// index.ts — the foundation egg entrypoint (PLAN-002 §0, Layer 0).
//
// T02 SCAFFOLD STATE: this entrypoint is intentionally a NO-OP beyond config
// validation. It calls loadConfig() so that `pulumi preview` exercises the
// CONTRACT_001 fail-closed validation (acceptance T02), but it creates NO real
// resources yet. The data plane / Vault / RustFS / Postgres / Forgejo / Caddy /
// runner components are LATER tasks (PLAN-002 §10: T03–T15) and are deliberately
// NOT authored here.
import * as pulumi from "@pulumi/pulumi";

import { loadConfig, sshPrivateKeyPath } from "./config";

// Fail closed here: if required config is missing/malformed, loadConfig throws
// and `pulumi preview` reports the full gap (CONTRACT_001 §Validation).
const config = loadConfig();

// The vendored @olsitec/pulumi-docker provider (CONTRACT_003) will, in T03+, use
// this key path + config.vm.{host,user} to reach the foundation VM over SSH.
// Resolved here only to prove the ENV channel is wired; not yet consumed.
const sshKeyPath = sshPrivateKeyPath();

pulumi.log.info(
  `foundation config loaded (no-op scaffold): ` +
    `baseDomain=${config.baseDomain}, vm=${config.vm.user}@${config.vm.host}, ` +
    `network=${config.network.name} (${config.network.subnet}), tls=${config.tls.mode}`,
);

// Stack outputs — safe, non-secret echoes so `pulumi preview`/`up` has something
// to show while no resources exist. Replaced by real component outputs in T03+.
export const phase = "T02-scaffold";
export const baseDomain = config.baseDomain;
export const networkName = config.network.name;
export const vmTarget = pulumi.interpolate`${config.vm.user}@${config.vm.host}`;
export const sshKeyConfigured = sshKeyPath.length > 0;
export const enabledFeatures = Object.entries(config.features)
  .filter(([, on]) => on)
  .map(([name]) => name);