#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
cd "$SCRIPT_DIR"

printf '[1/7] 检查 SHA-256 工具...\n'
if ! command -v sha256sum >/dev/null 2>&1; then
    printf '错误：未找到 sha256sum，请先安装 coreutils。\n' >&2
    exit 1
fi
printf '      使用：%s\n' "$(command -v sha256sum)"

printf '[2/7] 检查必须存在的配置和脚本...\n'
for required in bot-forge.toml bootstrap.sh bootstrap.ps1; do
    if [[ ! -f "$required" ]]; then
        printf '错误：缺少必须文件：%s\n' "$required" >&2
        exit 1
    fi
    printf '      已找到：%s\n' "$required"
done

printf '[3/7] 收集当前发布目录中的平台二进制...\n'
assets=()
for candidate in \
    linux-x86_64-bot-forge \
    linux-aarch64-bot-forge \
    windows-x86_64-bot-forge.exe \
    windows-aarch64-bot-forge.exe
do
    if [[ -f "$candidate" ]]; then
        assets+=("$candidate")
        printf '      加入清单：%s\n' "$candidate"
    else
        printf '      未提供，跳过：%s\n' "$candidate"
    fi
done
if (( ${#assets[@]} == 0 )); then
    printf '错误：没有找到任何受支持的平台二进制。\n' >&2
    exit 1
fi
assets+=(bot-forge.toml)
printf '      加入清单：bot-forge.toml\n'

manifest_stage="$(mktemp "$SCRIPT_DIR/.SHA256SUMS.new.XXXXXX")"
digest_stage="$(mktemp "$SCRIPT_DIR/.SHA256SUMS.sha256.new.XXXXXX")"
bootstrap_sh_stage="$(mktemp "$SCRIPT_DIR/.bootstrap.sh.new.XXXXXX")"
bootstrap_ps1_stage="$(mktemp "$SCRIPT_DIR/.bootstrap.ps1.new.XXXXXX")"
cleanup() {
    rm -f "$manifest_stage" "$digest_stage" "$bootstrap_sh_stage" "$bootstrap_ps1_stage"
}
trap cleanup EXIT

printf '[4/7] 计算发布文件摘要并生成 SHA256SUMS...\n'
sha256sum "${assets[@]}" > "$manifest_stage"
mv -f "$manifest_stage" SHA256SUMS
printf '      已写入：%s/SHA256SUMS\n' "$SCRIPT_DIR"
while IFS= read -r line; do
    printf '      %s\n' "$line"
done < SHA256SUMS

printf '[5/7] 计算 SHA256SUMS 文件自身的摘要...\n'
sha256sum SHA256SUMS > "$digest_stage"
mv -f "$digest_stage" SHA256SUMS.sha256
manifest_hash="$(awk 'NR == 1 { print tolower($1); exit }' SHA256SUMS.sha256)"
if [[ ! "$manifest_hash" =~ ^[[:xdigit:]]{64}$ ]]; then
    printf '错误：生成的 SHA256SUMS 摘要格式无效。\n' >&2
    exit 1
fi
printf '      已写入：%s/SHA256SUMS.sha256\n' "$SCRIPT_DIR"
printf '      清单摘要：%s\n' "$manifest_hash"

printf '[6/7] 将清单摘要写入 Linux 和 Windows bootstrap...\n'
sed "s/^CHECKSUMS_SHA256=.*/CHECKSUMS_SHA256=\"$manifest_hash\"/" \
    bootstrap.sh > "$bootstrap_sh_stage"
if ! grep -Fq "CHECKSUMS_SHA256=\"$manifest_hash\"" "$bootstrap_sh_stage"; then
    printf '错误：无法更新 bootstrap.sh 中的 CHECKSUMS_SHA256。\n' >&2
    exit 1
fi
chmod --reference=bootstrap.sh "$bootstrap_sh_stage"
mv -f "$bootstrap_sh_stage" bootstrap.sh
printf '      已更新：bootstrap.sh\n'

sed "s/^\$checksumsSha256 = .*/\$checksumsSha256 = '$manifest_hash'/" \
    bootstrap.ps1 > "$bootstrap_ps1_stage"
if ! grep -Fq "\$checksumsSha256 = '$manifest_hash'" "$bootstrap_ps1_stage"; then
    printf '错误：无法更新 bootstrap.ps1 中的 checksumsSha256。\n' >&2
    exit 1
fi
chmod --reference=bootstrap.ps1 "$bootstrap_ps1_stage"
mv -f "$bootstrap_ps1_stage" bootstrap.ps1
printf '      已更新：bootstrap.ps1\n'

printf '[7/7] 验证全部文件及 bootstrap 摘要...\n'
sha256sum --check SHA256SUMS
if [[ "$(sha256sum SHA256SUMS | awk '{ print tolower($1) }')" != "$manifest_hash" ]]; then
    printf '错误：SHA256SUMS.sha256 与实际清单不一致。\n' >&2
    exit 1
fi
grep -Fq "$manifest_hash" bootstrap.sh
grep -Fq "$manifest_hash" bootstrap.ps1
printf '      SHA256SUMS 自身摘要验证通过。\n'
printf '      两个平台 bootstrap 摘要验证通过。\n'
printf '完成：SHA-256 文件已生成并已自动更新 bootstrap。\n'