#!/usr/bin/env bash
set -euo pipefail
if [ "${1:-}" = "--help" ] || [ "${1:-}" = "-h" ]; then
  cat <<'USAGE'
Purpose: Validate dependency-advisory-triage output. Each finding has the
         required fields and no duplicate (ecosystem,package,advisory_id).
Usage:   bash scripts/lint-output.sh <file>   (or stdin)
USAGE
  exit 0
fi
if [ "${1:-}" = "" ] || [ "${1:-}" = "-" ]; then body=$(cat)
elif [ -f "$1" ]; then body=$(cat "$1")
else printf 'error: file not found: %s\n' "$1" >&2; exit 2
fi

issues=0
say() { printf '%s\n' "$1" >&2; issues=$((issues+1)); }

grep -qE '^## Dependency Findings' <<<"$body" || say 'missing "## Dependency Findings"'

em=$'\xe2\x80\x94'
keys=$(printf '%s\n' "$body" | grep -E '^### ' | sed -E "s/^### //; s/(:[[:space:]]|[[:space:]]+${em}).*\$//")
dupes=$(printf '%s\n' "$keys" | LC_ALL=C sort | uniq -d)
[ -n "$dupes" ] && say "duplicate finding keys: $(printf '%s' "$dupes" | tr '\n' ' ')"

count=$(printf '%s\n' "$keys" | grep -c '.' || true)
for needle in 'Severity:' 'Sources:' 'Installed:' 'Remediation:'; do
  hits=$(printf '%s' "$body" | grep -cE "^- \*\*${needle}" || true)
  [ "${hits:-0}" -lt "${count:-0}" ] && say "fewer '${needle}' lines (${hits:-0}) than findings (${count:-0})"
done

[ "$issues" -gt 0 ] && exit 1
printf 'ok\n'