param(
    [string]$Hex = "build\merged.hex"
)

Set-StrictMode -Version Latest
$ErrorActionPreference = "Stop"

$RepoRoot = Split-Path -Parent $PSScriptRoot
$HexPath = Join-Path $RepoRoot $Hex

if (-not (Test-Path -LiteralPath $HexPath)) {
    throw "Hex file not found: $HexPath. Build the project first."
}

Write-Host "[FLASH] FULL ERASE + APPROTECT LOCK mode (production)"
Write-Host "[FLASH] This wipes application flash, NVS/settings, and BLE bonds."
Write-Host "[FLASH] After locking, SWD debug read/write is disabled permanently."
Write-Host "[FLASH] To unlock later you MUST run 'nrfjprog --recover', which mass-erases the chip."
Write-Host "[FLASH] DFU(SMP) over BLE still works after locking."
Write-Host "[FLASH] Programming: $HexPath"

# 1) 전체 지우고 서명된 펌웨어 프로그램
Write-Host "[FLASH] Step 1/3: chip erase + program + verify"
nrfjprog --program $HexPath --chiperase --verify --reset

# 2) UICR.APPROTECT 잠금 (SWD 디버그 포트 차단)
Write-Host "[FLASH] Step 2/3: enabling APPROTECT (readback protection)"
nrfjprog --rbp ALL

# 3) APPROTECT는 파워사이클/핀리셋 후 실제 적용됨
Write-Host "[FLASH] Step 3/3: pin reset to apply protection"
nrfjprog --pinreset

Write-Host "[FLASH] Done. POWER-CYCLE the device to fully latch APPROTECT."
Write-Host "[FLASH] Verify lock: 'nrfjprog --memrd 0x0' should now FAIL."