#!/usr/bin/env bash
# Sentinel Linux Public Conversion Master
# Final: Phase 99 release evidence and ISO input gate.
set -Eeuo pipefail
IFS=$'\n\t'

readonly PROGRAM_NAME="sentinelos-public-convert"
readonly MASTER_VERSION="1.0.18-final"
export MASTER_VERSION
readonly SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
readonly CONFIG_FILE="$SCRIPT_DIR/config/conversion.conf"
readonly COMMON_LIB="$SCRIPT_DIR/lib/common.sh"
readonly PHASE_MANIFEST="$SCRIPT_DIR/manifests/phases.tsv"

[[ -r "$CONFIG_FILE" ]] || {
  printf 'ERROR: missing configuration: %s\n' "$CONFIG_FILE" >&2
  exit 2
}
[[ -r "$COMMON_LIB" ]] || {
  printf 'ERROR: missing common library: %s\n' "$COMMON_LIB" >&2
  exit 2
}

# shellcheck source=/dev/null
source "$CONFIG_FILE"
# shellcheck source=/dev/null
source "$COMMON_LIB"

TARGET_USER=""
WITH_AEGIS="$DEFAULT_WITH_AEGIS"
MODE=""
FROM_PHASE=""
TO_PHASE=""
DRY_RUN=0
RESUME=0
VERBOSE=0

usage() {
  cat <<'EOF'
Sentinel Linux Public Conversion Master — Final Release Gate

Usage:
  sentinelos-public-convert --plan [OPTIONS]
  sentinelos-public-convert --validate
  sudo sentinelos-public-convert --phase-99 --target-user USER [OPTIONS]

Modes:
  --plan
  --validate
  --preflight
  --phase-2
  --foundation
  --phase-3
  --phase-4
  --phase-5
  --phase-6
  --phase-7
  --phase-99
  --release-audit
  --drift-audit
  --drift-cleanup
  --drift-rollback
  --identity-rollback
  --hardening-rollback

Options:
  --target-user USER
  --with-aegis
  --without-aegis
  --from PHASE
  --to PHASE
  --dry-run
  --resume
  --verbose
  --version
  --help

Phase 99 performs the read-only final release decision, preserves complete
evidence and generates the exact ISO build-input manifest. It performs no
automatic remediation and does not build the ISO itself.
EOF
}

while (($#)); do
  case "$1" in
    --plan|--validate|--preflight|--phase-2|--foundation|--phase-3|--phase-4|--phase-5|--phase-6|--phase-7|--phase-99|--release-audit|--drift-audit|--drift-cleanup|--drift-rollback|--identity-rollback|--hardening-rollback)
      [[ -z "$MODE" ]] || die "choose only one mode"
      MODE="${1#--}"
      [[ "$MODE" == "foundation" ]] && MODE="phase-2"
      shift
      ;;
    --target-user)
      (($# >= 2)) || die "--target-user requires a username"
      TARGET_USER="$2"
      shift 2
      ;;
    --with-aegis)
      WITH_AEGIS=1
      shift
      ;;
    --without-aegis)
      WITH_AEGIS=0
      shift
      ;;
    --from)
      (($# >= 2)) || die "--from requires a phase number"
      FROM_PHASE="$2"
      shift 2
      ;;
    --to)
      (($# >= 2)) || die "--to requires a phase number"
      TO_PHASE="$2"
      shift 2
      ;;
    --dry-run)
      DRY_RUN=1
      shift
      ;;
    --resume)
      RESUME=1
      shift
      ;;
    --verbose)
      VERBOSE=1
      shift
      ;;
    --version)
      printf '%s %s\n' "$PROGRAM_NAME" "$MASTER_VERSION"
      exit 0
      ;;
    --help|-h)
      usage
      exit 0
      ;;
    *)
      die "unknown argument: $1"
      ;;
  esac
done

[[ -n "$MODE" ]] || {
  usage
  exit 2
}

export SENTINELOS_CONVERSION_ROOT="$SCRIPT_DIR"
export SENTINELOS_TARGET_USER="$TARGET_USER"
export SENTINELOS_WITH_AEGIS="$WITH_AEGIS"
export SENTINELOS_DRY_RUN="$DRY_RUN"
export SENTINELOS_RESUME="$RESUME"
export SENTINELOS_VERBOSE="$VERBOSE"

case "$MODE" in
  plan)
    print_banner "Sentinel Linux Public Conversion Plan"
    print_phase_plan "$PHASE_MANIFEST" "$WITH_AEGIS" "$FROM_PHASE" "$TO_PHASE"
    ;;
  validate)
    print_banner "Sentinel Linux Final Release Validation"
    exec "$SCRIPT_DIR/tools/validate_phase_99.sh"
    ;;
  preflight)
    require_root
    [[ -n "$TARGET_USER" ]] || die "--preflight requires --target-user USER"
    init_runtime_paths
    acquire_conversion_lock
    start_log "phase-00-preflight"
    trap 'release_conversion_lock' EXIT
    run_phase_script "$SCRIPT_DIR/phases/00_preflight.sh"
    ;;
  phase-2)
    require_root
    [[ -n "$TARGET_USER" ]] || die "--phase-2 requires --target-user USER"
    init_runtime_paths
    acquire_conversion_lock
    start_log "phase-2-foundation"
    trap 'release_conversion_lock' EXIT
    run_foundation_phase 00 "$SCRIPT_DIR/phases/00_preflight.sh"
    run_foundation_phase 10 "$SCRIPT_DIR/phases/10_repository_bootstrap.sh"
    run_foundation_phase 12 "$SCRIPT_DIR/phases/12_repository_key_rotation.sh"
    run_foundation_phase 15 "$SCRIPT_DIR/phases/15_repository_contract.sh"
    run_foundation_phase 20 "$SCRIPT_DIR/phases/20_base_mate_packages.sh"
    print_banner "Phase 2 Complete"
    pass "repository trust and Debian/MATE foundation established"
    ;;
  phase-3)
    require_root
    [[ -n "$TARGET_USER" ]] || die "--phase-3 requires --target-user USER"
    init_runtime_paths
    acquire_conversion_lock
    start_log "phase-3-policy-as-packages"
    trap 'release_conversion_lock' EXIT
    run_foundation_phase 00 "$SCRIPT_DIR/phases/00_preflight.sh"
    run_foundation_phase 10 "$SCRIPT_DIR/phases/10_repository_bootstrap.sh"
    run_foundation_phase 12 "$SCRIPT_DIR/phases/12_repository_key_rotation.sh"
    run_foundation_phase 15 "$SCRIPT_DIR/phases/15_repository_contract.sh"
    run_foundation_phase 20 "$SCRIPT_DIR/phases/20_base_mate_packages.sh"
    run_foundation_phase 30 "$SCRIPT_DIR/phases/30_sentinel_base_hardening.sh"
    print_banner "Phase 3 Complete"
    pass "package-owned Sentinel Base hardening established"
    ;;
  phase-4)
    require_root
    [[ -n "$TARGET_USER" ]] || die "--phase-4 requires --target-user USER"
    init_runtime_paths
    acquire_conversion_lock
    start_log "phase-4-desktop-policy-packages"
    trap 'release_conversion_lock' EXIT
    run_foundation_phase 00 "$SCRIPT_DIR/phases/00_preflight.sh"
    run_foundation_phase 10 "$SCRIPT_DIR/phases/10_repository_bootstrap.sh"
    run_foundation_phase 12 "$SCRIPT_DIR/phases/12_repository_key_rotation.sh"
    run_foundation_phase 15 "$SCRIPT_DIR/phases/15_repository_contract.sh"
    run_foundation_phase 20 "$SCRIPT_DIR/phases/20_base_mate_packages.sh"
    run_foundation_phase 30 "$SCRIPT_DIR/phases/30_sentinel_base_hardening.sh"
    run_foundation_phase 40 "$SCRIPT_DIR/phases/40_desktop_theme_baseline.sh"
    run_foundation_phase 50 "$SCRIPT_DIR/phases/50_icon_branding_baseline.sh"
    run_foundation_phase 60 "$SCRIPT_DIR/phases/60_menu_panel_baseline.sh"
    run_foundation_phase 65 "$SCRIPT_DIR/phases/65_cursor_baseline_v1_1.sh"
    run_foundation_phase 66 "$SCRIPT_DIR/phases/66_verify_base_desktop_identity.sh"
    print_banner "Phase 4 Complete"
    pass "base Sentinel Linux desktop identity established"
    ;;
  phase-5)
    require_root
    [[ -n "$TARGET_USER" ]] || die "--phase-5 requires --target-user USER"
    init_runtime_paths
    acquire_conversion_lock
    start_log "phase-5-public-desktop-suite"
    trap 'release_conversion_lock' EXIT
    run_foundation_phase 00 "$SCRIPT_DIR/phases/00_preflight.sh"
    run_foundation_phase 10 "$SCRIPT_DIR/phases/10_repository_bootstrap.sh"
    run_foundation_phase 12 "$SCRIPT_DIR/phases/12_repository_key_rotation.sh"
    run_foundation_phase 15 "$SCRIPT_DIR/phases/15_repository_contract.sh"
    run_foundation_phase 20 "$SCRIPT_DIR/phases/20_base_mate_packages.sh"
    run_foundation_phase 30 "$SCRIPT_DIR/phases/30_sentinel_base_hardening.sh"
    run_foundation_phase 40 "$SCRIPT_DIR/phases/40_desktop_theme_baseline.sh"
    run_foundation_phase 50 "$SCRIPT_DIR/phases/50_icon_branding_baseline.sh"
    run_foundation_phase 60 "$SCRIPT_DIR/phases/60_menu_panel_baseline.sh"
    run_foundation_phase 65 "$SCRIPT_DIR/phases/65_cursor_baseline_v1_1.sh"
    run_foundation_phase 66 "$SCRIPT_DIR/phases/66_verify_base_desktop_identity.sh"
    run_foundation_phase 70 "$SCRIPT_DIR/phases/70_public_desktop_suite.sh"
    print_banner "Phase 5 Complete"
    pass "complete public Sentinel Desktop Suite established"
    ;;
  phase-6)
    require_root
    [[ -n "$TARGET_USER" ]] || die "--phase-6 requires --target-user USER"
    init_runtime_paths
    acquire_conversion_lock
    start_log "phase-6-login-boot-release-identity"
    trap 'release_conversion_lock' EXIT
    run_foundation_phase 00 "$SCRIPT_DIR/phases/00_preflight.sh"
    run_foundation_phase 10 "$SCRIPT_DIR/phases/10_repository_bootstrap.sh"
    run_foundation_phase 12 "$SCRIPT_DIR/phases/12_repository_key_rotation.sh"
    run_foundation_phase 15 "$SCRIPT_DIR/phases/15_repository_contract.sh"
    run_foundation_phase 20 "$SCRIPT_DIR/phases/20_base_mate_packages.sh"
    run_foundation_phase 30 "$SCRIPT_DIR/phases/30_sentinel_base_hardening.sh"
    run_foundation_phase 40 "$SCRIPT_DIR/phases/40_desktop_theme_baseline.sh"
    run_foundation_phase 50 "$SCRIPT_DIR/phases/50_icon_branding_baseline.sh"
    run_foundation_phase 60 "$SCRIPT_DIR/phases/60_menu_panel_baseline.sh"
    run_foundation_phase 65 "$SCRIPT_DIR/phases/65_cursor_baseline_v1_1.sh"
    run_foundation_phase 66 "$SCRIPT_DIR/phases/66_verify_base_desktop_identity.sh"
    run_foundation_phase 70 "$SCRIPT_DIR/phases/70_public_desktop_suite.sh"
    run_foundation_phase 80 "$SCRIPT_DIR/phases/80_login_boot_branding.sh"
    run_foundation_phase 85 "$SCRIPT_DIR/phases/85_desktop_boot_hotfix.sh"
    print_banner "Phase 6 Complete"
    pass "LightDM, boot and Sentinel Linux release identity established"
    ;;
  phase-7)
    require_root
    [[ -n "$TARGET_USER" ]] || die "--phase-7 requires --target-user USER"
    init_runtime_paths
    acquire_conversion_lock
    start_log "phase-7-cleanup-drift-controls"
    trap 'release_conversion_lock' EXIT
    run_foundation_phase 00 "$SCRIPT_DIR/phases/00_preflight.sh"
    run_foundation_phase 10 "$SCRIPT_DIR/phases/10_repository_bootstrap.sh"
    run_foundation_phase 12 "$SCRIPT_DIR/phases/12_repository_key_rotation.sh"
    run_foundation_phase 15 "$SCRIPT_DIR/phases/15_repository_contract.sh"
    run_foundation_phase 20 "$SCRIPT_DIR/phases/20_base_mate_packages.sh"
    run_foundation_phase 30 "$SCRIPT_DIR/phases/30_sentinel_base_hardening.sh"
    run_foundation_phase 40 "$SCRIPT_DIR/phases/40_desktop_theme_baseline.sh"
    run_foundation_phase 50 "$SCRIPT_DIR/phases/50_icon_branding_baseline.sh"
    run_foundation_phase 60 "$SCRIPT_DIR/phases/60_menu_panel_baseline.sh"
    run_foundation_phase 65 "$SCRIPT_DIR/phases/65_cursor_baseline_v1_1.sh"
    run_foundation_phase 66 "$SCRIPT_DIR/phases/66_verify_base_desktop_identity.sh"
    run_foundation_phase 70 "$SCRIPT_DIR/phases/70_public_desktop_suite.sh"
    run_foundation_phase 80 "$SCRIPT_DIR/phases/80_login_boot_branding.sh"
    run_foundation_phase 85 "$SCRIPT_DIR/phases/85_desktop_boot_hotfix.sh"
    run_foundation_phase 90 "$SCRIPT_DIR/phases/90_cleanup_and_drift_lock.sh"
    print_banner "Phase 7 Complete"
    pass "safe cleanup, coherent release lock and drift controls established"
    ;;
  phase-99)
    require_root
    [[ -n "$TARGET_USER" ]] || die "--phase-99 requires --target-user USER"
    init_runtime_paths
    acquire_conversion_lock
    start_log "phase-99-final-release-gate"
    trap 'release_conversion_lock' EXIT
    run_foundation_phase 00 "$SCRIPT_DIR/phases/00_preflight.sh"
    run_foundation_phase 10 "$SCRIPT_DIR/phases/10_repository_bootstrap.sh"
    run_foundation_phase 12 "$SCRIPT_DIR/phases/12_repository_key_rotation.sh"
    run_foundation_phase 15 "$SCRIPT_DIR/phases/15_repository_contract.sh"
    run_foundation_phase 20 "$SCRIPT_DIR/phases/20_base_mate_packages.sh"
    run_foundation_phase 30 "$SCRIPT_DIR/phases/30_sentinel_base_hardening.sh"
    run_foundation_phase 40 "$SCRIPT_DIR/phases/40_desktop_theme_baseline.sh"
    run_foundation_phase 50 "$SCRIPT_DIR/phases/50_icon_branding_baseline.sh"
    run_foundation_phase 60 "$SCRIPT_DIR/phases/60_menu_panel_baseline.sh"
    run_foundation_phase 65 "$SCRIPT_DIR/phases/65_cursor_baseline_v1_1.sh"
    run_foundation_phase 66 "$SCRIPT_DIR/phases/66_verify_base_desktop_identity.sh"
    run_foundation_phase 70 "$SCRIPT_DIR/phases/70_public_desktop_suite.sh"
    run_foundation_phase 80 "$SCRIPT_DIR/phases/80_login_boot_branding.sh"
    run_foundation_phase 85 "$SCRIPT_DIR/phases/85_desktop_boot_hotfix.sh"
    run_foundation_phase 90 "$SCRIPT_DIR/phases/90_cleanup_and_drift_lock.sh"
    run_foundation_phase 99 "$SCRIPT_DIR/phases/99_final_release_verification.sh"
    print_banner "Sentinel Linux Conversion Complete"
    pass "Sentinel Linux v1.0 AMBROSO final release gate passed"
    ;;
  release-audit)
    init_runtime_paths
    command -v "$FINAL_RELEASE_GATE_COMMAND" >/dev/null 2>&1 ||
      die "final release-gate command unavailable: $FINAL_RELEASE_GATE_COMMAND"
    "$FINAL_RELEASE_GATE_COMMAND" --verify --json
    ;;
  drift-audit)
    init_runtime_paths
    command -v "$DRIFT_CONTROL_COMMAND" >/dev/null 2>&1 ||
      die "drift command unavailable: $DRIFT_CONTROL_COMMAND"
    "$DRIFT_CONTROL_COMMAND" --audit --json
    ;;
  drift-cleanup)
    require_root
    init_runtime_paths
    acquire_conversion_lock
    start_log "phase-90-safe-cleanup"
    trap 'release_conversion_lock' EXIT
    command -v "$DRIFT_CONTROL_COMMAND" >/dev/null 2>&1 ||
      die "drift command unavailable: $DRIFT_CONTROL_COMMAND"
    "$DRIFT_CONTROL_COMMAND" --cleanup
    ;;
  drift-rollback)
    require_root
    init_runtime_paths
    acquire_conversion_lock
    start_log "phase-90-drift-rollback"
    trap 'release_conversion_lock' EXIT
    systemctl disable --now "$DRIFT_AUDIT_TIMER" >/dev/null 2>&1 || true
    DEBIAN_FRONTEND=noninteractive apt-get remove -y \
      "$PKG_RELEASE_GATE" "$PKG_RELEASE_BASELINE" "$PKG_DRIFT_CONTROL"
    rm -f "$STATE_ROOT/phase-90.complete"
    pass "Phase 90 policy packages removed; component packages were retained"
    ;;
  identity-rollback)
    require_root
    init_runtime_paths
    acquire_conversion_lock
    start_log "phase-80-identity-rollback"
    trap 'release_conversion_lock' EXIT
    command -v "$LOGIN_BOOT_IDENTITY_COMMAND" >/dev/null 2>&1 ||
      die "identity rollback command unavailable: $LOGIN_BOOT_IDENTITY_COMMAND"
    if package_installed "$PKG_NAME_TRANSITION"; then
      DEBIAN_FRONTEND=noninteractive apt-get remove -y "$PKG_NAME_TRANSITION"
    fi
    "$LOGIN_BOOT_IDENTITY_COMMAND" --restore
    rm -f "$STATE_ROOT/phase-80.complete"
    pass "Phase 80 release identity restored to the recorded pre-conversion state"
    ;;
  hardening-rollback)
    require_root
    init_runtime_paths
    acquire_conversion_lock
    start_log "phase-30-hardening-rollback"
    trap 'release_conversion_lock' EXIT
    run_phase_script "$SCRIPT_DIR/phases/30_restore_sentinel_base_hardening.sh"
    ;;
esac
