param([string]$BundleRoot=(Join-Path $PSScriptRoot '..\artifacts\P_Rec_Annot.bundle'))
$ErrorActionPreference='Stop'
$package=Join-Path $BundleRoot 'PackageContents.xml'
[xml]$xml=Get-Content -LiteralPath $package
$entry=$xml.ApplicationPackage.Components.ComponentEntry
if(@($entry).Count -ne 1){throw 'Bundle must have exactly one entry assembly.'}
if($entry.ModuleName -match '_netload|OrthoLoader|Settings.xml'){throw 'Legacy loading chain is forbidden.'}
if($entry.ModuleName -notmatch 'PRecAnnot\.Plant3D2026\.dll'){throw 'Unexpected entry assembly.'}
if(-not (Test-Path (Join-Path $BundleRoot 'Contents\Windows\PRecAnnot.Plant3D2026.dll'))){throw 'Entry assembly is missing.'}
$moduleManifestPath=Join-Path $BundleRoot 'Contents\module-manifest.json'
if(-not (Test-Path $moduleManifestPath)){throw 'Composite module manifest is missing.'}
$moduleManifest=Get-Content $moduleManifestPath -Raw | ConvertFrom-Json
if($moduleManifest.package -ne 'P_Rec_Annot' -or $moduleManifest.version -ne $xml.ApplicationPackage.AppVersion){throw 'Composite module manifest identity/version mismatch.'}
foreach($assembly in $moduleManifest.assemblies){$path=Join-Path $BundleRoot "Contents\Windows\$($assembly.name)"; if(-not (Test-Path $path)){throw "Manifest assembly missing: $($assembly.name)"}; if((Get-FileHash $path -Algorithm SHA256).Hash.ToLowerInvariant() -ne $assembly.sha256){throw "Manifest hash mismatch: $($assembly.name)"}}
if($moduleManifest.schemaVersion -lt 2 -or @($moduleManifest.files).Count -eq 0){throw 'Complete package file manifest is missing.'}
foreach($file in $moduleManifest.files){$path=Join-Path $BundleRoot ($file.relativePath -replace '/', '\'); if(-not (Test-Path -LiteralPath $path)){throw "Manifest file missing: $($file.relativePath)"}; if((Get-FileHash $path -Algorithm SHA256).Hash.ToLowerInvariant() -ne $file.sha256){throw "Manifest hash mismatch: $($file.relativePath)"}}
$forbidden='^(AcMgd|AcDbMgd|AcCoreMgd|AdWindows|PnP.*)\.dll$'
$forbiddenFiles=Get-ChildItem $BundleRoot -Recurse -File | Where-Object { $_.Name -match $forbidden -or $_.Extension -in '.pdb','.cs' -or $_.FullName -match '\\(bin|obj)\\' }
if($forbiddenFiles){throw "Bundle contains forbidden files: $($forbiddenFiles.FullName -join ', ')"}
Write-Host 'Bundle manifest is structurally valid.'