import crypto from "node:crypto";
import fs from "node:fs";
import path from "node:path";
import { execFileSync } from "node:child_process";
import { fileURLToPath } from "node:url";

const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../..");
const releaseRoot = path.join(root, "release");
if (path.basename(releaseRoot) !== "release" || path.dirname(releaseRoot) !== root) throw new Error("unsafe release target");
const bundle = path.join(releaseRoot, "blender-web-offline");
execFileSync(process.execPath, [path.join(root, "tools/web/generate-sbom.mjs")], { stdio: "inherit" });
fs.rmSync(bundle, { recursive: true, force: true });
fs.mkdirSync(bundle, { recursive: true });
fs.cpSync(path.join(root, "web/dist"), path.join(bundle, "app"), { recursive: true });
fs.copyFileSync(path.join(root, "blender-5.2.0/COPYING"), path.join(bundle, "COPYING"));
fs.copyFileSync(path.join(root, "docs/web/third-party-notices.json"), path.join(bundle, "third-party-notices.json"));
fs.copyFileSync(path.join(root, "docs/web/sbom.spdx.json"), path.join(bundle, "sbom.spdx.json"));
fs.copyFileSync(path.join(root, "docs/web/deployment-contract.json"), path.join(bundle, "deployment-contract.json"));
fs.copyFileSync(path.join(root, "docs/web/DEPLOYMENT.md"), path.join(bundle, "DEPLOYMENT.md"));
fs.copyFileSync(path.join(root, "blender-5.2.0/extern/opensubdiv-source/LICENSE.txt"), path.join(bundle, "LICENSE-OpenSubdiv.txt"));
fs.copyFileSync(path.join(root, "blender-5.2.0/extern/gmp-source/COPYING.LESSERv3"), path.join(bundle, "LICENSE-GMP-LGPLv3.txt"));
fs.writeFileSync(path.join(bundle, "README.txt"), [
  "Web Blender Modeler V1 offline release",
  "",
  "Serve app/ from a static HTTP server that implements deployment-contract.json.",
  "See DEPLOYMENT.md for the required isolation, cache, MIME, ETag and byte-range behavior.",
  "The application has no runtime CDN dependency.",
  "Opening index.html directly is unsupported because browsers restrict module Workers and WASM under file://.",
  "See SOURCE_OFFER.txt and third-party-notices.json for licensing and corresponding source.",
  "",
].join("\n"));
fs.writeFileSync(path.join(bundle, "SOURCE_OFFER.txt"), [
  "Corresponding source for this GPL-2.0-or-later WebEngine distribution is provided in",
  "blender-web-corresponding-source.tar.gz alongside this archive. It contains the Blender 5.2",
  "source, Web application/protocol source, Web build scripts, dependency lockfile and build documentation.",
  "The source archive is covered by SHA256SUMS.txt.",
  "",
].join("\n"));

function sha256(file) {
  return crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
}
function walk(directory, base = directory) {
  const files = [];
  for (const entry of fs.readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
    const absolute = path.join(directory, entry.name);
    if (entry.isDirectory()) files.push(...walk(absolute, base));
    else files.push(path.relative(base, absolute).replaceAll(path.sep, "/"));
  }
  return files;
}

const manifest = walk(bundle).map((relative) => ({ path: relative, bytes: fs.statSync(path.join(bundle, relative)).size, sha256: sha256(path.join(bundle, relative)) }));
fs.writeFileSync(path.join(bundle, "manifest.json"), `${JSON.stringify({ schemaVersion: 1, files: manifest }, null, 2)}\n`);

function deterministicArchive(output, cwd, entries) {
  const tarPath = output.replace(/\.gz$/, "");
  fs.rmSync(output, { force: true });
  fs.rmSync(tarPath, { force: true });
  execFileSync("tar", ["--sort=name", "--mtime=@0", "--owner=0", "--group=0", "--numeric-owner", "-cf", tarPath, "-C", cwd, ...entries]);
  execFileSync("gzip", ["-n", "-f", tarPath]);
}

const binaryArchive = path.join(releaseRoot, "blender-web-offline.tar.gz");
deterministicArchive(binaryArchive, releaseRoot, ["blender-web-offline"]);
const sourceArchive = path.join(releaseRoot, "blender-web-corresponding-source.tar.gz");
deterministicArchive(sourceArchive, root, [
  "blender-5.2.0",
  "web/app",
  "web/protocol",
  "web/package.json",
  "web/package-lock.json",
  "web/tsconfig.json",
  "web/eslint.config.js",
  "web/playwright.config.ts",
  "web/playwright.release.config.ts",
  "tools/web",
  "docs/web",
  "docs/status",
  "docs/PROJECT_STATUS_AND_NEXT_WORK.md",
  "WEB_BLENDER_MIGRATION_EXECUTION_PLAN.md",
]);
const sums = [binaryArchive, sourceArchive].map((file) => `${sha256(file)}  ${path.basename(file)}`).join("\n") + "\n";
fs.writeFileSync(path.join(releaseRoot, "SHA256SUMS.txt"), sums);
process.stdout.write(`offline-release-ok binary=${fs.statSync(binaryArchive).size} source=${fs.statSync(sourceArchive).size} sha256=${sha256(binaryArchive)}\n`);