#!/usr/bin/env python3
"""Generate deterministic FE-M4 device/HAL/3D frontend evidence."""

from __future__ import annotations

import argparse
import hashlib
import json
import subprocess
from pathlib import Path
from typing import Any

CONTEXT = Path("context-lock.json")
FE3 = Path("coverage/frontend-m3.report.json")
HAL = Path("coverage/hal-component-manifest.report.json")
DEVICES = Path("coverage/virtual-device-fault-matrix.report.json")
GATE = Path("coverage/release-candidate-gate.report.json")
OUTPUT = Path("coverage/frontend-m4.report.json")
FILES = (Path("web/app/device-panel.mjs"), Path("web/app/hal-panel.mjs"), Path("web/app/machine-view.mjs"), Path("web/app/test_frontend_m4.mjs"))

def canonical(value: Any) -> str: return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
def digest(value: Any) -> str: return hashlib.sha256(canonical(value).encode()).hexdigest()
def artifact(root: Path, path: Path, role: str) -> dict[str, Any]:
    full = root / path
    if not full.is_file(): return {"path": path.as_posix(), "role": role, "status": "missing"}
    return {"path": path.as_posix(), "role": role, "status": "present", "bytes": full.stat().st_size, "sha256": hashlib.sha256(full.read_bytes()).hexdigest()}
def smoke(root: Path) -> dict[str, Any]:
    result = subprocess.run(["node", "web/app/test_frontend_m4.mjs"], cwd=root, check=False, capture_output=True, text=True)
    return {"status": "passed" if result.returncode == 0 else "blocked", "exit_code": result.returncode, "stdout": result.stdout.strip(), "stdout_sha256": digest(result.stdout), "stderr_sha256": digest(result.stderr)}

def generate(root: Path, output: Path = OUTPUT) -> dict[str, Any]:
    root = root.resolve()
    lock = json.loads((root / CONTEXT).read_text())
    fe3 = json.loads((root / FE3).read_text())
    hal = json.loads((root / HAL).read_text())
    devices = json.loads((root / DEVICES).read_text())
    gate = json.loads((root / GATE).read_text())
    outputs = [artifact(root, path, "frontend_source") for path in FILES]
    device = (root / FILES[0]).read_text() if (root / FILES[0]).is_file() else ""
    hal_source = (root / FILES[1]).read_text() if (root / FILES[1]).is_file() else ""
    machine = (root / FILES[2]).read_text() if (root / FILES[2]).is_file() else ""
    run = smoke(root)
    checks = {
        "fe3_dependency": {"status": "verified" if fe3.get("implementation_status") == "verified" else "blocked"},
        "device_workflow": {"status": "verified" if all(token in device for token in ("SPINDLE_COMMAND", "TOOL_PREPARE", "PROBE_CONFIG", "IO_RECOVER")) and devices.get("implementation_status") == "verified" else "blocked"},
        "hal_diagnostics": {"status": "verified" if "HAL diagnostics" in hal_source and hal.get("implementation_status") == "verified" else "blocked"},
        "machine_view_boundary": {"status": "verified" if "canvas" in machine and "_sim_" not in machine and "wasm" not in machine.lower() else "blocked"},
        "source_files": {"status": "verified" if all(row["status"] == "present" for row in outputs) else "blocked"},
        "browser_smoke": {"status": "verified" if run["status"] == "passed" else "blocked", "stdout": run["stdout"]},
        "release_stop_preserved": {"status": "verified" if gate.get("release_action") == "STOP_RELEASE" and gate.get("candidate_eligible") is False else "blocked", "release_action": gate.get("release_action")},
    }
    ok = all(value["status"] == "verified" for value in checks.values())
    report: dict[str, Any] = {"schema": "frontend-m4.v1", "context_id": lock.get("context_id"), "task_id": "FE-M4", "status": "partial" if ok else "blocked", "implementation_status": "verified" if ok else "blocked", "candidate_eligible": False, "release_action": "STOP_RELEASE", "inputs": [artifact(root, CONTEXT, "context_lock"), artifact(root, FE3, "frontend_m3"), artifact(root, HAL, "hal_component_manifest"), artifact(root, DEVICES, "virtual_device_fault_matrix"), artifact(root, GATE, "release_candidate_gate")], "outputs": outputs, "checks": checks, "smoke": run, "next_transition": "execute REG-01 full configuration startup matrix", "report_sha256": None}
    report["report_sha256"] = digest({key: value for key, value in report.items() if key != "report_sha256"})
    destination = output if output.is_absolute() else root / output
    destination.parent.mkdir(parents=True, exist_ok=True)
    destination.write_text(json.dumps(report, ensure_ascii=False, sort_keys=True, indent=2) + "\n")
    return report

def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--repo-root", type=Path, default=Path(__file__).resolve().parents[1])
    parser.add_argument("--output", type=Path, default=OUTPUT)
    args = parser.parse_args()
    report = generate(args.repo_root.resolve(), args.output)
    print(f"frontend_m4={report['status']} smoke={report['checks']['browser_smoke']['status']}")
    return 0

if __name__ == "__main__": raise SystemExit(main())