import fs from 'node:fs';
import path from 'node:path';
import os from 'node:os';
import crypto from 'node:crypto';
import {spawnSync} from 'node:child_process';
import {fileURLToPath} from 'node:url';
const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..'),archive=path.join(path.dirname(root),'Ankra-Redesign-2026-09-08.zip');
const taskTemp=fs.mkdtempSync(path.join(os.tmpdir(),'ankra-handoff-check-'));
const unzip=spawnSync('unzip',['-q',archive,'-d',taskTemp],{encoding:'utf8'});if(unzip.status!==0)throw new Error(unzip.stderr||'Archive extraction failed');
const unpacked=path.join(taskTemp,'ankra-next'),manifest=JSON.parse(fs.readFileSync(path.join(unpacked,'PACKAGE-MANIFEST.json'),'utf8'));
const sha=file=>crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
for(const entry of manifest.files)if(sha(path.join(unpacked,entry.path))!==entry.sha256)throw new Error('Checksum mismatch: '+entry.path);
const auditFiles=fs.readdirSync(path.join(unpacked,'audit'));if(auditFiles.some(x=>x.includes('live-structure')||x.includes('source-inventory')))throw new Error('Private evidence found in archive');
const before=sha(path.join(unpacked,'ANKRA-COMPLETE-BOARD.svg'));
const rebuild=spawnSync(process.execPath,['scripts/build.mjs'],{cwd:unpacked,encoding:'utf8'});if(rebuild.status!==0)throw new Error(rebuild.stderr||'Standalone rebuild failed');
if(before!==sha(path.join(unpacked,'ANKRA-COMPLETE-BOARD.svg')))throw new Error('Standalone board rebuild is not deterministic');
console.log(JSON.stringify({verifiedChecksums:manifest.files.length,privateEvidenceExcluded:true,standaloneRebuildPassed:true,boardRebuildIdentical:true,archiveBytes:fs.statSync(archive).size},null,2));
