"""Offline package integrity validation, without model or GPU imports."""
import argparse
import hashlib
import json
from pathlib import Path

p=argparse.ArgumentParser()
p.add_argument("--package",type=Path,default=Path(__file__).resolve().parent.parent)
args=p.parse_args()
root=args.package.resolve()
manifest=json.loads((root/"release-manifest.json").read_text())
expected={row["file"] for row in manifest["files"]}
for row in manifest["files"]:
    path=root/row["file"]
    assert path.resolve().is_relative_to(root),"Path outside package"
    assert path.is_file() and not path.is_symlink(),path
    assert path.stat().st_size==row["bytes"],path
    assert hashlib.file_digest(path.open("rb"),"sha256").hexdigest()==row["sha256"],path
actual={str(x.relative_to(root)) for x in root.rglob("*") if x.is_file()
        and not any(part in x.parts for part in ("__pycache__", ".git", ".cache")) and x.name!="release-manifest.json"}
assert actual==expected,(sorted(actual-expected),sorted(expected-actual))
print("PASS:",len(expected),"allowlisted files; all SHA-256 hashes verified")