param(
    [Parameter(Mandatory)]
    [ValidateSet(
        'linux-x64', 'linux-arm64', 'linux-arm',
        'linux-musl-x64', 'linux-musl-arm64', 'linux-musl-arm',
        'osx-x64', 'osx-arm64', 'win-x64', 'win-arm64'
    )]
    [string]$RuntimeIdentifier
)

$ErrorActionPreference = 'Stop'
Set-StrictMode -Version Latest

if (-not $env:CI_COMMIT_TAG -or $env:CI_COMMIT_TAG -notmatch '^v(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$') {
    throw 'Release must run from a vMAJOR.MINOR.PATCH tag.'
}
$version = $Matches[1]
$root = Split-Path -Parent $PSScriptRoot
$backend = Join-Path $root 'backend'
$projectVersion = [regex]::Match((Get-Content (Join-Path $backend 'Directory.Build.props') -Raw), '<Version>([^<]+)</Version>').Groups[1].Value
if ($version -ne $projectVersion) {
    throw "Tag version $version does not match project version $projectVersion."
}
if (-not $env:GITEA_TOKEN) {
    throw 'GITEA_TOKEN is required.'
}

$isWindows = $RuntimeIdentifier.StartsWith('win-', [StringComparison]::Ordinal)
$isMacOS = $RuntimeIdentifier.StartsWith('osx-', [StringComparison]::Ordinal)
$os = if ($isWindows) { 'windows' } elseif ($isMacOS) { 'macos' } else { 'linux' }
$arch = switch ($RuntimeIdentifier) {
    'linux-x64' { 'amd64' }
    'linux-arm64' { 'arm64' }
    'linux-arm' { 'arm' }
    'linux-musl-x64' { 'musl-amd64' }
    'linux-musl-arm64' { 'musl-arm64' }
    'linux-musl-arm' { 'musl-arm' }
    'osx-x64' { 'x64' }
    'osx-arm64' { 'arm64' }
    'win-x64' { 'amd64' }
    'win-arm64' { 'arm64' }
}

if ($isWindows) {
    $vcArchitecture = if ($RuntimeIdentifier -eq 'win-x64') { 'x64' } else { 'arm64' }
    $vsWhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
    $vsPath = & $vsWhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath
    if (-not $vsPath) {
        throw 'Visual Studio C++ Build Tools were not found.'
    }
    $devCmd = Join-Path $vsPath 'Common7\Tools\VsDevCmd.bat'
    $environmentLines = & cmd.exe /d /s /c "call `"$devCmd`" -no_logo -arch=$vcArchitecture -host_arch=x64 && set"
    foreach ($line in $environmentLines) {
        $separator = $line.IndexOf('=')
        if ($separator -gt 0) {
            [Environment]::SetEnvironmentVariable($line.Substring(0, $separator), $line.Substring($separator + 1), 'Process')
        }
    }
}

$publishRoot = Join-Path $root ".release\$RuntimeIdentifier-$PID"
$buildRoot = Join-Path $root ".release\build\$RuntimeIdentifier-$PID"
$packageRoot = Join-Path $root '.release\packages'
$agentOut = Join-Path $publishRoot 'agent'
$probeOut = Join-Path $publishRoot 'probe'
$enrollOut = Join-Path $publishRoot 'fleet-enroll'
$null = New-Item -ItemType Directory -Force -Path $agentOut, $probeOut, $enrollOut, $packageRoot

function Publish-Aot([string]$Project, [string]$Output) {
    $arguments = @(
        'publish', $Project,
        '-m:2',
        '-c', 'Release',
        '-r', $RuntimeIdentifier,
        '--self-contained', 'true',
        '-p:PublishAot=true',
        '-p:StripSymbols=true',
        '-p:DebugType=none',
        '--artifacts-path', $buildRoot,
        '-o', $Output
    )
    Push-Location $backend
    try {
        & dotnet @arguments
        if ($LASTEXITCODE -ne 0) {
            throw "NativeAOT publish failed for $Project ($RuntimeIdentifier)."
        }
    }
    finally {
        Pop-Location
    }
}

function New-TarGzArchive([string]$SourceDirectory, [string]$ArchivePath, [string[]]$Executables) {
    $tarFile = [IO.File]::Create($ArchivePath)
    $gzip = [IO.Compression.GZipStream]::new($tarFile, [IO.Compression.CompressionLevel]::Optimal, $true)
    $writer = [System.Formats.Tar.TarWriter]::new($gzip, [System.Formats.Tar.TarEntryFormat]::Pax, $true)
    $executableMode = [System.IO.UnixFileMode]::UserRead -bor [System.IO.UnixFileMode]::UserWrite -bor [System.IO.UnixFileMode]::UserExecute -bor [System.IO.UnixFileMode]::GroupRead -bor [System.IO.UnixFileMode]::GroupExecute -bor [System.IO.UnixFileMode]::OtherRead -bor [System.IO.UnixFileMode]::OtherExecute
    $regularMode = [System.IO.UnixFileMode]::UserRead -bor [System.IO.UnixFileMode]::UserWrite -bor [System.IO.UnixFileMode]::GroupRead -bor [System.IO.UnixFileMode]::OtherRead
    try {
        foreach ($file in Get-ChildItem -LiteralPath $SourceDirectory -File -Recurse) {
            $relativePath = [IO.Path]::GetRelativePath($SourceDirectory, $file.FullName).Replace('\', '/')
            $entry = [System.Formats.Tar.PaxTarEntry]::new([System.Formats.Tar.TarEntryType]::RegularFile, $relativePath)
            $entry.Mode = if ($Executables -contains $relativePath) { $executableMode } else { $regularMode }
            $entry.DataStream = [IO.File]::OpenRead($file.FullName)
            try {
                $writer.WriteEntry($entry)
            }
            finally {
                $entry.DataStream.Dispose()
            }
        }
    }
    finally {
        $writer.Dispose()
        $gzip.Dispose()
        $tarFile.Dispose()
    }
}

Publish-Aot 'agent/src/Monitor.Agent' $agentOut
Publish-Aot 'probe/src/Monitor.Probe' $probeOut
Publish-Aot 'fleet/tools/fleet-enroll' $enrollOut

$giteaBase = if ($env:GITEA_BASE) { $env:GITEA_BASE.TrimEnd('/') } else { 'http://localhost:3100' }
$netrc = Join-Path $env:TEMP ("monitor-gitea-$([guid]::NewGuid().ToString('N')).netrc")
$giteaHost = ([Uri]$giteaBase).Host
Set-Content -LiteralPath $netrc -Value "machine $giteaHost login justme password $($env:GITEA_TOKEN)" -Encoding ascii -NoNewline

function Publish-Package([string]$Role, [string]$BinaryDirectory) {
    $stage = Join-Path $publishRoot "stage-$Role"
    $null = New-Item -ItemType Directory -Force -Path $stage
    $binaryName = if ($isWindows) { "monitor-$Role.exe" } else { "monitor-$Role" }
    Copy-Item -LiteralPath (Join-Path $BinaryDirectory $binaryName) -Destination $stage
    Copy-Item -LiteralPath (Join-Path $root 'LICENSE') -Destination $stage
    Copy-Item -LiteralPath (Join-Path $root "backend\$Role\README.md") -Destination $stage

    if ($Role -eq 'agent') {
        $enrollName = if ($isWindows) { 'fleet-enroll.exe' } else { 'fleet-enroll' }
        Copy-Item -LiteralPath (Join-Path $enrollOut $enrollName) -Destination $stage
    }
    if ($os -eq 'linux') {
        Copy-Item -LiteralPath (Join-Path $root 'packaging/install.sh') -Destination $stage
        $systemd = Join-Path $stage 'systemd'
        $null = New-Item -ItemType Directory -Force -Path $systemd
        Copy-Item -LiteralPath (Join-Path $root "packaging/systemd/monitor-$Role.service") -Destination $systemd
        if ($Role -eq 'probe') {
            $openwrt = Join-Path $stage 'openwrt'
            $null = New-Item -ItemType Directory -Force -Path $openwrt
            Copy-Item -LiteralPath (Join-Path $root 'packaging/openwrt/monitor-probe.init') -Destination $openwrt
            Copy-Item -LiteralPath (Join-Path $root 'packaging/openwrt/monitor.keep') -Destination $openwrt
        }
    }
    elseif ($os -eq 'macos') {
        @'
This macOS NativeAOT binary is not signed with a Developer ID certificate and
has not been notarized by Apple. Apple Silicon builds receive an ad-hoc code
signature; Intel builds are unsigned. Gatekeeper may block browser-downloaded
files. A Developer ID signature and notarization are required for a seamless
consumer install.
'@ | Set-Content -LiteralPath (Join-Path $stage 'MACOS-SECURITY.txt') -Encoding utf8
    }

    $archiveName = if ($isWindows) {
        "monitor-$Role-v$version-windows-$arch.zip"
    }
    else {
        "monitor-$Role-v$version-$os-$arch.tar.gz"
    }
    $archive = Join-Path $packageRoot $archiveName
    if ($isWindows) {
        Compress-Archive -Path (Join-Path $stage '*') -DestinationPath $archive -CompressionLevel Optimal -Force
    }
    else {
        $executables = if ($os -eq 'linux') { @("monitor-$Role", 'install.sh') } else { @("monitor-$Role") }
        if ($Role -eq 'agent') { $executables += 'fleet-enroll' }
        New-TarGzArchive $stage $archive $executables
    }

    $hash = (Get-FileHash -LiteralPath $archive -Algorithm SHA256).Hash.ToLowerInvariant()
    $checksumPath = "$archive.sha256"
    [IO.File]::WriteAllText($checksumPath, "$hash  $archiveName`n", [Text.UTF8Encoding]::new($false))

    foreach ($file in @($archive, $checksumPath)) {
        $name = Split-Path -Leaf $file
        $url = "$giteaBase/api/packages/justme/generic/monitor-node/$version/$name"
        $status = & curl.exe --silent --show-error --retry 3 --netrc-file $netrc --upload-file $file --output NUL --write-out '%{http_code}' $url
        if ($LASTEXITCODE -ne 0) {
            throw "Gitea package upload failed for $name."
        }
        if ($status -match '^2') {
            Write-Output "uploaded Gitea package $name"
        }
        elseif ($status -eq '409') {
            Write-Output "Gitea package $name already exists; reusing the existing release file"
        }
        else {
            throw "Gitea package upload failed for $name (HTTP $status)."
        }
    }
}

try {
    Publish-Package 'agent' $agentOut
    Publish-Package 'probe' $probeOut
}
finally {
    Remove-Item -LiteralPath $netrc -Force -ErrorAction SilentlyContinue
}