#!/bin/bash
# Publish a release: run.so (compiled clients ONLY) + panel.html.
# Source-protection policy: the channel NEVER serves run.py. Only .so clients self-update;
# older .py clients must be converted with push_so.sh first.
# Usage: [SO_SRC=/root/run.so] ./publish.sh <version> ["notes"]
set -e
REL=/opt/nova-release; BASE_URL="https://sv1.nguyenminhchau.name.vn"
VER="${1:?usage: publish.sh <version> [notes]}"; NOTES="${2:-}"; SO_SRC="${SO_SRC:-/root/run.so}"
[ -f "$SO_SRC" ] || { echo "ERROR: run.so not found at $SO_SRC (this channel is .so-only)"; exit 1; }
cp /opt/webpanel/panel.html "$REL/panel.html"
SH=$(sha256sum "$REL/panel.html" | awk '{print $1}')
cp "$SO_SRC" "$REL/run.so"; SS=$(sha256sum "$REL/run.so" | awk '{print $1}')
rm -f "$REL/run.py"   # never expose source on the channel
cat > "$REL/version.json" <<JSON
{
  "version": "$VER",
  "run_so": "$BASE_URL/run.so",
  "panel_html": "$BASE_URL/panel.html",
  "notes": "$NOTES",
  "released": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "sha256_so": "$SS",
  "sha256_html": "$SH"
}
JSON
sed 's#http://103.195.238.54:8090#http://127.0.0.1:8090#g' "$REL/version.json" > "$REL/version-local.json"
echo "Published v$VER (run.so sha=$SS, .so-only)"