<?php

use App\Services\VirtualDesk;
use Illuminate\Contracts\Console\Kernel;
use Illuminate\Support\Facades\DB;

// Independent read-only persistence proof after real HTTP and Chromium journeys.
require dirname(__DIR__).'/vendor/autoload.php';
require __DIR__.'/portal-qa-environment.php';
$target = portalQaEnvironment();
$app = require dirname(__DIR__).'/bootstrap/app.php';
$app->make(Kernel::class)->bootstrap();
$identity = portalQaAssertTarget($target);
$dir = storage_path('app/private/investmoz-v2/portal-audit');
set_exception_handler(function (Throwable $error) use ($dir): void {
    file_put_contents($dir.'/legacy-sector-persistence-error-private.json', json_encode(['type' => get_class($error), 'message' => $error->getMessage()]));
    fwrite(STDERR, "QA persistence check failed; inspect private diagnostic.\n");
    exit(1);
});
$http = json_decode(file_get_contents($dir.'/legacy-sectors-http-qa.json'), true, 512, JSON_THROW_ON_ERROR);
$browser = json_decode(file_get_contents($dir.'/legacy-sectors-browser-qa.json'), true, 512, JSON_THROW_ON_ERROR);
throw_unless(($http['result'] ?? null) === 'passed' && ($browser['result'] ?? null) === 'passed'
    && $http['target'] === $target['database'].':55441' && $browser['target'] === $http['target'], RuntimeException::class, 'Passed same-target evidence required');
DB::statement('BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY');
try {
    $cases = [];
    foreach (['HTTP' => $http, 'Chromium' => $browser] as $consumer => $receipt) {
        foreach ($receipt['dossiers'] as $href => $entry) {
            $case = DB::table('desk_cases')->where('id', $entry['id'])->firstOrFail();
            $payload = app(VirtualDesk::class)->decode($case->payload);
            $refs = $payload['investor_path']['content_sources'] ?? [];
            $events = DB::table('desk_events')->where('case_id', $case->id)->where('action', 'legacy_content_referenced')->count();
            throw_unless((int) $case->user_id === 21 && count($refs) === 1 && $refs[0]['return_href'] === $href && $events === 1,
                RuntimeException::class, 'Dossier/source isolation or idempotence failed');
            $cases[] = ['consumer' => $consumer, 'id' => $case->id, 'resource_id' => $refs[0]['resource_id'], 'return_href' => $href,
                'reference_count' => 1, 'reference_event_count' => 1, 'version' => $case->version];
        }
    }
    $manifest = json_decode(file_get_contents(storage_path('app/private/document-import-staging/legacy-setores-20261010/manifest.json')), true, 512, JSON_THROW_ON_ERROR);
    $resources = DB::table('portal_resources as r')->join('documents as d', 'd.id', '=', 'r.document_id')
        ->whereIn('d.external_id', array_column($manifest['documents'], 'external_id'))->get(['r.id', 'r.published', 'r.metadata_version', 'd.external_id', 'd.sha256', 'd.malware_scan_status', 'd.malware_scanned_sha256']);
    $originals = [];
    foreach ($resources as $row) {
        $count = DB::table('documents')->where('sha256', $row->sha256)->whereNull('deleted_at')->count();
        throw_unless($count === 1 && $row->malware_scan_status === 'clean' && hash_equals(trim($row->sha256), trim($row->malware_scanned_sha256)), RuntimeException::class, 'Original duplication or missing scan');
        $originals[] = ['resource_id' => $row->id, 'documents_for_hash' => $count, 'metadata_version' => $row->metadata_version, 'published' => $row->published];
    }
    $finance = $resources->first(fn ($row) => str_starts_with($row->external_id, 'legacy-tempo-post-171994-'));
    $territorialLinks = DB::table('portal_resource_links')->whereIn('resource_id', $resources->pluck('id'))->where('target_type', 'territory')->count();
    throw_unless($resources->count() === 22 && $resources->where('published', true)->count() === 21 && $finance && ! $finance->published && $territorialLinks === 0,
        RuntimeException::class, 'Publication or territorial scope differs');
    $scans = DB::table('document_malware_scans')->whereIn('document_id', DB::table('documents')->whereIn('external_id', array_column($manifest['documents'], 'external_id'))->pluck('id'))
        ->get(['engine', 'engine_version', 'result', 'file_sha256']);
    throw_unless($scans->count() === 22 && $scans->every(fn ($s) => $s->engine === 'ClamAV' && $s->engine_version !== 'fixture' && $s->result === 'clean'), RuntimeException::class, 'Real ClamD evidence required');
    $proof = ['verified_at' => gmdate('c'), 'target' => $identity, 'transaction_read_only' => true, 'cases' => $cases, 'originals' => $originals,
        'real_scans' => $scans, 'automatic_territory_links' => $territorialLinks, 'finance_private' => true, 'database_writes' => 0, 'active_writes' => 0];
    file_put_contents($dir.'/legacy-sectors-persistence-qa.json', json_encode($proof, JSON_PRETTY_PRINT | JSON_THROW_ON_ERROR));
    echo json_encode(['dossiers_verified' => count($cases), 'originals' => count($originals), 'real_scans' => $scans->count(), 'published' => 21,
        'finance_private' => true, 'automatic_territory_links' => 0, 'database_writes' => 0, 'active_writes' => 0]).PHP_EOL;
} finally {
    DB::statement('ROLLBACK');
}