#!/usr/bin/env bash
# Deploy the engine runner to the worker VM (M17-4). Run from the repo root:
#   deploy/engine-runner/deploy.sh [host]
#
# exe.dev VMs have no scp, so the tree ships as tar-over-ssh: apps/server plus the pnpm
# workspace files the remote build needs (root manifest, lockfile, and every workspace
# package.json so the frozen-lockfile importer check passes). Idempotent: re-running replaces
# the shipped source, re-installs dependencies, rebuilds the runner bundle, (re)installs the
# unit, and restarts the service. The environment file is created once with a generated service
# token and the subscription OAuth token already on the VM; existing env files are left
# untouched.
set -euo pipefail

HOST="${1:-bloom-engine.exe.xyz}"
REMOTE="exedev@${HOST}"
APP_DIR="/home/exedev/bloom-engine-runner"

echo "==> shipping source to ${REMOTE}:${APP_DIR}"
# Clear the previously shipped source trees first so deleted files (and the retired runner
# implementation) don't linger, then extract the fresh subset.
git ls-files apps/server packages/config deploy/engine-runner \
  package.json pnpm-workspace.yaml pnpm-lock.yaml \
  'apps/*/package.json' 'packages/*/package.json' |
  sort -u | tar czf - -T - |
  ssh "${REMOTE}" "mkdir -p '${APP_DIR}' && rm -rf '${APP_DIR}/apps' '${APP_DIR}/packages' && tar xzf - -C '${APP_DIR}'"

ssh "${REMOTE}" bash -s <<'REMOTE_SCRIPT'
set -euo pipefail
APP_DIR="/home/exedev/bloom-engine-runner"
ENV_DIR="/home/exedev/.config/bloom-engine"
ENV_FILE="${ENV_DIR}/runner.env"

export PATH="$HOME/.local/bin:$PATH"
command -v node >/dev/null || { echo "error: node is required on the VM (the runner is a Node service)" >&2; exit 1; }
command -v corepack >/dev/null || { echo "error: corepack is required on the VM (it ships with Node)" >&2; exit 1; }
# corepack resolves pnpm from the workspace's packageManager pin; no global pnpm install.
export COREPACK_ENABLE_DOWNLOAD_PROMPT=0

echo "==> installing dependencies + building the runner bundle"
cd "${APP_DIR}"
corepack pnpm install --frozen-lockfile --filter bloom-server... >/dev/null
corepack pnpm --filter bloom-server build >/dev/null

# Environment file: create once; never overwrite (it holds the generated service token).
if [ ! -f "${ENV_FILE}" ]; then
  echo "==> creating ${ENV_FILE} (service token generated; oauth token from bootstrap file)"
  umask 077
  mkdir -p "${ENV_DIR}"
  {
    echo "BLOOM_RUNNER_TOKEN=$(openssl rand -hex 32)"
    echo "CLAUDE_CODE_OAUTH_TOKEN=$(cat "${ENV_DIR}/oauth-token")"
    echo "BLOOM_RUNNER_WORKSPACE_ROOT=/home/exedev/bloom-workspaces"
    echo "BLOOM_RUNNER_HOST=$(tailscale ip -4 2>/dev/null | head -1 || echo 127.0.0.1)"
    echo "BLOOM_RUNNER_PORT=8700"
  } > "${ENV_FILE}"
  chmod 600 "${ENV_FILE}"
fi

echo "==> installing systemd unit"
sudo cp "${APP_DIR}/deploy/engine-runner/bloom-engine-runner.service" /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now bloom-engine-runner
sudo systemctl restart bloom-engine-runner
sleep 2
sudo systemctl is-active bloom-engine-runner
REMOTE_SCRIPT

echo "==> deployed. Probe (from a tailnet peer):"
echo "    curl -H \"Authorization: Bearer \$TOKEN\" http://<tailscale-ip>:8700/health"