Phase 9: the private pack to hand out

build/...-private.mrpack lists every mod by download link, CurseForge-only ones
included, with the credits and non-affiliation notice inside and no third-party jar.
tools/check_private_pack.py downloads all of it and checks the hashes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/lock.py

@@ -12,6 +12,7 @@ import subprocess
 import sys
 import tarfile
 import tomllib
+import urllib.parse
 import urllib.request
 import venv
 from pathlib import Path
@@ -49,11 +50,23 @@ def download(name):
     return fetch(entry["url"], CACHE / name, entry["sha256"])
 
 
+def download_url(meta):
+    """Where a packwiz metafile's jar comes from; a CurseForge-only mod records no URL, only the file's id."""
+    if "url" in meta["download"]:
+        return meta["download"]["url"]
+    file_id = meta["update"]["curseforge"]["file-id"]
+    return f"https://edge.forgecdn.net/files/{file_id // 1000}/{file_id % 1000}/{urllib.parse.quote(meta['filename'])}"
+
+
+def fetch_mod(meta):
+    """The jar a packwiz metafile pins, checked against its hash."""
+    file = meta["download"]
+    return fetch(download_url(meta), CACHE / "mods" / meta["filename"], file["hash"], file["hash-format"])
+
+
 def mod_jar(slug):
     """A mod's jar as pack/mods/<slug>.pw.toml pins it, for the tools that read a mod's own data."""
-    meta = tomllib.loads((ROOT / f"pack/mods/{slug}.pw.toml").read_text())
-    file = meta["download"]
-    return fetch(file["url"], CACHE / "mods" / meta["filename"], file["hash"], file["hash-format"])
+    return fetch_mod(tomllib.loads((ROOT / f"pack/mods/{slug}.pw.toml").read_text()))
 
 
 def jdk():