#!/usr/bin/env bash
#
# build-release-macos.sh — Build a signed & notarized macOS DMG for PrivateVoice Dictation
#
# Prerequisites (one-time):
#   1. Install Developer ID certificate in Keychain
#   2. Store notarization credentials:
#      xcrun notarytool store-credentials "privatevoice" \
#        --apple-id "your@apple.id" --team-id "3HY4G7M2AL" \
#        --password "app-specific-password"
#
# Usage:
#   cd VoiceSnapGo && ./scripts/build-release-macos.sh [arm64|x86_64|all]
#   Default: build for current machine architecture
#
set -euo pipefail

# ── Configuration ─────────────────────────────────────────────────────────────
IDENTITY="Developer ID Application: Ningbo Zhuozhi Innovation Network Technology Co., Ltd. (3HY4G7M2AL)"
KEYCHAIN_PROFILE="privatevoice"

APP_NAME="PrivateVoice Dictation"
BUNDLE_ID="com.privatevoice.input"

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"

VERSION=$(defaults read "$PROJECT_DIR/build/darwin/Info.plist" CFBundleShortVersionString 2>/dev/null || echo "2.1.0")

ENTITLEMENTS="$PROJECT_DIR/build/darwin/entitlements.plist"
INFO_PLIST="$PROJECT_DIR/build/darwin/Info.plist"
GOMODCACHE=$(go env GOMODCACHE)
SHERPA_MACOS_MODULE_VERSION="$(cd "$PROJECT_DIR" && go list -m -f '{{.Version}}' github.com/k2-fsa/sherpa-onnx-go-macos)"
ONNXRUNTIME_DYLIB=""
ONNXRUNTIME_DYLIB_NAME=""

# ── Architecture mapping ────────────────────────────────────────────────────
resolve_arch() {
  local arch="$1"
  case "$arch" in
    arm64)
      GOARCH="arm64"
      SHERPA_ARCH="aarch64-apple-darwin"
      DMG_ARCH="arm64"
      ;;
    x86_64|amd64)
      GOARCH="amd64"
      SHERPA_ARCH="x86_64-apple-darwin"
      DMG_ARCH="x86_64"
      ;;
    *)
      fail "Unknown architecture: $arch (use arm64 or x86_64)"
      ;;
  esac
  SHERPA_LIB_DIR="$GOMODCACHE/github.com/k2-fsa/sherpa-onnx-go-macos@$SHERPA_MACOS_MODULE_VERSION/lib/$SHERPA_ARCH"
  DMG_NAME="${APP_NAME}-v${VERSION}-${DMG_ARCH}.dmg"
  BUILD_DIR="$PROJECT_DIR/build/release/${DMG_ARCH}"
  APP_BUNDLE="$BUILD_DIR/${APP_NAME}.app"
}

# ── Parse argument ──────────────────────────────────────────────────────────
TARGET_ARCH="${1:-$(uname -m)}"

if [[ "$TARGET_ARCH" == "all" ]]; then
  echo "==> Building for ALL architectures"
  "$0" arm64
  "$0" x86_64
  echo ""
  echo "==> All builds complete!"
  ls -lh "$PROJECT_DIR/build/release/"*/*.dmg
  exit 0
fi

resolve_arch "$TARGET_ARCH"
echo "==> Target: $DMG_ARCH (GOARCH=$GOARCH)"

# ── Helpers ───────────────────────────────────────────────────────────────────
step() { echo ""; echo "==> $1"; }
fail() { echo "ERROR: $1" >&2; exit 1; }

# ── Preflight checks ─────────────────────────────────────────────────────────
step "Preflight checks"
[[ -d "$SHERPA_LIB_DIR" ]] || fail "sherpa-onnx dylibs not found at $SHERPA_LIB_DIR"
ONNXRUNTIME_DYLIB="$(find "$SHERPA_LIB_DIR" -maxdepth 1 -type f -name 'libonnxruntime.*.dylib' | sort | tail -n 1)"
[[ -f "$ONNXRUNTIME_DYLIB" ]] || fail "onnxruntime dylib not found in $SHERPA_LIB_DIR"
ONNXRUNTIME_DYLIB_NAME="$(basename "$ONNXRUNTIME_DYLIB")"
[[ -f "$ENTITLEMENTS" ]]   || fail "entitlements.plist not found at $ENTITLEMENTS"
[[ -f "$INFO_PLIST" ]]     || fail "Info.plist not found at $INFO_PLIST"
security find-identity -v -p codesigning | grep -q "$IDENTITY" || fail "Signing identity not found in keychain"

# ── Step 1: Clean ─────────────────────────────────────────────────────────────
step "Cleaning old build artifacts"
rm -rf "$BUILD_DIR"
mkdir -p "$BUILD_DIR"

# ── Step 2: Build frontend ────────────────────────────────────────────────────
step "Building frontend"
cd "$PROJECT_DIR/frontend"
npm install --prefer-offline
npm run build
cd "$PROJECT_DIR"

# ── Step 3: Build Go binary ──────────────────────────────────────────────────
step "Building Go binary ($DMG_ARCH, GOARCH=$GOARCH)"
CGO_ENABLED=1 GOOS=darwin GOARCH="$GOARCH" \
  go build -buildvcs=false -gcflags=all="-l" -ldflags="-s -w" \
  -o "$BUILD_DIR/${APP_NAME}"

# ── Step 4: Assemble .app bundle ─────────────────────────────────────────────
step "Assembling ${APP_NAME}.app bundle"
mkdir -p "$APP_BUNDLE/Contents/MacOS"
mkdir -p "$APP_BUNDLE/Contents/Frameworks"
mkdir -p "$APP_BUNDLE/Contents/Resources"

cp "$INFO_PLIST"                         "$APP_BUNDLE/Contents/Info.plist"
cp "$BUILD_DIR/${APP_NAME}"              "$APP_BUNDLE/Contents/MacOS/${APP_NAME}"
cp "$PROJECT_DIR/build/darwin/icon.icns" \
                                         "$APP_BUNDLE/Contents/Resources/icon.icns"

# Copy dylibs
cp "$SHERPA_LIB_DIR/libsherpa-onnx-c-api.dylib"   "$APP_BUNDLE/Contents/Frameworks/"
cp "$ONNXRUNTIME_DYLIB"                            "$APP_BUNDLE/Contents/Frameworks/"

# ── Step 5: Fix rpaths ───────────────────────────────────────────────────────
step "Fixing rpaths with install_name_tool"

# Add @executable_path/../Frameworks rpath to binary
install_name_tool -add_rpath @executable_path/../Frameworks \
  "$APP_BUNDLE/Contents/MacOS/${APP_NAME}" 2>/dev/null || true

# Fix dylib install names
install_name_tool -id @rpath/libsherpa-onnx-c-api.dylib \
  "$APP_BUNDLE/Contents/Frameworks/libsherpa-onnx-c-api.dylib"

install_name_tool -id "@rpath/$ONNXRUNTIME_DYLIB_NAME" \
  "$APP_BUNDLE/Contents/Frameworks/$ONNXRUNTIME_DYLIB_NAME"

# Fix libsherpa's dependency on libonnxruntime
install_name_tool -change \
  @rpath/libonnxruntime.1.23.2.dylib \
  "@rpath/$ONNXRUNTIME_DYLIB_NAME" \
  "$APP_BUNDLE/Contents/Frameworks/libsherpa-onnx-c-api.dylib" 2>/dev/null || true
install_name_tool -change \
  @rpath/libonnxruntime.1.24.4.dylib \
  "@rpath/$ONNXRUNTIME_DYLIB_NAME" \
  "$APP_BUNDLE/Contents/Frameworks/libsherpa-onnx-c-api.dylib" 2>/dev/null || true

# ── Step 6: Code sign ────────────────────────────────────────────────────────
step "Code signing"

# Sign dylibs first (inside-out signing)
codesign --force --options runtime \
  --entitlements "$ENTITLEMENTS" \
  --sign "$IDENTITY" \
  "$APP_BUNDLE/Contents/Frameworks/$ONNXRUNTIME_DYLIB_NAME"

codesign --force --options runtime \
  --entitlements "$ENTITLEMENTS" \
  --sign "$IDENTITY" \
  "$APP_BUNDLE/Contents/Frameworks/libsherpa-onnx-c-api.dylib"

# Sign the main binary
codesign --force --options runtime \
  --entitlements "$ENTITLEMENTS" \
  --sign "$IDENTITY" \
  "$APP_BUNDLE/Contents/MacOS/${APP_NAME}"

# Sign the whole .app bundle
codesign --force --options runtime \
  --entitlements "$ENTITLEMENTS" \
  --sign "$IDENTITY" \
  "$APP_BUNDLE"

# Verify signature
step "Verifying code signature"
codesign -vvv --deep --strict "$APP_BUNDLE"

# ── Step 7: Create DMG ───────────────────────────────────────────────────────
step "Creating DMG"

DMG_PATH="$BUILD_DIR/$DMG_NAME"
DMG_TEMP="$BUILD_DIR/dmg-staging"

mkdir -p "$DMG_TEMP"
cp -R "$APP_BUNDLE" "$DMG_TEMP/"
ln -s /Applications "$DMG_TEMP/Applications"

hdiutil create -volname "$APP_NAME" \
  -srcfolder "$DMG_TEMP" \
  -ov -format UDZO \
  "$DMG_PATH"

rm -rf "$DMG_TEMP"

# ── Step 8: Sign DMG ─────────────────────────────────────────────────────────
step "Signing DMG"
codesign --force --sign "$IDENTITY" "$DMG_PATH"

# ── Step 9: Notarize ─────────────────────────────────────────────────────────
step "Submitting for notarization (this may take a few minutes)..."
xcrun notarytool submit "$DMG_PATH" \
  --keychain-profile "$KEYCHAIN_PROFILE" \
  --wait

# ── Step 10: Staple ──────────────────────────────────────────────────────────
step "Stapling notarization ticket"
xcrun stapler staple "$DMG_PATH"

# ── Done ──────────────────────────────────────────────────────────────────────
step "Build complete! ($DMG_ARCH)"
echo ""
echo "  Arch: $DMG_ARCH"
echo "  DMG:  $DMG_PATH"
echo "  Size: $(du -h "$DMG_PATH" | cut -f1)"
echo ""
echo "Verification commands:"
echo "  codesign -vvv --deep --strict \"$APP_BUNDLE\""
echo "  spctl -a -vvv \"$APP_BUNDLE\""
echo "  xcrun stapler validate \"$DMG_PATH\""