// builds chimes and deploys it to the PDS via wisp, served at the custom
// domain chimes.waow.tech. the OAuth client_id points at the hosted metadata
// on that same origin.
//
// one-time setup (run separately, see README):
//   wispctl domain claim zzstoatzz.io --domain chimes.waow.tech   # prints DNS
//   <set those records on the waow.tech zone>
//   wispctl domain add-site zzstoatzz.io --domain chimes.waow.tech --site chimes
import { $ } from "bun";

const HANDLE = process.env.WISP_HANDLE ?? "zzstoatzz.io";
const SITE = process.env.WISP_SITE ?? "chimes";
const ORIGIN = process.env.CHIMES_ORIGIN ?? "https://chimes.waow.tech";
const base = `${ORIGIN}/`;

// MUST stay in sync with SCOPE in src/data/oauth.ts — this generates the
// hosted document the auth server validates the client against.
const SCOPE =
  "atproto repo:tech.waow.chimes.tuning?action=create&action=update&action=delete";

const metadata = {
  client_id: `${base}oauth-client-metadata.json`,
  client_name: "chimes",
  client_uri: base,
  redirect_uris: [base],
  scope: SCOPE,
  grant_types: ["authorization_code", "refresh_token"],
  response_types: ["code"],
  token_endpoint_auth_method: "none",
  application_type: "web",
  dpop_bound_access_tokens: true,
};

await Bun.write("public/oauth-client-metadata.json", JSON.stringify(metadata, null, 2));
console.log(`wrote oauth-client-metadata.json for ${base}`);

// the audio is the product; never ship a build whose synth is unverified
await $`bun run scripts/test-audio.ts`;
await $`bun run scripts/test-gust.ts`;
await $`bun run build`;

await $`wispctl deploy ${HANDLE} --path ./dist --site ${SITE} --spa`;
console.log(`deployed → ${base}`);