"""Runtime source revision lock, separate from historical original paths."""
import hashlib
import json
import sys
from .paths import root


def check_sources():
    base=root()
    manifest=json.loads((base/'data/arbeit-source-lock.json').read_text(encoding='utf8'))
    for path, expected in manifest['files'].items():
        resource=(base/path).resolve()
        if not resource.is_relative_to(base.resolve()):raise ValueError('Resource escapes installation')
        actual=hashlib.sha256(resource.read_bytes()).hexdigest()
        if actual!=expected:raise ValueError('Source revision changed: '+path)
    if not getattr(sys, 'frozen', False):
        for path, expected in manifest.get('implementation', {}).items():
            resource=(base/path).resolve()
            if not resource.is_relative_to(base.resolve()):raise ValueError('Implementation escapes installation')
            if hashlib.sha256(resource.read_bytes()).hexdigest()!=expected:
                raise ValueError('Implementation revision changed: '+path)
    return {'status':'passed','files':len(manifest['files']),'revision':manifest['revision'],
            'implementation_fingerprint':manifest.get('implementation_fingerprint'),
            'meaning':'Bundled source integrity, not current server or live-game verification'}
