import assert from "node:assert/strict";
import crypto from "node:crypto";
import fs from "node:fs";
import path from "node:path";

const root = path.resolve(import.meta.dirname, "../../..");
const evidence = JSON.parse(fs.readFileSync(path.join(root, "tests/golden/WBV2-P1424-001/release-validation-20261021/M12-manifest-sha-drift-3.json"), "utf8"));
const sha256 = (file) => crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
assert.equal(sha256(path.join(root, evidence.previousEvidence.path)), evidence.previousEvidence.sha256);
assert.equal(sha256(path.join(root, evidence.previousObservation.path)), evidence.previousObservation.sha256);
const key = (task, artifact) => `${task}:${artifact}`;
const recorded = new Map(evidence.entries.map((entry) => [key(entry.task, entry.artifact), entry]));

export function assertLegacyManifestArtifacts(manifest) {
  const manifestPath = `tests/golden/${manifest.task}/manifest.json`;
  assert.equal(sha256(path.join(root, manifestPath)), evidence.manifestSha256[manifestPath], `${manifest.task} historical manifest changed`);
  for (const [artifact, binding] of Object.entries(manifest.artifacts ?? {})) {
    const actual = sha256(path.join(root, binding.path));
    if (actual === binding.sha256) continue;
    const entry = recorded.get(key(manifest.task, artifact));
    assert.ok(entry, `${manifest.task}:${artifact} drift is not classified`);
    assert.equal(entry.path, binding.path);
    assert.equal(entry.originalSha256, binding.sha256);
    assert.equal(entry.observedSha256, actual);
    if (entry.sourceSnapshot) {
      assert.equal(sha256(path.join(root, entry.sourceSnapshot)), binding.sha256);
      assert.equal(entry.provenanceState, "VERIFIED_HISTORICAL_BYTES");
    } else assert.equal(entry.provenanceState, "BLOCKED_SOURCE_LOST");
  }
}

export { evidence };