#!/usr/bin/env bash
# Re-vendor the BW kit from its source and rewrite the manifest: the ONE way a vendored file
# changes (plan accounts-2026-09 §4.1). Requires the kit on this machine. After a refresh, run
# check.sh: the TypeScript reference build and the conformance pack say whether the new kit fits.
set -euo pipefail
cd "$(dirname "$0")/.."
KIT=${KIT:-/srv/system/id-auth/app-auth}
[[ -d "$KIT" ]] || { echo "vendor-refresh: kit not found at $KIT"; exit 1; }
for f in bw_accounts bw_store_sqlalchemy bw_admin_api bw_view_as; do cp "$KIT/$f.py" "app/vendor/$f.py"; done
rm -rf web/src/vendor/bw-admin && cp -r "$KIT/react-admin" web/src/vendor/bw-admin
# The conformance pack rides only once tests/kit/conftest.py (the app's fixtures) exists,
# so a fresh vendoring never lands five tests that cannot yet import their contract.
if [[ -f tests/kit/conftest.py ]]; then
  for t in test_capabilities_me test_levels test_assignability test_view_as test_invites_resets; do
    cp "$KIT/app-template/main/tests/$t.py" "tests/kit/$t.py"
  done
fi
{
  for f in app/vendor/bw_accounts.py app/vendor/bw_store_sqlalchemy.py app/vendor/bw_admin_api.py app/vendor/bw_view_as.py; do sha256sum "$f"; done
  for f in web/src/vendor/bw-admin/*; do sha256sum "$f"; done
  for f in tests/kit/test_*.py; do [[ -e "$f" ]] && sha256sum "$f"; done
} > app/vendor/MANIFEST.sha256
echo "vendor-refresh: $(wc -l < app/vendor/MANIFEST.sha256) files vendored from $KIT"