"""Build a nonsecret target-side authorization support package, without altering r2."""
import hashlib
import io
import json
from pathlib import Path
import subprocess
import sys
import zipfile

sys.dont_write_bytecode = True
ROOT = Path(__file__).resolve().parents[1]
OUT = ROOT / 'docs/ksf-enterprise-auth-support-20261110-r1'
NAME = OUT.name
sha = lambda b: hashlib.sha256(b).hexdigest()
encode = lambda v: (json.dumps(v, ensure_ascii=False, indent=2) + '\n').encode()


def main():
    if OUT.exists():
        raise ValueError('NEW_RELEASE_DIRECTORY_REQUIRED')
    validation = json.loads((ROOT / 'work/enterprise-workshop-20261110/validation-auth-r1.json').read_bytes())
    assert validation['ok'] and validation['testsRun'] == 50
    names = ['common.mjs', 'export-recipient.mjs', 'install.mjs', 'decrypt-envelope.mjs', 'README.md']
    files = {n: (ROOT / 'scripts/enterprise-auth' / n).read_bytes() for n in names}
    for n in names:
        if n.endswith('.mjs'):
            result = subprocess.run(['node', '--check', str(ROOT / 'scripts/enterprise-auth' / n)], capture_output=True)
            assert result.returncode == 0, 'JAVASCRIPT_CHECK_FAILED'
    files['validation.json'] = encode(validation)
    files['source-info.json'] = encode({
        'schema': 'ksf.enterprise-workshop-auth-support-source.v1',
        'targetContainer': 'agent-node-kangshifu', 'targetHost': '6f03725e5dc8',
        'companyObjectId': 'FKieRbIoGt', 'appId': 'FKieRbIoGt_main',
        'configurationRepositoryCommitPreserved': '262151d448482f940938ae234505276a60f4c58b',
        'wrapperSha256': sha((ROOT / 'skills/ksf-workshop-runtime/scripts/ksf-secure.mjs').read_bytes()),
        'adminIssuerIncluded': False, 'credentialsIncluded': False,
        'credentialIssuedInProduction': False, 'productionBindingInstalled': False,
    })
    files['FILES.sha256'] = ''.join(sha(raw) + '  ' + n + '\n' for n, raw in sorted(files.items())).encode()
    for n, raw in files.items():
        dest = OUT / 'package' / n
        dest.parent.mkdir(parents=True, exist_ok=True)
        dest.write_bytes(raw)
    stream = io.BytesIO()
    with zipfile.ZipFile(stream, 'w', zipfile.ZIP_DEFLATED) as z:
        for name, raw in sorted(files.items()):
            entry = zipfile.ZipInfo(name, (2026, 11, 10, 0, 0, 0))
            entry.external_attr = 0o100644 << 16
            z.writestr(entry, raw, compress_type=zipfile.ZIP_DEFLATED)
    archive = stream.getvalue()
    (OUT / (NAME + '.zip')).write_bytes(archive)
    release = {'release': NAME, 'archive': NAME + '.zip', 'bytes': len(archive), 'sha256': sha(archive),
               'files': len(files), 'manifestEntries': len(files) - 1, 'credentialsIncluded': False,
               'skillModified': False, 'productionCredentialIssued': False, 'businessWrites': 0}
    (OUT / 'release.json').write_bytes(encode(release))
    print(json.dumps(release, ensure_ascii=False, indent=2))


if __name__ == '__main__':
    main()