#!/usr/bin/env bash
set -Eeuo pipefail

[[ $# == 2 ]] || { echo 'usage: provision-jd-chengyan-pncc-slot.sh <persona-source-dir> <source-commit>' >&2; exit 64; }

source_dir=$(cd "$1" && pwd -P)
source_commit=$2
readonly node_id=JD-FD-PRIMARY
readonly instance_id=f3d4b730-7f02-452f-975b-7091a4800431
readonly persona_id=ICE-P-CY0903
readonly destination=/var/lib/guanghu/personas/ICE-P-CY0903/pncc/repository
readonly receipt_root=/guanghu/recovery/JD-FD-PRIMARY-chengyan-pncc-20260904
readonly runtime=/usr/local/libexec/guanghu/pncc-runtime.mjs

[[ $source_commit =~ ^[0-9a-f]{40}$ ]]
[[ $(tr A-F a-f </sys/class/dmi/id/product_uuid | tr -d '\r\n') == "$instance_id" ]]
[[ -d $source_dir && ! -L $source_dir ]]
[[ -f $source_dir/.hololake/persona/manifest.json && ! -L $source_dir/.hololake/persona/manifest.json ]]
[[ -f $runtime && ! -L $runtime ]]
grep -Fq '"personaId": "ICE-P-CY0903"' "$source_dir/.hololake/persona/manifest.json"
grep -Fq 'primaryNode": "JD-FD-PRIMARY"' "$source_dir/.hololake/persona/manifest.json"

install -d -o guanghu -g guanghu -m 0700 "$receipt_root"
if [[ -e $destination ]]; then
  [[ -d $destination && ! -L $destination ]]
  diff -qr --exclude=.git "$source_dir" "$destination" >/dev/null
else
  install -d -o guanghu -g guanghu -m 0700 "$destination"
  cp -a "$source_dir"/. "$destination"/
  find "$destination" -type d -exec chmod 0700 {} +
  find "$destination" -type f -exec chmod 0600 {} +
  chown -R guanghu:guanghu "$destination"

  runuser -u guanghu -- git -C "$destination" init -q
  runuser -u guanghu -- git -C "$destination" config user.name '澄言 / ICE-P-CY0903'
  runuser -u guanghu -- git -C "$destination" config user.email 'ice-p-cy0903@persona.hololake.local'
  runuser -u guanghu -- git -C "$destination" add --all
  runuser -u guanghu -- git -C "$destination" commit -q -m 'establish Chengyan PNCC source slot'
fi
head=$(runuser -u guanghu -- git -C "$destination" rev-parse HEAD)
tree=$(runuser -u guanghu -- git -C "$destination" rev-parse HEAD^{tree})
inspection=$(runuser -u guanghu -- /usr/bin/node "$runtime" inspect --repository "$destination" --node-id "$node_id")
printf '%s\n' "$inspection" | python3 -c 'import json,sys; d=json.load(sys.stdin); assert d["personaId"]=="ICE-P-CY0903" and d["state"]=="PERSONA_REPOSITORY_BOUND_CARRIER_SEPARATE"'

cat >"$receipt_root/PROVISION-RECEIPT.hldp" <<EOF
[hldp]
schema=guanghu.jd-chengyan-pncc-provision/v1
node_id=${node_id}
instance_id=${instance_id}
persona_id=${persona_id}
source_commit=${source_commit}
persona_repository_head=${head}
persona_repository_tree=${tree}
runtime_inspection=PASS
carrier_binding=UNBOUND_EVIDENCE_REQUIRED
reality_execution_allowed=false
result=PASS_100
EOF
chmod 0600 "$receipt_root/PROVISION-RECEIPT.hldp"
sha256sum "$receipt_root/PROVISION-RECEIPT.hldp" >"$receipt_root/PROVISION-RECEIPT.hldp.sha256"
printf 'CHENGYAN_PNCC_PROVISIONED head=%s tree=%s\n' "$head" "$tree"