<?php

// Guarded QA, read-only persistence proof; never serialize credentials or ciphertexts.
use Illuminate\Contracts\Console\Kernel;
use Illuminate\Support\Facades\DB;

require dirname(__DIR__).'/vendor/autoload.php';
require __DIR__.'/portal-qa-environment.php';
$target = portalQaEnvironment();
$app = require dirname(__DIR__).'/bootstrap/app.php';
$app->make(Kernel::class)->bootstrap();
portalQaAssertTarget($target);
DB::beginTransaction();
DB::statement('SET TRANSACTION READ ONLY');
try {
    if (in_array('--inspect', $argv, true)) {
        $provinces = DB::table('geo_locations')->where('location_type', 'province')->where('name', 'ilike', '%Cabo%')->whereNull('deleted_at')->get(['id', 'name']);
        $districts = DB::table('geo_locations')->whereIn('parent_id', $provinces->pluck('id'))->where('location_type', 'district')->whereNull('deleted_at')->get(['id', 'name', 'parent_id']);
        echo json_encode(['target' => $target, 'read_only' => true, 'provinces' => $provinces, 'districts' => $districts], JSON_THROW_ON_ERROR).PHP_EOL;
        DB::rollBack();
        exit;
    }
    $directory = storage_path('app/private/investmoz-v2/portal-audit');
    $browser = json_decode(file_get_contents($directory.'/territory-resource-chromium-20261010.json'), true, 512, JSON_THROW_ON_ERROR);
    throw_unless($browser['result'] === 'passed', RuntimeException::class, 'Scoped browser proof not passed.');
    $opportunity = DB::table('opportunities')->where('id', 51)->first();
    throw_unless((int) $opportunity->owner_user_id === 21 && $opportunity->status === 'draft', RuntimeException::class, 'Synthetic draft identity/state changed.');
    $proof = ['captured_at' => gmdate('c'), 'target' => $target, 'read_only' => true, 'opportunity_id' => 51, 'owner_user_id' => 21, 'resources' => [], 'active_writes' => 0];
    foreach ($browser['resources'] as $name => $entry) {
        $row = DB::table('opportunity_location_drafts')->where('opportunity_id', 51)->where('id', $entry['id'])->whereNull('deleted_at')->first();
        throw_unless($row !== null && (int) $row->version === $entry['version'], RuntimeException::class, 'Saved resource/version unavailable.');
        $payload = json_decode($row->payload, true, 512, JSON_THROW_ON_ERROR);
        throw_unless($payload == $entry['payload'], RuntimeException::class, 'Browser and PostgreSQL payload differ.');
        $proof['resources'][$name] = ['id' => $row->id, 'version' => (int) $row->version, 'country_code' => $payload['country_code'],
            'province_id' => $payload['province_id'] ?? null, 'district_id' => $payload['district_id'] ?? null, 'payload_matches_browser' => true];
        if ($name === 'mz') {
            $district = DB::table('geo_locations')->where('id', $payload['district_id'])->first();
            throw_unless($district->parent_id === $payload['province_id'], RuntimeException::class, 'Saved hierarchy parent mismatch.');
            $proof['resources'][$name]['district_name'] = $district->name;
            $proof['resources'][$name]['parent_verified'] = true;
        }
    }
    $proof['accepted_territorial_links'] = DB::table('opportunity_locations')->where('opportunity_id', 51)->count();
    throw_unless($proof['accepted_territorial_links'] === $browser['before']['accepted_territorial_links'], RuntimeException::class, 'Preparation unexpectedly changed accepted territorial links.');
    $proof['result'] = 'passed';
    file_put_contents($directory.'/territory-resource-persistence-qa.json', json_encode($proof, JSON_PRETTY_PRINT | JSON_THROW_ON_ERROR));
    echo json_encode(['result' => 'passed', 'target' => $target, 'resources_verified' => count($proof['resources']), 'read_only' => true, 'active_writes' => 0], JSON_THROW_ON_ERROR).PHP_EOL;
} finally {
    DB::rollBack();
}