"""Read-only WP0c authorization inventory."""
from __future__ import annotations
from dataclasses import dataclass, asdict
from pathlib import Path
import argparse, json, re

TERMS={
 "task_principal":re.compile(r"\bTaskPrincipal\b|\btask[_ -]?principal\b",re.I),
 "owner_approval":re.compile(r"\bowner[_ -]?approval\b|\bOWNER_SIGNATURE_REQUIRED\b",re.I),
 "capability":re.compile(r"\bcapabilit(?:y|ies)\b",re.I),
 "signer":re.compile(r"\bsigner\b|\bsshsig\b",re.I),
 "lease":re.compile(r"\b(?:ClaimLease|WriterLease|writer[_ -]?lease)\b",re.I),
 "authorization":re.compile(r"\bauthori[sz]ation\b",re.I),
}

def scan(repo:Path)->dict:
    repo=repo.resolve(); refs=[]
    for p in sorted(repo.rglob("*")):
        if not p.is_file() or p.suffix.lower() not in {".py",".json",".yaml",".yml",".md"}: continue
        if any(x in p.parts for x in {".git",".venv","node_modules","__pycache__"}): continue
        try: lines=p.read_text(encoding="utf-8",errors="strict").splitlines()
        except (UnicodeDecodeError,OSError): continue
        for i,line in enumerate(lines,1):
            kinds=sorted(k for k,pat in TERMS.items() if pat.search(line))
            if kinds:
                refs.append({"path":p.relative_to(repo).as_posix(),"line":i,"kinds":kinds,"excerpt":line.strip()[:240]})
    return {
      "schema_version":"aios.authorization-inventory.v1",
      "references":refs,
      "reference_count":len(refs),
      "classification":"EVIDENCE_ONLY_NOT_AUTHORITY",
      "completeness":"PARTIAL_DISCOVERY",
      "covered_scope":["lexical_authorization_references"],
      "missing_scope":[
        "owner_broker_chain",
        "taskprincipal_admission_chain",
        "claim_and_task_lease_chain",
        "writerlease_chain",
        "release_recovery_capability_chain",
        "signer_credential_provisioning_chain",
        "live_caller_and_revocation_evidence",
      ],
      "g0_exit_eligible":False,
    }

def main()->int:
    ap=argparse.ArgumentParser(); ap.add_argument("--repo",type=Path,required=True); ap.add_argument("--out",type=Path)
    ns=ap.parse_args(); result=scan(ns.repo); text=json.dumps(result,indent=2,sort_keys=True)+"\n"
    if ns.out: ns.out.write_text(text,encoding="utf-8")
    else: print(text,end="")
    return 0
if __name__=="__main__": raise SystemExit(main())