#!/usr/bin/env bash
# verify-claims.sh (DC-170 r4) — regenerates VERIFY-OUTPUT.txt, the
# reproducible-evidence transcript backing the docs batch's version/count
# claims. Run from dashcaddy-api/ or the repo root; paths below are
# repo-root-relative and normalized. Every '$ <command>' line in
# VERIFY-OUTPUT.txt is the EXACT string executed (drift structurally
# impossible — see the emit loop), followed by stdout+stderr and the exit
# status, captured programmatically.
set -u
set -o pipefail  # a failure inside any pipeline stage fails the pipeline
cd "$(dirname "$0")/.." || exit 1
OUT="VERIFY-OUTPUT.txt"

FAILED=0
emit() { # emit "<displayed command>" then runs the SAME string
  local cmd="$1"
  echo "\$ $cmd"
  local out rc
  out=$(eval "$cmd" 2>&1)
  rc=$?
  [ -n "$out" ] && echo "$out"
  echo "[exit=$rc]"
  [ $rc -ne 0 ] && FAILED=1
  echo
}

{
  echo "# Reproducible verification — regenerated by scripts/verify-claims.sh"
  echo "# (this file: $OUT) on $(date -u '+%Y-%m-%d %H:%M:%S UTC')"
  echo "# Method (display drift): each '\$ command' line is executed verbatim; stdout+stderr and"
  echo "# the exit status are captured programmatically (see emit() above)."
  echo "# NOTES (context, not command output): dashcaddy-api/VERSION is the"
  echo "# deploy-time BUILD STAMP (the deployed commit SHA written by the"
  echo "# publish pipeline), not a semver source of truth — see"
  echo "# dashcaddy-api/src/docker/self-updater.js:123 which reads it as the"
  echo "# commit identity, and start.sh:193-205 which treats it as deployed"
  echo "# VERSION metadata. Version alignment claims refer to package.json,"
  echo "# openapi.yaml, and the README badge (all 1.17.0)."
  echo
  emit 'cat dashcaddy-api/VERSION'
  emit 'grep "version" dashcaddy-api/package.json | head -1'
  emit 'grep "version:" dashcaddy-api/openapi.yaml | head -1'
  emit 'grep "version-" README.md | head -1'
  emit "node -e 'const {APP_TEMPLATES}=require(\"./dashcaddy-api/src/docker/app-templates\"); console.log(\"templates:\", Object.keys(APP_TEMPLATES).length)'"
  emit 'cd dashcaddy-api && npx jest __tests__/self-updater-version.test.js __tests__/self-updater-isnewer.test.js --silent'
  emit 'grep -n "commit = fs.readFileSync" dashcaddy-api/src/docker/self-updater.js'
  emit 'sed -n "120,126p" dashcaddy-api/src/docker/self-updater.js'
  emit 'grep -n "VERSION METADATA\|source tree.s VERSION\|SRC_VERSION=" start.sh'
  emit 'python3 scripts/api-surface-extract.py --root "$(pwd)" --out "$(pwd)/API-SURFACE.md"'
  emit 'wc -c API-SURFACE.md'
  emit 'sha256sum API-SURFACE.md'
} > "$OUT" 2>&1
if [ $FAILED -ne 0 ]; then
  echo "[FAIL] one or more verification commands exited nonzero (see $OUT)" >&2
  exit 1
fi
echo "[ok] wrote $OUT"