#!/usr/bin/env python3
"""Copy original published ZIP bytes and safe batch records; never regenerate ZIPs."""
from pathlib import Path,PurePosixPath
import hashlib,io,json,re,zipfile
from collections import defaultdict
BASE=Path.cwd();OUT=BASE/'handoff_C479_work/coverage';DEST=OUT/'published_evidence';RECORDS=OUT/'batch_records'
DEST.mkdir(exist_ok=True);RECORDS.mkdir(exist_ok=True)
def sha(b):return hashlib.sha256(b).hexdigest()
def rel(p):return str(p.relative_to(BASE))
def dump(p,x):p.write_text(json.dumps(x,indent=2,ensure_ascii=False)+'\n')
def enum_step(s):
 m=re.match(r'490d_C(\d+)_.*Evidence.*\.zip$',s);return int(m[1]) if m and 266<=int(m[1])<=479 else None
def safe_record(s):return bool(re.fullmatch(r'490d_C\d+(?:_C\d+)?_(?:Reading_Index|Completion_and_Integrity|Access_and_Integrity)_\d+\.(?:json|md)',s))
candidates=defaultdict(list);batch=defaultdict(list)
for folder in ('deliverables','recovery_C423','handoff_C479_work/recovered'):
 for p in sorted((BASE/folder).glob('*')):
  if not p.is_file():continue
  n=enum_step(p.name)
  if n:candidates[n].append({'kind':'file','path':rel(p),'basename':p.name})
  if safe_record(p.name):batch[p.name].append({'kind':'file','path':rel(p),'basename':p.name})
archives=sorted((BASE/'handoff_C479_work/recovered').glob('*Continuation_Archive*.zip'))+sorted((BASE/'deliverables').glob('*Continuation_Archive*.zip'))+[BASE/'recovery_C423/490d_C423_Compact_Restart_Kit_20260924.zip']
for p in archives:
 with zipfile.ZipFile(p) as z:
  for m in z.namelist():
   bn=PurePosixPath(m).name;n=enum_step(bn)
   if n:candidates[n].append({'kind':'archive_member','archive':rel(p),'member':m,'basename':bn})
   if safe_record(bn):batch[bn].append({'kind':'archive_member','archive':rel(p),'member':m,'basename':bn})
def read(c):
 if c['kind']=='file':return (BASE/c['path']).read_bytes()
 with zipfile.ZipFile(BASE/c['archive']) as z:return z.read(c['member'])
coverage={r['number']:r for r in json.loads((OUT/'C266_C479_COVERAGE.json').read_text())['records']};index=[];missing=[]
for n in range(266,480):
 cs=candidates[n]
 if not cs:missing.append(n);continue
 c=cs[0];data=read(c);p=DEST/c['basename']
 with zipfile.ZipFile(io.BytesIO(data)) as z:
  bad=z.testzip();assert bad is None,(n,bad)
  certs=[(name,json.loads(z.read(name))) for name in z.namelist() if PurePosixPath(name).name=='CERTIFICATE.json' and '/sources/' not in name]
  certs=[(name,d) for name,d in certs if d.get('step')==f'C{n}'];assert len(certs)==1,(n,len(certs));name,d=certs[0]
  assert sha(z.read(name))==coverage[n]['certificate_sha256'],n
  assert d['report_sha256']==coverage[n]['checks']['report']['sha256'],n
  assert d['results_sha256']==coverage[n]['checks']['results']['sha256'],n
 p.write_bytes(data);index.append({'n':n,'step':f'C{n}','canonical_basename':p.name,'local_path':rel(p),'sha256':sha(data),'bytes':len(data),'source':c,'crc_verified':True,'certificate_matches_normalized_packet':True,'candidate_count':len(cs)})
bi=[]
for name,cs in sorted(batch.items()):
 c=cs[0];data=read(c);text=data.decode('utf-8');assert not re.search(r'(?:[?&]sig=|upload_url|signed_url|authorization["\s]*:["\s]*Bearer)',text,re.I),name
 p=RECORDS/name;p.write_bytes(data);bi.append({'basename':name,'local_path':rel(p),'sha256':sha(data),'bytes':len(data),'source':c})
summary={'expected_steps':214,'original_published_evidence_zips':len(index),'missing_original_zips':missing,'regenerated_zips':0,'total_zip_bytes':sum(r['bytes'] for r in index),'all_selected_zip_CRC_and_certificate_identity_verified':True,'batch_records':len(bi),'private_upload_logs_or_credentials_included':False}
dump(OUT/'PUBLISHED_EVIDENCE_INDEX.json',{'summary':summary,'records':index});dump(OUT/'BATCH_RECORDS_INDEX.json',{'records':bi});print(json.dumps(summary,indent=2))