import { appendFileSync, readFileSync, realpathSync } from 'node:fs';
import { execFileSync } from 'node:child_process';
import { fileURLToPath } from 'node:url';

const rootDocs = new Set([
  'README.md', ...['en', 'de-DE', 'zh-CN', 'zh-TW', 'ja', 'ko', 'pt-BR', 'id'].map(locale => `README-${locale}.md`),
  'AGENTS.md', 'AGENTS.zh-CN.md', 'CLAUDE.md', 'CONTRIBUTING.md', 'CHANGELOG.md',
  'LOCAL-DATA.md', 'LOCAL-DATA.zh-CN.md', 'ARCHITECTURE.md', 'ARCHITECTURE-zh-CN.md',
]);
const shaPattern = /^[a-f0-9]{40}$/;
const validSha = value => typeof value === 'string' && shaPattern.test(value) && !/^0+$/.test(value);

function documentationPath(value) {
  if (typeof value !== 'string' || /[\x00-\x1f\x7f\\]/.test(value)) return false;
  const parts = value.split('/');
  if (parts.some(part => !part || part === '.' || part === '..')) return false;
  return rootDocs.has(value) || (parts[0] === 'docs' && parts.length > 1 && value.endsWith('.md'));
}

// True is the safe default: unknown paths, modes, statuses and empty diffs run UI.
export function classifyEntries(entries) {
  if (!Array.isArray(entries) || entries.length === 0) return true;
  return !entries.every(entry => entry && documentationPath(entry.path) &&
    ['A', 'M', 'D'].includes(entry.status) &&
    ['100644', '000000'].includes(entry.oldMode) && ['100644', '000000'].includes(entry.newMode) &&
    (entry.status === 'A' ? entry.oldMode === '000000' && entry.newMode === '100644' :
      entry.status === 'D' ? entry.oldMode === '100644' && entry.newMode === '000000' :
        entry.oldMode === '100644' && entry.newMode === '100644'));
}

export function parseRawDiff(raw) {
  if (typeof raw !== 'string' || !raw || !raw.endsWith('\0')) throw new Error('Unverified diff');
  const fields = raw.split('\0');
  fields.pop();
  if (fields.length % 2 !== 0) throw new Error('Incomplete raw diff');
  const entries = [];
  for (let index = 0; index < fields.length; index += 2) {
    const match = /^:(\d{6}) (\d{6}) [a-f0-9]{40} [a-f0-9]{40} ([AMD])$/.exec(fields[index]);
    if (!match || !fields[index + 1]) throw new Error('Unexpected raw diff');
    entries.push({ path: fields[index + 1], oldMode: match[1], newMode: match[2], status: match[3] });
  }
  return entries;
}

export function classifyRepository({ cwd = process.cwd(), eventName, event, sha }) {
  const full = reason => ({ uiRequired: true, reason });
  try {
    if (!validSha(sha)) return full('unverified-checkout');
    const git = (...args) => execFileSync('git', args, { cwd, encoding: 'utf8',
      maxBuffer: 16 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] });
    if (git('rev-parse', 'HEAD').trim() !== sha) return full('checkout-mismatch');
    let base;
    if (eventName === 'pull_request') {
      base = event?.pull_request?.base?.sha;
      const head = event?.pull_request?.head?.sha;
      if (!validSha(base) || !validSha(head)) return full('unverified-pr-range');
      git('merge-base', '--is-ancestor', head, sha);
    } else if (eventName === 'push') {
      // A docs-only successor may cancel an unfinished runtime push under the
      // same main concurrency group. Never replace that coverage with an exemption.
      return full('push-full-verification');
    } else return full('unrecognized-event');
    // Compare the actual tested tree, not only the PR head or latest single commit.
    // --no-renames exposes both old and new paths, preventing a runtime→docs rename exemption.
    const entries = parseRawDiff(git('diff', '--raw', '-z', '--no-renames', '--no-abbrev', base, sha, '--'));
    const uiRequired = classifyEntries(entries);
    return { uiRequired, reason: uiRequired ? 'full-verification' : 'verified-documentation-only' };
  } catch { return full('unverified-diff'); }
}

export function gatePasses(scopeResult, uiRequired, shardResult) {
  return scopeResult === 'success' && ((uiRequired === 'true' && shardResult === 'success') ||
    (uiRequired === 'false' && shardResult === 'skipped'));
}

function main() {
  if (process.argv.length === 3 && process.argv[2] === '--gate') {
    const passed = gatePasses(process.env.SCOPE_RESULT, process.env.UI_REQUIRED, process.env.SHARDS_RESULT);
    console.log(passed ? 'UI gate satisfied by the verified scope and expected shard result.' : 'UI gate failed closed.');
    process.exitCode = passed ? 0 : 1;
    return;
  }
  if (process.argv.length !== 2) throw new Error('Unsupported scope arguments');
  let result;
  try {
    const event = JSON.parse(readFileSync(process.env.GITHUB_EVENT_PATH, 'utf8'));
    result = classifyRepository({ eventName: process.env.GITHUB_EVENT_NAME, event, sha: process.env.GITHUB_SHA });
  } catch { result = { uiRequired: true, reason: 'unverified-event' }; }
  console.log(`UI required: ${result.uiRequired}; ${result.reason}`);
  if (!process.env.GITHUB_OUTPUT) throw new Error('Missing output channel');
  appendFileSync(process.env.GITHUB_OUTPUT, `ui_required=${result.uiRequired}\n`);
}

if (process.argv[1] && realpathSync(process.argv[1]) === fileURLToPath(import.meta.url)) {
  try { main(); } catch (error) { console.error(error.message); process.exitCode = 1; }
}