#!/usr/bin/env bash
# fetch-vendor.sh <vendor-dir> <bun-version> <pi-version>
#
# Downloads the pinned third-party payloads sl0ppi redistributes:
#   - bun          : the runtime that executes pi (single static binary)
#   - pi           : the agent itself, installed with its dependency tree
#
# Nothing here is committed to git; vendor/cache/ is gitignored. This script is
# what makes an offline `make package` reproducible-ish: fetch once, package
# many times.
#
# Pins live in the Makefile and FORKS.md. Checksums of whatever we actually
# downloaded are recorded in packaging/pins.sha256 -- if an entry already
# exists, a mismatch is a hard error.
set -euo pipefail

VENDOR="${1:?vendor dir}"
BUN_VERSION="${2:?bun version}"
PI_VERSION="${3:?pi version}"

HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PINS="$HERE/pins.sha256"
touch "$PINS"

log() { printf '\033[36m==>\033[0m %s\n' "$*"; }

# record_or_verify <key> <file>
record_or_verify() {
    local key="$1" file="$2" have want
    have="$(sha256sum "$file" | cut -d' ' -f1)"
    want="$(awk -v k="$key" '$2 == k {print $1}' "$PINS")"
    if [ -z "$want" ]; then
        echo "$have $key" >> "$PINS"
        log "pinned $key = $have"
    elif [ "$have" != "$want" ]; then
        echo "fetch-vendor: CHECKSUM MISMATCH for $key" >&2
        echo "  expected $want (packaging/pins.sha256)" >&2
        echo "  got      $have" >&2
        exit 1
    else
        log "verified $key"
    fi
}

mkdir -p "$VENDOR"

# --- bun -------------------------------------------------------------------
BUN_DIR="$VENDOR/bun-$BUN_VERSION"
if [ ! -x "$BUN_DIR/bun" ]; then
    log "fetching bun $BUN_VERSION"
    tmp="$(mktemp -d)"
    trap 'rm -rf "$tmp"' EXIT
    # BASELINE, not the default build: bun-linux-x64.zip requires AVX2, and a
    # plain KVM guest without it dies with "Illegal instruction" the first time
    # anything runs pi -- i.e. the tarball installs fine and then does not work,
    # on exactly the kind of machine this project exists to install on. Baseline
    # costs some JS throughput we do not notice and runs everywhere.
    curl -fsSL -o "$tmp/bun.zip" \
        "https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/bun-linux-x64-baseline.zip"
    record_or_verify "bun-linux-x64-baseline-$BUN_VERSION.zip" "$tmp/bun.zip"
    unzip -q -d "$tmp" "$tmp/bun.zip"
    mkdir -p "$BUN_DIR"
    install -m755 "$tmp"/bun-linux-x64-baseline/bun "$BUN_DIR/bun"
    rm -rf "$tmp"; trap - EXIT
else
    log "bun $BUN_VERSION already vendored"
fi
"$BUN_DIR/bun" --version >/dev/null || { echo "vendored bun does not run" >&2; exit 1; }

# --- pi --------------------------------------------------------------------
# npm install (not npm pack): the published tarball has no dependency tree, and
# pi ships an npm-shrinkwrap.json so the resolved tree is deterministic.
PI_DIR="$VENDOR/pi-$PI_VERSION"
if [ ! -f "$PI_DIR/node_modules/@earendil-works/pi-coding-agent/package.json" ]; then
    log "fetching pi $PI_VERSION (npm install with its shrinkwrap)"
    mkdir -p "$PI_DIR"
    npm install --silent --omit=dev --prefix "$PI_DIR" \
        "@earendil-works/pi-coding-agent@$PI_VERSION"
else
    log "pi $PI_VERSION already vendored"
fi

# sanity: the vendored runtime can run the vendored agent
got="$("$BUN_DIR/bun" \
    "$PI_DIR/node_modules/@earendil-works/pi-coding-agent/dist/cli.js" --version)"
[ "$got" = "$PI_VERSION" ] || {
    echo "vendored bun ran pi but got version '$got', expected '$PI_VERSION'" >&2
    exit 1
}
log "vendored bun runs vendored pi $got"