"""Read-only audit of pinned local source and installed package metadata. No import/evaluation."""
from pathlib import Path
import json,re,hashlib
root=Path.cwd();lock=json.loads((root/'package-lock.json').read_text());report={}
names=['@google/genai','esbuild','protobufjs'];bundle=root/'node_modules/@earendil-works/pi-coding-agent/dist/bundle'
for name in names:
 p=root/'node_modules'/name/'package.json';pkg=json.loads(p.read_text());entry=lock['packages']['node_modules/'+name];assert pkg['version']==entry['version']
 report[name]={'version':entry['version'],'hasInstallScript':entry.get('hasInstallScript'),'lifecycle':{k:v for k,v in pkg['scripts'].items() if k in ['preinstall','postinstall']},'installedPackageJsonSha256':hashlib.sha256(p.read_bytes()).hexdigest(),'externalBundleImports':[]}
for p in bundle.rglob('*.js'):
 s=p.read_text()
 for m in re.finditer(r'(?:from\s*|\bimport\s*\(|\brequire\s*\(|\b__require\s*\()\s*["\']([^"\']+)',s):
  for name in names:
   if m.group(1)==name or m.group(1).startswith(name+'/'):report[name]['externalBundleImports'].append({'file':str(p.relative_to(root)),'specifier':m.group(1)})
# Direct package specifiers in the files the copy archives. No node_modules
# SDK entrypoint is assumed active merely because npm installed it.
script=(root/'scripts/stack-copy.sh').read_text();block=script.split('COPY_PATHS=(\n',1)[1].split('\n)',1)[0];paths=block.split()
for name in names:report[name]['copiedSourceMentions']=[]
for rel in paths:
 p=root/rel;files=p.rglob('*') if p.is_dir() else [p]
 for f in files:
  if f.is_file() and f.suffix in ['.mjs','.js','.sh']:
   s=f.read_text()
   for name in names:
    if name in s:report[name]['copiedSourceMentions'].append(str(f.relative_to(root)))
print(json.dumps(report,indent=2))