"""Package current sources, never environment/data/build outputs; validate every shipped hash."""
from pathlib import Path
import os, json, hashlib, zipfile, datetime
root = Path(__file__).resolve().parent.parent
output = root / 'justice-choice-production.zip'
excluded_dirs = {'node_modules', 'dist', '.next', '.git', '.agents', '.codex', '.aws', '.docker', 'coverage', '.cache', 'cache', 'uploads', 'releases', 'artifacts', 'verification-artifacts', 'public-sitemaps', '__pycache__'}
files = []
for directory, directories, names in os.walk(root):
    directories[:] = sorted(d for d in directories if d not in excluded_dirs and not (Path(directory) / d).is_symlink())
    for name in sorted(names):
        path = Path(directory) / name
        if path.is_symlink() or name == 'RELEASE-MANIFEST.json' or name.endswith(('.zip', '.log', '.tsbuildinfo', '.pyc')) or (name.startswith('.env') and name != '.env.example'):
            continue
        files.append(path)
files.sort(key=lambda p: p.relative_to(root).as_posix())
entries = [{'path': p.relative_to(root).as_posix(), 'bytes': p.stat().st_size, 'sha256': hashlib.sha256(p.read_bytes()).hexdigest()} for p in files]
manifest = {'release': 'Justice Choice production readiness', 'base': 'V2 justice-choice2.zip', 'generatedAt': datetime.datetime.now(datetime.timezone.utc).isoformat(), 'algorithm': 'SHA-256', 'fileCountExcludingManifest': len(entries), 'selfHashExcluded': True, 'excluded': sorted(excluded_dirs) + ['.env secrets', '*.zip', '*.log', '*.tsbuildinfo'], 'files': entries}
manifest_path = root / 'RELEASE-MANIFEST.json'
manifest_path.write_text(json.dumps(manifest, indent=2) + '\n', encoding='utf-8')
with zipfile.ZipFile(output, 'w', zipfile.ZIP_DEFLATED, compresslevel=9) as archive:
    for path in files + [manifest_path]:
        archive.write(path, 'justice-choice/' + path.relative_to(root).as_posix())
with zipfile.ZipFile(output) as archive:
    assert archive.testzip() is None
    assert set(archive.namelist()) == {'justice-choice/' + e['path'] for e in entries} | {'justice-choice/RELEASE-MANIFEST.json'}
    for entry in entries:
        assert hashlib.sha256(archive.read('justice-choice/' + entry['path'])).hexdigest() == entry['sha256'], entry['path']
print(json.dumps({'archive': output.name, 'files': len(entries) + 1, 'bytes': output.stat().st_size, 'sha256': hashlib.sha256(output.read_bytes()).hexdigest(), 'crcAndAllFileHashesVerified': True}))