#!/bin/bash
set -euo pipefail
cd "$(dirname "$0")"

if [ "$#" -ne 1 ]; then
    echo "usage: $0 <version>    e.g. ./release.sh 0.1.0" >&2
    exit 1
fi
VERSION="$1"

# Notarization credentials. Configure once, e.g. in ~/.zshrc:
#   export PROMPT_NOTARY_API_KEY_PATH="$HOME/.config/kapture/AuthKey_K5KXMMSB28.p8"
#   export PROMPT_NOTARY_API_KEY_ID="K5KXMMSB28"
#   export PROMPT_NOTARY_API_ISSUER="3e25e5dc-8b75-453f-a71c-c7f3feaac628"
# If these are unset (or PROMPT_SKIP_NOTARY=1), release.sh builds, zips,
# and stops there — the zip is signed but NOT notarized.

./build-app.sh "$VERSION"

mkdir -p dist
rm -f dist/Prompt.zip
ditto -c -k --keepParent Prompt.app dist/Prompt.zip

if [ -n "${PROMPT_SKIP_NOTARY:-}" ]; then
    echo
    echo "!! NOTARIZATION SKIPPED — this zip is NOT FOR PUBLICATION."
    echo "!! It is signed but Gatekeeper will reject it on other Macs."
    shasum -a 256 dist/Prompt.zip
    exit 0
fi

# Default to the shared TZGyn App Store Connect key (same one Kapture uses).
PROMPT_NOTARY_API_KEY_PATH="${PROMPT_NOTARY_API_KEY_PATH:-$HOME/.config/kapture/AuthKey_K5KXMMSB28.p8}"
PROMPT_NOTARY_API_KEY_ID="${PROMPT_NOTARY_API_KEY_ID:-K5KXMMSB28}"
PROMPT_NOTARY_API_ISSUER="${PROMPT_NOTARY_API_ISSUER:-3e25e5dc-8b75-453f-a71c-c7f3feaac628}"

if [ ! -f "$PROMPT_NOTARY_API_KEY_PATH" ]; then
    echo "ERROR: notarization key not found at $PROMPT_NOTARY_API_KEY_PATH." >&2
    echo "Notarization is required for a release; set PROMPT_SKIP_NOTARY=1 only" >&2
    echo "for a local dev build that must not be published." >&2
    exit 1
fi

if ! command -v xcrun >/dev/null 2>&1 || ! xcrun --find notarytool >/dev/null 2>&1; then
    echo "ERROR: xcrun notarytool not found (requires Xcode 13+)." >&2
    echo "Notarization is required for a release." >&2
    exit 1
fi

echo "Submitting to Apple for notarization (first run can take minutes)..."
xcrun notarytool submit dist/Prompt.zip \
    --key "$PROMPT_NOTARY_API_KEY_PATH" \
    --key-id "$PROMPT_NOTARY_API_KEY_ID" \
    --issuer "$PROMPT_NOTARY_API_ISSUER" \
    --wait \
    --output-format json > notary-result.json

STATUS=$(jq -r '.status' notary-result.json 2>/dev/null || echo "unknown")
if [ "$STATUS" != "Accepted" ]; then
    echo "Notarization failed with status: $STATUS" >&2
    cat notary-result.json >&2 || true
    rm -f notary-result.json
    exit 1
fi
rm -f notary-result.json

echo "Notarization accepted — stapling ticket onto the app..."
xcrun stapler staple Prompt.app
xcrun stapler validate Prompt.app

rm -f dist/Prompt.zip
ditto -c -k --keepParent Prompt.app dist/Prompt.zip

if ! spctl -a -vv Prompt.app 2>&1 | grep -q "source=Notarized Developer ID"; then
    echo "ERROR: spctl does not report a notarized build — do not publish this." >&2
    spctl -a -vv Prompt.app >&2
    exit 1
fi

echo
echo "Done — notarized and stapled."
shasum -a 256 dist/Prompt.zip