#!/usr/bin/env bash
# Assemble dist/ — the CSP-clean static build served at learn.bztmon.com.
# The site's face is the delivery arc (index.html); scripts stay SEPARATE files so
# `script-src 'self'` holds with no 'unsafe-inline' exception. Assembly logic lives
# in pilot/assemble-arc.mjs (node — the build image carries no python).
set -euo pipefail
IFS=$'\n\t'
trap 'printf "build failed at line %s\n" "$LINENO" >&2' ERR

here="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
cd -- "$here"

for f in pilot/arc.tpl.html pilot/manifest-docker.json pilot/manifest-cluster.json \
         pilot/manifest-gitops.json pilot/manifest-supply.json \
         pilot/manifest-helm.json gsap.min.js st.min.js \
         assets/dist/course-VI-gitops.webp assets/dist/course-VII-supply-chain.webp \
         assets/dist/course-VIII-helm-press.webp assets/dist/appendix-dependency-ledger.webp \
         assets/dist/delivery-flow.svg assets/dist/docker-layers.webp \
         assets/dist/course-II-cluster.webp; do
  [[ -f "$f" ]] || { printf 'missing source: %s\n' "$f" >&2; exit 1; }
done

dist="$here/dist"
rm -rf -- "$dist"
node pilot/assemble-arc.mjs "$dist"

# No inline JS may survive into the served HTML, or the CSP silently kills the page.
if grep -oiE '<script[^>]*>' -- "$dist/index.html" | grep -qivE 'src='; then
  printf 'index.html contains an inline <script> — CSP script-src self would block it\n' >&2
  exit 1
fi

printf 'built %s\n' "$dist"
find "$dist" -type f -printf '  %-32P %8s bytes\n' | sort