import { createHash } from 'node:crypto';
import { readFile, readdir, stat } from 'node:fs/promises';
import path from 'node:path';

const desktopDir = path.resolve(new URL('..', import.meta.url).pathname);
const repoDir = path.resolve(desktopDir, '..', '..');
const webDir = path.join(repoDir, 'apps', 'web');
const requiredDesktop = ['package.json', 'main.cjs', 'preload.cjs', 'url-validation.js', 'connection.html', 'desktop-manifest.json'];
const secretAssignment = /(?:api[_-]?key|secret|token|password|private[_-]?key)\s*[:=]\s*['"][^'"\n]{8,}['"]/i;
const fail = (message) => { throw new Error(message); };
async function filesUnder(dir) {
  const output = [];
  async function walk(current) {
    for (const entry of await readdir(current, { withFileTypes: true })) {
      if (entry.name === 'node_modules' || entry.name === '.git' || entry.name === 'release') continue;
      const full = path.join(current, entry.name);
      if (entry.isDirectory()) await walk(full); else output.push(full);
    }
  }
  await walk(dir); return output.sort();
}
const digest = (buffer) => `sha256-${createHash('sha256').update(buffer).digest('hex')}`;
for (const file of requiredDesktop) await stat(path.join(desktopDir, file)).catch(() => fail(`Missing desktop entrypoint: ${file}`));
const webManifest = JSON.parse(await readFile(path.join(webDir, 'asset-manifest.json'), 'utf8'));
if (webManifest.schema !== 1 || !webManifest.version || !webManifest.integrity) fail('Invalid apps/web asset manifest');
const listed = [...new Set([...(webManifest.entrypoints || []), ...(webManifest.publicAssets || [])])].sort();
if (!listed.includes('index.html')) fail('Web manifest must include index.html');
for (const [relative, expected] of Object.entries(webManifest.integrity)) {
  const full = path.join(webDir, relative);
  await stat(full).catch(() => fail(`Manifest asset is missing: ${relative}`));
  const actual = digest(await readFile(full));
  if (actual !== expected) fail(`Integrity mismatch for ${relative}`);
}
for (const relative of listed) if (!webManifest.integrity[relative]) fail(`Manifest asset lacks integrity: ${relative}`);
const desktopManifest = JSON.parse(await readFile(path.join(desktopDir, 'desktop-manifest.json'), 'utf8'));
for (const relative of desktopManifest.assets || []) await stat(path.resolve(desktopDir, relative)).catch(() => fail(`Desktop manifest asset is missing: ${relative}`));
const files = [...await filesUnder(webDir), ...await filesUnder(desktopDir)];
for (const file of files) {
  const buffer = await readFile(file);
  if (buffer.includes(0)) continue;
  if (secretAssignment.test(buffer.toString('utf8'))) fail(`Secret-like assignment found in ${path.relative(repoDir, file)}`);
}
const packageJson = JSON.parse(await readFile(path.join(desktopDir, 'package.json'), 'utf8'));
if (packageJson.main !== 'main.cjs') fail('package.json main must be main.cjs');
if (!packageJson.build?.extraResources?.some((item) => item.from === '../web' && item.to === 'web')) fail('Build must copy apps/web into packaged resources');
const targets = packageJson.build?.win?.target || [];
if (!targets.some((target) => target.target === 'nsis')) fail('Windows NSIS target is missing');
if (!targets.some((target) => target.target === 'portable')) fail('Windows portable target is missing');
console.log(`Packaging verification passed: ${listed.length} web assets, ${files.length} scanned source files, NSIS + portable targets.`);