#!/usr/bin/env node
// Builds the repository's real sharp proof as a native Module Package for the hardened verifier
// container test. Run inside deploy/Dockerfile's build stage, where the workspace is already built
// and has exactly the locked dependencies the runtime image was built against.

import { cp, mkdir, mkdtemp, readFile, realpath, rm, symlink, writeFile } from "node:fs/promises";
import { tmpdir } from "node:os";
import path from "node:path";
import { packModule } from "@ekklesia/module-pack";

const repositoryRoot = path.resolve(import.meta.dirname, "..", "..", "..", "..");
const outDirectory = process.argv[2];
if (outDirectory === undefined || !path.isAbsolute(outDirectory)) {
  throw new Error("An absolute output directory is required.");
}

const temporaryRoot = await mkdtemp(path.join(tmpdir(), "ekklesia-native-verifier-proof-"));
try {
  const moduleDirectory = path.join(temporaryRoot, "native-proof");
  await cp(
    path.join(repositoryRoot, "packages", "module-pack", "tests", "fixtures", "native-module"),
    moduleDirectory,
    { recursive: true },
  );
  const packageFile = path.join(moduleDirectory, "package.json");
  const packageJson = JSON.parse(await readFile(packageFile, "utf8"));
  packageJson.engines = { node: ">=24.11.0 <25" };
  await writeFile(packageFile, `${JSON.stringify(packageJson, null, 2)}\n`);

  const modulesDirectory = path.join(moduleDirectory, "node_modules");
  await mkdir(path.join(modulesDirectory, "@ekklesia"), { recursive: true });
  await symlink(
    await realpath(path.join(repositoryRoot, "packages", "module-pack", "node_modules", "sharp")),
    path.join(modulesDirectory, "sharp"),
  );
  await symlink(
    await realpath(
      path.join(
        repositoryRoot,
        "packages",
        "module-pack",
        "node_modules",
        "@ekklesia",
        "module-sdk",
      ),
    ),
    path.join(modulesDirectory, "@ekklesia", "module-sdk"),
  );

  const result = await packModule({
    licenseFile: path.join(repositoryRoot, "LICENSE"),
    moduleDirectory,
    outDirectory,
    sourceRevision: "0".repeat(40),
    target: "linux-x64-glibc",
  });
  process.stdout.write(`${path.basename(result.archivePath)}\n`);
} finally {
  await rm(temporaryRoot, { force: true, recursive: true });
}