#!/usr/bin/env bash
set -euo pipefail

root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "${root}"

# Load Cloudflare deploy credentials from the founder's Vault by default, but never commit secrets.
# Override paths via EVERY_CHANNEL_CF_TOKEN_FILE / EVERY_CHANNEL_CF_ACCOUNT_FILE, or set env vars directly.
token_file="${EVERY_CHANNEL_CF_TOKEN_FILE:-$HOME/Vault/Secrets/ecp-cf-token.txt}"
account_file="${EVERY_CHANNEL_CF_ACCOUNT_FILE:-$HOME/Vault/Secrets/ecp-cf-account.txt}"

if [[ -z "${CLOUDFLARE_API_TOKEN:-}" && -f "${token_file}" ]]; then
  export CLOUDFLARE_API_TOKEN
  CLOUDFLARE_API_TOKEN="$(cat "${token_file}")"
fi

if [[ -z "${CLOUDFLARE_ACCOUNT_ID:-}" && -f "${account_file}" ]]; then
  export CLOUDFLARE_ACCOUNT_ID
  CLOUDFLARE_ACCOUNT_ID="$(cat "${account_file}")"
fi

if [[ -z "${CLOUDFLARE_API_TOKEN:-}" ]]; then
  echo "error: CLOUDFLARE_API_TOKEN is not set (set env var or provide ${token_file})" >&2
  exit 2
fi

./scripts/build-web.sh

cd deploy/cloudflare-worker
exec nix develop --accept-flake-config -c bash -lc 'npm ci && wrangler deploy'