// Source-only repository: retrieve the two runtime binaries during build/dev.
// URLs are version-pinned; the content must match the audited SHA-256 hashes.
import { createHash, randomUUID } from 'node:crypto';
import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
import { dirname, resolve } from 'node:path';
import { fileURLToPath } from 'node:url';

const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
const runtimes = [
  {
    path: 'public/vendor/usd-reader/wasm/usd_wasm_bg.wasm',
    url: 'https://huggingface.co/spaces/nvidia/simready-central/resolve/66f9109e5e383369ce351be2d1b4a285455fd8f7/services/explorer/dist/static/usd-reader/00c663a/wasm/usd_wasm_bg.wasm',
    sha256: '6eac411e5266dbfbf3157e560a85a9f156aa8a13a07f4bbc99b0e320e1495bb9',
    bytes: 2280023,
  },
  {
    path: 'public/vendor/basis/basis_transcoder.wasm',
    url: 'https://unpkg.com/three@0.180.0/examples/jsm/libs/basis/basis_transcoder.wasm',
    sha256: '6cf17dc889352c42e9acf8897107978d127005fe3386c36a0e3845e27967630a',
    bytes: 527333,
  },
];

function matches(data, runtime) {
  return data.length === runtime.bytes
    && data.subarray(0, 4).equals(Buffer.from([0, 97, 115, 109]))
    && createHash('sha256').update(data).digest('hex') === runtime.sha256;
}

async function prepare(runtime) {
  const destination = resolve(root, runtime.path);
  try {
    if (matches(await readFile(destination), runtime)) {
      console.log(`Verified ${runtime.path}`);
      return;
    }
  } catch (error) {
    if (error.code !== 'ENOENT') throw error;
  }

  console.log(`Downloading ${runtime.path}`);
  const response = await fetch(runtime.url, { signal: AbortSignal.timeout(60000) });
  if (!response.ok) throw new Error(`HTTP ${response.status}: ${runtime.url}`);
  const chunks = [];
  let length = 0;
  for await (const chunk of response.body) {
    length += chunk.length;
    if (length > runtime.bytes) throw new Error(`Unexpected file size: ${runtime.path}`);
    chunks.push(chunk);
  }
  const data = Buffer.concat(chunks);
  if (!matches(data, runtime)) throw new Error(`SHA-256 or size mismatch: ${runtime.path}`);

  await mkdir(dirname(destination), { recursive: true });
  const temporary = `${destination}.${randomUUID()}.tmp`;
  try {
    await writeFile(temporary, data, { flag: 'wx' });
    await rename(temporary, destination);
  } finally {
    await rm(temporary, { force: true });
  }
  console.log(`Downloaded and verified ${runtime.path}`);
}

try {
  for (const runtime of runtimes) await prepare(runtime);
} catch (error) {
  console.error(`Runtime preparation failed: ${error.message}`);
  console.error('Build stopped. Check access to the pinned public URLs and retry.');
  process.exitCode = 1;
}