#!/usr/bin/env node
/**
 * Studio L3b slice 2 — the editor-dist build hook (requirement 7).
 *
 * Wired into `package.json` as `prebuild`, so it runs before every
 * `next build` — on a laptop, in CI and on Vercel.
 *
 * OFF BY DEFAULT. When `INFERWAY_STUDIO_EDITOR_BUILD` is not exactly `"1"`
 * this script prints ONE line and exits 0 without touching the network or the
 * filesystem — no directory is created, no file is read or written, no request
 * is made. That is the whole production story of this slice: with the variable
 * unset, the build output for every existing route is what it was before.
 *
 * With `INFERWAY_STUDIO_EDITOR_BUILD=1` it:
 *
 *   1. runs `scripts/studio-editor-fetch.mjs` (the wheel's sha256 is verified
 *      BEFORE anything is extracted — slice 1's contract);
 *   2. verifies the extracted `index.html` is still byte-identical to the
 *      upstream one recorded in the lock, then injects exactly ONE line —
 *      `<script src="./inferway-shim.js"></script>` — as the first element of
 *      `<head>` (idempotent: a second run changes nothing);
 *   3. copies the shim, the protocol, the upstream licence (verified against
 *      the lock) and the NOTICE into the dist;
 *   4. verifies the result: file count against the lock, `index.html` present,
 *      exactly one injected line, and the upstream sha again after stripping
 *      that line;
 *   5. verifies every file in the dist against the static file inventory
 *      (`studio-editor/static-files.sha256`, one `sha256␠␠path` line per
 *      shipped file — requirement 3). `--write-inventory` regenerates that
 *      file from the dist just built, for a deliberate upstream bump.
 *
 * Every failure exits non-zero and fails the build.
 *
 * Usage:
 *   node scripts/studio-editor-build.mjs [--lock <file>] [--cache-dir <dir>]
 *                                        [--out-dir <dir>] [--inventory <file>]
 *                                        [--write-inventory]
 */

import { spawnSync } from "node:child_process";
import { createHash } from "node:crypto";
import fs from "node:fs";
import path from "node:path";
import { fileURLToPath } from "node:url";

const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url));
const WEBSITE_DIR = path.resolve(SCRIPT_DIR, "..");

const SOURCE_DIR = path.join(WEBSITE_DIR, "studio-editor");
const DEFAULT_LOCK = path.join(SCRIPT_DIR, "studio-editor.lock.json");
const DEFAULT_CACHE_DIR = path.join(WEBSITE_DIR, ".studio-editor-cache");
const DEFAULT_OUT_DIR = path.join(WEBSITE_DIR, "public", "console", "studio", "editor");
const DEFAULT_INVENTORY = path.join(SOURCE_DIR, "static-files.sha256");
const FETCH_SCRIPT = path.join(SCRIPT_DIR, "studio-editor-fetch.mjs");

/** How the inventory is regenerated, quoted back when it does not match. */
const REGENERATE_HINT =
  `regenerate it with INFERWAY_STUDIO_EDITOR_BUILD=1 node scripts/studio-editor-build.mjs --write-inventory`;

/** The ONE line this hook may add to the upstream index.html. */
const INJECT_TAG = '<script src="./inferway-shim.js"></script>';

/** Tracked sources copied into the dist, source name → name in the dist. */
const COPIES = [
  ["inferway-shim.js", "inferway-shim.js"],
  ["inferway-bridge-protocol.js", "inferway-bridge-protocol.js"],
  ["LICENSE.comfyui-frontend-v1.51.10.txt", "LICENSE.txt"],
  ["NOTICE.md", "NOTICE.md"],
];

const ENABLE_ENV = "INFERWAY_STUDIO_EDITOR_BUILD";

class BuildError extends Error {}

function usage() {
  return [
    "Usage: node scripts/studio-editor-build.mjs [options]",
    "",
    `  The editor dist is only built when ${ENABLE_ENV}=1 (exact string).`,
    "",
    "  --lock <file>          lock JSON to honour (default scripts/studio-editor.lock.json)",
    "  --cache-dir <dir>      wheel cache (default <website>/.studio-editor-cache)",
    "  --out-dir <dir>        extraction target (default <website>/public/console/studio/editor)",
    "  --inventory <file>     static file inventory (default studio-editor/static-files.sha256)",
    "  --write-inventory      rewrite the inventory from the dist just built (instead of verifying it)",
  ].join("\n");
}

function parseArgs(argv) {
  const options = {
    lock: DEFAULT_LOCK,
    cacheDir: DEFAULT_CACHE_DIR,
    outDir: DEFAULT_OUT_DIR,
    inventory: DEFAULT_INVENTORY,
    writeInventory: false,
    help: false,
  };
  for (let i = 0; i < argv.length; i += 1) {
    const arg = argv[i];
    if (arg === "--help" || arg === "-h") {
      options.help = true;
      return options;
    }
    if (arg === "--write-inventory") {
      options.writeInventory = true;
      continue;
    }
    const value = argv[i + 1];
    if (arg === "--lock" || arg === "--cache-dir" || arg === "--out-dir" || arg === "--inventory") {
      if (!value) throw new BuildError(`${arg} requires a value`);
      const key =
        arg === "--lock" ? "lock" : arg === "--cache-dir" ? "cacheDir" : arg === "--out-dir" ? "outDir" : "inventory";
      options[key] = path.resolve(value);
      i += 1;
      continue;
    }
    throw new BuildError(`unknown argument: ${arg}`);
  }
  return options;
}

function sha256(buffer) {
  return createHash("sha256").update(buffer).digest("hex");
}

function readLock(lockPath) {
  let lock;
  try {
    lock = JSON.parse(fs.readFileSync(lockPath, "utf8"));
  } catch (error) {
    throw new BuildError(`lock unreadable: ${lockPath} (${error.message})`);
  }
  for (const field of ["package", "version", "wheel_url", "sha256"]) {
    if (typeof lock[field] !== "string" || lock[field].length === 0) {
      throw new BuildError(`lock field "${field}" must be a non-empty string`);
    }
  }
  const indexHtml = lock.index_html;
  if (!indexHtml || typeof indexHtml.sha256 !== "string" || typeof indexHtml.size !== "number") {
    throw new BuildError('lock field "index_html" must carry the upstream sha256 and size');
  }
  const license = lock.license;
  if (!license || typeof license.sha256 !== "string" || typeof license.size !== "number") {
    throw new BuildError('lock field "license" must carry the licence sha256 and size');
  }
  if (typeof lock.static_files !== "number" || lock.static_files <= 0) {
    throw new BuildError('lock field "static_files" must be the number of files in the upstream static tree');
  }
  return lock;
}

/** Every file under `dir`, relative and sorted (an absent directory is empty). */
function walkFiles(dir) {
  const files = [];
  if (!fs.existsSync(dir)) return files;
  const stack = [dir];
  while (stack.length > 0) {
    const current = stack.pop();
    for (const dirent of fs.readdirSync(current, { withFileTypes: true })) {
      const absolute = path.join(current, dirent.name);
      if (dirent.isDirectory()) stack.push(absolute);
      else if (dirent.isFile()) files.push(path.relative(dir, absolute));
      else throw new BuildError(`refused non-regular file in the dist: ${absolute}`);
    }
  }
  return files.sort();
}

function totalBytes(dir) {
  return walkFiles(dir).reduce((sum, relative) => sum + fs.statSync(path.join(dir, relative)).size, 0);
}

function runFetch(options) {
  const result = spawnSync(
    process.execPath,
    [
      FETCH_SCRIPT,
      "--lock",
      options.lock,
      "--cache-dir",
      options.cacheDir,
      "--out-dir",
      options.outDir,
    ],
    { stdio: "inherit" }
  );
  if (result.error) throw new BuildError(`could not run the fetch script: ${result.error.message}`);
  if (result.status !== 0) throw new BuildError(`studio-editor-fetch exited with code ${result.status}`);
}

/**
 * Insert the one injected line after `<head>`, or verify it is already the
 * only difference from upstream. Returns the html that must be on disk.
 */
function inject(html, lock, outDir) {
  const occurrences = html.split(INJECT_TAG).length - 1;
  if (occurrences > 1) {
    throw new BuildError(`index.html carries the injected line ${occurrences} times (expected at most 1)`);
  }
  if (!html.includes("<head>")) throw new BuildError("index.html has no <head> to inject into");

  let injected = html;
  if (occurrences === 0) injected = html.replace("<head>", `<head>${INJECT_TAG}`);

  const stripped = injected.replace(INJECT_TAG, "");
  const digest = sha256(Buffer.from(stripped, "utf8"));
  if (digest !== lock.index_html.sha256) {
    throw new BuildError(
      `index.html differs from the pinned upstream file beyond the injected line\n` +
        `  expected sha256 ${lock.index_html.sha256}\n` +
        `  actual   sha256 ${digest}\n` +
        `  nothing was written to ${outDir}`
    );
  }
  if (Buffer.byteLength(stripped, "utf8") !== lock.index_html.size) {
    throw new BuildError(
      `index.html is ${Buffer.byteLength(stripped, "utf8")} bytes without the injected line, lock says ${lock.index_html.size}`
    );
  }
  const firstOtherScript = injected.indexOf("<script", INJECT_TAG.length);
  const tagIndex = injected.indexOf(INJECT_TAG);
  if (tagIndex > (firstOtherScript < 0 ? injected.length : firstOtherScript)) {
    throw new BuildError("the injected line is not the first <script> in index.html");
  }
  if (injected.indexOf(INJECT_TAG) !== injected.lastIndexOf(INJECT_TAG)) {
    throw new BuildError("index.html must carry exactly one injected line");
  }
  return injected;
}

function copySources(lock, outDir) {
  for (const [source, target] of COPIES) {
    const from = path.join(SOURCE_DIR, source);
    let content;
    try {
      content = fs.readFileSync(from);
    } catch (error) {
      throw new BuildError(`missing tracked source ${from}: ${error.message}`);
    }
    if (source.startsWith("LICENSE.")) {
      const digest = sha256(content);
      if (digest !== lock.license.sha256) {
        throw new BuildError(
          `licence file does not match the lock\n  expected ${lock.license.sha256}\n  actual   ${digest}`
        );
      }
      if (content.length !== lock.license.size) {
        throw new BuildError(`licence file is ${content.length} bytes, lock says ${lock.license.size}`);
      }
    }
    fs.writeFileSync(path.join(outDir, target), content);
  }
}

/** `sha256␠␠relative/path` for every file the dist ships, sorted by path. */
function inventoryText(outDir) {
  const lines = walkFiles(outDir)
    .sort()
    .map((relative) => `${sha256(fs.readFileSync(path.join(outDir, relative)))}  ${relative}`);
  return `${lines.join("\n")}\n`;
}

/** The tracked inventory must describe the dist exactly: same paths, same bytes. */
function verifyInventory(outDir, inventoryPath) {
  if (!fs.existsSync(inventoryPath)) {
    throw new BuildError(`there is no static file inventory at ${inventoryPath} — ${REGENERATE_HINT}`);
  }
  const recorded = new Map();
  for (const [lineNumber, line] of fs.readFileSync(inventoryPath, "utf8").split("\n").entries()) {
    if (!line) continue;
    const match = /^([0-9a-f]{64})  (.+)$/.exec(line);
    if (!match) throw new BuildError(`${inventoryPath}:${lineNumber + 1} is not \`<sha256>  <path>\``);
    if (recorded.has(match[2])) throw new BuildError(`${inventoryPath} lists ${match[2]} twice`);
    recorded.set(match[2], match[1]);
  }

  const actual = new Map(walkFiles(outDir).map((relative) => [relative, sha256(fs.readFileSync(path.join(outDir, relative)))]));
  const problems = [];
  for (const relative of [...recorded.keys()].sort()) {
    if (!actual.has(relative)) problems.push(`missing from the dist: ${relative}`);
    else if (actual.get(relative) !== recorded.get(relative)) problems.push(`contents differ: ${relative}`);
  }
  for (const relative of [...actual.keys()].sort()) {
    if (!recorded.has(relative)) problems.push(`not in the inventory: ${relative}`);
  }
  if (problems.length > 0) {
    const shown = problems.slice(0, 5).join("\n  ");
    const more = problems.length > 5 ? `\n  … and ${problems.length - 5} more` : "";
    throw new BuildError(`the static file inventory disagrees with the dist:\n  ${shown}${more} — ${REGENERATE_HINT}`);
  }
  return recorded.size;
}

function main() {
  const options = parseArgs(process.argv.slice(2));
  if (options.help) {
    console.log(usage());
    return 0;
  }

  // OFF BY DEFAULT — decided before anything is read, created or fetched.
  if (process.env[ENABLE_ENV] !== "1") {
    console.log(
      `studio-editor-build: editor dist skipped (${ENABLE_ENV} is not "1") — no network access, no files written`
    );
    return 0;
  }

  console.log(`studio-editor-build: ${ENABLE_ENV}=1 — building the pinned editor dist into ${options.outDir}`);
  const lock = readLock(options.lock);

  runFetch(options);

  const extracted = walkFiles(options.outDir);
  if (extracted.length !== lock.static_files) {
    throw new BuildError(
      `the extraction has ${extracted.length} files, the lock pins ${lock.static_files} (wrong wheel or layout)`
    );
  }
  const indexPath = path.join(options.outDir, "index.html");
  if (!fs.existsSync(indexPath)) throw new BuildError("the dist has no index.html");

  const injected = inject(fs.readFileSync(indexPath, "utf8"), lock, options.outDir);
  fs.writeFileSync(indexPath, injected);
  console.log(
    `studio-editor-build: index.html verified against the pinned upstream sha256 and given exactly one injected line`
  );

  copySources(lock, options.outDir);
  console.log(`studio-editor-build: copied ${COPIES.length} files (shim, protocol, licence, notice)`);

  const finalFiles = walkFiles(options.outDir);
  const expected = lock.static_files + COPIES.length;
  if (finalFiles.length !== expected) {
    throw new BuildError(`the dist holds ${finalFiles.length} files, expected ${expected}`);
  }
  for (const [, target] of COPIES) {
    if (!finalFiles.includes(target)) throw new BuildError(`the dist is missing ${target}`);
  }
  const finalIndex = fs.readFileSync(indexPath, "utf8");
  if (finalIndex.split(INJECT_TAG).length - 1 !== 1) {
    throw new BuildError("the dist index.html does not carry exactly one injected line");
  }
  const finalStripped = finalIndex.replace(INJECT_TAG, "");
  if (sha256(Buffer.from(finalStripped, "utf8")) !== lock.index_html.sha256) {
    throw new BuildError("the dist index.html no longer matches the pinned upstream file");
  }

  if (options.writeInventory) {
    fs.writeFileSync(options.inventory, inventoryText(options.outDir));
    console.log(`studio-editor-build: wrote the static file inventory (${finalFiles.length} files)`);
  } else {
    const count = verifyInventory(options.outDir, options.inventory);
    console.log(`studio-editor-build: static file inventory verified (${count} files, sha256 each)`);
  }

  console.log(
    `studio-editor-build: verified ${finalFiles.length} files, ${totalBytes(options.outDir)} bytes ` +
      `(${lock.package}==${lock.version}, licence ${lock.license.spdx ?? "see lock"})`
  );
  return 0;
}

/**
 * `p` as the filesystem really holds it — `argv[1]` may be a symlink or a
 * relative path, and comparing either of those with the module URL made
 * `invokedDirectly` false for a legitimate invocation.
 */
function realPathMaybe(p) {
  const resolved = path.resolve(p);
  try {
    return fs.realpathSync(resolved);
  } catch {
    return resolved;
  }
}

/**
 * Whether this file IS the process entry point. Both sides go through
 * `realpath` first: running the hook through a symlink used to make the
 * comparison fail, and the gated mode then printed "skipped" and exited 0 —
 * silently building nothing (review of #2214, nit: a fail-open gate).
 */
const invokedDirectly =
  Boolean(process.argv[1]) && realPathMaybe(process.argv[1]) === realPathMaybe(fileURLToPath(import.meta.url));
if (invokedDirectly) {
  try {
    process.exitCode = main();
  } catch (error) {
    const message = error instanceof Error ? error.message : String(error);
    console.error(`studio-editor-build: ${message}`);
    process.exitCode = 1;
  }
}

export { BuildError, COPIES, INJECT_TAG, inject, inventoryText, main, sha256, verifyInventory, walkFiles };