"""Fetch pinned official reference engine, without install scripts or production changes."""
from pathlib import Path
import base64, hashlib, io, json, tarfile, urllib.request

root = Path(__file__).resolve().parent / 'elk-reference-20260925'
root.mkdir(exist_ok=False)
url = 'https://registry.npmjs.org/elkjs/0.12.0'
metadata_raw = urllib.request.urlopen(url, timeout=30).read()
metadata = json.loads(metadata_raw)
assert metadata['name'] == 'elkjs' and metadata['version'] == '0.12.0'
tar_url = metadata['dist']['tarball']
assert tar_url == 'https://registry.npmjs.org/elkjs/-/elkjs-0.12.0.tgz'
raw = urllib.request.urlopen(tar_url, timeout=30).read()
expected = 'sha512-YZcKynxVxYoKIOEpywEPwCFdg+BTbxQRNf3pbwdDCvc8O3kQD8bmIwSxKU1eOTVc4Xo+VG9Te+575mlfvOrhEQ=='
actual = 'sha512-' + base64.b64encode(hashlib.sha512(raw).digest()).decode()
assert actual == expected == metadata['dist']['integrity']
(root / 'registry-metadata.json').write_bytes(metadata_raw)
(root / 'elkjs-0.12.0.tgz').write_bytes(raw)
allowed = {'package/lib/elk.bundled.js', 'package/package.json', 'package/LICENSE.md', 'package/README.md'}
members = []
with tarfile.open(fileobj=io.BytesIO(raw), mode='r:gz') as archive:
    for member in archive.getmembers():
        if member.name not in allowed:
            continue
        assert member.isfile()
        data = archive.extractfile(member).read()
        relative = Path(member.name).relative_to('package')
        destination = root / relative
        destination.parent.mkdir(exist_ok=True)
        destination.write_bytes(data)
        members.append({'path': relative.as_posix(), 'bytes': len(data), 'sha256': hashlib.sha256(data).hexdigest()})
assert len(members) == len(allowed)
receipt = {'package': 'elkjs', 'version': '0.12.0', 'registry_url': url, 'tarball_url': tar_url,
           'integrity': actual, 'tarball_sha256': hashlib.sha256(raw).hexdigest(),
           'license': metadata['license'], 'members': members, 'scope': 'Isolated reference experiment; no install scripts or production dependency.'}
(root / 'dependency-receipt.json').write_text(json.dumps(receipt, indent=2)+'\n', encoding='utf-8')
print(json.dumps(receipt))