#!/usr/bin/env python3
"""Seal reviewed package files, or check the existing seal. Never reads secrets."""
from pathlib import Path
import argparse
import hashlib
import sys

import yaml


def manifest(root):
    catalog = yaml.safe_load((root / "catalog.yaml").read_text())
    paths = [root / "catalog.yaml", root / "sources.yaml"]
    paths += sorted((root / "cards").glob("*.md"))
    paths += sorted((root / "adapters").glob("*.md"))
    return {"schema": "emergent.release.v1", "version": catalog["version"],
            "trust": "repository-reviewed-content; hashes are not signatures",
            "files": {str(p.relative_to(root)): hashlib.sha256(p.read_bytes()).hexdigest() for p in paths}}


def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--check", action="store_true")
    parser.add_argument("--bundle", type=Path, default=Path(__file__).resolve().parents[1] / "knowledge")
    args = parser.parse_args()
    expected = manifest(args.bundle)
    path = args.bundle / "release.yaml"
    if args.check:
        if not path.exists() or yaml.safe_load(path.read_text()) != expected:
            print("Release differs from reviewed files; review before resealing.")
            return 1
        print(f"Knowledge {expected['version']}: seal matches all package files.")
    else:
        path.write_text(yaml.safe_dump(expected, sort_keys=False))
        print(f"Sealed {len(expected['files'])} reviewed files; inspect the diff before release.")
    return 0


if __name__ == "__main__":
    sys.exit(main())