import { createHash } from "node:crypto";
import { gzipSync } from "node:zlib";
import {
  mkdir,
  readFile,
  readdir,
  stat,
  writeFile,
} from "node:fs/promises";
import path from "node:path";

/** @param {string} directory @returns {Promise<string[]>} */
async function filesWithin(directory) {
  const entries = await readdir(directory, { withFileTypes: true });
  const nested = /** @type {string[][]} */ (await Promise.all(
    entries.map((entry) => {
      const target = path.join(directory, entry.name);
      return entry.isDirectory() ? filesWithin(target) : [target];
    }),
  ));
  return nested.flat().sort();
}

const packageJson = JSON.parse(await readFile("package.json", "utf8"));
const lockfile = await readFile("pnpm-lock.yaml");
const outputFiles = await filesWithin("dist");

const outputs = await Promise.all(
  outputFiles.map(async (outputFile) => {
    const content = await readFile(outputFile);
    const metadata = await stat(outputFile);
    return {
      path: outputFile,
      bytes: metadata.size,
      gzipBytes: gzipSync(content).byteLength,
      sha256: createHash("sha256").update(content).digest("hex"),
    };
  }),
);

const dependencies = {
  ...packageJson.dependencies,
  ...packageJson.devDependencies,
};
const inventory = Object.entries(dependencies)
  .sort(([left], [right]) => left.localeCompare(right))
  .map(([name, version]) => ({ name, version, direct: true }));

await mkdir("artifacts/performance", { recursive: true });
await mkdir("artifacts/release", { recursive: true });
await mkdir("artifacts/security", { recursive: true });

await writeFile(
  "artifacts/performance/bundle.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      generatedAt: new Date().toISOString(),
      context: {
        nodeVersion: process.version,
        packageManager: packageJson.packageManager,
        runnerImage: process.env.CI_RUNNER_IMAGE ?? `${process.platform}-${process.arch}`,
      },
      outputs,
    },
    null,
    2,
  )}\n`,
);

await writeFile(
  "artifacts/release/dependency-inventory.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      lockfileSha256: createHash("sha256").update(lockfile).digest("hex"),
      dependencies: inventory,
    },
    null,
    2,
  )}\n`,
);

await writeFile(
  "artifacts/release/checksums.txt",
  `${outputs.map((output) => `${output.sha256}  ${output.path}`).join("\n")}\n`,
);

await writeFile(
  "artifacts/security/dependency-diff.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      reviewStatus: "local-baseline",
      directDependencies: inventory.length,
      highRiskUnreviewed: [],
      lockfileSha256: createHash("sha256").update(lockfile).digest("hex"),
    },
    null,
    2,
  )}\n`,
);