// Static assessment of retained REA exports only. Never reads the original installation.
const fs = require('node:fs/promises')
const path = require('node:path')
const crypto = require('node:crypto')
const assert = require('node:assert/strict')
const archive = path.resolve('.tmp/rea-runtime-scripts.json')
const output = path.resolve('.tmp/connector-assessment-20261016')
const evidence = 'ev_717fa5e846e64d67ac19c8925d121bff632c0d3aefb3603b10858559cabb2dcb'
const sha = text => crypto.createHash('sha256').update(text, 'utf8').digest('hex')
;(async () => {
  const source = JSON.parse(await fs.readFile(archive, 'utf8'))
  assert.equal(source.evidence_id, evidence)
  const files = source.items.map(item => {
    const artifact = item.source?.artifact, text = artifact?.text
    const actualSha256 = typeof text === 'string' ? sha(text) : null
    return { name: path.win32.basename(item.file_path), declaredLength: item.length, textLength: text?.length ?? null,
      sha256: artifact?.sha256 ?? null, actualSha256, verified: actualSha256 !== null && actualSha256 === artifact?.sha256 }
  })
  const failures = files.filter(file => !file.verified)
  assert.equal(failures.length, 0, 'Every retained script body must match its REA artifact SHA before assessment')
  const args = process.argv.slice(2)
  if (args[0] === '--find') {
    const file = source.items.find(item => path.win32.basename(item.file_path) === args[1])
    assert.ok(file, 'Select an exact retained REA filename')
    const text = file.source.artifact.text
    console.log(JSON.stringify({ file: args[1], sha256: file.source.artifact.sha256, matches: args.slice(2).map(term => {
      const offsets = []; let offset = -1
      while ((offset = text.indexOf(term, offset + 1)) !== -1) offsets.push(offset)
      return { term, offsets }
    }) }))
    return
  }
  if (args[0] === '--excerpt') {
    const file = source.items.find(item => path.win32.basename(item.file_path) === args[1])
    assert.ok(file, 'Select an exact retained REA filename')
    const start = Number(args[2]), length = Number(args[3] || 4000)
    assert.ok(Number.isInteger(start) && start >= 0 && Number.isInteger(length) && length > 0 && length <= 16000)
    console.log(JSON.stringify({ evidenceId: evidence, file: args[1], sha256: file.source.artifact.sha256,
      offsetUnit: 'zero-based JavaScript UTF-16 code units', start, end: start + length, text: file.source.artifact.text.slice(start, start + length) }))
    return
  }
  const selectedNames = new Set(['store-BKmTj0KI.js', 'contexts-BMeWSUHk.js', 'common-DRZ6FwkK.js', 'adapters-SPAem2E3.js',
    'skills-panel-CvMlV3m8.js', 'wb-input-add-B045GnIg.js', 'runtime-B7PLES2V.js', 'workbuddy-provider-DkH2YFYM.js',
    'desktop-sdk-setup-C2AUiJmx.js', 'main-content-core-Dlaq72qt.js', 'services-Dz7-cD7Y.js', 'zh-cn-Dfzn8myY.js', 'wb-CocRQn4C.js'])
  const selected = source.items.filter(item => /connector|mcp-server-loader|mcp-token-config|oauth-contract/.test(path.win32.basename(item.file_path)) || selectedNames.has(path.win32.basename(item.file_path))).map(item => {
    const name = path.win32.basename(item.file_path), text = item.source.artifact.text
    return { ...files.find(file => file.name === name), functions: [...text.matchAll(/function ([\w$]+)\(/g)]
      .filter(match => /connector|mcp|oauth|tokenConfig|catalog|category/i.test(match[1]))
      .map(match => ({ name: match[1], offset: match.index })) }
  })
  const supplementaryPath = path.resolve('.tmp/rea-expert-runtime-scripts-20261016.json')
  let supplementary
  try {
    const newer = JSON.parse(await fs.readFile(supplementaryPath, 'utf8'))
    assert.equal(newer.evidence_id, 'ev_e91787b1d4dea651582c6cf12827775b9068b0ee8b80c68ba08d4c1d87d94e90')
    const verified = newer.items.map(item => ({ name: path.win32.basename(item.file_path), sha256: item.source?.artifact?.sha256,
      actualSha256: sha(item.source.artifact.text) }))
    assert.ok(verified.every(file => file.sha256 === file.actualSha256), 'Supplementary REA body SHA mismatch')
    supplementary = { archive: supplementaryPath, evidenceId: newer.evidence_id, total: verified.length, verified: verified.length,
      changedFromBaseline: verified.filter(file => files.some(before => before.name === file.name && before.sha256 !== file.sha256)),
      newNames: verified.filter(file => !files.some(before => before.name === file.name)).map(file => file.name) }
  } catch (error) { if (error.code !== 'ENOENT') throw error }
  const cssManifest = JSON.parse(await fs.readFile('.tmp/rea-css-recovered/manifest.json', 'utf8'))
  const css = []
  for (const file of cssManifest.files.filter(file => /^(connector-(?:device-code|token-config)-modal|skills-panel)-/.test(file.file))) {
    const bytes = await fs.readFile(path.join('.tmp/rea-css-recovered', file.file))
    const actualSha256 = crypto.createHash('sha256').update(bytes).digest('hex')
    assert.equal(actualSha256, file.sha256, 'Retained connector CSS SHA mismatch')
    css.push({ file: file.file, sha256: file.sha256, bytes: bytes.length, rules: file.rules, verified: true })
  }
  const runtimeBaselines = []
  for (const directory of ['rea-market-connectors-static-20261016', 'rea-custom-connectors-static-20261016', 'rea-connector-detail-20261016']) {
    const capture = path.join('.tmp', directory), layout = JSON.parse(await fs.readFile(path.join(capture, 'layout.json'), 'utf8'))
    const bytes = await fs.readFile(path.join(capture, 'workbuddy.png'))
    assert.equal(crypto.createHash('sha256').update(bytes).digest('hex'), layout.artifact.sha256)
    const retained = JSON.parse(await fs.readFile(layout.archive, 'utf8')), probe = retained.normalized_result.visuals.probe
    const frames = []
    for (const [index, frame] of (probe?.frames || []).entries()) {
      const bytes = await fs.readFile(path.join(capture, `frame-${String(index).padStart(3, '0')}.png`))
      assert.equal(crypto.createHash('sha256').update(bytes).digest('hex'), frame.artifact.sha256)
      frames.push({ index, stepId: frame.step_id, sha256: frame.artifact.sha256 })
    }
    runtimeBaselines.push({ directory, evidenceId: layout.evidenceId, screenshotSha256: layout.artifact.sha256,
      probe: probe && { status: probe.status, steps: probe.steps, restoration: probe.restoration, frames } })
  }
  await fs.mkdir(output, { recursive: true })
  const report = { result: 'PASS retained-script integrity', archive, evidenceId: evidence, version: 'WorkBuddy 5.8.2',
    offsetUnit: 'zero-based JavaScript UTF-16 code units', filesTotal: files.length, verifiedCount: files.filter(file => file.verified).length,
    files, selected, supplementary, css: { evidenceId: cssManifest.sourceEvidenceId, files: css }, runtimeBaselines, limitations: ['Retained REA exports only; this audit performs no original runtime actions or authentication.', 'Function presence does not establish backend behavior or current catalog contents.'] }
  await fs.writeFile(path.join(output, 'integrity-and-anchors.json'), JSON.stringify(report, null, 2))
  console.log(JSON.stringify({ result: report.result, total: files.length, verified: report.verifiedCount, selected: selected.length, report: path.join(output, 'integrity-and-anchors.json') }))
})().catch(error => { console.error(error); process.exitCode = 1 })