#!/usr/bin/env bash
# Run operator tasks that REQUIRE being on LAN and/or having NPM_PASSWORD, PRIVATE_KEY.
# Always loads dotenv from repo .env and smom-dbis-138/.env (no need to source before running).
# Usage: ./scripts/run-operator-tasks-from-lan.sh [--dry-run] [--skip-backup] [--skip-verify]

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
cd "$PROJECT_ROOT"

# Always load dotenv so Operator/LAN has NPM_PASSWORD, PRIVATE_KEY, etc.
if [[ -f "$SCRIPT_DIR/lib/load-project-env.sh" ]]; then
  # shellcheck source=scripts/lib/load-project-env.sh
  source "$SCRIPT_DIR/lib/load-project-env.sh"
fi

DRY_RUN=false
SKIP_BACKUP=false
SKIP_VERIFY=false
for a in "$@"; do
  [[ "$a" == "--dry-run" ]] && DRY_RUN=true
  [[ "$a" == "--skip-backup" ]] && SKIP_BACKUP=true
  [[ "$a" == "--skip-verify" ]] && SKIP_VERIFY=true
done

echo "=== Operator tasks (from LAN) ==="
echo ""

# W0-1 + W0-3: NPMplus RPC fix and backup
bash "$SCRIPT_DIR/run-wave0-from-lan.sh" $([[ "$DRY_RUN" == true ]] && echo --dry-run) $([[ "$SKIP_BACKUP" == true ]] && echo --skip-backup)
echo ""

# O-1: Blockscout source verification (from host that can reach Blockscout)
if [[ "$SKIP_VERIFY" != true ]]; then
  echo "O-1: Blockscout source verification..."
  if [[ "$DRY_RUN" == true ]]; then
    echo "  [DRY-RUN] source smom-dbis-138/.env 2>/dev/null; ./scripts/verify/run-contract-verification-with-proxy.sh"
  else
    ([[ -f smom-dbis-138/.env ]] && source smom-dbis-138/.env 2>/dev/null; bash "$SCRIPT_DIR/verify/run-contract-verification-with-proxy.sh") || echo "  Skip (smom-dbis-138/.env or script failed)"
  fi
  echo ""
fi

echo "=== Next steps (manual or run separately) ==="
echo "  W0-2 sendCrossChain:  bash scripts/bridge/run-send-cross-chain.sh <amount> [recipient]  (PRIVATE_KEY, LINK in .env)"
echo "  W1-1 SSH keys:        bash scripts/security/setup-ssh-key-auth.sh [--dry-run|--apply]"
echo "  W1-2 Firewall 8006:   bash scripts/security/firewall-proxmox-8006.sh [--dry-run|--apply] [CIDR]"
echo "  W1-8 Backup cron:     bash scripts/maintenance/schedule-npmplus-backup-cron.sh --install"
echo "  Cron-2 daily/weekly:  bash scripts/maintenance/schedule-daily-weekly-cron.sh --install"
echo "  O-1 retry one:        ./scripts/verify/run-contract-verification-with-proxy.sh --only ContractName"
echo "  CR-1 Config-ready:    see docs/07-ccip/CONFIG_READY_CHAINS_COMPLETION_RUNBOOK.md"
echo "  API keys:             reports/API_KEYS_REQUIRED.md → set in .env"