// Bump the pinned Electron to the latest release, in package.json and
// package-lock.json, and keep the `allowScripts` key matching.
//
// Chromium CVEs are fixed in Electron releases; a client built against an old
// one ships those holes. This is the same policy packaging/build/build-client.sh
// applies on Linux -- factored out to a file so build-win.ps1 does not have to
// carry a PowerShell here-string (whose terminator rules make it fragile).
//
// Run from packages/meshbay-client. Writes both manifests and exits 0 whether
// or not a bump happened; exits non-zero only on an actual error. Prints the
// new version to stdout when it changed, nothing when it did not.

import { readFileSync, writeFileSync } from 'node:fs';
import { execFileSync } from 'node:child_process';

const pinned = JSON.parse(readFileSync('package-lock.json', 'utf8'))
  .packages['node_modules/electron'].version;

let latest;
try {
  latest = execFileSync('npm', ['view', 'electron', 'version'], { encoding: 'utf8' }).trim();
} catch {
  process.stderr.write('npm registry unreachable -- keeping Electron ' + pinned + '\n');
  process.exit(0);
}

if (latest === pinned) process.exit(0);

execFileSync('npm', ['install', '--save-dev', '--ignore-scripts', `electron@${latest}`],
  { stdio: 'inherit' });

const pkg = JSON.parse(readFileSync('package.json', 'utf8'));
if (pkg.allowScripts) {
  for (const k of Object.keys(pkg.allowScripts)) {
    if (k.startsWith('electron@')) {
      delete pkg.allowScripts[k];
      pkg.allowScripts[`electron@${latest}`] = true;
    }
  }
  writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
}

process.stdout.write(latest + '\n');