#!/usr/bin/env bash
set -euo pipefail

model_file=${1:?usage: validate-model-file <file> <sha256-or-empty> <expected-bytes-or-empty>}
expected_sha=${2-}
expected_bytes=${3-}

test -f "$model_file" || { printf 'model file not found: %s\n' "$model_file" >&2; exit 2; }

if [ -n "$expected_sha" ]; then
  if command -v sha256sum >/dev/null 2>&1; then
    hash_line=$(sha256sum "$model_file")
  else
    hash_line=$(shasum -a 256 "$model_file")
  fi
  actual_sha=${hash_line%% *}
  [ "$actual_sha" = "$expected_sha" ] || { printf 'SHA-256 mismatch\n' >&2; exit 1; }
fi

if [ -n "$expected_bytes" ]; then
  actual_bytes=$(wc -c < "$model_file")
  actual_bytes=${actual_bytes//[[:space:]]/}
  [ "$actual_bytes" = "$expected_bytes" ] || { printf 'byte-size mismatch\n' >&2; exit 1; }
fi

printf 'model integrity checks passed\n'