"""Read-only SYSDBA role evidence. Password goes only over child stdin."""
import json,getpass,subprocess,sys,os
from target_contract import validate_target,verify_files
from pathlib import Path
if not __debug__:raise SystemExit('Python optimization is forbidden for migration acceptance gates')
if len(sys.argv)!=3:raise SystemExit('Usage: python3 capture_roles.py /absolute/path/to/node private/import.private.json')
node=sys.argv[1];cfgpath=Path(sys.argv[2]).resolve();root=Path(__file__).resolve().parent
cfg=json.loads(cfgpath.read_text());manifest=json.loads((root/'manifest.json').read_text());validate_target(cfg,manifest);verify_files(root,manifest)
password=getpass.getpass('SYSDBA password (not saved): ')
p=subprocess.run([node,str(root/'capture_role_evidence.cjs'),str(cfgpath)],input=json.dumps({'password':password}),text=True);del password
if p.returncode:raise SystemExit(p.returncode)
e=cfgpath.parent/'role-evidence.json';report=json.loads(e.read_text());cfg=json.loads(cfgpath.read_text());assert report['environment']==cfg['environment'] and report['dataset']==cfg['dataset'] and report['host']==cfg['host'] and str(report['port'])==str(cfg['port'])
assert report['passed']and report['user']==cfg['user']and report['build']==cfg['expectedBuild']
cfg['roleEvidenceFile']=str(e);tmp=cfgpath.with_suffix('.tmp')
with tmp.open('x')as f:json.dump(cfg,f,indent=2)
tmp.chmod(0o600);os.replace(tmp,cfgpath);print('Role evidence bound to target configuration; no database changes performed')