param([string]$Tag = '')

$ErrorActionPreference = 'Stop'
$repoRoot = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
Push-Location $repoRoot
try {
    if (-not $Tag) { $Tag = (& git rev-parse --short=12 HEAD).Trim() }
    if ($Tag -notmatch '^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,100}$') { throw 'Invalid release tag' }
    & git diff --quiet -- . ':!configs/config.yaml'
    if ($LASTEXITCODE -ne 0) { throw 'Commit source changes before packaging' }
    & git diff --cached --quiet
    if ($LASTEXITCODE -ne 0) { throw 'Commit staged changes before packaging' }

    $outputRoot = Join-Path $repoRoot '.cache\deploy'
    $stage = Join-Path $outputRoot $Tag
    $archive = Join-Path $outputRoot "sw2-$Tag.tar.gz"
    if (Test-Path -LiteralPath $archive) { throw "Release archive already exists: $archive" }
    New-Item -ItemType Directory -Force -Path (Join-Path $stage 'backend'), (Join-Path $stage 'frontend') | Out-Null
    $previous = @{}
    try {
        foreach ($name in @('GOOS', 'GOARCH', 'CGO_ENABLED')) {
            $previous[$name] = [Environment]::GetEnvironmentVariable($name, 'Process')
        }
        $env:GOOS = 'linux'
        $env:GOARCH = 'amd64'
        $env:CGO_ENABLED = '0'
        & go build -trimpath -ldflags "-s -w -X main.Version=$Tag" -o (Join-Path $stage 'backend\kratos-admin') ./cmd
        if ($LASTEXITCODE -ne 0) { throw 'Linux backend build failed' }
    } finally {
        foreach ($name in $previous.Keys) { [Environment]::SetEnvironmentVariable($name, $previous[$name], 'Process') }
    }

    Push-Location (Join-Path $repoRoot 'web')
    try {
        & pnpm build
        if ($LASTEXITCODE -ne 0) { throw 'Frontend build failed' }
    } finally { Pop-Location }

    Copy-Item -LiteralPath (Join-Path $PSScriptRoot 'backend.Dockerfile') -Destination (Join-Path $stage 'backend\Dockerfile')
    Copy-Item -LiteralPath (Join-Path $PSScriptRoot 'frontend.Dockerfile') -Destination (Join-Path $stage 'frontend\Dockerfile')
    Copy-Item -LiteralPath (Join-Path $PSScriptRoot 'nginx.conf') -Destination (Join-Path $stage 'frontend\nginx.conf')
    $frontendDist = Join-Path $stage 'frontend\dist'
    New-Item -ItemType Directory -Force -Path $frontendDist | Out-Null
    Get-ChildItem -LiteralPath (Join-Path $repoRoot 'web\dist') | ForEach-Object {
        Copy-Item -LiteralPath $_.FullName -Destination $frontendDist -Recurse -Force
    }
    foreach ($name in @('deploy.sh', 'bt-nginx-sw2.fuhua91.com.conf')) {
        Copy-Item -LiteralPath (Join-Path $PSScriptRoot $name) -Destination (Join-Path $stage $name)
    }
    & tar -czf $archive -C $stage .
    if ($LASTEXITCODE -ne 0) { throw 'Release archive failed' }
    $hash = (Get-FileHash -LiteralPath $archive -Algorithm SHA256).Hash.ToLowerInvariant()
    [IO.File]::WriteAllText("$archive.sha256", "$hash  $([IO.Path]::GetFileName($archive))`n", [Text.UTF8Encoding]::new($false))
    Write-Output "Release: $archive"
    Write-Output "SHA256: $hash"
} finally { Pop-Location }