"""Check installed locked graph, notices, browser backend and reviewed source reuse."""
import hashlib
import json
from pathlib import Path

root = Path(__file__).resolve().parent
lock = json.loads((root / 'package-lock.json').read_text())['packages']
manifest = json.loads((root / 'package.json').read_text())
inventory = (root / 'LICENSE_INVENTORY.md').read_text()
notices = (root / 'THIRD_PARTY_NOTICES.md').read_text()
for section in ('dependencies', 'devDependencies'):
    for name, version in manifest[section].items():
        assert lock['node_modules/' + name]['version'] == version
installed = 0
for path, entry in lock.items():
    if not path:
        continue
    name = path.split('node_modules/')[-1]
    assert entry['resolved'].startswith('https://registry.npmjs.org/')
    assert entry['integrity'].startswith('sha512-')
    assert f"| {name} | {entry['version']} | {entry['license']} |" in inventory
    package = root / path
    if not package.exists():
        assert entry.get('optional'), name
        continue
    meta = json.loads((package / 'package.json').read_text())
    assert meta['version'] == entry['version']
    assert meta['license'] == entry['license']
    licenses = [f for f in package.iterdir() if f.is_file() and
                ('license' in f.name.lower() or f.name.lower().startswith(('notice', 'copying')))]
    if name == 'saxes':
        licenses = [root / 'licenses/saxes-6.0.0-LICENSE']
    if not licenses and name.startswith('@rolldown/binding-'):
        licenses = [root / 'node_modules/rolldown/LICENSE', root / 'node_modules/rolldown/THIRD-PARTY-LICENSE']
    assert licenses, name
    for file in licenses:
        assert file.read_text().rstrip() in notices, file
    installed += 1
# Independently installed, reviewed locked vendor graph, read only.
original = root.parent / 'environment-access/node_modules/stanza'
current = root / 'node_modules/stanza'
files = {f.relative_to(current) for f in current.rglob('*') if f.is_file()}
assert files == {f.relative_to(original) for f in original.rglob('*') if f.is_file()}
for file in files:
    assert (current / file).read_bytes() == (original / file).read_bytes(), file
for local, reviewed in [('bounded-ingress.mjs', 'parser-validation/bounded-ingress.mjs'),
                        ('sha512-mechanism.mjs', 'sha512-validation/sha512-mechanism.mjs'),
                        ('licenses/saxes-6.0.0-LICENSE', 'parser-validation/licenses/saxes-6.0.0-LICENSE')]:
    assert (root / local).read_bytes() == (root.parent / reviewed).read_bytes(), local
modules = json.loads((root / 'dist/modules.json').read_text())
assert any(x.endswith('/stanza/platform/browser/crypto/Hmac.js') for x in modules)
assert not any('/platform/node/' in x or x.startswith('node:') or 'browser-external' in x for x in modules)
print(f'{len(lock)-1} locked / {installed} installed packages; notices verified; {len(files)} unchanged Stanza files; reviewed parser/alias reused; browser backend')
for file in ['package-lock.json', 'validated-sasl.mjs', 'dist/browser.mjs']:
    print(file, hashlib.sha256((root / file).read_bytes()).hexdigest())