"""Seal original10+clientheaders; zero4 is a separately authorized future phase."""
import hashlib,json,os,stat
from pathlib import Path
HERE=Path(__file__).resolve().parent
assert not (HERE/'manifest10.json').exists(),'Do not reseal immutable evidence'
rows=[]
for f in sorted(HERE.rglob('*')):
    rel=f.relative_to(HERE)
    if rel.parts[0] in ['zero4','__pycache__']:continue
    assert not f.is_symlink(),str(rel)
    if 'private' in rel.parts:os.chmod(f,0o700 if f.is_dir() else 0o600)
    if f.is_file():
        b=f.read_bytes();rows.append(dict(path=str(rel),bytes=len(b),sha256=hashlib.sha256(b).hexdigest(),mode=oct(stat.S_IMODE(f.stat().st_mode))))
out=dict(scope='original10+clientheaders22 only; zero4 excluded',files=rows)
out['seal_sha256']=hashlib.sha256(json.dumps(out,ensure_ascii=False,sort_keys=True,separators=(',',':')).encode()).hexdigest()
target=HERE/'manifest10.json';target.write_text(json.dumps(out,ensure_ascii=False,indent=2)+'\n');print(json.dumps(dict(files=len(rows),manifest_file_sha256=hashlib.sha256(target.read_bytes()).hexdigest(),canonical_seal_sha256=out['seal_sha256'])))