev" and (.properties | has("catalog-digest") | not)' "$ROOT_DIR/schema/config.json" >/dev/null
jq -e '[."$defs".BackendKind.oneOf[].const] | index("git") != null' "$ROOT_DIR/schema/registry.json" >/dev/null
jq -e '[."$defs".InstallKind.oneOf[].const] == ["tool", "skill"]' "$ROOT_DIR/schema/registry.json" >/dev/null
jq -e '."$defs".RegistryEntry.required == ["name", "kind", "source", "profile", "targets", "installed_at", "artifact_id", "previous_artifact_id", "config_hash", "plan_hash", "source_revision", "backend"]' "$ROOT_DIR/schema/registry.json" >/dev/null
jq -e '."$defs".RegistryTarget.required == ["path", "binary"] and ."$defs".RegistryTarget.properties.path.type == "string" and (."$defs".RegistryEntry.properties | has("binaries") | not) and (."$defs" | has("RegistryArtifact") | not)' "$ROOT_DIR/schema/registry.json" >/dev/null
if rg -q '"kind"\s*:\s*"crate"|--kind crate|"targets"\s*:\s*\[[[:space:]]*sys\.argv' "$ROOT_DIR/.github" "$ROOT_DIR/scripts/test-managed-cargo-smoke.sh"; then
    printf 'Release fixtures still use a removed registry contract.\n' >&2
    exit 1
fi
grep -Fq 'bash scripts/test-managed-cargo-smoke.sh' "$ROOT_DIR/.github/workflows/ci.yml"
grep -Fq 'bash scripts/test-install-script.sh' "$ROOT_DIR/.github/workflows/ci.yml"
grep -Fq './scripts/test-install-script.ps1' "$ROOT_DIR/.github/workflows/ci.yml"

command_names="$($ROOT_DIR/target/debug/bot-forge generate json 2>/dev/null || true)"
if [[ -n "$command_names" ]]; then
    python3 -c 'import json,sys; names={x["name"] for x in json.load(sys.stdin)}; required={"install","plan","status","resume","remove","config","cache","doctor","apt-mirror"}; assert required <= names; assert not ({"list","state","update","repair","install-crate","install-skill"} & names)' <<<"$command_names"
fi

if rg -q 'install --dry-run|state recover' "$ROOT_DIR/README.md" "$ROOT_DIR/SECURITY.md" "$ROOT_DIR/docs"; then
    printf 'Documentation still references a removed command surface.\n' >&2
    exit 1
fi

printf 'Release asset contract is consistent for %s.\n' "$TAG"