<?php
/** Explicit QA-only tooling: no active environment or .env fallback. */
require __DIR__.'/proactive-supply-qa-bootstrap.php';
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Schema;
use Illuminate\Support\Facades\Artisan;
$operation=$argv[1]??'';
if($operation==='test'){
    $argv=['phpunit','-c','phpunit.investmoz.xml','tests/Feature/ProactiveSupplyTest.php','tests/Feature/ProactiveInvestmentTest.php'];
    if(getenv('PROACTIVE_SUPPLY_FILTER')){$argv[]='--filter';$argv[]=getenv('PROACTIVE_SUPPLY_FILTER');}
    $argc=count($argv);$_SERVER['argv']=$argv;$_SERVER['argc']=$argc;
    require dirname(__DIR__).'/vendor/phpunit/phpunit/phpunit';exit;
}
Tests\Support\ProactiveInvestmentFixture::guard();
$out=dirname(__DIR__).'/outputs/proactive-supply-20261028';
if($operation==='geography'){
    file_put_contents($out.'/private/geography.json',json_encode(DB::table('geo_locations')->whereNull('deleted_at')->get(['id','name','parent_id','location_type']),JSON_UNESCAPED_UNICODE|JSON_THROW_ON_ERROR));
    echo "QA geography exported privately.\n";exit;
}
if($operation==='schema'){
    if(!Schema::hasTable('proactive_supply_sources')){
        (require dirname(__DIR__).'/database/migrations/2026_10_28_180000_create_proactive_supply_observations.php')->up();
    }
    echo "QA schema available; no existing table altered.\n";exit;
}
if(in_array($operation,['import','extend'],true)){
    $dir=$out.'/private-v2';
    $manifest=json_decode(file_get_contents($dir.'/preview.json'),true,512,JSON_THROW_ON_ERROR);
    $scan=json_decode(file_get_contents($out.'/private/scan.json'),true,512,JSON_THROW_ON_ERROR);
    if(($scan['exit_code']??1)!==0||array_diff(array_column($manifest['sources'],'sha256'),$scan['source_hashes']??[]))throw new RuntimeException('Hash-specific malware scan required');
    $file=$dir.'/observations.jsonl';$hash=hash_file('sha256',$file);
    if(($argv[2]??'')!==$hash)throw new RuntimeException('Review preview and supply exact JSONL hash');
    $before=DB::table('proactive_supply_observations')->count();
    $extension=$operation==='extend';$previousHash=$argv[3]??null;
    if($extension){
        $delta=json_decode(file_get_contents($dir.'/extension-preview.json'),true,512,JSON_THROW_ON_ERROR);
        if(($delta['sha256']??null)!==$hash||($delta['previous_sha256']??null)!==$previousHash||empty($delta['no_replacement'])||$delta['previous_observations_unchanged']+$delta['new_observations']!==$manifest['records'])throw new RuntimeException('Extension must prove all previously accepted observations unchanged and bind both snapshot hashes.');
    }
    DB::transaction(function()use($manifest,$file,$hash,$extension,$previousHash){
        DB::select("select pg_advisory_xact_lock(hashtext('proactive-supply-import-v1'))");
        foreach($manifest['sources']as$s){
            $existing=DB::table('proactive_supply_sources')->where('sha256',$s['sha256'])->first();
            if($existing && data_get(json_decode($existing->receipt,true),'transport_sha256')!==($extension?$previousHash:$hash))throw new RuntimeException('Existing source has a different prepared classification snapshot; preserve it and prepare an explicit mapping delta instead of silently replacing observations.');
            if($extension){
                if(!$existing)throw new RuntimeException('An extension must reference the already imported originals.');
                $receipt=json_decode($existing->receipt,true);
                $history=$receipt['extensions']??[];
                if(!in_array($hash,array_column($history,'transport_sha256'),true)){
                    $history[]=['transport_sha256'=>$hash,'rows_in_extended_preview'=>$manifest['records'],'at'=>now()->toIso8601String(),'operation'=>'append previously unrepresented source rows;existing observations immutable'];
                    DB::table('proactive_supply_sources')->where('sha256',$s['sha256'])->update(['receipt'=>json_encode([...$receipt,'extensions'=>$history])]);
                }
            }
            DB::table('proactive_supply_sources')->insertOrIgnore(['sha256'=>$s['sha256'],'name'=>$s['name'],'period'=>$s['period'],'limitations'=>$manifest['limitations'],'receipt'=>json_encode(['source'=>$s,'preview_rows'=>$manifest['records'],'transport_sha256'=>$hash,'scan'=>'Defender custom scan, no threats, hash-specific receipt','scope'=>'isolated QA, internal analysis only']),'imported_at'=>now()]);
        }
        $f=fopen($file,'rb');$batch=[];$n=0;
        while(($line=fgets($f))!==false){
            $r=json_decode($line,true,512,JSON_THROW_ON_ERROR);
            if(!in_array($r['source_hash'],array_column($manifest['sources'],'sha256'),true))throw new RuntimeException('Unknown source');
            $batch[]=$r;$n++;
            if(count($batch)===500){DB::table('proactive_supply_observations')->insertOrIgnore($batch);$batch=[];}
        }
        fclose($f);if($batch)DB::table('proactive_supply_observations')->insertOrIgnore($batch);
        if($n!==$manifest['records'])throw new RuntimeException('Incomplete candidate');
    });
    $receipt=['before'=>$before,'after'=>DB::table('proactive_supply_observations')->count(),'sha256'=>$hash,'extension'=>$extension,'previous_snapshot'=>$previousHash,'publication'=>false,'database'=>'proactive_investment_20261027_test','port'=>55441];
    file_put_contents($out.'/import-'.($extension?'extension':($before?'replay':'first')).'.json',json_encode($receipt,JSON_PRETTY_PRINT));echo json_encode($receipt)."\n";exit;
}
throw new RuntimeException('Use geography,schema,import <reviewed hash>,extend <reviewed hash> <previous snapshot hash>,or test;exclusively isolated QA.');