#!/usr/bin/env python3
# Week 34 Sandbox Challenge: policy provenance + coverage inventory for cloudbeat,
# no cloud credentials needed. Run with cwd = the cloudbeat checkout.
from pathlib import Path
from collections import Counter
import hashlib, json, re, sys

root = Path('security-policies')
files = sorted(p for p in root.rglob('*') if p.is_file())
extensions = Counter(p.suffix.lower() or '<none>' for p in files)
providers = Counter()
terms = {
    'aws': re.compile(r'aws', re.I),
    'azure': re.compile(r'azure', re.I),
    'gcp': re.compile(r'\bgcp\b|google cloud', re.I),
    'kubernetes': re.compile(r'kubernetes|\bk8s\b', re.I),
}
for p in files:
    text = p.read_text(errors='ignore')
    for name, pattern in terms.items():
        if pattern.search(str(p)) or pattern.search(text):
            providers[name] += 1
manifest = [{'path': str(p), 'bytes': p.stat().st_size,
             'sha256': hashlib.sha256(p.read_bytes()).hexdigest()} for p in files]
out = {
    'policy_root_exists': root.exists(),
    'file_count': len(files),
    'total_bytes': sum(x['bytes'] for x in manifest),
    'extensions': dict(extensions.most_common()),
    'files_mentioning_provider': dict(providers),
    'manifest': manifest,
}
outdir = Path(sys.argv[1] if len(sys.argv) > 1 else '.')
(outdir / 'policy-manifest.json').write_text(json.dumps(out, indent=2) + '\n')
print(json.dumps({k: v for k, v in out.items() if k != 'manifest'}, indent=2))
print('\nLargest policy artifacts:')
for item in sorted(manifest, key=lambda x: x['bytes'], reverse=True)[:10]:
    print(f"{item['bytes']:9d}  {item['path']}  {item['sha256'][:12]}")