#!/usr/bin/env python3
"""Independent replay of Alpha Covenant Holdings' accuracy check — from the outside, with nothing but public URLs.

    python3 replay.py                      # replays the latest published run against alphacovenantholdings.com
    python3 replay.py --json               # machine-readable
    python3 replay.py --base https://...   # another deployment
    FMCSA_WEBKEY=... python3 replay.py     # also replays FMCSA rows (free key: https://mobile.fmcsa.dot.gov/QCDevsite/)

Standard library only. No account, no database, no secrets. Every published check carries a `recipe` — the exact request the
platform made and the exact field it read — so this script re-issues it and compares the source's answer with the figure the
platform published. This reproduces the platform's own method; it is not an independent audit and it does not grade anyone.
"""
import argparse
import json
import os
import re
import sys
import time
import urllib.error
import urllib.parse
import urllib.request
from datetime import datetime, timezone

UA = "AlphaCovenant-replay/1 (public reproducibility script; +https://alphacovenantholdings.com/accuracy)"
RATING = {"S": "Satisfactory", "C": "Conditional", "U": "Unsatisfactory", "N": "", "": ""}


def fetch(method, url, body=None, headers=None, timeout=60):
    data = json.dumps(body).encode() if body is not None else None
    req = urllib.request.Request(url, data=data, method=method, headers={"User-Agent": UA, "Accept": "application/json", **({"Content-Type": "application/json"} if data else {}), **(headers or {})})
    try:
        with urllib.request.urlopen(req, timeout=timeout) as r:
            return r.status, json.loads(r.read().decode())
    except urllib.error.HTTPError as e:
        return e.code, None
    except Exception as e:
        return type(e).__name__, None


def pick(d, key, *alts):
    low = {k.lower(): v for k, v in d.items()}
    for n in (key, *alts):
        if n.lower() in low and low[n.lower()] not in (None, ""):
            return low[n.lower()]
    return None


def extract(recipe, j):
    kind = recipe["extract"]
    if kind == "json_path":
        cur = j
        for part in recipe["path"].split("."):
            cur = cur[part]
        return cur
    if kind == "registry_rows":
        f, s = recipe["name_field"], recipe.get("status_field")
        return sorted(f"{row.get(f)} · {row.get(s) if s else recipe.get('implied_status')}" for row in j)
    if kind == "usaspending_active":
        today = datetime.now(timezone.utc).strftime("%Y-%m-%d")
        norm = lambda s: re.sub(r"\s+", " ", re.sub(r"[^A-Z0-9 ]+", " ", (s or "").upper())).strip()  # noqa: E731
        searched = [norm(x) for x in (((recipe.get("body") or {}).get("filters") or {}).get("recipient_search_text") or []) if norm(x)]
        counted = lambda nm: not searched or any(norm(nm) == q or norm(nm).startswith(q + " ") for q in searched)  # noqa: E731
        return len([a for a in j.get("results", []) if (a.get("End Date") or "") >= today and counted(a.get("Recipient Name"))])
    c = (j.get("content") or {}).get("carrier") or {}
    if kind == "fmcsa_status":
        return "ACTIVE" if str(pick(c, "allowToOperate", "allowedToOperate")).upper() == "Y" else str(pick(c, "statusCode") or "").upper() or "NOT AUTHORIZED"
    if kind == "fmcsa_rating":
        raw = str(pick(c, "safetyRating") or "").upper()
        return RATING.get(raw, pick(c, "safetyRating") or "")
    if kind == "fmcsa_power_units":
        v = pick(c, "totalPowerUnits")
        return str(int(float(str(v).replace(",", "")))) if v not in (None, "") else "0"
    raise ValueError(f"unknown extract {kind}")


def replay_one(check):
    r = check.get("recipe")
    if not r:
        return {"replay": "no_recipe", "value": None}
    url = r["url"]
    if r.get("needs_env"):
        key = os.environ.get(r["needs_env"])
        if not key:
            return {"replay": "needs_key", "value": None, "note": f"set {r['needs_env']} to replay this row"}
        q = {k: (key if v == f"${r['needs_env']}" else v) for k, v in (r.get("query") or {}).items()}
        url = url + ("&" if "?" in url else "?") + urllib.parse.urlencode(q)
    status, j = fetch(r["method"], url, r.get("body"), r.get("headers"))
    if status == 429:
        return {"replay": "rate_limited", "value": None, "http": status}
    if status != 200 or j is None:
        return {"replay": "unavailable", "value": None, "http": status, "note": "no answer from the source (timeout or network error); try again later" if not isinstance(status, int) else f"HTTP {status}"}
    pg = r.get("paginate")
    if pg and r["extract"] == "usaspending_active":
        today = datetime.now(timezone.utc).strftime("%Y-%m-%d")
        results, page = list(j.get("results", [])), 1
        while page < pg["max_pages"] and (j.get("page_metadata") or {}).get("hasNext") and not any((a.get("End Date") or "") < today for a in j.get("results", [])):
            page += 1
            time.sleep(1)
            status, j = fetch(r["method"], url, {**r["body"], pg["field"]: page}, r.get("headers"))
            if status != 200 or j is None:
                return {"replay": "unavailable", "value": None, "http": status, "note": f"page {page} of the source failed"}
            results += j.get("results", [])
        j = {"results": results}
    try:
        val = extract(r, j)
    except Exception as e:
        return {"replay": "unavailable", "value": None, "note": f"could not read field: {e!r}"}
    ours = check.get("ours")
    same = val == ours or str(val) == str(ours)
    return {"replay": "match" if same else "differs", "value": val}


def main():
    ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
    ap.add_argument("--base", default="https://alphacovenantholdings.com")
    ap.add_argument("--json", action="store_true")
    ap.add_argument("--pause", type=float, default=1.0, help="seconds between source requests (be polite to public APIs)")
    a = ap.parse_args()
    status, pub = fetch("GET", f"{a.base.rstrip('/')}/api/public/accuracy")
    if status != 200 or not pub or not pub.get("latest_run"):
        print(f"could not load {a.base}/api/public/accuracy (HTTP {status})", file=sys.stderr)
        sys.exit(2)
    run = pub["latest_run"]
    now = datetime.now(timezone.utc)
    rows = []
    for c in run["checks"]:
        res = replay_one(c)
        pulled = c.get("our_pull_at")
        hours_since_pull = round((now - datetime.fromisoformat(pulled)).total_seconds() / 3600, 1) if pulled else None
        if res["replay"] == "differs":
            res["reading"] = ("our copy is now outside its refresh window; a difference is expected if you replay days after the check" if hours_since_pull is not None and hours_since_pull > c.get("refresh_window_hours", 24)
                              else "source changed since our pull, inside the refresh window")
        rows.append({"source": c["source"], "subject": c["subject"], "field": c["field"], "published_value": c.get("ours"), "published_result": c["result"], "checked_at": run["at"],
                     "our_pull_at": pulled, "hours_since_our_pull": hours_since_pull, **res, "source_url": c.get("source_url"), "cite": (a.base.rstrip("/") + c["cite"]) if c.get("cite") else None})
        if c.get("recipe"):
            time.sleep(a.pause)
    summary = {}
    for r in rows:
        summary[r["replay"]] = summary.get(r["replay"], 0) + 1
    out = {"base": a.base, "published_run_at": run["at"], "published_totals": run.get("totals"), "replayed_at": now.isoformat(), "summary": summary, "rows": rows,
           "what_this_is": "A re-issue of the exact public requests behind each published check, compared with the published figure. It reproduces the platform's own method from outside; it is not an independent audit and it is not a grade.",
           "how_to_read": {"match": "the source returns the figure the platform published", "differs": "the source now returns something else — see `reading`; live counters move, so a later replay legitimately drifts",
                           "rate_limited": "the source refused this anonymous request (HTTP 429); nothing can be concluded", "unavailable": "the source did not answer or the field could not be read", "needs_key": "row needs a free API key set in the environment", "no_recipe": "row carries no public recipe (e.g. a source that was not configured when the check ran)"}}
    if a.json:
        print(json.dumps(out, indent=1, default=str))
        return
    print(f"Replay of Alpha Covenant accuracy check published {run['at'][:16]} UTC — replayed {now.isoformat()[:16]} UTC\n")
    for r in rows:
        v = r["value"]
        v = f"{len(v)} rows" if isinstance(v, list) else v
        p = r["published_value"]
        p = f"{len(p)} rows" if isinstance(p, list) else p
        print(f"{r['replay']:<13} {r['source'][:34]:<34} {r['subject'][:38]:<38} {r['field'][:30]:<30} published {p!s:<12} source-now {v!s:<12} (platform said: {r['published_result']})")
        if r.get("reading") or r.get("note"):
            print(f"{'':13} ↳ {r.get('reading') or r.get('note')}")
    print("\nsummary:", ", ".join(f"{k} {v}" for k, v in sorted(summary.items())))
    print("\n" + out["what_this_is"])


if __name__ == "__main__":
    main()