# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/which-software-bill-of-materials-sbom-attestations-must-be-sealed-into-a-session-residual-before-deployment.md
# Remnant Warrant:    https://corpusfetch.com/c/which-software-bill-of-materials-sbom-attestations-must-be-sealed-into-a-session-residual-before-deployment.warrant.json
# Markdown SHA-256:   967ac3d0993a4ddbeda136f0f8f1eae4ececde0be68d69c955ce222637a6460f
# Code AST SHA-256:   dd483c1723186b91a09959926296d778921c26c5032f30e4f18dc9025b4515d0
# Verified Classes:   SBOMPresence, SBOMContext, ExpectedDependency, SBOMManifest, SBOMIntegrityGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class SBOMPresence(Enum):
    SEALED_AND_VALID = auto()
    MISSING = auto()
    TAMPERED = auto()

@dataclass(frozen=True)
class SBOMContext:
    sbom_hash: str
    builder_provenance_hash: str
    transitive_deps: tuple[tuple[str, str], ...]  # (name, version)

@dataclass(frozen=True)
class ExpectedDependency:
    name: str
    allowed_versions: frozenset[str]

@dataclass(frozen=True)
class SBOMManifest:
    presence: SBOMPresence
    violations: tuple[str, ...]
    manifest_digest: str

class SBOMIntegrityGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def verify_artifact_sbom(
        cls, context: SBOMContext, expected_deps: tuple[ExpectedDependency, ...]
    ) -> SBOMManifest:
        
        if not context.sbom_hash.strip():
            return SBOMManifest(SBOMPresence.MISSING, ("NO_SBOM_HASH",), cls._hash("MISSING"))
            
        if not context.builder_provenance_hash.strip():
            return SBOMManifest(SBOMPresence.MISSING, ("NO_PROVENANCE",), cls._hash("NO_PROV"))

        violations = []
        expected_map = {d.name: d.allowed_versions for d in expected_deps}

        # Gate 1: Verify all transitive dependencies are explicitly allowed
        for name, version in context.transitive_deps:
            if name not in expected_map:
                violations.append(f"UNKNOWN_DEP:{name}@{version}")
            elif version not in expected_map[name]:
                violations.append(f"VERSION_VIOLATION:{name}@{version}")

        if violations:
            digest = cls._hash(json.dumps({"violations": tuple(sorted(violations))}, sort_keys=True))
            return SBOMManifest(SBOMPresence.TAMPERED, tuple(violations), digest)

        digest = cls._hash(json.dumps({"sbom": context.sbom_hash, "prov": context.builder_provenance_hash}, sort_keys=True))
        return SBOMManifest(SBOMPresence.SEALED_AND_VALID, tuple(), digest)