SQLTriage.csproj

<Project Sdk="Microsoft.NET.Sdk.Razor">

  <!-- Community Edition build gating: -p:SQLTriageProfile=community excludes gated modules
       per buildprofile.json. Default is the full/dev superset (no effect). -->
  <Import Project="buildprofile.targets" />

  <PropertyGroup>
    <!-- net8 dropped 2026-06-10 in favour of net10 (LTS). Self-contained single-file publish
         bundles the runtime, so clients need nothing pre-installed regardless of target. -->
    <TargetFramework>net10.0-windows</TargetFramework>
    <OutputType>WinExe</OutputType>
    <UseWPF>true</UseWPF>
    <!--<UseWindowsForms>true</UseWindowsForms> will get namespace issues when false-->
    <UseWindowsForms>true</UseWindowsForms>
    <DefaultItemExcludes>$(DefaultItemExcludes);tools\**;PerformanceMonitor-main\**;PerformanceMonitor_db\**;Tests\**;BenchmarkSuite1\**;Data\DashboardPreloaderService.cs;Data\OptimizedDashboardLoader.cs;publish\**;release\**;lib\**;BPScripts\\Ignore\\*\\*;SQLTriage-RAG-Builder\\*\\***;corpus\**;rag.db</DefaultItemExcludes>
    <NoWarn>$(NoWarn);CS0169;CS0414;BL0007</NoWarn>
    <RootNamespace>SQLTriage</RootNamespace>
    <AssemblyName>SQLTriage</AssemblyName>
    <Product>SQLTriage</Product>
    <Nullable>enable</Nullable>
    <ImplicitUsings>enable</ImplicitUsings>
    <PlatformTarget>x64</PlatformTarget>
    <PublishSingleFile>false</PublishSingleFile>
    <Platforms>AnyCPU;x64</Platforms>
    <!-- Only include English satellite resource assemblies � prevents NuGet packages from copying 14+ language folders -->
    <SatelliteResourceLanguages>en</SatelliteResourceLanguages>
    <ApplicationIcon>SQLTriage.ico</ApplicationIcon>
    <ApplicationManifest>app.manifest</ApplicationManifest>
    <Title>SQLTriage</Title>
    <Authors>Adrian Sullivan</Authors>
    <Description>An Enterprise grade SQL health check assessment tool. This tool will generate diagnostic outputs for a comprehensive SQL health audit. Incorporating SQLWATCH for database metrics.</Description>
    <Copyright>Adrian Sullivan</Copyright>
    <PackageProjectUrl>https://github.com/SQLAdrian/SQLTriage</PackageProjectUrl>
    <PackageIcon>SQLTriage.png</PackageIcon>
    <RepositoryUrl>https://github.com/SQLAdrian/SQLTriage</RepositoryUrl>
    <RepositoryType>git</RepositoryType>
    <!-- Desktop footprint: Workstation GC, NOT Server GC. Server GC allocates one managed
         heap + one background GC thread per logical core (22 on this CPU) and holds memory
         aggressively for throughput we don't need on an I/O-bound desktop app — it inflates
         idle working set by 100-200MB. Workstation GC = single heap, returns memory to the OS.
         Concurrent kept so background collection stays UI-responsive.
         To A/B compare without rebuilding: launch with env var DOTNET_gcServer=1 (Server) vs 0. -->
    <ServerGarbageCollection>false</ServerGarbageCollection>
    <ConcurrentGarbageCollection>true</ConcurrentGarbageCollection>
    <!-- Windows-only: Exclude non-Windows runtimes -->
    <RuntimeIdentifier>win-x64</RuntimeIdentifier>
    <!-- Disable Blazor hot-reload to suppress _wpftmp.csproj side-project generation -->
    <RazorHotReload>false</RazorHotReload>
    <!-- Work around _wpftmp.csproj Razor source generator NullReferenceException.
         The WPF temp project cannot run the Razor source generator; skip Razor compilation
         for the temp project only. The main project handles Razor normally. -->
    <EnableDefaultRazorGenerateItems Condition="$(MSBuildProjectFile.Contains('_wpftmp'))">false</EnableDefaultRazorGenerateItems>
    <!-- Suppress duplicate AssemblyInfo attributes in the WPF hot-reload temp project -->
    <GenerateAssemblyInfo Condition="$(MSBuildProjectFile.Contains('_wpftmp'))">false</GenerateAssemblyInfo>
    <GenerateTargetFrameworkAttribute Condition="$(MSBuildProjectFile.Contains('_wpftmp'))">false</GenerateTargetFrameworkAttribute>
    <!-- Specify entry point for WPF temp project to avoid CS0017 -->
    <StartupObject Condition="$(MSBuildProjectFile.Contains('_wpftmp'))">SQLTriage.Program</StartupObject>
    <!-- Suppress Razor compilation in the WPF hot-reload temp project -->
    <RazorCompileOnBuild Condition="$(MSBuildProjectFile.Contains('_wpftmp'))">false</RazorCompileOnBuild>
    <RazorCompileOnPublish Condition="$(MSBuildProjectFile.Contains('_wpftmp'))">false</RazorCompileOnPublish>
    <!-- Suppress the Razor SDK's duplicate AssemblyInfo generation � standard .NET SDK handles this -->
    <GenerateRazorTargetAssemblyInfo>false</GenerateRazorTargetAssemblyInfo>
    <!-- Custom entry point: Program.Main handles both WPF and service modes -->
    <StartupObject Condition="!$(MSBuildProjectFile.Contains('_wpftmp'))">SQLTriage.Program</StartupObject>
    <!-- Supply-chain: reproducible builds + lock file -->
    <Deterministic>true</Deterministic>
    <ContinuousIntegrationBuild Condition="'$(CI)' == 'true'">true</ContinuousIntegrationBuild>
    <EmbedAllSources>true</EmbedAllSources>
    <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
  </PropertyGroup>

  <!-- ASP.NET Core framework for Blazor Server mode (Kestrel, SignalR) -->
  <ItemGroup>
    <FrameworkReference Include="Microsoft.AspNetCore.App" />
  </ItemGroup>

  <!-- ══ blazor.web.js: the file that made server mode a dead UI ════════════════════════════
       Components/ServerApp.razor loads _framework/blazor.web.js. Nothing in this project ever
       produced that file, so it 404'd, window.Blazor stayed undefined, and every control in
       headless/server mode was inert. That is the lane clients run on a locked-down box.
       PROVEN 2026-07-20, not assumed: a fresh self-contained Release publish had no wwwroot/
       _framework directory at all, and the running published exe returned 404 for
       /_framework/blazor.web.js while /themes.js returned 200 (control — the probe could fail).
       Dropping this one file into the published wwwroot took /_blazor from dead to a connected
       WebSocket circuit.

       Why it was missing: blazor.web.js ships in Microsoft.AspNetCore.App.Internal.Assets,
       which the Web SDK references implicitly. That package's own targets gate the asset on
       '$(UsingMicrosoftNETSdkWeb)' == 'true' AND '$(OutputType)' == 'Exe'. This project is
       Microsoft.NET.Sdk.Razor + WinExe (a WPF app that also self-hosts Kestrel), so BOTH gates
       fail and the file is never emitted. Referencing the package alone does not fix it.

       So: take the package for its path only (ExcludeAssets=all keeps its gated targets inert)
       and let wwwroot/_framework/blazor.web.js ride the same discovery pipeline as themes.js.

       ⚠ wwwroot/_framework/blazor.web.js IS COMMITTED ON PURPOSE. Do not delete it and assume
       the target below regenerates it. MSBuild expands the SDK's wwwroot/** glob at EVALUATION,
       before any target executes, so a file a target creates during the build is not in Content
       for THAT build — it is only picked up by the NEXT one. Measured 2026-07-20: with the file
       absent at evaluation, blazor.web.js appeared 0 times in staticwebassets.build.json and
       never reached publish/win-x64/wwwroot; with it present, 1. A staging-target-only fix
       therefore produces a working second build and a BROKEN first build from a clean clone —
       which is the failure that would actually reach a client.

       The target below is a refresher and a guard, not the delivery mechanism: it re-copies from
       the pinned package so a version bump shows up as a reviewable git diff instead of silent
       drift, and it hard-fails if the package is missing rather than leaving a runtime 404. ══ -->
  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore.App.Internal.Assets" Version="10.0.9"
                      GeneratePathProperty="true" ExcludeAssets="all" PrivateAssets="all" />
  </ItemGroup>

  <Target Name="StageBlazorWebJs" BeforeTargets="ResolveStaticWebAssetsInputs"
          Condition="!$(MSBuildProjectFile.Contains('_wpftmp'))">
    <Error Condition="!Exists('$(PkgMicrosoft_AspNetCore_App_Internal_Assets)\_framework\blazor.web.js')"
           Text="blazor.web.js not found under '$(PkgMicrosoft_AspNetCore_App_Internal_Assets)'. Without it server mode renders a dead UI, so this is a hard failure rather than a silent 404 at runtime." />
    <Copy SourceFiles="$(PkgMicrosoft_AspNetCore_App_Internal_Assets)\_framework\blazor.web.js"
          DestinationFolder="$(MSBuildProjectDirectory)\wwwroot\_framework"
          SkipUnchangedFiles="true" />
  </Target>

  <!-- Exclude orphaned scratch projects and research artefacts from compilation -->
  <ItemGroup>
    <Compile Remove="CheckValidator\**" />
    <Content Remove="CheckValidator\**" />
    <EmbeddedResource Remove="CheckValidator\**" />
    <None Remove="CheckValidator\**" />
    <Compile Remove="CheckMerger\**" />
    <Content Remove="CheckMerger\**" />
    <EmbeddedResource Remove="CheckMerger\**" />
    <None Remove="CheckMerger\**" />
    <!-- research_output: never built, tested, published, or copied to bin -->
    <Compile Remove="research_output\**" />
    <Content Remove="research_output\**" />
    <EmbeddedResource Remove="research_output\**" />
    <None Remove="research_output\**" />
    <Compile Remove="research_logs\**" />
    <Content Remove="research_logs\**" />
    <EmbeddedResource Remove="research_logs\**" />
    <None Remove="research_logs\**" />
    <Compile Remove="DdgTest\**" />
    <Content Remove="DdgTest\**" />
    <EmbeddedResource Remove="DdgTest\**" />
    <None Remove="DdgTest\**" />
  </ItemGroup>

  <!-- L1: CC7.2 / SI-7 — SBOM generation (Release only) -->
  <!-- Writes bin/<config>/sbom.json listing all direct + transitive packages. -->
  <!-- No new package dependency: uses the dotnet CLI already on PATH. -->
  <Target Name="GenerateSbom" AfterTargets="Build" Condition="'$(Configuration)' == 'Release' AND !$(MSBuildProjectFile.Contains('_wpftmp'))">
    <!-- .NET 10 SDK removed the "output" flag from `dotnet list package`; JSON goes to stdout now, so redirect. -->
    <Exec Command="dotnet list &quot;$(MSBuildProjectFullPath)&quot; package --include-transitive --format json &gt; &quot;$(OutputPath)sbom.json&quot;" ContinueOnError="true" />
    <Message Text="[SBOM] Written to $(OutputPath)sbom.json" Importance="high" />
  </Target>

  <!-- The author commissioned an adversarial self-assessment (Pages/About.razor) sealed with a
       SHA-256, and asked to be held to it on every build. This gate fails the build if the text
       is edited. Skips wpftmp temp projects. -->
  <Target Name="VerifyAuthorChecksum" BeforeTargets="Build" Condition="!$(MSBuildProjectFile.Contains('_wpftmp'))">
    <Exec Command="powershell -NoProfile -ExecutionPolicy Bypass -File &quot;$(MSBuildProjectDirectory)\build\verify-author-checksum.ps1&quot; -AboutRazorPath &quot;$(MSBuildProjectDirectory)\Pages\About.razor&quot;" />
  </Target>

  <!-- Release Build Optimizations -->
  <PropertyGroup Condition="'$(Configuration)' == 'Release'">
    <PublishReadyToRun>true</PublishReadyToRun>
    <PublishReadyToRunShowWarnings>true</PublishReadyToRunShowWarnings>
    <DebugType>embedded</DebugType>
    <DebugSymbols>true</DebugSymbols>
    <Optimize>true</Optimize>
    <SelfContained>true</SelfContained>
    <PublishSingleFile>true</PublishSingleFile>
    <IncludeNativeLibrariesForSelfExtract>true</IncludeNativeLibrariesForSelfExtract>
    <EnableCompressionInSingleFile>true</EnableCompressionInSingleFile>
    <!-- Was trimmed false, trying on true for smaller footprint, fails on winforms and runtimeidentifierinference... so perhaps not worth it-->
    <PublishTrimmed>false</PublishTrimmed>
  </PropertyGroup>

  <ItemGroup>
    <Content Remove="SqlWatch.Monitor\**" />
    <Content Remove="PerformanceMonitor-main\**" />
  </ItemGroup>

  <ItemGroup>
    <Compile Remove="SqlWatch.Monitor\**" />
    <Compile Remove="Tests\**" />
    <Compile Remove="BenchmarkSuite1\**" />
    <Compile Remove="Release\**" />
    <Compile Remove="PerformanceMonitor-main\**" />
    <Compile Remove="Config\Ignore\**" />
    <Compile Remove="Data\Services\Analysis\**" />
    <EmbeddedResource Remove="SqlWatch.Monitor\**" />
    <EmbeddedResource Remove="Tests\**" />
    <EmbeddedResource Remove="BenchmarkSuite1\**" />
    <EmbeddedResource Remove="Release\**" />
    <EmbeddedResource Remove="PerformanceMonitor-main\**" />
    <None Remove="SqlWatch.Monitor\**" />
    <None Remove="Tests\**" />
    <None Remove="BenchmarkSuite1\**" />
    <None Remove="Release\**" />
    <None Remove="PerformanceMonitor-main\**" />
  </ItemGroup>

  <!-- Include Deploy folder in publish output for database scripts.
       UNBUNDLED 2026-07-21 (client safety): the two collector installers are excluded.
       Deploy\PerformanceMonitor_db\** (67 files) and Deploy\SQLWATCH_db\** (5 files, incl.
       the DACPACs) were shipped into every build and publish output by the unconditional
       glob below. Nothing in the app reads them any more — PMInstallationService and
       SqlWatchDeploymentService were the only consumers and both are deleted — so they were
       pure payload: 2.2 MB of ready-to-run installer SQL sitting on a client's server next
       to a page of instructions telling them how to run it by hand.
       Removing the UI button but still shipping the scripts would leave the manual install
       path fully intact, so the exclusion is part of the same safety change.
       The source files remain in the repo (git history + working tree) so an opt-in path
       could be rebuilt deliberately; they simply never reach a build output again.
       See RouteConstants.cs "Deployment". -->
  <ItemGroup>
    <Content Include="Deploy\**"
             Exclude="Deploy\PerformanceMonitor_db\**;Deploy\SQLWATCH_db\**"
             CopyToOutputDirectory="PreserveNewest" CopyToPublishDirectory="PreserveNewest" />
    <!-- Ship the licence so end users + auditors can see it. Per-app DefaultGroupName
         in Inno Setup also picks it up via .iss [Files]. -->
    <Content Include="LICENSE.txt" CopyToOutputDirectory="PreserveNewest" CopyToPublishDirectory="PreserveNewest" />
    <!-- Config\*.json files are auto-included by the SDK (Config is not in DefaultItemExcludes).
         TargetPath for each is set via Content Update entries below. -->
    <Content Remove="Config\Ignore\**" />
    <Content Remove="Config\*.backup" />
    <Content Remove="Config\*.backup_*" />
    <!-- Stale bundle backup — never ship (the live free-bundle.dat is the product). -->
    <Content Remove="Config\free-bundle.dat.bak" />
    <Content Remove="Config\*.dat.bak" />
    <!-- examples/ is dev-only (no runtime reader; carries internal .claude agent docs). Never ship. -->
    <Content Remove="examples\**" />
    <None Remove="examples\**" />
    <!-- Curation / research artefacts — keep in repo for tooling, never ship. -->
    <Content Remove="Config\consolidation-model*.json" />
    <Content Remove="Config\code_enhanced_final_validated.json" />
    <Content Remove="Config\control_mappings_lookup.md" />
    <Content Remove="Config\sql-checks-final.json" />
    <Content Remove="Config\sql-checks-merged.json" />
    <Content Remove="Config\sql-checks-voice-rewrite.json" />
    <Content Remove="Config\sql-checks-voice-rewrite-v2.json" />
    <Content Remove="Config\sql-checks-with-narrative.json" />
    <!-- Stray Python tooling outputs at repo root — must not ship in publish. -->
    <Content Remove="measurement_*.json" />
    <None Remove="measurement_*.json" />

    <!-- SoD Permissions Matrix preferred-state baseline SAMPLE (slice 2). A commented schema
         reference for the paid-only SoD engine — a dev/consultant artefact, NOT an app asset. Its
         .jsonc extension already keeps it out of the SDK's **/*.json Content glob, and the whole
         Data\Services\AccessSurface\ folder is denied from the public mirror (.publicignore); this
         explicit Remove is the belt-and-braces so it can never ship in any build (community OR full). -->
    <Content Remove="Data\Services\AccessSurface\sample-preferred-baseline.jsonc" />
    <None Remove="Data\Services\AccessSurface\sample-preferred-baseline.jsonc" />

    <!-- Gated Config files — never ship plaintext. Loaded at runtime from the encrypted bundle via IBundleAccessor. -->
    <Content Remove="Config\control_mappings.json" />
    <None Remove="Config\control_mappings.json" />
    <Content Remove="Config\governance-weights.json" />
    <None Remove="Config\governance-weights.json" />
    <Content Remove="Config\queries.json" />
    <None Remove="Config\queries.json" />
    <Content Remove="Config\ruleset.json" />
    <None Remove="Config\ruleset.json" />
    <Content Remove="Config\error-catalog.json" />
    <None Remove="Config\error-catalog.json" />
    <Content Remove="Config\roadmap-mapping.json" />
    <None Remove="Config\roadmap-mapping.json" />
    <Content Remove="Config\roadmap-aliases.json" />
    <None Remove="Config\roadmap-aliases.json" />
    <Content Remove="Config\sql-build-catalogue.json" />
    <None Remove="Config\sql-build-catalogue.json" />
    <Content Remove="Config\sql-licensing-pricing.json" />
    <None Remove="Config\sql-licensing-pricing.json" />

    <!-- Dev-only / unused configs — not installed, not needed at runtime. -->
    <Content Remove="Config\appsettings.Development.json" />
    <None Remove="Config\appsettings.Development.json" />
    <Content Remove="Config\dashboard-config.default.json" />
    <None Remove="Config\dashboard-config.default.json" />

    <!-- Defence-in-depth: corpus directory and rag.db must never reach publish. -->
    <!-- DefaultItemExcludes above handles the MSBuild glob sweep; these are explicit safety nets. -->
    <Content Remove="corpus\**" />
    <None Remove="corpus\**" />
    <Content Remove="rag.db" />
    <None Remove="rag.db" />

    <!-- Free-tier bundle — shipped plaintext in installer. No key required. -->
    <!-- Condition: file may be absent in dev (CI generates it). Dev build proceeds; publish enforced below.
         CopyToOutputDirectory too (was publish-only) so dev/Debug runs find the Free bundle
         next to the exe — without it, dev builds boot "NOT ACTIVATED" with an empty catalog. -->
    <Content Include="Config\free-bundle.dat" CopyToOutputDirectory="PreserveNewest" CopyToPublishDirectory="PreserveNewest" Condition="Exists('Config\free-bundle.dat')" />
  </ItemGroup>

  <ItemGroup>
    <PackageReference Include="MailKit" Version="4.16.0" />
    <PackageReference Include="Markdig" Version="1.2.0" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.Google" Version="8.0.*" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.MicrosoftAccount" Version="8.0.*" />
    <!-- Windows (Negotiate) auth for server mode: local SAM + domain accounts. Pinned to the
         10.0 band to match the net10.0 shared framework rather than copying the 8.0 OAuth pins. -->
    <PackageReference Include="Microsoft.AspNetCore.Authentication.Negotiate" Version="10.0.*" />
    <PackageReference Include="Microsoft.AspNetCore.Components.WebView.Wpf" Version="8.0.*" />
    <PackageReference Include="Microsoft.SqlServer.DacFx" Version="162.*" />
    <PackageReference Include="Blazor-ApexCharts" Version="3.*" />
    <PackageReference Include="Radzen.Blazor" Version="5.*" />
    <PackageReference Include="Microsoft.Data.SqlClient" Version="6.*" />
    <PackageReference Include="Microsoft.SqlServer.Management.Assessment" Version="1.*" />
    <PackageReference Include="Microsoft.SqlServer.SqlManagementObjects" Version="172.*" />

    <!-- Pinned EXACT (2026-08-12, was 8.0.*): the cipher stack is version-coherence-sensitive.
         When a lock regeneration floated the test graph to SQLitePCLRaw.core 2.1.12 against
         provider.e_sqlcipher 2.1.10, bundle init silently fell back to the unencrypted
         e_sqlite3 provider and every SqliteCipherReinitTests store came back Plaintext (CI run
         31580506025). 8.0.29 is what the shipped lock already resolves, so this pin changes
         nothing in the product; it stops the outside world changing the resolution. Bump it
         DELIBERATELY, together with bundle_e_sqlcipher below, and run SqliteCipherReinitTests. -->
    <PackageReference Include="Microsoft.Data.Sqlite" Version="8.0.29">
      <ExcludeAssets>runtimes</ExcludeAssets>
    </PackageReference>
    <!-- SQLCipher native provider — replaces the default SQLite3 bundle with an encrypted one.
         Microsoft.Data.Sqlite API surface is unchanged; only the native library swaps. -->
    <PackageReference Include="SQLitePCLRaw.bundle_e_sqlcipher" Version="2.1.10" />
    <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="8.0.*" />
    <PackageReference Include="Microsoft.Extensions.DependencyInjection" Version="8.0.*" />
    <PackageReference Include="Polly" Version="8.4.2" />
    <PackageReference Include="Serilog" Version="4.*" />
    <PackageReference Include="Serilog.Extensions.Logging" Version="8.*" />
    <PackageReference Include="Serilog.Sinks.File" Version="6.*" />
    <PackageReference Include="Serilog.Sinks.Console" Version="6.*" />
    <PackageReference Include="Microsoft.Extensions.Hosting.WindowsServices" Version="8.0.*" />
    <PackageReference Include="Azure.Storage.Blobs" Version="12.*" />
    <PackageReference Include="QuestPDF" Version="2024.10.4" />
    <!-- Donut/ring charts in PDFs are rendered to PNG via SkiaSharp, then embedded as images
         (QuestPDF 2024 bundles its own internal Skia and exposes no public SkiaSharp surface). -->
    <PackageReference Include="SkiaSharp" Version="2.88.8" />
    <PackageReference Include="Konscious.Security.Cryptography.Argon2" Version="1.3.1" />
    <PackageReference Include="YamlDotNet" Version="16.*" /> <!-- B2 source parser (#27 v3) -->
    <PackageReference Include="System.DirectoryServices" Version="10.0.*" /> <!-- Dig Deeper: AD SPN enumeration (Windows-only) -->


  </ItemGroup>

  <!-- D2 Phase B: standalone DevBridge loopback library lifted to sibling repo.
       Local ProjectReference until Phase C publishes the NuGet package.
       The sibling repo is cloned next to SQLTriage-dev; CI must do the same.
       COMMUNITY builds exclude it (DevBridge sources are Compile-Removed by
       buildprofile.targets, and the public repo has neither the sibling repo
       nor the DevBridge sources — the rebuild gate proved this 2026-06-12). -->
  <ItemGroup Condition="'$(SQLTriageProfile)' != 'community'">
    <ProjectReference Include="..\sqltriage-mcp\src\BlazorHybridBridge\BlazorHybridBridge.csproj" />
  </ItemGroup>

  <!-- Read-only MCP surface (Mcp/): internal-only per D2. The SDK is referenced for
       full/dev builds only; community Compile-Removes the Mcp/ sources (buildprofile.targets)
       and the DI callsite is fenced behind #if ENABLE_MCP (opt-in, off in all shipped
       profiles), so the package is unused there. -->
  <ItemGroup Condition="'$(SQLTriageProfile)' != 'community'">
    <PackageReference Include="ModelContextProtocol" Version="1.4.0" /> <!-- abstractions-only deps -->
  </ItemGroup>

  <ItemGroup>
    <!-- ruleset.json is a gated file — handled by Content Remove above; no Update entry needed. -->
    <!-- sql-checks.json was retired in commit 100965c and fully removed 2026-05-26 (D5). -->
    <Content Update="Config\script-configurations.json">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
      <TargetPath>config/script-configurations.json</TargetPath>
    </Content>
    <Content Update="Config\user-settings.json">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
      <TargetPath>config/user-settings.json</TargetPath>
    </Content>
    <Content Update="Config\alert-definitions.json">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
      <TargetPath>config/alert-definitions.json</TargetPath>
    </Content>
    <Content Update="Config\scheduled-tasks.json">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
      <TargetPath>config/scheduled-tasks.json</TargetPath>
    </Content>
    <Content Update="Config\appsettings.json">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
      <TargetPath>config/appsettings.json</TargetPath>
    </Content>
    <Content Update="Config\appsettings.Production.json">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
      <TargetPath>config/appsettings.Production.json</TargetPath>
    </Content>
    <!-- appsettings.Development.json is dev-only — handled by Content Remove above; no Update entry needed. -->
    <Content Update="Config\version.json">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
      <TargetPath>config/version.json</TargetPath>
    </Content>
    <Content Update="Config\dashboard-config.json">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
      <TargetPath>config/dashboard-config.json</TargetPath>
    </Content>

  </ItemGroup>

  <ItemGroup>
    <Content Include="SQLTriage.ico" CopyToOutputDirectory="PreserveNewest" />
    <!-- Canonical S-mark tile (green-on-ink, 512px) rendered into client-facing PDF reports.
         Loaded at render time from AppContext.BaseDirectory\Assets\brand\; the QuestPDF builders
         fall back to the ⛁ glyph if it is absent, so a missing asset never breaks a report. -->
    <Content Include="Assets\brand\sqltriage-mark.png" CopyToOutputDirectory="PreserveNewest" CopyToPublishDirectory="PreserveNewest" />
  </ItemGroup>

  <!-- ── Export Pack identity manifest (E3 verify MUST-FIX #1) ─────────────────────────────
       identity_manifest.sql is what the export lane runs against the selected instance to get
       the instance's OWN declaration of every real name it knows, so the tokenizer replaces
       from an authoritative list instead of guessing. Until this line it lived ONLY in the
       sibling sqltriage-meta checkout, resolved through MetaRepoPath / SQLTRIAGE_META_REPO —
       so on a normal install (and on a client's production box, which has no such checkout)
       every Run refused. Same reason R1b moved the canonical kernel into the app: a client
       box cannot be asked to hold a private repo.

       The SOURCE sits under Data\Services\Portal\Export\ so the existing portal denies cover
       it (.handoff\.publicignore Data/Services/Portal/), and the Include is conditioned on
       the SAME property that Compile-Removes that whole tree — a community build carries
       neither the code that reads it nor the file. Condition is written here rather than as a
       Content Remove in buildprofile.targets because that file is imported at the TOP of this
       one, so a Remove there cannot see an Include added below it.

       It ships as scripts\identity_manifest.sql, beside the other SQL the app runs
       (sp_Blitz.sql, SQLDBA.ORG.sp_triage.sql). Read-only; it changes no state.

       The Exists() guard is the same one Config\free-bundle.dat carries: the public mirror is
       published WITHOUT this tree (.publicignore), and a literal Content Include of a file that
       is not there fails the copy step rather than evaluating away. A build that needs the file
       and lacks it is caught by ExportPackCompositionTests, not by an MSBuild error. -->
  <ItemGroup Condition="'$(SQLTExcludePortal)' != 'true' And Exists('Data\Services\Portal\Export\identity_manifest.sql')">
    <None Remove="Data\Services\Portal\Export\identity_manifest.sql" />
    <Content Include="Data\Services\Portal\Export\identity_manifest.sql">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
      <CopyToPublishDirectory>PreserveNewest</CopyToPublishDirectory>
      <TargetPath>scripts\identity_manifest.sql</TargetPath>
    </Content>
  </ItemGroup>

  <!-- Phase 3: BIP39 wordlist for license key encoding/decoding.
       Run tools\fetch-bip39-wordlist.ps1 once to download the wordlist file.
       The Condition prevents the build from failing if the file has not been fetched yet. -->
  <ItemGroup>
    <EmbeddedResource Include="Resources\bip39-english.txt" Condition="Exists('Resources\bip39-english.txt')" />
    <!-- Trusted public key for verifying signed update artifacts. Until the real
         code-signing cert is dropped in (tools\extract-update-pubkey.ps1), this is a
         placeholder and UpdateSignatureVerifier fails closed. Public key only — never
         the private key. -->
    <EmbeddedResource Include="Resources\update-signing-public.pem" Condition="Exists('Resources\update-signing-public.pem')" />
    <!-- S3: Ola Hallengren's Maintenance Solution (MIT-licensed), embedded so
         MaintenanceSolutionOpRenderer can load + checksum-verify it at runtime without
         depending on the loose BPScripts\ copy surviving deployment. BPScripts is excluded
         from default globbing (DefaultItemExcludes above does not list it, but it also has
         no implicit EmbeddedResource glob) — Include it explicitly. The Exists() guard is the same
         one its siblings above carry: the public mirror is published WITHOUT BPScripts
         (.publicignore), and a literal Include of a file that is not there fails the build rather
         than evaluating away. -->
    <EmbeddedResource Include="BPScripts\01. MaintenanceSolution.sql" Condition="Exists('BPScripts\01. MaintenanceSolution.sql')" />
  </ItemGroup>

  <!-- Warn at build time if the BIP39 wordlist is missing. Community builds have no
       key-entry surface (the key card is compiled out), so they neither need nor
       check for the wordlist — and the public repo cannot fetch it (tools/ is private). -->
  <Target Name="WarnIfBip39WordlistMissing" BeforeTargets="Build" Condition="'$(SQLTriageProfile)' != 'community'">
    <Warning Text="[SQLTriage] BIP39 wordlist missing: Resources\bip39-english.txt. License key decode/encode will throw at runtime. Run tools\fetch-bip39-wordlist.ps1 to fetch it." Condition="!Exists('Resources\bip39-english.txt')" />
  </Target>

  <!-- Refresh SQL Server licensing prices from Microsoft before publish (best-effort). -->
  <!-- Scrapes https://www.microsoft.com/en-us/sql-server/sql-server-2022-pricing and rewrites -->
  <!-- Config\sql-licensing-pricing.json (which is then baked into the bundle). Falls back to the -->
  <!-- committed anchor prices on network failure or missing Python, so it never breaks the build. -->
  <Target Name="RefreshLicensingPricing" BeforeTargets="Publish" Condition="Exists('scripts\update-licensing-pricing.py')">
    <Exec Command="python scripts\update-licensing-pricing.py" ContinueOnError="true" />
  </Target>

  <!-- Fail publish if the Free-tier bundle was not generated. -->
  <!-- CI: release.yml runs the FreeBundleBuild step before dotnet publish. -->
  <!-- Local: publish-release.ps1 clones corpus repo and runs CorpusEncryptor before dotnet publish. -->
  <Target Name="EnsureFreeBundlePresentForPublish" BeforeTargets="Publish">
    <Error Condition="!Exists('Config\free-bundle.dat')" Text="Config\free-bundle.dat is missing. Run the FreeBundleBuild step (publish-release.ps1 or release.yml) before dotnet publish." />
  </Target>

  <!-- Fail publish if the BIP39 wordlist was not fetched (full profile only — see
       WarnIfBip39WordlistMissing for why community skips this). -->
  <!-- Run tools\fetch-bip39-wordlist.ps1 once to download the wordlist. -->
  <Target Name="EnsureBip39WordlistPresentForPublish" BeforeTargets="Publish" Condition="'$(SQLTriageProfile)' != 'community'">
    <Error Condition="!Exists('Resources\bip39-english.txt')" Text="Resources\bip39-english.txt is missing. Run tools\fetch-bip39-wordlist.ps1 before publish." />
  </Target>

  <ItemGroup>
    <None Remove="BPScripts\\Ignore\\*\\*;SQLTriage-RAG-Builder\\*\\***" />
    <Content Remove="BPScripts\\Ignore\\*\\*;SQLTriage-RAG-Builder\\*\\***" />
    <None Update="BPScripts\01. MaintenanceSolution.sql">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="ConfigScripts\Server Configuration and Hardening.sql">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="BPScripts\03. dba quick view.sql">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="BPScripts\09. Do Stats.sql">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="BPScripts\AddTraceflags.ps1">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="BPScripts\availibility group job step script replica check.sql">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="BPScripts\doSPNs.sql">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="BPScripts\find indexes to drop.sql">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="BPScripts\Firewall rules with PowerShell.ps1">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="BPScripts\Install-All-Scripts.sql">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="BPScripts\shrinkfile -gradual.sql">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="BPScripts\WeeklyReportSchedule.sql">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
<None Update="scripts\Check_BP_Servers.sql">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="scripts\sp_Blitz.sql">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="scripts\SQLDBA.ORG.sp_triage.sql">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="scripts\stpChecklist_Seguranca.sql">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
    <None Update="SQLTriage.png">
      <Pack>True</Pack>
      <PackagePath>\</PackagePath>
    </None>
    <!-- SECOND, independent copy rule for Deploy\**. The Content Include near the top of this
         file is not the only thing that puts these files in the output directory — this None
         Include does it too, so the collector-installer exclusion has to be repeated here or
         it is vacuous. Verified against the actual build output, not assumed. -->
    <None Include="Deploy\**\*.*"
          Exclude="Deploy\PerformanceMonitor_db\**;Deploy\SQLWATCH_db\**">
      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
    </None>
  </ItemGroup>

  <!-- Config files are included via Content Include="Config\*.json" above.
       Do NOT re-declare them as None � that overrides Content and breaks publish. -->

  <ItemGroup>
     <Resource Include="SQLTriage.png" />
  </ItemGroup>

  <!-- Organize build output: DLLs to bin/, JSON configs to config/ -->
  <Target Name="OrganizeBuildOutput" AfterTargets="Build" Condition="'$(PublishDir)' == '' AND ('$(IsPublishing)' == 'true' OR '$(_IsPublishing)' == 'true')">
    <ItemGroup>
      <DllFiles Include="$(OutputPath)*.dll" Exclude="$(OutputPath)SQLTriage.dll" />
      <ConfigFiles Include="$(OutputPath)appsettings*.json" />
      <ConfigFiles Include="$(OutputPath)dashboard-config.json" Condition="Exists('$(OutputPath)dashboard-config.json')" />
      <ConfigFiles Include="$(OutputPath)version.json" Condition="Exists('$(OutputPath)version.json')" />
      <ConfigFiles Include="$(OutputPath)script-configurations.json" Condition="Exists('$(OutputPath)script-configurations.json')" />
      <ConfigFiles Include="$(OutputPath)user-settings.json" Condition="Exists('$(OutputPath)user-settings.json')" />
      <ConfigFiles Include="$(OutputPath)SQLTriage.*.json" />
    </ItemGroup>
    <MakeDir Directories="$(OutputPath)bin" />
    <MakeDir Directories="$(OutputPath)config" />
    <Move SourceFiles="@(DllFiles)" DestinationFolder="$(OutputPath)bin" />
    <Move SourceFiles="@(ConfigFiles)" DestinationFolder="$(OutputPath)config" />
  </Target>

  <!-- Remove language folders from publish output -->
  <Target Name="RemoveLanguageFolders" AfterTargets="Publish" Condition="'$(PublishDir)' != ''">
    <ItemGroup>
      <LanguageFolders Include="$(PublishDir)cs;$(PublishDir)de;$(PublishDir)es;$(PublishDir)fr;$(PublishDir)it;$(PublishDir)ja;$(PublishDir)ko;$(PublishDir)pl;$(PublishDir)pt;$(PublishDir)pt-BR;$(PublishDir)ru;$(PublishDir)tr;$(PublishDir)zh-Hans;$(PublishDir)zh-Hant" />
    </ItemGroup>
    <RemoveDir Directories="@(LanguageFolders)" ContinueOnError="true" />
  </Target>

  <!-- Remove non-English language resources to reduce size -->
  <Target Name="RemoveUnnecessaryLanguageResources" AfterTargets="Build">
    <ItemGroup>
      <LanguageFolders Include="$(OutputPath)cs;$(OutputPath)de;$(OutputPath)es;$(OutputPath)fr;$(OutputPath)it;$(OutputPath)ja;$(OutputPath)ko;$(OutputPath)pl;$(OutputPath)pt;$(OutputPath)pt-BR;$(OutputPath)ru;$(OutputPath)tr;$(OutputPath)zh-Hans;$(OutputPath)zh-Hant" />
    </ItemGroup>
    <RemoveDir Directories="@(LanguageFolders)" ContinueOnError="true" />
  </Target>

  <!-- Increment build number on every build -->
  <Target Name="IncrementBuildNumber" BeforeTargets="BeforeBuild" Condition="'$(CI)' != 'true' AND '$(ContinuousIntegrationBuild)' != 'true'">
    <Exec Command="powershell -ExecutionPolicy Bypass -File increment-build.ps1" />
  </Target>

  <!-- Stamp exe file version from Config\version.json on every build -->
  <Target Name="StampVersionFromJson" AfterTargets="IncrementBuildNumber">
    <PropertyGroup>
      <VersionJson>$([System.IO.File]::ReadAllText('Config\version.json'))</VersionJson>
      <VersionNumber>$([System.Text.RegularExpressions.Regex]::Match($(VersionJson), '"version"\s*:\s*"([^"]+)"').Groups[1].Value)</VersionNumber>
      <BuildNumber>$([System.Text.RegularExpressions.Regex]::Match($(VersionJson), '"buildNumber"\s*:\s*(\d+)').Groups[1].Value)</BuildNumber>
      <Version>$(VersionNumber).$(BuildNumber)</Version>
      <AssemblyVersion>$(VersionNumber).$(BuildNumber)</AssemblyVersion>
      <FileVersion>$(VersionNumber).$(BuildNumber)</FileVersion>
      <InformationalVersion>v$(VersionNumber) build $(BuildNumber)</InformationalVersion>
    </PropertyGroup>
    <Message Importance="high" Text="Version stamped: $(FileVersion)" />
  </Target>

  <!-- Authenticode-sign the published exe BEFORE it is zipped, so the release ZIP carries the
       signed binary. Runs when EITHER -p:SigningThumbprint=<sha1> (the Certum cloud/HSM cert,
       selected from Cert:\CurrentUser\My — requires a logged-in SimplySign session) OR
       -p:SigningPfx=<path> (legacy file-based cert) is supplied. Ordinary dev/CI builds skip it.
       Requires signtool (Windows SDK) on PATH.
       Timestamping uses Certum's RFC3161 TSA so signatures outlive the certificate. -->
  <Target Name="SignPublishedExe" AfterTargets="Publish" BeforeTargets="CreateReleaseZip" Condition="'$(Configuration)' == 'Release' AND '$(PublishDir)' != '' AND ('$(SigningPfx)' != '' OR '$(SigningThumbprint)' != '')">
    <!-- Locate signtool.exe. It is NOT on PATH by default (proven on the release machine
         2026-07-21: this Exec failed with 9009 'not recognized'), so relying on PATH — as
         this target used to — meant exe signing could never succeed here. publish-release.ps1
         resolves it and passes -p:SignToolPath=...; the glob below covers direct msbuild use. -->
    <ItemGroup Condition="'$(SignToolPath)' == ''">
      <_SignToolCandidate Include="C:\Program Files (x86)\Windows Kits\10\bin\**\x64\signtool.exe" />
      <_SignToolCandidate Include="C:\Program Files\Windows Kits\10\bin\**\x64\signtool.exe" />
    </ItemGroup>
    <PropertyGroup>
      <_SignToolAll>@(_SignToolCandidate)</_SignToolAll>
      <_SignToolExe Condition="'$(SignToolPath)' != ''">$(SignToolPath)</_SignToolExe>
      <!-- Take the first match. Any Windows SDK signtool.exe signs identically, so picking the
           newest is not worth nested-property-function gymnastics (MSBuild MSB4184). The
           supported entry point, publish-release.ps1, resolves the newest and passes
           -p:SignToolPath explicitly; this glob only serves direct `dotnet msbuild` use. -->
      <_SignToolExe Condition="'$(_SignToolExe)' == '' AND '$(_SignToolAll)' != ''">$(_SignToolAll.Split(';')[0])</_SignToolExe>

      <_SignPwdArg Condition="'$(SigningPassword)' != ''">/p "$(SigningPassword)"</_SignPwdArg>
      <!-- Thumbprint wins if both are somehow set; publish-release.ps1 rejects that combination. -->
      <_SignCredArg Condition="'$(SigningThumbprint)' != ''">/sha1 $(SigningThumbprint)</_SignCredArg>
      <_SignCredArg Condition="'$(SigningThumbprint)' == ''">/f "$(SigningPfx)" $(_SignPwdArg)</_SignCredArg>
      <_SignTsaUrl>http://time.certum.pl</_SignTsaUrl>
    </PropertyGroup>

    <!-- OSS cert guard (Adrian's ruling 2026-07-21, item C): the Open-Source Code Signing
         certificate (thumbprint below) may sign the COMMUNITY build ONLY. Any other profile
         (the default full build, or a paid/custom client build) must stay UNSIGNED until the
         commercial cert exists — signing a paid build with the OSS cert would put a
         "distributed commercially" claim on a cert Certum can revoke, killing the community
         build's reputation with it. Fail the publish loudly, naming the ruling. Fail-closed:
         the exemption is granted ONLY when SQLTriageProfile is exactly 'community'. -->
    <PropertyGroup>
      <_NormSigningThumbprint Condition="'$(SigningThumbprint)' != ''">$([System.Text.RegularExpressions.Regex]::Replace('$(SigningThumbprint)', '[^0-9A-Fa-f]', '').ToUpperInvariant())</_NormSigningThumbprint>
    </PropertyGroup>
    <Error Condition="'$(_NormSigningThumbprint)' == 'FCC63574AF60CB55D40AEB91531AD7FAACA15537' AND '$(SQLTriageProfile)' != 'community'"
           Text="[SQLTriage] REFUSING to sign: thumbprint FCC63574AF60CB55D40AEB91531AD7FAACA15537 is the Open-Source Code Signing certificate, which per Adrian's ruling (2026-07-21, item C) signs the COMMUNITY build ONLY. This build's profile is '$(SQLTriageProfile)' — a non-community (full / paid / custom) artifact must stay UNSIGNED until the commercial cert exists. Rebuild with -p:SQLTriageProfile=community, or sign with the commercial certificate." />

    <!-- Fail loudly rather than let the Exec die with a cryptic 9009. -->
    <Error Condition="'$(_SignToolExe)' == ''"
           Text="Signing was requested but signtool.exe could not be found. Install the Windows SDK 'Signing Tools for Desktop', or pass -p:SignToolPath=&lt;full path to signtool.exe&gt;." />

    <Message Importance="high" Text="[SQLTriage] Authenticode-signing $(PublishDir)SQLTriage.exe using $(_SignToolExe)" />
    <Exec Command="&quot;$(_SignToolExe)&quot; sign $(_SignCredArg) /fd SHA256 /tr $(_SignTsaUrl) /td SHA256 &quot;$(PublishDir)SQLTriage.exe&quot;" />
    <!-- VERIFY GATE: prove the exe really is signed before CreateReleaseZip packages it.
         Without this the build would happily zip an unsigned exe if signing degraded to a
         no-op. /pa applies the Authenticode policy Windows itself uses. A non-zero exit
         fails the build - that is deliberate; an unsigned exe must not reach a release. -->
    <Message Importance="high" Text="[SQLTriage] Verifying Authenticode signature on $(PublishDir)SQLTriage.exe" />
    <Exec Command="&quot;$(_SignToolExe)&quot; verify /pa /v &quot;$(PublishDir)SQLTriage.exe&quot;" />
  </Target>

  <!-- Create release ZIP after publish -->
  <Target Name="CreateReleaseZip" AfterTargets="Publish" Condition="'$(Configuration)' == 'Release' AND '$(PublishDir)' != ''">
    <PropertyGroup>
      <VersionJson>$([System.IO.File]::ReadAllText('Config\version.json'))</VersionJson>
      <VersionNumber>$([System.Text.RegularExpressions.Regex]::Match($(VersionJson), '"version"\s*:\s*"([^"]+)"').Groups[1].Value)</VersionNumber>
      <BuildNumber>$([System.Text.RegularExpressions.Regex]::Match($(VersionJson), '"buildNumber"\s*:\s*(\d+)').Groups[1].Value)</BuildNumber>
      <!-- Release artifacts are split by build profile (full|community) into separate
           folders AND the community zip is name-suffixed, so a private full artifact can
           never be confused with - or accidentally shipped as - the public community one. -->
      <ReleaseDir>release\$(SQLTriageProfile)</ReleaseDir>
      <ZipFileName Condition="'$(SQLTriageProfile)' == 'community'">SQLTriage-v$(VersionNumber)-build$(BuildNumber)-community-win-x64.zip</ZipFileName>
      <ZipFileName Condition="'$(ZipFileName)' == ''">SQLTriage-v$(VersionNumber)-build$(BuildNumber)-win-x64.zip</ZipFileName>
      <ZipFilePath>$(ReleaseDir)\$(ZipFileName)</ZipFilePath>
    </PropertyGroup>
    <RemoveDir Directories="$(PublishDir)bin" ContinueOnError="true" />
    <!-- Strip dev/research artefacts that must never ship in a release -->
    <RemoveDir Directories="$(PublishDir)BPScripts\\Ignore\\*\\*;SQLTriage-RAG-Builder\\*\\*" ContinueOnError="true" />
    <RemoveDir Directories="$(PublishDir)research_output" ContinueOnError="true" />
    <RemoveDir Directories="$(PublishDir)research_logs" ContinueOnError="true" />
    <RemoveDir Directories="$(PublishDir)temp" ContinueOnError="true" />
    <RemoveDir Directories="$(PublishDir)win-x64" ContinueOnError="true" />
    <RemoveDir Directories="$(PublishDir).git" ContinueOnError="true" />
    <!-- Strip test/coverage infrastructure that leaks in from SQLTriage.Tests -->
    <RemoveDir Directories="$(PublishDir)CodeCoverage" ContinueOnError="true" />
    <RemoveDir Directories="$(PublishDir)InstrumentationEngine" ContinueOnError="true" />
    <!-- coverlet + code coverage -->
    <Delete Files="$(PublishDir)coverlet.collector.dll;$(PublishDir)coverlet.collector.pdb;$(PublishDir)coverlet.collector.deps.json;$(PublishDir)coverlet.collector.targets;$(PublishDir)coverlet.core.dll;$(PublishDir)coverlet.core.pdb" ContinueOnError="true" />
    <Delete Files="$(PublishDir)Microsoft.CodeCoverage.Core.dll;$(PublishDir)Microsoft.CodeCoverage.Instrumentation.dll;$(PublishDir)Microsoft.CodeCoverage.Interprocess.dll;$(PublishDir)Microsoft.CodeCoverage.props;$(PublishDir)Microsoft.CodeCoverage.targets" ContinueOnError="true" />
    <Delete Files="$(PublishDir)Microsoft.VisualStudio.CodeCoverage.Shim.dll;$(PublishDir)Microsoft.VisualStudio.TraceDataCollector.dll" ContinueOnError="true" />
    <!-- xunit + test platform -->
    <Delete Files="$(PublishDir)xunit.abstractions.dll;$(PublishDir)xunit.assert.dll;$(PublishDir)xunit.core.dll;$(PublishDir)xunit.execution.dotnet.dll" ContinueOnError="true" />
    <Delete Files="$(PublishDir)xunit.runner.reporters.netcoreapp10.dll;$(PublishDir)xunit.runner.utility.netcoreapp10.dll;$(PublishDir)xunit.runner.visualstudio.dotnetcore.testadapter.dll" ContinueOnError="true" />
    <Delete Files="$(PublishDir)testhost.dll;$(PublishDir)testhost.exe" ContinueOnError="true" />
    <Delete Files="$(PublishDir)Microsoft.TestPlatform.CommunicationUtilities.dll;$(PublishDir)Microsoft.TestPlatform.CoreUtilities.dll;$(PublishDir)Microsoft.TestPlatform.CrossPlatEngine.dll;$(PublishDir)Microsoft.TestPlatform.PlatformAbstractions.dll;$(PublishDir)Microsoft.TestPlatform.Utilities.dll" ContinueOnError="true" />
    <Delete Files="$(PublishDir)Microsoft.VisualStudio.TestPlatform.Common.dll;$(PublishDir)Microsoft.VisualStudio.TestPlatform.ObjectModel.dll" ContinueOnError="true" />
    <!-- test project outputs -->
    <Delete Files="$(PublishDir)SQLTriage.Tests.dll;$(PublishDir)SQLTriage.Tests.pdb;$(PublishDir)SQLTriage.Tests.deps.json;$(PublishDir)SQLTriage.Tests.runtimeconfig.json" ContinueOnError="true" />
    <MakeDir Directories="$(ReleaseDir)" />
    <ZipDirectory SourceDirectory="$(PublishDir)" DestinationFile="$(ZipFilePath)" Overwrite="true" />
    <Message Importance="high" Text="Release ZIP created: $(ZipFilePath)" />
  </Target>

  <!-- Build Inno Setup installer and convert screenshots after ZIP is created -->
  <Target Name="BuildInstaller" AfterTargets="CreateReleaseZip" Condition="'$(Configuration)' == 'Release'">
    <PropertyGroup>
      <IsccExe Condition="Exists('C:\GitHub\Inno Setup 6\iscc.exe')">C:\GitHub\Inno Setup 6\iscc.exe</IsccExe>
      <IsccExe Condition="'$(IsccExe)' == '' AND Exists('C:\Program Files (x86)\Inno Setup 6\iscc.exe')">C:\Program Files (x86)\Inno Setup 6\iscc.exe</IsccExe>
      <IsccExe Condition="'$(IsccExe)' == '' AND Exists('C:\Program Files\Inno Setup 6\iscc.exe')">C:\Program Files\Inno Setup 6\iscc.exe</IsccExe>
      <FfmpegExe Condition="Exists('C:\GitHub\TranscriptExtractor\ffmpeg.exe')">C:\GitHub\TranscriptExtractor\ffmpeg.exe</FfmpegExe>
      <ScreenshotSrc>$(MSBuildProjectDirectory)\docs\screenshots\src</ScreenshotSrc>
      <ScreenshotOut>$(MSBuildProjectDirectory)\docs\screenshots</ScreenshotOut>
      <!-- Community installers carry a -community filename suffix (matches the zip). -->
      <SQLTEditionSuffix Condition="'$(SQLTriageProfile)' == 'community'">-community</SQLTEditionSuffix>
    </PropertyGroup>

    <!-- Generate installer\version.iss with current version/build so iscc doesn't need to parse JSON -->
    <!-- Use a separate ps1 file rather than inline -Command so we don't fight MSBuild $-property expansion. -->
    <Exec Command="powershell -ExecutionPolicy Bypass -File &quot;$(MSBuildProjectDirectory)\installer\write-version-iss.ps1&quot;" Condition="'$(IsccExe)' != ''" ContinueOnError="true" />

    <!-- Inno Setup installer - routed into the per-profile release folder (full|community)
         so the two publish use cases never share an output directory, and pinned to the
         dir that was ACTUALLY just published (the .iss default of ..\publish\win-x64 could
         silently package a stale - or wrong-profile - tree). -->
    <Message Importance="high" Text="Building Inno Setup installer..." Condition="'$(IsccExe)' != ''" />
    <Exec Command="&quot;$(IsccExe)&quot; &quot;/DSourceDir=$([System.IO.Path]::GetFullPath('$(PublishDir)').TrimEnd('\'))&quot; &quot;/DOutputDir=$(MSBuildProjectDirectory)\release\$(SQLTriageProfile)&quot; &quot;/DEditionSuffix=$(SQLTEditionSuffix)&quot; installer\SQLTriage.iss" Condition="'$(IsccExe)' != ''" ContinueOnError="true" />
    <Message Importance="high" Text="iscc.exe not found � skipping installer build" Condition="'$(IsccExe)' == ''" />

    <!-- Convert source screenshots to web-ready JPEGs (1280px wide, q:v 4) -->
    <Message Importance="high" Text="Converting screenshots for GitHub Pages..." Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)')" />
    <Exec Command="&quot;$(FfmpegExe)&quot; -y -i &quot;$(ScreenshotSrc)\1-addserver.jpg&quot;                                        -vf scale=1280:-1 -q:v 4 &quot;$(ScreenshotOut)\1-addserver.jpg&quot;" Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)\1-addserver.jpg')" ContinueOnError="true" />
    <Exec Command="&quot;$(FfmpegExe)&quot; -y -i &quot;$(ScreenshotSrc)\2-whats-new.jpg&quot;                                        -vf scale=1280:-1 -q:v 4 &quot;$(ScreenshotOut)\2-whats-new.jpg&quot;" Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)\2-whats-new.jpg')" ContinueOnError="true" />
    <Exec Command="&quot;$(FfmpegExe)&quot; -y -i &quot;$(ScreenshotSrc)\3-wait-state.jpg&quot;                                        -vf scale=1280:-1 -q:v 4 &quot;$(ScreenshotOut)\3-wait-state.jpg&quot;" Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)\3-wait-state.jpg')" ContinueOnError="true" />
    <Exec Command="&quot;$(FfmpegExe)&quot; -y -i &quot;$(ScreenshotSrc)\4-live-sessions.jpg&quot;                                     -vf scale=1280:-1 -q:v 4 &quot;$(ScreenshotOut)\4-live-sessions.jpg&quot;" Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)\4-live-sessions.jpg')" ContinueOnError="true" />
    <Exec Command="&quot;$(FfmpegExe)&quot; -y -i &quot;$(ScreenshotSrc)\5-database-health.jpg&quot;                                   -vf scale=1280:-1 -q:v 4 &quot;$(ScreenshotOut)\5-database-health.jpg&quot;" Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)\5-database-health.jpg')" ContinueOnError="true" />
    <Exec Command="&quot;$(FfmpegExe)&quot; -y -i &quot;$(ScreenshotSrc)\6-instance-overview.jpg&quot;                                 -vf scale=1280:-1 -q:v 4 &quot;$(ScreenshotOut)\6-instance-overview.jpg&quot;" Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)\6-instance-overview.jpg')" ContinueOnError="true" />
    <Exec Command="&quot;$(FfmpegExe)&quot; -y -i &quot;$(ScreenshotSrc)\7-environment-map.jpg&quot;                                  -vf scale=1280:-1 -q:v 4 &quot;$(ScreenshotOut)\7-environment-map.jpg&quot;" Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)\7-environment-map.jpg')" ContinueOnError="true" />
    <Exec Command="&quot;$(FfmpegExe)&quot; -y -i &quot;$(ScreenshotSrc)\8-servers-easily-monitor-50-instances-or-more.jpg&quot;     -vf scale=1280:-1 -q:v 4 &quot;$(ScreenshotOut)\8-servers-easily-monitor-50-instances-or-more.jpg&quot;" Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)\8-servers-easily-monitor-50-instances-or-more.jpg')" ContinueOnError="true" />
    <Exec Command="&quot;$(FfmpegExe)&quot; -y -i &quot;$(ScreenshotSrc)\9-run-full-sql-audits.jpg&quot;                             -vf scale=1280:-1 -q:v 4 &quot;$(ScreenshotOut)\9-run-full-sql-audits.jpg&quot;" Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)\9-run-full-sql-audits.jpg')" ContinueOnError="true" />
    <Exec Command="&quot;$(FfmpegExe)&quot; -y -i &quot;$(ScreenshotSrc)\10-microsoft-sql-vulnerability-assessment.jpg&quot;         -vf scale=1280:-1 -q:v 4 &quot;$(ScreenshotOut)\10-microsoft-sql-vulnerability-assessment.jpg&quot;" Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)\10-microsoft-sql-vulnerability-assessment.jpg')" ContinueOnError="true" />
    <Exec Command="&quot;$(FfmpegExe)&quot; -y -i &quot;$(ScreenshotSrc)\11-upload-results-securely-to-azure-blob-storage.jpg&quot;  -vf scale=1280:-1 -q:v 4 &quot;$(ScreenshotOut)\11-upload-results-securely-to-azure-blob-storage.jpg&quot;" Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)\11-upload-results-securely-to-azure-blob-storage.jpg')" ContinueOnError="true" />
    <Exec Command="&quot;$(FfmpegExe)&quot; -y -i &quot;$(ScreenshotSrc)\12-multiple-notification-channels.jpg&quot;               -vf scale=1280:-1 -q:v 4 &quot;$(ScreenshotOut)\12-multiple-notification-channels.jpg&quot;" Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)\12-multiple-notification-channels.jpg')" ContinueOnError="true" />
    <Exec Command="&quot;$(FfmpegExe)&quot; -y -i &quot;$(ScreenshotSrc)\13-maturity-roadmap.jpg&quot;                               -vf scale=1280:-1 -q:v 4 &quot;$(ScreenshotOut)\13-maturity-roadmap.jpg&quot;" Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)\13-maturity-roadmap.jpg')" ContinueOnError="true" />
    <Exec Command="&quot;$(FfmpegExe)&quot; -y -i &quot;$(ScreenshotSrc)\14-alerting.jpg&quot;                                        -vf scale=1280:-1 -q:v 4 &quot;$(ScreenshotOut)\14-alerting.jpg&quot;" Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)\14-alerting.jpg')" ContinueOnError="true" />
    <Exec Command="&quot;$(FfmpegExe)&quot; -y -i &quot;$(ScreenshotSrc)\15-query-plan-viewer.jpg&quot;                              -vf scale=1280:-1 -q:v 4 &quot;$(ScreenshotOut)\15-query-plan-viewer.jpg&quot;" Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)\15-query-plan-viewer.jpg')" ContinueOnError="true" />
    <Exec Command="&quot;$(FfmpegExe)&quot; -y -i &quot;$(ScreenshotSrc)\16-risk-register-compliance-mapping-ISO-SOC2-NIST.jpg&quot; -vf scale=1280:-1 -q:v 4 &quot;$(ScreenshotOut)\16-risk-register-compliance-mapping-ISO-SOC2-NIST.jpg&quot;" Condition="'$(FfmpegExe)' != '' AND Exists('$(ScreenshotSrc)\16-risk-register-compliance-mapping-ISO-SOC2-NIST.jpg')" ContinueOnError="true" />
    <Message Importance="high" Text="ffmpeg not found � skipping screenshot conversion" Condition="'$(FfmpegExe)' == ''" />
  </Target>

  <!-- Remove redundant publish folder and other unnecessary files -->
  <Target Name="RemoveRedundantPublishFolder" AfterTargets="Build;Publish">
    <RemoveDir Directories="$(OutputPath)publish;$(OutputPath)BenchmarkSuite1;$(OutputPath)Tests;$(OutputPath)PerformanceMonitor-main;$(PublishDir)publish" ContinueOnError="true" />
    <Delete Files="$(OutputPath)*.pdb" Condition="'$(Configuration)' == 'Release'" ContinueOnError="true" />
  </Target>

</Project>