#!/usr/bin/env bun
// scripts/release-firefox.ts
// One-command Firefox AMO release.
// Usage: bun run scripts/release-firefox.ts
//
// Required environment variables:
//   AMO_JWT_ISSUER, AMO_JWT_SECRET
//
// PB-26-211: all tools are resolved from node_modules/.bin — run
// `bun install --frozen-lockfile` before invoking release.

import {
  preflight,
  readVersion,
  runCommand,
  safeEnv,
  packageFirefoxSourceZip,
  signFirefox,
} from "./release-lib";

// ─── Preflight ───────────────────────────────────────────────────────────────

preflight();
const version = readVersion("manifest.firefox.json");
console.log(`\n🍑 Peach Firefox — releasing v${version}`);

// ─── CI gate ───────────────────────────────────────────────────────────────────
// PB-26-211: CI runs with a minimal safe environment — no store credentials.

runCommand("npm", ["run", "ci"], {
  label: "Running CI gate",
  env: safeEnv(),
});

// ─── Build ─────────────────────────────────────────────────────────────────────

runCommand("npm", ["run", "build:firefox"], {
  label: `Building Firefox extension v${version}`,
  env: safeEnv(),
});

// ─── Package source archive ────────────────────────────────────────────────────
// AMO requires source for any extension with minified/transpiled code.
// This zips everything a reviewer needs to build Peach from source.

const sourceZip = packageFirefoxSourceZip(version);

// ─── Sign and submit ───────────────────────────────────────────────────────────
// PB-26-211: AMO credentials are read and validated here, immediately before
// signing. They are passed only to the web-ext child.

signFirefox(sourceZip);

// ─── Done ──────────────────────────────────────────────────────────────────────

console.log(`\n✓ Peach Firefox v${version} submitted to AMO.`);
console.log(`  Source archive retained at ${sourceZip}.`);
console.log("  Existing users will receive the update automatically.");
console.log("  Check AMO developer hub for review status.");
console.log("");