<#
  NetDesk by Akronlogic  --  MSI build script (WiX v4).

  Produces dist\NetDesk.msi for enterprise / unattended deployment (GPO / SCCM /
  Intune). The MSI installs the portable payload and runs `NetDesk.exe --config`
  to write config.json non-interactively from the deployment properties:

    msiexec /i NetDesk.msi /qn SERVER="wss://relay.corp/ws" REGKEY="CORP1" `
            PASSWORD="Sup3rSecret!" HOSTID="123456789"

  Prerequisite (one time) -- the WiX toolset, which needs the .NET SDK:
    winget install Microsoft.DotNet.SDK.8      # or any current .NET SDK
    dotnet tool install --global wix

  NOTE: this box has only the .NET RUNTIME (no SDK), so WiX cannot be installed
  here and the MSI has not been built/verified in this environment. The
  unattended `--config` injection the MSI drives IS proven (viewer
  config_cli_tests + a live `NetDesk.exe --config` run). Run this on a build box
  that has WiX.

  Usage:
    powershell -ExecutionPolicy Bypass -File build-msi.ps1
    powershell -ExecutionPolicy Bypass -File build-msi.ps1 -SkipBuild   # reuse staged payload
#>
[CmdletBinding()]
param(
  [string]$MingwBin = "C:\mingw-netdesk\mingw64\bin",
  [switch]$SkipBuild,
  [switch]$NoSign,
  [string]$Thumbprint = "YOUR_CODE_SIGNING_CERT_THUMBPRINT"
)
$ErrorActionPreference = "Stop"

$PkgDir   = $PSScriptRoot
$RootDir  = Split-Path -Parent $PkgDir
$DistDir  = Join-Path $PkgDir "dist"
$StageDir = Join-Path $DistDir "NetDesk-Portable"
$Wxs      = Join-Path $PkgDir "netdesk.wxs"
$MsiOut   = Join-Path $DistDir "NetDesk.msi"
$SignPs1  = Join-Path $RootDir "certs\sign-release.ps1"

Write-Host "=== NetDesk MSI build (Akronlogic) ===" -ForegroundColor Cyan

# 1. stage the signed portable payload (NetDesk.exe + runtime DLLs).
$portableArgs = @{ MingwBin = $MingwBin }
if ($SkipBuild) { $portableArgs.SkipBuild = $true }
& (Join-Path $PkgDir "build-portable.ps1") @portableArgs
if (-not (Test-Path (Join-Path $StageDir "NetDesk.exe"))) { throw "payload missing: $StageDir" }

# 2. locate WiX.
$wix = Get-Command wix -ErrorAction SilentlyContinue
if (-not $wix) {
  throw "WiX toolset not found. Install it (needs the .NET SDK): dotnet tool install --global wix"
}

# 3. build the MSI, passing the payload dir as the $(Payload) preprocessor var.
New-Item -ItemType Directory -Force -Path $DistDir | Out-Null
& $wix.Source build $Wxs -d "Payload=$StageDir" -arch x64 -o $MsiOut
if ($LASTEXITCODE) { throw "wix build failed (exit $LASTEXITCODE)" }
Write-Host "  built: $MsiOut"

# 4. sign the MSI with the same cert as the portable / installer.
if (-not $NoSign -and (Test-Path $SignPs1)) {
  $signtool = Get-Command signtool.exe -ErrorAction SilentlyContinue
  if ($signtool) {
    & $signtool.Source sign /sha1 $Thumbprint /fd SHA256 /tr "http://timestamp.sectigo.com" /td SHA256 "$MsiOut"
    if ($LASTEXITCODE) { Write-Host "  signtool returned $LASTEXITCODE (continuing)" -ForegroundColor DarkYellow }
    else { Write-Host "  signed: $MsiOut" -ForegroundColor Green }
  }
}

Write-Host "`nMSI build complete -> $MsiOut" -ForegroundColor Green
Write-Host "Deploy: msiexec /i NetDesk.msi /qn SERVER=... REGKEY=... PASSWORD=... HOSTID=..."