"""Canonical permission and preseal artifact publisher."""

from __future__ import annotations

import hashlib
import json
from pathlib import Path

from .contract import approval_phrase
from .durable import publish_atomic
from .fdio import create_control_root
from .permission import PermissionPackage, load_permission


class SealError(RuntimeError):
    """A package cannot be sealed in the requested private roots."""


def seal(package: PermissionPackage, permission_root: Path, preseal_root: Path) -> str:
    """Publish canonical permission and independently replayable preseal receipts."""
    if permission_root.exists() or preseal_root.exists():
        raise SealError("seal roots occupied")
    create_control_root(permission_root)
    create_control_root(preseal_root)
    publish_atomic(permission_root, "package.json", package.canonical_bytes())
    loaded = load_permission(permission_root)
    if loaded != package:
        raise SealError("permission round trip")
    manifest = {
        "package_digest": package.package_digest,
        "package_sha256": hashlib.sha256(package.canonical_bytes()).hexdigest(),
        "permission_root": str(permission_root),
        "schema": "nutricoach-day-status-continuity-preseal-v1",
    }
    payload = json.dumps(manifest, sort_keys=True, separators=(",", ":")).encode() + b"\n"
    publish_atomic(preseal_root, "preseal-manifest.json", payload)
    return approval_phrase(package.package_digest)