#!/usr/bin/env node
/**
 * Post-build step for the static export.
 *
 * The API serves the console with `Content-Security-Policy: script-src 'self'` (no 'unsafe-inline').
 * Next.js App Router emits the React Server Components payload as inline
 * `<script>self.__next_f.push([...])</script>` tags, which such a CSP blocks — hydration would never run.
 *
 * This script rewrites every `out/**\/*.html`: the inline scripts (all of them are `__next_f` pushes) are
 * concatenated, in document order, into one external file `out/_next/static/flight/<hash>.js`, and a single
 * blocking `<script src=…>` is inserted where the first inline script was. Pushing the flight data from an
 * external file is order-independent for Next's client runtime (it buffers pushes until the app chunk takes
 * over and closes the stream on DOMContentLoaded, which a blocking script always precedes).
 *
 * Fails loudly if an inline script that is not a `__next_f` push is found, so the CSP contract stays explicit.
 */
import { createHash } from "node:crypto";
import { mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
import { dirname, join, relative } from "node:path";
import { fileURLToPath } from "node:url";

const root = join(dirname(fileURLToPath(import.meta.url)), "..");
const out = join(root, "out");
const flightDir = join(out, "_next", "static", "flight");

function walk(dir, acc = []) {
  for (const name of readdirSync(dir)) {
    const p = join(dir, name);
    const st = statSync(p);
    if (st.isDirectory()) {
      if (name === "_next") continue;
      walk(p, acc);
    } else if (name.endsWith(".html")) acc.push(p);
  }
  return acc;
}

const INLINE = /<script>([\s\S]*?)<\/script>/g;
let files = 0, scripts = 0, bytes = 0;
mkdirSync(flightDir, { recursive: true });

for (const file of walk(out)) {
  const html = readFileSync(file, "utf8");
  const chunks = [];
  let first = -1;
  for (const m of html.matchAll(INLINE)) {
    const body = m[1];
    if (!/^\s*\(?self\.__next_f/.test(body)) {
      throw new Error(`${relative(root, file)}: unexpected inline <script> (not a __next_f push):\n${body.slice(0, 200)}`);
    }
    if (first < 0) first = m.index;
    chunks.push(body.trim().replace(/;?$/, ";"));
  }
  if (!chunks.length) continue;
  const js = chunks.join("\n") + "\n";
  const hash = createHash("sha256").update(js).digest("hex").slice(0, 16);
  const name = `${hash}.js`;
  writeFileSync(join(flightDir, name), js);
  let i = 0;
  const rewritten = html.replace(INLINE, () => (i++ === 0 ? `<script src="/_next/static/flight/${name}"></script>` : ""));
  writeFileSync(file, rewritten);
  files++;
  scripts += chunks.length;
  bytes += js.length;
}
console.log(`externalize-inline-scripts: ${files} html files, ${scripts} inline scripts moved to _next/static/flight (${(bytes / 1024).toFixed(1)} kB)`);