"""Prove the FastAPI application imports cleanly with declared dependencies only.

Why this exists
---------------
``feat/kd-6b`` added ``Form(...)`` parameters to
``musehub/api/routes/musehub/ui_vault.py`` without declaring ``python-multipart``
in ``requirements.txt`` or ``pyproject.toml``. FastAPI validates form
dependencies while the route decorator runs, so the failure is an ``ImportError``
at module import — the whole app refuses to start, for every repo, not just
knowtation-domain ones (issue #169).

Importing the app is the cheapest possible proof that no route module has an
undeclared dependency or an import-time contract error. It runs without Postgres
because database work happens in the lifespan handler, not at import.

Exit codes
----------
``0``
    ``musehub.main:app`` imported. Emits ``ARTIFACT_SHA256`` over the app title,
    version, and route count for L1 evidence.
``1``
    Import failed — the app would not start.
"""

from __future__ import annotations

import hashlib
import json
import sys
import traceback


def main() -> int:
    try:
        from musehub.main import app
    except Exception:  # noqa: BLE001 — the failure text is the finding
        print("FAIL: musehub.main:app does not import", file=sys.stderr)
        traceback.print_exc()
        print(
            "\nCheck for a route using Form(...)/File(...) without python-multipart "
            "declared, or any other undeclared import-time dependency.",
            file=sys.stderr,
        )
        return 1

    identity = {
        "title": getattr(app, "title", None),
        "version": getattr(app, "version", None),
        "route_count": len(app.routes),
    }
    digest = hashlib.sha256(
        json.dumps(identity, sort_keys=True).encode("utf-8")
    ).hexdigest()
    print(f"OK: app imported ({identity['route_count']} routes)")
    print(f"ARTIFACT_SHA256={digest}")
    return 0


if __name__ == "__main__":
    sys.exit(main())