#!/usr/bin/env bash
set -euo pipefail

# Версии и контрольные суммы toolchain приходят из versions.env через
# load_versions_contract (tools/build/lib/versions.sh). Собственных значений
# по умолчанию здесь нет намеренно: второй источник истины неизбежно
# разъезжается с первым.
[ -n "${GO_REQUIRED:-}" ] || fail "deps.sh: GO_REQUIRED is not set; load_versions_contract must run first"
[ -n "${BUN_REQUIRED:-}" ] || fail "deps.sh: BUN_REQUIRED is not set; load_versions_contract must run first"
[ -n "${NODE_REQUIRED:-}" ] || fail "deps.sh: NODE_REQUIRED is not set; load_versions_contract must run first"
[ -n "${PNPM_REQUIRED:-}" ] || fail "deps.sh: PNPM_REQUIRED is not set; load_versions_contract must run first"

TOOLCHAIN_DIR="${TOOLCHAIN_DIR:-$ROOT_DIR/.toolchain}"
VERIFY_TOOLCHAIN_CHECKSUMS="${VERIFY_TOOLCHAIN_CHECKSUMS:-true}"
BUN_FLAVOR="${BUN_FLAVOR:-auto}"

verify_archive_sha256() {
  local archive="$1"
  local expected="$2"
  local label="$3"

  if [ "$VERIFY_TOOLCHAIN_CHECKSUMS" != "true" ]; then
    return 0
  fi

  [ -n "$expected" ] || fail "missing expected SHA256 for $label (declare it in versions.env)"
  local actual
  actual="$(sha256sum "$archive" | awk '{print $1}')"
  [ "$actual" = "$expected" ] || fail "$label sha256 mismatch: expected $expected, got $actual"
}

require_build_host_platform() {
  local want_os="$HY2XS_BUILD_OS"
  local want_version="$HY2XS_BUILD_OS_VERSION"
  local want_arch="$HY2XS_BUILD_ARCH"

  [ "$(uname -s)" = "Linux" ] \
    || fail "production builder supports only Linux ${want_os} ${want_version} ${want_arch}"

  local arch
  arch="$(uname -m)"
  if [ "$want_arch" = "amd64" ]; then
    [ "$arch" = "x86_64" ] || [ "$arch" = "amd64" ] \
      || fail "production builder supports only ${want_arch}, got: $arch"
  else
    [ "$arch" = "$want_arch" ] || fail "production builder supports only ${want_arch}, got: $arch"
  fi

  [ -f /etc/os-release ] || fail "missing /etc/os-release"
  # shellcheck disable=SC1091
  . /etc/os-release
  [ "${ID:-}" = "$want_os" ] \
    || fail "production builder supports only ${want_os} ${want_version}, got: ${ID:-unknown}"
  [ "${VERSION_ID:-}" = "$want_version" ] \
    || fail "production builder supports only ${want_os} ${want_version}, got version: ${VERSION_ID:-unknown}"
}

apt_install_missing() {
  local missing=()
  local pkg
  for pkg in "$@"; do
    local pkg_status
    pkg_status="$(dpkg-query -W -f='${Status}' "$pkg" 2>/dev/null)" || pkg_status=""
    if ! grep -q 'install ok installed' <<<"$pkg_status"; then
      missing+=("$pkg")
    fi
  done

  if [ "${#missing[@]}" -eq 0 ]; then
    return 0
  fi

  log_info "Installing missing build packages: ${missing[*]}"
  if [ "$(id -u)" = "0" ]; then
    apt-get update
    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "${missing[@]}"
  elif command -v sudo >/dev/null 2>&1; then
    sudo apt-get update
    sudo DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "${missing[@]}"
  else
    fail "missing packages (${missing[*]}) and neither root nor sudo is available"
  fi
}

ensure_build_dependencies() {
  apt_install_missing \
    ca-certificates curl unzip tar xz-utils git build-essential pkg-config \
    bash coreutils findutils grep sed gawk openssl

  require_tool curl
  require_tool tar
  require_tool xz
  require_tool unzip
  require_tool sha256sum
  require_tool find
  require_tool install
  require_tool sort
  require_tool xargs
  require_tool grep
  require_tool sed
}

go_version() {
  "$1" version | sed -E 's/^go version go([0-9.]+).*/\1/'
}

ensure_go() {
  local managed="$TOOLCHAIN_DIR/go/bin/go"
  local go_mode=""
  if [ -x "$managed" ] && [ "$(go_version "$managed")" = "$GO_REQUIRED" ]; then
    GO_BIN="$managed"
    go_mode="managed"
  elif command -v go >/dev/null 2>&1 && [ "$(go_version "$(command -v go)")" = "$GO_REQUIRED" ]; then
    GO_BIN="$(command -v go)"
    go_mode="global"
  else
    log_info "Installing Go $GO_REQUIRED into $TOOLCHAIN_DIR/go"
    mkdir -p "$TOOLCHAIN_DIR/downloads"
    local archive="$TOOLCHAIN_DIR/downloads/go${GO_REQUIRED}.linux-amd64.tar.gz"
    download_file "https://go.dev/dl/go${GO_REQUIRED}.linux-amd64.tar.gz" "$archive"
    verify_archive_sha256 "$archive" "$GO_ARCHIVE_SHA256" "GO_ARCHIVE"
    rm -rf "$TOOLCHAIN_DIR/go"
    tar -C "$TOOLCHAIN_DIR" -xzf "$archive"
    GO_BIN="$managed"
    go_mode="managed"
  fi

  export GO_BIN
  if [ "$go_mode" = "managed" ]; then
    export GOROOT="$TOOLCHAIN_DIR/go"
  else
    unset GOROOT || true
  fi
  export PATH="$(dirname "$GO_BIN"):$PATH"
  export GOTOOLCHAIN=local
  [ "$(go_version "$GO_BIN")" = "$GO_REQUIRED" ] || fail "Go version mismatch: required $GO_REQUIRED, got $($GO_BIN version)"
}

cpu_has_avx2() {
  local flags
  flags="$(grep -m1 '^flags' /proc/cpuinfo 2>/dev/null)" || flags=""
  grep -qw avx2 <<<"$flags"
}

select_bun_artifact() {
  case "$BUN_FLAVOR" in
    auto)
      if cpu_has_avx2; then
        BUN_ARTIFACT="bun-linux-x64"
      else
        BUN_ARTIFACT="bun-linux-x64-baseline"
      fi
      ;;
    x64|bun-linux-x64)
      BUN_ARTIFACT="bun-linux-x64"
      ;;
    baseline|x64-baseline|bun-linux-x64-baseline)
      BUN_ARTIFACT="bun-linux-x64-baseline"
      ;;
    *)
      fail "unsupported BUN_FLAVOR: $BUN_FLAVOR (use auto, x64, or x64-baseline)"
      ;;
  esac

  BUN_COMPILE_TARGET="$BUN_ARTIFACT"
  export BUN_ARTIFACT BUN_COMPILE_TARGET
}

bun_version() {
  local bun="$1"
  "$bun" --version 2>/dev/null || true
}

ensure_bun() {
  select_bun_artifact

  local managed="$TOOLCHAIN_DIR/bun/bin/bun"
  local selected_bun=""
  local actual=""

  if [ -x "$managed" ]; then
    actual="$(bun_version "$managed")"
    if [ "$actual" = "$BUN_REQUIRED" ]; then
      selected_bun="$managed"
    else
      log_info "Ignoring managed Bun at $managed: required $BUN_REQUIRED, got ${actual:-failed to execute}"
    fi
  fi

  if [ -z "$selected_bun" ] && command -v bun >/dev/null 2>&1; then
    local system_bun
    system_bun="$(command -v bun)"

    if [ "$system_bun" != "$managed" ]; then
      actual="$(bun_version "$system_bun")"
      if [ "$actual" = "$BUN_REQUIRED" ]; then
        selected_bun="$system_bun"
      else
        log_info "Ignoring system Bun at $system_bun: required $BUN_REQUIRED, got ${actual:-failed to execute}"
      fi
    fi
  fi

  if [ -z "$selected_bun" ]; then
    log_info "Installing Bun $BUN_REQUIRED ($BUN_ARTIFACT) into $TOOLCHAIN_DIR/bun"

    mkdir -p "$TOOLCHAIN_DIR/downloads" "$TOOLCHAIN_DIR/bun"

    local archive="$TOOLCHAIN_DIR/downloads/${BUN_ARTIFACT}-${BUN_REQUIRED}.zip"
    download_file "https://github.com/oven-sh/bun/releases/download/bun-v${BUN_REQUIRED}/${BUN_ARTIFACT}.zip" "$archive"
    # Ожидаемый digest выбирается ПОСЛЕ select_bun_artifact: x64 и
    # x64-baseline — разные архивы с разными суммами.
    verify_archive_sha256 "$archive" "$(expected_bun_sha256)" "BUN_ARCHIVE(${BUN_ARTIFACT})"

    rm -rf "$TOOLCHAIN_DIR/bun-tmp" "$TOOLCHAIN_DIR/bun"
    mkdir -p "$TOOLCHAIN_DIR/bun-tmp"

    unzip -q "$archive" -d "$TOOLCHAIN_DIR/bun-tmp"

    mkdir -p "$TOOLCHAIN_DIR/bun/bin"
    install -m 0755 "$TOOLCHAIN_DIR/bun-tmp/${BUN_ARTIFACT}/bun" "$managed"

    rm -rf "$TOOLCHAIN_DIR/bun-tmp"

    selected_bun="$managed"
  fi

  BUN_BIN="$selected_bun"
  export BUN_BIN
  export PATH="$(dirname "$BUN_BIN"):$PATH"

  actual="$(bun_version "$BUN_BIN")"

  if [ "$actual" != "$BUN_REQUIRED" ]; then
    fail "Bun version mismatch: required $BUN_REQUIRED, got ${actual:-failed to execute}. Selected artifact: ${BUN_ARTIFACT}. On old CPUs without AVX2 use BUN_FLAVOR=x64-baseline."
  fi

  log_info "Using Bun $actual; artifact=$BUN_ARTIFACT; compile_target=$BUN_COMPILE_TARGET"
}

node_version() {
  "$1" --version | sed 's/^v//'
}

ensure_node() {
  local managed="$TOOLCHAIN_DIR/node/bin/node"
  if [ -x "$managed" ] && [ "$(node_version "$managed")" = "$NODE_REQUIRED" ]; then
    NODE_BIN="$managed"
  elif command -v node >/dev/null 2>&1 && [ "$(node_version "$(command -v node)")" = "$NODE_REQUIRED" ]; then
    NODE_BIN="$(command -v node)"
  else
    log_info "Installing Node.js $NODE_REQUIRED into $TOOLCHAIN_DIR/node"
    mkdir -p "$TOOLCHAIN_DIR/downloads"
    local archive="$TOOLCHAIN_DIR/downloads/node-v${NODE_REQUIRED}-linux-x64.tar.xz"
    download_file "https://nodejs.org/dist/v${NODE_REQUIRED}/node-v${NODE_REQUIRED}-linux-x64.tar.xz" "$archive"
    verify_archive_sha256 "$archive" "$NODE_ARCHIVE_SHA256" "NODE_ARCHIVE"
    rm -rf "$TOOLCHAIN_DIR/node" "$TOOLCHAIN_DIR/node-v${NODE_REQUIRED}-linux-x64"
    tar -C "$TOOLCHAIN_DIR" -xJf "$archive"
    mv "$TOOLCHAIN_DIR/node-v${NODE_REQUIRED}-linux-x64" "$TOOLCHAIN_DIR/node"
    NODE_BIN="$managed"
  fi

  export NODE_BIN
  export PATH="$(dirname "$NODE_BIN"):$PATH"
  [ "$(node_version "$NODE_BIN")" = "$NODE_REQUIRED" ] || fail "Node.js version mismatch: required $NODE_REQUIRED, got $($NODE_BIN --version)"
}

ensure_pnpm() {
  local managed="$TOOLCHAIN_DIR/pnpm/bin/pnpm"
  export PATH="$TOOLCHAIN_DIR/pnpm/bin:$PATH"
  if [ -x "$managed" ] && [ "$($managed --version)" = "$PNPM_REQUIRED" ]; then
    PNPM_BIN="$managed"
  else
    log_info "Installing pnpm $PNPM_REQUIRED into $TOOLCHAIN_DIR/pnpm"
    mkdir -p "$TOOLCHAIN_DIR/pnpm/bin"
    corepack enable --install-directory "$TOOLCHAIN_DIR/pnpm/bin"
    corepack prepare "pnpm@$PNPM_REQUIRED" --activate
    [ -x "$managed" ] || fail "pnpm binary was not installed into $managed"
    PNPM_BIN="$managed"
  fi

  export PNPM_BIN
  [ "$($PNPM_BIN --version)" = "$PNPM_REQUIRED" ] || fail "pnpm version mismatch: required $PNPM_REQUIRED, got $($PNPM_BIN --version)"
}

ensure_toolchain() {
  ensure_go
  ensure_bun
  ensure_node
  ensure_pnpm

  log_info "Go: $($GO_BIN version)"
  log_info "Bun: $($BUN_BIN --version)"
  log_info "Node.js: $($NODE_BIN --version)"
  log_info "pnpm: $($PNPM_BIN --version)"
}