#!/usr/bin/env bash
# Bundle the five TypeScript handlers for HCP plan/apply.
# Runs on the Terraform worker during plan (see artifacts.tf).
set -euo pipefail

ROOT="$(cd "$(dirname "$0")" && pwd)"
BUILD="${ROOT}/build"
REPO="$(cd "${ROOT}/.." && pwd)"
NODE_PREFIX="${BUILD}/.node"

ensure_node() {
  if command -v node >/dev/null 2>&1; then
    local major
    major="$(node -v | sed 's/^v//;s/\..*//')"
    if [ "${major}" -ge 20 ]; then
      return
    fi
  fi

  local version="24.11.1"
  local os arch tarball
  os="$(uname -s | tr '[:upper:]' '[:lower:]')"
  case "$(uname -m)" in
    x86_64 | amd64) arch="x64" ;;
    arm64 | aarch64) arch="arm64" ;;
    *)
      echo "error: unsupported arch $(uname -m)" >&2
      exit 1
      ;;
  esac
  tarball="node-v${version}-${os}-${arch}"
  mkdir -p "${NODE_PREFIX}"
  # HCP Terraform Linux workers do not ship xz. Use the gzip tarball.
  curl -fsSL "https://nodejs.org/dist/v${version}/${tarball}.tar.gz" \
    | tar -xz -C "${NODE_PREFIX}" --strip-components=1
  export PATH="${NODE_PREFIX}/bin:${PATH}"
}

rm -rf "${BUILD}"
mkdir -p "${BUILD}/packages"
ensure_node

if [ ! -d "${REPO}/node_modules/esbuild" ]; then
  (cd "${REPO}" && npm ci)
fi

bundle() {
  local name="$1"
  local src="$2"
  local outfile="$3"
  mkdir -p "${BUILD}/functions/${name}"
  npx --prefix "${REPO}" esbuild "${src}" \
    --bundle \
    --platform=node \
    --target=node24 \
    --outfile="${BUILD}/functions/${name}/${outfile}" \
    --external:@aws-sdk/*
}

bundle unlock "${REPO}/lambda/unlock/unlock-handler.ts" unlock-handler.js
bundle lockdown "${REPO}/lambda/lockdown/lockdown-handler.ts" lockdown-handler.js
bundle authorizer "${REPO}/lambda/authorizer/authorizer-handler.ts" authorizer-handler.js
bundle poller "${REPO}/lambda/poller/lockdown-poller.ts" lockdown-poller.js
bundle blf_sync "${REPO}/lambda/blf-sync/blf-sync-handler.ts" blf-sync-handler.js