#!/usr/bin/env bash
# Trusted-workstation entrypoint for K3s node enrollment planning.
set -euo pipefail
umask 077
export PYTHONDONTWRITEBYTECODE=1

usage() {
  cat <<'USAGE'
Usage:
  tools/k3s/enroll-node.sh CANDIDATE [--plan|--dry-run] [options]

Examples:
  # Phase 2 deterministic fixture proof (no live calls or mutations)
  tools/k3s/enroll-node.sh debian4 --dry-run \
    --fixture tools/k3s/test/fixtures/phase2-debian4.json

  # Phase 2 read-only plan against an OS + Tailscale-ready candidate
  tools/k3s/enroll-node.sh debian4 --plan

Options are forwarded to enroll-node.py. Phase 2 hard-disables live enrollment;
actual mutation is unlocked only by the reviewed Phase 3 canary package.
USAGE
}

(($# >= 1)) || { usage >&2; exit 2; }
case "${1:-}" in -h|--help) usage; exit 0;; esac
CANDIDATE=$1
shift
MODE=dry-run
ARGS=()
while (($#)); do
  case "$1" in
    --plan) MODE=plan; shift ;;
    --dry-run) MODE=dry-run; shift ;;
    --apply|--execute)
      printf 'enroll-node: live enrollment is hard-disabled in Phase 2; use the reviewed Phase 3 package\n' >&2
      exit 2
      ;;
    -h|--help) usage; exit 0 ;;
    *) ARGS+=("$1"); shift ;;
  esac
done

HERE=$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
exec python3 "$HERE/enroll-node.py" "$CANDIDATE" --mode "$MODE" "${ARGS[@]}"