#!/usr/bin/env node
// Print the CSP source expression for the inline <base>-fix script in
// the BUILT index.html (dist/), e.g.  'sha256-…='.
//
// The live nginx Content-Security-Policy pins that script by hash. Run
// this after any change to packages/web-ui/index.html and paste the
// value into ops/nginx-digibyte-x.conf + the live vhost. ops/push.sh
// runs it automatically and warns when the live header no longer
// matches.
import { readFileSync } from 'node:fs';
import { createHash } from 'node:crypto';
import { fileURLToPath } from 'node:url';
import { dirname, join } from 'node:path';

const here = dirname(fileURLToPath(import.meta.url));
const file = process.argv[2] ?? join(here, '..', 'dist', 'index.html');
const html = readFileSync(file, 'utf8');
const m = html.match(/<script>([\s\S]*?)<\/script>/);
if (!m) {
  console.error(`no inline <script> in ${file}`);
  process.exit(1);
}
const digest = createHash('sha256').update(m[1], 'utf8').digest('base64');
process.stdout.write(`'sha256-${digest}'\n`);