"""Reproducible public source release; explicit allowlist, no Git history or data."""
from pathlib import Path
import hashlib, json, tarfile, io
root=Path(__file__).resolve().parents[1]
folders=['app','components','lib','db','drizzle','worker','build','scripts','hooks','vendor','public']
names=['docs/LAUNCH-READINESS.md','README.md','CONTRIBUTING.md','LICENSE','package.json','package-lock.json','tsconfig.json','cloudflare-env.d.ts','vite.config.ts','next.config.ts','postcss.config.mjs','components.json','drizzle.config.ts','eslint.config.mjs','wrangler.local.jsonc']
files=[root/n for n in names if (root/n).is_file()]
for folder in folders:
 files.extend(f for f in (root/folder).rglob('*') if f.is_file() and not f.is_relative_to(root/'public/source') and '__pycache__' not in f.parts and f.suffix not in ['.pyc','.gz'])
# Include test sources, not outputs or local database contents.
files.extend((root/'tests').glob('*.mjs'))
archive=root/'public/source/opentaskrelay-source.tar'
with tarfile.open(archive,'w') as tar:
 for f in sorted(set(files)):
  data=f.read_bytes();info=tarfile.TarInfo('opentaskrelay/'+f.relative_to(root).as_posix());info.size=len(data);info.mtime=0;info.mode=0o644;tar.addfile(info,io.BytesIO(data))
sha=hashlib.sha256(archive.read_bytes()).hexdigest()
(root/'public/source/checksum.json').write_text(json.dumps({'file':'opentaskrelay-source.tar','sha256':sha,'license':'MIT','includes':'Application source and tests; no production data, secrets or Git history.'},indent=2)+'\n')
print('Exported',len(set(files)),'source files; SHA-256',sha)
