"""Verify exact installed pins/notices, immutable vendor files and browser graph."""
import hashlib
import json
from pathlib import Path

root = Path(__file__).resolve().parent
lock = json.loads((root / 'package-lock.json').read_text())
manifest = json.loads((root / 'package.json').read_text())
inventory = (root / 'LICENSE_INVENTORY.md').read_text()
notices = (root / 'THIRD_PARTY_NOTICES.md').read_text()
installed = 0
for section in ['dependencies', 'devDependencies']:
    for name, version in manifest[section].items():
        assert lock['packages']['node_modules/' + name]['version'] == version
for path, entry in lock['packages'].items():
    if not path:
        continue
    name = path.split('node_modules/')[-1]
    assert entry['resolved'].startswith('https://registry.npmjs.org/')
    assert entry['integrity'].startswith('sha512-')
    assert f"| {name} | {entry['version']} | {entry['license']} |" in inventory
    package = root / path
    if not package.exists():
        assert entry.get('optional'), name
        continue
    meta = json.loads((package / 'package.json').read_text())
    assert meta['version'] == entry['version'], name
    assert meta['license'] == entry['license'], name
    licenses = [f for f in package.iterdir() if f.is_file() and
                ('license' in f.name.lower() or f.name.lower().startswith(('copying', 'notice')))]
    if name == '@rolldown/binding-darwin-arm64':
        assert not licenses
        licenses = [root / 'node_modules/rolldown/LICENSE',
                    root / 'node_modules/rolldown/THIRD-PARTY-LICENSE']
    assert licenses, name
    for file in licenses:
        assert file.read_text().rstrip() in notices, file
    installed += 1
# Parent is read-only evidence of unmodified pinned candidate, not a dependency.
original = root.parent / 'node_modules/stanza'
current = root / 'node_modules/stanza'
files = [f for f in current.rglob('*') if f.is_file()]
assert {f.relative_to(current) for f in files} == {
    f.relative_to(original) for f in original.rglob('*') if f.is_file()}
for file in files:
    assert file.read_bytes() == (original / file.relative_to(current)).read_bytes(), file
modules = json.loads((root / 'dist/modules.json').read_text())
assert any(x.endswith('/stanza/platform/browser/crypto/Hmac.js') for x in modules)
assert not any('/platform/node/' in x or x.startswith('node:') or 'browser-external' in x for x in modules)
print(f"{len(lock['packages']) - 1} locked entries; {installed} installed licenses/pins; "
      f"{len(files)} unchanged Stanza files; browser backend confirmed")
for name in ['package-lock.json', 'sha512-mechanism.mjs', 'validated-sasl.mjs',
             'test/scramp-vectors.json', 'dist/browser.mjs', 'dist/modules.json']:
    print(name, hashlib.sha256((root / name).read_bytes()).hexdigest())