#!/usr/bin/env bash
# ADR 0055's full proof, with real sources: the native proof module (sharp 0.35.5, libvips 1.3.4) and
# its corresponding-source artifact.
#
#   bash scripts/test-corresponding-source.sh
#
# 1. Acquisition (network, first run only): every checked-in recipe's recorded source files are
#    downloaded into a verified cache, each checked against its recorded size and SHA-256. A file
#    already in the cache with the right bytes is never fetched again.
# 2. Construction and the gate (offline): the artifact is built twice from unrelated directories and
#    must be byte-identical; the public-distribution gate must approve it, and must refuse it once it
#    is removed or corrupted; sharp must still run from the verified binary package.
#
# EKKLESIA_CORRESPONDING_SOURCE_CACHE chooses the cache directory; the default is
# ${XDG_CACHE_HOME:-$HOME/.cache}/ekklesia/corresponding-sources. It is about 200 MB per recipe.
set -Eeuo pipefail

root="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$root"
cache="${EKKLESIA_CORRESPONDING_SOURCE_CACHE:-${XDG_CACHE_HOME:-$HOME/.cache}/ekklesia/corresponding-sources}"

pnpm exec turbo run build --filter=@ekklesia/module-pack... --filter=@ekklesia/core... >/dev/null

recipes="packages/module-pack/corresponding-sources"
while IFS= read -r recipe; do
  relative="${recipe#"$recipes"/}"
  relative="${relative%/recipe.json}"
  echo "==> Acquiring the recorded sources for ${relative%/*}@${relative##*/}"
  node packages/module-pack/bin/ekklesia-corresponding-source.mjs acquire \
    --recipe "${relative%/*}@${relative##*/}" --cache "$cache"
done < <(find "$recipes" -name recipe.json | LC_ALL=C sort)

echo "==> Building, gating, and running the native proof offline"
EKKLESIA_CORRESPONDING_SOURCE_CACHE="$cache" EKKLESIA_CORRESPONDING_SOURCE_REQUIRED=1 \
  pnpm --filter @ekklesia/module-pack exec vitest run tests/corresponding-source-native.test.ts