import { copyFile, mkdir, readFile, rm, stat, writeFile } from "node:fs/promises";
import { createHash } from "node:crypto";
import { execFileSync } from "node:child_process";
import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
import process from "node:process";

const root = resolve(new URL("..", import.meta.url).pathname.replace(/^\/(.:)/, "$1"));
const destination = resolve(process.argv[2] ?? "");
if (!process.argv[2] || destination === root || relative(root, destination).split(sep).includes("..") === false)
  throw new Error("Choose an empty export directory outside the canonical repository.");
if (execFileSync("git", ["status", "--porcelain"], { cwd: root, encoding: "utf8" }).trim())
  throw new Error("The canonical worktree must be clean before export.");
await stat(join(root, "LICENSE")).catch(() => { throw new Error("Confirm and commit a root LICENSE before public export."); });

const rules = (await readFile(join(root, "public-source.allowlist"), "utf8"))
  .split(/\r?\n/).map(line => line.trim()).filter(line => line && !line.startsWith("#"));
const tracked = execFileSync("git", ["ls-files", "-z"], { cwd: root, encoding: "utf8" })
  .split("\0").filter(Boolean).map(path => path.replaceAll("\\", "/"));
const allowed = path => rules.some(rule => rule.endsWith("/**") ?
  path.startsWith(rule.slice(0, -3) + "/") : path === rule);
const files = tracked.filter(allowed).sort();
const missing = rules.filter(rule => !rule.endsWith("/**") && !tracked.includes(rule));
if (missing.length) throw new Error(`Allowlisted files are missing: ${missing.join(", ")}`);

const proprietaryPayload = /\.(?:iso|rom|bin|cue|chd|rvz|wbfs|xci|nsp|keys|exe|nes|pbp)(?:\.|$)/i;
const privateMarkers = [
  ["192", "168", "10", "150"].join("."),
  ["ludarium", "itworx", "tech"].join("."),
  ["player", "ludarium", "itworx", "tech"].join("."),
];
const binaryExtensions = new Set([".png", ".jpg", ".jpeg", ".webp", ".gif", ".ico", ".mp4", ".woff", ".woff2", ".7z"]);
const extension = path => path.slice(path.lastIndexOf(".")).toLowerCase();

await rm(destination, { recursive: true, force: true });
await mkdir(destination, { recursive: true });
const manifestFiles = [];
for (const path of files) {
  if (isAbsolute(path) || path.split("/").includes("..")) throw new Error(`Unsafe allowlisted path: ${path}`);
  const syntheticFixture = path.startsWith("fixtures/synthetic/");
  if (proprietaryPayload.test(path) && !syntheticFixture)
    throw new Error(`Proprietary payload extension is not publishable: ${path}`);
  const source = join(root, path);
  const metadata = await stat(source);
  if (!metadata.isFile() || metadata.size > 50 * 1024 * 1024 || (syntheticFixture && metadata.size > 1024 * 1024))
    throw new Error(`Irregular or oversized public file: ${path}`);
  const data = await readFile(source);
  if (!binaryExtensions.has(extension(path))) {
    const text = data.toString("utf8");
    const marker = privateMarkers.find(value => text.toLowerCase().includes(value));
    if (marker) throw new Error(`Private infrastructure marker found in ${path}`);
  }
  const target = join(destination, path);
  await mkdir(dirname(target), { recursive: true });
  await copyFile(source, target);
  manifestFiles.push({ path, bytes: metadata.size, sha256: createHash("sha256").update(data).digest("hex") });
}

const sourceRevision = execFileSync("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" }).trim();
await writeFile(join(destination, "PUBLIC_SOURCE_MANIFEST.json"), JSON.stringify({
  schemaVersion: 1,
  sourceRevision,
  generatedAt: new Date().toISOString(),
  files: manifestFiles,
}, null, 2) + "\n");
console.log(`Exported ${files.length} reviewed files from ${sourceRevision} to ${destination}`);