#!/bin/zsh
set -euo pipefail

script_dir=${0:A:h}
project="$script_dir/VoiceCat.Mac/VoiceCat.Mac.csproj"
configuration=Release
dry_run=0
dotnet_host=${VOICECAT_DOTNET:-}

if [[ -z "$dotnet_host" ]]; then
  if [[ -x /usr/local/share/dotnet/dotnet ]]; then
    dotnet_host=/usr/local/share/dotnet/dotnet
  else
    dotnet_host=$(command -v dotnet)
  fi
fi

if [[ ${1:-} == "--dry-run" ]]; then
  dry_run=1
fi

"$dotnet_host" publish "$project" -c "$configuration" --no-restore -p:ArchiveOnBuild=false
built_app="$script_dir/VoiceCat.Mac/bin/Release/net10.0-macos27.0/osx-arm64/VoiceCat.app"
if [[ ! -d "$built_app" ]]; then
  print -u2 "VoiceCat.app was not produced at $built_app"
  exit 1
fi

# Signing mutates every nested runtime binary. Work on a disposable distribution copy so a
# validation run can never poison MSBuild's incremental output or its signing caches.
distribution="$script_dir/VoiceCat.Mac/bin/Release/distribution"
app="$distribution/VoiceCat.app"
if [[ -e "$app" ]]; then
  rm -rf "$app"
fi
mkdir -p "$distribution"
ditto "$built_app" "$app"

if (( dry_run )); then
  # The workload may preserve mixed ad-hoc signatures on nested runtime dylibs. Re-sign the
  # complete local bundle as one ad-hoc unit so hardened-runtime Team-ID checks are meaningful.
  codesign --force --deep --sign - "$app"
  codesign --verify --deep --strict "$app"
  spctl --assess --type execute "$app" 2>/dev/null || true
  print "Validated ad-hoc build: $app"
  exit 0
fi

identity=${VOICECAT_CODESIGN_IDENTITY:-}
if [[ -z "$identity" ]]; then
  print -u2 "Set VOICECAT_CODESIGN_IDENTITY to a Developer ID Application identity."
  exit 2
fi

codesign --force --deep --timestamp --options runtime \
  --entitlements "$script_dir/VoiceCat.Mac/VoiceCat.Mac.entitlements" \
  --sign "$identity" "$app"
codesign --verify --deep --strict --verbose=2 "$app"

archive="$distribution/VoiceCat-macOS-arm64.zip"
ditto -c -k --keepParent "$app" "$archive"

if [[ -n ${APPLE_ID:-} && -n ${APPLE_TEAM_ID:-} && -n ${APPLE_APP_PASSWORD:-} ]]; then
  xcrun notarytool submit "$archive" --wait \
    --apple-id "$APPLE_ID" --team-id "$APPLE_TEAM_ID" --password "$APPLE_APP_PASSWORD"
  xcrun stapler staple "$app"
  xcrun stapler validate "$app"
  spctl --assess --type execute --verbose=2 "$app"
  ditto -c -k --keepParent "$app" "$archive"
  print "Signed, notarized, and stapled: $archive"
else
  print "Signed archive produced without notarization: $archive"
  print "Set APPLE_ID, APPLE_TEAM_ID, and APPLE_APP_PASSWORD to submit it."
fi