"""Read-only verifier for the NutriCoach V1.5 V4 network-gate preseal."""

from __future__ import annotations

import argparse
import hashlib
import json
import sys
from pathlib import Path

from pydantic import JsonValue, TypeAdapter

sys.path.insert(0, str(Path(__file__).resolve().parents[1]))

from scripts.nutricoach_v150_detached_bootstrap import (
    verify_closure,
    verify_package_inventory,
)

_OBJECT = TypeAdapter(dict[str, JsonValue])
_PRESEAL = Path(
    "/home/cube/.hermes/migrations/nutricoach-v1.5.0-combined/"
    + "live-transaction-preseal-v4-network-gate"
)
_SOURCE_ROOT = Path("/home/cube/projects/richard/.worktrees/nutricoach-v150-combined")
_SUPERSEDED = {
    "a362d994b41a5d05ed2fcdafc76482e72d18ff69334cd8249eec061bff733acb",
    "869c1e8f080ce79600ed7af58e0bd33db54cf316fa9aff4efe924fee15409fa5",
    "94953fed9802b406e70341bb053532095db56b2d294b9fdf8e935bf688990818",
    "d23faa5cb136290d5dbd8b75430abe6aa98526fee7ca6f11201df5e2342b587d",
    "3fbaea7e19a77a1007e27f3f0a3610a727baeeb2ab7bded1f5301a3da5872dd9",
}


class VerificationDenied(RuntimeError):
    """Stable successor-preseal integrity denial."""


def _load(path: Path) -> dict[str, JsonValue]:
    return _OBJECT.validate_json(path.read_bytes())


def _text(value: JsonValue | None, label: str) -> str:
    if not isinstance(value, str):
        raise VerificationDenied(label)
    return value


def verify() -> dict[str, JsonValue]:
    """Verify inventory, closure, package, supersession, and ledger absence."""
    verify_package_inventory(_PRESEAL / "package-manifest.json", _PRESEAL)
    closure = verify_closure(
        _PRESEAL / "controller-source-manifest.json",
        _SOURCE_ROOT,
    )
    target = _load(_PRESEAL / "sealed-target.json")
    package_path = Path(_text(target.get("permission_package"), "package_path"))
    package_sha = hashlib.sha256(package_path.read_bytes()).hexdigest()
    if package_sha != target.get("permission_package_sha256"):
        raise VerificationDenied("permission_package")
    package = _load(package_path)
    digest = _text(package.get("package_digest"), "package_digest")
    phrase = _text(package.get("approval_phrase"), "approval_phrase")
    if digest in _SUPERSEDED or phrase != (
        f"AUTHORIZE NUTRICOACH V1.5 LIVE UPGRADE {digest}"
    ):
        raise VerificationDenied("superseded_package")
    ledger = Path(_text(target.get("global_approval_ledger"), "ledger"))
    if ledger.exists():
        raise VerificationDenied("approval_ledger_touched")
    return {
        "approval_phrase": phrase,
        "closure_digest": closure,
        "package_digest": digest,
        "package_sha256": package_sha,
        "status": "V4_NETWORK_GATE_PRESEAL_VERIFIED",
    }


def main() -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    _ = parser.add_argument("--verify", action="store_true", required=True)
    _ = parser.parse_args()
    try:
        result = verify()
    except (OSError, VerificationDenied) as exc:
        print(f"DENIED:{exc}", file=sys.stderr)
        return 2
    print(json.dumps(result, sort_keys=True, separators=(",", ":")))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())