"""Check exact installed graph, preserved notices, and unchanged candidate files."""
import hashlib
import json
from pathlib import Path

root = Path(__file__).resolve().parent
lock = json.loads((root / 'package-lock.json').read_text())
manifest = json.loads((root / 'package.json').read_text())
assert manifest['engines'] == {'node': '24.21.0', 'npm': '11.19.0'}
assert manifest['dependencies'] == {'saxes': '6.0.0', 'stanza': '12.22.1', 'xmlchars': '2.2.0'}
notices = (root / 'THIRD_PARTY_NOTICES.md').read_text()
inventory = (root / 'LICENSE_INVENTORY.md').read_text()
count = 0
for key, entry in lock['packages'].items():
    if not key:
        continue
    count += 1
    assert entry['resolved'].startswith('https://registry.npmjs.org/')
    assert entry['integrity'].startswith('sha512-')
    installed = root / key
    meta = json.loads((installed / 'package.json').read_text())
    assert meta['version'] == entry['version']
    assert meta['license'] == entry['license']
    assert f"| {meta['name']} | {meta['version']} | {meta['license']} |" in inventory
    files = [p for p in installed.iterdir() if p.is_file() and
             (p.name.lower().startswith('license') or p.name.lower().startswith('notice'))]
    if meta['name'] == 'saxes':
        files = [root / 'licenses/saxes-6.0.0-LICENSE']
    assert files
    for path in files:
        assert path.read_text().strip() in notices
assert count == 10
# Independent previously installed candidate; no ignored vendor patches.
candidate = root / 'node_modules/stanza'
original = root.parent / 'node_modules/stanza'
files = [p for p in candidate.rglob('*') if p.is_file()]
assert files
for path in files:
    assert path.read_bytes() == (original / path.relative_to(candidate)).read_bytes(), path
print(f'{count} exact dependency licenses/integrities; {len(files)} unchanged Stanza files')
for name in ['package-lock.json', 'bounded-ingress.mjs', 'licenses/saxes-6.0.0-LICENSE']:
    print(f'{name} SHA256 {hashlib.sha256((root / name).read_bytes()).hexdigest()}')