/** Assemble portable deployment and author starter archives from reviewed release inputs. */
import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
import { dirname, join, resolve } from 'node:path';
import { fileURLToPath } from 'node:url';
import { spawnSync } from 'node:child_process';
import { verifyPackage } from '../packages/plugin-manager/src/verify-package.mjs';
import { composeReleases } from '../packages/plugin-manager/src/compose-release.mjs';
import { loadRelease } from '../packages/plugin-manager/src/release.mjs';
import { selectVerification } from '../packages/plugin-manager/src/verification.mjs';
import { renderSiteTemplate } from '../packages/plugin-manager/src/framework-config.mjs';
import { createPublicBuildView, publicInputFiles, writePublicInputRecord } from '../packages/plugin-manager/src/public-build-view.mjs';
import { hash, readArchive } from '../packages/plugin-manager/src/state.mjs';
import { installManagerArchive } from './manager-tooling.mjs';

const managerCli = '/opt/plugin-manager/node_modules/@dsh-plugin-manager/plugin-manager/dist/cli.mjs';
const hostCli = '/opt/dsh-runtime/node_modules/@deepseek-ai/dsh/lib/bin.js';
const digestReference = /^[a-z0-9][a-z0-9._:/-]*@sha256:[a-f0-9]{64}$/u;
const json = path => JSON.parse(readFileSync(path, 'utf8'));
const write = (path, content) => { mkdirSync(dirname(path), { recursive: true }); writeFileSync(path, content); };
function command(bin, args, options = {}) {
  const result = spawnSync(bin, args, { encoding: 'utf8', windowsHide: true, maxBuffer: 16 * 1024 * 1024, ...options });
  if (result.error || result.status !== 0) throw new Error(`${bin} ${args[0]} failed: ${result.error?.message ?? result.stderr ?? result.status}`);
  return result.stdout.trim();
}

/** Match the installed archive label and fixed version probes against the immutable image. */
export function runtimeFromImage(image, version, managerHash, execute = command) {
  if (!digestReference.test(image)) throw new Error('Runtime image must be a registry/repository@sha256 reference.');
  if (!/^[a-f0-9]{64}$/u.test(managerHash)) throw new Error('A verified manager archive SHA256 is required.');
  const [info] = JSON.parse(execute('docker', ['image', 'inspect', image]));
  const platform = `${info?.Os}/${info?.Architecture}`;
  if (!/^linux\/(amd64|arm64)$/u.test(platform) || !/^sha256:[a-f0-9]{64}$/u.test(info?.Id)) throw new Error('Runtime image identity or platform is invalid.');
  if (!info.RepoDigests?.includes(image)) throw new Error('Inspected image does not own the requested repository digest.');
  if (info.Config?.Labels?.['com.dsh-plugin-manager.manager.sha256'] !== managerHash) throw new Error('Runtime manager archive SHA256 does not match the release archive.');
  const hostCommit = info.Config?.Labels?.['org.opencontainers.image.revision'];
  const hostVersion = info.Config?.Labels?.['org.opencontainers.image.version'];
  if (!/^[a-f0-9]{40}$/u.test(hostCommit) || typeof hostVersion !== 'string' || !hostVersion) throw new Error('Runtime is missing the verified host identity labels.');
  if (JSON.stringify(info.Config?.Entrypoint) !== JSON.stringify(['node', managerCli, 'container-start', '--root', '/opt/plugin-project'])) throw new Error('Runtime does not expose the supported manager container entry.');
  for (const [cli, expected] of [[managerCli, version], [hostCli, hostVersion]]) {
    const actual = execute('docker', ['run', '--rm', '--network', 'none', '--read-only', '--cap-drop', 'ALL', '--security-opt', 'no-new-privileges', '--entrypoint', 'node', info.Id, cli, '--version']);
    if (actual !== expected) throw new Error(`Runtime version does not match: ${cli}`);
  }
  return { platform, image, hostCommit };
}

function toolArchive(path, name, version, entry) {
  const manifest = JSON.parse(readArchive(path, ['-xzOf', '-', 'package/package.json']).toString('utf8'));
  if (manifest.name !== name || manifest.version !== version) throw new Error(`${name} archive does not match framework ${version}.`);
  return verifyPackage({ package: name, version, verifyFiles: [entry] }, path);
}

/** The allowlist belongs to this release recipe, not to a recursively copied checkout. */
function copyPublic(source, target) {
  const info = lstatSync(source);
  if (info.isSymbolicLink()) throw new Error(`Release input must not be a link: ${source}`);
  if (info.isDirectory()) {
    mkdirSync(target, { recursive: true });
    for (const name of readdirSync(source)) {
      if (['node_modules', '.git', '.local', 'dist', 'coverage'].includes(name)) throw new Error(`Unexpected generated/private starter input: ${source}/${name}`);
      copyPublic(join(source, name), join(target, name));
    }
  } else if (info.isFile()) {
    mkdirSync(dirname(target), { recursive: true }); cpSync(source, target);
  } else throw new Error(`Release input is not a regular file: ${source}`);
}

const shell = `#!/usr/bin/env bash
set -Eeuo pipefail
ROOT="$(cd -- "$(dirname -- "\${BASH_SOURCE[0]}")" && pwd)"
command -v node >/dev/null || { printf 'Missing prerequisite: Node.js. See README.md.\\n' >&2; exit 1; }
CLI="$ROOT/tools/node_modules/@dsh-plugin-manager/plugin-manager/dist/cli.mjs"
HELP=false
for argument in "$@"; do [[ "$argument" != "--help" ]] || HELP=true; done
if [[ ( $# -eq 0 || "$1" == "release" || "$1" == --* ) && "$HELP" == false ]] && command -v flock >/dev/null; then
  mkdir -p "$ROOT/.local"
  exec flock -n "$ROOT/.local/source-release.lock" node "$CLI" release-site --root "$ROOT" "$@"
fi
exec node "$CLI" release-site --root "$ROOT" "$@"
`;
const powershell = `$ErrorActionPreference = 'Stop'
if (-not (Get-Command node -CommandType Application -ErrorAction SilentlyContinue)) {
    throw 'Missing prerequisite: Node.js. See README.md.'
}
& node (Join-Path $PSScriptRoot 'tools/node_modules/@dsh-plugin-manager/plugin-manager/dist/cli.mjs') release-site --root $PSScriptRoot @args
exit $LASTEXITCODE
`;

/** Return staged trees so their real independent consumption can be checked before publication. */
export function assembleDeployment({ root, manager, kit, images, output }, { inspectRuntime = runtimeFromImage, installTools = installManagerArchive } = {}) {
  if (![root, manager, kit, output].every(value => typeof value === 'string' && value)) throw new Error('Explicit root, tool archives and new output are required.');
  root = resolve(root); output = resolve(output); manager = resolve(manager); kit = resolve(kit);
  const version = json(join(root, 'package.json')).version;
  if (!/^\d+\.\d+\.\d+$/u.test(version)) throw new Error('Expected a stable framework version.');
  if (existsSync(output) && readdirSync(output).length) throw new Error('Release output must be new or empty.');
  if (!Array.isArray(images) || !images.length) throw new Error('At least one verified public runtime is required.');
  const managerHash = hash(readFileSync(manager)), kitHash = hash(readFileSync(kit));
  toolArchive(manager, '@dsh-plugin-manager/plugin-manager', version, 'dist/cli.mjs');
  toolArchive(kit, '@dsh-plugin-manager/plugin-kit', version, 'dist/index.mjs');
  const runtimes = images.map(image => inspectRuntime(image, version, managerHash));
  if (new Set(runtimes.map(runtime => runtime.platform)).size !== runtimes.length) throw new Error('Only one runtime per platform may be published.');
  for (const doc of ['deploy/DEPLOYMENT.md', 'deploy/STARTERS.md', 'incoming/README.md', 'LICENSE']) if (!existsSync(join(root, doc))) throw new Error(`Missing public release document: ${doc}`);
  const deployment = join(output, 'dsh-deployment'), starters = join(output, 'dsh-starters');
  mkdirSync(deployment, { recursive: true }); mkdirSync(starters);
  const tooling = installTools({ archive: manager, output: join(deployment, 'tools'), version });
  if (tooling.sha256 !== managerHash) throw new Error('Installed manager bytes differ from the verified release archive.');
  const metadata = { schemaVersion: 1, frameworkVersion: version, manager: { version, sha256: tooling.sha256 }, runtimes };
  write(join(deployment, 'framework-runtime.json'), `${JSON.stringify(metadata, null, 2)}\n`);
  // 统一部署路径需要内置源码与公开构建输入：发行包必须自带，不能让站点在含 external 的现场生成。
  // source/ 是只含公开目录的源码材料，它的清单/workspace/锁与 tools/builtin-build/ 都逐字节来自
  // **本次公共框架根文件**（同一份输入），打包后立刻核对字节，避免交付走样。
  const source = join(deployment, 'source');
  createPublicBuildView({ root, output: source, inputs: root });
  const builtinBuild = join(deployment, 'tools/builtin-build');
  mkdirSync(builtinBuild, { recursive: true });
  for (const name of publicInputFiles) copyPublic(join(root, name), join(builtinBuild, name));
  for (const name of publicInputFiles) {
    if (!readFileSync(join(builtinBuild, name)).equals(readFileSync(join(root, name)))) throw new Error(`公开构建输入交付后字节不一致：${name}`);
    if (!readFileSync(join(source, name)).equals(readFileSync(join(root, name)))) throw new Error(`source/ 的公开构建输入与根文件不一致：${name}`);
  }
  // 交付记录随包产出：站点侧用的是独立交付目录，没有记录就直接拒绝构造构建视图。记录取自刚写下的
  // 字节（发行目录没有提交身份，只记来源种类），时间戳一律不写，发行包保持可复现。
  writePublicInputRecord(builtinBuild, { version, sourceKind: 'release', sourceCommit: null, sourceModified: null });
  write(join(deployment, 'build.sh'), shell); write(join(deployment, 'build.ps1'), powershell);
  write(join(deployment, 'env.conf.example'), renderSiteTemplate('archives'));
  write(join(deployment, '.gitignore'), '.local/\nincoming/*\n!incoming/README.md\n');
  copyPublic(join(root, 'deploy/DEPLOYMENT.md'), join(deployment, 'README.md'));
  copyPublic(join(root, 'incoming/README.md'), join(deployment, 'incoming/README.md'));
  copyPublic(join(root, 'LICENSE'), join(deployment, 'LICENSE'));
  copyPublic(join(root, 'deploy/STARTERS.md'), join(starters, 'README.md'));
  copyPublic(join(root, 'LICENSE'), join(starters, 'LICENSE'));
  for (const name of ['standalone-plugin', 'standalone-kit']) {
    const source = join(root, 'examples', name), target = join(starters, name);
    for (const path of ['src', 'package.json', 'cordis.patch.yml', 'README.md', name === 'standalone-kit' ? 'tsdown.config.mjs' : 'build.mjs']) copyPublic(join(source, path), join(target, path));
    copyPublic(join(root, 'LICENSE'), join(target, 'LICENSE'));
    write(join(target, '.gitignore'), 'node_modules/\ndist/\n.local/\n');
    if (name === 'standalone-kit') {
      copyPublic(kit, join(target, 'vendor/plugin-kit.tgz'));
      if (hash(readFileSync(join(target, 'vendor/plugin-kit.tgz'))) !== kitHash) throw new Error('Kit bytes changed after verification.');
      const manifest = json(join(target, 'package.json'));
      manifest.devDependencies = { ...manifest.devDependencies, '@dsh-plugin-manager/plugin-kit': 'file:vendor/plugin-kit.tgz' };
      write(join(target, 'package.json'), `${JSON.stringify(manifest, null, 2)}\n`);
    }
  }
  return { version, deployment, starters, metadata };
}

// Python's standard zipfile preserves a portable file tree, without shell interpolation.
const zipProgram = `import pathlib, stat, sys, zipfile
root, output = pathlib.Path(sys.argv[1]), pathlib.Path(sys.argv[2])
with zipfile.ZipFile(output, 'x', zipfile.ZIP_DEFLATED) as archive:
    for path in sorted(root.rglob('*')):
        if path.is_symlink(): raise ValueError('ZIP input cannot contain links: ' + str(path))
        if not path.is_file(): continue
        relative = path.relative_to(root)
        if '.local' in relative.parts or '.git' in relative.parts: raise ValueError('Private release path: ' + str(relative))
        if path.name in ('package-lock.json', '.package-lock.json') and relative.parts[0] == 'tools': continue
        info = zipfile.ZipInfo(root.name + '/' + relative.as_posix(), (2020, 1, 1, 0, 0, 0))
        info.create_system = 3
        info.external_attr = (stat.S_IFREG | (0o755 if path.suffix == '.sh' else 0o644)) << 16
        archive.writestr(info, path.read_bytes(), compress_type=zipfile.ZIP_DEFLATED)
with zipfile.ZipFile(output) as archive:
    if archive.testzip() is not None: raise ValueError('ZIP checksum verification failed')
`;
export function zipTree(root, archive, python = process.platform === 'win32' ? 'python' : 'python3') {
  command(python, ['-c', zipProgram, root, archive]);
}

export function packageDeployment(options, dependencies) {
  const result = assembleDeployment(options, dependencies);
  const archives = [
    [result.deployment, `dsh-plugin-manager-deployment-${result.version}.zip`],
    [result.starters, `dsh-plugin-manager-starters-${result.version}.zip`],
  ].map(([source, filename]) => {
    const path = resolve(options.output, filename); zipTree(source, path, options.python); return path;
  });
  return { ...result, archives };
}

if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
  try {
    const options = { images: [] }, values = { '--root': 'root', '--manager': 'manager', '--kit': 'kit', '--output': 'output', '--python': 'python' };
    const args = process.argv.slice(2);
    while (args.length) {
      const flag = args.shift(), value = args.shift();
      if ((!Object.hasOwn(values, flag) && flag !== '--image') || !value || value.startsWith('--')) throw new Error('Usage: package-deployment.mjs --root <framework> --manager <tgz> --kit <tgz> --image <repository@sha256> --output <new-directory> [--python <executable>]');
      if (flag === '--image') options.images.push(value);
      else if (options[values[flag]]) throw new Error(`Repeated argument: ${flag}`);
      else options[values[flag]] = value;
    }
    console.log(JSON.stringify(packageDeployment(options)));
  } catch (error) { console.error(error.message); process.exitCode = 1; }
}