Makefile

.PHONY : check lint install-linters dep test lint-extra
.PHONY : update-deps update-dmsg update-skycoin push-deps
.PHONY : build clean install format  bin build-race netview-wasm check-netview-wasm
.PHONY : build-mobile android-mobile android-mobile-check android-mobile-ndk android-mobile-x86_64 android-apk android-aab android-apk-debug android-sh-apk check-mobile-version
.PHONY : generate services vet check-cg check-help check-inner check-ci hostbridge-dist
.PHONY : e2e-build e2e-run e2e-test e2e-stop e2e-clean e2e-skychat

# --match 'v[0-9]*' pins this to the SKYWIRE release tags. The repo also carries
# `mobile-vX.Y.Z` APK tags, and an annotated one of those sitting on HEAD would
# otherwise become the version every binary in the tree reports. --always still
# falls back to a bare hash when no release tag is reachable.
VERSION := $(shell git describe --always --match 'v[0-9]*')
RFC_3339 := "+%Y-%m-%dT%H:%M:%SZ"
COMMIT := $(shell git rev-list -1 HEAD)

PROJECT_BASE := github.com/skycoin/skywire
ifeq ($(OS),Windows_NT)
	SHELL := pwsh
	OPTS?=powershell -Command setx GO111MODULE on;
	DATE := $(shell powershell -Command date -u ${RFC_3339})
	.DEFAULT_GOAL := help-windows
else
	SHELL := /usr/bin/env bash
	OPTS?=GO111MODULE=on
	DATE := $(shell date -u $(RFC_3339))
	.DEFAULT_GOAL := help
endif

ifeq ($(VERSION),)
	VERSION = unknown
endif

ifeq ($(COMMIT),)
	COMMIT = unknown
endif

SYSTRAY_CGO_ENABLED := 1

ifeq ($(BUILDTAG),)
	ifeq ($(OS),Windows_NT)
		BUILDTAG = Windows
	else
		UNAME_S := $(shell uname -s)
		ifeq ($(UNAME_S),Linux)
			BUILDTAG = Linux
			SYSTRAY_CGO_ENABLED := 0
		endif
	 	ifeq ($(UNAME_S),Darwin)
			BUILDTAG = Darwin
			export CGO_CFLAGS := -Wno-deprecated-declarations
		endif
	endif
endif

STATIC_OPTS?= $(OPTS) CC=musl-gcc
MANAGER_UI_DIR = static/skywire-manager-src
MANAGER_UI_BUILT_DIR=pkg/visor/static
DOCKER_COMPOSE_FILE:=./docker/docker-compose.yml
DOCKER_REGISTRY:=skycoin

# -timeout is go test's PER-PACKAGE deadline: a deadlock backstop, not a
# budget. A package that passes is unaffected by raising it.
#
# 5m was tight enough to BE the failure. cmd/apps/skychat/group runs
# ~270 tests, a few dozen of them full dmsg round trips, and takes ~12.5
# min in aggregate; crossing 5m panicked the package with "test timed
# out" naming whichever 1s test happened to be running when the alarm
# fired. That reads exactly like a hang and isn't one. 25m keeps real
# headroom over that 12.5 min on a loaded runner.
#
# Race overhead doesn't scale this package the way it scales CPU-bound
# ones — its wall clock is dominated by fixed network timeouts — so the
# -race CI run measures about the same as a local run without it.
TEST_OPTS:=-cover -timeout=25m -mod=vendor -tags no_ci
# Windows skips -race. Linux runs the suite with it, and under it the wasm
# presets package alone took over 10 min on the windows lane.
TEST_OPTS_WINDOWS:=$(TEST_OPTS)

GOARCH:=$(shell go env GOARCH)

ifneq (,$(findstring 64,$(GOARCH)))
    TEST_OPTS:=$(TEST_OPTS) -race
endif

BUILDINFO_PATH := $(PROJECT_BASE)/pkg/buildinfo
BUILD_PATH := ./build/

BUILDINFO_VERSION := -X $(BUILDINFO_PATH).version=$(VERSION)
BUILDINFO_DATE := -X $(BUILDINFO_PATH).date=$(DATE)
BUILDINFO_COMMIT := -X $(BUILDINFO_PATH).commit=$(COMMIT)
BUILDTAGINFO := -X $(PROJECT_BASE)/pkg/visor.BuildTag=$(BUILDTAG)

BUILDINFO?=$(BUILDINFO_VERSION) $(BUILDINFO_DATE) $(BUILDINFO_COMMIT) $(BUILDTAGINFO)
INFO?=$(VERSION) $(DATE) $(COMMIT) $(BUILDTAG)

# The repo's OWN pkg/buildinfo (vs skywire-utilities' above). The skywire-mobile
# targets stamp it (MOBILE_APPINFO below): /api/about + cobra --version read this
# package.
#
# The js/wasm command module (exec-wasm) deliberately takes NO version
# ldflags. Instead it self-describes
# from the VCS info the Go toolchain records automatically (debug.BuildInfo
# vcs.revision / vcs.modified, written into a GOOS=js binary as plain text via
# -buildvcs): buildinfo.VersionOrCommit() turns that into a
# "dev-<commit>[-dirty]" string. No git-describe, no -X, no git dependency for
# the wasm build. skycoin reads the same vcs records in
# ci-scripts/check-wasm-version.js.
SKYWIRE_BUILDINFO_PATH := $(PROJECT_BASE)/pkg/buildinfo

BUILD_OPTS?="-ldflags=$(BUILDINFO)" -mod=vendor
BUILD_OPTS_DEPLOY?="-ldflags=$(BUILDINFO) -w -s"

export COMPOSE_FILE=${DOCKER_COMPOSE_FILE}
export REGISTRY=${DOCKER_REGISTRY}

buildinfo:
	@echo $(INFO)

version:
	@echo $(VERSION)

date:
	@echo $(DATE)

commit:
	@echo $(COMMIT)

services: ## update services-config.json
	scripts/services.sh

dig-services: ## show IP addresses for the services
	scripts/dig-services.sh

dmsghttp: ## update dmsghttp-config.json
	scripts/dmsghttp.sh

dmsg-servers: ## update embedded dmsg_servers in deployment/services-config.json from the discovery, over dmsg
	go run . dmsg conf pull
	go generate ./deployment/

check: ## Run linters and tests (lint, check-cg, check-help, test). Serialized via flock so two concurrent invocations don't trigger overlapping parallel test runs that pin every core and make the machine unresponsive.
	@if command -v flock >/dev/null 2>&1; then \
		exec 9>.make-check.lock; \
		if ! flock -n 9; then \
			echo "another 'make check' is already holding .make-check.lock; waiting for it to finish..." >&2; \
			flock 9; \
		fi; \
		$(MAKE) --no-print-directory -f $(firstword $(MAKEFILE_LIST)) check-inner; \
	else \
		echo "WARNING: 'flock' not available; running unguarded. install util-linux's flock to enable serialization." >&2; \
		$(MAKE) --no-print-directory -f $(firstword $(MAKEFILE_LIST)) check-inner; \
	fi

check-inner: lint check-cg check-browseui check-help test ## Internal: the actual check targets, run inside flock by 'make check'. Don't call directly unless you've already acquired .make-check.lock.


# BROWSEUI_ENTRYPOINTS: embedded browser scripts that define a global when they
# load, as path:symbol. Only scripts that assign unconditionally belong here —
# seed-skywire.js and autoupdate.js return early off-environment and define
# nothing, so asserting a symbol for them would fail for the wrong reason.
BROWSEUI_ENTRYPOINTS := \
	pkg/wasmhv/browseui/desk-boot.js:skywireDeskBoot \
	pkg/wasmhv/browseui/exec-remote.js:SkywireExecWorker \
	pkg/wasmhv/browseui/skywire-exec.js:skywireExec \
	pkg/wasmhv/browseui/identity-vault.js:SkywireIdentityVault

check-browseui: ## Fail if an embedded browser script does not load and define its entry point
	@# node --check is NOT enough. It validates syntax, and a statement at the
	@# wrong scope is syntactically perfect: #4675 and again #4869 both shipped
	@# a stray insert at the top of desk-boot.js that referenced `opts` outside
	@# the function it belonged to, threw ReferenceError at load, and killed the
	@# IIFE before it assigned skywireDeskBoot — so no desk booted at all. Both
	@# times `node --check` passed. Load the file and assert the entry point.
	@command -v node >/dev/null 2>&1 || { echo "node not found; skipping browser-script load check"; exit 0; }
	@set -e; \
	for f in $(BROWSEUI_ENTRYPOINTS); do \
		path=$${f%%:*}; sym=$${f##*:}; \
		node -e "globalThis.window = globalThis; \
			try { require('$(CURDIR)/$$path'); } \
			catch (e) { console.error('$$path threw at load: ' + e.message); process.exit(1); } \
			if (typeof globalThis['$$sym'] !== 'function' && typeof globalThis['$$sym'] !== 'object') { \
				console.error('$$path loaded but did not define $$sym'); process.exit(1); \
			} \
			process.exit(0);" || exit 1; \
		echo "  ok  $$path defines $$sym"; \
	done
	@# The identity vault is a device-theft defence; assert its properties, not
	@# just that it parses. Plain node, no framework.
	@if [ -f pkg/wasmhv/browseui/identity-vault.test.js ]; then \
		node pkg/wasmhv/browseui/identity-vault.test.js "$(CURDIR)/pkg/wasmhv/browseui/identity-vault.js" || exit 1; \
	fi
	@echo "embedded browser scripts load and define their entry points"

check-cg: ## Cursory check of the main help menu, offline dmsghttp config gen and offline config gen
	@echo "checking dmsghttp offline config gen"
	@echo
	go run . cli config gen -f --nofetch -dnw
	@echo
	@echo "checking offline config gen"
	@echo
	go run . cli config gen -f --nofetch -nw
	@echo
	@echo "config gen succeeded without error"
	@echo

check-help: ## Cursory check of the help menus
	@echo "checking help menu for compilation without errors"
	go run . --help
	@echo "compilation successful"

vet: ## Run go vet (the non-golangci-lint half of 'lint')
	CGO_ENABLED=0 ${OPTS} go vet -mod=vendor -tags 'withoutsystray withoutgotop' ./...

check-ci: vet check-cg check-help test ## CI check: like 'check' but skips golangci-lint (CI runs it as a separate pinned, cached step). Keeps go vet + config-gen smoke + tests.

check-windows: lint-windows test-windows ## Run linters and tests on windows image

build: clean build-merged ## Install dependencies, build apps and binaries. `go build` with ${OPTS}

print-build: ## Print the command used to build the binary
	@echo "${OPTS} go build ${BUILD_OPTS} -o $(BUILD_PATH)skywire ./cmd/skywire"

print-run-source: ## Print the command used to go run from source
	@echo "${OPTS} go run ${BUILD_OPTS} . cli config gen -n | sudo ${OPTS} go run ${BUILD_OPTS} . visor -n || true"

build-merged: ## Install dependencies, build apps and binaries. `go build` with ${OPTS}
	${OPTS} go build ${BUILD_OPTS} -o $(BUILD_PATH)skywire .

build-merged-cgo: ## Build with CGO optimization for faster DMSG handshakes (requires libsecp256k1-dev)
	${OPTS} go build -tags=cgo ${BUILD_OPTS} -o $(BUILD_PATH)skywire .

# ---- skywire-mobile: the lite multicall core for the Android app ----------
# One binary: visor + cli `config` subtree + the 4 client apps (in-proc via the
# launcher registry). The `mobile` tag strips the embedded desktop assets
# (geoip db 30 MB, manager UI 6.8 MB, vendored browser wallet 11 MB, tpviz
# legacy 2.8 MB).
# Output lands in the android project's jniLibs so Android
# Studio picks it up directly. -checklinkname=0 is REQUIRED on GOOS=android:
# the vendored wlynxg/anet uses //go:linkname into net (Go ≥1.23 blocks it).
ANDROID_JNILIBS := android/app/src/main/jniLibs/arm64-v8a
MOBILE_TAGS := mobile,withoutsystray
# Size budget for the android payload, in bytes (70 MiB). The CI lane fails
# over it so the lite variant can't silently rot or regain the stripped fat.
# It gates the pure-Go lane, which measured 68.8 MB (65.6 MiB) on 2026-09-23;
# the NDK release lane is 6 MB smaller again (packed relocations).
ANDROID_MOBILE_MAX_BYTES := 73400320

# MOBILE_APPINFO stamps the same symbols as $(BUILDINFO) with the phone's own
# version. It is listed AFTER $(BUILDINFO) on the ldflags line, and the linker
# takes the last -X for a symbol, so MOBILE_VERSION wins — which is what
# /api/about + cobra --version show on the phone's info card. That version MUST
# parse as semver (visorconfig.Parse semver-checks it and FATALs otherwise), and
# on a checkout with no reachable tag `git describe --always` is a bare hash —
# so fall back to a v0.0.0-<sha> pseudo-version.
#
# --match 'v[0-9]*' keeps this a clean SKYWIRE version: the nearest `vX.Y.Z`
# tag, exactly the version the visor should report. The repo also carries
# `mobile-vX.Y.Z` APK tags, and a bare `git describe --tags` that resolved to one
# of those would stamp "mobile-v0.0.2" as the visor version — `config gen` writes
# it into the config's `version` field and every visor start would then die in
# visorconfig.Parse with `Invalid character(s) found in major number
# "mobile-v0"`. The APK's own version is passed separately (APK_VERSION,
# derived from the `mobile-vX.Y.Z` tag). The glob is 'v[0-9]*' and not 'v*'
# because 'v*' still matches any `vpn-v1.2.3`-style tag.
MOBILE_VERSION := $(shell git describe --tags --match 'v[0-9]*' 2>/dev/null || echo "v0.0.0-$(VERSION)")
MOBILE_APPINFO := -X $(SKYWIRE_BUILDINFO_PATH).version=$(MOBILE_VERSION) -X $(SKYWIRE_BUILDINFO_PATH).commit=$(COMMIT) -X $(SKYWIRE_BUILDINFO_PATH).date=$(DATE)

# A MOBILE_VERSION that isn't semver produces a binary whose only symptom is a
# FATAL in the phone's log the first time a user starts the visor — after the
# APK has shipped. Every mobile build target goes through this first so the
# failure lands on the builder instead.
check-mobile-version:
	@printf '%s' '$(MOBILE_VERSION)' | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)?$$' || { \
		echo "MOBILE_VERSION='$(MOBILE_VERSION)' is not a version the visor accepts."; \
		echo "config gen writes it into the config's 'version' field, and visorconfig.Parse"; \
		echo "semver-checks it — the visor would exit at 'Failed to read in config'."; \
		exit 1; }

build-mobile: check-mobile-version ## Build the skywire-mobile lite core for the HOST OS (desktop smoke of the mobile build variant)
	${OPTS} go build -tags $(MOBILE_TAGS) "-ldflags=$(BUILDINFO) $(MOBILE_APPINFO)" -mod=vendor -o $(BUILD_PATH)skywire-mobile ./cmd/skywire-mobile

android-mobile: check-mobile-version ## Build libskywire-mobile.so (android/arm64) into android jniLibs — pure-Go lane (CI/emulator); use android-mobile-ndk for release (bionic DNS)
	mkdir -p $(ANDROID_JNILIBS)
	GOOS=android GOARCH=arm64 CGO_ENABLED=0 ${OPTS} go build -tags $(MOBILE_TAGS) "-ldflags=$(BUILDINFO) $(MOBILE_APPINFO) -w -s -checklinkname=0" -mod=vendor -o $(ANDROID_JNILIBS)/libskywire-mobile.so ./cmd/skywire-mobile
	@ls -la $(ANDROID_JNILIBS)/libskywire-mobile.so

ANDROID_JNILIBS_X86_64 := android/app/src/main/jniLibs/x86_64

# Go links android/amd64 only through cgo, so this lane needs the NDK too.
android-mobile-x86_64: check-mobile-version ## Debug lane: NDK/cgo android/amd64 build into jniLibs/x86_64, for an x86_64 emulator; requires ANDROID_NDK_HOME
	@set -e; \
	test -n "$(ANDROID_NDK_HOME)" || { echo "ANDROID_NDK_HOME is not set"; exit 1; }; \
	CC_BIN=$$(ls $(ANDROID_NDK_HOME)/toolchains/llvm/prebuilt/*/bin/x86_64-linux-android26-clang 2>/dev/null | head -n1); \
	test -n "$$CC_BIN" || { echo "x86_64-linux-android26-clang not found under ANDROID_NDK_HOME"; exit 1; }; \
	mkdir -p $(ANDROID_JNILIBS_X86_64); \
	GOOS=android GOARCH=amd64 CGO_ENABLED=1 CC="$$CC_BIN" go build -tags $(MOBILE_TAGS) "-ldflags=$(BUILDINFO) $(MOBILE_APPINFO) -w -s -checklinkname=0" -mod=vendor -o $(ANDROID_JNILIBS_X86_64)/libskywire-mobile.so ./cmd/skywire-mobile; \
	ls -la $(ANDROID_JNILIBS_X86_64)/libskywire-mobile.so

android-mobile-check: android-mobile ## CI lane: android-mobile + fail over the size budget
	@size=$$(wc -c < $(ANDROID_JNILIBS)/libskywire-mobile.so | tr -d '[:space:]'); \
	echo "libskywire-mobile.so: $$size bytes (budget $(ANDROID_MOBILE_MAX_BYTES))"; \
	if [ "$$size" -gt "$(ANDROID_MOBILE_MAX_BYTES)" ]; then \
		echo "ERROR: libskywire-mobile.so exceeds the size budget — the mobile variant regained fat"; \
		exit 1; \
	fi

# --pack-dyn-relocs=android: the payload is a PIE, and its 7 MB .rela table of
# dynamic relocations packs into Android's compact format (−6 MB on disk,
# −0.6 MB in the APK). bionic's linker reads it from API 23; minSdk is 26.
# External linking only, so the pure-Go lane above can't take it — that lane
# doesn't ship.
android-mobile-ndk: check-mobile-version ## Release lane: NDK/cgo android build (DNS via bionic getaddrinfo); requires ANDROID_NDK_HOME
	@set -e; \
	test -n "$(ANDROID_NDK_HOME)" || { echo "ANDROID_NDK_HOME is not set"; exit 1; }; \
	CC_BIN=$$(ls $(ANDROID_NDK_HOME)/toolchains/llvm/prebuilt/*/bin/aarch64-linux-android26-clang 2>/dev/null | head -n1); \
	test -n "$$CC_BIN" || { echo "aarch64-linux-android26-clang not found under ANDROID_NDK_HOME"; exit 1; }; \
	mkdir -p $(ANDROID_JNILIBS); \
	GOOS=android GOARCH=arm64 CGO_ENABLED=1 CC="$$CC_BIN" go build -tags $(MOBILE_TAGS) "-ldflags=$(BUILDINFO) $(MOBILE_APPINFO) -w -s -checklinkname=0 -extldflags=-Wl,--pack-dyn-relocs=android" -mod=vendor -o $(ANDROID_JNILIBS)/libskywire-mobile.so ./cmd/skywire-mobile; \
	ls -la $(ANDROID_JNILIBS)/libskywire-mobile.so

# Android Studio's bundled JDK (gradle needs JDK 17+); override if yours differs.
ANDROID_JAVA_HOME ?= /Applications/Android Studio.app/Contents/jbr/Contents/Home

# APK_VERSION=X.Y.Z stamps the build; without it the committed gradle
# fallbacks apply. The versionCode formula lives HERE and nowhere else — the
# Android release workflow (android-release.yml) calls this target rather than
# computing its own — so a tag build and a local build can never disagree about
# the number. Minor and patch are capped at 99, past which the scheme stops
# being monotonic.
ifdef APK_VERSION
APK_VERSION_CODE := $(shell printf '%s' '$(APK_VERSION)' | awk -F. \
	'{ if (NF==3 && $$1$$2$$3 ~ /^[0-9]+$$/ && $$2<=99 && $$3<=99) print $$1*10000+$$2*100+$$3 }')
APK_GRADLE_ARGS := -PskywireVersionName=$(APK_VERSION) -PskywireVersionCode=$(APK_VERSION_CODE)
endif

android-apk: ## Build the Android APK (release; APK_VERSION=X.Y.Z to stamp it; signed when ANDROID_KEYSTORE_FILE/_PASSWORD + ANDROID_KEY_ALIAS/_PASSWORD are set, else unsigned) — run android-mobile-ndk first for a fresh Go payload
	@if [ -n "$(APK_VERSION)" ] && [ -z "$(APK_VERSION_CODE)" ]; then \
		echo "APK_VERSION='$(APK_VERSION)' is not X.Y.Z with minor/patch <= 99"; exit 1; fi
	@if [ "$(APK_VERSION_CODE)" = "0" ]; then \
		echo "APK_VERSION=0.0.0 derives versionCode 0, and Android requires a"; \
		echo "positive integer — the lowest usable version is 0.0.1."; exit 1; fi
	@if [ -n "$(APK_VERSION)" ]; then \
		echo "version: $(APK_VERSION) (versionCode $(APK_VERSION_CODE))"; fi
	@if [ -n "$$ANDROID_KEYSTORE_FILE" ]; then \
		echo "signing with $$ANDROID_KEYSTORE_FILE"; \
	else \
		echo "ANDROID_KEYSTORE_FILE unset — building UNSIGNED (app-release-unsigned.apk)"; fi
	cd android && JAVA_HOME="$(ANDROID_JAVA_HOME)" ./gradlew assembleRelease $(APK_GRADLE_ARGS)

android-aab: ## Build the Android App Bundle (release .aab for Play; APK_VERSION=X.Y.Z to stamp it; signed when ANDROID_KEYSTORE_FILE/_PASSWORD + ANDROID_KEY_ALIAS/_PASSWORD are set, else unsigned) — run android-mobile-ndk first for a fresh Go payload
	@if [ -n "$(APK_VERSION)" ] && [ -z "$(APK_VERSION_CODE)" ]; then \
		echo "APK_VERSION='$(APK_VERSION)' is not X.Y.Z with minor/patch <= 99"; exit 1; fi
	@if [ "$(APK_VERSION_CODE)" = "0" ]; then \
		echo "APK_VERSION=0.0.0 derives versionCode 0, and Android requires a"; \
		echo "positive integer — the lowest usable version is 0.0.1."; exit 1; fi
	@if [ -n "$(APK_VERSION)" ]; then \
		echo "version: $(APK_VERSION) (versionCode $(APK_VERSION_CODE))"; fi
	@if [ -n "$$ANDROID_KEYSTORE_FILE" ]; then \
		echo "signing with $$ANDROID_KEYSTORE_FILE"; \
	else \
		echo "ANDROID_KEYSTORE_FILE unset — building UNSIGNED App Bundle"; fi
	cd android && JAVA_HOME="$(ANDROID_JAVA_HOME)" ./gradlew bundleRelease $(APK_GRADLE_ARGS)

android-apk-debug: ## Build + the debug-signed APK (installable via adb) — the dev loop's CLI twin of Android Studio Run
	cd android && JAVA_HOME="$(ANDROID_JAVA_HOME)" ./gradlew assembleDebug

# The skywire app: skywire sh in a Gio window, built by gogio from the 0magnet
# Gio fork, which opens with the visor starting as the browser desk does. It
# is not the Skywire app above. Needs ANDROID_HOME (the newest platform there
# is the target SDK), ANDROID_NDK_ROOT and a JDK. ANDROID_SH_VERSION=X.Y.Z
# stamps it, the version code X*1000000+Y*1000+Z. Signed with the keystore
# ANDROID_SH_KEYSTORE and its password in GOGIO_SIGNPASS, else a debug key.
GOGIO_VERSION := 332d2dd
ANDROID_SH_APPID := com.skycoin.skywire.term
ANDROID_SH_ARCH ?= arm64,amd64
ANDROID_SH_APK ?= skywire-android.apk
ANDROID_SH_CODE := $(shell echo '$(ANDROID_SH_VERSION)' | awk -F. 'NF==3 && $$0 ~ /^[0-9]+\.[0-9]+\.[0-9]+$$/ && $$2<1000 && $$3<1000 { print $$1*1000000+$$2*1000+$$3 }')

android-sh-apk: ## Build the skywire app (skywire sh in a window, starting the visor), see the comment above
	@if [ -n "$(ANDROID_SH_VERSION)" ] && [ -z "$(ANDROID_SH_CODE)" ]; then \
		echo "ANDROID_SH_VERSION='$(ANDROID_SH_VERSION)' is not X.Y.Z with minor and patch below 1000"; exit 1; fi
	GOBIN=$(CURDIR)/build/gogio GOFLAGS= go install github.com/0magnet/gio-cmd/gogio@$(GOGIO_VERSION)
	GOFLAGS=-mod=vendor $(CURDIR)/build/gogio/gogio -target android -arch $(ANDROID_SH_ARCH) -minsdk 26 \
		-tags withoutsystray -ldflags "-checklinkname=0 $(BUILDINFO)" \
		-appid $(ANDROID_SH_APPID) -name skywire -o $(ANDROID_SH_APK) \
		$(if $(ANDROID_SH_CODE),-version $(ANDROID_SH_VERSION).$(ANDROID_SH_CODE)) \
		$(if $(ANDROID_SH_KEYSTORE),-signkey $(ANDROID_SH_KEYSTORE)) \
		. sh --window --tab "skywire autoconfig --ishv" --tab "skywire --help"

build-merged-windows: clean-windows
	powershell '${OPTS} go build ${BUILD_OPTS} -o $(BUILD_PATH)skywire.exe .'

install-system-linux: build ## Install apps and binaries over those provided by the linux package - linux package must be installed first!
	sudo echo "sudo cache"
	sudo install -Dm755 $(BUILD_PATH)skywire /opt/skywire/bin/

install-generate: ## Installs required execs for go generate.
	${OPTS} go install github.com/vektra/mockery/v2@latest

	## TO DO: it may be unnecessary to install required execs for go generate into the path. An alternative method may exist which does not require this
	## https://eli.thegreenplace.net/2021/a-comprehensive-guide-to-go-generate

generate: ## Generate mocks and config README's
	go generate ./...

hostbridge-dist: ## Rebuild the TinyGo host bridges the wasm visor embeds (needs the 0magnet/tinygo fork as tinygo)
	for t in linux/amd64 linux/arm64 linux/arm linux/386 darwin/amd64 darwin/arm64 windows/amd64; do \
		os=$${t%/*}; arch=$${t#*/}; ext=; [ $$os = windows ] && ext=.exe; \
		f=pkg/hostbridge/dist/skywire-hostbridge-$$os-$$arch$$ext; \
		GOOS=$$os GOARCH=$$arch tinygo build -no-debug -o $$f ./cmd/hostbridge && gzip -9 -n -f $$f || exit 1; \
	done

doc-gen: ## Regenerate docs/skywire/ from the live cobra command tree
	go run ./cmd/skywire doc --out docs/skywire

docs-prepare: ## Stage external doc trees (specs/, rewards/, cmd/apps/, cmd/dmsg/, cmd/svc/) under docs/ for MkDocs
	bash scripts/docs-prepare.sh

docs-serve: docs-prepare ## Local preview of the MkDocs site at http://127.0.0.1:8000
	mkdocs serve

docs-build: docs-prepare ## Build the MkDocs site into ./site (mirrors CI)
	mkdocs build

docs-install-deps: ## Install MkDocs + plugins (run once per machine)
	pip install --user 'mkdocs-material==9.5.*' 'mkdocs-awesome-pages-plugin==2.9.*' 'pymdown-extensions==10.*'

clean: ## Clean project: remove created binaries and apps
	-rm -rf ./build ./local

build-wasm: ## Compile-check the js/wasm module (GOOS=js GOARCH=wasm), no run — mirrors the CI wasm lane
	@echo "compile-checking the js/wasm module..."
	@# The root module: it IS the one command module every page serves
	@# (exec-wasm), built with the same tags.
	@echo "  GOOS=js GOARCH=wasm go build -tags \"$(EXEC_WASM_TAGS)\" ."
	@GOOS=js GOARCH=wasm go build -mod=vendor -tags "$(EXEC_WASM_TAGS)" -o /dev/null . || exit 1
	@echo "the js/wasm module compiles."

# Most packages' tests want a socket or a filesystem that js/wasm has not got,
# so the list is explicit rather than ./... .
#
# pkg/dmsg/dmsg is not here yet even though it holds the WebTransport deadline
# tests. 38 of its 50 test files carry no build tag, and its shared helpers sit
# in test files whose tags differ (GenKeyPair is in stream_test.go), so tagging
# the socket-bound ones one at a time does not converge. Covering it means
# tagging them all or moving the helpers, which is its own change.
WASM_TEST_PKGS ?= ./pkg/transport/network/...

.PHONY: test-wasm
test-wasm: ## Run the js/wasm tests under Node (GOOS=js GOARCH=wasm) — the browser carriers' deadline and backpressure behaviour
	@command -v node >/dev/null 2>&1 || { echo "node not installed — needed to run the js/wasm tests"; exit 1; }
	@# Go ships the Node shim. It moved from misc/wasm to lib/wasm in go1.24.
	@wasmexec="$$(go env GOROOT)/lib/wasm/go_js_wasm_exec"; \
	 [ -x "$$wasmexec" ] || wasmexec="$$(go env GOROOT)/misc/wasm/go_js_wasm_exec"; \
	 [ -x "$$wasmexec" ] || { echo "no go_js_wasm_exec under $$(go env GOROOT)"; exit 1; }; \
	 echo "  GOOS=js GOARCH=wasm go test $(WASM_TEST_PKGS)"; \
	 GOOS=js GOARCH=wasm go test -mod=vendor -count=1 -exec "$$wasmexec" $(WASM_TEST_PKGS) || exit 1
	@echo "the js/wasm tests pass."

build-wasm-tinygo: ## Compile-check the TinyGo wasm binaries (-o /dev/null, no run) — mirrors the CI wasm-tinygo lane
	@command -v tinygo >/dev/null 2>&1 || { echo "tinygo not installed — see docs/examples/routing-policies/wasm/README.md (TinyGo 0.41+)"; exit 1; }
	@# TinyGo trails Go by weeks after each Go minor, and refuses to run at all
	@# against a newer one ("requires go version 1.19 through 1.26, got go1.27").
	@# CI installs the current Go, so this lane went red the day #4221 bumped it.
	@# The script asks TinyGo what it supports and resolves a matching toolchain,
	@# printing "auto" once TinyGo has caught up — so no version is written down.
	@#
	@# -interp-timeout raises TinyGo's 3m default for the compile-time
	@# interpreter, which folds skycoin's secp256k1 package init. That fits
	@# inside the default on a CI runner but not on a slower machine building
	@# from a cold cache, so the ceiling does not depend on whose machine runs it.
	@echo "compile-checking TinyGo wasm binaries..."
	@# Only net/http-free binaries belong here: TinyGo cannot compile net/http
	@# for wasm. The one js/wasm module (the root binary) uses it and is
	@# standard-Go-only — the `build-wasm` lane compile-checks it instead.
	@echo "  tinygo build -target wasi (app-mux routing policy)"
	@cd docs/examples/routing-policies/wasm/app-mux && GOTOOLCHAIN=$$(cd ../../../../.. && sh scripts/tinygo-toolchain.sh) tinygo build -target=wasi -no-debug -opt=2 -o /dev/null . || exit 1
	@echo "all TinyGo wasm binaries compile."

test-wasm-policy: ## Rebuild app-mux.wasm from source with TinyGo and run the policy loader test against the FRESH build (real WASM runtime smoke test)
	@command -v tinygo >/dev/null 2>&1 || { echo "tinygo not installed — see docs/examples/routing-policies/wasm/README.md (TinyGo 0.32+)"; exit 1; }
	@mkdir -p ./build/wasm-fixtures
	cd docs/examples/routing-policies/wasm/app-mux && GOTOOLCHAIN=$$(cd ../../../../.. && sh scripts/tinygo-toolchain.sh) tinygo build -target=wasi -no-debug -opt=2 -o "$(CURDIR)/build/wasm-fixtures/app-mux.wasm" .
	SKYWIRE_APPMUX_WASM="$(CURDIR)/build/wasm-fixtures/app-mux.wasm" go test -mod=vendor -count=1 -v -run TestWasmEvaluator ./pkg/router/policy/wasm/

BUNDLE_WASM_SRC = docs/examples/routing-policies/wasm/bundle
BUNDLE_WASM = pkg/router/policy/wasm/presets/bundle.wasm

bundle-wasm: ## Rebuild the COMMITTED routing-policy bundle.wasm (pkg/router/policy/wasm/presets) from source with TinyGo, then check parity
	@command -v tinygo >/dev/null 2>&1 || { echo "tinygo not installed — see docs/examples/routing-policies/wasm/README.md (TinyGo 0.41+)"; exit 1; }
	cd $(BUNDLE_WASM_SRC) && GOTOOLCHAIN=$$(cd "$(CURDIR)" && sh scripts/tinygo-toolchain.sh) tinygo build -target=wasi -no-debug -opt=2 -o "$(CURDIR)/$(BUNDLE_WASM)" .
	@echo "rebuilt $(BUNDLE_WASM). Verifying native<->wazero parity..."
	go test -count=1 -run 'TestDecideParity|TestTickParity' ./pkg/router/policy/wasm/presets/
	@echo "review with 'git status' and commit $(BUNDLE_WASM) intentionally."

check-bundle-wasm: ## Warn if the committed routing-policy bundle.wasm differs from a fresh TinyGo build
	@command -v tinygo >/dev/null 2>&1 || { echo "tinygo not installed — see docs/examples/routing-policies/wasm/README.md (TinyGo 0.41+)"; exit 1; }
	@# pkg/router/policy/wasm/presets/bundle.wasm is a build artifact committed to
	@# the repo and embedded in the visor: a native visor on a preset:* policy runs
	@# it via wazero. A stale one ships DIFFERENT routing decisions (and different
	@# mux-control tunable defaults) than the source it is a compilation of
	@# (pkg/router/policy/preset) — exactly #4325.
	@#
	@# This used to FAIL on any byte difference. It does not any more, because the
	@# build is not byte-reproducible across machines and the gate spent days red
	@# on develop while nothing was actually stale. Measured: same TinyGo 0.42.0,
	@# same Go 1.27.1, and CI's build came out 34 bytes smaller than the committed
	@# blob (1110801 vs 1110835). Ruled out as causes — GOEXPERIMENT (incl. the
	@# distro's nodwarf5), -trimpath, the build path, the TinyGo distribution
	@# (official release tarball vs the distro package) and the Go distribution
	@# (upstream go1.27.1 tarball vs the distro's). The local build is
	@# deterministic and byte-identical to the committed blob; CI's differs
	@# consistently. Whatever the remaining 34 bytes are, they are not staleness.
	@#
	@# Staleness is caught properly, and semantically, by the parity test in
	@# pkg/router/policy/wasm/presets: it loads the COMMITTED blob through wazero
	@# and compares it field-for-field against the native preset package, so a
	@# blob built from a different revision of that package fails there and in the
	@# ordinary linux lane. That is the gate. This target is the provenance hint
	@# that goes with it, and a hint that cannot distinguish "rebuilt elsewhere"
	@# from "out of date" has no business failing a build.
	@tmp=$$(mktemp) && \
	( cd $(BUNDLE_WASM_SRC) && GOTOOLCHAIN=$$(cd "$(CURDIR)" && sh scripts/tinygo-toolchain.sh) tinygo build -target=wasi -no-debug -opt=2 -o "$$tmp" . ) && \
	if cmp -s "$$tmp" "$(BUNDLE_WASM)"; then rm -f "$$tmp"; echo "The committed routing-policy bundle.wasm is byte-identical to a fresh build."; else \
		echo "NOTE: the committed routing-policy bundle.wasm differs from a fresh build here."; \
		echo "      Byte equality does not hold across toolchain builds, so this is not by"; \
		echo "      itself staleness. If you CHANGED pkg/router/policy/preset, run"; \
		echo "      'make bundle-wasm' and commit the result; the parity test in"; \
		echo "      pkg/router/policy/wasm/presets is what actually fails on a stale blob."; \
		ls -l "$$tmp" "$(CURDIR)/$(BUNDLE_WASM)"; rm -f "$$tmp"; \
	fi

# The WebGL graph view is its own small module, committed gzipped. It is built
# with the go.mod toolchain so the build is byte-reproducible and matches the
# committed pkg/wasmhv/wasm_exec.js.
NETVIEW_WASM = pkg/tpviz/netview/netview.wasm.gz
NETVIEW_BUILD = GOTOOLCHAIN=go$$(awk '/^go /{print $$2}' go.mod) GOOS=js GOARCH=wasm go build -trimpath -buildvcs=false -ldflags='-s -w'

netview-wasm: ## Rebuild the committed netview module (pkg/tpviz/netview)
	@tmp=$$(mktemp) && $(NETVIEW_BUILD) -o "$$tmp" ./cmd/netview && gzip -9 -n -c "$$tmp" > $(NETVIEW_WASM) && rm -f "$$tmp"
	@ls -l $(NETVIEW_WASM); echo "commit $(NETVIEW_WASM) with the change that needed it."

check-netview-wasm: ## Fail if the committed netview module differs from a fresh build
	@tmp=$$(mktemp) && $(NETVIEW_BUILD) -o "$$tmp" ./cmd/netview && gzip -9 -n -c "$$tmp" > "$$tmp.gz" && rm -f "$$tmp" && \
	if cmp -s "$$tmp.gz" $(NETVIEW_WASM); then rm -f "$$tmp.gz"; echo "$(NETVIEW_WASM) is up to date."; else \
		rm -f "$$tmp.gz"; echo "$(NETVIEW_WASM) is stale. Run 'make netview-wasm' and commit it."; exit 1; fi


# embed-winbox was removed: the window manager now lives in
# github.com/0magnet/winbox-go, which the Go desk host links directly. To
# update it: push winbox-go, then
# `go get github.com/0magnet/winbox-go@main && go mod vendor` here.
# embed-wallet was removed: the wallet is now served straight from the VENDORED
# skycoin module's own embedded dist (skycoin-web/src/gui.DistFS, via
# visor.WalletUIFS) — a skycoin vendor bump IS the wallet update; there is no
# copied pkg/visor/static/wallet tree to sync (or forget to sync) anymore.

tpviz-ui: ## Build transport visualizer TypeScript UI into pkg/tpviz/legacy for embedding
	cd ./pkg/tpviz/ui && npm install && npm run build

clean-windows: ## Clean project: remove created binaries and apps
	powershell -Command "If (Test-Path ./local) { Remove-Item -Path ./local -Force -Recurse }"
	powershell -Command "If (Test-Path ./build) { Remove-Item -Path ./build -Force -Recurse }"

install: ## Install `skywire-visor`, `skywire-cli`, `setup-node`
	${OPTS} go install ${BUILD_OPTS} .

install-windows: ## Install `skywire-visor`, `skywire-cli`, `setup-node`
	powershell 'Get-ChildItem .\cmd | % { ${OPTS} go install ${BUILD_OPTS} ./ $$_.FullName }'

install-static: ## Install `skywire-visor`, `skywire-cli`, `setup-node`
	${STATIC_OPTS} go install -trimpath --ldflags '-linkmode external -extldflags "-static" -buildid=' .

lint: ## Run linters. Use make install-linters first
	command -v golangci-lint || go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
	golangci-lint --version
	CGO_ENABLED=0 ${OPTS} golangci-lint run -c .golangci.yml --build-tags 'withoutsystray withoutgotop' ./...
	CGO_ENABLED=0 ${OPTS} go vet -mod=vendor -tags 'withoutsystray withoutgotop' ./...

lint-extra: ## Run linters with extra checks.
	golangci-lint run --no-config --enable-all ./...
	go vet -all -mod=vendor ./...

gocyclo: ## Run gocyclo
	gocyclo -over 14 .

lint-windows: ## Run linters. Use make install-linters-windows first
	powershell 'if (-not (Get-Command golangci-lint -ErrorAction SilentlyContinue)) { go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest }'
	powershell 'golangci-lint --version'
	powershell '$$env:CGO_ENABLED=0; golangci-lint run -c .golangci.yml --build-tags "withoutsystray withoutgotop" ./...'

gocyclo-windows: ## Run gocyclo on windows
	powershell 'gocyclo -over 14 .'

install-shellcheck: ## install shellcheck to current directory
	./ci_scripts/install-shellcheck.sh

lint-shell:
	find ./ci_scripts -type f -iname '*.sh' -print0 | xargs -0 -I {} bash -c "$$(command -v ./shellcheck || command -v shellcheck) \"{}\""
	find ./docker -type f -iname '*.sh' -print0 | xargs -0 -I {} bash -c "$$(command -v ./shellcheck || command -v shellcheck) -e SC2086 \"{}\""

test: ## Run tests
	${OPTS} go test ${TEST_OPTS} ./internal/... ./pkg/... ./cmd/...
	${OPTS} go test ${TEST_OPTS}

test-32bit: ## Run the packages that use 64-bit atomics under a 32-bit GOARCH, where a misaligned atomic panics
	# A 64-bit atomic on a 4-aligned address panics with "unaligned 64-bit
	# atomic operation" on arm/386/mips and takes the process with it. The
	# offsets differ only by word size, so a 386 run reproduces what an armhf
	# visor does — and 386 test binaries are static and run on an amd64 host,
	# which arm ones do not. Declaring such counters atomic.Int64/Uint64 is the
	# fix; this is how the ones that were not get found.
	CGO_ENABLED=0 GOARCH=386 go test  ./pkg/transport/... ./pkg/router/... ./pkg/dmsg/... ./pkg/logging/... ./pkg/vpn/... ./pkg/httpauthclient/... ./pkg/metricsutil/...

test-windows: ## Run tests on windows
	${OPTS} go test ${TEST_OPTS_WINDOWS} ./internal/... ./pkg/... ./cmd/skywire-cli... ./cmd/skywire-visor... ./cmd/skywire... ./cmd/apps...

install-linters: ## Install linters
	${OPTS} go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest
	${OPTS} go install golang.org/x/tools/cmd/goimports@latest github.com/FiloSottile/vendorcheck@latest

install-linters-windows: ## Install linters
	${OPTS} go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest golang.org/x/tools/cmd/goimports@latest

tidy: ## Tidies and vendors dependencies.
	${OPTS} go mod tidy -v

format: tidy ## Formats the code. Must have goimports installed (use make install-linters).
	@if grep -qE '^(replace|exclude)' go.mod; then \
		echo "ERROR: go.mod contains replace or exclude directives which break go install @version and Docker builds"; \
		grep -E '^(replace|exclude)' go.mod; \
		exit 1; \
	fi
	${OPTS} goimports -w -local ${PROJECT_BASE} ./pkg ./cmd ./internal

format-windows: tidy ## Formats the code. Must have goimports installed (use make install-linters).
	powershell 'Get-ChildItem -Directory | where Name -NotMatch vendor | % { Get-ChildItem $$_ -Recurse -Include *.go } | % {goimports -w -local ${PROJECT_BASE} $$_ }'

dep: tidy ## Sorts dependencies
	${OPTS} go mod vendor -v

update-deps: ## Update all dependencies to latest versions (use 'make update-deps push-deps' to also commit and push)
	${OPTS} go get -v -u ./...
	${OPTS} go mod tidy -v
	${OPTS} go mod vendor -v
	@echo "Dependencies updated. Run 'make push-deps' to commit and push changes."

update-dmsg: ## Update dmsg to latest develop branch
	@echo "Updating dmsg to latest develop..."
	${OPTS} GOPROXY=direct go get -v github.com/skycoin/dmsg@develop
	${OPTS} go mod tidy -v
	${OPTS} go mod vendor -v
	@echo "dmsg updated successfully"

update-skycoin: ## Update skycoin to latest develop branch
	@echo "Updating skycoin to latest develop..."
	${OPTS} go get -v github.com/skycoin/skycoin@develop
	${OPTS} go mod tidy -v
	${OPTS} go mod vendor -v
	@echo "skycoin updated successfully"

push-deps: ## Commit and push dependency updates
	@echo "Committing dependency updates..."
	git add go.mod go.sum vendor
	git commit -m "Update dependencies"
	git push
	@echo "Dependencies pushed successfully"

example-apps: ## Build example apps
	${OPTS} go build ${BUILD_OPTS} -o $(BUILD_PATH)apps/ ./example/...

# Bin
bin: fix-systray-vendor bin-fix unfix-systray-vendor

bin-fix: ## Build `skywire`
	${OPTS} go build ${BUILD_OPTS} -o $(BUILD_PATH) .

fix-systray-vendor:
	@if [ $(UNAME_S) = "Linux" ]; then\
		sed -i '/go conn.handleCall(msg)/c\conn.handleCall(msg)' ./vendor/github.com/godbus/dbus/v5/conn.go ;\
	fi

unfix-systray-vendor:
	@if [ $(UNAME_S) = "Linux" ]; then\
		sed -i '/conn.handleCall(msg)/c\			go conn.handleCall(msg)' ./vendor/github.com/godbus/dbus/v5/conn.go ;\
	fi

build-windows: ## Build `skywire-visor`
	powershell '${OPTS} go build ${BUILD_OPTS} -o $(BUILD_PATH) ./cmd/skywire'

# Static Bin
build-static: ## Build `skywire-visor`, `skywire-cli`
	${STATIC_OPTS} go build -trimpath --ldflags '-linkmode external -extldflags "-static" -buildid=' -o $(BUILD_PATH) .

# Static Bin without Systray
build-static-wos: ## Build `skywire-visor`, `skywire-cli`
	${STATIC_OPTS} go build -tags withoutsystray -trimpath --ldflags '-linkmode external -extldflags "-static" -buildid=' -o $(BUILD_PATH)skywire-visor .

build-deploy: ## Build for deployment Docker images
	${OPTS} go build -tags netgo ${BUILD_OPTS_DEPLOY} -o /release/skywire .

build-race: ## Build for testing Docker images
	CGO_ENABLED=1 ${OPTS} go build -tags netgo ${BUILD_OPTS} -race -o /release/skywire .

dep-github-release:
	rm -rf musl-data
	mkdir -p musl-data
	go run github.com/melbahja/got/cmd/got@latest https://github.com/skycoin/skywire/releases/download/v1.3.29/aarch64-linux-musl-cross.tgz #https://more.musl.cc/10/x86_64-linux-musl/aarch64-linux-musl-cross.tgz
	tar -xzf aarch64-linux-musl-cross.tgz -C ./musl-data && rm aarch64-linux-musl-cross.tgz
	go run github.com/melbahja/got/cmd/got@latest https://github.com/skycoin/skywire/releases/download/v1.3.29/arm-linux-musleabi-cross.tgz #https://more.musl.cc/10/x86_64-linux-musl/arm-linux-musleabi-cross.tgz
	tar -xzf arm-linux-musleabi-cross.tgz -C ./musl-data && rm arm-linux-musleabi-cross.tgz
	go run github.com/melbahja/got/cmd/got@latest https://github.com/skycoin/skywire/releases/download/v1.3.29/arm-linux-musleabihf-cross.tgz #https://more.musl.cc/10/x86_64-linux-musl/arm-linux-musleabihf-cross.tgz
	tar -xzf arm-linux-musleabihf-cross.tgz -C ./musl-data && rm arm-linux-musleabihf-cross.tgz
	go run github.com/melbahja/got/cmd/got@latest https://github.com/skycoin/skywire/releases/download/v1.3.29/i686-linux-musl-cross.tgz #https://more.musl.cc/10/x86_64-linux-musl/x86_64-linux-musl-cross.tgz
	tar -xzf i686-linux-musl-cross.tgz -C ./musl-data && rm i686-linux-musl-cross.tgz
	go run github.com/melbahja/got/cmd/got@latest https://github.com/skycoin/skywire/releases/download/v1.3.29/riscv64-linux-musl-cross.tgz #https://more.musl.cc/10/x86_64-linux-musl/riscv64-linux-musl-cross.tgz
	tar -xzf riscv64-linux-musl-cross.tgz -C ./musl-data && rm riscv64-linux-musl-cross.tgz
	go run github.com/melbahja/got/cmd/got@latest https://github.com/skycoin/skywire/releases/download/v1.3.29/x86_64-linux-musl-cross.tgz #https://more.musl.cc/10/x86_64-linux-musl/i686-linux-musl-cross.tgz
	tar -xzf x86_64-linux-musl-cross.tgz -C ./musl-data && rm x86_64-linux-musl-cross.tgz
	# Build secp256k1 static libraries for each musl target
	./ci_scripts/build-secp256k1-musl.sh amd64 x86_64-linux-musl ./musl-data/x86_64-linux-musl-cross
	./ci_scripts/build-secp256k1-musl.sh arm64 aarch64-linux-musl ./musl-data/aarch64-linux-musl-cross
	./ci_scripts/build-secp256k1-musl.sh arm arm-linux-musleabi ./musl-data/arm-linux-musleabi-cross
	./ci_scripts/build-secp256k1-musl.sh armhf arm-linux-musleabihf ./musl-data/arm-linux-musleabihf-cross
	./ci_scripts/build-secp256k1-musl.sh 386 i686-linux-musl ./musl-data/i686-linux-musl-cross
	#./ci_scripts/build-secp256k1-musl.sh riscv64 riscv64-linux-musl ./musl-data/riscv64-linux-musl-cross
	# Build libusb static libraries for each musl target (for hardware wallet support)
	./ci_scripts/build-libusb-musl.sh amd64 x86_64-linux-musl ./musl-data/x86_64-linux-musl-cross
	./ci_scripts/build-libusb-musl.sh arm64 aarch64-linux-musl ./musl-data/aarch64-linux-musl-cross
	./ci_scripts/build-libusb-musl.sh arm arm-linux-musleabi ./musl-data/arm-linux-musleabi-cross
	./ci_scripts/build-libusb-musl.sh armhf arm-linux-musleabihf ./musl-data/arm-linux-musleabihf-cross
	#./ci_scripts/build-libusb-musl.sh 386 i686-linux-musl ./musl-data/i686-linux-musl-cross  # 386 uses stub, no libusb needed
	./ci_scripts/build-libusb-musl.sh riscv64 riscv64-linux-musl ./musl-data/riscv64-linux-musl-cross

build-docker: ## Build docker image (alias for docker-build)
	bash ./docker/docker_build.sh prod "" $(BUILD_ARCH)

.PHONY: check-ui check-onpush check-scss-imports bundle-wasm check-bundle-wasm

# Manager UI
install-deps-ui:  ## Install the UI dependencies
	cd $(MANAGER_UI_DIR) && npm ci

config: ## Create or regenerate a config with correct default app bin_path for `make build`
	$(BUILD_PATH)skywire-cli config gen -irx --binpath $(BUILD_PATH)apps

run: ## Run skywire visor with skywire-config.json, and start a browser if running a hypervisor
	$(BUILD_PATH)skywire-visor -bc ./skywire-config.json

## Prepare to run skywire from source, without compiling binaries
prepare:
	test -d apps && rm -r apps || true
	test -d build && rm -r build || true
	mkdir -p build || true
	ln ./scripts/skywire ./build/
	chmod +x ./build/*
	sudo echo "sudo cache"


run-source: prepare ## Run skywire from source, without compiling binaries
	${OPTS} go run ${BUILD_OPTS} . cli config gen -n | sudo ${OPTS} go run ${BUILD_OPTS} . visor -n || true

run-systray: prepare ## Run skywire from source, with vpn server enabled
	${OPTS} go run ${BUILD_OPTS} . cli config gen -n | sudo ${OPTS} go run ${BUILD_OPTS} . visor -n --systray || true

run-vpnsrv: prepare ## Run skywire from source, without compiling binaries
	${OPTS} go run ${BUILD_OPTS} . cli config gen -n --servevpn | sudo ${OPTS} go run ${BUILD_OPTS} . visor -n || true

run-source-dmsghttp: prepare ## Run skywire from source with dmsghttp config
	${OPTS} go run ${BUILD_OPTS} . cli config gen -dn | sudo ${OPTS} go run ${BUILD_OPTS} . visor -n || true

run-vpnsrv-dmsghttp: prepare ## Run skywire from source with dmsghttp config and vpn server
	${OPTS} go run ${BUILD_OPTS} . cli config gen -dn --servevpn | sudo ${OPTS} go run ${BUILD_OPTS} . visor -n || true

lint-ui:  ## Lint the UI code
	cd $(MANAGER_UI_DIR) && npm run lint

test-ui:  ## Run the hypervisor UI unit tests headless (needs Chrome; set CHROME_BIN if it isn't on PATH)
	cd $(MANAGER_UI_DIR) && npm run test-headless

build-ui: install-deps-ui  ## Builds the UI
	cd $(MANAGER_UI_DIR) && npm run build
	mkdir -p ${PWD}/bin
	rm -rf ${MANAGER_UI_BUILT_DIR}
	mkdir ${MANAGER_UI_BUILT_DIR}
	cp -r ${MANAGER_UI_DIR}/dist/. ${MANAGER_UI_BUILT_DIR}

check-descriptors: ## Fail if a Go file lacks a c<layer>-<domain>-<system> descriptor, or a package mixes two (docs/code-descriptors.md)
	bash scripts/check-descriptors.sh

check-dead-api-fields: ## Fail if a json-tagged API field is never assigned (always serializes as its zero value)
	bash scripts/check-dead-api-fields.sh

check-onpush:  ## Fail if an OnPush component has an unmarked asynchronous callback
	node ci-scripts/check-onpush-marks.js $(MANAGER_UI_DIR)/src

check-scss-imports:  ## Fail if a stylesheet other than styles.scss uses @import (the build silences that deprecation for Bootstrap 5 there)
	@bad=$$(grep -rnE '^[[:space:]]*@import' $(MANAGER_UI_DIR)/src --include='*.scss' --exclude-dir=skycoin-wallet | grep -vE '\.css["'\'']|url\(' | grep -v '^$(MANAGER_UI_DIR)/src/styles.scss:'); \
	if [ -n "$$bad" ]; then echo "Sass @import outside styles.scss (use @use):"; echo "$$bad"; exit 1; fi; echo "only styles.scss uses Sass @import."

check-ui: build-ui  ## Fail if the committed manager UI bundle is stale vs a fresh build
	@# pkg/visor/static is a build artifact committed to the repository and
	@# embedded in the visor, so a stale one ships an old UI from source that
	@# looks current. CI builds the UI already; this is what makes the build
	@# prove the committed copy matches.
	@git diff --quiet -- $(MANAGER_UI_BUILT_DIR) && git diff --quiet --cached -- $(MANAGER_UI_BUILT_DIR) \
		&& test -z "$$(git ls-files --others --exclude-standard -- $(MANAGER_UI_BUILT_DIR))" || { \
		echo "ERROR: the committed manager UI bundle is stale."; \
		echo "Run 'make build-ui' and commit the result."; \
		git --no-pager diff --stat -- $(MANAGER_UI_BUILT_DIR); \
		git ls-files --others --exclude-standard -- $(MANAGER_UI_BUILT_DIR); \
		exit 1; \
	}
	@echo "The committed manager UI bundle is up to date."

build-ui-windows: install-deps-ui ## Builds the UI on windows
	cd $(MANAGER_UI_DIR) && npm run build
	powershell 'Remove-Item -Recurse -Force -Path ${MANAGER_UI_BUILT_DIR}'
	powershell 'New-Item -Path ${MANAGER_UI_BUILT_DIR} -ItemType Directory'
	powershell 'Copy-Item -Recurse ${MANAGER_UI_DIR}\dist\* ${MANAGER_UI_BUILT_DIR}'

installer: mac-installer ## Builds MacOS installer for skywire-visor

mac-installer: ## Create unsigned and not-notarized application, run make mac-installer-help for more
	./scripts/mac_installer/create_installer.sh

mac-installer-help: ## Show installer creation help
	./scripts/mac_installer/create_installer.sh -h

# --match 'v[0-9]*': the latest tag overall can be a `mobile-vX.Y.Z` APK release,
# and this would then upload a macOS installer to the phone's release.
mac-installer-release: mac-installer ## Upload created signed and notarized applciation to github
	$(eval GITHUB_TAG=$(shell git describe --abbrev=0 --tags --match 'v[0-9]*'))
	gh release upload --repo skycoin/skywire ${GITHUB_TAG} ./skywire-installer-${GITHUB_TAG}-darwin-amd64.pkg
	gh release upload --repo skycoin/skywire ${GITHUB_TAG} ./skywire-installer-${GITHUB_TAG}-darwin-arm64.pkg

win-installer-latest: ## Build the windows .msi (installer) latest version
	@powershell '.\scripts\win_installer\script.ps1 latest amd64'
	@powershell '.\scripts\win_installer\script.ps1 latest 386'

win-installer: ## Build the windows .msi (installer) custom version
	@powershell '.\scripts\win_installer\script.ps1 $(CUSTOM_VERSION) amd64'
	@powershell '.\scripts\win_installer\script.ps1 $(CUSTOM_VERSION) 386'

# --match 'v[0-9]*': as in mac-installer-release — never resolve to a
# `mobile-vX.Y.Z` APK tag.
windows-installer-release:
	$(eval GITHUB_TAG=$(shell git describe --abbrev=0 --tags --match 'v[0-9]*'))
	make win-installer CUSTOM_VERSION=$(GITHUB_TAG)
	gh release upload --repo skycoin/skywire ${GITHUB_TAG} ./skywire-installer-${GITHUB_TAG}-windows-amd64.msi
	gh release upload --repo skycoin/skywire ${GITHUB_TAG} ./skywire-installer-${GITHUB_TAG}-windows-386.msi

# useful commands
#dmsghttp-update: ## update dmsghttp config
#	go run cmd/skywire/skywire.go cli config update dmsghttp -p dmsghttp-config.json

help: ## `make help` menu
	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'

help-windows: ## Display help for windows
	@powershell 'Select-String -Pattern "windows[a-zA-Z_-]*:.*## .*$$" $(MAKEFILE_LIST) | % { $$_.Line -split ":.*?## " -Join "`t:`t" } '

## : ## _ [E2E tests suite]

e2e-build: set-forwarding e2e-dock ## E2E. Set port forwarding & Build dockers and containers for e2e-tests

e2e-dock: ## E2E. Build dockers and containers for e2e-tests
	./docker/docker_build.sh e2e "" $(BUILD_ARCH)

e2e-run: ## E2E. Start e2e environment and wait for all health checks to pass
	@# Start services in stages to avoid overwhelming the CI runner.
	@# On a dual-core GitHub Actions runner, starting everything at
	@# once causes healthcheck timeouts because Go services are too
	@# slow to initialize when competing for CPU.
	@#
	@# visor-s is the deployment host: one visor that is also the dmsg
	@# server and runs every deployment service in its process under
	@# the service's own key, as the production hosts do. All services
	@# share one redis, each on its own logical DB.
	bash -c "DOCKER_TAG=e2e docker compose up -d --wait redis"
	bash -c "DOCKER_TAG=e2e docker compose up -d --wait visor-s || { echo '=== visor-s (deployment services) unhealthy — logs: ==='; docker compose logs --tail=200 visor-s; exit 1; }"
	bash -c "DOCKER_TAG=e2e docker compose up -d --wait visor-b || { echo '=== visor-b unhealthy — visor-s + visor-b logs: ==='; docker compose logs --tail=200 visor-s; docker compose logs --tail=120 visor-b; exit 1; }"
	bash -c "DOCKER_TAG=e2e docker compose up -d --wait visor-a visor-c || { echo '=== visor-a/visor-c unhealthy — logs: ==='; docker compose logs --tail=150 visor-a visor-c; exit 1; }"
	bash -c "DOCKER_TAG=e2e docker compose ps"

e2e-logs:
	bash -c "docker compose logs --tail=all --follow"

e2e-test:  ## E2E. Run e2e-tests suite in Docker. Prepare e2e environment with `make e2e-build && make e2e-run`
	DOCKER_TAG=e2e docker compose -f ${COMPOSE_FILE} run --rm \
		e2e-test \
		sh -c "go clean -testcache && go test -v -timeout=45m ./internal/integration"

e2e-test-local:  ## E2E. Run e2e-tests suite in Docker. Prepare e2e environment with `make e2e-build && make e2e-run`
	DOCKER_TAG=integration docker compose -f ${COMPOSE_FILE} run --rm \
		e2e-test \
		sh -c "go clean -testcache && go test -v -timeout=45m ./internal/integration"

e2e-config: ## E2E. Regenerate visor configs from template and deployment config
	@# skychat comes out as `--addr *:8001 --pair-enable` on its own:
	@# SKYCHATADDR in docker/integration/e2e.conf supplies the
	@# all-interfaces bind (the suite reaches http://visor-x:8001 across
	@# containers, and docker-compose publishes those ports to the host)
	@# and SKYCHATPAIR defaults on. It is still the in-process app — no
	@# "binary" key, bin_path is "./", so an external launch could not
	@# resolve one anyway — just one that also listens. This used to need
	@# a manual re-apply after every regeneration; it does not any more.
	@#
	@# --pty-rpc-exec is required by TestEnv_DmsgPtyExec: #3658 gated the
	@# RPC-initiated `cli pty exec` path behind pty.allow_rpc_exec, OFF by
	@# default. Every visor needs it, not just the hypervisor — the test's
	@# negative case drives visor-a as the CALLER to prove the remote's
	@# whitelist rejects it, and without the flag that call dies on the
	@# gate instead, which is a different (and untested) rejection.
	@echo "Regenerating E2E visor configs..."
	@# visor-A: skychat node with hypervisor set to visor-B
	SKYDEPLOY=docker/integration/services-config.json SKYENV=docker/integration/e2e.conf \
		go run . cli config gen -f --nofetch --sk 42bca4df2f3189b28872d40e6c61aacd5e85b8e91f8fea65780af27c142419e5 \
		-j 0348c941c5015a05c455ff238af2e57fb8f914c399aab604e9abb5b32b91a4c1fe \
		--pty-rpc-exec \
		-o docker/integration/visorA.json
	@# visor-B: hypervisor
	SKYDEPLOY=docker/integration/services-config.json SKYENV=docker/integration/e2e.conf \
		go run . cli config gen -f --nofetch --sk da4f48916e99aa3de794bffe1b5ecd465335e38b55457a9f78b411eb8585e36f \
		--pty-rpc-exec \
		-i -o docker/integration/visorB.json
	@# visor-C: skychat node with hypervisor set to visor-B
	SKYDEPLOY=docker/integration/services-config.json SKYENV=docker/integration/e2e.conf \
		go run . cli config gen -f --nofetch --sk 0e17cd505d81f998950e22864ae4692249124441bd9148b801f76f1595ac688f \
		-j 0348c941c5015a05c455ff238af2e57fb8f914c399aab604e9abb5b32b91a4c1fe \
		--pty-rpc-exec \
		-o docker/integration/visorC.json
	@# visor-S is the deployment host, as on prod: one visor that is also the
	@# dmsg server (dmsg.server.config_path keeps the server's own key) and runs
	@# every deployment service in its process under the service's own key
	@# (embedded_services). The blocks are in docker/integration/visorS.jq.
	SKYDEPLOY=docker/integration/services-config.json SKYENV=docker/integration/e2e.conf \
		go run . cli config gen -f --nofetch --sk e31d7e9cb497d8a39f211a5b012982a3546c7a3bdf50ed65fe6e8442a4297e5b \
		-o docker/integration/visorS.json
	jq --indent 2 -f docker/integration/visorS.jq docker/integration/visorS.json > docker/integration/visorS.json.tmp && mv docker/integration/visorS.json.tmp docker/integration/visorS.json
	@echo "E2E visor configs regenerated."
	@echo ""
	@echo "NOTE: skychat should read \"--addr *:8001 --pair-enable\" in"
	@echo "      docker/integration/visor{A,B,C}.json (from SKYCHATADDR in"
	@echo "      docker/integration/e2e.conf). If it does not, the e2e suite"
	@echo "      and the browser UIs cannot reach it — see make e2e-skychat."

e2e-skychat: ## E2E. Wire transports between all three visors and print the skychat UIs + PKs
	@# Manual/browser testing of the chat app against three real visors.
	@# Run after `make e2e-build && make e2e-run`.
	@#
	@# Every visor runs skychat in-process on container port 8001, published
	@# to the host by docker-compose on 8001/8002/8003 (127.0.0.1 only — the
	@# mic/camera and notification APIs need a secure context, which plain
	@# http only provides for localhost).
	@#
	@# The composer's default network is "skynet", which routes over a
	@# transport, so this pairs every visor with every other one. ("dmsg"
	@# needs none — it goes through the dmsg server — so if a transport
	@# fails you can still test by switching the composer's network select.)
	@set -e; \
	pk() { docker exec "$$1" /release/skywire cli visor --rpc localhost:3435 pk --json | tr -dc '0-9a-f'; }; \
	tp() { \
	  if docker exec "$$1" /release/skywire cli --rpc localhost:3435 tp add "$$2" --json >/dev/null 2>&1; then \
	    echo "  $$1 -> $$3  ok"; \
	  else \
	    echo "  $$1 -> $$3  not added (already present, or the pair is still settling)"; \
	  fi; }; \
	PKA=$$(pk visor-a); PKB=$$(pk visor-b); PKC=$$(pk visor-c); \
	for p in "$$PKA" "$$PKB" "$$PKC"; do \
	  if [ $${#p} -ne 66 ]; then \
	    echo "could not read a visor public key — is the environment up? (make e2e-build && make e2e-run)"; \
	    exit 1; \
	  fi; \
	done; \
	echo ""; \
	echo "Transports:"; \
	tp visor-a "$$PKB" visor-b; \
	tp visor-a "$$PKC" visor-c; \
	tp visor-b "$$PKC" visor-c; \
	echo ""; \
	echo "Open a skychat UI per visor, then add a peer by pasting its public key:"; \
	echo ""; \
	printf '  %-9s %-28s %s\n' visor-a "http://127.0.0.1:8001" "$$PKA"; \
	printf '  %-9s %-28s %s\n' visor-b "http://127.0.0.1:8002" "$$PKB"; \
	printf '  %-9s %-28s %s\n' visor-c "http://127.0.0.1:8003" "$$PKC"; \
	echo ""; \
	echo "  hypervisor (visor-b)  http://127.0.0.1:8000"; \
	echo ""

e2e-stop: ## E2E. Stop e2e environment without destroying it. Restart with `make e2e-run`
	bash -c "DOCKER_TAG=e2e docker compose -f ${COMPOSE_FILE} stop"
	bash -c "DOCKER_TAG=e2e docker compose -f ${COMPOSE_FILE} ps"
	-sudo ./ci_scripts/cleanup-ip-aliases.sh

e2e-clean: ## E2E. Stop e2e environment and clean everything. Restart only with `make e2e-build && make e2e-run`
	bash -c "DOCKER_TAG=e2e docker compose -f ${COMPOSE_FILE} down"
	bash ./docker/docker_clean.sh e2e
	-sudo ./ci_scripts/cleanup-ip-aliases.sh

e2e-help: ## E2E. Show env-vars and useful commands
	@echo -e "\nNow you can use docker compose:\n"
	@echo -e "   docker compose ps/top/logs"
	@echo -e "   docker compose up/down/start/stop"
	@echo -e "\nConsult with:\n\n   docker compose help\n"

docker-build-test:
	bash ./docker/docker_build.sh test "" $(BUILD_ARCH)

docker-build:
	bash ./docker/docker_build.sh prod "" $(BUILD_ARCH)

docker-push-test:
	bash ./docker/docker_build.sh test "" $(BUILD_ARCH)
	bash ./docker/docker_push.sh test

docker-push:
	bash ./docker/docker_build.sh prod "" $(BUILD_ARCH)
	bash ./docker/docker_push.sh prod

set-forwarding: #sudo ./ci_scripts/setup-sudo-requirements.sh
	sudo ./ci_scripts/setup-sudo-requirements.sh

#reset-forwarding:
	# If you need to disable forwarding, run:
	#   sudo sysctl -w net.ipv4.ip_forward=0
	#   sudo sysctl -w net.ipv6.conf.all.forwarding=0

integration-env-build: #build
	./docker/docker_build.sh integration "" $(BUILD_ARCH)
	bash -c "DOCKER_TAG=integration docker compose up -d"

integration-env-start: #start
	bash -c "DOCKER_TAG=integration docker compose up -d"

integration-env-stop: #stop
	bash -c "DOCKER_TAG=integration docker compose -f ${COMPOSE_FILE} stop"

integration-env-clean: #clean
	bash -c "DOCKER_TAG=integration docker compose -f ${COMPOSE_FILE} down"
	bash ./docker/docker_clean.sh integration

update-dep: update-deps ## Alias for update-deps

## Sync local develop branch with upstream skycoin/skywire develop.
## Requires: origin = your fork, upstream = skycoin/skywire
sync-upstream-develop: #sync develop branch with upstream develop branch for forks
	@normalize() { \
		echo "$$1" | sed \
			-e 's|git@github.com:|https://github.com/|' \
			-e 's|\.git$$||' \
			-e 's|https://github.com/||' \
			| tr '[:upper:]' '[:lower:]'; \
	}; \
	# --- check upstream points to skycoin/skywire --- \
	UPSTREAM_URL=$$(git remote get-url upstream 2>/dev/null); \
	if [ -z "$$UPSTREAM_URL" ]; then \
		echo "[error] no 'upstream' remote found. Add it with:"; \
		echo "  git remote add upstream https://github.com/skycoin/skywire.git"; \
		exit 1; \
	fi; \
	UPSTREAM_NORM=$$(normalize "$$UPSTREAM_URL"); \
	if [ "$$UPSTREAM_NORM" != "skycoin/skywire" ]; then \
		echo "[error] upstream remote does not point to skycoin/skywire."; \
		echo "  Found: $$UPSTREAM_URL"; \
		exit 1; \
	fi; \
	# --- check origin is NOT skycoin/skywire (must be a fork) --- \
	ORIGIN_URL=$$(git remote get-url origin 2>/dev/null); \
	if [ -z "$$ORIGIN_URL" ]; then \
		echo "[error] no 'origin' remote found."; \
		exit 1; \
	fi; \
	ORIGIN_NORM=$$(normalize "$$ORIGIN_URL"); \
	if [ "$$ORIGIN_NORM" = "skycoin/skywire" ]; then \
		echo "[error] origin points to skycoin/skywire directly."; \
		echo "  This target must be run from a fork, not a clone of the canonical repo."; \
		exit 1; \
	fi; \
	echo "[ok] origin is a fork ($$ORIGIN_NORM), upstream is skycoin/skywire — syncing develop..."; \
	git checkout develop && \
	git pull && \
	git fetch upstream && \
	git merge upstream/develop && \
	git push

playground: ## Build the docs-site playground (static desk page: shell + skywire commands + nested browser, NO auto-started visor) into build/playground
	mkdir -p ./build/playground
	GOOS=js GOARCH=wasm go build -buildvcs=true -tags "withoutsystray withoutgotop" -trimpath -ldflags="-s -w" -o ./build/playground/skywire.wasm .
	gzip -9 -n -f ./build/playground/skywire.wasm
	cp "$$(go env GOROOT)/lib/wasm/wasm_exec.js" ./build/playground/
	go run ./scripts/stage-playground ./build/playground
	cp ./docs/playground/index.html ./docs/playground/favicon.ico ./build/playground/
	@echo "built ./build/playground — serve it statically to test (any static file server)"

# --- one wasm module (#4484 convergence) --------------------------------------
# The full skywire command module for GOOS=js: the desk's `skywire` command and
# the tab visor. It is not embedded; a visor serves the copy beside its binary.
EXEC_WASM_TAGS ?= withoutsystray withoutgotop

exec-wasm: ## Build the js/wasm command module to build/exec-wasm/skywire.wasm
	mkdir -p ./build/exec-wasm
	GOOS=js GOARCH=wasm go build -trimpath -buildvcs=true -mod=vendor -tags "$(EXEC_WASM_TAGS)" -ldflags="-s -w" -o ./build/exec-wasm/skywire.wasm .
	@ls -la ./build/exec-wasm/skywire.wasm

wasm-module: exec-wasm ## Put the js/wasm command module and its manifest beside ./skywire
	sh ./scripts/wasm-module.sh ./build/exec-wasm/skywire.wasm . dev