from __future__ import annotations

import hashlib
import json
from pathlib import Path


ROOT = Path(__file__).resolve().parent
MANIFEST = ROOT / "manifest.json"


def sha256(path: Path) -> str:
    digest = hashlib.sha256()
    with path.open("rb") as stream:
        for chunk in iter(lambda: stream.read(1024 * 1024), b""):
            digest.update(chunk)
    return digest.hexdigest()


def main() -> int:
    manifest = json.loads(MANIFEST.read_text(encoding="utf-8"))
    expected_files = manifest.get("files", [])
    if not expected_files:
        raise SystemExit("FAIL: empty manifest")
    for item in expected_files:
        path = ROOT / item["path"]
        if not path.is_file():
            raise SystemExit(f"FAIL: missing {item['path']}")
        if sha256(path) != item["sha256"]:
            raise SystemExit(f"FAIL: hash mismatch {item['path']}")
        if path.suffix == ".json" and path.name != "manifest.json":
            payload = json.loads(path.read_text(encoding="utf-8"))
            if payload.get("privacy") != "SANITIZED":
                raise SystemExit(f"FAIL: privacy marker {item['path']}")
            if not payload.get("evidence_id"):
                raise SystemExit(f"FAIL: missing evidence_id {item['path']}")
    print("DRENDA_PUBLIC_EVIDENCE_PACK: PASS")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())