#!/usr/bin/env python3
"""Emit only the credential-free identity of the connected runtime database."""

from __future__ import annotations

import asyncio
import json
import sys
from pathlib import Path


REPO_ROOT = Path(__file__).resolve().parents[1]
API_ROOT = REPO_ROOT / "apps" / "api"
if str(API_ROOT) not in sys.path:
    sys.path.insert(0, str(API_ROOT))
if str(Path(__file__).resolve().parent) not in sys.path:
    sys.path.insert(0, str(Path(__file__).resolve().parent))

from app.config import settings  # noqa: E402
from public_runtime_database_identity import (  # noqa: E402
    connected_database_target_sha256,
)


async def _probe() -> str:
    import asyncpg

    connection = await asyncpg.connect(
        settings.database_url,
        command_timeout=settings.db_command_timeout,
    )
    try:
        return await connected_database_target_sha256(connection)
    finally:
        await connection.close()


def main() -> int:
    try:
        digest = asyncio.run(_probe())
    except BaseException:
        print(
            json.dumps(
                {"status": "failed", "reason": "database_identity_probe_failed"},
                ensure_ascii=True,
                separators=(",", ":"),
            )
        )
        return 1
    print(
        json.dumps(
            {"status": "passed", "database_target_sha256": digest},
            ensure_ascii=True,
            separators=(",", ":"),
        )
    )
    return 0


if __name__ == "__main__":
    raise SystemExit(main())