"""Integrate reviewed source only; preserve all unrelated owner edits."""
from datetime import datetime, timezone
import hashlib
import json
from pathlib import Path
import subprocess

ROOT = Path(__file__).resolve().parent
TARGETS = (
    ("approval-engine", "approval-reference", "implementation.patch",
     "a6bf77fa8b6916f423db7832f475e38747b828dd632a88f9631131e28e3230ee",
     "9491d1d3a7b6554fa04f8dc06f65d50e3d6ee4e1", "files"),
    ("ops-mason", "mason-browser", "implementation.patch",
     "cfe7648ed119d83faca228a2f21611c9388de1ba166598cbeb64f40e81620067",
     "e4761b843cd881a672cbb33a5b451de31a61d730", "changed_source"),
    ("railiance-platform", "protected-execution-wave3", "platform-grant-projection.patch",
     "d91fdbd68b328d430e0e2b0b7f44d552095b8688ae4942d398d2e126b3648ad5",
     "4021ca5e79d3f85197b26cc20d29c55771462cf1", "files_sha256"),
    ("access-engine", "access-verifier-review", "producer-signing-r2.patch",
     "25e05b04f96cfe6f7d1abb11ab5d533b14a830c437136fc78aa381198ff8db37",
     "62ac2b4e99dec2005c7c407fe633612578a7907d", "source_files"),
)


def main():
    prepared = []
    for repo, part, filename, expected, base, files_key in TARGETS:
        owner, folder = Path("/home/worsch") / repo, ROOT / part
        patch = folder / filename
        assert hashlib.sha256(patch.read_bytes()).hexdigest() == expected, repo
        head = subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=owner, text=True).strip()
        assert head == base, f"owner revision changed: {repo}"
        manifest = "manifest-r2.json" if repo == "access-engine" else "manifest.json"
        files = json.loads((folder / manifest).read_text())[files_key]
        assert not subprocess.check_output(["git", "diff", "HEAD", "--", *files], cwd=owner), f"target files dirty: {repo}"
        for name in files:
            tracked = subprocess.run(["git", "ls-files", "--error-unmatch", name], cwd=owner, capture_output=True).returncode == 0
            assert tracked or not (owner / name).exists(), f"untracked target collision: {repo}/{name}"
        subprocess.run(["git", "apply", "--check", str(patch)], cwd=owner, check=True)
        prepared.append((repo, owner, folder, patch, expected, head, files))
    # Secrets R2 is deliberately still uncommitted after two public-ID scanner
    # false positives. Apply only the reviewed naming delta to those exact bytes.
    owner, folder = Path("/home/worsch/secrets-engine"), ROOT / "decision-auth"
    manifest = json.loads((folder / "integration-manifest-r3.json").read_text())
    patch = folder / "implementation-r3-delta.patch"
    expected = "b6c944fee615298a29dbd50ba0ad437ff76e6eab190f6168427e4ae5dbbfc59c"
    assert hashlib.sha256(patch.read_bytes()).hexdigest() == expected
    for name, hashes in manifest["files"].items():
        assert hashlib.sha256((owner / name).read_bytes()).hexdigest() == hashes["r2_sha256"], name
    subprocess.run(["git", "apply", "--check", str(patch)], cwd=owner, check=True)
    head = subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=owner, text=True).strip()
    prepared.append(("secrets-engine", owner, folder, patch, expected, head,
                     {name: hashes["r3_sha256"] for name, hashes in manifest["files"].items()}))
    for repo, owner, folder, patch, patch_hash, head, files in prepared:
        subprocess.run(["git", "apply", str(patch)], cwd=owner, check=True)
        for name, expected in files.items():
            assert hashlib.sha256((owner / name).read_bytes()).hexdigest() == expected.removeprefix("sha256:"), name
        receipt = {"repo": repo, "base_commit": head, "patch_sha256": patch_hash,
                   "integrated_at": datetime.now(timezone.utc).isoformat(), "files_sha256": files,
                   "source_integrated": True, "committed": False, "published": False,
                   "native_accepted": False}
        name = "canonical-integration-r3.json" if repo == "secrets-engine" else "canonical-integration.json"
        (folder / name).write_text(json.dumps(receipt, indent=2) + "\n")
        print(f"{repo}: {len(files)} exact reviewed source files integrated")


if __name__ == "__main__":
    main()