#!/usr/bin/env python3
"""Exact, one-transition authority for an already migrated Prod baseline."""

from __future__ import annotations

import hashlib
import json
import re
from typing import Any


SCHEMA_VERSION = "ordinary-prod-migrated-baseline/v4"
SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
GIT_COMMIT_RE = re.compile(r"^[0-9a-f]{40}$")
IDENTIFIER_RE = re.compile(r"^[a-z0-9][a-z0-9._:-]{0,127}$")
COMMAND_ID_RE = re.compile(
    r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
)
PACK_PAYLOAD_HASH_RE = re.compile(r"^nexus-pack-sha256-v1:[0-9a-f]{64}$")

TOP_LEVEL_KEYS = {
    "schema_version",
    "migration_id",
    "active",
    "candidate",
    "database",
    "evidence",
    "receipt_sha256",
}
ACTIVE_KEYS = {"release_tag", "tag_target_commit"}
CANDIDATE_KEYS = {
    "release_tag",
    "tag_target_commit",
    "contract_sha256",
    "shared_state_digest",
    "final_pack_hash",
}
DATABASE_KEYS = {"installed_packs"}
INSTALLED_PACK_KEYS = {
    "name",
    "source_revision",
    "desired_payload_hash",
    "applied_payload_hash",
}
EVIDENCE_KEYS = {
    "migration_command_id",
    "verification_command_id",
    "preflight_plan_sha256",
    "rehearsal_evidence_sha256",
    "source_reader_stop_command_id",
    "zero_nonterminal_workitems_command_id",
}


def _canonical_json(value: object) -> bytes:
    return json.dumps(
        value,
        ensure_ascii=True,
        separators=(",", ":"),
        sort_keys=True,
    ).encode("utf-8")


def _sha256(value: bytes) -> str:
    return hashlib.sha256(value).hexdigest()


def _require_keys(value: object, expected: set[str], label: str) -> dict[str, Any]:
    if not isinstance(value, dict) or set(value) != expected:
        raise ValueError(f"{label} has unexpected or missing fields")
    return value


def _require_string(value: object, label: str) -> str:
    normalized = str(value).strip()
    if not normalized:
        raise ValueError(f"{label} is required")
    return normalized


def _require_match(value: object, pattern: re.Pattern[str], label: str) -> str:
    normalized = _require_string(value, label).lower()
    if not pattern.fullmatch(normalized):
        raise ValueError(f"{label} is invalid")
    return normalized


def build_migrated_baseline_receipt(
    *,
    migration_id: str,
    active_release_tag: str,
    active_tag_target_commit: str,
    candidate_release_tag: str,
    candidate_tag_target_commit: str,
    candidate_contract_sha256: str,
    candidate_shared_state_digest: str,
    candidate_final_pack_hash: str,
    installed_packs: list[dict[str, str]],
    migration_command_id: str,
    verification_command_id: str,
    preflight_plan_sha256: str,
    rehearsal_evidence_sha256: str,
    source_reader_stop_command_id: str,
    zero_nonterminal_workitems_command_id: str,
) -> dict[str, Any]:
    receipt: dict[str, Any] = {
        "schema_version": SCHEMA_VERSION,
        "migration_id": migration_id.strip(),
        "active": {
            "release_tag": active_release_tag.strip(),
            "tag_target_commit": active_tag_target_commit.strip(),
        },
        "candidate": {
            "release_tag": candidate_release_tag.strip(),
            "tag_target_commit": candidate_tag_target_commit.strip(),
            "contract_sha256": candidate_contract_sha256.strip(),
            "shared_state_digest": candidate_shared_state_digest.strip(),
            "final_pack_hash": candidate_final_pack_hash.strip(),
        },
        "database": {
            "installed_packs": installed_packs,
        },
        "evidence": {
            "migration_command_id": migration_command_id.strip(),
            "verification_command_id": verification_command_id.strip(),
            "preflight_plan_sha256": preflight_plan_sha256.strip(),
            "rehearsal_evidence_sha256": rehearsal_evidence_sha256.strip(),
            "source_reader_stop_command_id": (
                source_reader_stop_command_id.strip()
            ),
            "zero_nonterminal_workitems_command_id": (
                zero_nonterminal_workitems_command_id.strip()
            ),
        },
    }
    receipt["receipt_sha256"] = _sha256(_canonical_json(receipt))
    return require_migrated_baseline_receipt(receipt)


def require_migrated_baseline_receipt(value: object) -> dict[str, Any]:
    receipt = _require_keys(value, TOP_LEVEL_KEYS, "migrated Prod baseline receipt")
    if receipt.get("schema_version") != SCHEMA_VERSION:
        raise ValueError("migrated Prod baseline receipt schema_version is unsupported")
    _require_match(
        receipt.get("migration_id"),
        IDENTIFIER_RE,
        "migrated Prod baseline receipt migration_id",
    )
    unsigned = {
        key: item for key, item in receipt.items() if key != "receipt_sha256"
    }
    if receipt.get("receipt_sha256") != _sha256(_canonical_json(unsigned)):
        raise ValueError("migrated Prod baseline receipt_sha256 mismatch")

    active = _require_keys(receipt.get("active"), ACTIVE_KEYS, "active identity")
    candidate = _require_keys(
        receipt.get("candidate"),
        CANDIDATE_KEYS,
        "candidate identity",
    )
    database = _require_keys(
        receipt.get("database"),
        DATABASE_KEYS,
        "database proof",
    )
    evidence = _require_keys(
        receipt.get("evidence"),
        EVIDENCE_KEYS,
        "migration evidence",
    )

    _require_string(active.get("release_tag"), "active.release_tag")
    _require_match(
        active.get("tag_target_commit"),
        GIT_COMMIT_RE,
        "active.tag_target_commit",
    )
    _require_string(candidate.get("release_tag"), "candidate.release_tag")
    _require_match(
        candidate.get("tag_target_commit"),
        GIT_COMMIT_RE,
        "candidate.tag_target_commit",
    )
    for key in ("contract_sha256", "shared_state_digest", "final_pack_hash"):
        _require_match(candidate.get(key), SHA256_RE, f"candidate.{key}")

    installed_packs = database.get("installed_packs")
    if not isinstance(installed_packs, list) or not installed_packs:
        raise ValueError("database.installed_packs must be a non-empty list")
    pack_names: list[str] = []
    for index, raw_pack in enumerate(installed_packs):
        pack = _require_keys(
            raw_pack,
            INSTALLED_PACK_KEYS,
            f"database.installed_packs[{index}]",
        )
        pack_name = _require_match(
            pack.get("name"),
            IDENTIFIER_RE,
            f"database.installed_packs[{index}].name",
        )
        pack_names.append(pack_name)
        _require_match(
            pack.get("source_revision"),
            GIT_COMMIT_RE,
            f"database.installed_packs[{index}].source_revision",
        )
        desired_payload_hash = _require_match(
            pack.get("desired_payload_hash"),
            PACK_PAYLOAD_HASH_RE,
            f"database.installed_packs[{index}].desired_payload_hash",
        )
        applied_payload_hash = _require_match(
            pack.get("applied_payload_hash"),
            PACK_PAYLOAD_HASH_RE,
            f"database.installed_packs[{index}].applied_payload_hash",
        )
        if desired_payload_hash != applied_payload_hash:
            raise ValueError(
                "migrated Prod baseline pack payload hashes do not match"
            )
    if pack_names != sorted(set(pack_names)):
        raise ValueError(
            "database.installed_packs must be unique and sorted by name"
        )

    for key in (
        "migration_command_id",
        "verification_command_id",
        "source_reader_stop_command_id",
        "zero_nonterminal_workitems_command_id",
    ):
        _require_match(evidence.get(key), COMMAND_ID_RE, f"evidence.{key}")
    for key in ("preflight_plan_sha256", "rehearsal_evidence_sha256"):
        _require_match(evidence.get(key), SHA256_RE, f"evidence.{key}")
    return json.loads(json.dumps(receipt))


def require_bound_migrated_baseline_receipt(
    value: object,
    *,
    baseline_transition: dict[str, Any],
    expected_final_pack_hash: str,
    allow_baseline_match: bool = False,
) -> dict[str, Any]:
    receipt = require_migrated_baseline_receipt(value)
    allowed_statuses = {"mismatch"}
    if allow_baseline_match:
        allowed_statuses.add("match")
    if baseline_transition.get("status") not in allowed_statuses:
        raise ValueError(
            "migrated Prod baseline authority requires an allowed baseline transition"
        )
    active = baseline_transition["active"]
    candidate = baseline_transition["candidate"]
    expected_active = {
        "release_tag": str(active["release_tag"]),
        "tag_target_commit": str(active["tag_target_commit"]),
    }
    expected_candidate = {
        "release_tag": str(candidate["release_tag"]),
        "tag_target_commit": str(candidate["tag_target_commit"]),
        "contract_sha256": str(candidate["contract_sha256"]),
        "shared_state_digest": str(candidate["shared_state_digest"]),
        "final_pack_hash": _require_match(
            expected_final_pack_hash,
            SHA256_RE,
            "expected_final_pack_hash",
        ),
    }
    if receipt["active"] != expected_active:
        raise ValueError(
            "migrated Prod baseline receipt is not bound to the exact active release"
        )
    if receipt["candidate"] != expected_candidate:
        raise ValueError(
            "migrated Prod baseline receipt is not bound to the exact candidate"
        )
    return receipt