#!/bin/bash -p
builtin set +vx
# Keep service-account credentials shell-local until the 1Password loader
# moves them into its owner-private handoff. The privileged entrypoint's
# function/environment scrub must not expose raw tokens to subprocesses.
for raw_service_credential in OP_SERVICE_ACCOUNT_TOKEN MOLTY_OP_SERVICE_ACCOUNT_TOKEN; do
  if [[ -n "${!raw_service_credential+x}" ]]; then
    builtin export -n "$raw_service_credential" || builtin exit 1
  fi
done
builtin unset raw_service_credential
entry_requires_service_custody=false
for required_entry_value in OP_SERVICE_ACCOUNT_TOKEN MOLTY_OP_SERVICE_ACCOUNT_TOKEN; do
  [[ -z "${!required_entry_value+x}" ]] || entry_requires_service_custody=true
done
builtin unset required_entry_value
MAC_RELEASE_CALLER_PATH=${MAC_RELEASE_CALLER_PATH:-${PATH:-/usr/bin:/bin}}
builtin export MAC_RELEASE_CALLER_PATH
PATH=/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin
builtin export PATH
raw_function_names_file=$(/usr/bin/mktemp /tmp/peekaboo-functions.XXXXXX) || builtin exit 1
/usr/bin/env -0 | /usr/bin/env -i /usr/bin/perl -0ne '
  if (index($_, "BASH_FUNC_") == 0) { my ($name) = split(/=/, $_, 2); print $name, chr(0); }
' > "$raw_function_names_file"
raw_function_scan_status=("${PIPESTATUS[@]}")
if [[ ${raw_function_scan_status[0]} -ne 0 || ${raw_function_scan_status[1]} -ne 0 ]]; then
  /bin/rm -f "$raw_function_names_file"
  /bin/echo 'Could not inspect exported-function environment safely.' >&2
  builtin exit 1
fi
raw_function_scrub_args=()
while IFS= read -r -d '' raw_function_name; do
  [[ -n "$raw_function_name" ]] || { /bin/rm -f "$raw_function_names_file"; builtin exit 1; }
  raw_function_scrub_args+=(-u "$raw_function_name")
done < "$raw_function_names_file"
/bin/rm -f "$raw_function_names_file"
if (("${#raw_function_scrub_args[@]}" > 0)); then
  if [[ "$entry_requires_service_custody" == true ]]; then
    /bin/echo 'Service-token invocation refuses an exported-function environment.' >&2
    builtin exit 1
  fi
  builtin exec /usr/bin/env "${raw_function_scrub_args[@]}" \
    -u BASH_ENV -u ENV -u CDPATH -u GLOBIGNORE \
    PATH=/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin \
    /bin/bash -p "${BASH_SOURCE[0]}" "$@"
fi
for imported_function in $(builtin compgen -A function); do
  builtin unset -f -- "$imported_function"
done
builtin unset BASH_ENV ENV CDPATH GLOBIGNORE 2>/dev/null || true
builtin set +p
builtin set -euo pipefail

source_path=${BASH_SOURCE[0]}
case "$source_path" in
  */*) source_directory=${source_path%/*}; [[ -n "$source_directory" ]] || source_directory=/ ;;
  *) source_directory=. ;;
esac
SCRIPT_DIR=$(builtin cd "$source_directory" && builtin pwd -P)
# shellcheck source=/Users/steipete/Projects/agent-scripts/skills/release-mac-app/scripts/lib/mac_release.sh
source "$SCRIPT_DIR/lib/mac_release.sh"

cmd=${1:-status}
shift || true

case "$cmd" in
  status)
    mac_release_status "$@"
    ;;
  notes|generate-release-notes)
    mac_release_load
    version=${1:-$MARKETING_VERSION}
    out=${2:-}
    if [[ -z "$out" ]]; then
      tmp=$(mktemp "/tmp/${APP_NAME}-notes.XXXXXX")
      extract_notes_from_changelog "$version" "$tmp"
      cat "$tmp"
      rm -f "$tmp"
    else
      extract_notes_from_changelog "$version" "$out"
    fi
    ;;
  changelog-html|changelog-to-html)
    mac_release_changelog_html "$@"
    ;;
  make-appcast|appcast)
    mac_release_make_appcast "$@"
    ;;
  verify-appcast)
    mac_release_verify_appcast "$@"
    ;;
  check-assets)
    mac_release_load
    check_assets "${1:-$(git describe --tags --abbrev=0)}" "$ARTIFACT_PREFIX"
    ;;
  sparkle-key-status)
    mac_release_sparkle_key_status "$@"
    ;;
  codesign-run)
    mac_release_codesign_run "$@"
    ;;
  package-run)
    mac_release_package_run "$@"
    ;;
  --public-key)
    mac_release_load
    mac_release_public_key_for_source "${1:-keychain}"
    ;;
  --expected-public-key)
    mac_release_expected_public_key
    ;;
  release)
    mac_release_release "$@"
    ;;
  *)
    cat >&2 <<'EOF'
Usage: mac-release <command>

Commands:
  status
  notes [version] [output.md]
  changelog-html <version> [CHANGELOG.md]
  make-appcast <zip> [feed-url]
  verify-appcast [version]
  check-assets [tag]
  sparkle-key-status [keychain|/path/to/key]
  codesign-run [--with-package-secrets] -- <command> [args...]
  package-run -- <command> [args...]
  release
EOF
    exit 2
    ;;
esac
