#!/bin/bash
# 构建 TinySTT.app：swift build → 组装 bundle → 签名
set -euo pipefail

ROOT="$(cd "$(dirname "$0")/.." && pwd)"
cd "$ROOT"

export CLANG_MODULE_CACHE_PATH="${CLANG_MODULE_CACHE_PATH:-$ROOT/.build/ModuleCache}"
export SWIFTPM_MODULECACHE_OVERRIDE="$CLANG_MODULE_CACHE_PATH"
CONFIG="${1:-release}"
echo "==> 编译 ${CONFIG}"
swift build -c "${CONFIG}" --disable-sandbox

BIN="$ROOT/.build/${CONFIG}/TinySTT"
APP="$ROOT/dist/TinySTT.app"

echo "==> 组装 bundle"
rm -rf "$APP"
mkdir -p "$APP/Contents/MacOS" "$APP/Contents/Resources"
cp "$BIN" "$APP/Contents/MacOS/TinySTT"
cp "$ROOT/Resources/Info.plist" "$APP/Contents/Info.plist"
cp "$ROOT/Resources/AppIcon.icns" "$APP/Contents/Resources/AppIcon.icns"

# 优先使用显式指定 > Apple Development > 本地自签名 > 临时签名。
# 固定身份很关键：否则每次重建都会让「辅助功能」授权失效。
resolve_identity() {
    if [ -n "${TINYSTT_SIGN_IDENTITY:-${TINYTTS_SIGN_IDENTITY:-}}" ]; then
        echo "${TINYSTT_SIGN_IDENTITY:-${TINYTTS_SIGN_IDENTITY}}"
        return
    fi
    local valid
    valid="$(security find-identity -v -p codesigning 2>/dev/null || true)"
    if echo "${valid}" | grep -q "Apple Development"; then
        echo "${valid}" | grep "Apple Development" | head -1 | sed -E 's/.*"(.*)"/\1/'
        return
    fi
    if echo "${valid}" | grep -q "TinySTT Dev"; then
        echo "TinySTT Dev"
        return
    fi
    # Keep using a pre-rename identity when one is already installed.
    if echo "${valid}" | grep -q "TinyTTS Dev"; then
        echo "TinyTTS Dev"
        return
    fi
    echo ""
}

IDENTITY="$(resolve_identity)"

echo "==> 签名"
if [ -n "${IDENTITY}" ]; then
    codesign --force --sign "${IDENTITY}" --timestamp=none "$APP" >/dev/null 2>&1 \
        || codesign --force --sign "${IDENTITY}" "$APP"
    echo "签名身份：${IDENTITY}"
else
    codesign --force --sign - "$APP" >/dev/null
    echo "⚠️  只找到临时签名，重建后「辅助功能」授权会失效。"
    echo "    先运行 ./scripts/setup-signing.sh 可生成固定身份。"
fi

codesign --verify --strict "$APP" && echo "==> 签名校验通过"
echo "==> 产物：$APP"