<?php
declare(strict_types=1);

// Reuses only the pinned nonproduction Store worker environment in memory.
$mode = (string)($argv[1] ?? '');
if (!in_array($mode, ['--preflight', '--execute', '--audit'], true)
    || count($argv) !== 2
    || ($mode === '--execute' && (string)getenv('CDX_EM_C_LUNCH_RELEASE')
        !== 'ROOT_RELEASED_C_LUNCH_RIGHT_PREVIEW_V1')) {
    echo json_encode(['status' => 'default_deny', 'http_sent' => false]), PHP_EOL;
    exit(78);
}
$workerPid = 112175;
$cmdline = (string)@file_get_contents('/proc/' . $workerPid . '/cmdline');
if (strpos($cmdline, '/tmp/zhct-dm-poc-20260928.fcpiiN/store/public') === false
    || strpos($cmdline, '127.0.0.1:18080') === false) {
    throw new RuntimeException('C isolated listener drift');
}
$env = [];
foreach (explode("\0", (string)@file_get_contents('/proc/' . $workerPid . '/environ')) as $entry) {
    $at = strpos($entry, '=');
    if ($at !== false) $env[substr($entry, 0, $at)] = substr($entry, $at + 1);
}
$servicePath = (string)($env['DM_SVC_PATH'] ?? '');
if (($env['POC_PORT'] ?? '') !== '5237'
    || ($env['POC_SCHEMA'] ?? '') !== 'ZHCT_APP'
    || substr(hash('sha256', $servicePath), 0, 12) !== '5a92d26aec07'
    || !is_file($servicePath . '/dm_svc.conf')
    || strpos((string)file_get_contents($servicePath . '/dm_svc.conf'),
        'CHAR_CODE=(PG_UTF8)') === false) {
    throw new RuntimeException('C client boundary drift');
}
$directory = __DIR__;
$runner = $directory . '/runner.php';
$expectedSha = '3b0e41c8056b2f7f9f2004ca7333708de972e88383cf9ee69eff943b585ab990';
if (is_link($directory) || is_link($runner) || !is_file($runner)
    || (fileperms($directory) & 0777) !== 0700
    || (fileperms($runner) & 0777) !== 0600
    || hash_file('sha256', $runner) !== $expectedSha) {
    throw new RuntimeException('C private runner drift');
}
if ($mode === '--execute') {
    $env['CDX_EM_LUNCH_APPROVE'] = 'ROOT_RELEASED_C_LUNCH_RIGHT_PREVIEW_V1';
    $env['CDX_EM_LUNCH_SHA'] = $expectedSha;
    $env['CDX_EM_LUNCH_SOURCE_SHA'] = (string)getenv('CDX_EM_C_LUNCH_SOURCE_SHA');
} elseif ($mode === '--audit') {
    $env['CDX_EM_LUNCH_AUDIT_SHA'] = $expectedSha;
}
$command = escapeshellarg('/www/server/php/73/bin/php')
    . ' -d display_errors=0 -d log_errors=0'
    . ' -d extension=/home/dmdba/dmdbms/drivers/php_pdo/php73_pdo_dm.so'
    . ' ' . escapeshellarg($runner) . ' ' . escapeshellarg($mode);
$process = proc_open($command, [1 => ['pipe', 'w'], 2 => ['pipe', 'w']],
    $pipes, null, $env);
if (!is_resource($process)) throw new RuntimeException('C child unavailable');
$stdout = stream_get_contents($pipes[1]);
$stderr = stream_get_contents($pipes[2]);
fclose($pipes[1]);
fclose($pipes[2]);
$exit = proc_close($process);
$result = json_decode((string)$stdout, true);
if (!is_array($result)) {
    echo json_encode(['status' => 'redacted_child_error', 'exit' => $exit,
        'stderr' => $stderr === '' ? 'empty' : 'nonempty']), PHP_EOL;
    exit($exit === 0 ? 2 : $exit);
}
echo json_encode(['exit' => $exit, 'result' => $result,
    'stderr' => $stderr === '' ? 'empty' : 'nonempty'], JSON_UNESCAPED_SLASHES), PHP_EOL;
exit($exit);