# ============================================================
# 审计完整性告警 v1（moduleId: core-audit-alerts, 可重生 ✅）
# plan.md §3.6 / 矩阵「全审计」：链/锚定/镜像异常的聚合告警
# ============================================================
from __future__ import annotations                    # 前向类型引用

from typing import Any                                 # 类型标注


def build_alerts(chain: dict[str, Any], anchor: dict[str, Any],
                 source: str = "world") -> list[dict[str, str]]:
    """聚合审计完整性告警（纯只读；正常态返回空数组）。

    触发条件：
    - 链校验失败（critical）
    - 锚定不匹配 / 未锚定（warning）
    - 镜像源异常（warning）
    """
    alerts: list[dict[str, str]] = []
    if not chain.get("ok"):
        alerts.append({
            "code": "AUDIT_CHAIN_BROKEN",
            "severity": "critical",
            "message": f"审计哈希链断裂于事件 #{chain.get('brokenAt')}（已校验 {chain.get('checked')} 条）",
        })
    if anchor.get("reason") == "mismatch":
        alerts.append({
            "code": "AUDIT_ANCHOR_MISMATCH",
            "severity": "warning",
            "message": "独立介质锚定根与当前事件不一致（可能被篡改）",
        })
    elif anchor.get("reason") == "not-anchored":
        alerts.append({
            "code": "AUDIT_NOT_ANCHORED",
            "severity": "info",
            "message": "审计事件尚未锚定到独立介质",
        })
    elif anchor.get("reason") == "corrupt-ledger":
        alerts.append({
            "code": "AUDIT_LEDGER_CORRUPT",
            "severity": "critical",
            "message": "审计账本文件损坏",
        })
    if source != "mirror":
        alerts.append({
            "code": "AUDIT_SOURCE_WORLD",
            "severity": "info",
            "message": "审计事件源为世界状态（镜像源不可用/未启用）",
        })
    return alerts