"""Build a review-only integration handoff. Never installs or touches a gateway."""
from pathlib import Path
from io import BytesIO
import hashlib
import json
import zipfile

ROOT = Path(__file__).resolve().parent.parent
DEST = ROOT / 'work/delivery-by-recipient-20261102'
NAME = 'ksf-current-employee-integration-prep-20261102-v2'
skill = ROOT / 'skills/ksf-workshop-runtime'
payloads = {}
rows = (skill / 'FILES.sha256').read_text(encoding='utf-8').splitlines()
assert len(rows) == 10
for row in rows:
    fingerprint, rel = row.split('  ', 1)
    b = (skill / rel).read_bytes()
    assert hashlib.sha256(b).hexdigest() == fingerprint
    payloads['skills/ksf-workshop-runtime/' + rel] = b
payloads['skills/ksf-workshop-runtime/FILES.sha256'] = (skill / 'FILES.sha256').read_bytes()
files = [
    'scripts/install-workshop-skill.mjs',
    'integrations/wecom-identity/workshop_registration.py',
    'integrations/wecom-identity/__init__.py',
    'integrations/wecom-identity/registration.example.json',
    'test/workshop-identity.test.js', 'test/workshop-registration.test.py',
    'docs/wecom-current-employee-registration.md', 'docs/aibot-adapter-v3-review-20261102.md',
]
for rel in files: payloads[rel] = (ROOT / rel).read_bytes()
# identity JS suite imports runWorkshop, which is part of the skill payload.
for name in ('给运维001-v3复核与接口.txt', '给王刚001-v3阶段回复.txt'):
    payloads[name] = (DEST / name).read_bytes()
for rel, b in payloads.items():
    assert 'credential-binding' not in rel and not rel.endswith(('.pem', '.key', '.env'))
    assert b'-----BEGIN PRIVATE KEY-----' not in b
payloads['FILES.sha256'] = ''.join(hashlib.sha256(payloads[k]).hexdigest() + '  ' + k + chr(10) for k in sorted(payloads)).encode()
memory = BytesIO()
with zipfile.ZipFile(memory, 'w', zipfile.ZIP_DEFLATED) as z:
    for rel, b in sorted(payloads.items()):
        z.writestr(zipfile.ZipInfo(rel, (2026, 11, 2, 0, 0, 0)), b, compress_type=zipfile.ZIP_DEFLATED)
packed = memory.getvalue()
with zipfile.ZipFile(BytesIO(packed)) as z:
    assert z.testzip() is None
    for line in z.read('FILES.sha256').decode().splitlines():
        fingerprint, rel = line.split('  ', 1)
        assert hashlib.sha256(z.read(rel)).hexdigest() == fingerprint
DEST.mkdir(parents=True, exist_ok=True)
target = DEST / (NAME + '.zip')
if target.exists(): assert target.read_bytes() == packed, 'REFUSE_OVERWRITE_DIFFERENT_PACKAGE'
else: target.write_bytes(packed)
receipt = {'file': str(target), 'sizeBytes': len(packed), 'sha256': hashlib.sha256(packed).hexdigest(),
           'outerManifestEntries': len(payloads) - 1, 'skillManifestEntries': len(rows),
           'purpose': 'isolated integration review only', 'installed': False, 'deployed': False, 'containsCredentials': False}
(DEST / (NAME + '.json')).write_text(json.dumps(receipt, ensure_ascii=False, indent=2) + chr(10), encoding='utf-8')
print(json.dumps(receipt, ensure_ascii=False, indent=2))