name: Publish npm

on:
  push:
    tags:
      - 'v*'
  workflow_dispatch:

jobs:
  publish:
    name: Publish to npm
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      id-token: write

    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          registry-url: https://registry.npmjs.org

      - uses: mlugg/setup-zig@v2
        with:
          version: 0.15.2

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Get version
        id: version
        run: echo "version=$(jq -r .version package.json)" >> "$GITHUB_OUTPUT"

      - name: Replace workspace:* with version
        run: |
          VERSION=${{ steps.version.outputs.version }}
          for f in packages/*/package.json apps/cli/package.json; do
            if [ -f "$f" ]; then
              jq --arg v "$VERSION" '
                if .dependencies then
                  .dependencies |= with_entries(
                    if .value == "workspace:*" then .value = $v else . end
                  )
                else . end |
                if .devDependencies then
                  .devDependencies |= with_entries(
                    if .value == "workspace:*" then .value = $v else . end
                  )
                else . end
              ' "$f" > "$f.tmp" && mv "$f.tmp" "$f"
              echo "Updated $f"
            fi
          done

      - name: Checkout openpencil-skill
        uses: actions/checkout@v4
        with:
          repository: zseven-w/openpencil-skill
          path: ../openpencil-skill

      - name: Compile CLI
        run: bun run cli:compile

      - name: Verify CLI build
        run: node apps/cli/dist/openpencil-cli.cjs --version

      # Publish in topological order — skip packages already published at this version
      - name: Publish pen-types
        run: npm publish --access public 2>&1 || [[ $? -eq 0 ]] || npm view "@zseven-w/pen-types@${{ steps.version.outputs.version }}" version
        working-directory: packages/pen-types
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish pen-core
        run: npm publish --access public 2>&1 || npm view "@zseven-w/pen-core@${{ steps.version.outputs.version }}" version
        working-directory: packages/pen-core
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish pen-figma
        run: npm publish --access public 2>&1 || npm view "@zseven-w/pen-figma@${{ steps.version.outputs.version }}" version
        working-directory: packages/pen-figma
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish pen-renderer
        run: npm publish --access public 2>&1 || npm view "@zseven-w/pen-renderer@${{ steps.version.outputs.version }}" version
        working-directory: packages/pen-renderer
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish pen-engine
        run: npm publish --access public 2>&1 || npm view "@zseven-w/pen-engine@${{ steps.version.outputs.version }}" version
        working-directory: packages/pen-engine
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish pen-react
        run: npm publish --access public 2>&1 || npm view "@zseven-w/pen-react@${{ steps.version.outputs.version }}" version
        working-directory: packages/pen-react
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish pen-mcp
        run: npm publish --access public 2>&1 || npm view "@zseven-w/pen-mcp@${{ steps.version.outputs.version }}" version
        working-directory: packages/pen-mcp
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish pen-sdk
        run: npm publish --access public 2>&1 || npm view "@zseven-w/pen-sdk@${{ steps.version.outputs.version }}" version
        working-directory: packages/pen-sdk
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish pen-ai-skills
        run: npm publish --access public 2>&1 || npm view "@zseven-w/pen-ai-skills@${{ steps.version.outputs.version }}" version
        working-directory: packages/pen-ai-skills
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

      - name: Publish CLI
        run: npm publish --access public 2>&1 || npm view "@zseven-w/openpencil-cli@${{ steps.version.outputs.version }}" version
        working-directory: apps/cli
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}