#!/usr/bin/env bash
# deploy-cli.sh — package the keep CLI (bundle + its one real runtime
# dependency, libsodium-wrappers) and ship it straight to a host over SSH.
# No git clone, no npm install on the target.
#
# Not a single file: libsodium-wrappers' published ESM build is broken
# (a relative import that doesn't resolve outside a bundler-aware
# context — see src/shared/crypto.ts), and statically force-inlining it
# via esbuild breaks its own Node-crypto feature-detection at runtime
# ("No secure random number generator found"). Shipping the real,
# unmodified package alongside a small (~18kb) bundle for everything
# else is more reliable than fighting that — the whole package is still
# only ~1.6MB and this script is still the entire deploy step.
#
# Usage: HOST=user@host ./deploy-cli.sh
set -euo pipefail

HOST="${HOST:?usage: HOST=user@host ./deploy-cli.sh}"
BIN_DIR="${BIN_DIR:-~/bin}"
INSTALL_DIR="${INSTALL_DIR:-~/.keep-cli}"

echo "→ bundling keep CLI…"
npm run build:cli-bundle

echo "→ packaging…"
tar -C dist-bundle -czf /tmp/keep-cli.tar.gz .

echo "→ uploading to $HOST:$INSTALL_DIR…"
ssh "$HOST" "mkdir -p $INSTALL_DIR && tar -C $INSTALL_DIR -xzf -" < /tmp/keep-cli.tar.gz
rm /tmp/keep-cli.tar.gz

echo "→ linking $BIN_DIR/keep…"
ssh "$HOST" "mkdir -p $BIN_DIR && chmod +x $INSTALL_DIR/keep.mjs && ln -sf $INSTALL_DIR/keep.mjs $BIN_DIR/keep"

echo "→ verifying…"
ssh "$HOST" "$BIN_DIR/keep --help" | head -1

echo "✓ done — re-run this script any time the CLI changes; safe to overwrite."