import { copyFile, mkdir, readFile, writeFile, stat } from "node:fs/promises";
import { createHash } from "node:crypto";
import { execFileSync } from "node:child_process";
import { createRequire } from "node:module";
import { fileURLToPath } from "node:url";
const require = createRequire(import.meta.url);
const asar = require("@electron/asar");
const archive = fileURLToPath(
  new URL("./dist/win-unpacked/resources/app.asar", import.meta.url),
);
let privateTerms = [];
try {
  const remote = execFileSync("git", ["remote", "get-url", "origin"], {
    cwd: fileURLToPath(new URL("..", import.meta.url)),
    encoding: "utf8",
    stdio: ["ignore", "pipe", "ignore"],
    windowsHide: true,
  }).trim();
  const hostname = remote.includes("://")
    ? new URL(remote).hostname
    : remote.split("@").pop().split(":")[0];
  privateTerms = [remote, hostname]
    .filter(Boolean)
    .map((term) => term.toLowerCase());
} catch {
  /* Source snapshots need no Git metadata. */
}
for (const entry of asar.listPackage(archive)) {
  const name = entry.replace(/^[/\\]+/, "");
  if (!asar.statFile(archive, name).files) {
    const content = asar
      .extractFile(archive, name)
      .toString("utf8")
      .toLowerCase();
    if (privateTerms.some((term) => content.includes(term)))
      throw new Error(`Private Git reference in desktop archive: ${name}`);
  }
}
console.log("Desktop archive privacy scan passed.");
const pkg = JSON.parse(
  await readFile(new URL("./package.json", import.meta.url), "utf8"),
);
const file = `MineGeo-${pkg.version}-windows-x64.exe`;
const source = new URL(`./dist/${file}`, import.meta.url);
const directory = new URL("../public/desktop/", import.meta.url);
await mkdir(directory, { recursive: true });
await copyFile(source, new URL(file, directory));
const sha256 = createHash("sha256")
  .update(await readFile(source))
  .digest("hex");
await writeFile(new URL(`${file}.sha256`, directory), `${sha256}  ${file}\n`);
await writeFile(
  new URL("../shared/desktop-release.json", import.meta.url),
  JSON.stringify(
    {
      version: pkg.version,
      file: `/desktop/${file}`,
      bytes: (await stat(source)).size,
      sha256,
    },
    null,
    2,
  ) + "\n",
);
console.log(`Published ${file} (${sha256})`);