package persistence

import (
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"fmt"
)

// PermissionStateSchemaFingerprint returns the canonical managed-catalog
// fingerprint that compatible reader and writer images advertise. The same
// catalog definition drives bootstrap and exact readiness verification.
func PermissionStateSchemaFingerprint() (string, error) {
	definition, err := permissionStateTableDefinition()
	if err != nil {
		return "", err
	}
	canonical, err := json.Marshal(definition)
	if err != nil {
		return "", fmt.Errorf("permission state: encode schema fingerprint: %w", err)
	}
	sum := sha256.Sum256(canonical)
	return "sha256:" + hex.EncodeToString(sum[:]), nil
}