#!/usr/bin/env bun
/**
 * Publishes the public @executor-js/* workspace packages to npm.
 *
 * Walks a hard-coded list of publishable package directories, determines the
 * dist-tag from the version string (anything containing `-` is treated as beta),
 * and packs + publishes each package whose current version is not already on npm.
 *
 * Invoked from `.github/workflows/release.yml` via the `publish:` input on
 * changesets/action after the Version Packages PR has been merged, and locally
 * via `bun run release:publish:packages` (or `--dry-run`).
 */
import { $ } from "bun";
import { existsSync } from "node:fs";
import { readdir, readFile, rm, stat, writeFile } from "node:fs/promises";
import { dirname, join, resolve } from "node:path";
import { fileURLToPath } from "node:url";

type Channel = "latest" | "beta";

const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");

/**
 * The repo uses `@executor/*` internally (matching historical package names
 * and the workspace graph) but publishes under `@executor-js/*` because the
 * short scope was taken on npm. At pack time we rewrite package manifests and
 * compiled `dist/` artifacts so the tarball ships with the public scope —
 * source code stays unchanged. Only package names in `PUBLIC_PACKAGE_DIRS`
 * are rewritten; unpublished peer deps like `@executor/api` / `@executor/react`
 * are left alone (they're optional peers and users who don't install them
 * just see a warning).
 */
const INTERNAL_SCOPE = "@executor";
const PUBLISHED_SCOPE = "@executor-js";

/**
 * Workspace-relative paths of the public packages. Kept explicit so a new
 * directory under `packages/plugins/` does not accidentally ship to npm.
 */
const PUBLIC_PACKAGE_DIRS = [
  "packages/core/storage-core",
  "packages/kernel/core",
  "packages/kernel/runtime-quickjs",
  "packages/core/sdk",
  "packages/core/execution",
  "packages/core/cli",
  "packages/plugins/file-secrets",
  "packages/plugins/google-discovery",
  "packages/plugins/graphql",
  "packages/plugins/keychain",
  "packages/plugins/mcp",
  "packages/plugins/onepassword",
  "packages/plugins/openapi",
] as const;

const parseArgs = (argv: ReadonlyArray<string>): { dryRun: boolean } => {
  let dryRun = false;
  for (const arg of argv) {
    if (arg === "--dry-run") {
      dryRun = true;
      continue;
    }
    throw new Error(`Unknown argument: ${arg}`);
  }
  return { dryRun };
};

const resolveChannel = (version: string): Channel => (version.includes("-") ? "beta" : "latest");

const readPackageMeta = async (pkgDir: string) => {
  const pkgJsonPath = join(pkgDir, "package.json");
  const pkg = (await Bun.file(pkgJsonPath).json()) as {
    name?: string;
    version?: string;
    private?: boolean;
  };

  if (!pkg.name || !pkg.version) {
    throw new Error(`Missing name/version in ${pkgJsonPath}`);
  }
  if (pkg.private === true) {
    throw new Error(`${pkg.name} is marked private and cannot be published`);
  }

  return { name: pkg.name, version: pkg.version };
};

const packageAlreadyPublished = async (name: string, version: string): Promise<boolean> => {
  const proc = Bun.spawn(["npm", "view", `${name}@${version}`, "version"], {
    stdio: ["ignore", "ignore", "ignore"],
  });
  return (await proc.exited) === 0;
};

type DependencyBlock = Record<string, string>;
type MutablePackageJson = {
  name?: string;
  dependencies?: DependencyBlock;
  devDependencies?: DependencyBlock;
  peerDependencies?: DependencyBlock;
  optionalDependencies?: DependencyBlock;
  [key: string]: unknown;
};

/**
 * Rewrites the internal `@executor/*` scope to the published `@executor-js/*`
 * scope for the given set of names, inside both `package.json` (name +
 * dep blocks) and compiled `dist/` artifacts (`.js`, `.d.ts`). Also resolves
 * `workspace:*` dep references to concrete versions, since `bun pm pack`
 * can't resolve workspace specifiers that no longer match any workspace name
 * (after the rename). Returns a restore function that reverts every file we
 * touched. Only names in `publishable` are rewritten — `@executor/api` and
 * `@executor/react` are left alone because they're unpublished optional peers.
 */
const applyScopeRename = async (
  pkgDir: string,
  publishable: ReadonlySet<string>,
  publishableVersions: ReadonlyMap<string, string>,
): Promise<() => Promise<void>> => {
  const toPublished = (internal: string): string =>
    internal.replace(`${INTERNAL_SCOPE}/`, `${PUBLISHED_SCOPE}/`);
  const toInternal = (published: string): string =>
    published.replace(`${PUBLISHED_SCOPE}/`, `${INTERNAL_SCOPE}/`);

  const publishableInternalNames = new Set<string>();
  for (const published of publishable) publishableInternalNames.add(toInternal(published));

  const renameDepBlock = (block: DependencyBlock | undefined): DependencyBlock | undefined => {
    if (!block) return block;
    const next: DependencyBlock = {};
    let mutated = false;
    for (const [key, value] of Object.entries(block)) {
      if (publishableInternalNames.has(key)) {
        const newKey = toPublished(key);
        // Resolve workspace:* to the concrete version of the published package.
        const newValue = value.startsWith("workspace:")
          ? (publishableVersions.get(newKey) ?? value)
          : value;
        next[newKey] = newValue;
        mutated = true;
      } else {
        next[key] = value;
      }
    }
    return mutated ? next : block;
  };

  const snapshots = new Map<string, string>();
  const writeIfChanged = async (absPath: string, next: string): Promise<void> => {
    const original = await readFile(absPath, "utf8");
    if (next === original) return;
    snapshots.set(absPath, original);
    await writeFile(absPath, next);
  };

  // 1. package.json — rewrite `name` and every dep block structurally so we
  //    can also resolve workspace specifiers while we're here.
  const pkgJsonPath = join(pkgDir, "package.json");
  const pkgRaw = await readFile(pkgJsonPath, "utf8");
  const pkg = JSON.parse(pkgRaw) as MutablePackageJson;
  if (pkg.name && publishableInternalNames.has(pkg.name)) {
    pkg.name = toPublished(pkg.name);
  }
  pkg.dependencies = renameDepBlock(pkg.dependencies);
  pkg.devDependencies = renameDepBlock(pkg.devDependencies);
  pkg.peerDependencies = renameDepBlock(pkg.peerDependencies);
  pkg.optionalDependencies = renameDepBlock(pkg.optionalDependencies);
  const pkgNext = `${JSON.stringify(pkg, null, 2)}\n`;
  if (pkgNext !== pkgRaw) {
    snapshots.set(pkgJsonPath, pkgRaw);
    await writeFile(pkgJsonPath, pkgNext);
  }

  // 2. dist/**/*.{js,d.ts} — plain string replace of import specifiers, one
  //    package name at a time. Longest-first avoids partial matches.
  const orderedInternal = [...publishableInternalNames].sort((a, b) => b.length - a.length);
  const replaceAllInText = (text: string): string => {
    let out = text;
    for (const internal of orderedInternal) {
      out = out.split(internal).join(toPublished(internal));
    }
    return out;
  };
  const distDir = join(pkgDir, "dist");
  if (existsSync(distDir)) {
    const walk = async (dir: string): Promise<void> => {
      const entries = await readdir(dir);
      for (const entry of entries) {
        const abs = join(dir, entry);
        const info = await stat(abs);
        if (info.isDirectory()) {
          await walk(abs);
          continue;
        }
        if (entry.endsWith(".js") || entry.endsWith(".d.ts")) {
          const original = await readFile(abs, "utf8");
          await writeIfChanged(abs, replaceAllInText(original));
        }
      }
    };
    await walk(distDir);
  }

  return async () => {
    for (const [path, original] of snapshots) {
      await writeFile(path, original);
    }
  };
};

/**
 * Applies `publishConfig` field overrides to package.json in place, returning a
 * function that restores the original file. `bun pm pack` does not substitute
 * `publishConfig.exports` / `publishConfig.main` etc at pack time (npm does,
 * but only for a subset of fields and only for `npm pack`), so we rewrite the
 * file ourselves so the packed tarball has the correct `exports` pointing at
 * `dist/` instead of the dev-time `src/index.ts`.
 */
const applyPublishConfig = async (pkgDir: string): Promise<() => Promise<void>> => {
  const pkgJsonPath = join(pkgDir, "package.json");
  const original = await readFile(pkgJsonPath, "utf8");
  const parsed = JSON.parse(original) as {
    publishConfig?: Record<string, unknown>;
    [key: string]: unknown;
  };

  const publishConfig = parsed.publishConfig;
  if (!publishConfig || typeof publishConfig !== "object") {
    return async () => {};
  }

  // Fields we allow publishConfig to override. `access`/`tag`/`registry` are
  // real npm publish-time config keys — they must NOT be hoisted into the
  // top-level manifest.
  const overridable = new Set([
    "exports",
    "main",
    "module",
    "types",
    "typings",
    "bin",
    "browser",
    "files",
  ]);

  const nextPublishConfig: Record<string, unknown> = {};
  let mutated = false;
  for (const [key, value] of Object.entries(publishConfig)) {
    if (overridable.has(key)) {
      parsed[key] = value;
      mutated = true;
    } else {
      nextPublishConfig[key] = value;
    }
  }

  if (!mutated) {
    return async () => {};
  }

  if (Object.keys(nextPublishConfig).length === 0) {
    delete parsed.publishConfig;
  } else {
    parsed.publishConfig = nextPublishConfig;
  }

  await writeFile(pkgJsonPath, `${JSON.stringify(parsed, null, 2)}\n`);
  return async () => {
    await writeFile(pkgJsonPath, original);
  };
};

const publishPackage = async (
  pkgDir: string,
  dryRun: boolean,
  publishable: ReadonlySet<string>,
  publishableVersions: ReadonlyMap<string, string>,
) => {
  const { name: internalName, version } = await readPackageMeta(pkgDir);
  const publishedName = internalName.replace(`${INTERNAL_SCOPE}/`, `${PUBLISHED_SCOPE}/`);
  const channel = resolveChannel(version);

  if (!existsSync(join(pkgDir, "dist"))) {
    throw new Error(`Missing dist/ in ${pkgDir}. Did you run 'bun run build:packages'?`);
  }

  if (await packageAlreadyPublished(publishedName, version)) {
    console.log(`[skip] ${publishedName}@${version} already on npm`);
    return;
  }

  console.log(`[publish] ${publishedName}@${version} (${channel})${dryRun ? " [dry-run]" : ""}`);

  // Clean any stale tarballs from previous runs so our readdir finds exactly
  // the archive produced by the pack below.
  const stale = (await readdir(pkgDir)).filter((entry) => entry.endsWith(".tgz"));
  for (const entry of stale) {
    await rm(join(pkgDir, entry), { force: true });
  }

  // Order matters: rename the scope first so publishConfig sees the final
  // package.json, then apply publishConfig on top. Restore in reverse.
  const restoreScope = await applyScopeRename(pkgDir, publishable, publishableVersions);
  const restorePublishConfig = await applyPublishConfig(pkgDir);
  try {
    await $`bun pm pack`.cwd(pkgDir);
  } finally {
    await restorePublishConfig();
    await restoreScope();
  }

  const produced = (await readdir(pkgDir)).filter((entry) => entry.endsWith(".tgz"));
  if (produced.length !== 1) {
    throw new Error(
      `Expected exactly 1 .tgz in ${pkgDir}, found ${produced.length}: ${produced.join(", ")}`,
    );
  }
  const tarball = produced[0]!;

  if (dryRun) {
    return;
  }

  const args = ["publish", tarball, "--access", "public", "--tag", channel];
  if (process.env.GITHUB_ACTIONS === "true") {
    args.push("--provenance");
  }
  await $`npm ${args}`.cwd(pkgDir);
};

const main = async () => {
  const { dryRun } = parseArgs(process.argv.slice(2));

  // Each package's own version determines its dist-tag (pre-release versions
  // with `-` publish to `beta`, everything else to `latest`). Packages are
  // only skipped when their current version is already on npm.
  console.log(`Publishing ${PUBLISHED_SCOPE} packages${dryRun ? " [dry-run]" : ""}`);

  await $`bun run build:packages`.cwd(repoRoot);

  // Snapshot the internal package names and versions up front so
  // applyScopeRename knows (a) which `@executor/*` references to rewrite
  // (vs. unpublished peer deps like `@executor/api` that should be left
  // alone) and (b) how to resolve `workspace:*` dep specifiers after the
  // rename — `bun pm pack` can no longer resolve them itself once the name
  // doesn't match any workspace.
  const publishable = new Set<string>();
  const publishableVersions = new Map<string, string>();
  for (const relDir of PUBLIC_PACKAGE_DIRS) {
    const pkg = await readPackageMeta(join(repoRoot, relDir));
    const publishedName = pkg.name.replace(`${INTERNAL_SCOPE}/`, `${PUBLISHED_SCOPE}/`);
    publishable.add(publishedName);
    publishableVersions.set(publishedName, pkg.version);
  }

  for (const relDir of PUBLIC_PACKAGE_DIRS) {
    await publishPackage(join(repoRoot, relDir), dryRun, publishable, publishableVersions);
  }
};

await main();