"""Generate checksums for this publication only, after real download success."""
from datetime import datetime, timezone
import json
from pathlib import Path
import subprocess

from publish_archives import canonical, no_links, sha_file, write_new


def main():
    root = no_links(Path.cwd())
    protected = Path('/data/digital-drosophila')
    if root == protected or protected in root.parents or not (root / '.git').is_dir():
        raise ValueError('Only an isolated publication checkout is allowed')
    folder = root / 'registry/publication-20261001'
    output, checksums = folder / 'publication-manifest.json', folder / 'SHA256SUMS'
    if output.exists() or checksums.exists():
        raise ValueError('Never overwrite a publication manifest')
    transport = json.loads((folder / 'fresh-download-verification.json').read_bytes())
    guard = json.loads((folder / 'source-guard-final.json').read_bytes())
    head = subprocess.check_output(['git', 'rev-parse', 'HEAD'], text=True).strip()
    if not (transport['pass_all'] and transport['fresh_download_proven'] and guard['pass_all']
            and transport['expected_commit'] == head):
        raise ValueError('Actual transport/source evidence or commit binding is missing')
    files = [root / p for p in ('.gitattributes', '.gitignore', 'NOTICE.md')]
    for prefix in ('artifacts/public-resources-20261001', 'artifacts/lfs-smoke',
                   'registry/publication-20261001', 'tools/lfs-publication'):
        for p in (root / prefix).rglob('*'):
            no_links(p)
            if '__pycache__' not in p.parts and p.is_file():
                files.append(p)
    rows = [dict(path=p.relative_to(root).as_posix(), **sha_file(p)) for p in sorted(files)]
    if len({row['path'] for row in rows}) != len(rows):
        raise ValueError('Duplicate publication path')
    manifest = dict(schema='lfs-publication-final-manifest-v1', pass_all=True,
                    generated_utc=datetime.now(timezone.utc).isoformat(), data_commit=head,
                    branch='codex/lfs-public-resources', repository_public=True,
                    aggregate_inventory_sha256=transport['aggregate_inventory_sha256'],
                    logical_files=len(rows), logical_bytes=sum(r['bytes'] for r in rows),
                    files=rows,
                    scope='Publication payload, tools, notices and evidence only; original file SHA are nested in members.jsonl.gz. Not an entire server backup or scientific pass.',
                    self_hash_policy='Manifest is covered by SHA256SUMS; SHA256SUMS self-hash is omitted and its bytes are bound by the final Git commit.')
    write_new(output, canonical(manifest))
    rows.append(dict(path=output.relative_to(root).as_posix(), **sha_file(output)))
    write_new(checksums, ''.join(r['sha256'] + '  ' + r['path'] + '\n' for r in sorted(rows, key=lambda r: r['path'])).encode())
    print(json.dumps(dict(pass_all=True, files=len(rows), manifest=sha_file(output), checksums=sha_file(checksums))))


if __name__ == '__main__':
    main()