#!/usr/bin/env bash
# prod-precis — run the precis CLI against the LIVE precis_prod DB.
#
# Mirrors scripts/prod-psql's credential handling: the DSN is read from
# ~/.secrets/pw/PRECIS_DATABASE_URL inside this process and exported to
# the child only — it never appears on a command line or in output.
#
# ⚠ agent_rw is WRITE-capable and this is PRODUCTION. The `precis tools`
# subcommands are the CLI mirror of the MCP seven-verb API (same
# handlers, same gates); use those, not raw SQL.
#
# Usage:
#   /tmp/prod-precis tools get --id fi237847
#   /tmp/prod-precis tools edit --kind draft --id dc123 --find '…' --text '…'
#   /tmp/prod-precis taproot mint --dry-run --spec spec.json
set -euo pipefail
# The stored DSN is container-oriented (host.docker.internal = the Mac's
# autossh tunnel to caspar's pgbouncer); on the host that's 127.0.0.1.
export PRECIS_DATABASE_URL="$(sed 's#@host.docker.internal:#@127.0.0.1:#' "$HOME/.secrets/pw/PRECIS_DATABASE_URL")"
# Cloud calls need the same configured gateway as services. Honour an explicit
# environment override; an absent optional file must not break non-cloud CLI.
# Read into the child environment only, never argv or diagnostic output.
if [[ -z "${PRECIS_LLM_BASE_URL+x}" && -r "$HOME/.secrets/pw/PRECIS_LLM_BASE_URL" ]]; then
    export PRECIS_LLM_BASE_URL="$(cat "$HOME/.secrets/pw/PRECIS_LLM_BASE_URL")"
fi
export PRECIS_EMBEDDER=remote PRECIS_EMBEDDER_URL=http://127.0.0.1:8181
cd "$(dirname "$0")/.."
exec uv run precis "$@"
