#!/usr/bin/env bash
set -euo pipefail

bundle="$(realpath "$1")"

required_patterns=(
  '/jrpg/index.html$'
  '/jrpg/jrpg.css$'
  '/jrpg/jrpg.js$'
  '/pixel-mplus-12-regular.ttf$'
  '/copilot_sidecar.zip$'
  '/litellm_proxy.zip$'
  '/litellm_config.yaml$'
  '/inference_stack.sh$'
  '/inference_sidecar_launcher.sh$'
  '/production_entrypoint.sh$'
  '/copilot$'
  '/python3$'
)

files="$(find -L "$bundle" -type f)"
for pattern in "${required_patterns[@]}"; do
  if ! grep -Eq "$pattern" <<<"$files"; then
    echo "Production bundle is missing inference runtime: $pattern" >&2
    exit 1
  fi
done

if grep -Eq '/mock_sidecar($|\\.)|/mock_responses\\.json$' <<<"$files"; then
  echo "Production bundle contains the development mock inference runtime" >&2
  exit 1
fi

config="$(find -L "$bundle" -type f -name litellm_config.yaml -print -quit)"
grep -q 'os.environ/LITELLM_MASTER_KEY' "$config"
if grep -Eq 'sk-[A-Za-z0-9_-]{16,}|gh[opurs]_[A-Za-z0-9]{16,}' "$config"; then
  echo "Production LiteLLM config contains a credential" >&2
  exit 1
fi

entrypoint="$(find -L "$bundle" -type f -name production_entrypoint.sh -print -quit)"
bash -n "$entrypoint"
grep -q 'mrjunejune_server_binary' "$entrypoint"
grep -q "+_repo_rules2+copilot_cli_linux_x86_64/copilot" "$entrypoint"
grep -q "+http_archive+copilot_cli_linux_x86_64/copilot" "$entrypoint"
grep -q "rules_python++python+python_3_11_x86_64-unknown-linux-gnu/bin/python3" "$entrypoint"
if grep -q 'MRJUNEJUNE_ALLOW_.*INFERENCE' "$entrypoint"; then
  echo "Production entrypoint must not override guest policy from .config" >&2
  exit 1
fi

sidecar="$(find -L "$bundle" -type f -path '*/mrjunejune/inference/copilot_sidecar.zip' -print -quit)"
litellm="$(find -L "$bundle" -type f -path '*/mrjunejune/inference/litellm_proxy.zip' -print -quit)"
copilot_cli="$(
  find -L "$bundle" -type f \
    \( \
      -path '*+_repo_rules2+copilot_cli_linux_x86_64/copilot' -o \
      -path '*+http_archive+copilot_cli_linux_x86_64/copilot' \
    \) -print -quit
)"
python="$(find -L "$bundle" -type f -path '*/rules_python++python+python_3_11_*/bin/python3' -print -quit)"
state="$(mktemp -d)"
trap 'rm -rf "$state"' EXIT

sidecar_files="$(unzip -Z1 "$sidecar")"
for required in \
  'mrjunejune/inference/public_knowledge.py' \
  'mrjunejune/assistant/common.md' \
  'mrjunejune/assistant/public_visitor.md' \
  'mrjunejune/assistant/invited_friend.md' \
  'mrjunejune/assistant/june_admin.md' \
  'mrjunejune/assistant/knowledge/public_facts.json'; do
  if ! grep -q "$required" <<<"$sidecar_files"; then
    echo "Copilot sidecar is missing assistant prompt data: $required" >&2
    exit 1
  fi
done

facts_path="$(
  grep 'mrjunejune/assistant/knowledge/public_facts.json$' \
    <<<"$sidecar_files"
)"
facts="$(unzip -p "$sidecar" "$facts_path")"
grep -q '"visibility": "public"' <<<"$facts"
grep -q '"status": "verified"' <<<"$facts"
if grep -Eqi \
    '[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}|650-531-1728|437-580-8026' \
    <<<"$facts"; then
  echo "Copilot sidecar public knowledge contains contact data" >&2
  exit 1
fi

output="$(
  printf '%s\n' '{"command":"shutdown","request_id":"bundle-test","conversation_id":null}' |
    COPILOT_SIDECAR_HOME="$state/copilot" \
    LITELLM_BASE_URL='http://127.0.0.1:1/v1' \
    LITELLM_MODEL='jrpg-copilot' \
    LITELLM_WIRE_API='completions' \
    "$python" "$sidecar" "$copilot_cli"
)"
grep -q '"type":"ready"' <<<"$output"
grep -q '"public_visitor"' <<<"$output"
grep -q '"invited_friend"' <<<"$output"
grep -q '"june_admin"' <<<"$output"
grep -q 'XDG_CACHE_HOME=' "$(
  find -L "$bundle" -type f -name inference_stack.sh -print -quit
)"
"$python" "$litellm" --help >/dev/null