"""Build a deterministic, private source handoff. Never uploads or publishes."""
import gzip
import hashlib
import io
import json
import pathlib
import tarfile

ROOT = pathlib.Path(__file__).resolve().parents[2]
OUT = ROOT / 'packaging'
NAME = 'slow-triage-private-source'
selected = set()

def include(path):
    if path.is_symlink():
        raise ValueError(f'Symlinks are not packaged: {path}')
    if path.is_file():
        selected.add(path.relative_to(ROOT).as_posix())

for directory in ['src', 'public', 'scripts', 'tests', 'data']:
    for path in (ROOT / 'prototype' / directory).rglob('*'):
        if '__pycache__' not in path.parts and path.suffix != '.pyc':
            include(path)
for name in ['README.md', 'LICENSE', 'THIRD_PARTY_NOTICES.md', 'package.json', 'package-lock.json', 'environment.json', '.gitignore', 'models/manifest.json']:
    include(ROOT / 'prototype' / name)
for name in ['evaluation.json', 'dependency-licenses.json', 'pre-evaluation-freeze.sha256', 'pre-evaluation-freeze.txt', 'end-to-end-demo.json', 'ui-dom-checks.cjs', 'ui-dom-report.json', 'verification-summary.json']:
    include(ROOT / 'prototype/evidence' / name)
for path in (ROOT / 'prototype/evidence/cli-demo').glob('*.json'):
    include(path)
for path in (ROOT / 'review').iterdir():
    if path.suffix in {'.md', '.json', '.mjs', '.py', '.csv'}:
        include(path)

files = {name: (ROOT / name).read_bytes() for name in sorted(selected)}
verification = json.loads((ROOT / 'prototype/evidence/verification-summary.json').read_text())
manifest = {
    'status': 'Private preparation only; no publication or entry',
    'archiveRoot': 'slow-triage-private',
    'contains': 'Source, lockfile, synthetic fixtures, measured evidence and independent review',
    'excludes': ['node_modules', 'npm cache', 'model weights (obtain with the pinned verified downloader)', 'private mission/account/chat notes', 'installation/browser-error logs', 'screenshots/video (none recorded)'],
    'originalEvaluationFreezeScope': verification['originalSourceFreezeComparison'],
    'postEvaluationChanges': verification['finalPreparationChanges'],
    'files': {name: {'bytes': len(data), 'sha256': hashlib.sha256(data).hexdigest()} for name, data in files.items()},
}
manifest_bytes = (json.dumps(manifest, indent=2) + '\n').encode()
OUT.mkdir(exist_ok=True)
archive = OUT / f'{NAME}.tar.gz'
with archive.open('wb') as output:
    with gzip.GzipFile(filename='', mode='wb', fileobj=output, mtime=0) as compressed:
        with tarfile.open(fileobj=compressed, mode='w') as tar:
            for name, data in [('PACKAGE_MANIFEST.json', manifest_bytes), *files.items()]:
                info = tarfile.TarInfo('slow-triage-private/' + name)
                info.size = len(data)
                info.mode = 0o644
                info.mtime = 0
                tar.addfile(info, io.BytesIO(data))
digest = hashlib.sha256(archive.read_bytes()).hexdigest()
(OUT / f'{NAME}.manifest.json').write_bytes(manifest_bytes)
(OUT / f'{NAME}.sha256').write_text(f'{digest}  {archive.name}\n')
print(json.dumps({'archive': str(archive), 'bytes': archive.stat().st_size, 'sha256': digest, 'files': len(files)}))