"""Approved preparation only: execute in verified hardened API pod after phase B.
stdin envelope contains only three base64-encoded hash-bound non-secret packets.
No token accepted; native module consumes its reviewed runtime source credential.
"""
import base64,hashlib,json,os,tempfile
from pathlib import Path
import sys
from reuse_surface import federation, private_source_verify as native
EXPECTED={'proposal':'7819eb51d249f5c7aff4df9fb520afcfb76603b05a4104439499102b6c20af99','disclosure':'46ac4fe49a08054cc215aade2fbaf3b36ee334520997857ed84f530b52da9d35','consent':'4a4602ad926e3af855d6ddba4731430d33e4a7432c507ba0a5193b9f43056b52'}
FEDI='dbaa40f25cc0f090143578cd1c7068cb2cb00960fafd17d5239bf8a5bac514dd'
NATIVE='c67a284091cc4dd62dca56658a14b8ea1357e2b3df1518120da4c51e0ee8d85c'
receipt={'id':'CUST81-NATIVE-RUNTIME-PROOF-R1','status':'unverified','raw_errors_or_values_emitted':False}
try:
    source_sha=hashlib.sha256(Path(federation.__file__).read_bytes()).hexdigest()
    helper_sha=hashlib.sha256(Path(native.__file__).read_bytes()).hexdigest()
    assert source_sha==FEDI and helper_sha==NATIVE
    envelope=json.loads(sys.stdin.buffer.read(1048576))
    assert set(envelope)==set(EXPECTED)
    with tempfile.TemporaryDirectory(prefix='cust81-native-packets-') as temporary:
        paths={}
        for name,digest in EXPECTED.items():
            content=base64.b64decode(envelope[name],validate=True)
            assert hashlib.sha256(content).hexdigest()==digest
            p=Path(temporary)/(name+'.json');p.write_bytes(content);p.chmod(0o600);paths[name]=p
        sources=list(native._prepared_sources(paths['proposal'],paths['disclosure'],paths['consent']))
        expected_urls={native._raw_url(source['repo'],source['consented_commit'],path) for source,files in sources for path in files}
        allow=json.loads(os.environ.get('REUSE_SURFACE_AUTH_SOURCE_ALLOWLIST','{}'))
        assert set(allow)=={native.AUTH_ENV} and len(allow[native.AUTH_ENV])==14 and set(allow[native.AUTH_ENV])==expected_urls
        # Presence only: never print/read the secret value here. Native acquisition
        # is subsequently performed only at its reviewed exact URL routing boundary.
        key_present=native.AUTH_ENV in os.environ
        assert key_present
        result=native.verify(paths['proposal'],paths['disclosure'],paths['consent'])
        receipt.update(source_sha256=source_sha,helper_sha256=helper_sha,packet_sha256=EXPECTED,runtime_allowlist_exact14=True,reader_key_present=True,native_fetch=result,status='verified' if result['all_verified'] else 'native_fetch_failed')
except Exception:
    receipt.update(status='runtime_or_native_proof_refused',error='hash_scope_or_native_validation_failed')
print(json.dumps(receipt,sort_keys=True))
raise SystemExit(0 if receipt['status']=='verified' else 1)