"""Read-only verification of this exact private runtime's pinned distributions.

Installed RECORD checks detect inconsistent installation; only the PDFium wheel
comparison below supplies independent pinned artifact provenance. Neither is an
independent attestation of all base package wheels beyond prior provisioning.
"""
import base64
import hashlib
import importlib.metadata
import re
import sys
import zipfile
from pathlib import Path

root = Path(__file__).resolve().parent.parent
runtime = root / '.runtime/windows/python'
site = runtime / 'Lib/site-packages'
if Path(sys.executable).resolve().parent != runtime.resolve():
    raise SystemExit('Use the exact private Windows Python runtime')

names = []
checked = 0
def file_hash(path):
    digest = hashlib.sha256()
    with path.open('rb') as file:
        for chunk in iter(lambda: file.read(1048576), b''): digest.update(chunk)
    return digest.digest()

for filename in ('requirements.lock.txt', 'requirements-macros.lock.txt', 'requirements-pdf.lock.txt'):
    for line in (root / 'apps/inspector' / filename).read_text(encoding='utf-8').splitlines():
        if not line or line.startswith('#'): continue
        match = re.match(r'^([A-Za-z0-9_.-]+)==([^\s]+)\s+--hash=sha256:', line)
        if not match: raise SystemExit('Runtime dependency lock rejected')
        name, version = match.groups()
        distribution = importlib.metadata.distribution(name)
        if distribution.version != version: raise SystemExit('Runtime dependency version mismatch')
        names.append(name)
        for entry in distribution.files or []:
            if entry.hash is None: continue
            path = distribution.locate_file(entry).resolve()
            if not path.is_relative_to(runtime.resolve()) or not path.is_file(): raise SystemExit('Runtime dependency file missing')
            if entry.hash.mode != 'sha256': raise SystemExit('Runtime dependency hash algorithm rejected')
            actual = base64.urlsafe_b64encode(file_hash(path)).decode().rstrip('=')
            if actual != entry.hash.value: raise SystemExit('Runtime dependency file integrity mismatch')
            checked += 1

wheel = root / '.runtime/windows/pypdfium2-5.14.0-py3-none-win_amd64.whl'
expected = '149fd5c6397b8df8bf7911a93506eff0be874f877afe7ac936cf5d37d21a6a06'
if not wheel.is_file() or hashlib.sha256(wheel.read_bytes()).hexdigest() != expected:
    raise SystemExit('Pinned PDFium wheel verification failed')
pdf_files = 0
with zipfile.ZipFile(wheel) as archive:
    for entry in archive.infolist():
        if entry.is_dir() or entry.filename.endswith('.dist-info/RECORD'): continue
        target = (site / entry.filename).resolve()
        if not target.is_relative_to(site.resolve()) or not target.is_file() or target.read_bytes() != archive.read(entry):
            raise SystemExit('Installed PDFium differs from pinned wheel')
        pdf_files += 1
import pypdfium2
if pypdfium2.PYPDFIUM_INFO.api_tag != (5, 14, 0) or pypdfium2.PDFIUM_INFO.flags:
    raise SystemExit('PDFium feature manifest rejected')
licenses = site / 'pypdfium2-5.14.0.dist-info/licenses'
if not (licenses / 'LICENSES/Apache-2.0.txt').is_file() or not (licenses / 'LICENSES/BSD-3-Clause.txt').is_file() or not any((licenses / 'data/windows_x64/BUILD_LICENSES').glob('*')):
    raise SystemExit('PDFium license notices missing')
print(f'Private runtime verified: {len(names)} pinned distributions, {checked} RECORD hashes, {pdf_files} pinned PDFium wheel files; license notices retained.')