#!/usr/bin/env python3
"""GCP-staging entry point over the unchanged shared Cloud SQL bridge."""

from __future__ import annotations

import hashlib
import importlib.util
import json
import stat
import sys
from pathlib import Path
from types import ModuleType
from typing import Any

RUNTIME_IDENTITY_SCHEMA = "livingip.leocleanGcpRuntimeIdentity.v1"
STAGING_SERVICE_ACCOUNT = "sa-teleo-staging-vm@teleo-501523.iam.gserviceaccount.com"
HERE = Path(__file__).resolve().parent


def _load_sibling(name: str, filename: str) -> ModuleType:
    path = HERE / filename
    if path.is_symlink() or not path.is_file():
        raise SystemExit(f"Bound runtime module was unavailable: {filename}.")
    spec = importlib.util.spec_from_file_location(name, path)
    if spec is None or spec.loader is None:
        raise SystemExit(f"Bound runtime module was unavailable: {filename}.")
    module = importlib.util.module_from_spec(spec)
    sys.modules[name] = module
    spec.loader.exec_module(module)
    return module


cloudsql = _load_sibling("livingip_cloudsql_memory_base", "cloudsql_memory_base.py")
contracts = _load_sibling("livingip_operational_contracts", "operational_contracts.py")
_BASE_QUERY_ROWS = cloudsql.query_rows
_BASE_PARSE_ARGS = cloudsql.parse_args


def _parse_runtime_identity(body: bytes) -> str:
    def reject_duplicates(pairs: list[tuple[str, Any]]) -> dict[str, Any]:
        value: dict[str, Any] = {}
        for key, item in pairs:
            if key in value:
                raise ValueError("duplicate key")
            value[key] = item
        return value

    try:
        value = json.loads(body, object_pairs_hook=reject_duplicates)
    except (UnicodeDecodeError, ValueError):
        raise SystemExit("Runtime identity manifest was invalid.") from None
    if value != {
        "expected_service_account": STAGING_SERVICE_ACCOUNT,
        "schema": RUNTIME_IDENTITY_SCHEMA,
    }:
        raise SystemExit("Runtime identity manifest was invalid.")
    return STAGING_SERVICE_ACCOUNT


def expected_runtime_service_account(path: Path | None = None) -> str:
    """Read the exact root-controlled staging identity bound beside this tool."""

    identity_path = path or (HERE / "gcp-runtime-identity.json")
    try:
        if identity_path.is_symlink():
            raise OSError
        resolved = identity_path.resolve(strict=True)
        if resolved != identity_path or not resolved.is_file():
            raise OSError
        metadata = resolved.stat()
        if metadata.st_uid != 0 or stat.S_IMODE(metadata.st_mode) != 0o644:
            raise OSError
        body = resolved.read_bytes()
    except OSError:
        raise SystemExit("Runtime identity manifest was invalid.") from None
    if not body or len(body) > 1024:
        raise SystemExit("Runtime identity manifest was invalid.")
    return _parse_runtime_identity(body)


def _parse_args() -> Any:
    """Consume bounded contextual-retrieval flags before the shared parser."""

    filtered = [sys.argv[0]]
    retrieval_query: str | None = None
    retrieval_anchors: list[str] = []
    arguments = iter(sys.argv[1:])
    for argument in arguments:
        if argument == "--retrieval-query":
            if retrieval_query is not None:
                raise SystemExit("Only one retrieval query is allowed.")
            retrieval_query = next(arguments, None)
            if retrieval_query is None:
                raise SystemExit("Retrieval query value is required.")
            continue
        if argument.startswith("--retrieval-query="):
            if retrieval_query is not None:
                raise SystemExit("Only one retrieval query is allowed.")
            retrieval_query = argument.split("=", 1)[1]
            continue
        if argument == "--retrieval-anchor":
            anchor = next(arguments, None)
            if anchor is None:
                raise SystemExit("Retrieval anchor value is required.")
            retrieval_anchors.append(anchor)
            continue
        if argument.startswith("--retrieval-anchor="):
            retrieval_anchors.append(argument.split("=", 1)[1])
            continue
        filtered.append(argument)
    if retrieval_query is not None and (not retrieval_query.strip() or len(retrieval_query) > 16_000):
        raise SystemExit("Retrieval query was invalid.")
    if len(retrieval_anchors) > 4 or any(not item.strip() or len(item) > 120 for item in retrieval_anchors):
        raise SystemExit("Retrieval anchors were invalid.")
    original = sys.argv
    try:
        sys.argv = filtered
        parsed = _BASE_PARSE_ARGS()
    finally:
        sys.argv = original
    parsed.retrieval_query = retrieval_query
    parsed.retrieval_anchor = retrieval_anchors
    return parsed


def _claim_mentions_anchor(claim: dict[str, Any], anchors: list[str]) -> bool:
    haystack = " ".join([str(claim.get("text") or ""), *(str(item) for item in claim.get("tags") or [])]).casefold()
    return any(anchor.casefold() in haystack for anchor in anchors)


def _merge_anchor_backfill(
    primary: dict[str, Any],
    anchor_result: dict[str, Any],
    *,
    anchors: list[str],
    limit: int,
) -> dict[str, Any]:
    primary_claims = list(primary.get("claims") or [])
    if any(_claim_mentions_anchor(claim, anchors) for claim in primary_claims):
        return primary
    primary_ids = {str(claim.get("id") or "") for claim in primary_claims}
    backfill = [
        claim for claim in list(anchor_result.get("claims") or []) if str(claim.get("id") or "") not in primary_ids
    ][: max(1, min(2, limit))]
    if not backfill:
        return primary
    claims = (backfill + primary_claims)[:limit]
    context_rows = list(primary.get("context_rows") or [])
    include_private = str(primary.get("privacy") or "").startswith("private agent context mode")
    claim_hits = []
    for claim in claims:
        hit = {
            "source_table": "public.claims",
            "row_id": claim.get("id"),
            "score": claim.get("score"),
            "claim_type": claim.get("type"),
            "claim_status": claim.get("status"),
            "confidence": claim.get("confidence"),
            "tags": claim.get("tags") or [],
            "evidence_count": claim.get("evidence_count"),
            "edge_count": claim.get("edge_count"),
        }
        if include_private:
            hit["excerpt"] = claim.get("text")
        claim_hits.append(hit)
    context_hits = [hit for hit in list(primary.get("hits") or []) if hit.get("source_table") != "public.claims"]
    merged = dict(primary)
    merged["claims"] = claims
    merged["hits"] = claim_hits + context_hits
    merged["hit_count_total"] = len(claims) + len(context_rows)
    return merged


def _enrich_context(args: Any, query: str, result: dict[str, Any]) -> dict[str, Any]:
    """Attach current-main response contracts to the real Cloud SQL rows."""

    operational_contracts = contracts.operational_contracts(query)
    claims = result.get("claims")
    if not isinstance(claims, list) or not all(isinstance(item, dict) for item in claims):
        raise SystemExit("Cloud SQL context returned an invalid claims payload.")
    evidence = {str(claim.get("id") or ""): list(claim.get("evidence") or []) for claim in claims if claim.get("id")}
    contracts.bind_claim_evidence_challenge(operational_contracts, claims, evidence)
    enriched = dict(result)
    enriched["operational_contracts"] = operational_contracts
    enriched["compiled_response"] = contracts.compile_operational_response(operational_contracts)
    enriched["runtime_contract_mode"] = contracts.classify_contract_mode(query)
    return enriched


def _query_rows(args: Any, query: str, limit: int) -> dict[str, Any]:
    retrieval_query = str(getattr(args, "retrieval_query", None) or query)
    retrieval_anchors = list(getattr(args, "retrieval_anchor", None) or [])
    result = _BASE_QUERY_ROWS(args, retrieval_query, limit)
    if getattr(args, "command", None) == "context" and retrieval_anchors:
        anchor_result = _BASE_QUERY_ROWS(args, " ".join(retrieval_anchors), max(1, min(2, limit)))
        result = _merge_anchor_backfill(result, anchor_result, anchors=retrieval_anchors, limit=limit)
    result["query"] = query
    result["retrieval_query_sha256"] = hashlib.sha256(retrieval_query.encode("utf-8")).hexdigest()
    result["retrieval_anchors_sha256"] = hashlib.sha256(
        json.dumps(retrieval_anchors, sort_keys=True, separators=(",", ":")).encode("utf-8")
    ).hexdigest()
    if getattr(args, "command", None) != "context":
        return result
    return _enrich_context(args, query, result)


def main() -> None:
    cloudsql.RUNTIME_SERVICE_ACCOUNT = expected_runtime_service_account()
    cloudsql.parse_args = _parse_args
    cloudsql.query_rows = _query_rows
    cloudsql.main()


if __name__ == "__main__":
    main()
