#!/bin/bash
#
#  release.sh
#  Zyquo Local
#
#  Author: Simon-Pierre Boucher
#  Mail: contact@spboucher.ai
#
# Developer ID signing, notarization and stapling for Zyquo Local.
# Identity and notarytool profile reused from the Zyquo Term pipeline.
#
# Usage:
#   scripts/release.sh          # full: build + bundle + sign + notarize + staple + dmg
#   scripts/release.sh sign|notarize|dmg   # individual steps

set -euo pipefail
cd "$(dirname "$0")/.."

export SDKROOT=/Library/Developer/CommandLineTools/SDKs/MacOSX26.5.sdk
export PATH="$HOME/Developer/Metal.xctoolchain/usr/bin:$PATH"

IDENTITY="Developer ID Application: Simon-Pierre Boucher (3YM54G49SN)"
KEYCHAIN_PROFILE="MacLustr-Notarize"
APP_DIR="dist/Zyquo Local.app"
ZIP_NAME="dist/ZyquoLocal.zip"
DMG_NAME="dist/ZyquoLocal.dmg"
ENTITLEMENTS="Support/entitlements.plist"

build() {
    echo "=== Release build + bundle ==="
    make bundle-release
}

sign() {
    [ -d "$APP_DIR" ] || { echo "ERROR: $APP_DIR missing — run 'make bundle-release' first" >&2; exit 1; }
    echo "=== Signing (Developer ID, hardened runtime) ==="
    # Nested code first: resource bundles (the Cmlx bundle seals the MLX
    # metallib — the classic notarization culprit), then the app.
    find "$APP_DIR/Contents/Resources" -maxdepth 1 -name '*.bundle' -print0 |
        while IFS= read -r -d '' bundle; do
            codesign --force --options runtime --timestamp --sign "$IDENTITY" "$bundle"
        done
    codesign --force --options runtime --timestamp \
        --entitlements "$ENTITLEMENTS" \
        --sign "$IDENTITY" "$APP_DIR"
    codesign --verify --deep --strict --verbose=2 "$APP_DIR"
    echo "Signature valid."
}

notarize() {
    echo "=== Notarizing app (profile: $KEYCHAIN_PROFILE) ==="
    rm -f "$ZIP_NAME"
    ditto -c -k --keepParent "$APP_DIR" "$ZIP_NAME"
    xcrun notarytool submit "$ZIP_NAME" --keychain-profile "$KEYCHAIN_PROFILE" --wait
    xcrun stapler staple "$APP_DIR"
    xcrun stapler validate "$APP_DIR"
    spctl -a -vv "$APP_DIR"
    echo "App notarized and stapled."
}

dmg() {
    echo "=== Creating signed + notarized DMG ==="
    rm -f "$DMG_NAME"
    DMG_TEMP="dist/dmg_temp"
    rm -rf "$DMG_TEMP"
    mkdir -p "$DMG_TEMP"
    cp -R "$APP_DIR" "$DMG_TEMP/"
    ln -s /Applications "$DMG_TEMP/Applications"
    hdiutil create -volname "Zyquo Local" -srcfolder "$DMG_TEMP" -ov -format UDZO "$DMG_NAME"
    rm -rf "$DMG_TEMP"
    codesign --force --sign "$IDENTITY" --timestamp "$DMG_NAME"
    xcrun notarytool submit "$DMG_NAME" --keychain-profile "$KEYCHAIN_PROFILE" --wait
    xcrun stapler staple "$DMG_NAME"
    echo "DMG ready: $DMG_NAME"
}

case "${1:-dist}" in
    sign) sign ;;
    notarize) notarize ;;
    dmg) dmg ;;
    dist) build; sign; notarize; dmg ;;
    *) echo "Usage: $0 {sign|notarize|dmg|dist}" >&2; exit 64 ;;
esac