#!/usr/bin/env bash
# SPDX-License-Identifier: GPL-3.0-or-later

set -euo pipefail

if [ "$#" -ne 1 ]; then
  echo "Usage: $0 OUTPUT_DIRECTORY" >&2
  exit 2
fi

ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
OUTPUT_DIR="$1"

if [ -e "$OUTPUT_DIR" ]; then
  echo "Output path already exists: $OUTPUT_DIR" >&2
  exit 1
fi
if ! git -C "$ROOT_DIR" -c core.fileMode=false diff --ignore-space-at-eol --quiet \
  || ! git -C "$ROOT_DIR" -c core.fileMode=false diff --cached --quiet; then
  echo "Commit or stash repository changes before creating a public export." >&2
  exit 1
fi

mkdir -p "$OUTPUT_DIR"
git -C "$ROOT_DIR" archive --format=tar HEAD | tar -xf - -C "$OUTPUT_DIR"

# Agent instructions contain private research-session context and are not part
# of the distributable library or its safety evidence.
find "$OUTPUT_DIR" -type f -name AGENTS.md -delete

for forbidden in \
  '.env' '*.pem' '*.key' '*.p12' '*.pfx' '*.db' '*.sqlite' '*.sqlite3' \
  '*.elf' '*.self' '*.bin' '*.dmp' '*.core' '*.zip' \
  'secret.key' 'id_rsa' 'id_ed25519'; do
  if find "$OUTPUT_DIR" -type f -name "$forbidden" -print -quit | grep -q .; then
    echo "Forbidden file found in public export: $forbidden" >&2
    exit 1
  fi
done

if grep -RIlE --exclude='export-public-source.sh' \
  '192\.168\.10\.150|NuklearRabbit|C:\\Users\\Jens' "$OUTPUT_DIR" >/dev/null; then
  echo "Private operator marker found in public export." >&2
  exit 1
fi
if find "$OUTPUT_DIR" -type f -size +10M -print -quit | grep -q .; then
  echo "Unexpected file larger than 10 MiB found in public export." >&2
  exit 1
fi

git -C "$OUTPUT_DIR" init -q
# The export is created in a fresh repository, so source paths that happen to
# match a diagnostic ignore rule (for example src/core/) must still be added.
git -C "$OUTPUT_DIR" add --force .
git -C "$OUTPUT_DIR" -c user.name='Chimera GFX release export' \
  -c user.email='release-export@invalid.example' \
  commit -q -m "Publish Chimera GFX source"

EXPECTED_FILES="$(mktemp)"
ACTUAL_FILES="$(mktemp)"
trap 'rm -f "$EXPECTED_FILES" "$ACTUAL_FILES"' EXIT
git -C "$ROOT_DIR" ls-tree -r --name-only HEAD \
  | grep -Ev '(^|/)AGENTS\.md$' \
  | LC_ALL=C sort > "$EXPECTED_FILES"
git -C "$OUTPUT_DIR" ls-files | LC_ALL=C sort > "$ACTUAL_FILES"
if ! diff -u "$EXPECTED_FILES" "$ACTUAL_FILES"; then
  echo "Public export does not contain the complete tracked source tree." >&2
  exit 1
fi

(
  cd "$OUTPUT_DIR"
  git ls-files -z | sort -z | xargs -0 sha256sum > PUBLIC-SOURCE-MANIFEST.sha256
)
git -C "$OUTPUT_DIR" add PUBLIC-SOURCE-MANIFEST.sha256
git -C "$OUTPUT_DIR" -c user.name='Chimera GFX release export' \
  -c user.email='release-export@invalid.example' \
  commit -q --amend --no-edit
git -C "$OUTPUT_DIR" tag public-release-baseline

echo "Public source export created at $OUTPUT_DIR"
echo "Commit: $(git -C "$OUTPUT_DIR" rev-parse HEAD)"