"""Package explicitly named closed Process native runs; never execute archived helpers."""
from pathlib import Path
import argparse
import io
import json
import re
import zipfile
from verify import pin, parsed, need, norm, relative, safe, zip_inventory, verify_data, verify_package

HERE = Path(__file__).resolve().parent
FAILED_RUN_ONE = "Observed Back restored qualified highlight with outer-reference editable Properties; reorder and Undo/Redo/reopen history were not performed. Failed native workflow, despite three positive unchanged Project reports."


def collect(root, runs, extra_helpers=()):
    native = root / ".local/process-multiselect-native"
    candidates = [p for p in native.iterdir() if p.is_file()]
    candidates += sorted((root / ".local/process-group-gates").glob("*.py"))
    candidates += list(extra_helpers)
    helpers = [(p.suffix, p.read_bytes()) for p in candidates]
    payload, specs = {}, {}
    def add(name, data):
        need(safe(name) and (name not in payload or payload[name] == data), "member collision: " + name)
        payload[name] = data
        return name
    def helper(expected):
        matches = [(suffix, data) for suffix, data in helpers if pin(data) == expected]
        need(matches, "exact historical helper unavailable: " + str(expected))
        suffix, data = matches[0]
        return add("helpers/" + expected["sha256"] + suffix, data)
    def tree(folder, prefix):
        need(folder.is_dir(), "missing directory: " + str(folder))
        for path in sorted(folder.rglob("*")):
            need(not path.is_symlink() and not getattr(path, "is_junction", lambda: False)(), "linked evidence input")
            if path.is_file():
                add(prefix + path.relative_to(folder).as_posix(), path.read_bytes())
    for run in runs:
        folder = native / run
        need((folder / "finished.json").is_file(), "open/unlaunched run refused: " + run)
        prepared = parsed((folder / "prepared.json").read_bytes())
        tree(folder, "runs/" + run + "/raw/")
        spec = {"originalRun": norm(prepared["cwd"]) + "/.local/process-multiselect-native/" + run,
                "reviewStatus": "failed" if run == "run-1" else "unreviewed",
                "reviewNote": FAILED_RUN_ONE if run == "run-1" else "Packaging consistency does not decide native acceptance. Consult the independent parent review.",
                "helpers": {name: helper(expected) for name, expected in prepared["helpers"].items()},
                "executedCapture": pin((folder / "capture-executed.js").read_bytes()), "builds": {}}
        for kind in ("gui", "checker"):
            recorded = prepared[kind]
            rel = relative(recorded["receipt"], prepared["cwd"])
            need(rel.startswith(".local/process-group-gates/") and rel.endswith("/result.json"), "unexpected receipt location")
            receipt = root / rel
            result_data = receipt.read_bytes()
            need(pin(result_data) == recorded["receiptPin"], "historical build receipt changed")
            result = parsed(result_data)
            prefix = "builds/" + pin(result_data)["sha256"] + "/"
            build = {"originalRelative": rel, "helper": helper(result["helper"])}
            for name in ("started.json", "process.json", "result.json", "stdout.log", "stderr.log", "inputs.json", "inputs.zip"):
                data = (receipt.parent / name).read_bytes()
                # Deduplicate source capsules independently of differing build receipts.
                member = ("inputs/" + pin(data)["sha256"] + Path(name).suffix) if name.startswith("inputs.") else prefix + name
                build[name] = add(member, data)
            spec["builds"][kind] = build
            if kind == "checker":
                capsule = payload[build["inputs.zip"]]
                need(pin(capsule) == result["archive"], "historical checker capsule pin")
                inputs = parsed(payload[build["inputs.json"]])
                with zipfile.ZipFile(io.BytesIO(capsule)) as archive:
                    zip_inventory(archive, inputs)
                    source = archive.read("crates/oa-core/examples/process_multiselect_native.rs")
                spec["checkerSource"] = add("checker-source/" + pin(source)["sha256"] + ".rs", source)
        specs[run] = spec
    manifest = {"schema": 1, "kind": "process-multiselect-native", "runs": specs,
                "members": {name: pin(data) for name, data in sorted(payload.items())}}
    return payload, manifest, verify_data(manifest, payload.__getitem__)


def write_json(path, value):
    with path.open("xb") as stream:
        stream.write((json.dumps(value, indent=2) + "\n").encode())


def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--root", type=Path, required=True)
    parser.add_argument("--runs", nargs="+", required=True)
    parser.add_argument("--output", type=Path)
    parser.add_argument("--check-only", action="store_true")
    parser.add_argument("--helper", type=Path, action="append", default=[], help="Exact historical helper bytes if current helper changed")
    args = parser.parse_args()
    need(len(args.runs) == len(set(args.runs)) and all(re.fullmatch(r"run-[0-9]+", name) for name in args.runs), "explicit unique run-N names required")
    need(args.check_only or args.output is not None, "--output or --check-only required")
    if args.output is not None:
        need(not args.output.exists(), "fresh nonexistent output directory required")
    payload, manifest, summary = collect(args.root.resolve(), args.runs, args.helper)
    if args.check_only:
        print("PASS raw consistency; no archive written:", summary)
        return
    out = args.output.resolve()
    out.mkdir(parents=True, exist_ok=False)
    for name in ("prepare.py", "verify.py", "README.md"):
        with (out / name).open("xb") as stream:
            stream.write((HERE / name).read_bytes())
    with zipfile.ZipFile(out / "evidence.zip", "x", compression=zipfile.ZIP_DEFLATED, compresslevel=9) as archive:
        for name, data in sorted(payload.items()):
            info = zipfile.ZipInfo(name, date_time=(2026, 9, 23, 0, 0, 0))
            info.compress_type = zipfile.ZIP_DEFLATED
            info.external_attr = 0o100644 << 16
            archive.writestr(info, data)
    write_json(out / "manifest.json", manifest)
    write_json(out / "files.json", {name: pin((out / name).read_bytes()) for name in ("prepare.py", "verify.py", "README.md", "manifest.json", "evidence.zip")})
    need(verify_package(out) == summary, "written package differs from raw evidence")
    print("PASS package readback:", out, summary)


if __name__ == "__main__":
    main()