#!/usr/bin/env bash
# Build the fully-static linux/amd64 `nucleicd` for the runner container image
# (docs/COVALENCE_RUNNER.md §9; Cloudflare Containers run amd64 only).
#
# Cross-compiles with Swift's Static Linux SDK (musl), so it works at native speed from ANY
# build host arch — including the arm64 swift container on an Apple-silicon Mac. The one wrinkle
# is GRDB: it links the system sqlite3, which the musl sysroot doesn't ship, so this script
# compiles the SQLite amalgamation for the target (Debian-equivalent feature flags) and installs
# it into the SDK sysroot first. Exercised end to end: the resulting binary boots under
# qemu-x86_64, enrolls with the deployed relay, and mints pairing codes.
#
# Run inside a Swift toolchain matching SWIFT_VERSION (e.g.):
#   docker run --rm -v "$PWD":/src -w /src swift:6.3-bookworm scripts/build-nucleicd-linux.sh
# Output: .build/x86_64-swift-linux-musl/release/nucleicd  (copy into containers/nucleic-runner/)
set -euo pipefail

SWIFT_VERSION="6.3.3"
SDK_BUNDLE_VERSION="0.1.0"
# From https://www.swift.org/api/v1/install/releases.json (platform "static-sdk").
SDK_CHECKSUM="87c3eaf908e67c0e13a84367119e12273cec1d2cd3d81f7d74bb36722d6b607b"
SDK_URL="https://download.swift.org/swift-${SWIFT_VERSION}-release/static-sdk/swift-${SWIFT_VERSION}-RELEASE/swift-${SWIFT_VERSION}-RELEASE_static-linux-${SDK_BUNDLE_VERSION}.artifactbundle.tar.gz"
SDK_ID="x86_64-swift-linux-musl"
SCRATCH="${NUCLEICD_SCRATCH:-.build}"

toolchain=$(swift --version 2>/dev/null | head -1)
case "$toolchain" in
  *"$SWIFT_VERSION"*) ;;
  *) echo "error: need Swift $SWIFT_VERSION (the static SDK is toolchain-locked); have: $toolchain" >&2
     exit 1 ;;
esac

command -v curl >/dev/null || { apt-get update -qq && apt-get install -y -qq curl; }
command -v unzip >/dev/null || { apt-get update -qq && apt-get install -y -qq unzip; }

if ! swift sdk list 2>/dev/null | grep -q "static-linux-${SDK_BUNDLE_VERSION}"; then
  echo "==> installing the Static Linux SDK ${SWIFT_VERSION}/${SDK_BUNDLE_VERSION}"
  tmp=$(mktemp -d)
  curl -sL "$SDK_URL" -o "$tmp/sdk.tar.gz"
  swift sdk install "$tmp/sdk.tar.gz" --checksum "$SDK_CHECKSUM"
  rm -rf "$tmp"
fi

sysroot=$(dirname "$(find ~/.swiftpm/swift-sdks -name SDKSettings.json -path '*x86_64*' | head -1)")
[ -n "$sysroot" ] || { echo "error: couldn't locate the x86_64 musl sysroot" >&2; exit 1; }

if [ ! -f "$sysroot/usr/lib/libsqlite3.a" ]; then
  echo "==> building SQLite (musl, x86_64) into the SDK sysroot for GRDB"
  tmp=$(mktemp -d)
  rel=$(curl -s https://sqlite.org/download.html \
    | grep -oE "[0-9]{4}/sqlite-amalgamation-[0-9]+\.zip" | head -1)
  curl -sL "https://sqlite.org/$rel" -o "$tmp/sq.zip"
  (cd "$tmp" && unzip -q sq.zip)
  src=$(echo "$tmp"/sqlite-amalgamation-*)
  # Feature flags match what Debian's libsqlite3 ships (GRDB expects column metadata etc.).
  clang --target=x86_64-unknown-linux-musl --sysroot "$sysroot" -O2 \
    -DSQLITE_THREADSAFE=1 -DSQLITE_ENABLE_COLUMN_METADATA -DSQLITE_ENABLE_FTS5 \
    -DSQLITE_ENABLE_RTREE -DSQLITE_ENABLE_SNAPSHOT -DSQLITE_ENABLE_DBSTAT_VTAB \
    -c "$src/sqlite3.c" -o "$tmp/sqlite3.o"
  ar rcs "$tmp/libsqlite3.a" "$tmp/sqlite3.o"
  cp "$src/sqlite3.h" "$src/sqlite3ext.h" "$sysroot/usr/include/"
  cp "$tmp/libsqlite3.a" "$sysroot/usr/lib/"
  rm -rf "$tmp"
fi

echo "==> cross-compiling nucleicd (release, $SDK_ID)"
swift build --scratch-path "$SCRATCH" --swift-sdk "$SDK_ID" -c release --product nucleicd
out="$SCRATCH/x86_64-swift-linux-musl/release/nucleicd"
echo "==> built: $out"
ls -la "$out"
