"""Install only the pinned uv executable from a hash-checked official PyPI wheel."""
import hashlib
import io
import json
import urllib.request
import zipfile
from pathlib import Path

with urllib.request.urlopen("https://pypi.org/pypi/uv/0.12.17/json", timeout=30) as r:
    metadata = json.load(r)
choices = [f for f in metadata["urls"] if f["filename"].endswith("manylinux_2_17_x86_64.manylinux2014_x86_64.whl")]
if len(choices) != 1:
    raise RuntimeError("Expected one Linux x86_64 wheel")
item = choices[0]
if item["size"] > 40_000_000 or not item["url"].startswith("https://files.pythonhosted.org/"):
    raise RuntimeError("Wheel boundary")
with urllib.request.urlopen(item["url"], timeout=60) as r:
    body = r.read(40_000_001)
if len(body) != item["size"] or hashlib.sha256(body).hexdigest() != item["digests"]["sha256"]:
    raise RuntimeError("Wheel digest mismatch")
destination = Path("/opt/chameleon-laya/bootstrap-uv")
destination.mkdir(exist_ok=True)
with zipfile.ZipFile(io.BytesIO(body)) as archive:
    names = [name for name in archive.namelist() if name.endswith("/uv")]
    if len(names) != 1:
        raise RuntimeError("Executable member mismatch")
    target = destination / "uv"
    target.write_bytes(archive.read(names[0]))
    target.chmod(0o750)
(destination / "receipt.json").write_text(json.dumps({"version": "0.12.17", "url": item["url"], "sha256": item["digests"]["sha256"]}))
print("Pinned uv bootstrap verified")