$ErrorActionPreference = 'Stop'
$PSNativeCommandUseErrorActionPreference = $true
Set-Location (Split-Path -Parent $PSScriptRoot)

if (-not (Get-Command go -ErrorAction SilentlyContinue)) {
  $cachedGo = Join-Path $env:LOCALAPPDATA 'ITWorx-Pulse\toolchains\go1.26.6\bin'
  if (-not (Test-Path (Join-Path $cachedGo 'go.exe'))) { throw 'Go 1.26.6 is not available on PATH or in the recorded local toolchain cache.' }
  $env:PATH = $cachedGo + ';' + $env:PATH
}

function Invoke-Checked([string]$Label, [scriptblock]$Command) {
  Write-Host "== $Label ==" -ForegroundColor Cyan
  & $Command
  if ($LASTEXITCODE -ne 0) { throw "$Label failed with exit code $LASTEXITCODE" }
}

Invoke-Checked 'Go tests' { go test ./... }
Invoke-Checked 'Go vet' { go vet ./... }
Invoke-Checked 'Frontend install' { pnpm install --frozen-lockfile }
Invoke-Checked 'Frontend tests' { pnpm test }
Invoke-Checked 'Frontend typecheck' { pnpm typecheck }
Invoke-Checked 'Frontend lint' { pnpm lint }
Invoke-Checked 'Frontend build' { pnpm build }
Invoke-Checked 'API contract' { python tools/check_api_contract.py }
Invoke-Checked 'Schema contracts' { python tools/validate_contracts.py }
Invoke-Checked 'Production wiring' { python tools/check_wiring.py }
Invoke-Checked 'Secret markers' { python tools/check_secrets.py }
Invoke-Checked 'Image digest policy' { bash deploy/verify-image-digests.sh }

if (Test-Path -LiteralPath 'PUBLIC_SOURCE_MANIFEST.json') {
  Invoke-Checked 'Public source manifest' { node scripts/validate-public-source.mjs }
} else {
  Write-Host 'Public source manifest check skipped in canonical private checkout.' -ForegroundColor Yellow
}

Write-Host 'PUBLIC VERIFY: PASS' -ForegroundColor Green