#!/usr/bin/env node
/**
 * Bundle the CLI into a single self-contained ESM file.
 *
 * Shipping a bundle rather than the TypeScript sources means the installed
 * command has no build step, no tsx loader at runtime, and a fixed
 * dependency set that can be checksummed — the release-integrity workflow
 * hashes exactly what users execute.
 */

import { build } from "esbuild";
import { readFile, writeFile, chmod, mkdir } from "node:fs/promises";
import { dirname, join } from "node:path";
import { fileURLToPath } from "node:url";
import { createHash } from "node:crypto";

const here = dirname(fileURLToPath(import.meta.url));
const pkg = JSON.parse(await readFile(join(here, "package.json"), "utf8"));
const outfile = join(here, "dist", "seedpass-js.mjs");

await mkdir(dirname(outfile), { recursive: true });

await build({
  entryPoints: [join(here, "src", "main.ts")],
  outfile,
  bundle: true,
  platform: "node",
  target: "node22",
  format: "esm",
  minify: false, // auditability beats a few hundred kilobytes
  sourcemap: false,
  banner: {
    js:
      "#!/usr/bin/env node\n" +
      "// SeedPass CLI (TypeScript port). Generated by build.mjs — do not edit.\n" +
      "import { createRequire as __seedpassCreateRequire } from 'node:module';\n" +
      "const require = __seedpassCreateRequire(import.meta.url);\n",
  },
  define: { __SEEDPASS_VERSION__: JSON.stringify(pkg.version) },
});

await chmod(outfile, 0o755);

const bytes = await readFile(outfile);
const digest = createHash("sha256").update(bytes).digest("hex");
await writeFile(`${outfile}.sha256`, `${digest}  seedpass-js.mjs\n`);

console.log(`built ${outfile}`);
console.log(`  ${(bytes.length / 1024).toFixed(0)} KiB`);
console.log(`  sha256 ${digest}`);