#!/usr/bin/env python3
"""Standalone synthetic fixture; standard library only. No network, credentials or user paths."""
import json, math, statistics, sys, platform, datetime

import zipfile,hashlib,io,pathlib
source={'catalog/summary.txt':b'collection: BK-42\ncopies: 7\n','inventory/BK-42.tsv':b'book_id\tcopies\nBK-42\t7\n','flags/catalog-ready.flag':b''}
def sha(b):return hashlib.sha256(b).hexdigest()
expected={n:{'bytes':len(b),'sha256':sha(b)} for n,b in source.items()}
def archive(data):
 f=io.BytesIO()
 with zipfile.ZipFile(f,'w',compression=zipfile.ZIP_DEFLATED) as z:
  for n,b in data.items():z.writestr(n,b)
 return f.getvalue()
def inspect(raw):
 with zipfile.ZipFile(io.BytesIO(raw)) as z:
  names=z.namelist();bad=[n for n in names if pathlib.PurePosixPath(n).is_absolute() or '..' in pathlib.PurePosixPath(n).parts or '\\' in n]
  duplicate=len(names)!=len(set(names));actual={n:{'bytes':len(z.read(n)),'sha256':sha(z.read(n))} for n in names if n not in bad}
  return {'zipCrcFailure':z.testzip(),'unsafeNames':bad,'duplicateNames':duplicate,'missing':sorted(set(expected)-set(actual)),'unexpected':sorted(set(actual)-set(expected)),'changed':sorted(n for n in set(actual)&set(expected) if actual[n]!=expected[n]),'actual':actual}
good=inspect(archive(source));modified=dict(source);modified['catalog/summary.txt']=b'COLLECTION: BK-42\ncopies: 7\n';wrong=inspect(archive(modified));missing=dict(source);missing.pop('flags/catalog-ready.flag');miss=inspect(archive(missing));unsafe=inspect(archive({'../escape.txt':b'x'}))
extra=dict(source);extra['scratch/work.tmp']=b'not-in-source\n';unexpected=inspect(archive(extra))
import warnings
f=io.BytesIO()
with warnings.catch_warnings():
 warnings.simplefilter('ignore',UserWarning)
 with zipfile.ZipFile(f,'w') as z:
  z.writestr('catalog/summary.txt',b'one');z.writestr('catalog/summary.txt',b'two')
dup=inspect(f.getvalue())
# Real restoration only for our trusted fixed archive in a new temporary directory.
import tempfile
with tempfile.TemporaryDirectory(prefix='aigainos-zip-lab-') as td:
 with zipfile.ZipFile(io.BytesIO(archive(source))) as z:z.extractall(td)
 restored={n:sha((pathlib.Path(td)/n).read_bytes()) for n in source}
result={'expectedManifest':expected,'good':good,'changedButValidZip':wrong,'missingEmptyFile':miss,'unexpectedFile':unexpected,'unsafeArchive':unsafe,'duplicateArchive':dup,'restoredContentMatches':all(restored[n]==expected[n]['sha256'] for n in source),'scope':'Trusted synthetic ZIP; unknown archives never extracted. Permissions, ownership, executable bits, xattrs, encryption, database consistency and signature authenticity not tested.'}
assert good['zipCrcFailure'] is None and wrong['zipCrcFailure'] is None and wrong['changed']==['catalog/summary.txt'] and miss['missing']==['flags/catalog-ready.flag'] and result['restoredContentMatches']
assert unexpected['unexpected']==['scratch/work.tmp'] and not unexpected['missing'] and not unexpected['changed']
assert dup['duplicateNames'] and unsafe['unsafeNames']==['../escape.txt']
assert good['actual']['catalog/summary.txt']['bytes']==wrong['actual']['catalog/summary.txt']['bytes']==28

print(json.dumps({"fixtureCreatedOn":"2026-10-15","executedAt":datetime.datetime.now(datetime.timezone.utc).isoformat(),"synthetic":True,"runtime":platform.python_version(),"result":result},ensure_ascii=False,indent=2))