import hashlib,json,os,stat,sys
from pathlib import Path
P=Path(__file__).resolve().parent
exclude={'manifest.json','MANIFEST.sha256'}
def entries():
    public={};private={}
    for path in sorted(P.rglob('*')):
        rel=path.relative_to(P).as_posix()
        if '__pycache__' in path.parts or path.is_dir():continue
        assert not path.is_symlink(),('link',rel)
        if rel in exclude:continue
        assert 'source/' not in rel and not rel.endswith('/tokens.json'),('active_source_or_token',rel)
        record={'bytes':path.stat().st_size,'sha256':hashlib.sha256(path.read_bytes()).hexdigest()}
        if rel.startswith('private/'):
            assert stat.S_IMODE(path.stat().st_mode)==0o600,('private_mode',rel)
            private[rel]=record
        else:public[rel]=record
    for path in (P/'private').rglob('*'):
        if path.is_dir():assert stat.S_IMODE(path.stat().st_mode)==0o700,('private_directory_mode',str(path))
    assert stat.S_IMODE((P/'private').stat().st_mode)==0o700
    return {'public':public,'private':private}
if '--verify' in sys.argv:
    expected=json.loads((P/'manifest.json').read_text());actual=entries();assert actual['public']==expected['public'] and actual['private']==expected['private']
    assert (P/'MANIFEST.sha256').read_text()==hashlib.sha256((P/'manifest.json').read_bytes()).hexdigest()+'  manifest.json\n'
    print(json.dumps({'seal_valid':True,'public_files':len(actual['public']),'private_files':len(actual['private'])}))
else:
    assert not (P/'manifest.json').exists(),'Do not overwrite sealed evidence'
    value=entries();value['scope']={'actual_HTTP_B':21,'actual_HTTP_C':20,'formal_rope_INSERT_per_lane':4,'prepared_Store_INSERT_per_lane':2,'source_files_unchanged':6168,'business_DDL':0,'business_UPDATE_DELETE':0,'slice_main_changes':0,'new_interface_keys':0}
    data=json.dumps(value,ensure_ascii=False,indent=2)+'\n';(P/'manifest.json').write_text(data);digest=hashlib.sha256(data.encode()).hexdigest();(P/'MANIFEST.sha256').write_text(digest+'  manifest.json\n');print(json.dumps({'seal_sha256':digest,'public_files':len(value['public']),'private_files':len(value['private'])}))