#!/usr/bin/env bash
# ============================================================
# setup-account.sh — Phase 0 account setup
# Resolves (or mints) the HOUSE account directory, then scaffolds it via
# `provision_account_dir`: Claude Code project settings (hooks only — no
# permission allowlist; native agent frontmatter is the permission surface),
# specialist plugin templates, account.json defaults (stamping role:"house"),
# and the owner userId. Neo4j seeding lives in `seed-neo4j.sh`; this script does
# no Neo4j work.
#
# Multi-account managed service (Task 983): an install may host N accounts, but
# this default-install path only provisions the single role:"house" account.
# Client accounts are provisioned by the admin-core `account_create` tool, which
# calls the same `provision_account_dir` with role:"client".
# ============================================================

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
TEMPLATES_DIR="$PROJECT_DIR/templates"
# Accounts live at {installDir}/data/accounts/ — outside the platform/ wipe zone.
INSTALL_DIR="$(dirname "$PROJECT_DIR")"
ACCOUNTS_DIR="$INSTALL_DIR/data/accounts"

# ------------------------------------------------------------------
# 1. Resolve the HOUSE account directory (or mint on fresh install)
# ------------------------------------------------------------------
# Registry-membership model: every account dir with a parseable account.json is
# durable and never swept. The resolver returns the single role:"house" account
# (or the sole account in the pre-migration window). Orphan dirs (no account.json)
# are reported, not deleted (sweep is log-only this sprint — see resolve-account-dir.sh).
# shellcheck source=lib/resolve-account-dir.sh
. "$SCRIPT_DIR/lib/resolve-account-dir.sh"
# shellcheck source=lib/provision-account-dir.sh
. "$SCRIPT_DIR/lib/provision-account-dir.sh"
# shellcheck source=lib/account-settings-askgate.sh
. "$SCRIPT_DIR/lib/account-settings-askgate.sh"
# shellcheck source=lib/account-settings-pdf-conformance.sh
. "$SCRIPT_DIR/lib/account-settings-pdf-conformance.sh"
# shellcheck source=lib/read-brand-json.sh
. "$SCRIPT_DIR/lib/read-brand-json.sh"
# Resolve brand-aware persistent users.json path before the resolver runs.
_CONFIG_DIR_NAME=".maxy"
read_brand_json_key "$PROJECT_DIR/config/brand.json" "configDir"
[ -n "$BRAND_JSON_VALUE" ] && _CONFIG_DIR_NAME="$BRAND_JSON_VALUE"
USERS_FILE="$HOME/$_CONFIG_DIR_NAME/users.json"
mkdir -p "$HOME/$_CONFIG_DIR_NAME"

USERS_FILE="$USERS_FILE" resolve_and_sweep_account_dir

# ------------------------------------------------------------------
# 2. Scaffold the resolved house account
# ------------------------------------------------------------------
# `provision_account_dir` reads TEMPLATES_DIR / PROJECT_DIR / SCRIPT_DIR /
# USERS_FILE from the environment (set above). role="house" stamps the
# designation (migrating a legacy unlabelled account in the same step).
export TEMPLATES_DIR PROJECT_DIR SCRIPT_DIR USERS_FILE
provision_account_dir "$ACCOUNT_DIR" "$ACCOUNT_ID" "house"

# ------------------------------------------------------------------
# 3. Reconcile plugin-declared owned top-level dirs across every account
# ------------------------------------------------------------------
# Standing check + durable backfill: every account under data/accounts/ gets the
# brand's plugin-declared owned dirs unioned into its SCHEMA.md. Runs on every
# install so a re-provision cannot drop a previously-added owned dir.
# reconcile_all_accounts_owned_dirs is available because provision-account-dir.sh
# (sourced above) sources the owned-dir lib.
reconcile_all_accounts_owned_dirs "$ACCOUNTS_DIR"

# ------------------------------------------------------------------
# 4. Retrofit the AskUserQuestion carrier gate onto every existing account
# ------------------------------------------------------------------
# Standing check + durable backfill (Task 1683): provision_account_dir writes the
# AskUserQuestion PreToolUse matcher (both gates) only at provision time, and this
# script re-provisions only the house account — so a client sub-account created
# before Task 1552 keeps a stale matcher with no channel-carrier gate and
# re-wedges on a channel AskUserQuestion. Reconcile every account on every install
# so the gate reaches pre-1552 accounts. Idempotent; logs one [backfill-1683] line
# per account.
reconcile_all_accounts_askgate "$ACCOUNTS_DIR"

# ------------------------------------------------------------------
# 5. Retrofit the quote-render PDF-conformance matcher onto every account
# ------------------------------------------------------------------
# Standing check + durable backfill (Task 1929): provision_account_dir writes the
# PostToolUse browser-pdf-save matcher (quote-render-pdf-conformance.sh) only at
# provision time, and this script re-provisions only the house account. An
# account created before Task 1922 keeps a settings.json without the matcher and
# never runs the PDF gate. Reconcile every account on every install so the gate
# reaches pre-1922 accounts. Idempotent; logs one [backfill-1929] line per account.
reconcile_all_accounts_pdf_conformance "$ACCOUNTS_DIR"