# gov_publish_scripts_to_nas_v1.2.ps1
# Objet : Publier des scripts locaux (*.ps1) depuis C:\Temp_Gouvernance vers \\..._registry\scripts (SoT).
# PS 5.1 strict : pas d'opérateurs PS7, pas de ternaire, pas de here-strings.
# SAFE-CREATE : Ensure-Parent -> copie __tmp_ -> Move-Item atomique -> .bak horodaté -> triple SHA.
param(
  [string]$Root="\\DS-918\chatgpt\ChatGPT-Gouvernance-Projets\_registry",
  [string]$LocalDir="C:\Temp_Gouvernance",
  [string[]]$Patterns=@("gov_*.ps1","kb_*.ps1","writer_*.ps1"),
  [switch]$Preview,
  [switch]$Execute
)
if($Preview -and $Execute){ Write-Host "[NOK] -Preview et -Execute exclusifs."; exit 1 }
if(-not $Preview -and -not $Execute){ $Preview = $true }
try { [Console]::OutputEncoding = New-Object System.Text.UTF8Encoding } catch {}

function NowIso(){ (Get-Date).ToString("yyyyMMdd_HHmmss") }
function Ensure-Parent([string]$p){
  $parent=[IO.Path]::GetDirectoryName($p)
  if(-not [string]::IsNullOrWhiteSpace($parent)){ [void][IO.Directory]::CreateDirectory($parent) }
}
function Sha([string]$p){ if(Test-Path -LiteralPath $p){ (Get-FileHash -LiteralPath $p -Algorithm SHA256).Hash } else { "" } }

$nasScripts = Join-Path -Path $Root -ChildPath "scripts"
if(-not (Test-Path -LiteralPath $nasScripts)){ Write-Host ("[NOK] Dossier NAS introuvable : {0}" -f $nasScripts); exit 2 }

# Collecte locale
$locals=@()
foreach($pat in $Patterns){
  $got = Get-ChildItem -LiteralPath $LocalDir -Filter $pat -File -ErrorAction SilentlyContinue
  foreach($f in $got){ $locals += $f }
}
$locals = $locals | Sort-Object FullName -Unique

Write-Host ("== PREVIEW PUBLISH :: {0} fichier(s) candidat(s) ==" -f $locals.Count)
foreach($f in $locals){
  $dst = Join-Path -Path $nasScripts -ChildPath $f.Name
  Write-Host ("PUBLISH {0} -> {1}" -f $f.FullName, $dst)
}
if($Preview){ Write-Host "[INFO] Preview : aucune écriture."; exit 0 }

if($Execute){
  $errors=0; $ok=0
  $ts = NowIso
  foreach($f in $locals){
    $dst = Join-Path -Path $nasScripts -ChildPath $f.Name
    $tmp = Join-Path -Path (Join-Path -Path $Root -ChildPath "__tmp_scripts") -ChildPath $f.Name
    Ensure-Parent $tmp
    Copy-Item -LiteralPath $f.FullName -Destination $tmp -Force
    $shaLocal = Sha $f.FullName
    $shaTmp   = Sha $tmp
    if($shaLocal -ne $shaTmp){ Write-Host ("[NOK] SHA local/tmp diff pour {0}" -f $f.Name); $errors++; continue }
    if(Test-Path -LiteralPath $dst){
      $bak = $dst + "." + $ts + ".bak"
      Rename-Item -LiteralPath $dst -NewName (Split-Path -Leaf $bak) -Force
    }
    Ensure-Parent $dst
    Move-Item -LiteralPath $tmp -Destination $dst -Force
    $shaFinal = Sha $dst
    if($shaFinal -ne $shaLocal){ Write-Host ("[NOK] SHA final diff pour {0}" -f $f.Name); $errors++ } else { $ok++ }
  }
  Write-Host ("== RESULTAT == OK={0} Errors={1}" -f $ok, $errors)
  exit ([int]([bool]($errors -gt 0)))
}