"""Read-only verifier for the NutriCoach V1.5 V7 sandbox-cleanup preseal."""

from __future__ import annotations

import argparse
import hashlib
import json
import sys
from pathlib import Path

from pydantic import JsonValue, TypeAdapter

sys.path.insert(0, str(Path(__file__).resolve().parents[1]))

from scripts.nutricoach_v150_detached_bootstrap import (
    verify_closure,
    verify_package_inventory,
)

_OBJECT = TypeAdapter(dict[str, JsonValue])
_PRESEAL = Path(
    "/home/cube/.hermes/migrations/nutricoach-v1.5.0-combined/"
    + "live-transaction-preseal-v7-sandbox-cleanup"
)
_SOURCE_ROOT = Path("/home/cube/projects/richard/.worktrees/nutricoach-v150-combined")
_SUPERSEDED = {
    "a362d994b41a5d05ed2fcdafc76482e72d18ff69334cd8249eec061bff733acb",
    "869c1e8f080ce79600ed7af58e0bd33db54cf316fa9aff4efe924fee15409fa5",
    "94953fed9802b406e70341bb053532095db56b2d294b9fdf8e935bf688990818",
    "d23faa5cb136290d5dbd8b75430abe6aa98526fee7ca6f11201df5e2342b587d",
    "3fbaea7e19a77a1007e27f3f0a3610a727baeeb2ab7bded1f5301a3da5872dd9",
    "cb18dad93de038d355a6feea866d89cb98be7eb990decab33d2e3154e2222f41",
    "6033ff140f60822c34e588fefffbf64c6630ea17a8c74f8aa524408b7313cd25",
    "7e2c228a757083fe2f8cebe06b03e854fb40b02fae1b18e30fd471c8d1b187ee",
}


class VerificationDenied(RuntimeError):
    """Stable sandbox-cleanup preseal integrity denial."""


def _load(path: Path) -> dict[str, JsonValue]:
    return _OBJECT.validate_json(path.read_bytes())


def _text(value: JsonValue | None, label: str) -> str:
    if not isinstance(value, str):
        raise VerificationDenied(label)
    return value


def verify() -> dict[str, JsonValue]:
    """Verify inventory, closure, verifier, package, and untouched ledger."""
    verify_package_inventory(_PRESEAL / "package-manifest.json", _PRESEAL)
    closure = verify_closure(
        _PRESEAL / "controller-source-manifest.json",
        _SOURCE_ROOT,
    )
    _ = verify_closure(_PRESEAL / "verifier-source.json", _SOURCE_ROOT)
    target = _load(_PRESEAL / "sealed-target.json")
    package_path = Path(_text(target.get("permission_package"), "package_path"))
    package_sha = hashlib.sha256(package_path.read_bytes()).hexdigest()
    if package_sha != target.get("permission_package_sha256"):
        raise VerificationDenied("permission_package")
    package = _load(package_path)
    digest = _text(package.get("package_digest"), "package_digest")
    phrase = _text(package.get("approval_phrase"), "approval_phrase")
    if digest in _SUPERSEDED or phrase != (
        f"AUTHORIZE NUTRICOACH V1.5 LIVE UPGRADE {digest}"
    ):
        raise VerificationDenied("superseded_package")
    ledger = Path(_text(target.get("global_approval_ledger"), "ledger"))
    if ledger.exists():
        raise VerificationDenied("approval_ledger_touched")
    return {
        "approval_phrase": phrase,
        "closure_digest": closure,
        "package_digest": digest,
        "package_sha256": package_sha,
        "status": "V7_SANDBOX_CLEANUP_PRESEAL_VERIFIED",
    }


def main() -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    _ = parser.add_argument("--verify", action="store_true", required=True)
    _ = parser.parse_args()
    try:
        result = verify()
    except (OSError, VerificationDenied) as exc:
        print(f"DENIED:{exc}", file=sys.stderr)
        return 2
    print(json.dumps(result, sort_keys=True, separators=(",", ":")))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())