#!/bin/bash
# Render deploy/ai-atlas.mld.json with the real secrets and push it to the mld gateway (M1M32:~/dispatch/apps/).
# Usage: deploy/render-manifest.sh [--push]
# Secrets (git-ignored): deploy/.admin-token (generated if missing), deploy/.llm-key (llm-api.io API key for the LLM factory; optional).
set -euo pipefail
cd "$(dirname "$0")/.."
TOKEN_FILE=deploy/.admin-token
LLM_FILE=deploy/.llm-key
[ -s "$TOKEN_FILE" ] || { openssl rand -hex 24 > "$TOKEN_FILE"; echo "generated $TOKEN_FILE"; }
TOKEN=$(tr -d '\n' < "$TOKEN_FILE")
LLM_KEY=""
[ -s "$LLM_FILE" ] && LLM_KEY=$(tr -d '\n' < "$LLM_FILE") || echo "warning: $LLM_FILE missing — LLM factory disabled in production"
mkdir -p deploy/rendered
sed -e "s/{{ADMIN_TOKEN}}/$TOKEN/g" -e "s#{{LLM_KEY}}#$LLM_KEY#g" deploy/ai-atlas.mld.json > deploy/rendered/ai-atlas.json
python3 -c "import json; json.load(open('deploy/rendered/ai-atlas.json')); print('manifest ok')"
if [ "${1:-}" = "--push" ]; then
  scp -q deploy/rendered/ai-atlas.json M1M32:~/dispatch/apps/ai-atlas.json
  ssh M1M32 'chmod 600 ~/dispatch/apps/ai-atlas.json && echo "pushed to M1M32:~/dispatch/apps/ai-atlas.json"'
fi