#!/usr/bin/env bash
# Deploy phasefinal.com to Cloudflare Pages (project `phasefinal`, account vh@phasefinal).
#   stacks/phasefinal-web/deploy-pages.sh
# The site is the static tree in conf/site/ (with its _headers and 404.html); there is no build step.
# Token: a Cloudflare API token with Account → Cloudflare Pages: Edit, read from the vault.
#   PAGES_TOKEN_KEY defaults to the dedicated infra-ops token (to be minted by Prime);
#   the 2026-10-04 migration used nh3-dev/development/jackdaw/cloudflare-api-token as a one-off.
set -euo pipefail
here=$(cd "$(dirname "$0")" && pwd)
key=${PAGES_TOKEN_KEY:-nh3-dev/.config/cloudflare/infra-ops-pages-token}
CLOUDFLARE_API_TOKEN=$(secret get "$key") || { echo "no token at vault key $key (set PAGES_TOKEN_KEY)" >&2; exit 2; }
export CLOUDFLARE_API_TOKEN
CLOUDFLARE_ACCOUNT_ID=$(curl -s -m 15 -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" https://api.cloudflare.com/client/v4/accounts \
  | python3 -c 'import json,sys; r=json.load(sys.stdin)["result"]; print(next(a["id"] for a in r if a["name"]=="vh@phasefinal"))')
export CLOUDFLARE_ACCOUNT_ID
# run wrangler from a scratch dir so it never drops .wrangler/ state into the repo
cd "$(mktemp -d)"
npx -y wrangler@4 pages deploy "$here/conf/site" --project-name phasefinal --branch main --commit-dirty=true \
  --commit-message "deploy from eshpfi-management $(git -C "$here" rev-parse --short HEAD)"