import hashlib
import json
from pathlib import Path

ROOT = Path(__file__).resolve().parent

def scan_headers(value):
    if isinstance(value, dict):
        if value.get('key') == 'Access-Token':
            assert value['value'].startswith('{{') and value['value'].endswith('}}'), 'Live token in public artifact'
        for v in value.values(): scan_headers(v)
    elif isinstance(value, list):
        for v in value: scan_headers(v)

def main():
    hashes = {}
    for file in sorted(ROOT.rglob('*')):
        if not file.is_file() or any(x in {'private-evidence', '__pycache__'} for x in file.parts) or file.name in {'manifest.json', 'MANIFEST.sha256'}: continue
        if file.suffix == '.json': scan_headers(json.loads(file.read_text()))
        hashes[str(file.relative_to(ROOT))] = hashlib.sha256(file.read_bytes()).hexdigest()
    resources = {k: json.loads((ROOT / ('resource-cleanup-' + k + '.json')).read_text()) for k in ['B', 'C']}
    assert all(v['worker_stopped'] and v['port_closed'] and v['cache_files'] == 0 for v in resources.values())
    manifests = {
        'task': 'ZHCTPROMPT-20260928-SMART-CANTEEN-DUAL-DB-COMPAT-PLAN',
        'slice': 'parallel-ai-market-sign-config-20261010',
        'scope': '10 ai_api store/terminal market.Sign methods, partial DB scenarios',
        'source_head': 'bb530e9b78894faa0f83d0d92416a152a468b1c2',
        'actual_business_HTTP': 110,
        'actual_business_named_assertions': 470,
        'initial_business_failed_assertions_retained': 11,
        'separate_native_tool_initialization_HTTP': 4,
        'separate_native_tool_initialization_failed_assertions': 16,
        'strict_full_body_pairs': 33,
        'final_original_projection_reads': 6,
        'own_DML': 70,
        'global_DML': 0,
        'DDL': 0,
        'external_network_sent': False,
        'real_WeChat_QR_OSS_acceptance': False,
        'private_credential_free_terminal_evidence': {k: v['credential_free_terminal_evidence'] for k, v in resources.items()},
        'private_evidence_local_copy': 'private-evidence/ (ignored, no raw credentials; not in public SHA set)',
        'hashes': hashes,
    }
    (ROOT / 'manifest.json').write_text(json.dumps(manifests, ensure_ascii=False, indent=2) + '\n')
    sha = hashlib.sha256((ROOT / 'manifest.json').read_bytes()).hexdigest()
    (ROOT / 'MANIFEST.sha256').write_text(sha + '  manifest.json\n' + ''.join(v + '  ' + k + '\n' for k, v in hashes.items()))
    print(json.dumps({'public_files': len(hashes), 'manifest_sha256': sha, 'private_evidence_excluded': True}))

if __name__ == '__main__': main()