#!/usr/bin/env bash
# provision.sh <port> — enrol a NEW {{name}} and flash it in ONE run (token never touches shell history).
#   WIFI_SSID=home WIFI_KEY=secret bash tools/provision.sh /dev/cu.usbmodemXXXX
# Needs: ESP-IDF exported (esptool, nvs_partition_gen), a built build/{{slug}}.bin, ~/.tiny/credentials.json.
set -euo pipefail
PORT="${1:?usage: provision.sh /dev/cu.usbmodemXXXX}"
DIR="$(cd "$(dirname "$0")/.." && pwd)"; API="${TINY_API:-https://tiny.technology}"
: "${WIFI_SSID:?set WIFI_SSID}"; : "${WIFI_KEY:?set WIFI_KEY}"
CREDS="${TINY_CREDENTIALS:-$HOME/.tiny/credentials.json}"
command -v esptool.py >/dev/null || command -v esptool >/dev/null || { echo "esptool not found — export ESP-IDF"; exit 1; }
ESPTOOL=$(command -v esptool.py || command -v esptool)
MAC=$("$ESPTOOL" --chip esp32s3 -p "$PORT" --before default_reset --after no_reset read_mac 2>&1 | grep -m1 -oE '([0-9a-f]{2}:){5}[0-9a-f]{2}')
[ -n "$MAC" ] || { echo "REFUSED: could not read MAC on $PORT"; exit 1; }
NAME=$(python3 - "$MAC" <<'PY'
import sys
h = 0x811C9DC5
for b in bytes.fromhex(sys.argv[1].replace(':', '')):
    h ^= b; h = (h * 0x01000193) & 0xFFFFFFFF
print(f"tiny-{h & 0xffff:04x}")
PY
)
echo "[provision] $PORT mac=$MAC name=$NAME"
TOK=$(python3 -c "import json;print(json.load(open('$CREDS'))['token'])")
if curl -sf -H "Authorization: Bearer $TOK" "$API/api/devices" | python3 -c "
import json,sys; ds=json.load(sys.stdin).get('devices',[]); sys.exit(0 if any(d.get('name')=='$NAME' and d.get('online') for d in ds) else 1)"; then
  echo "REFUSED: $NAME is ONLINE in the fleet — this board (or its twin) is already enrolled"; exit 2
fi
RESP=$(curl -sf -X POST "$API/api/devices" -H "Authorization: Bearer $TOK" -H 'content-type: application/json' \
  -d "{\"name\":\"$NAME\",\"kind\":\"daemon\",\"platform\":\"{{platform}}\",\"capabilities\":{{capabilities}}}")
python3 - "$RESP" "$NAME" "$API" > "$DIR/build/nvs.csv" <<'PY'
import json, sys
r = json.loads(sys.argv[1]); assert r.get("device_token"), r
import os
cfg = {"device_id": r["device_id"], "token": r["device_token"], "api": sys.argv[3], "name": sys.argv[2],
       "networks": [{"ssid": os.environ["WIFI_SSID"], "key": os.environ["WIFI_KEY"]}]}
print("key,type,encoding,value"); print("tiny,namespace,,"); print("cfg,data,string," + json.dumps(json.dumps(cfg)))
PY
python3 "$IDF_PATH/components/nvs_flash/nvs_partition_generator/nvs_partition_gen.py" generate "$DIR/build/nvs.csv" "$DIR/build/nvs.bin" 0x6000 >/dev/null
"$ESPTOOL" --chip esp32s3 -p "$PORT" -b 460800 write_flash 0x0 "$DIR/build/bootloader/bootloader.bin" 0x8000 "$DIR/build/partition_table/partition-table.bin" 0x9000 "$DIR/build/nvs.bin" 0x20000 "$DIR/build/{{slug}}.bin"
rm -f "$DIR/build/nvs.csv"
echo "flashed + provisioned $NAME — it heartbeats when it joins $WIFI_SSID"