#!/bin/bash
# cayce-autodeploy — r18: despliega main nuevo SIN intervención del operador.
#   ~/cayce-ops        → git pull de main (docs, prompts; el despliegue lee el tree)
#   /srv/cayce-core    → checkout de cayce/entity main, con PUBLISH_OFF activo
#                        durante el swap. Solo se retira si: tests del guard
#                        27+/27 y watcher sin VIOLACION. Rollback automatico.
# Timer: cada 3 min. Fallo → DM al supervisor + logger. Nunca toca un tree sucio.

say() { echo "[autodeploy] $*"; logger -t cayce-autodeploy "$*"; }
dm() {
  SUP=$(grep -aoE 'SUPERVISOR_NPUB_HEX=[0-9a-f]+' /srv/cayce-nostr/.env 2>/dev/null | cut -d= -f2)
  [ -n "$SUP" ] && curl -s -X POST http://127.0.0.1:3011/dm -H "Content-Type: application/json" \
    -d "{\"to_hex\":\"$SUP\",\"content\":\"AUTODEPLOY: $1\"}" >/dev/null 2>&1
}

# r31 (S1): lock compartido con cayce-auto-merge — nunca compiten sobre los
# mismos arboles/branches (incidente 02:06:29Z del 2026-11-03: un rollback
# `git reset --hard $OLD` pisó una rama de trabajo porque el árbol cambió de
# branch a mitad de deploy). Las ops manuales con git sobre /srv/* tambien
# lo toman: flock /run/lock/cayce-git-ops.lock <comando>
LOCK=/run/lock/cayce-git-ops.lock
exec 9>"$LOCK" || { say 'FATAL: no se puede abrir lockfile'; exit 1; }
if ! flock -n 9; then
  say "auto-merge (u otra op) mantiene el lock — paso de este ciclo"
  exit 0
fi

# ── 1. cayce-ops (main) ──────────────────────────────────────────────────────
cd /home/ubuntu/cayce-ops || { say "FATAL: sin ~/cayce-ops"; exit 1; }
git fetch -q origin 2>/dev/null
if [ "$(git branch --show-current)" = "main" ] && ! git merge-base --is-ancestor origin/main HEAD 2>/dev/null; then
  if [ -n "$(git status --porcelain)" ]; then
    say "ABORT: cayce-ops tree sucio"; dm "abortado: cayce-ops dirty"
  elif git pull -q --ff-only origin main; then
    say "cayce-ops → $(git rev-parse --short HEAD)"
  # r21: sin DM (no urgente) — dm "cayce-ops actualizado a $(git rev-parse --short HEAD)"
  else
    say "ERROR: pull cayce-ops"; dm "error pull cayce-ops"
  fi
fi

# ── 2. entity → /srv/cayce-core (con regla de urgencia) ──────────────────────
cd /srv/cayce-core || { say "FATAL: sin /srv/cayce-core"; exit 1; }
git fetch -q origin 2>/dev/null
# desplegar solo si main tiene commits que NO estan en el checkout
# r20: sin exit 0 — mataba el script y la sección bitcoinhotels nunca corría
if ! git merge-base --is-ancestor origin/main HEAD 2>/dev/null; then
# r25: lessons.md lo muta el ciclo retro en produccion — preservar (stash/pop).
# Cualquier OTRO fichero sucio si aborta.
DIRTY_OTHER=$(git status --porcelain | grep -v " lessons.md" | head -3)
if [ -n "$DIRTY_OTHER" ]; then
  say "ABORT: /srv/cayce-core tree sucio: $DIRTY_OTHER"; dm "abortado: /srv/cayce-core dirty ($DIRTY_OTHER) — deploy pendiente"
  exit 1
fi
git stash push -q -m "autodeploy-lessons" -- lessons.md 2>/dev/null || true

OLD=$(git rev-parse HEAD)
echo "autodeploy $(date -u +%FT%TZ)" > PUBLISH_OFF   # r21: firmado para que urgent-watch no lo tome por manual
say "main nuevo detectado: $(git rev-parse --short HEAD) → $(git rev-parse --short origin/main) (PUBLISH_OFF activo)"

if ! git checkout -q main || ! git reset -q --hard origin/main; then
  git reset -q --hard "$OLD" 2>/dev/null; rm -f PUBLISH_OFF
  say "FATAL: checkout entity"; dm "FATAL checkout entity — deploy cancelado, sin cambios"
  exit 1
fi

# verificación 1: tests del guard
OUT=$(cd /srv/cayce-core && node --test guard.test.mjs 2>&1)
PASS=$(echo "$OUT" | grep -c '^ok ')
FAIL=$(echo "$OUT" | grep -c '^not ok ')
if [ "$FAIL" != "0" ] || [ "$PASS" -lt 27 ]; then
  git reset -q --hard "$OLD"
  git stash pop -q 2>/dev/null || true
  say "ROLLBACK: tests $PASS ok / $FAIL fail (<27 o fail>0)"
  dm "ROLLBACK en deploy entity: tests $PASS/$FAIL. main NO desplegado; runtime en $(git rev-parse --short HEAD)"
  exit 1
fi

# verificación 2: daemon + watcher limpio
sudo -n systemctl restart cayce-nostr.service
sudo -n systemctl start cayce-relay-watcher.service
W=0
for i in 1 2 3 4 5 6; do
  sleep 5
  [ "$(systemctl is-active cayce-relay-watcher.service)" = "inactive" ] && break
done
if systemctl is-failed cayce-relay-watcher.service >/dev/null 2>&1 \
   || journalctl -u cayce-relay-watcher -n 8 --no-pager 2>/dev/null | grep -q VIOLACION; then
  git reset -q --hard "$OLD"
  sudo -n systemctl restart cayce-nostr.service
  say "ROLLBACK: watcher con VIOLACION — PUBLISH_OFF queda ACTIVO"
  dm "ROLLBACK watcher en deploy entity. PUBLISH_OFF QUEDA ACTIVO — revision manual"
  exit 1   # ojo: PUBLISH_OFF se queda (fail-safe deliberado)
fi

rm -f PUBLISH_OFF
git stash pop -q 2>/dev/null || true   # lessons.md del ciclo retro
say "entity → $(git rev-parse --short HEAD) (tests $PASS/27, watcher OK, live)"
  # r21: sin DM (no urgente) — dm "entity desplegado: $(git rev-parse --short HEAD) — tests $PASS/27, watcher OK"
fi   # fin sección entity

# ── 2b. hardcap-news → /srv/hardcap-news (GitHub; web, sin PUBLISH_OFF) ─────
cd /srv/hardcap-news || { say "FATAL: sin /srv/hardcap-news"; exit 1; }
git fetch -q origin 2>/dev/null
if ! git merge-base --is-ancestor origin/main HEAD 2>/dev/null && [ -z "$(git status --porcelain)" ]; then
  OLD=$(git rev-parse HEAD)
  if ! git checkout -q main || ! git reset -q --hard origin/main; then
    git reset -q --hard "$OLD" 2>/dev/null; say "FATAL: checkout hardcap-news"; exit 1
  fi
  if git diff --name-only "$OLD" HEAD 2>/dev/null | grep -q "^frontend/package-lock.json$"; then
    (cd frontend && npm ci --ignore-scripts >/dev/null 2>&1) || say "WARN: npm ci hardcap"
  fi
  if ! (cd frontend && npm run build >/tmp/hc-autodeploy-build.log 2>&1); then
    git reset -q --hard "$OLD"; (cd frontend && npm run build >/dev/null 2>&1); sudo -n systemctl restart hardcap-frontend.service
    say "ROLLBACK hardcap-news: fallo el build"; dm "ROLLBACK hardcap-news (build) — main NO desplegado, rollback activo"
    exit 1
  fi
  sudo -n systemctl restart hardcap-frontend.service
  sleep 6
  CODE=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:3003/)
  if [ "$CODE" != "200" ]; then
    git reset -q --hard "$OLD"; (cd frontend && npm run build >/dev/null 2>&1); sudo -n systemctl restart hardcap-frontend.service
    say "ROLLBACK hardcap-news: verificacion (code=$CODE)"; dm "ROLLBACK hardcap-news verificacion: code=$CODE — rollback activo"
    exit 1
  fi
  # r24: identidad por build-id (cuando el despliegue trae la función)
  if git grep -q "NEXT_PUBLIC_BUILD_ID" -- frontend/src/app/layout.tsx frontend/next.config.js 2>/dev/null; then
    BUILT=$(curl -s -m 8 http://127.0.0.1:3003/ | grep -oE 'name="build-id" content="[a-f0-9]{8}"' | grep -oE '[a-f0-9]{8}' | head -1)
    WANT=$(git rev-parse --short=8 HEAD)
    if [ "$BUILT" != "$WANT" ]; then
      git reset -q --hard "$OLD"; (cd frontend && npm run build >/dev/null 2>&1); sudo -n systemctl restart hardcap-frontend.service
      say "ROLLBACK hardcap-news: build-id '$BUILT' != '$WANT'"; dm "ROLLBACK hardcap-news: servia build '$BUILT' pero lo desplegado era '$WANT'."
      exit 1
    fi
    say "identidad hardcap OK: servido=$BUILT desplegado=$WANT"
  fi
  say "hardcap-news → $(git rev-parse --short HEAD) (200)"
fi

# ── 3. bitcoinhotels → /srv/bitcoinhotels (web; sin PUBLISH_OFF) ────────────
cd /srv/bitcoinhotels || { say "FATAL: sin /srv/bitcoinhotels"; exit 1; }
git fetch -q origin 2>/dev/null
if ! git merge-base --is-ancestor origin/main HEAD 2>/dev/null && [ -z "$(git status --porcelain)" ]; then
  OLD=$(git rev-parse HEAD)
  if ! git checkout -q main || ! git reset -q --hard origin/main; then
    git reset -q --hard "$OLD" 2>/dev/null; say "FATAL: checkout bitcoinhotels"; dm "FATAL checkout bitcoinhotels — sin cambios"; exit 1
  fi
  if git diff --name-only "$OLD" HEAD 2>/dev/null | grep -q "^package-lock.json$"; then
    npm ci --ignore-scripts >/dev/null 2>&1 || { say "WARN: npm ci bitcoinhotels"; }
  fi
  if ! npm run build >/tmp/bh-autodeploy-build.log 2>&1; then
    git reset -q --hard "$OLD"; npm run build >/dev/null 2>&1; systemctl restart cayce-bitcoinhotels
    say "ROLLBACK bitcoinhotels: fallo el build"; dm "ROLLBACK bitcoinhotels (build) — main NO desplegado, rollback activo"
    exit 1
  fi
  sudo -n systemctl restart cayce-bitcoinhotels
  sleep 6
  CODE=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:3002/)
  UMAMI=$(curl -s http://127.0.0.1:3002/ | grep -c umami)
  MARCAS=$(curl -s http://127.0.0.1:3002/guides/how-to-pay-with-lightning-abroad | grep -cE "Trezor|Ledger|BitBox|Coldcard")
  if [ "$CODE" != "200" ] || [ "$UMAMI" = "0" ] || [ "$MARCAS" != "0" ]; then
    git reset -q --hard "$OLD"; npm run build >/dev/null 2>&1; systemctl restart cayce-bitcoinhotels
    say "ROLLBACK bitcoinhotels: verificacion (code=$CODE umami=$UMAMI marcas=$MARCAS)"
    dm "ROLLBACK bitcoinhotels verificacion: code=$CODE umami=$UMAMI marcas=$MARCAS — rollback activo"
    exit 1
  fi
  say "bitcoinhotels → $(git rev-parse --short HEAD) (200 + umami + 0 marcas)"
  # r22: verificación de IDENTIDAD — lo servido debe ser lo desplegado
  if git grep -q "NEXT_PUBLIC_BUILD_ID" -- src/app/layout.tsx 2>/dev/null; then
    BUILT=$(curl -s -m 8 http://127.0.0.1:3002/ | grep -oE 'name="build-id" content="[a-f0-9]{8}"' | grep -oE '[a-f0-9]{8}' | head -1)
    WANT=$(git rev-parse --short=8 HEAD)
    if [ "$BUILT" != "$WANT" ]; then
      git reset -q --hard "$OLD"; npm run build >/dev/null 2>&1; sudo -n systemctl restart cayce-bitcoinhotels
      say "ROLLBACK bitcoinhotels: build-id servido '$BUILT' != desplegado '$WANT'"
      dm "ROLLBACK bitcoinhotels: el sitio servia build '$BUILT' pero lo desplegado era '$WANT' — rollback activo."
      exit 1
    fi
    say "identidad OK: servido=$BUILT desplegado=$WANT"
  fi
fi