"""Restore exact selected evidence from static revision3 JSON tar/XZ pack.
Standard library only. No decoded content is executed.
"""
import argparse,base64,hashlib,io,json,lzma,pathlib,tarfile
p=argparse.ArgumentParser();p.add_argument('--pack',default=str(pathlib.Path(__file__).resolve().parent/'evidence-pack.json'));p.add_argument('--out',required=True);a=p.parse_args();root=pathlib.Path(a.out).resolve()
if root.exists():raise SystemExit('Output must be a new disposable directory')
pack=json.loads(pathlib.Path(a.pack).read_text());assert pack['encoding']=='tar-xz-base64-exact-bytes-v2';assert len(pack['files'])<=64
manifest={e['path']:e for e in pack['files']};assert len(manifest)==len(pack['files'])
decoder=lzma.LZMADecompressor();raw=decoder.decompress(base64.b64decode(pack['data'],validate=True),max_length=128*1024**2+1);assert decoder.eof and len(raw)<=128*1024**2
root.mkdir(parents=True);total=0;seen=set()
with tarfile.open(fileobj=io.BytesIO(raw),mode='r:') as archive:
 for member in archive.getmembers():
  assert member.isfile() and member.name in manifest and member.name not in seen;seen.add(member.name);name=pathlib.PurePosixPath(member.name);assert not name.is_absolute() and '..' not in name.parts and all(not part.startswith('.') for part in name.parts)
  data=archive.extractfile(member).read();entry=manifest[member.name];assert len(data)==entry['bytes']<=48*1024**2;total+=len(data);assert total<=128*1024**2 and hashlib.sha256(data).hexdigest()==entry['sha256']
  target=root.joinpath(*name.parts);assert not target.exists();target.parent.mkdir(parents=True,exist_ok=True);target.write_bytes(data)
assert seen==set(manifest)
print('Restored',len(seen),'selected files;',total,'exact bytes. No content executed.')