"""Freeze or verify exact local Windows integration inputs; no compiler invocation."""
from pathlib import Path
import datetime
import hashlib
import json
import subprocess
import sys
import zipfile

root = Path(__file__).resolve().parent.parent
worktree = root / '.local/canvas-union-ytr83r-20260911'
out = root / '.local/grapheme-fixed-windows-20260911'
manifest = out / 'inputs.json'
paths = sorted(set(subprocess.run(
    ['git', 'ls-files', '-co', '--exclude-standard', '--', 'crates', 'assets',
     'build', '.cargo', 'examples', 'docs', 'harness/fixtures', 'Cargo.toml',
     'Cargo.lock', 'rust-toolchain', 'rust-toolchain.toml'],
    cwd=worktree, capture_output=True, check=True).stdout.decode().splitlines()))
files = []
for name in paths:
    data = (worktree / name).read_bytes()
    files.append({'path': name, 'bytes': len(data),
                  'sha256': hashlib.sha256(data).hexdigest()})
now = datetime.datetime.now(datetime.timezone.utc).isoformat()
if sys.argv[1] == 'freeze':
    assert not manifest.exists() and not (out / 'exact-inputs.zip').exists(), 'Refusing to overwrite an existing input freeze'
    out.mkdir(exist_ok=True)
    with zipfile.ZipFile(out / 'exact-inputs.zip', 'w', zipfile.ZIP_DEFLATED) as archive:
        for item in files:
            archive.write(worktree / item['path'], item['path'])
    record = {'captured_utc': now, 'worktree': str(worktree),
              'baseline': '108b1dd208fabf1dafdafee22554e8fd16288851',
              'peer': 'a31b40d0f8551ed87c8cd66250b9afb4809b3a79',
              'scope': 'Resolved three-file grapheme-shortening candidate on a57 canvas union; Windows-only execution. '
                       'All crate, build, asset, Cargo, example, documentation and fixture inputs.',
              'files': files}
    manifest.write_text(json.dumps(record, indent=2) + '\n', encoding='utf-8')
elif sys.argv[1] in ('verify', 'verify-index', 'verify-head'):
    record = json.loads(manifest.read_bytes())
    assert record['files'] == files, 'Source inventory or bytes changed after freeze'
    if sys.argv[1] != 'verify':
        prefix = ':' if sys.argv[1] == 'verify-index' else 'HEAD:'
        response = subprocess.run(['git', 'cat-file', '--batch'], cwd=worktree,
            input=''.join(prefix + f['path'] + '\n' for f in files).encode(),
            capture_output=True, check=True).stdout
        offset = 0
        for item in files:
            end = response.index(b'\n', offset)
            oid, kind, count = response[offset:end].split()
            assert kind == b'blob', item['path']
            size = int(count)
            data = response[end+1:end+1+size]
            assert size == item['bytes'] and hashlib.sha256(data).hexdigest() == item['sha256'], item['path']
            offset = end + size + 2
        assert offset == len(response)
else:
    raise ValueError('Expected freeze or verify')
print(json.dumps({'mode': sys.argv[1], 'utc': now, 'files': len(files),
                  'bytes': sum(f['bytes'] for f in files),
                  'manifest_sha256': hashlib.sha256(manifest.read_bytes()).hexdigest(),
                  'pass': True}))