"""Fail-closed verification of immutable deployment artifacts."""

from __future__ import annotations

import hashlib
from pathlib import Path


PROJECT_ROOT = Path(__file__).resolve().parents[1]


def _sha256(path: Path) -> str:
    digest = hashlib.sha256()
    with path.open("rb") as stream:
        for block in iter(lambda: stream.read(1024 * 1024), b""):
            digest.update(block)
    return digest.hexdigest()


def verify_artifacts(manifest: str | Path | None = None) -> dict[str, str]:
    path = Path(manifest) if manifest is not None else PROJECT_ROOT / "ARTIFACTS.sha256"
    if not path.is_file():
        raise FileNotFoundError(f"artifact manifest is missing: {path}")
    verified: dict[str, str] = {}
    for line_number, raw in enumerate(path.read_text(encoding="utf-8").splitlines(), start=1):
        line = raw.strip()
        if not line or line.startswith("#"):
            continue
        parts = line.split(maxsplit=1)
        if len(parts) != 2 or len(parts[0]) != 64:
            raise RuntimeError(f"invalid artifact manifest line {line_number}: {raw!r}")
        expected, relative = parts[0].lower(), parts[1].lstrip(" *")
        artifact = (PROJECT_ROOT / relative).resolve()
        if PROJECT_ROOT not in artifact.parents:
            raise RuntimeError(f"manifest path escapes deployment root: {relative}")
        if not artifact.is_file():
            raise FileNotFoundError(f"manifest artifact is missing: {artifact}")
        actual = _sha256(artifact)
        if actual != expected:
            raise RuntimeError(
                f"artifact hash mismatch for {relative}: expected {expected}, got {actual}"
            )
        verified[relative] = actual
    if not verified:
        raise RuntimeError("artifact manifest contains no files")
    return verified


__all__ = ["verify_artifacts"]