"""Build-input identity for detecting stale, otherwise checksum-valid runtimes."""
import hashlib
from pathlib import Path

ROOT = Path(__file__).resolve().parents[2]
UPSTREAM_COMMIT = "4d756bc72bf00a4aacf410ae15a2d315f3db400d"
INPUTS = (
    "crates/searchi-semantic/native/worker.cpp",
    "crates/searchi-semantic/native/CMakeLists.txt",
    "tools/embeddinggemma2/build_runtime.py",
    "tools/embeddinggemma2/macos_runtime.py",
    "tools/embeddinggemma2/no-logits.patch",
    "tools/embeddinggemma2/cpu-dispatch.patch",
    "tools/embeddinggemma2/cpu-only-loader.patch",
)


def fingerprint(root=ROOT):
    hashes = {}
    for name in INPUTS:
        path = Path(root) / name
        with path.open("rb") as source:
            data = source.read(1024 * 1024 + 1)
        if not data or len(data) > 1024 * 1024:
            raise ValueError("Native build input is empty or oversized")
        # Only build-source line endings are canonicalized; indexed user bytes
        # and extraction provenance are never processed by this helper.
        hashes[name] = hashlib.sha256(data.replace(b"\r\n", b"\n")).hexdigest()
    return {"schema": 1, "upstream_commit": UPSTREAM_COMMIT,
            "normalization": "CRLF-to-LF build inputs only", "inputs": hashes}


def verify(manifest, root=ROOT):
    if not isinstance(manifest.get("build_provenance"), dict) or manifest["build_provenance"] != fingerprint(root):
        raise ValueError("Runtime build provenance missing or stale; rebuild the normal native runtime")