"""Apply four reviewed source packages; no install, credentials or live effects."""
from datetime import datetime, timezone
import hashlib
import json
from pathlib import Path
import subprocess

ROOT = Path(__file__).resolve().parent
TARGETS = (
    ('secrets-engine', 'decision-package', 'implementation-r1.patch',
     '86179e607509d782f8a00012174c549997e0997ce4f84fc1078d245e4670a4ae',
     'c80a944105a00220cd3c1a007709e72d830dd08d', 'coordinator-file-hashes.json', None),
    ('secrets-engine', 'decision-handoff', 'implementation-r2.patch',
     '1ef8b67e2352415ddbdadc86cd151a8b6caf76628350657ed3e674aefcf49945',
     'c80a944105a00220cd3c1a007709e72d830dd08d', 'integration-manifest-r2.json', 'files'),
    ('railiance-platform', 'protected-execution-wave4', 'platform-confirmation-seam.patch',
     'f26a5e1f63f68c487930d3f076502f1bae73d16107d3be2537aeeda56e73628e',
     'd042d468df6d4085bb93a73ec26f4c4103554575', 'manifest.json', 'files_sha256'),
    ('approval-engine', 'approval-confirmation', 'implementation.patch',
     'a2dfa6585a8b97fc6facec7b0815ffc3374869b8de51cc696d534c69643e3621',
     '8624fa20bbfb0c0329e5327b4dd8d8c05a312d7a', 'manifest.json', 'files'),
)


def main():
    prepared = []
    for repo, part, filename, expected, base, manifest_name, files_key in TARGETS:
        owner, folder = Path('/home/worsch') / repo, ROOT / part
        patch = folder / filename
        assert hashlib.sha256(patch.read_bytes()).hexdigest() == expected, repo
        head = subprocess.check_output(['git', 'rev-parse', 'HEAD'], cwd=owner, text=True).strip()
        assert head == base, f'owner HEAD changed: {repo}'
        manifest = json.loads((folder / manifest_name).read_text())
        files = manifest[files_key] if files_key else manifest
        assert not subprocess.check_output(['git', 'diff', 'HEAD', '--', *files], cwd=owner), f'target files dirty: {repo}'
        for name in files:
            tracked = subprocess.run(['git', 'ls-files', '--error-unmatch', name], cwd=owner, capture_output=True).returncode == 0
            assert tracked or not (owner / name).exists(), f'untracked target collision: {repo}/{name}'
        subprocess.run(['git', 'apply', '--check', str(patch)], cwd=owner, check=True)
        prepared.append((repo, owner, folder, patch, expected, head, files))
    for repo, owner, folder, patch, patch_hash, head, files in prepared:
        subprocess.run(['git', 'apply', str(patch)], cwd=owner, check=True)
        for name, expected in files.items():
            assert hashlib.sha256((owner / name).read_bytes()).hexdigest() == expected, name
        receipt = {'repo': repo, 'base_commit': head, 'patch_sha256': patch_hash,
                   'integrated_at': datetime.now(timezone.utc).isoformat(), 'files_sha256': files,
                   'source_integrated': True, 'committed': False, 'published': False,
                   'native_accepted': False}
        (folder / 'canonical-integration.json').write_text(json.dumps(receipt, indent=2) + '\n')
        print(f'{repo}/{folder.name}: {len(files)} reviewed files integrated')


if __name__ == '__main__':
    main()