"""Administrative CLI: publish a built Agent package (scripts/build_agent_package.py
output) as an AgentRelease, ready to be downloaded/enrolled from the panel.

Like register_agent.py, this is a one-time, operator-run action against
DATABASE_URL directly — never a browser upload endpoint, so the release
binary never has to pass through an HTTP request body. The zip is copied
into the Hub's local release storage (AGENT_RELEASE_STORAGE_PATH), never
into PostgreSQL; only its metadata (version, sha256, size, path) is a row.

Usage:
    python central/scripts/publish_agent_release.py --zip dist/GTIFiscalAgent-1.0.0.zip \\
        --notes "First distributable build with secure enrollment"

Refuses to publish the same version+platform+architecture twice with a
different sha256 (an accidental respin must get a new version). Publishing
the exact same bytes again is a no-op (idempotent).
"""
import argparse
import hashlib
import sys
from datetime import datetime, timezone
from pathlib import Path

ROOT = Path(__file__).resolve().parents[2]
sys.path.insert(0, str(ROOT / "central"))

from sqlalchemy.orm import Session  # noqa: E402

from app import release_storage  # noqa: E402
from app.db import engine  # noqa: E402
from app.models import AgentRelease  # noqa: E402


def publish(session, zip_path: Path, *, platform="windows", architecture="x64", notes=None, created_by=None, version=None):
    data = zip_path.read_bytes()
    digest = hashlib.sha256(data).hexdigest()
    version = version or _version_from_manifest(zip_path)
    existing = session.query(AgentRelease).filter_by(version=version, platform=platform, architecture=architecture).one_or_none()
    if existing:
        if existing.sha256 == digest:
            return existing, False  # identical content already published: idempotent no-op
        raise SystemExit(f"refused: {version}/{platform}/{architecture} is already published with a different sha256 "
                          f"({existing.sha256[:12]}... != {digest[:12]}...) — bump the version instead of overwriting it")
    filename = release_storage.release_filename(version, platform, architecture)
    dest = release_storage.storage_root() / filename
    dest.write_bytes(data)
    release = AgentRelease(version=version, platform=platform, architecture=architecture, filename=filename,
                            size_bytes=len(data), sha256=digest, storage_path=filename, status="PUBLISHED",
                            published_at=datetime.now(timezone.utc),
                            release_notes=notes, created_by=created_by)
    session.add(release)
    session.commit()
    return release, True


def _version_from_manifest(zip_path: Path) -> str:
    # The package name is `GTIFiscalAgent-<version>.zip`; avoids depending on
    # zip internals just to learn the version this script itself is publishing.
    stem = zip_path.stem
    prefix = "GTIFiscalAgent-"
    if not stem.startswith(prefix):
        raise SystemExit(f"cannot infer version from filename {zip_path.name!r} — pass --version explicitly")
    return stem[len(prefix):]


def main():
    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
    parser.add_argument("--zip", required=True, type=Path, help="Path to the built package zip (scripts/build_agent_package.py output)")
    parser.add_argument("--version", default=None, help="Override the version instead of inferring it from the filename")
    parser.add_argument("--platform", default="windows")
    parser.add_argument("--architecture", default="x64")
    parser.add_argument("--notes", default=None, help="Release notes shown in the panel")
    args = parser.parse_args()

    if not args.zip.exists():
        raise SystemExit(f"not found: {args.zip}")

    with Session(engine) as session:
        release, created = publish(session, args.zip, platform=args.platform, architecture=args.architecture, notes=args.notes, version=args.version)
        print(f"{'published' if created else 'already published (idempotent)'}: version={release.version} "
              f"platform={release.platform} architecture={release.architecture} sha256={release.sha256} size_bytes={release.size_bytes}")


if __name__ == "__main__":
    main()