#!/bin/bash -p
builtin set +vx
# Keep service-account credentials shell-local while resolving the trusted
# release helper. Re-export them only for the exact helper exec below.
for raw_service_credential in OP_SERVICE_ACCOUNT_TOKEN MOLTY_OP_SERVICE_ACCOUNT_TOKEN; do
  if [[ -n "${!raw_service_credential+x}" ]]; then
    builtin export -n "$raw_service_credential" || builtin exit 1
  fi
done
builtin unset raw_service_credential
entry_requires_service_custody=false
for required_entry_value in OP_SERVICE_ACCOUNT_TOKEN MOLTY_OP_SERVICE_ACCOUNT_TOKEN; do
  [[ -z "${!required_entry_value+x}" ]] || entry_requires_service_custody=true
done
builtin unset required_entry_value
PATH=/usr/bin:/bin
builtin export PATH
raw_function_names_file=$(/usr/bin/mktemp /tmp/peekaboo-functions.XXXXXX) || builtin exit 1
/usr/bin/env -0 | /usr/bin/env -i /usr/bin/perl -0ne '
  if (index($_, "BASH_FUNC_") == 0) { my ($name) = split(/=/, $_, 2); print $name, chr(0); }
' > "$raw_function_names_file"
raw_function_scan_status=("${PIPESTATUS[@]}")
if [[ ${raw_function_scan_status[0]} -ne 0 || ${raw_function_scan_status[1]} -ne 0 ]]; then
  /bin/rm -f "$raw_function_names_file"
  /bin/echo 'Could not inspect exported-function environment safely.' >&2
  builtin exit 1
fi
raw_function_scrub_args=()
while IFS= read -r -d '' raw_function_name; do
  [[ -n "$raw_function_name" ]] || { /bin/rm -f "$raw_function_names_file"; builtin exit 1; }
  raw_function_scrub_args+=(-u "$raw_function_name")
done < "$raw_function_names_file"
/bin/rm -f "$raw_function_names_file"
if (("${#raw_function_scrub_args[@]}" > 0)); then
  if [[ "$entry_requires_service_custody" == true ]]; then
    /bin/echo 'Service-token invocation refuses an exported-function environment.' >&2
    builtin exit 1
  fi
  builtin exec /usr/bin/env "${raw_function_scrub_args[@]}" \
    -u BASH_ENV -u ENV -u CDPATH -u GLOBIGNORE \
    PATH=/usr/bin:/bin \
    /bin/bash -p "${BASH_SOURCE[0]}" "$@"
fi
for imported_function in $(builtin compgen -A function); do
  builtin unset -f -- "$imported_function"
done
builtin unset BASH_ENV ENV CDPATH GLOBIGNORE 2>/dev/null || true
builtin set +p

builtin set -euo pipefail

source_path=${BASH_SOURCE[0]}
case "$source_path" in
  */*) source_directory=${source_path%/*}; [[ -n "$source_directory" ]] || source_directory=/ ;;
  *) source_directory=. ;;
esac
SCRIPT_DIR=$(builtin cd "$source_directory" && builtin pwd -P)
ROOT=$(cd "$SCRIPT_DIR/.." && pwd)
cd "$ROOT"

exec_release_helper() {
  candidate=$1
  if [[ -n "${MAC_RELEASE_EXPECTED_HELPER_COMMIT:-}" ]]; then
    helper_repo=$(/usr/bin/git -C "$(dirname "$candidate")" rev-parse --show-toplevel) || builtin exit 1
    [[ "$(/usr/bin/git -C "$helper_repo" rev-parse HEAD)" == "$MAC_RELEASE_EXPECTED_HELPER_COMMIT" &&
       -z "$(/usr/bin/git -C "$helper_repo" status --porcelain --untracked-files=no)" ]] || {
      /bin/echo 'Release helper differs from the frozen release plan.' >&2
      builtin exit 1
    }
    helper_executable_sha=$(/usr/bin/shasum -a 256 "$candidate" | /usr/bin/awk '{print $1}')
    helper_library_sha=$(/usr/bin/shasum -a 256 "$(dirname "$candidate")/lib/mac_release.sh" |
      /usr/bin/awk '{print $1}')
    [[ "$helper_executable_sha" == "${MAC_RELEASE_EXPECTED_HELPER_EXECUTABLE_SHA256:?}" &&
       "$helper_library_sha" == "${MAC_RELEASE_EXPECTED_HELPER_LIBRARY_SHA256:?}" ]] || {
      /bin/echo 'Release helper hashes differ from the frozen release plan.' >&2
      builtin exit 1
    }
  fi
  for raw_service_credential in OP_SERVICE_ACCOUNT_TOKEN MOLTY_OP_SERVICE_ACCOUNT_TOKEN; do
    if [[ -n "${!raw_service_credential+x}" ]]; then
      builtin export "$raw_service_credential"
    fi
  done
  builtin unset raw_service_credential
  builtin unset candidate helper_repo helper_executable_sha helper_library_sha
  builtin exec "$@"
}

if [[ -n "${MAC_RELEASE_TOOL:-}" ]]; then
  exec_release_helper "$MAC_RELEASE_TOOL" "$@"
fi

for candidate in \
  "$ROOT/../agent-scripts/skills/release-mac-app/scripts/mac-release" \
  "$HOME/Projects/agent-scripts/skills/release-mac-app/scripts/mac-release"; do
  if [[ -x "$candidate" ]]; then
    exec_release_helper "$candidate" "$@"
  fi
done

cat >&2 <<'EOF'
Missing mac-release helper.
Clone agent-scripts next to this repo or set MAC_RELEASE_TOOL=/path/to/mac-release.
EOF
exit 127
