#!/usr/bin/env bash
set -euo pipefail

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
TMP_ENV="$(mktemp "${TMPDIR:-/tmp}/matchday-deploy-env.XXXXXX")"
trap 'rm -f "$TMP_ENV"' EXIT

cat >"$TMP_ENV" <<'ENV'
POSTGRES_PASSWORD=validation-only-password
MATCHDAY_BACKEND_SIGNING_SECRET=validation-only-signing-secret-with-32-bytes
DASHSCOPE_API_KEY=validation-only-qwen-key
MATCHDAY_PUBLIC_URL=https://example.invalid
MATCHDAY_PUBLIC_HOST=example.invalid
ENV

MATCHDAY_RELEASE=validation-commit docker compose --env-file "$TMP_ENV" \
  -f "$ROOT/deploy/alibaba/docker-compose.yml" config --quiet

if ! rg -q '^  run-worker:' "$ROOT/deploy/alibaba/docker-compose.yml"; then
  echo "Durable run-worker service is missing from the deployment manifest." >&2
  exit 1
fi

if ! rg -q 'command: \["python", "-m", "matchday\.run_worker"\]' \
  "$ROOT/deploy/alibaba/docker-compose.yml"; then
  echo "Durable run-worker service does not invoke matchday.run_worker." >&2
  exit 1
fi

for variable in \
  MATCHDAY_QWEN_TIMEOUT_SECONDS \
  MATCHDAY_SERPAPI_TIMEOUT_SECONDS \
  MATCHDAY_SERPAPI_MAX_RESULTS \
  MATCHDAY_TRAVEL_ACTION_CACHE_SECONDS \
  MATCHDAY_WEB_BLOCKED_DOMAINS \
  UNSPLASH_ACCESS_KEY \
  MATCHDAY_CONTEXT_ENABLED \
  MATCHDAY_CONTEXT_TIMEOUT_SECONDS \
  MATCHDAY_NEARBY_MAX_RESULTS \
  MATCHDAY_NEARBY_RADIUS_KM \
  MATCHDAY_FIXTURE_REFRESH_ENABLED \
  MATCHDAY_FIXTURE_REFRESH_INTERVAL_SECONDS \
  MATCHDAY_FIXTURE_STALE_SECONDS \
  MATCHDAY_FIXTURE_REFRESH_TIMEOUT_SECONDS \
  MATCHDAY_FIXTURE_REFRESH_RETRY_SECONDS \
  MATCHDAY_AGENT_MAX_STEPS \
  MATCHDAY_RUN_STALL_SECONDS \
  MATCHDAY_RUN_MAX_SECONDS \
  MATCHDAY_RUN_LEASE_SECONDS \
  MATCHDAY_RUN_MAX_ATTEMPTS \
  MATCHDAY_RUN_MAX_MODEL_TURNS \
  MATCHDAY_RUN_MAX_TOOL_CALLS \
  MATCHDAY_RUN_MAX_COST_UNITS \
  MATCHDAY_RUN_RETRY_BASE_SECONDS \
  MATCHDAY_RUN_WORKER_POLL_SECONDS \
  VIATOR_API_KEY \
  MATCHDAY_VIATOR_ACCESS_TIER \
  MATCHDAY_VIATOR_ENVIRONMENT \
  MATCHDAY_VIATOR_TIMEOUT_SECONDS \
  MATCHDAY_VIATOR_MAX_RETRIES \
  MATCHDAY_VIATOR_LOCAL_RATE_LIMIT_PER_MINUTE \
  OPENROUTESERVICE_API_KEY \
  MATCHDAY_OPENROUTESERVICE_TIMEOUT_SECONDS \
  MATCHDAY_OPENROUTESERVICE_MAX_RETRIES \
  MATCHDAY_OPENROUTESERVICE_LOCAL_RATE_LIMIT_PER_DAY \
  AMADEUS_API_KEY \
  AMADEUS_API_SECRET \
  MATCHDAY_AMADEUS_ENVIRONMENT \
  MATCHDAY_AMADEUS_TIMEOUT_SECONDS \
  MATCHDAY_AMADEUS_MAX_RETRIES \
  MATCHDAY_AMADEUS_LOCAL_RATE_LIMIT_PER_MINUTE; do
  matches="$(rg -c "^[[:space:]]+${variable}:" "$ROOT/deploy/alibaba/docker-compose.yml" || true)"
  if [ "${matches:-0}" -lt 2 ]; then
    echo "Runtime/provider variable is not forwarded to both API and run-worker: ${variable}" >&2
    exit 1
  fi
done

if rg -n 'CreateInstance|RunInstances|CreateServer|ModifyInstance|ResizeDisk' \
  "$ROOT/deploy/alibaba"; then
  echo "Billable Alibaba mutation command found in deployment automation." >&2
  exit 1
fi

echo "Deployment manifest valid; no Alibaba resource-creation command found."