set -e

APP_BUNDLE_PATH="$1"

VERSION="$2"

ARCH="$3"

if [ -z "$APP_BUNDLE_PATH" ] || [ -z "$VERSION" ] || [ -z "$ARCH" ]; then

echo "Usage: $0 <app_bundle_path> <version> <arch>"

echo "Example: $0 ./pkg_temp/pkg_root/Applications/mcpproxy.app v1.0.0 arm64"

exit 1

if [ ! -d "$APP_BUNDLE_PATH" ]; then

echo "App bundle not found: $APP_BUNDLE_PATH"

exit 1

APP_NAME=$(basename "$APP_BUNDLE_PATH" .app)

DMG_NAME="mcpproxy-${VERSION#v}-darwin-${ARCH}-installer"

TEMP_DIR="dmg_app_temp"

echo "Creating app DMG for ${APP_NAME} ${VERSION} (${ARCH})"

rm -rf "$TEMP_DIR"

rm -f "${DMG_NAME}.dmg"

mkdir -p "$TEMP_DIR"

echo "Copying app bundle: $APP_BUNDLE_PATH"

cp -R "$APP_BUNDLE_PATH" "$TEMP_DIR/"

cat > "$TEMP_DIR/README.txt" << EOF

ln -s /Applications "$TEMP_DIR/Applications"

sync

sleep 2

echo "Creating DMG..."

hdiutil create -size 100m -fs HFS+ -volname "Smart MCP Proxy ${VERSION#v}" -srcfolder "$TEMP_DIR" "${DMG_NAME}.dmg"

rm -rf "$TEMP_DIR"

echo "DMG created: ${DMG_NAME}.dmg"

echo "Compressing DMG..."

hdiutil convert "${DMG_NAME}.dmg" -format UDZO -o "${DMG_NAME}-compressed.dmg"

mv "${DMG_NAME}-compressed.dmg" "${DMG_NAME}.dmg"

echo "Signing DMG..."

if [ -n "${APP_CERT_IDENTITY}" ] && [ "${APP_CERT_IDENTITY}" != "" ]; then

CERT_IDENTITY="${APP_CERT_IDENTITY}"

echo "✅ Using provided certificate for DMG: ${CERT_IDENTITY}"

# Fallback to ad-hoc signing

CERT_IDENTITY="-"

echo "Using ad-hoc signature for DMG (development build)"

codesign --force \

--sign "${CERT_IDENTITY}" \

"${DMG_NAME}.dmg"

echo "=== Verifying DMG signature ==="

codesign --verify --verbose "${DMG_NAME}.dmg" || echo "⚠️ Ad-hoc signed (expected for development)"

echo "✅ DMG created successfully: ${DMG_NAME}.dmg"