import { createHash } from 'node:crypto';
import { mkdir, writeFile } from 'node:fs/promises';
import { join } from 'node:path';
import { lookupSha256 } from './checksums.js';
import { requestBytes, requestText } from './http.js';
import { verifyMinisign } from './minisign.js';
async function fetchText(url, { userAgent = 'happier-release-runtime' } = {}) {
    return await requestText({ url, headers: { 'user-agent': userAgent } });
}
async function fetchBytes(url, { userAgent = 'happier-release-runtime' } = {}) {
    return await requestBytes({ url, headers: { 'user-agent': userAgent } });
}
function sha256Hex(bytes) {
    return createHash('sha256').update(bytes).digest('hex');
}
export async function downloadVerifiedReleaseAssetBundle(params) {
    const bundle = params.bundle;
    const destDir = String(params.destDir ?? '').trim();
    const pubkeyFile = String(params.pubkeyFile ?? '');
    const userAgent = String(params.userAgent ?? '').trim() || 'happier-release-runtime';
    if (!destDir)
        throw new Error('[download] destDir is required');
    if (!pubkeyFile.trim())
        throw new Error('[download] pubkeyFile is required');
    await mkdir(destDir, { recursive: true });
    const checksumsText = await fetchText(bundle.checksums.url, { userAgent });
    const sigFile = await fetchText(bundle.checksumsSig.url, { userAgent });
    const ok = verifyMinisign({ message: Buffer.from(checksumsText, 'utf-8'), pubkeyFile, sigFile });
    if (!ok) {
        throw new Error('[download] signature verification failed for checksums file');
    }
    const expected = lookupSha256({ checksumsText, filename: bundle.archive.name });
    const bytes = await fetchBytes(bundle.archive.url, { userAgent });
    const actual = sha256Hex(bytes);
    if (actual !== expected) {
        throw new Error(`[download] checksum verification failed for ${bundle.archive.name}`);
    }
    const archivePath = join(destDir, bundle.archive.name);
    await writeFile(archivePath, bytes);
    return {
        version: String(bundle.version ?? ''),
        archiveName: bundle.archive.name,
        archivePath,
        source: { archiveUrl: bundle.archive.url, checksumsUrl: bundle.checksums.url },
    };
}
//# sourceMappingURL=verifiedDownload.js.map