"""Build explicit file-bound authorities; does not run a brain or prove a process.

The registered coordinator authenticates source/input bytes and actual exits.
All output here is a new dictionary; existing authority files are never edited.
"""
from __future__ import annotations

import copy
import hashlib
import json
from pathlib import Path

import numpy as np


def require(ok, message):
    if not ok: raise ValueError(message)


def digest(path):
    h=hashlib.sha256()
    with Path(path).open('rb') as stream:
        for block in iter(lambda:stream.read(8<<20),b''):h.update(block)
    return h.hexdigest()


def read(path):
    def unique(items):
        value={}
        for k,v in items:
            require(k not in value,'Duplicate JSON key');value[k]=v
        return value
    return json.loads(Path(path).read_text(encoding='utf-8'),object_pairs_hook=unique,
        parse_constant=lambda x: (_ for _ in ()).throw(ValueError('Nonfinite JSON')))


def pin(path):
    p=Path(path)
    require(p.is_absolute() and p.is_file() and not any(x.is_symlink() for x in (p,*p.parents)),
            'Absolute unlinked regular source required')
    return dict(path=str(p.resolve()),sha256=digest(p))


def files_from_authority(value):
    """Exact direct closure. Parent full payload is additionally checked by loader."""
    result={}
    def add(path,sha):
        require(path not in result or result[path]==sha,'Conflicting input pin')
        result[path]=sha
    def visit(item):
        if type(item)is dict:
            if set(item)=={'path','sha256'}:add(item['path'],item['sha256'])
            else:
                for key,value in item.items():
                    if key=='frozen_inputs':
                        for path,sha in value.items():add(path,sha)
                    else:visit(value)
        elif type(item)is list:
            for value in item:visit(value)
    visit(value)
    if 'parent' in value:
        p=value['parent'];add(str(Path(p['directory'])/'checkpoint-manifest.json'),p['checkpoint_manifest_sha256'])
    if 'checkpoint_dir' in value:
        add(str(Path(value['checkpoint_dir'])/'checkpoint-manifest.json'),value['checkpoint_manifest_sha256'])
    return result


def effective_hash(spec,overlay_file):
    """Independent original-base bridge, exact SI arithmetic and APL fast mask."""
    graph=Path(spec['graph_dir'])
    weights=np.load(graph/'weights.npy',allow_pickle=False)
    src=np.load(graph/'src.npy',allow_pickle=False,mmap_mode='r')
    ids=np.load(graph/'edge_id.npy',allow_pickle=False,mmap_mode='r')
    try:
        require(weights.dtype==np.float64 and weights.shape==(25582938,) and
                src.dtype==np.int32 and src.shape==weights.shape and ids.dtype==np.int64 and ids.shape==weights.shape,
                'Full canonical graph required')
        apl=np.load(Path(spec['apl_bundle_dir'])/'apl_globals.npy',allow_pickle=False)
        require(apl.dtype==np.int32 and apl.shape==(2,),'Two canonical APL IDs required')
        fast=np.isin(src,apl);require(int(fast.sum())==5845,'Original fast-APL mask differs')
        weights[fast]=np.float64(0)
        with np.load(overlay_file,allow_pickle=False) as f:
            require(set(f.files)=={'edge_id','plastic_delta_mv'},'Overlay array fields differ')
            mask=f['edge_id'];delta=f['plastic_delta_mv']
        require(mask.dtype==np.int64 and mask.shape==(14232,) and delta.dtype==np.float32 and delta.shape==mask.shape and
                np.all((mask>=0)&(mask<len(weights))) and np.all(mask[1:]>mask[:-1]) and
                np.array_equal(ids[mask],mask) and not fast[mask].any() and np.isfinite(delta).all() and np.all(delta<=0),
                'Original candidate overlay contract differs')
        nz=delta!=np.float32(0)
        rows=mask[nz]
        weights[rows]=np.add(weights[rows],np.multiply(delta[nz].astype(np.float64),np.float64(.001)))
        require(np.isfinite(weights).all() and np.all(weights[mask]>0),'Effective candidate sign/nonfinite failure')
        return hashlib.sha256(weights.astype('<f8',copy=False).tobytes()).hexdigest()
    finally:
        src._mmap.close();ids._mmap.close()


def epoch_authority(template,*,case,checkpoint,overlay,epoch_id,us_tick,d_command=1.,frozen=False):
    value=copy.deepcopy(template)
    require(value['schema']=='phase4an-epoch-postprocess-authority-v1','Wrong epoch template')
    case,checkpoint=Path(case),Path(checkpoint)
    spec=read(case/'spec.json');summary=read(checkpoint/'summary.json')
    require(type(us_tick)is int and 0<=us_tick<spec['steps'] and summary['steps']==spec['steps'],'Invalid epoch clock')
    value.update(epoch_id=epoch_id,diagnostic_mode=summary['diagnostic_mode'],checkpoint_dir=str(checkpoint),
                 checkpoint_manifest_sha256=digest(checkpoint/'checkpoint-manifest.json'))
    value['command']=dict(steps=spec['steps'],compartment="y5B'2a",us_tick=us_tick,
                          d_command=d_command,frozen=frozen,trace_backend='torch')
    for role,path in dict(spec=case/'spec.json',requests=case/'requests.npz',state=checkpoint/'state.npz',
                         overlay_before=overlay['overlay_file'],overlay_manifest_before=overlay['overlay_manifest']).items():
        value['files'][role]=pin(path)
    return value


def boundary_authority(*,boundary_id,registration_sha256,case,parent,transition,input_policy,mode,
                       before_overlay,after_overlay,source_files,frozen_inputs,epoch=None,update_dir=None,cpu_receipt=None):
    require(transition in ('epoch_update','idle') and mode in ('reference','light'),'Invalid transition/mode')
    case,parent=Path(case),Path(parent);spec=read(case/'spec.json');summary=read(parent/'summary.json')
    offset=summary.get('global_next_tick',summary['steps'])
    require(spec['global_tick_offset']==offset and spec['parent_checkpoint_manifest_sha256']==digest(parent/'checkpoint-manifest.json'),
            'Case does not identify exact parent/clock')
    before=effective_hash(spec,before_overlay['overlay_file']);after=effective_hash(spec,after_overlay['overlay_file'])
    require(before==summary['effective_weights_raw_sha256'],'Before effective weight is not parent installation')
    update=None
    if transition=='epoch_update':
        require(epoch is not None and update_dir is not None and cpu_receipt is not None,'Missing actual update evidence')
        update=dict(epoch_authority=pin(epoch),files={n:pin(Path(update_dir)/n) for n in
            ('chain-receipt.json','update-receipt.json','delta-after.npz','overlay-manifest.json')})
    else:
        require(epoch is update_dir is cpu_receipt is None and before==after,'Idle cannot include a new update')
    return dict(schema='conditioning-updated-boundary-v1',boundary_id=boundary_id,registration_sha256=registration_sha256,
        transition=transition,diagnostic_mode=mode,input_policy=input_policy,
        case=dict(spec=pin(case/'spec.json'),requests=pin(case/'requests.npz')),
        parent=dict(directory=str(parent),checkpoint_manifest_sha256=digest(parent/'checkpoint-manifest.json')),
        global_tick_offset=offset,
        overlay_before=dict(file=pin(before_overlay['overlay_file']),manifest=pin(before_overlay['overlay_manifest'])),
        overlay_after=dict(file=pin(after_overlay['overlay_file']),manifest=pin(after_overlay['overlay_manifest'])),
        expected_effective_weight_before_sha256=before,expected_effective_weight_after_sha256=after,
        update=update,cpu_validation=None if cpu_receipt is None else pin(cpu_receipt),
        source_files=copy.deepcopy(source_files),frozen_inputs=copy.deepcopy(frozen_inputs))