"""Create a source-only archive and its per-file integrity manifest."""
import hashlib
import json
from pathlib import Path
import re
import sys
import zipfile

ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(ROOT))
from config import VERSION

EXCLUDED = {".git", ".venv", "__pycache__", ".pytest_cache"}
ROOT_EXCLUDED = {".runtime", "outputs", "models", "dist"}
FORBIDDEN = {".pyc", ".wav", ".mp3", ".pt", ".pth", ".safetensors", ".gguf", ".bin", ".zip"}


def eligible(path):
    rel = path.relative_to(ROOT)
    return (path.is_file() and not path.is_symlink() and not EXCLUDED.intersection(rel.parts)
            and rel.parts[0] not in ROOT_EXCLUDED and not rel.parts[0].startswith("pytest-of-")
            and path.suffix not in FORBIDDEN and not path.name.startswith(".env")
            and path.name != "MANIFEST.sha256")


def main():
    files = sorted(p for p in ROOT.rglob("*") if eligible(p))
    included = {p.relative_to(ROOT).as_posix() for p in files}
    for entry in json.loads((ROOT / "vendor-manifest.json").read_text())["files"]:
        if entry["path"] not in included:
            raise ValueError(f"Required upstream source omitted: {entry['path']}")
        if hashlib.sha256((ROOT / entry["path"]).read_bytes()).hexdigest() != entry["sha256"]:
            raise ValueError(f"Unexpected upstream modification: {entry['path']}")
    # Never ship downloaded Hugging Face tokens or developer workspace paths.
    for path in files:
        if path.suffix == ".far":
            assert not path.read_bytes().startswith(b"version https://git-lfs.github.com"), path
            continue
        data = path.read_bytes()
        if str(ROOT).encode() in data:
            raise ValueError(f"Developer workspace path in {path.relative_to(ROOT)}")
        if re.search(rb"hf_[A-Za-z0-9]{30,}", data):
            raise ValueError(f"Potential token in {path.relative_to(ROOT)}")
    manifest = ROOT / "MANIFEST.sha256"
    manifest.write_text("".join(f"{hashlib.sha256(p.read_bytes()).hexdigest()}  {p.relative_to(ROOT).as_posix()}\n" for p in files))
    files.append(manifest)
    output = Path(sys.argv[1]).resolve() if len(sys.argv)>1 else ROOT.parent / f"zonos3-mini-zerogpu-v{VERSION}.zip"
    with zipfile.ZipFile(output, "w", compression=zipfile.ZIP_DEFLATED, compresslevel=9) as archive:
        for path in files:
            info = zipfile.ZipInfo(f"zonos3-mini-space/{path.relative_to(ROOT).as_posix()}", date_time=(2026,11,10,0,0,0))
            info.external_attr = 0o100644 << 16
            info.compress_type = zipfile.ZIP_DEFLATED
            archive.writestr(info, path.read_bytes())
    with zipfile.ZipFile(output) as archive:
        assert archive.testzip() is None
        for line in manifest.read_text().splitlines():
            expected, rel = line.split("  ",1)
            assert hashlib.sha256(archive.read("zonos3-mini-space/"+rel)).hexdigest() == expected
    print(f"{output.name}: {len(files)} files, {output.stat().st_size} bytes, SHA256 {hashlib.sha256(output.read_bytes()).hexdigest()}")


if __name__ == "__main__":
    main()