from pathlib import Path
import json,subprocess,hashlib
ROOT=Path(__file__).resolve().parent.parent
OUT=ROOT/'outputs/investmoz-country02-https-20261011'
meta=json.loads((ROOT/'storage/app/private/investmoz-v2/portal-audit/country-https-latest.json').read_text());work=Path(meta['work'])
proposal=OUT/'portal-investidor.test-https.proposta.conf'
text=proposal.read_text().replace('C:/Users/macbook/.config/investmoz/tls/',(work/'active-tls-prepared').as_posix()+'/')
(work/'syntax-vhost.conf').write_text(text,encoding='utf-8')
apache=Path('C:/laragon/bin/apache/httpd-2.4.54-win64-VS16/conf/httpd.conf')
text=apache.read_text();anchor='IncludeOptional "C:/laragon/etc/apache2/sites-enabled/*.conf"'
assert text.count(anchor)==1
text=text.replace(anchor,'Include "'+(work/'syntax-vhost.conf').as_posix()+'"')
(work/'syntax-main.conf').write_text(text,encoding='utf-8')
cmd=['C:/laragon/bin/apache/httpd-2.4.54-win64-VS16/bin/httpd.exe','-t','-f',str(work/'syntax-main.conf')]
r=subprocess.run(cmd,capture_output=True,text=True);assert r.returncode==0,r.stderr
proof={'result':'passed','tool':'Apache httpd -t','proposed_vhost_sha256':hashlib.sha256(proposal.read_bytes()).hexdigest(),'actual_apache_config_unchanged':True,'test':'current module/include configuration copied privately with proposed vhosts; private prepared certificate paths substituted; syntax only, no server reload or active trust change','diagnostic':r.stderr.strip(),'active_changes':0}
(OUT/'apache-syntax.json').write_text(json.dumps(proof,indent=2),encoding='utf-8');print(json.dumps(proof))