#!/usr/bin/env python3
"""Seal currently staged file bytes into a new SHA-256 file; no scientific writes."""
import hashlib
from pathlib import Path
import subprocess

root = Path.cwd()
target = root/"registry/repository-files.sha256"
if target.exists():
    raise RuntimeError("Refusing to overwrite repository seal")
lines = []
for name in sorted(filter(None, subprocess.check_output(["git","ls-files","-z"]).decode().split("\0"))):
    blob = subprocess.check_output(["git","show",":"+name])
    actual = (root/name).read_bytes()
    if blob != actual:
        raise RuntimeError("Staged/worktree bytes differ: "+name)
    lines.append(hashlib.sha256(blob).hexdigest()+"  "+name+"\n")
with target.open("x",encoding="utf-8",newline="\n") as f:
    f.writelines(lines)
print("sealed files:",len(lines))