#!/bin/bash
# Author: Simon-Pierre Boucher — contact@spboucher.ai
# Developer ID signing, DMG, and notarization for Forge Studio.
# Identity and notarization flow reused from the zyquo-term pipeline
# (Team 3YM54G49SN, notarytool keychain profile "MacLustr-Notarize").
set -euo pipefail
cd "$(dirname "$0")/.."

IDENTITY="Developer ID Application: Simon-Pierre Boucher (3YM54G49SN)"
KEYCHAIN_PROFILE="MacLustr-Notarize"
APP_DIR="dist/ForgeStudio.app"
DMG_NAME="dist/ForgeStudio-0.2.0.dmg"

./scripts/package-app.sh release

echo "=== Signing (Developer ID, hardened runtime) ==="
codesign --force --options runtime --timestamp \
    --sign "$IDENTITY" "$APP_DIR/Contents/MacOS/ForgeStudio"
codesign --force --options runtime --timestamp \
    --sign "$IDENTITY" "$APP_DIR"
codesign --verify --deep --strict --verbose=2 "$APP_DIR"

echo "=== DMG ==="
rm -f "$DMG_NAME"
if command -v create-dmg >/dev/null; then
    create-dmg --volname "Forge Studio" --app-drop-link 480 200 \
        --window-size 660 420 "$DMG_NAME" "$APP_DIR"
else
    hdiutil create -volname "Forge Studio" -srcfolder "$APP_DIR" \
        -ov -format UDZO "$DMG_NAME"
fi
codesign --force --sign "$IDENTITY" --timestamp "$DMG_NAME"

echo "=== Notarizing (profile: $KEYCHAIN_PROFILE) ==="
xcrun notarytool submit "$DMG_NAME" --keychain-profile "$KEYCHAIN_PROFILE" --wait

echo "=== Stapling ==="
xcrun stapler staple "$APP_DIR"
xcrun stapler staple "$DMG_NAME"
xcrun stapler validate "$DMG_NAME"
spctl -a -vv "$APP_DIR"
echo "OK: $DMG_NAME"