#!/usr/bin/env bash
# scripts/run_spike_plan.sh - run the v1.1 spike's real terraform plan against AWS.
#
# Uses the rotated spike key (D-039) from gitignored .env.secrets.
# Plan-only (no apply); -lock=false per D-P09-1 (the spike's DynamoDB
# outbox table PK is contractId, not Terraform's expected LockID; plan
# does not write state so locking is unnecessary; v1.2 creates a proper
# LockID-keyed acdl-tflock table).
set -u
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT"

ENV_FILE="$ROOT/.env.secrets"
[ -f "$ENV_FILE" ] || { echo "FAIL: .env.secrets missing (run scripts/rotate_spike_key.sh)" >&2; exit 1; }
set -a
. "$ENV_FILE"
set +a
export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"
export AWS_SECRET_ACCESS_KEY="$ACDL_AWS_SECRET_ACCESS_KEY"
export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION"

cd terraform/spike
echo "=== terraform init -lock=false -input=false ==="
terraform init -lock=false -input=false
echo "=== terraform validate ==="
terraform validate
echo "=== terraform plan -lock=false -input=false -out=tfplan ==="
terraform plan -lock=false -input=false -out=tfplan
echo "spike plan OK"