anodizer_stage_nsis/

lib.rs

use std::collections::HashMap;
use std::fs;
use std::path::PathBuf;
use std::process::Command;

use anyhow::{Context as _, Result};

use anodizer_core::artifact::{Artifact, ArtifactKind};
use anodizer_core::context::Context;
use anodizer_core::stage::Stage;

// ---------------------------------------------------------------------------
// Default NSIS script
// ---------------------------------------------------------------------------

/// Generate a default `.nsi` script template using Tera syntax.
///
/// Uses `{{ ProjectName }}`, `{{ NsisOutputFile }}`, `{{ ProgramFiles }}`,
/// `{{ NsisBinaryPath }}`, and `{{ NsisBinaryName }}`. `NsisOutputFile` is
/// the absolute path makensis writes the installer to (equal to the recorded
/// artifact path); makensis resolves a relative `OutFile` against the script's
/// directory, which is an ephemeral staging dir, so it must be absolute.
/// `ProgramFiles` resolves to `$PROGRAMFILES64` on 64-bit targets and
/// `$PROGRAMFILES` on 32-bit targets, so the installer lands in the correct
/// directory on all Windows variants.
pub fn default_nsi_script() -> &'static str {
    r#"!include "MUI2.nsh"
Name "{{ ProjectName }}"
OutFile "{{ NsisOutputFile }}"
InstallDir "{{ ProgramFiles }}\{{ ProjectName }}"
RequestExecutionLevel admin
!insertmacro MUI_PAGE_DIRECTORY
!insertmacro MUI_PAGE_INSTFILES
!insertmacro MUI_LANGUAGE "English"
Section "Install"
    SetOutPath "$INSTDIR"
    File "{{ NsisBinaryPath }}"
    CreateShortCut "$DESKTOP\{{ ProjectName }}.lnk" "$INSTDIR\{{ NsisBinaryName }}"
    WriteUninstaller "$INSTDIR\uninstall.exe"
SectionEnd
Section "Uninstall"
    Delete "$INSTDIR\{{ NsisBinaryName }}"
    Delete "$DESKTOP\{{ ProjectName }}.lnk"
    Delete "$INSTDIR\uninstall.exe"
    RMDir "$INSTDIR"
SectionEnd
"#
}

// ---------------------------------------------------------------------------
// makensis command construction
// ---------------------------------------------------------------------------

/// Build the `makensis` CLI arguments.
///
/// - `script_path`: path to the `.nsi` script file
pub fn nsis_command(script_path: &str) -> Vec<String> {
    vec!["makensis".to_string(), script_path.to_string()]
}

/// Resolve the installer output path to an absolute, cwd-independent path.
///
/// makensis is invoked with the rendered `.nsi` script, and it chdir's to the
/// script's directory — an ephemeral staging tempdir — before resolving a
/// relative `OutFile`. The recorded `Artifact.path` is later relativized to the
/// process cwd by the registry (for deterministic `artifacts.json`), so the
/// OutFile makensis writes to must be the absolute path that resolves to that
/// same cwd-relative location. `canonicalize` is tried first (it resolves
/// symlinks and `.` components) but fails pre-build because the file does not
/// exist yet, so the cwd-join branch is what fires for a relative input.
fn absolutize_output_path(path: PathBuf) -> PathBuf {
    std::fs::canonicalize(&path).unwrap_or_else(|_| {
        if path.is_absolute() {
            path
        } else {
            std::env::current_dir()
                .map(|c| c.join(&path))
                .unwrap_or(path)
        }
    })
}

// ---------------------------------------------------------------------------
// NsisStage
// ---------------------------------------------------------------------------

pub struct NsisStage;

/// Parse Os and Arch from a Rust target triple using the shared mapping.
fn os_arch_from_target(target: Option<&str>) -> (String, String) {
    anodizer_core::target::os_arch_with_default(target, "windows")
}

/// Map a Go/Rust-style architecture identifier to the NSIS-native name.
///
/// Recognised values:
/// `x86` for 32-bit, `x64` for 64-bit AMD, `arm64` for ARM 64-bit.
pub(crate) fn map_arch_to_nsis(arch: &str) -> &str {
    match arch {
        "amd64" | "x86_64" => "x64",
        "386" | "i386" | "i586" | "i686" | "x86" => "x86",
        "arm64" | "aarch64" => "arm64",
        other => other,
    }
}

/// Return the correct NSIS `$PROGRAMFILESxx` constant for the given arch.
///
/// 64-bit targets use `$PROGRAMFILES64`; all others use `$PROGRAMFILES`.
/// This prevents installers from landing in the WOW6432-redirected path
/// (`Program Files (x86)`) on 64-bit Windows.
pub(crate) fn program_files_for_arch(nsis_arch: &str) -> &str {
    if nsis_arch == "x64" || nsis_arch == "arm64" {
        "$PROGRAMFILES64"
    } else {
        "$PROGRAMFILES"
    }
}

/// Default output filename template.
///
/// `Arch` here is the NSIS-native arch (`x86`, `x64`, `arm64`) injected
/// per-target before the name is rendered.
const DEFAULT_NAME_TEMPLATE: &str = "{{ ProjectName }}_{{ Arch }}_setup";

impl Stage for NsisStage {
    fn name(&self) -> &str {
        "nsis"
    }

    fn run(&self, ctx: &mut Context) -> Result<()> {
        let log = ctx.logger("nsis");
        let selected = ctx.options.selected_crates.clone();
        let dry_run = ctx.options.dry_run;
        let dist = ctx.config.dist.clone();

        // Collect crates that have NSIS config
        let crates: Vec<_> = ctx
            .config
            .crates
            .iter()
            .filter(|c| selected.is_empty() || selected.contains(&c.name))
            .filter(|c| c.nsis.is_some())
            .cloned()
            .collect();

        if crates.is_empty() {
            return Ok(());
        }

        // In workspace per-crate mode the same pipeline run produces an NSIS
        // installer for each crate. Rebinding `ProjectName` to the current
        // crate's name (mirroring the archive stage) keeps default name
        // templates like `{{ ProjectName }}_{{ Arch }}_setup` distinct per crate
        // so two crates' installers don't render the same filename and clobber
        // each other. Restored after the loop.
        let multi_crate = crates.len() > 1;
        let original_project_name = ctx
            .template_vars()
            .get("ProjectName")
            .cloned()
            .unwrap_or_else(|| ctx.config.project_name.clone());

        let mut new_artifacts: Vec<Artifact> = Vec::new();
        let mut archives_to_remove: Vec<PathBuf> = Vec::new();

        // Capture the loop result rather than `?`-ing inside it: a per-crate
        // failure must still restore the rebound `ProjectName` below before
        // propagating, so the workspace value never leaks past this stage.
        let loop_result: Result<()> = (|| {
            for krate in &crates {
                let Some(nsis_configs) = krate.nsis.as_ref() else {
                    continue;
                };
                if multi_crate {
                    ctx.template_vars_mut().set("ProjectName", &krate.name);
                }

                // Collect Windows binary artifacts for this crate
                let windows_binaries: Vec<_> = ctx
                    .artifacts
                    .by_kind_and_crate(ArtifactKind::Binary, &krate.name)
                    .into_iter()
                    .filter(|b| {
                        b.target
                            .as_deref()
                            .map(anodizer_core::target::is_windows)
                            .unwrap_or(false)
                    })
                    .cloned()
                    .collect();

                for nsis_cfg in nsis_configs {
                    let nsis_id_for_log = nsis_cfg.id.as_deref().unwrap_or("default").to_string();

                    // `nsis.if`: template-conditional skip (opt-in).
                    // Render error => hard bail (W1 avoidance).
                    let proceed = anodizer_core::config::evaluate_if_condition(
                        nsis_cfg.if_condition.as_deref(),
                        &format!(
                            "nsis config '{}' for crate '{}'",
                            nsis_id_for_log, krate.name
                        ),
                        |t| ctx.render_template(t),
                    )?;
                    if !proceed {
                        log.status(&format!(
                        "skipped nsis config '{}' for crate {} — `if` condition evaluated falsy",
                        nsis_id_for_log, krate.name
                    ));
                        continue;
                    }

                    // Skip configs marked skip:
                    if let Some(ref d) = nsis_cfg.skip {
                        let off = d
                            .try_evaluates_to_true(|s| ctx.render_template(s))
                            .with_context(|| {
                                format!("nsis: render skip template for crate {}", krate.name)
                            })?;
                        if off {
                            log.status(&format!("NSIS config skipped for crate {}", krate.name));
                            continue;
                        }
                    }

                    // Filter by build IDs if specified
                    let mut filtered = windows_binaries.clone();
                    if let Some(ref filter_ids) = nsis_cfg.ids
                        && !filter_ids.is_empty()
                    {
                        filtered.retain(|b| {
                            b.metadata
                                .get("id")
                                .map(|id| filter_ids.contains(id))
                                .unwrap_or(false)
                                || b.metadata
                                    .get("name")
                                    .map(|n| filter_ids.contains(n))
                                    .unwrap_or(false)
                        });
                    }

                    // `amd64_variant` filter.
                    // amd64-variant filtering:
                    // only constrains `amd64` artifacts. Non-amd64 always passes.
                    // Unset `amd64_variant` metadata is treated as `v1`.
                    if let Some(ref want) = nsis_cfg.amd64_variant {
                        filtered.retain(|b| {
                            let target = b.target.as_deref().unwrap_or("");
                            let (_, arch) = anodizer_core::target::map_target(target);
                            if arch != "amd64" {
                                return true;
                            }
                            b.metadata
                                .get("amd64_variant")
                                .map(String::as_str)
                                .unwrap_or("v1")
                                == want
                        });
                    }

                    // Warn and skip if no Windows binaries found
                    if filtered.is_empty() && windows_binaries.is_empty() {
                        log.skip_line(
                            ctx.options.show_skipped,
                            &format!(
                                "skipped NSIS generation for crate '{}' — no Windows binary \
                         artifacts found (expected binaries targeting windows)",
                                krate.name
                            ),
                        );
                        continue;
                    }
                    if filtered.is_empty() {
                        log.warn(&format!(
                            "skipped nsis for crate '{}' — ids filter {:?} matched no binaries",
                            krate.name, nsis_cfg.ids
                        ));
                        continue;
                    }

                    let effective_binaries: Vec<(Option<String>, PathBuf)> = filtered
                        .iter()
                        .map(|b| (b.target.clone(), b.path.clone()))
                        .collect();

                    // Validate extra_files shape up-front so misconfiguration fails
                    // before any subprocess spawn and surfaces in dry-run too.
                    // The canonical resolver bails when a constant name_template is
                    // paired with a multi-match glob (which would silently
                    // overwrite every match to the same dst name). The resolved set
                    // is recomputed at copy time below.
                    if let Some(extra_files) = &nsis_cfg.extra_files {
                        anodizer_core::extrafiles::resolve(extra_files, &log)
                            .context("nsis: validate extra_files")?;
                    }

                    // Check that makensis is available once per config (not per binary)
                    if !dry_run && !anodizer_core::util::find_binary("makensis") {
                        anyhow::bail!(
                            "makensis not found on PATH; install NSIS to create Windows installers"
                        );
                    }

                    for (target, binary_path) in &effective_binaries {
                        // Derive Os/Arch from the target triple for template rendering
                        let (os, arch) = os_arch_from_target(target.as_deref());

                        // Set Os/Arch/Target in the global vars so extra_files,
                        // templated_extra_files, and mod_timestamp can reference them.
                        ctx.template_vars_mut().set("Os", &os);
                        ctx.template_vars_mut().set("Arch", &arch);
                        ctx.template_vars_mut()
                            .set("Target", target.as_deref().unwrap_or(""));

                        // Build a one-shot render context with NSIS-native vars so
                        // user scripts can use these names without polluting
                        // the global template var table.
                        let nsis_arch = map_arch_to_nsis(&arch);
                        let program_files = program_files_for_arch(nsis_arch);

                        let binary_name_raw = binary_path
                            .file_name()
                            .and_then(|n| n.to_str())
                            .unwrap_or(&krate.name);

                        let binary_val = binary_name_raw.to_string();

                        // Determine output filename using the one-shot vars so `Arch`
                        // inside `name` sees NSIS-native values (`x64`, `x86`, `arm64`).
                        let name_template =
                            nsis_cfg.name.as_deref().unwrap_or(DEFAULT_NAME_TEMPLATE);

                        let mut name_vars = ctx.template_vars().clone();
                        name_vars.set("Arch", nsis_arch);
                        name_vars.set("ProgramFiles", program_files);
                        name_vars.set("Binary", &binary_val);

                        // Render the name first so it can be re-injected as `Name`
                        // for the script context.
                        let rendered_name =
                            anodizer_core::template::render(name_template, &name_vars)
                                .with_context(|| {
                                    format!(
                                        "nsis: render name template for crate {} target {:?}",
                                        krate.name, target
                                    )
                                })?;

                        name_vars.set("Name", &rendered_name);

                        // The recorded artifact path and the `OutFile` makensis is
                        // told to write must end in `.exe`. The default name template
                        // is extension-less (mirroring how dmg/pkg append `.dmg`/`.pkg`
                        // after rendering); append `.exe` here unless the user's custom
                        // `name` already supplies it (case-insensitive, no double-append).
                        let exe_filename = if rendered_name.to_ascii_lowercase().ends_with(".exe") {
                            rendered_name
                        } else {
                            format!("{rendered_name}.exe")
                        };

                        // Output goes in dist/windows/
                        let output_dir = dist.join("windows");
                        let exe_path = output_dir.join(&exe_filename);

                        // makensis chdir's to the .nsi script's directory (an
                        // ephemeral staging tempdir) before resolving a relative
                        // `OutFile`. Under the default `dist: ./dist`, `exe_path` is
                        // relative, so a relative OutFile would land the installer
                        // inside the staging tempdir (which then vanishes). The
                        // absolute path is cwd-independent and points makensis at the
                        // real `dist/windows/` location regardless of its chdir.
                        let exe_path = absolutize_output_path(exe_path);

                        let binary_name = binary_name_raw;

                        if dry_run {
                            log.status(&format!(
                                "(dry-run) would create NSIS installer {} for crate {} target {:?}",
                                exe_filename, krate.name, target
                            ));

                            if let Some(ts) = &nsis_cfg.mod_timestamp {
                                log.status(&format!("(dry-run) would apply mod_timestamp={ts}"));
                            }

                            new_artifacts.push(Artifact {
                                kind: ArtifactKind::Installer,
                                name: String::new(),
                                path: exe_path,
                                target: target.clone(),
                                crate_name: krate.name.clone(),
                                metadata: {
                                    let mut m =
                                        HashMap::from([("format".to_string(), "nsis".to_string())]);
                                    if let Some(id) = &nsis_cfg.id {
                                        m.insert("id".to_string(), id.clone());
                                    }
                                    m
                                },
                                size: None,
                            });

                            // If replace is set, mark archives for this crate+target for removal
                            archives_to_remove.extend(anodizer_core::util::collect_if_replace(
                                nsis_cfg.replace,
                                &ctx.artifacts,
                                &krate.name,
                                target.as_deref(),
                            ));

                            continue;
                        }

                        // Create output directory
                        fs::create_dir_all(&output_dir).with_context(|| {
                            format!("create NSIS output dir: {}", output_dir.display())
                        })?;

                        // Create staging directory
                        let staging_tmp =
                            tempfile::tempdir().context("create temp dir for NSIS staging")?;
                        let staging_dir = staging_tmp.path();

                        // Copy binary into staging dir
                        let staged_binary = staging_dir.join(binary_name);
                        fs::copy(binary_path, &staged_binary).with_context(|| {
                            format!("copy binary {} to staging dir", binary_path.display())
                        })?;

                        // Copy extra files into staging dir via the canonical
                        // resolver (dedup + sort + bail-on-multi-match when a
                        // name_template is set).
                        if let Some(extra_files) = &nsis_cfg.extra_files {
                            let resolved = anodizer_core::extrafiles::resolve(extra_files, &log)
                                .context("nsis: resolve extra_files")?;
                            for rf in resolved {
                                let dst_name = rf
                                    .name_template
                                    .or_else(|| {
                                        rf.path
                                            .file_name()
                                            .and_then(|n| n.to_str())
                                            .map(|s| s.to_string())
                                    })
                                    .unwrap_or_else(|| "extra".to_string());
                                let dst = staging_dir.join(&dst_name);
                                fs::copy(&rf.path, &dst).with_context(|| {
                                    format!("copy extra file {} to staging dir", rf.path.display())
                                })?;
                            }
                        }

                        // Process templated_extra_files: render and copy to staging dir
                        if let Some(ref tpl_specs) = nsis_cfg.templated_extra_files
                            && !tpl_specs.is_empty()
                        {
                            anodizer_core::templated_files::process_templated_extra_files(
                                tpl_specs,
                                ctx,
                                staging_dir,
                                "nsis",
                            )?;
                        }

                        // Populate the one-shot script context with the remaining
                        // NSIS-specific vars. name_vars already carries Arch/ProgramFiles/
                        // Binary/Name from the name-render step above.
                        let exe_path_str = exe_path.to_string_lossy().into_owned();
                        let staged_binary_str = staged_binary.to_string_lossy().into_owned();
                        name_vars.set("NsisOutputFile", &exe_path_str);
                        name_vars.set("NsisBinaryPath", &staged_binary_str);
                        name_vars.set("NsisBinaryName", binary_name);

                        // Keep global vars in sync for mod_timestamp and anything that
                        // follows — they use ctx.render_template, not name_vars.
                        ctx.template_vars_mut().set("NsisOutputFile", &exe_path_str);
                        ctx.template_vars_mut()
                            .set("NsisBinaryPath", &staged_binary_str);
                        ctx.template_vars_mut().set("NsisBinaryName", binary_name);

                        // Get the script content (user-provided or default), render
                        // through the one-shot context so NSIS-native vars are available.
                        let script_content = if let Some(script_tmpl) = &nsis_cfg.script {
                            fs::read_to_string(script_tmpl).with_context(|| {
                                format!("nsis: read script template: {script_tmpl}")
                            })?
                        } else {
                            default_nsi_script().to_string()
                        };

                        let rendered_script =
                            anodizer_core::template::render(&script_content, &name_vars)
                                .with_context(|| {
                                    format!(
                                        "nsis: render script for crate {} target {:?}",
                                        krate.name, target
                                    )
                                })?;

                        let nsi_script_path = staging_dir.join("installer.nsi");
                        fs::write(&nsi_script_path, &rendered_script).with_context(|| {
                            format!(
                                "nsis: write rendered script to {}",
                                nsi_script_path.display()
                            )
                        })?;

                        // Apply mod_timestamp if set (template-rendered, to staging dir contents)
                        if let Some(ref ts_tmpl) = nsis_cfg.mod_timestamp {
                            let ts = ctx
                                .render_template(ts_tmpl)
                                .with_context(|| "nsis: render mod_timestamp template")?;
                            anodizer_core::util::apply_mod_timestamp(staging_dir, &ts, &log)?;
                        }

                        // Build makensis command
                        let script_path_str = nsi_script_path.to_string_lossy().into_owned();
                        let cmd_args = nsis_command(&script_path_str);

                        log.verbose(&format!("running {}", cmd_args.join(" ")));

                        let output = Command::new(&cmd_args[0])
                            .args(&cmd_args[1..])
                            .output()
                            .with_context(|| {
                                format!(
                                    "execute makensis for crate {} target {:?}",
                                    krate.name, target
                                )
                            })?;
                        log.check_output(output, "nsis")?;

                        // Apply mod_timestamp to the output .exe if set (template-rendered)
                        if let Some(ref ts_tmpl) = nsis_cfg.mod_timestamp
                            && exe_path.exists()
                        {
                            let ts = ctx.render_template(ts_tmpl).with_context(
                                || "nsis: render mod_timestamp template for output",
                            )?;
                            let mtime = anodizer_core::util::parse_mod_timestamp(&ts)?;
                            anodizer_core::util::set_file_mtime(&exe_path, mtime)?;
                            log.status(&format!(
                                "applied mod_timestamp={ts} to {}",
                                exe_path.display()
                            ));
                        }

                        log.status(&format!(
                            "built installer {}",
                            exe_path
                                .file_name()
                                .map(|n| n.to_string_lossy().into_owned())
                                .unwrap_or_else(|| exe_path.to_string_lossy().into_owned())
                        ));

                        new_artifacts.push(Artifact {
                            kind: ArtifactKind::Installer,
                            name: String::new(),
                            path: exe_path,
                            target: target.clone(),
                            crate_name: krate.name.clone(),
                            metadata: {
                                let mut m =
                                    HashMap::from([("format".to_string(), "nsis".to_string())]);
                                if let Some(id) = &nsis_cfg.id {
                                    m.insert("id".to_string(), id.clone());
                                }
                                m
                            },
                            size: None,
                        });

                        // If replace is set, mark archives for this crate+target for removal
                        archives_to_remove.extend(anodizer_core::util::collect_if_replace(
                            nsis_cfg.replace,
                            &ctx.artifacts,
                            &krate.name,
                            target.as_deref(),
                        ));
                    }
                }
            }
            Ok(())
        })();

        if multi_crate {
            ctx.template_vars_mut()
                .set("ProjectName", &original_project_name);
        }
        loop_result?;

        anodizer_core::template::clear_per_target_vars(ctx.template_vars_mut());

        // Remove replaced archives
        if !archives_to_remove.is_empty() {
            ctx.artifacts.remove_by_paths(&archives_to_remove);
        }

        // Register new NSIS artifacts
        for artifact in new_artifacts {
            ctx.artifacts.add(artifact);
        }

        Ok(())
    }
}

// ---------------------------------------------------------------------------
// Tests
// ---------------------------------------------------------------------------

/// Environment requirements for the nsis stage: `makensis` when any
/// active `nsis:` entry exists and the configured build targets include
/// Windows (the stage only packages Windows binaries).
pub fn env_requirements(
    ctx: &anodizer_core::context::Context,
) -> Vec<anodizer_core::EnvRequirement> {
    if !anodizer_core::env_preflight::configured_build_targets(ctx)
        .iter()
        .any(|t| anodizer_core::target::is_windows(t))
    {
        return Vec::new();
    }
    let configured = anodizer_core::env_preflight::crate_universe(&ctx.config)
        .into_iter()
        .flat_map(|c| c.nsis.iter().flatten())
        .any(|cfg| {
            !anodizer_core::env_preflight::entry_inactive(
                ctx,
                cfg.skip.as_ref(),
                None,
                cfg.if_condition.as_deref(),
            )
        });
    if !configured {
        return Vec::new();
    }
    vec![anodizer_core::EnvRequirement::Tool {
        name: "makensis".to_string(),
    }]
}

#[cfg(test)]
#[allow(clippy::field_reassign_with_default)]
mod tests {
    use super::*;
    use std::path::PathBuf;

    // -----------------------------------------------------------------------
    // Default NSI script generation
    // -----------------------------------------------------------------------

    #[test]
    fn test_default_nsi_script_generation() {
        let script = default_nsi_script();

        assert!(
            script.contains("!include \"MUI2.nsh\""),
            "should include MUI2"
        );
        assert!(
            script.contains("Name \"{{ ProjectName }}\""),
            "should reference ProjectName"
        );
        // OutFile must be the absolute NsisOutputFile (the recorded artifact
        // path), never a bare relative filename — makensis resolves a relative
        // OutFile against the ephemeral staging dir.
        assert!(
            script.contains("OutFile \"{{ NsisOutputFile }}\""),
            "should use the absolute NsisOutputFile var for OutFile"
        );
        assert!(
            !script.contains("OutFile \"{{ Name }}.exe\""),
            "OutFile must not be a bare relative filename"
        );
        // Default script uses ProgramFiles (arch-aware) instead of the hardcoded $PROGRAMFILES
        assert!(
            script.contains("InstallDir \"{{ ProgramFiles }}\\{{ ProjectName }}\""),
            "should use ProgramFiles var for InstallDir"
        );
        assert!(
            !script.contains("$PROGRAMFILES\\"),
            "should not hardcode $PROGRAMFILES (use ProgramFiles var instead)"
        );
        assert!(
            script.contains("RequestExecutionLevel admin"),
            "should request admin execution level"
        );
        assert!(
            script.contains("Section \"Install\""),
            "should have Install section"
        );
        assert!(
            script.contains("File \"{{ NsisBinaryPath }}\""),
            "should include the binary via template var"
        );
        assert!(
            script.contains("Section \"Uninstall\""),
            "should have Uninstall section"
        );
        assert!(
            script.contains("Delete \"$INSTDIR\\{{ NsisBinaryName }}\""),
            "uninstaller should delete the binary"
        );
        assert!(
            script.contains("Delete \"$INSTDIR\\uninstall.exe\""),
            "uninstaller should delete itself"
        );
        assert!(
            script.contains("RMDir \"$INSTDIR\""),
            "should remove install dir"
        );
        assert!(
            script.contains("CreateShortCut"),
            "should create a desktop shortcut"
        );
        assert!(
            script.contains("WriteUninstaller"),
            "should write the uninstaller"
        );
    }

    #[test]
    fn test_map_arch_to_nsis() {
        assert_eq!(map_arch_to_nsis("amd64"), "x64");
        assert_eq!(map_arch_to_nsis("x86_64"), "x64");
        assert_eq!(map_arch_to_nsis("386"), "x86");
        assert_eq!(map_arch_to_nsis("i386"), "x86");
        assert_eq!(map_arch_to_nsis("i686"), "x86");
        assert_eq!(map_arch_to_nsis("arm64"), "arm64");
        assert_eq!(map_arch_to_nsis("aarch64"), "arm64");
        assert_eq!(map_arch_to_nsis("riscv64"), "riscv64");
    }

    #[test]
    fn test_program_files_for_arch() {
        assert_eq!(program_files_for_arch("x64"), "$PROGRAMFILES64");
        assert_eq!(program_files_for_arch("arm64"), "$PROGRAMFILES64");
        assert_eq!(program_files_for_arch("x86"), "$PROGRAMFILES");
        assert_eq!(program_files_for_arch("other"), "$PROGRAMFILES");
    }

    // -----------------------------------------------------------------------
    // Default name template renders with NSIS-native arch
    // -----------------------------------------------------------------------

    #[test]
    fn test_default_name_template_uses_nsis_arch() {
        // The default name template uses `Arch`, which is overridden to the
        // NSIS-native value in the one-shot context before rendering.
        // For x86_64-pc-windows-msvc: Go arch = "amd64" -> NSIS arch = "x64".
        use anodizer_core::config::{Config, CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};

        let tmp = tempfile::TempDir::new().unwrap();
        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        config.crates = vec![CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![NsisConfig::default()]),
            ..Default::default()
        }];

        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "1.0.0");
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp.exe"),
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });

        NsisStage.run(&mut ctx).unwrap();
        let installers = ctx.artifacts.by_kind(ArtifactKind::Installer);
        assert_eq!(installers.len(), 1);
        let path = installers[0].path.to_string_lossy();
        // Default template `{{ ProjectName }}_{{ Arch }}_setup` renders with the
        // NSIS-native arch (x64) and gains the auto-appended `.exe`.
        assert!(
            path.ends_with("myapp_x64_setup.exe"),
            "expected NSIS-native arch + .exe in filename, got: {path}"
        );
    }

    // -----------------------------------------------------------------------
    // makensis command construction
    // -----------------------------------------------------------------------

    #[test]
    fn test_nsis_command_args() {
        let cmd = nsis_command("/tmp/staging/installer.nsi");

        assert_eq!(cmd[0], "makensis");
        assert_eq!(cmd[1], "/tmp/staging/installer.nsi");
        assert_eq!(cmd.len(), 2);
    }

    // -----------------------------------------------------------------------
    // Stage behavior tests
    // -----------------------------------------------------------------------

    #[test]
    fn test_stage_skips_when_no_nsis_config() {
        use anodizer_core::config::Config;
        use anodizer_core::context::{Context, ContextOptions};

        let config = Config::default();
        let mut ctx = Context::new(config, ContextOptions::default());
        let stage = NsisStage;
        assert!(stage.run(&mut ctx).is_ok());
        assert!(ctx.artifacts.all().is_empty());
    }

    #[test]
    fn test_stage_skips_when_disabled() {
        use anodizer_core::config::{Config, CrateConfig, NsisConfig, StringOrBool};
        use anodizer_core::context::{Context, ContextOptions};

        let tmp = tempfile::TempDir::new().unwrap();

        let nsis_cfg = NsisConfig {
            skip: Some(StringOrBool::Bool(true)),
            ..Default::default()
        };

        let crate_cfg = CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![nsis_cfg]),
            ..Default::default()
        };

        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        config.crates = vec![crate_cfg];

        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "1.0.0");

        // Add a Windows binary so the stage has something to potentially process
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp.exe"),
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });

        let stage = NsisStage;
        stage.run(&mut ctx).unwrap();

        // No installer artifacts should be produced because config is disabled
        let installers = ctx.artifacts.by_kind(ArtifactKind::Installer);
        assert!(installers.is_empty());
    }

    #[test]
    fn test_stage_skips_when_disabled_via_template() {
        use anodizer_core::config::{Config, CrateConfig, NsisConfig, StringOrBool};
        use anodizer_core::context::{Context, ContextOptions};

        let tmp = tempfile::TempDir::new().unwrap();

        // Template evaluates to "true" when IsSnapshot is set
        let nsis_cfg = NsisConfig {
            skip: Some(StringOrBool::String("{{ IsSnapshot }}".to_string())),
            ..Default::default()
        };

        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        config.crates = vec![CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![nsis_cfg]),
            ..Default::default()
        }];

        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "1.0.0");
        ctx.template_vars_mut().set("IsSnapshot", "true");

        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp.exe"),
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });

        let stage = NsisStage;
        stage.run(&mut ctx).unwrap();

        let installers = ctx.artifacts.by_kind(ArtifactKind::Installer);
        assert!(installers.is_empty(), "should be disabled by template");
    }

    #[test]
    fn test_stage_dry_run_registers_artifacts() {
        use anodizer_core::config::{Config, CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};

        let tmp = tempfile::TempDir::new().unwrap();

        let nsis_cfg = NsisConfig::default();

        let crate_cfg = CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![nsis_cfg]),
            ..Default::default()
        };

        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        config.crates = vec![crate_cfg];

        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "1.0.0");

        // Register Windows binary artifacts
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp.exe"),
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp_arm.exe"),
            target: Some("aarch64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });

        let stage = NsisStage;
        stage.run(&mut ctx).unwrap();

        // Two Windows binaries -> two installer artifacts
        let installers = ctx.artifacts.by_kind(ArtifactKind::Installer);
        assert_eq!(installers.len(), 2);

        // All should have format=nsis metadata
        for inst in &installers {
            assert_eq!(inst.metadata.get("format").unwrap(), "nsis");
            assert_eq!(inst.kind, ArtifactKind::Installer);
        }

        // Check targets are preserved
        let targets: Vec<&str> = installers
            .iter()
            .map(|a| a.target.as_deref().unwrap())
            .collect();
        assert!(targets.contains(&"x86_64-pc-windows-msvc"));
        assert!(targets.contains(&"aarch64-pc-windows-msvc"));
    }

    #[test]
    fn test_stage_dry_run_with_name_template() {
        use anodizer_core::config::{Config, CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};

        let tmp = tempfile::TempDir::new().unwrap();

        let nsis_cfg = NsisConfig {
            name: Some("{{ ProjectName }}-{{ Version }}-{{ Arch }}-setup.exe".to_string()),
            ..Default::default()
        };

        let crate_cfg = CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![nsis_cfg]),
            ..Default::default()
        };

        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        config.crates = vec![crate_cfg];

        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "2.0.0");

        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp.exe"),
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });

        let stage = NsisStage;
        stage.run(&mut ctx).unwrap();

        let installers = ctx.artifacts.by_kind(ArtifactKind::Installer);
        assert_eq!(installers.len(), 1);

        let installer_path = installers[0].path.to_string_lossy();
        // Arch in user name templates is NSIS-native: x86_64 maps to x64
        assert!(
            installer_path.ends_with("myapp-2.0.0-x64-setup.exe"),
            "expected NSIS-native arch in template-rendered name, got: {installer_path}"
        );
    }

    #[test]
    fn test_stage_dry_run_replace_removes_archives() {
        use anodizer_core::config::{Config, CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};

        let tmp = tempfile::TempDir::new().unwrap();

        let nsis_cfg = NsisConfig {
            replace: Some(true),
            ..Default::default()
        };

        let crate_cfg = CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![nsis_cfg]),
            ..Default::default()
        };

        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        config.crates = vec![crate_cfg];

        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "1.0.0");

        // Register a Windows binary
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp.exe"),
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });

        // Register an archive artifact for the same crate+target
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Archive,
            name: String::new(),
            path: PathBuf::from("dist/myapp_1.0.0_windows_amd64.zip"),
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: HashMap::from([("format".to_string(), "zip".to_string())]),
            size: None,
        });

        // Also register a Linux archive that should NOT be removed
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Archive,
            name: String::new(),
            path: PathBuf::from("dist/myapp_1.0.0_linux_amd64.tar.gz"),
            target: Some("x86_64-unknown-linux-gnu".to_string()),
            crate_name: "myapp".to_string(),
            metadata: HashMap::from([("format".to_string(), "tar.gz".to_string())]),
            size: None,
        });

        let stage = NsisStage;
        stage.run(&mut ctx).unwrap();

        // NSIS installer artifact should be registered
        let installers = ctx.artifacts.by_kind(ArtifactKind::Installer);
        assert_eq!(installers.len(), 1);

        // The Windows archive should have been removed (replace: true)
        let archives = ctx.artifacts.by_kind(ArtifactKind::Archive);
        assert_eq!(archives.len(), 1, "only the Linux archive should remain");
        assert!(
            archives[0].target.as_deref().unwrap().contains("linux"),
            "remaining archive should be the Linux one"
        );
    }

    #[test]
    fn test_stage_ignores_non_windows_binaries() {
        use anodizer_core::config::{Config, CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};

        let tmp = tempfile::TempDir::new().unwrap();

        let nsis_cfg = NsisConfig::default();

        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        config.crates = vec![CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![nsis_cfg]),
            ..Default::default()
        }];

        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "1.0.0");

        // Only add Linux and macOS binaries — no Windows binaries
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp"),
            target: Some("x86_64-unknown-linux-gnu".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp_darwin"),
            target: Some("aarch64-apple-darwin".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });

        let stage = NsisStage;
        stage.run(&mut ctx).unwrap();

        // No installer artifacts — no Windows binaries available
        let installers = ctx.artifacts.by_kind(ArtifactKind::Installer);
        assert!(
            installers.is_empty(),
            "should produce no installers for non-Windows binaries"
        );
    }

    #[test]
    fn test_config_parse_nsis() {
        let yaml = r#"
project_name: test
crates:
  - name: test
    path: "."
    tag_template: "v{{ .Version }}"
    nsis:
      - name: "{{ ProjectName }}_{{ Version }}_{{ Arch }}_setup.exe"
"#;
        let config: anodizer_core::config::Config = serde_yaml_ng::from_str(yaml).unwrap();
        let nsis_configs = config.crates[0].nsis.as_ref().unwrap();
        assert_eq!(nsis_configs.len(), 1);
        assert_eq!(
            nsis_configs[0].name.as_deref(),
            Some("{{ ProjectName }}_{{ Version }}_{{ Arch }}_setup.exe")
        );
        assert!(nsis_configs[0].skip.is_none());
        assert!(nsis_configs[0].replace.is_none());
        assert!(nsis_configs[0].script.is_none());
    }

    #[test]
    fn test_config_parse_nsis_full() {
        let yaml = r#"
project_name: test
crates:
  - name: test
    path: "."
    tag_template: "v{{ .Version }}"
    nsis:
      - id: windows-nsis
        ids:
          - build_windows_amd64
          - build_windows_arm64
        name: "myapp-{{ Version }}-{{ Arch }}-setup.exe"
        script: "installer.nsi"
        extra_files:
          - README.md
          - LICENSE
        replace: true
        mod_timestamp: "{{ .CommitTimestamp }}"
        skip: "false"
"#;
        let config: anodizer_core::config::Config = serde_yaml_ng::from_str(yaml).unwrap();
        let nsis_configs = config.crates[0].nsis.as_ref().unwrap();
        assert_eq!(nsis_configs.len(), 1);

        let nsis = &nsis_configs[0];
        assert_eq!(nsis.id.as_deref(), Some("windows-nsis"));
        assert_eq!(
            nsis.ids.as_ref().unwrap(),
            &vec![
                "build_windows_amd64".to_string(),
                "build_windows_arm64".to_string()
            ]
        );
        assert_eq!(
            nsis.name.as_deref(),
            Some("myapp-{{ Version }}-{{ Arch }}-setup.exe")
        );
        assert_eq!(nsis.script.as_deref(), Some("installer.nsi"));
        assert_eq!(nsis.replace, Some(true));
        assert_eq!(
            nsis.mod_timestamp.as_deref(),
            Some("{{ .CommitTimestamp }}")
        );
        assert_eq!(
            nsis.skip,
            Some(anodizer_core::config::StringOrBool::String(
                "false".to_string()
            ))
        );
    }

    #[test]
    fn test_invalid_name_template_errors() {
        use anodizer_core::config::{Config, CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};

        let tmp = tempfile::TempDir::new().unwrap();

        let nsis_cfg = NsisConfig {
            // Tera will error on unclosed tags
            name: Some("{{ ProjectName }}_{{ Version".to_string()),
            ..Default::default()
        };

        let crate_cfg = CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![nsis_cfg]),
            ..Default::default()
        };

        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        config.crates = vec![crate_cfg];

        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "1.0.0");

        // Add a Windows binary so we actually attempt to render the template
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp.exe"),
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });

        let stage = NsisStage;
        let result = stage.run(&mut ctx);
        assert!(result.is_err(), "should error on invalid template");
    }

    #[test]
    fn test_stage_ids_filter() {
        use anodizer_core::config::{Config, CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};

        let tmp = tempfile::TempDir::new().unwrap();

        let nsis_cfg = NsisConfig {
            ids: Some(vec!["build_amd64".to_string()]),
            ..Default::default()
        };

        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        config.crates = vec![CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![nsis_cfg]),
            ..Default::default()
        }];

        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "1.0.0");

        // Add two Windows binaries with different IDs
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp_amd64.exe"),
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: HashMap::from([("id".to_string(), "build_amd64".to_string())]),
            size: None,
        });
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp_arm64.exe"),
            target: Some("aarch64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: HashMap::from([("id".to_string(), "build_arm64".to_string())]),
            size: None,
        });

        let stage = NsisStage;
        stage.run(&mut ctx).unwrap();

        // Only the amd64 binary should produce an installer
        let installers = ctx.artifacts.by_kind(ArtifactKind::Installer);
        assert_eq!(installers.len(), 1);
        assert_eq!(
            installers[0].target.as_deref().unwrap(),
            "x86_64-pc-windows-msvc"
        );
    }

    /// The recorded `Installer` artifact path — what every downstream stage
    /// (sign, checksum, upload) and makensis itself reference — must end in
    /// `.exe`. The extension-less default/user `name` template gains `.exe`
    /// after rendering (mirroring how dmg/pkg append `.dmg`/`.pkg`).
    #[test]
    fn test_stage_exe_extension_appended() {
        use anodizer_core::config::{Config, CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};

        let tmp = tempfile::TempDir::new().unwrap();
        let nsis_cfg = NsisConfig {
            name: Some("{{ ProjectName }}_{{ Arch }}_setup".to_string()),
            ..Default::default()
        };

        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        config.crates = vec![CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![nsis_cfg]),
            ..Default::default()
        }];

        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "1.0.0");

        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp.exe"),
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });

        NsisStage.run(&mut ctx).unwrap();

        let installers = ctx.artifacts.by_kind(ArtifactKind::Installer);
        assert_eq!(installers.len(), 1);
        let path = installers[0].path.to_string_lossy();
        assert!(
            path.ends_with("myapp_x64_setup.exe"),
            ".exe must be appended to the recorded artifact path, got: {path}"
        );
    }

    /// A user `name` that already ends in `.exe` (any case) must not be
    /// double-appended.
    #[test]
    fn test_stage_exe_extension_not_double_appended() {
        use anodizer_core::config::{Config, CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};

        for literal in ["myapp_setup.exe", "myapp_setup.EXE"] {
            let tmp = tempfile::TempDir::new().unwrap();
            let nsis_cfg = NsisConfig {
                name: Some(literal.to_string()),
                ..Default::default()
            };

            let mut config = Config::default();
            config.project_name = "myapp".to_string();
            config.dist = tmp.path().join("dist");
            config.crates = vec![CrateConfig {
                name: "myapp".to_string(),
                path: ".".to_string(),
                tag_template: "v{{ .Version }}".to_string(),
                nsis: Some(vec![nsis_cfg]),
                ..Default::default()
            }];

            let mut ctx = Context::new(
                config,
                ContextOptions {
                    dry_run: true,
                    ..Default::default()
                },
            );
            ctx.template_vars_mut().set("Version", "1.0.0");
            ctx.artifacts.add(Artifact {
                kind: ArtifactKind::Binary,
                name: String::new(),
                path: PathBuf::from("dist/myapp.exe"),
                target: Some("x86_64-pc-windows-msvc".to_string()),
                crate_name: "myapp".to_string(),
                metadata: Default::default(),
                size: None,
            });

            NsisStage.run(&mut ctx).unwrap();

            let installers = ctx.artifacts.by_kind(ArtifactKind::Installer);
            assert_eq!(installers.len(), 1);
            let path = installers[0].path.to_string_lossy();
            assert!(
                path.ends_with(literal),
                "existing .exe must not be double-appended, got: {path} (name was {literal})"
            );
            assert!(
                !path.to_ascii_lowercase().ends_with(".exe.exe"),
                "double .exe append, got: {path}"
            );
        }
    }

    // --- `nsis.if` template-conditional ---

    fn nsis_if_test_ctx(if_expr: Option<&str>) -> anodizer_core::context::Context {
        use anodizer_core::artifact::{Artifact, ArtifactKind};
        use anodizer_core::config::{Config, CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};
        let tmp = tempfile::TempDir::new().unwrap();
        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        std::fs::create_dir_all(&config.dist).unwrap();
        let nsis_cfg = NsisConfig {
            script: Some("installer.nsi".to_string()),
            if_condition: if_expr.map(str::to_string),
            ..Default::default()
        };
        config.crates = vec![CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![nsis_cfg]),
            ..Default::default()
        }];
        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "1.0.0");
        ctx.template_vars_mut().set("Os", "windows");
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: std::path::PathBuf::from("dist/myapp.exe"),
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });
        ctx
    }

    #[test]
    fn test_nsis_if_false_skips_config() {
        use anodizer_core::artifact::ArtifactKind;
        let mut ctx = nsis_if_test_ctx(Some("false"));
        NsisStage.run(&mut ctx).unwrap();
        assert_eq!(
            ctx.artifacts.by_kind(ArtifactKind::Installer).len(),
            0,
            "nsis if=false should skip"
        );
    }

    #[test]
    fn test_nsis_if_render_failure_is_hard_error() {
        let mut ctx = nsis_if_test_ctx(Some("{{ undefined_function 42 }}"));
        let err = NsisStage
            .run(&mut ctx)
            .expect_err("unrenderable `if` should hard-error");
        let msg = format!("{:#}", err);
        assert!(
            msg.contains("`if` template render failed"),
            "error should name `if` render failure, got: {msg}"
        );
    }

    // -------------------------------------------------------------------
    // `nsis.amd64_variant` filter
    // -------------------------------------------------------------------

    /// Build a context with three windows/amd64 binaries (v1/v2/v3) +
    /// one windows/arm64 binary. The `amd64_variant` field on the config drives
    /// which subset of amd64 binaries reaches NSIS Installer artifact creation.
    fn nsis_amd64_variant_test_ctx(amd64_variant: Option<&str>) -> anodizer_core::context::Context {
        use anodizer_core::artifact::Artifact;
        use anodizer_core::config::{CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};

        let tmp = tempfile::TempDir::new().unwrap();
        let script_path = tmp.path().join("installer.nsi");
        std::fs::write(&script_path, "OutFile \"out.exe\"\nSection\nSectionEnd\n").unwrap();

        let nsis_cfg = NsisConfig {
            script: Some(script_path.to_string_lossy().into_owned()),
            amd64_variant: amd64_variant.map(str::to_string),
            ..Default::default()
        };

        let mut config = anodizer_core::config::Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        std::fs::create_dir_all(&config.dist).unwrap();
        config.crates = vec![CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![nsis_cfg]),
            ..Default::default()
        }];

        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "1.0.0");

        for variant in ["v1", "v2", "v3"] {
            ctx.artifacts.add(Artifact {
                kind: ArtifactKind::Binary,
                name: String::new(),
                path: PathBuf::from(format!("dist/myapp_{variant}.exe")),
                target: Some("x86_64-pc-windows-msvc".to_string()),
                crate_name: "myapp".to_string(),
                metadata: HashMap::from([("amd64_variant".to_string(), variant.to_string())]),
                size: None,
            });
        }
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp_arm.exe"),
            target: Some("aarch64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: HashMap::new(),
            size: None,
        });
        ctx
    }

    #[test]
    fn test_nsis_amd64_variant_unset_passes_all_amd64_variants() {
        let mut ctx = nsis_amd64_variant_test_ctx(None);
        NsisStage.run(&mut ctx).unwrap();
        let installers = ctx.artifacts.by_kind(ArtifactKind::Installer);
        // 3 amd64 variants + 1 arm64 -> 4 NSIS installers.
        assert_eq!(installers.len(), 4);
    }

    #[test]
    fn test_nsis_amd64_variant_v3_only_keeps_matching_variant() {
        let mut ctx = nsis_amd64_variant_test_ctx(Some("v3"));
        NsisStage.run(&mut ctx).unwrap();
        let installers = ctx.artifacts.by_kind(ArtifactKind::Installer);
        // Only v3 amd64 + arm64 -> 2 installers.
        assert_eq!(installers.len(), 2);
        let targets: Vec<&str> = installers
            .iter()
            .map(|a| a.target.as_deref().unwrap())
            .collect();
        assert!(targets.contains(&"x86_64-pc-windows-msvc"));
        assert!(targets.contains(&"aarch64-pc-windows-msvc"));
    }

    #[test]
    fn test_nsis_amd64_variant_filter_does_not_drop_arm64() {
        // Pin: amd64 filter never affects arm64.
        let mut ctx = nsis_amd64_variant_test_ctx(Some("v9000"));
        NsisStage.run(&mut ctx).unwrap();
        let installers = ctx.artifacts.by_kind(ArtifactKind::Installer);
        assert_eq!(installers.len(), 1);
        assert_eq!(
            installers[0].target.as_deref(),
            Some("aarch64-pc-windows-msvc")
        );
    }

    /// Core invariant: the `OutFile` literal in the rendered default script
    /// equals the recorded `Installer` artifact path — both absolute, both
    /// ending in `.exe`. A bare relative `OutFile` would make makensis write
    /// into the ephemeral staging dir, and a path mismatch would leave every
    /// downstream stage pointing at a file that does not exist.
    #[test]
    fn test_outfile_equals_recorded_artifact_path() {
        use anodizer_core::config::{Config, CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};
        use anodizer_core::template::render;

        let tmp = tempfile::TempDir::new().unwrap();
        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        config.crates = vec![CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![NsisConfig::default()]),
            ..Default::default()
        }];

        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "1.0.0");
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp.exe"),
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });

        NsisStage.run(&mut ctx).unwrap();
        let installers = ctx.artifacts.by_kind(ArtifactKind::Installer);
        assert_eq!(installers.len(), 1);
        let recorded = installers[0].path.clone();

        // The recorded artifact path is absolute and ends in `.exe`.
        assert!(recorded.is_absolute(), "recorded path must be absolute");
        assert!(
            recorded.to_string_lossy().ends_with(".exe"),
            "recorded path must end in .exe, got: {}",
            recorded.display()
        );

        // The stage injects the recorded path as `NsisOutputFile` for the script
        // render. Feeding that same value into the default script must yield an
        // `OutFile` line equal to the recorded path verbatim.
        let recorded_str = recorded.to_string_lossy().into_owned();
        let mut vars = ctx.template_vars().clone();
        vars.set("NsisOutputFile", &recorded_str);
        vars.set("ProgramFiles", "$PROGRAMFILES64");
        vars.set("NsisBinaryPath", "staging/myapp.exe");
        vars.set("NsisBinaryName", "myapp.exe");
        let script = render(default_nsi_script(), &vars).expect("default script must render");
        assert!(
            script.contains(&format!("OutFile \"{recorded_str}\"")),
            "OutFile must equal the recorded artifact path; script:\n{script}"
        );
    }

    /// Under the DEFAULT `dist: ./dist` (relative, never canonicalized by
    /// config), the path makensis is told to write — `NsisOutputFile`, derived
    /// from the same `exe_path` `absolutize_output_path` produces — must be
    /// ABSOLUTE. makensis chdir's to the .nsi script's staging tempdir before
    /// resolving a relative `OutFile`, so a relative path would land the
    /// installer in that tempdir (which then vanishes). The recorded
    /// `Artifact.path` is separately relativized to cwd by the registry for a
    /// stable `artifacts.json`; the absolute OutFile resolves to that same
    /// cwd-relative location. This case must fail without the cwd-absolutize
    /// (the join produces a relative path) and pass with it.
    #[test]
    fn test_relative_dist_output_path_is_absolute() {
        // Exactly the shape the stage builds under default config:
        // `dist.join("windows").join(<name>.exe)` with the default relative dist.
        let relative = PathBuf::from("./dist")
            .join("windows")
            .join("myapp_x64_setup.exe");
        assert!(
            !relative.is_absolute(),
            "precondition: the dist-relative path must start out relative"
        );

        let absolute = absolutize_output_path(relative);
        assert!(
            absolute.is_absolute(),
            "OutFile/NsisOutputFile must be absolute under relative dist, got: {}",
            absolute.display()
        );
        assert!(
            absolute.to_string_lossy().ends_with("myapp_x64_setup.exe"),
            "absolutize must preserve the rendered name + .exe, got: {}",
            absolute.display()
        );
    }

    /// An already-absolute output path passes through `absolutize_output_path`
    /// unchanged (canonicalize fails pre-build, so the `is_absolute` branch
    /// fires and returns it verbatim).
    #[test]
    fn test_absolutize_keeps_absolute_path() {
        // is_absolute() is host-relative; use a host-absolute input so passthrough is exercised on every platform.
        let absolute = if cfg!(windows) {
            PathBuf::from(r"C:\dist\windows\myapp_x64_setup.exe")
        } else {
            PathBuf::from("/dist/windows/myapp_x64_setup.exe")
        };
        let out = absolutize_output_path(absolute.clone());
        assert_eq!(out, absolute);
    }

    /// End-to-end under relative dist: the recorded `Installer` artifact must
    /// still resolve to a file named `myapp_x64_setup.exe`. The registry
    /// relativizes the absolute OutFile back to a cwd-relative path for
    /// `artifacts.json` stability — both name the same on-disk location.
    #[test]
    fn test_relative_dist_records_resolvable_path() {
        use anodizer_core::config::{Config, CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};

        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = PathBuf::from("./dist");
        config.crates = vec![CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![NsisConfig::default()]),
            ..Default::default()
        }];

        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "1.0.0");
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp.exe"),
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });

        NsisStage.run(&mut ctx).unwrap();
        let installers = ctx.artifacts.by_kind(ArtifactKind::Installer);
        assert_eq!(installers.len(), 1);
        let recorded = installers[0].path.clone();
        assert!(
            recorded
                .file_name()
                .and_then(|n| n.to_str())
                .is_some_and(|n| n == "myapp_x64_setup.exe"),
            "recorded path must name the installer file, got: {}",
            recorded.display()
        );
        // The recorded path resolves under dist/windows/ relative to cwd.
        assert!(
            recorded.to_string_lossy().contains("dist/windows/")
                || recorded.to_string_lossy().contains("dist\\windows\\"),
            "recorded path must live under dist/windows/, got: {}",
            recorded.display()
        );
    }

    // -------------------------------------------------------------------
    // NSIS script template vars
    // -------------------------------------------------------------------

    /// Render the built-in default script with realistic vars and ensure the
    /// output is the expected NSIS snippet (`OutFile`, `InstallDir`, etc.).
    /// Pins the default-script render path end-to-end including ProgramFiles
    /// (arch-aware) and the absolute `NsisOutputFile` makensis writes to.
    #[test]
    fn test_default_script_renders_correctly_for_amd64() {
        use anodizer_core::template::{TemplateVars, render};

        let mut vars = TemplateVars::new();
        vars.set("ProjectName", "myapp");
        // OutFile must be the absolute artifact path, ending in `.exe`.
        vars.set("NsisOutputFile", "/dist/windows/myapp_x64_setup.exe");
        vars.set("ProgramFiles", "$PROGRAMFILES64");
        vars.set("NsisBinaryPath", "/tmp/staging/myapp.exe");
        vars.set("NsisBinaryName", "myapp.exe");
        vars.set("Binary", "myapp.exe");
        vars.set("Arch", "x64");

        let out = render(default_nsi_script(), &vars).expect("default script must render");

        assert!(out.contains("Name \"myapp\""));
        // OutFile is the absolute NsisOutputFile, never a bare relative filename.
        assert!(out.contains("OutFile \"/dist/windows/myapp_x64_setup.exe\""));
        assert!(!out.contains("OutFile \"myapp_x64_setup.exe\""));
        // 64-bit target lands in PROGRAMFILES64 (not the WOW6432 redirect)
        assert!(out.contains("InstallDir \"$PROGRAMFILES64\\myapp\""));
        assert!(!out.contains("$PROGRAMFILES\\myapp"));
        assert!(out.contains("RequestExecutionLevel admin"));
        assert!(out.contains("File \"/tmp/staging/myapp.exe\""));
        assert!(out.contains("Delete \"$INSTDIR\\myapp.exe\""));
    }

    #[test]
    fn test_default_script_renders_correctly_for_x86() {
        use anodizer_core::template::{TemplateVars, render};

        let mut vars = TemplateVars::new();
        vars.set("ProjectName", "myapp");
        vars.set("NsisOutputFile", "/dist/windows/myapp_x86_setup.exe");
        vars.set("ProgramFiles", "$PROGRAMFILES");
        vars.set("NsisBinaryPath", "/tmp/staging/myapp.exe");
        vars.set("NsisBinaryName", "myapp.exe");
        vars.set("Binary", "myapp.exe");
        vars.set("Arch", "x86");

        let out = render(default_nsi_script(), &vars).expect("default script must render");
        assert!(out.contains("OutFile \"/dist/windows/myapp_x86_setup.exe\""));
        // 32-bit target uses $PROGRAMFILES
        assert!(out.contains("InstallDir \"$PROGRAMFILES\\myapp\""));
        assert!(!out.contains("$PROGRAMFILES64"));
    }

    /// Pin the documented vars (`Name`, `ProgramFiles`, `Binary`, NSIS-native
    /// `Arch`) are usable inside a custom user script — pasting an example
    /// script must not raise an undefined-variable error.
    #[test]
    fn test_custom_script_can_use_gr_documented_vars() {
        use anodizer_core::config::{Config, CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};

        let tmp = tempfile::TempDir::new().unwrap();
        let script_path = tmp.path().join("installer.nsi");
        // Mirror the shape of the example script: every documented var
        // appears at least once.
        std::fs::write(
            &script_path,
            r#"Name "{{ Name }}"
OutFile "{{ Name }}.exe"
InstallDir "{{ ProgramFiles }}\app"
!define ARCH "{{ Arch }}"
File "{{ Binary }}"
Section
SectionEnd
"#,
        )
        .unwrap();

        let nsis_cfg = NsisConfig {
            script: Some(script_path.to_string_lossy().into_owned()),
            ..Default::default()
        };

        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        std::fs::create_dir_all(&config.dist).unwrap();
        config.crates = vec![CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![nsis_cfg]),
            ..Default::default()
        }];

        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "1.0.0");
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp.exe"),
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });

        // dry-run only renders the name template (not the script body), so to
        // exercise the script-render path we drop out of dry-run by writing a
        // real `makensis` shim is overkill — instead we directly assert that
        // the script's required vars are present in the one-shot context the
        // stage builds. This is verified by the lower-level
        // `test_default_script_renders_correctly_*` tests above; here we just
        // ensure the dry-run path accepts the user script without error.
        NsisStage.run(&mut ctx).unwrap();

        let installers = ctx.artifacts.by_kind(ArtifactKind::Installer);
        assert_eq!(installers.len(), 1);
    }

    /// Global template vars must not be polluted by the NSIS-native `Arch`
    /// override (which is meant for the script render context only).
    #[test]
    fn test_nsis_arch_override_does_not_pollute_global_vars() {
        use anodizer_core::config::{Config, CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};

        let tmp = tempfile::TempDir::new().unwrap();
        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        config.crates = vec![CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![NsisConfig::default()]),
            ..Default::default()
        }];

        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "1.0.0");
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp.exe"),
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });

        NsisStage.run(&mut ctx).unwrap();

        // After the stage runs, the global Arch must be back to the Go-style
        // value (or cleared) — NSIS-native `x64` must not leak out.
        let global_arch = ctx.template_vars().get("Arch").cloned();
        assert!(
            global_arch.as_deref() != Some("x64"),
            "NSIS-native Arch must not leak into global vars, got: {global_arch:?}"
        );
    }

    // -------------------------------------------------------------------
    // extra_files glob with name_template — multi-match bail
    // -------------------------------------------------------------------

    /// When a glob in `extra_files` matches multiple files and a constant
    /// `name_template` is set, the stage must bail rather than silently
    /// overwrite every file to the same destination name.
    #[test]
    fn test_extra_files_multi_match_with_name_template_bails() {
        use anodizer_core::config::ExtraFileSpec;
        use anodizer_core::config::{Config, CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};

        let tmp = tempfile::TempDir::new().unwrap();
        let extra_dir = tmp.path().join("extras");
        std::fs::create_dir_all(&extra_dir).unwrap();
        std::fs::write(extra_dir.join("a.txt"), "a").unwrap();
        std::fs::write(extra_dir.join("b.txt"), "b").unwrap();

        let glob_pattern = format!("{}/*.txt", extra_dir.display());
        let nsis_cfg = NsisConfig {
            extra_files: Some(vec![ExtraFileSpec::Detailed {
                glob: glob_pattern,
                name_template: Some("renamed.txt".to_string()),
                allow_empty: false,
            }]),
            ..Default::default()
        };

        let script_path = tmp.path().join("installer.nsi");
        std::fs::write(&script_path, "Section\nSectionEnd\n").unwrap();
        let nsis_cfg = NsisConfig {
            script: Some(script_path.to_string_lossy().into_owned()),
            ..nsis_cfg
        };

        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        std::fs::create_dir_all(&config.dist).unwrap();
        config.crates = vec![CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![nsis_cfg]),
            ..Default::default()
        }];

        let mut ctx = Context::new(config, ContextOptions::default());
        ctx.template_vars_mut().set("Version", "1.0.0");

        // Write a fake binary file so the stage actually reaches extra_files.
        let bin_path = tmp.path().join("myapp.exe");
        std::fs::write(&bin_path, b"binary").unwrap();
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: bin_path,
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });

        // Stage will bail on extra_files before reaching makensis. The bail
        // is what we're asserting, so the makensis-missing path is irrelevant.
        let err = NsisStage
            .run(&mut ctx)
            .expect_err("multi-match glob + name_template must bail");
        let msg = format!("{err:#}");
        assert!(
            msg.contains("name_template") && msg.contains("exactly one"),
            "error must reference the name_template constraint, got: {msg}"
        );
    }

    /// Single-match glob with `name_template` is the supported case — must
    /// not bail.
    #[test]
    fn test_extra_files_single_match_with_name_template_ok() {
        use anodizer_core::config::ExtraFileSpec;
        use anodizer_core::config::{Config, CrateConfig, NsisConfig};
        use anodizer_core::context::{Context, ContextOptions};

        let tmp = tempfile::TempDir::new().unwrap();
        let extra_dir = tmp.path().join("extras");
        std::fs::create_dir_all(&extra_dir).unwrap();
        std::fs::write(extra_dir.join("only.txt"), "x").unwrap();
        let glob_pattern = format!("{}/only.txt", extra_dir.display());

        let nsis_cfg = NsisConfig {
            extra_files: Some(vec![ExtraFileSpec::Detailed {
                glob: glob_pattern,
                name_template: Some("renamed.txt".to_string()),
                allow_empty: false,
            }]),
            ..Default::default()
        };

        let mut config = Config::default();
        config.project_name = "myapp".to_string();
        config.dist = tmp.path().join("dist");
        config.crates = vec![CrateConfig {
            name: "myapp".to_string(),
            path: ".".to_string(),
            tag_template: "v{{ .Version }}".to_string(),
            nsis: Some(vec![nsis_cfg]),
            ..Default::default()
        }];

        let mut ctx = Context::new(
            config,
            ContextOptions {
                dry_run: true,
                ..Default::default()
            },
        );
        ctx.template_vars_mut().set("Version", "1.0.0");
        ctx.artifacts.add(Artifact {
            kind: ArtifactKind::Binary,
            name: String::new(),
            path: PathBuf::from("dist/myapp.exe"),
            target: Some("x86_64-pc-windows-msvc".to_string()),
            crate_name: "myapp".to_string(),
            metadata: Default::default(),
            size: None,
        });

        // dry-run does not exercise the extra_files copy loop, but multi-match
        // bail logic is exercised by the prior test. Here we just assert that
        // a single-match glob with name_template doesn't trigger any error.
        NsisStage.run(&mut ctx).unwrap();
    }
}