"""Apply only the two reviewed source patches; no commit, sync or live action."""
from pathlib import Path
import hashlib
import json
import subprocess
from datetime import datetime, timezone

ROOT = Path(__file__).resolve().parent
TARGETS = (
    ("railiance-platform", "protected-execution", "platform-cleanup.patch",
     "be8de4975980e4b88b37ed98d3fdd509d513f85834efc3a5cb744410c4e95392"),
    ("net-kingdom", "browser-case", "implementation.patch",
     "d32a7f51cbf3012bee3e4bb329f4259dea867eff1c59a2b01a65d72774488d05"),
)


def digest(path):
    return hashlib.sha256(path.read_bytes()).hexdigest()


def main():
    prepared = []
    for repo, part, patch_name, expected_patch in TARGETS:
        checkout = Path("/home/worsch") / repo
        patch = ROOT / part / patch_name
        manifest = json.loads((patch.parent / "manifest.json").read_text())
        if digest(patch) != expected_patch:
            raise SystemExit(f"reviewed patch changed: {repo}")
        head = subprocess.check_output(["git", "-C", str(checkout), "rev-parse", "HEAD"], text=True).strip()
        if head != manifest["base_commit"]:
            raise SystemExit(f"owner revision changed: {repo}")
        files = manifest.get("files_sha256", manifest.get("files"))
        dirty = subprocess.check_output(["git", "-C", str(checkout), "diff", "HEAD", "--", *files])
        if dirty:
            raise SystemExit(f"targeted owner files contain independent changes: {repo}")
        subprocess.run(["git", "-C", str(checkout), "apply", "--check", str(patch)], check=True)
        prepared.append((repo, checkout, patch, files, expected_patch, head))
    for repo, checkout, patch, files, patch_hash, head in prepared:
        subprocess.run(["git", "-C", str(checkout), "apply", str(patch)], check=True)
        for name, expected in files.items():
            if digest(checkout / name) != expected.removeprefix("sha256:"):
                raise SystemExit(f"integrated file differs: {repo}/{name}")
        receipt = {"repo": repo, "base_commit": head, "patch_sha256": patch_hash,
                   "integrated_at": datetime.now(timezone.utc).isoformat(),
                   "files_sha256": files, "source_integrated": True,
                   "committed": False, "published": False, "native_accepted": False}
        (patch.parent / "canonical-integration.json").write_text(json.dumps(receipt, indent=2) + "\n")
        print(f"{repo}: exact reviewed source integrated ({len(files)} files)")


if __name__ == "__main__":
    main()