[CmdletBinding()]
param(
    [Parameter(Mandatory = $true)][ValidateSet('purchase', 'leave')][string]$Workflow,
    [Parameter(Mandatory = $true)][ValidatePattern('^[A-Za-z0-9_.:-]{1,64}$')][string]$ModuleCode,
    [Parameter(Mandatory = $true)][string]$AccountBook,
    [Parameter(Mandatory = $true)][string]$SubSystemId,
    [Parameter(Mandatory = $true)][ValidatePattern('^[A-Fa-f0-9]{40}$')][string]$SourceCommit,
    [Parameter(Mandatory = $true)][ValidatePattern('^[A-Fa-f0-9]{64}$')][string]$PackageSha256,
    [Parameter(Mandatory = $true)][string]$RuntimeConfigurationFile,
    [Parameter(Mandatory = $true)][ValidatePattern('^[A-Za-z0-9][A-Za-z0-9_.:-]{0,63}$')][string]$RolloutCustomerId,
    [Parameter(Mandatory = $true)][ValidatePattern('^[A-Za-z0-9_.:-]{8,128}$')][string]$EnvironmentId,
    [Parameter(Mandatory = $true)][ValidatePattern('^[A-Za-z0-9_.:-]{1,128}$')][string]$TestedBy,
    [Parameter(Mandatory = $true)][string]$CasesFile,
    [Parameter(Mandatory = $true)][string]$UatAuthorizationFile,
    [Parameter(Mandatory = $true)][string]$VerifierCliPath,
    [Parameter(Mandatory = $true)][string]$OutputPath
)

Set-StrictMode -Version 2.0
$ErrorActionPreference = 'Stop'

function Get-RegularFile([string]$Path, [long]$MaximumBytes, [string]$Label) {
    $full = [IO.Path]::GetFullPath($Path)
    if (-not [IO.File]::Exists($full)) { throw "$Label file does not exist." }
    $info = Get-Item -LiteralPath $full -Force
    if ($info.Length -le 0 -or $info.Length -gt $MaximumBytes -or
        (($info.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0)) {
        throw "$Label must be a non-empty ordinary file within the size limit."
    }
    return $full
}

function Get-Sha256([byte[]]$Bytes) {
    $sha = [Security.Cryptography.SHA256]::Create()
    try {
        return ([BitConverter]::ToString($sha.ComputeHash($Bytes))).Replace('-', '').ToLowerInvariant()
    }
    finally { $sha.Dispose() }
}

function Test-ExactProperties([object]$Value, [string[]]$Expected) {
    if ($null -eq $Value) { return $false }
    $names = @($Value.PSObject.Properties | ForEach-Object { $_.Name })
    if ($names.Count -ne $Expected.Count) { return $false }
    foreach ($name in $Expected) { if ($names -cnotcontains $name) { return $false } }
    return $true
}

$strictUtf8 = New-Object Text.UTF8Encoding($false, $true)
$runtimePath = Get-RegularFile $RuntimeConfigurationFile 64KB 'Runtime configuration'
$casesPath = Get-RegularFile $CasesFile 2MB 'Cases'
$uatAuthorizationPath = Get-RegularFile `
    $UatAuthorizationFile 512KB 'UAT authorization'
$cliPath = Get-RegularFile $VerifierCliPath 64MB 'Verifier CLI'
if ([IO.Path]::GetFileName($cliPath) -ne 'lserp-cli.exe') {
    throw 'Verifier CLI filename must be lserp-cli.exe.'
}
$runtimeBytes = [IO.File]::ReadAllBytes($runtimePath)
$runtimeHash = Get-Sha256 $runtimeBytes
$uatAuthorizationHash = Get-Sha256 `
    ([IO.File]::ReadAllBytes($uatAuthorizationPath))
$cliHash = Get-Sha256 ([IO.File]::ReadAllBytes($cliPath))
$uatOutput = @(& $cliPath 'acceptance' 'verify-uat-authorization' `
    '--input' $uatAuthorizationPath '--json' 2>&1)
if ($LASTEXITCODE -ne 0) {
    throw 'UAT authorization failed final CLI verification.'
}
try {
    $uatVerification = (($uatOutput | ForEach-Object { [string]$_ }) -join `
        [Environment]::NewLine) | ConvertFrom-Json
}
catch { throw 'UAT authorization verifier returned invalid JSON.' }
if (-not (Test-ExactProperties $uatVerification @('ok', 'correlationId', 'data')) -or
    -not (Test-ExactProperties $uatVerification.data.erpScope @(
            'accountBook', 'subSystemId', 'userIdSha256', 'userNameSha256',
            'databaseScopeFingerprint', 'isAdministrator')) -or
    -not (Test-ExactProperties $uatVerification.data.runtimeCli @(
            'fileName', 'version', 'sha256', 'signerThumbprint',
            'requiresElevation', 'bridgeOnly', 'databaseDirectAccess',
            'sessionSource')) -or
    -not (Test-ExactProperties $uatVerification.data.verifierCli @(
            'fileName', 'sha256', 'signerThumbprint',
            'requiresElevation')) -or
    $uatVerification.ok -ne $true -or
    $uatVerification.data.packageType -cne 'workflow_write_uat_authorization' -or
    $uatVerification.data.schemaVersion -cne '1.2' -or
    $uatVerification.data.sourceSha256 -cne $uatAuthorizationHash -or
    $uatVerification.data.runtimeConfigurationSha256 -cne $runtimeHash -or
    $uatVerification.data.sourceCommit -cne $SourceCommit.ToLowerInvariant() -or
    $uatVerification.data.packageSha256 -cne $PackageSha256.ToLowerInvariant() -or
    $uatVerification.data.customerId -cne $RolloutCustomerId -or
    $uatVerification.data.environmentId -cne $EnvironmentId -or
    $uatVerification.data.erpScope.accountBook -cne $AccountBook -or
    $uatVerification.data.erpScope.subSystemId -cne $SubSystemId -or
    $uatVerification.data.runtimeCli.fileName -cne 'lserp-agent-cli.exe' -or
    [string]$uatVerification.data.runtimeCli.version -cnotmatch
        '^[0-9]{1,4}\.[0-9]{1,4}\.[0-9]{1,4}$' -or
    [string]$uatVerification.data.runtimeCli.sha256 -cnotmatch
        '^[a-f0-9]{64}$' -or
    [string]$uatVerification.data.runtimeCli.signerThumbprint -cnotmatch
        '^[A-F0-9]{40}$' -or
    $uatVerification.data.runtimeCli.requiresElevation -ne $false -or
    $uatVerification.data.runtimeCli.bridgeOnly -ne $true -or
    $uatVerification.data.runtimeCli.databaseDirectAccess -ne $false -or
    $uatVerification.data.runtimeCli.sessionSource -cne
        'current_logged_in_erp_process' -or
    $uatVerification.data.verifierCli.fileName -cne 'lserp-cli.exe' -or
    $uatVerification.data.verifierCli.sha256 -cne $cliHash -or
    $uatVerification.data.verifierCli.requiresElevation -ne $true -or
    $uatVerification.data.signatureVerified -ne $true -or
    $uatVerification.data.uatAuthorized -ne $true -or
    $uatVerification.data.productionReady -ne $false) {
    throw 'UAT authorization does not bind the final test scope and verifier.'
}
$authorizedWorkflows = @($uatVerification.data.workflows | Where-Object {
        [string]$_.workflow -ceq $Workflow -and
        [string]$_.moduleCode -ceq $ModuleCode
    })
if ($authorizedWorkflows.Count -ne 1) {
    throw 'UAT authorization does not contain the exact workflow and module.'
}
$casesText = [IO.File]::ReadAllText($casesPath, $strictUtf8)
$casesHash = Get-Sha256 ($strictUtf8.GetBytes($casesText))
try { $cases = @($casesText | ConvertFrom-Json) }
catch { throw 'Cases file must be a UTF-8 JSON array.' }
if ($cases.Count -le 0 -or $cases.Count -gt 32 -or $casesText.TrimStart()[0] -ne '[') {
    throw 'Cases file must contain a JSON array with 1-32 items.'
}
$runtimeCliVersion = [string]$uatVerification.data.runtimeCli.version
$runtimeCliSha256 = [string]$uatVerification.data.runtimeCli.sha256
$runtimeCliSigner = [string]$uatVerification.data.runtimeCli.signerThumbprint
foreach ($case in $cases) {
    if ([string]$case.runtimeCliVersion -cne $runtimeCliVersion -or
        [string]$case.runtimeCliSha256 -cne $runtimeCliSha256 -or
        [string]$case.runtimeCliSignerThumbprint -cne $runtimeCliSigner) {
        throw 'A projected case does not bind the authorized runtime CLI.'
    }
}

$testedAt = [DateTime]::UtcNow
$content = [ordered]@{
    evidenceType = 'workflow_write_integration'
    workflow = $Workflow
    moduleCode = $ModuleCode
    erpScope = [ordered]@{
        accountBook = $AccountBook
        subSystemId = $SubSystemId
    }
    sourceCommit = $SourceCommit.ToLowerInvariant()
    packageSha256 = $PackageSha256.ToLowerInvariant()
    runtimeConfigurationSha256 = $runtimeHash
    runtimeCli = [ordered]@{
        fileName = 'lserp-agent-cli.exe'
        version = $runtimeCliVersion
        sha256 = $runtimeCliSha256
        signerThumbprint = $runtimeCliSigner
        requiresElevation = $false
        bridgeOnly = $true
        databaseDirectAccess = $false
        sessionSource = 'current_logged_in_erp_process'
    }
    uatAuthorizationSourceSha256 = [string]$uatVerification.data.sourceSha256
    uatAuthorizationContentSha256 = [string]$uatVerification.data.contentSha256
    uatAuthorizationIdSha256 = [string]$uatVerification.data.authorizationIdSha256
    environmentId = $EnvironmentId
    testedAtUtc = $testedAt.ToString('yyyy-MM-ddTHH:mm:ss.fffZ')
    testedBy = $TestedBy
    cases = $cases
}
$canonical = $content | ConvertTo-Json -Compress -Depth 12
$contentHash = Get-Sha256 $strictUtf8.GetBytes($canonical)
$envelope = [ordered]@{
    schemaVersion = '1.6'
    contentSha256 = $contentHash
    content = $content
}
$body = $strictUtf8.GetBytes(($envelope | ConvertTo-Json -Depth 12) + [Environment]::NewLine)
$bodyHash = Get-Sha256 $body
$target = [IO.Path]::GetFullPath($OutputPath)
$directory = [IO.Path]::GetDirectoryName($target)
if ([string]::IsNullOrWhiteSpace($directory) -or -not [IO.Directory]::Exists($directory) -or
    [IO.File]::Exists($target) -or [IO.Directory]::Exists($target)) {
    throw 'Output must be a new file in an existing directory.'
}
$temporary = Join-Path $directory ('.lserp-write-evidence-' + [Guid]::NewGuid().ToString('N') + '.tmp')
$published = $false
try {
    $stream = [IO.File]::Open(
        $temporary, [IO.FileMode]::CreateNew, [IO.FileAccess]::Write, [IO.FileShare]::None)
    try { $stream.Write($body, 0, $body.Length); $stream.Flush() }
    finally { $stream.Dispose() }

    $arguments = @(
        'adapters', 'verify-write-integration-evidence', '--input', $temporary,
        '--workflow', $Workflow, '--module', $ModuleCode,
        '--account-book', $AccountBook, '--subsystem', $SubSystemId,
        '--runtime-sha256', $runtimeHash,
        '--source-commit', $SourceCommit.ToLowerInvariant(),
        '--package-sha256', $PackageSha256.ToLowerInvariant()
    )
    $verificationOutput = @(& $cliPath @arguments 2>&1)
    if ($LASTEXITCODE -ne 0) { throw 'Generated write integration evidence failed CLI verification.' }
    $verificationText = (($verificationOutput | ForEach-Object { [string]$_ }) -join [Environment]::NewLine)
    try { $verification = $verificationText | ConvertFrom-Json }
    catch { throw 'Verifier CLI returned invalid JSON.' }
    $expectedData = @(
        'evidenceType', 'schemaVersion', 'contentSha256', 'workflow', 'moduleCode',
        'erpScope', 'sourceCommit', 'packageSha256', 'runtimeConfigurationSha256',
        'runtimeCli',
        'uatAuthorizationSourceSha256', 'uatAuthorizationContentSha256',
        'uatAuthorizationIdSha256',
        'environmentId', 'testedAtUtc', 'testedBy', 'caseCount', 'verified',
        'registrationReady'
    )
    if (-not (Test-ExactProperties $verification @('ok', 'correlationId', 'data')) -or
        -not (Test-ExactProperties $verification.data $expectedData) -or
        -not (Test-ExactProperties $verification.data.erpScope @(
                'accountBook', 'subSystemId', 'userIdSha256', 'userNameSha256',
                'databaseScopeFingerprint', 'isAdministrator')) -or
        -not (Test-ExactProperties $verification.data.runtimeCli @(
                'fileName', 'version', 'sha256', 'signerThumbprint',
                'requiresElevation', 'bridgeOnly', 'databaseDirectAccess',
                'sessionSource')) -or
        $verification.ok -ne $true -or $verification.data.verified -ne $true -or
        $verification.data.schemaVersion -ne '1.6' -or
        $verification.data.registrationReady -ne $false -or
        $verification.data.contentSha256 -ne $contentHash -or
        $verification.data.workflow -ne $Workflow -or
        $verification.data.moduleCode -ne $ModuleCode -or
        $verification.data.erpScope.accountBook -ne $AccountBook -or
        $verification.data.erpScope.subSystemId -ne $SubSystemId -or
        $verification.data.erpScope.userIdSha256 -cne
            $uatVerification.data.erpScope.userIdSha256 -or
        $verification.data.erpScope.userNameSha256 -cne
            $uatVerification.data.erpScope.userNameSha256 -or
        $verification.data.erpScope.databaseScopeFingerprint -cne
            $uatVerification.data.erpScope.databaseScopeFingerprint -or
        $verification.data.erpScope.isAdministrator -ne
            $uatVerification.data.erpScope.isAdministrator -or
        $verification.data.runtimeConfigurationSha256 -ne $runtimeHash -or
        $verification.data.runtimeCli.fileName -cne 'lserp-agent-cli.exe' -or
        $verification.data.runtimeCli.version -cne $runtimeCliVersion -or
        $verification.data.runtimeCli.sha256 -cne $runtimeCliSha256 -or
        $verification.data.runtimeCli.signerThumbprint -cne $runtimeCliSigner -or
        $verification.data.runtimeCli.requiresElevation -ne $false -or
        $verification.data.runtimeCli.bridgeOnly -ne $true -or
        $verification.data.runtimeCli.databaseDirectAccess -ne $false -or
        $verification.data.runtimeCli.sessionSource -cne
            'current_logged_in_erp_process' -or
        $verification.data.uatAuthorizationSourceSha256 -ne
            $uatVerification.data.sourceSha256 -or
        $verification.data.uatAuthorizationContentSha256 -ne
            $uatVerification.data.contentSha256 -or
        $verification.data.uatAuthorizationIdSha256 -ne
            $uatVerification.data.authorizationIdSha256 -or
        $verification.data.sourceCommit -ne $SourceCommit.ToLowerInvariant() -or
        $verification.data.packageSha256 -ne $PackageSha256.ToLowerInvariant() -or
        [int]$verification.data.caseCount -ne $cases.Count -or
        (Get-Sha256 ([IO.File]::ReadAllBytes($temporary))) -ne $bodyHash) {
        throw 'Verifier CLI response is not bound to the generated evidence.'
    }
    if ((Get-Sha256 ([IO.File]::ReadAllBytes($uatAuthorizationPath))) -ne
            $uatAuthorizationHash -or
        (Get-Sha256 ([IO.File]::ReadAllBytes($runtimePath))) -ne $runtimeHash -or
        (Get-Sha256 ([IO.File]::ReadAllBytes($casesPath))) -ne $casesHash -or
        (Get-Sha256 ([IO.File]::ReadAllBytes($cliPath))) -ne $cliHash) {
        throw 'A locked evidence input changed during final verification.'
    }
    [IO.File]::Move($temporary, $target)
    $published = $true
}
finally {
    if (-not $published -and [IO.File]::Exists($temporary)) {
        [IO.File]::Delete($temporary)
    }
}

[ordered]@{
    outputFile = $target
    workflow = $Workflow
    moduleCode = $ModuleCode
    accountBook = $AccountBook
    subSystemId = $SubSystemId
    sourceCommit = $SourceCommit.ToLowerInvariant()
    packageSha256 = $PackageSha256.ToLowerInvariant()
    runtimeConfigurationSha256 = $runtimeHash
    runtimeCliVersion = $runtimeCliVersion
    runtimeCliSha256 = $runtimeCliSha256
    runtimeCliSignerThumbprint = $runtimeCliSigner
    uatAuthorizationSourceSha256 = [string]$uatVerification.data.sourceSha256
    uatAuthorizationContentSha256 = [string]$uatVerification.data.contentSha256
    uatAuthorizationIdSha256 = [string]$uatVerification.data.authorizationIdSha256
    contentSha256 = $contentHash
    caseCount = $cases.Count
    testedAtUtc = $testedAt.ToString('o')
    nextStep = 'Run lserp-cli adapters verify-write-integration-evidence, then sign the workflow acceptance manifest.'
} | ConvertTo-Json -Depth 5