Taskfile.yml

version: '3'

vars:
  # LanceDB native library configuration
  LANCEDB_VERSION: v0.1.2
  PLATFORM:
    sh: go env GOOS
  ARCH:
    sh: go env GOARCH
  LANCEDB_LIB_DIR: "{{.ROOT_DIR}}/lib/{{.PLATFORM}}_{{.ARCH}}"

tasks:
  setup:
    desc: Install all dependencies
    cmds:
      - cd web && nub install
      - go mod download

  setup:lancedb:
    desc: Download LanceDB native libraries (required RAG pipeline)
    cmds:
      - mkdir -p lib include
      - |
        echo "Downloading LanceDB native libraries for {{.PLATFORM}}_{{.ARCH}}..."
        curl -sSL https://raw.githubusercontent.com/lancedb/lancedb-go/main/scripts/download-artifacts.sh | bash -s {{.LANCEDB_VERSION}}
    status:
      - test -f "{{.LANCEDB_LIB_DIR}}/liblancedb_go.a"

  validate:migrations:
    desc: Validate LATEST.sql is in sync with migration files
    cmds:
      - ./scripts/validate-migrations.sh

  validate:schema:
    desc: Validate database schema and test CRUD operations
    cmds:
      - echo "Running schema validation tests..."
      - go test -v ./store/test/... -run "TestSchemaValidation|TestAgentSourceFile|TestAgentTenantScript|TestMigrationHistoryVersion"
      - echo "Schema validation passed!"

  build:frontend:
    desc: Build frontend assets
    cmds:
      - cd web && nub run release

  version:info:
    desc: Show computed version from migration filesystem (informational, read-only)
    cmds:
      - ./scripts/bump-version.sh

  migrate:new:
    desc: "Create new migration file templates for both drivers (usage: task migrate:new NAME=add_widget_config)"
    cmds:
      - ./scripts/create-migration.sh "{{.NAME}}"

  validate:parity:
    desc: Validate SQLite and Postgres migration parity
    cmds:
      - ./scripts/validate-parity.sh

  test:scripts:
    desc: Run automation script tests
    cmds:
      - ./scripts/test/run-tests.sh

  build:backend:
    desc: Build the Go binary
    deps: [validate:migrations, validate:parity, test:scripts]
    cmds:
      - mkdir -p build
      - go build -o build/memos ./bin/memos/main.go

  build:backend:rag:
    desc: Build the Go binary with LanceDB RAG support
    deps: [build:frontend, setup:lancedb, validate:migrations, validate:parity, test:scripts]
    env:
      CGO_ENABLED: "1"
      CGO_CFLAGS: "-I{{.ROOT_DIR}}/include"
      CGO_LDFLAGS: "{{if eq .PLATFORM \"linux\"}}-L{{.LANCEDB_LIB_DIR}} -llancedb_go -Wl,-rpath,{{.LANCEDB_LIB_DIR}}{{else}}{{.LANCEDB_LIB_DIR}}/liblancedb_go.a{{end}} {{if eq .PLATFORM \"darwin\"}}-framework Security -framework CoreFoundation{{end}}"
    cmds:
      - mkdir -p build
      - go build -tags rag -o build/memos ./bin/memos/main.go

  build:widget:
    desc: Build the embeddable chat widget
    dir: widget
    cmds:
      - nub install
      - nub run build
      - cp dist/embed.min.js site/

  build:
    desc: Build everything (frontend + backend)
    deps: [build:backend]

  build:all:
    desc: Build everything including widget (frontend + backend + widget)
    deps: [build:backend:rag, build:widget]

  build:rag:
    desc: Build everything with RAG support (frontend + backend with LanceDB)
    deps: [build:backend:rag]

  build:rag:all:
    desc: Build everything with RAG support including widget
    deps: [build:backend:rag, build:widget]


  run:
    desc: Run development server (sources .env file if present)
    deps: [build:backend]
    cmds:
      - |
        if [ -f .env ]; then
          echo "Loading environment from .env file..."
          set -a && . .env && set +a
          [ -f .env.local ] && set -a && . .env.local && set +a
        fi
        ./build/memos --mode dev --data {{.ROOT_DIR}}/build/data

  run:rag:
    desc: Run with RAG enabled (sources .env file, local storage)
    deps: [build:backend:rag]
    cmds:
      - |
        if [ -f .env ]; then
          echo "Loading environment from .env file..."
          set -a && . .env && set +a
          [ -f .env.local ] && set -a && . .env.local && set +a
        fi
        FORCE_REINDEX_ON_STARTUP=false RAG_PIPELINE_ENABLED=true EMBEDDING_MODEL=openai/text-embedding-3-small LANCEDB_STORAGE_PROVIDER=local ./build/memos --mode dev --data {{.ROOT_DIR}}/build/data

  run:rag:s3:
    desc: Run with RAG enabled using Tigris S3 storage
    deps: [build:backend:rag]
    cmds:
      - |
        if [ -f .env ]; then
          echo "Loading environment from .env file..."
          set -a && . .env && set +a
          [ -f .env.local ] && set -a && . .env.local && set +a
        fi
        RAG_PIPELINE_ENABLED=true LANCEDB_STORAGE_PROVIDER=s3 ./build/memos --mode dev --data {{.ROOT_DIR}}/build/data


  run:testrag:
    desc: Run with RAG enabled and FORCE full reindex on startup (useful for testing)
    deps: [build:backend:rag]
    cmds:
      - |
        if [ -f .env ]; then
          echo "Loading environment from .env file..."
          set -a && . .env && set +a
          [ -f .env.local ] && set -a && . .env.local && set +a
        fi
        FORCE_REINDEX_ON_STARTUP=true RAG_PIPELINE_ENABLED=true EMBEDDING_MODEL=qwen/qwen3-embedding-8b EMBEDDING_BATCH_SIZE=32 LANCEDB_STORAGE_PROVIDER=local ./build/memos --mode dev --data {{.ROOT_DIR}}/build/data

  run:binary:
    desc: Run pre-compiled binary with RAG enabled (no build, sources .env file)
    cmds:
      - |
        if [ -f .env ]; then
          echo "Loading environment from .env file..."
          set -a && . .env && set +a
          [ -f .env.local ] && set -a && . .env.local && set +a
        fi
        LD_LIBRARY_PATH={{.LANCEDB_LIB_DIR}}:$LD_LIBRARY_PATH RAG_PIPELINE_ENABLED=true EMBEDDING_MODEL=qwen/qwen3-embedding-8b EMBEDDING_BATCH_SIZE=10 LANCEDB_STORAGE_PROVIDER=local ./build/memos --mode dev --data {{.ROOT_DIR}}/build/data

  run:rag:l12:
    desc: Run with RAG + L12 embeddings (sources .env file)
    deps: [build:backend:rag]
    cmds:
      - |
        if [ -f .env ]; then
          echo "Loading environment from .env file..."
          set -a && . .env && set +a
          [ -f .env.local ] && set -a && . .env.local && set +a
        fi
        RAG_PIPELINE_ENABLED=true \
        EMBEDDING_MODEL=sentence-transformers/all-MiniLM-L12-v2 \
        LANCEDB_STORAGE_PROVIDER=local \
        ./build/memos --mode dev --data {{.ROOT_DIR}}/build/data

  generate:
    desc: Run go generate
    cmds:
      - go generate ./...

  fly:check:
    desc: Validate environment chain (.env -> Dockerfile -> fly.toml -> fly secrets)
    cmds:
      - ./scripts/validate-env-chain.sh {{.CLI_ARGS}}

  fly:check:fix:
    desc: Fix missing/mismatched env vars in Dockerfile and fly.toml from .env
    cmds:
      - ./scripts/fix-env-chain.sh

  fly:db-check:
    desc: Validate database migrations before fly.io deployment (auto-detects backend from fly.toml)
    cmds:
      - |
        DOCKERFILE=$(grep -E '^\s*dockerfile\s*=' fly.toml | head -1 | sed -E "s/.*=\s*['\"]//; s/['\"].*//")
        echo "Detected Dockerfile: $DOCKERFILE"
        
        if [[ "$DOCKERFILE" == *"cockroach"* ]]; then
          echo "Running CockroachDB compatibility check..."
          ./scripts/validate-cockroach-compat.sh
        elif [[ "$DOCKERFILE" == *"pg"* ]]; then
          echo "Running Postgres migration check..."
          ./scripts/validate-pg-migrations.sh
        else
          echo "Running SQLite migration check..."
          ./scripts/validate-db-migrations.sh
        fi

  fly:pre-deploy:
    desc: Run all pre-deployment checks (env + database)
    cmds:
      - task: fly:check
      - task: fly:db-check
      - |
        echo ""
        echo "=== All pre-deployment checks passed ==="
        echo "Safe to run: fly deploy"

  fly:check:sqlite:
    desc: Validate SQLite migrations before deployment
    cmds:
      - ./scripts/validate-db-migrations.sh

  fly:check:postgres:
    desc: Validate Postgres migrations before deployment
    cmds:
      - ./scripts/validate-pg-migrations.sh

  fly:check:cockroach:
    desc: Validate CockroachDB migrations before deployment
    cmds:
      - ./scripts/validate-cockroach-compat.sh

  fly:pre-deploy:cockroach:
    desc: Run all pre-deployment checks for CockroachDB
    cmds:
      - task: fly:check
        vars: {CLI_ARGS: "fly_cockroach.toml"}
      - task: fly:check:cockroach
      - |
        echo ""
        echo "=== All pre-deployment checks passed ==="
        echo "Safe to run: task deploy:cockroach"

  fly:pre-deploy:postgres:
    desc: Run all pre-deployment checks for Postgres
    cmds:
      - task: fly:check
        vars: {CLI_ARGS: "fly_pg.toml"}
      - task: fly:check:postgres
      - |
        echo ""
        echo "=== All pre-deployment checks passed ==="
        echo "Safe to run: task deploy:postgres"

  fly:pre-deploy:sqlite:
    desc: Run all pre-deployment checks for SQLite
    cmds:
      - task: fly:check
        vars: {CLI_ARGS: "fly.toml"}
      - task: fly:check:sqlite
      - |
        echo ""
        echo "=== All pre-deployment checks passed ==="
        echo "Safe to run: fly deploy -c fly.toml"

  fly:logs:rag:
    desc: Stream RAG and database initialization logs on Fly.io (Ctrl+C to exit)
    cmds:
      - fly logs | grep -E "RAG|LanceDB|Embedding|vector database|Reindex"

  fly:ssh:db:
    desc: Open an interactive SQLite terminal inside the remote Fly.io persistent volume
    cmds:
      - fly ssh console -C "sqlite3 /var/opt/memos/memos_prod.db"

  # ============================================================================
  # COCKROACHDB TASKS
  # ============================================================================

  build:backend:cockroach:
    desc: Build the Go binary with CockroachDB vector store support
    cmds:
      - mkdir -p build
      - go build -tags "cockroach" -o build/memos ./bin/memos/main.go

  build:cockroach:
    desc: Build everything with CockroachDB support
    deps: [build:backend:cockroach]

  run:cockroach:
    desc: Run with CockroachDB vector store (sources .env file)
    deps: [build:backend:cockroach]
    cmds:
      - |
        if [ -f .env ]; then
          echo "Loading environment from .env file..."
          set -a && . .env && set +a
          [ -f .env.local ] && set -a && . .env.local && set +a
        fi
        MEMOS_DRIVER=cockroach RAG_PIPELINE_ENABLED=true LANCEDB_STORAGE_PROVIDER=cockroach TICKET_EMBEDDING_ENABLED=true ./build/memos --mode dev --data {{.ROOT_DIR}}/build/data

  run:cockroach:local:
    desc: Hermetic local CockroachDB run (fresh bchat_test DB; never touches cloud; sources .env.local)
    deps: [build:backend:cockroach]
    cmds:
      - |
        if [ -f .env ]; then
          echo "Loading environment from .env file..."
          set -a && . .env && set +a
        fi
        [ -f .env.local ] && set -a && . .env.local && set +a
        bash scripts/init-local-cockroach-db.sh
        echo "=== Starting memos on hermetic bchat_test (port ${MEMOS_PORT:-5230}) ==="
        MEMOS_DRIVER=cockroach RAG_PIPELINE_ENABLED=true LANCEDB_STORAGE_PROVIDER=cockroach \
        TICKET_EMBEDDING_ENABLED=true RAG_STARTUP_REINDEX_DISABLED=true MEMOS_PORT=5230 \
        ./build/memos --mode dev --data {{.ROOT_DIR}}/build/data

  run:cockroach:seed:
    desc: Seed demo tickets for hackathon demo
    cmds:
      - |
        if [ -f .env ]; then
          echo "Loading environment from .env file..."
          set -a && . .env && set +a
          [ -f .env.local ] && set -a && . .env.local && set +a
        fi
        go run cmd/seed/seed_demo_tickets.go

  crdb:check:
    desc: Validate CockroachDB parity + compat scanner
    deps: [validate:parity]
    cmds:
      - |
        echo "=== CockroachDB Migration Compatibility Scanner ==="
        ./scripts/validate-cockroach-compat.sh
        echo ""
        echo "All checks passed!"

  # TODO(post-hackathon): profile-parameterized aliases — db:up PROFILE=cockroach,
  # db:reset PROFILE=cockroach (scales to SQLite/TiDB/PlanetScale)
  crdb:up:
    desc: Start local CockroachDB compose cluster (waits for healthcheck)
    cmds:
      - docker compose -f scripts/docker-compose.cockroach.yml up -d --wait

  crdb:down:
    desc: Stop local CockroachDB compose cluster
    cmds:
      - docker compose -f scripts/docker-compose.cockroach.yml down

  crdb:init:
    desc: Apply cluster settings to local CockroachDB (idempotent, safe to rerun)
    cmds:
      - |
        set -e
        echo "=== Waiting for CockroachDB SQL readiness ==="
        for i in $(seq 1 30); do
          if cockroach sql --url "postgresql://root@localhost:26257/bchat?sslmode=disable" -e "SELECT 1;" >/dev/null 2>&1; then
            echo "CockroachDB SQL ready (attempt $i)"
            break
          fi
          if [ "$i" -eq 30 ]; then
            echo "ERROR: CockroachDB not ready after 30 attempts"
            exit 1
          fi
          echo "  Waiting for SQL... (attempt $i/30)"
          sleep 2
        done
        echo "=== Applying cluster settings ==="
        cockroach sql --url "postgresql://root@localhost:26257/bchat?sslmode=disable" \
          < scripts/crdb-init.sql
        echo "=== Cluster settings applied ==="

  crdb:reset:
    desc: Wipe and restart local CockroachDB compose cluster (A1 state)
    cmds:
      - docker compose -f scripts/docker-compose.cockroach.yml down -v
      - docker compose -f scripts/docker-compose.cockroach.yml up -d --wait
      - task: crdb:init

  crdb:migrate:
    desc: Boot memos against CockroachDB (boot applies migrations)
    cmds:
      - |
        if [ -f .env ]; then
          echo "Loading environment from .env file..."
          set -a && . .env && set +a
          [ -f .env.local ] && set -a && . .env.local && set +a
        fi
        COCKROACH_DSN="${COCKROACH_DSN}" ./build/memos --driver=cockroach --mode dev --data {{.ROOT_DIR}}/build/data

  crdb:verify:
    desc: Run production-facing P1-P6 verification against CockroachDB (bugs/057 §6.2)
    cmds:
      - |
        echo "=== CockroachDB Verification (P1-P6) ==="
        # TestCockroachP0 re-runs the entire LATEST.sql migration twice + CREATE TABLE
        # (bugs/057 §4.0.1 P0 gate). That is destructive/hanging against a live cluster
        # whose migration already ran, so it is LOCAL-ONLY. Against a non-local DSN
        # (e.g. prod) or when DSN is unset, we skip and rely on the read-only §6.2 SQL
        # checks below — mirroring the TestCockroachMigrate guard directly beneath it.
        if echo "${COCKROACH_DSN:-}" | grep -qE "localhost|127\.0\.0\.1"; then
          go test -tags "cockroach integration" ./store/ -run TestCockroachP0 -v
        else
          echo "SKIP: TestCockroachP0 (whole-file migration re-run) — COCKROACH_DSN is unset or non-local"
        fi
        if echo "${COCKROACH_DSN:-}" | grep -qE "localhost|127\.0\.0\.1"; then
          BCHAT_ALLOW_DB_RESET=1 go test -tags "cockroach integration" ./store/test/ -run "TestCockroachMigrate" -v
        else
          echo "SKIP: E2E migrate tests (resetCockroachDB) — COCKROACH_DSN is unset or non-local"
        fi
        echo ""
        echo "--- §6.2 checks (env-gated on COCKROACH_DSN + cockroach binary) ---"
        if [ -z "${COCKROACH_DSN:-}" ]; then
          echo "COCKROACH_DSN not set — skipping §6.2 SQL checks"
        elif ! command -v cockroach &>/dev/null; then
          echo "cockroach binary not found — skipping §6.2 SQL checks"
        else
          run_sql() { cockroach sql --url "${COCKROACH_DSN}" -e "$1" 2>/dev/null; }
          run_sql "SELECT 1;" >/dev/null || { echo "FAIL: SELECT 1"; exit 1; }
          echo "OK: SELECT 1"
          DB=$(run_sql "SELECT current_database();" 2>/dev/null | tail -1)
          echo "OK: current_database() = $DB"
          EXPECTED_DB=$(echo "$COCKROACH_DSN" | grep -oE '[^/]+$' | cut -d'?' -f1)
          if [ "$DB" != "$EXPECTED_DB" ]; then
            echo "FAIL: connected to $DB, expected $EXPECTED_DB"; exit 1
          fi
          echo "OK: database matches DSN"
          V=$(run_sql "SELECT version();")
          echo "$V" | grep -qi cockroach || { echo "FAIL: version() is not Cockroach"; exit 1; }
          echo "OK: version() = Cockroach"
          H=$(run_sql "SELECT count(*) FROM migration_history;" | tail -1)
          echo "$H" | grep -q "1" || { echo "FAIL: migration_history count != 1"; exit 1; }
          echo "OK: migration_history = 1 row (A1)"
          C=$(run_sql "SHOW CREATE TABLE agent_tenants;")
          echo "$C" | grep -q "nextval" || { echo "FAIL: agent_tenants has no nextval default"; exit 1; }
          echo "OK: nextval() defaults present"
        S=$(run_sql "SHOW CLUSTER SETTING feature.vector_index.enabled;")
        echo "$S" | grep -qE "^[[:space:]]*t$" || { echo "FAIL: feature.vector_index.enabled != true"; exit 1; }
          echo "OK: vector index enabled"
          I=$(run_sql "SELECT count(*) FROM information_schema.statistics WHERE table_name='agent_vectors';" | tail -1)
          echo "$I" | grep -qv "^0" || { echo "FAIL: agent_vectors has no indexes"; exit 1; }
          echo "OK: agent_vectors indexed"
          JOBS=$(run_sql "SELECT count(*) FROM [SHOW JOBS] WHERE status = 'failed' AND job_type IN ('SCHEMA CHANGE', 'NEW SCHEMA CHANGE');" 2>/dev/null | tail -1)
          if [ "$JOBS" != "0" ] && [ -n "$JOBS" ]; then
            echo "FAIL: $JOBS failed schema job(s) found"
            run_sql "SELECT job_id, job_type, status, error FROM [SHOW JOBS] WHERE status = 'failed' AND job_type IN ('SCHEMA CHANGE', 'NEW SCHEMA CHANGE') LIMIT 5;" 2>/dev/null
            exit 1
          else
            echo "OK: no failed schema jobs"
          fi
          if [ -n "${BCHAT_URL:-}" ]; then
            curl -fsS -o /dev/null "$BCHAT_URL/healthz" 2>/dev/null \
              || { echo "FAIL: /healthz not 200 at $BCHAT_URL"; exit 1; }
            echo "OK: /healthz 200"
          else
            echo "WARN: BCHAT_URL not set — skipping /healthz check"
          fi
        fi
        echo ""
        echo "P1-P6 verification complete!"

  crdb:verify-vectors:
    desc: Verify agent_vectors table and vector index (P6 only — run after reindex)
    cmds:
      - |
        echo "=== P6: Vector Index Verification ==="
        if ! echo "${COCKROACH_DSN:-}" | grep -qE "localhost|127\.0\.0\.1"; then
          echo "SKIP: COCKROACH_DSN is unset or non-local"
          exit 0
        fi
        if ! command -v cockroach &>/dev/null; then
          echo "SKIP: cockroach binary not found"
          exit 0
        fi
        run_sql() { cockroach sql --url "${COCKROACH_DSN}" -e "$1" 2>/dev/null; }
        S=$(run_sql "SHOW CLUSTER SETTING feature.vector_index.enabled;")
        echo "$S" | grep -qE "^[[:space:]]*t$" || { echo "FAIL: feature.vector_index.enabled != true (got: $S)"; exit 1; }
        echo "OK: vector index enabled"
        I=$(run_sql "SELECT count(*) FROM information_schema.statistics WHERE table_name='agent_vectors';" | tail -1)
        echo "$I" | grep -qv "^0" || { echo "FAIL: agent_vectors has no indexes"; exit 1; }
        echo "OK: agent_vectors indexed"
        echo ""
        echo "P6 verification complete!"

  crdb:cluster:bootstrap:
    desc: Bootstrap a 2-region Basic cluster (console-first; see bugs/057/pre_code.md §5)
    cmds:
      - |
        echo "Multi-region Basic clusters are created in the Cloud Console (https://cockroachlabs.cloud)."
        echo "ccloud cluster create basic accepts exactly ONE region — create the cluster in the"
        echo "console with 2+ regions, then configure operator access:"
        echo "  1. Console: Clusters → Create Cluster → Basic → 2+ regions"
        echo "  2. ccloud cluster networking allowlist create <name> 0.0.0.0/0 --sql --ui --name all"
        echo "  3. Create a SQL user + password in the console"
        echo "  4. Export COCKROACH_DSN and set feature.vector_index.enabled=true (v25.x)"
        echo "     e.g. cockroach sql --url 'postgresql://user:pass@host:26257/defaultdb?sslmode=verify-full' \\"
        echo "       -e \"SET CLUSTER SETTING feature.vector_index.enabled = true;\""
        echo "  5. task crdb:migrate"

  crdb:db-check:
    desc: Validate CockroachDB database migrations
    cmds:
      - |
        echo "=== CockroachDB Database Check ==="
        if [ -z "${COCKROACH_DSN:-}" ]; then
          echo "SKIP: COCKROACH_DSN not set"
          exit 0
        fi
        echo "Connecting to CockroachDB..."
        # This would run the validation script if we had one
        echo "Database check passed!"

  crdb:cluster:create:
    desc: Bootstrap a 2-region Basic cluster (console-first; see bugs/057/pre_code.md §5)
    deps: [crdb:cluster:bootstrap]

  crdb:cluster:delete:
    desc: Delete a CockroachDB cluster
    cmds:
      - |
        echo "Deleting CockroachDB cluster..."
        ccloud cluster delete hackathon-demo
        echo "Cluster deleted!"

  crdb:sql:shell:
    desc: Open SQL shell to CockroachDB
    cmds:
      - |
        if [ -z "${COCKROACH_DSN:-}" ]; then
          echo "ERROR: COCKROACH_DSN not set"
          exit 1
        fi
        ccloud cluster sql hackathon-demo

  crdb:backup:list:
    desc: List CockroachDB backups
    cmds:
      - ccloud cluster backup list hackathon-demo

  crdb:ip:allow:
    desc: Allowlist IP for CockroachDB
    cmds:
      - |
        echo "Allowlisting IP..."
        ccloud cluster networking allowlist create hackathon-demo 0.0.0.0/0 --sql --ui --name "hackathon-allowlist"
        echo "IP allowlisted!"

  crdb:test:
    desc: Run CockroachDB integration tests
    cmds:
      - |
        echo "Running CockroachDB integration tests..."
        go test -v -tags "cockroach" ./server/router/api/v1/agent/... -run "TestProcessPendingTickets|TestEmbedTenantTickets|TestBuildTicketClusters|TestEscalateTicket"
        echo "Tests passed!"

  crdb:docker:build:
    desc: Build Docker image for CockroachDB deployment
    cmds:
      - |
        echo "Building Docker image for CockroachDB..."
        docker build -t bchat:cockroach -f Dockerfile.ecs .
        echo "Docker image built!"

  crdb:docker:run:
    desc: Run Docker image for CockroachDB
    cmds:
      - |
        echo "Running Docker image for CockroachDB..."
        docker run -p 8081:8081 \
          -e COCKROACH_DSN="${COCKROACH_DSN}" \
          -e LANCEDB_STORAGE_PROVIDER=cockroach \
          -e RAG_PIPELINE_ENABLED=true \
          -e TICKET_EMBEDDING_ENABLED=true \
          -e EMBEDDING_PROVIDER=openrouter \
          -e OPENROUTER_API_KEY="${OPENROUTER_API_KEY}" \
          bchat:cockroach
        echo "Docker container started!"

  deploy:cockroach:
    desc: Deploy bchat to Fly.io with CockroachDB (build -> checks -> fly deploy -> verify; bugs/057 §4.10)
    cmds:
      - bash scripts/crdb-deploy.sh {{.CLI_ARGS}}

  deploy:postgres:
    desc: Deploy bchat to Fly.io with Neon Postgres (proves the same Taskfile drives both profiles)
    cmds:
      - fly -a bchat-pg deploy -c fly_pg.toml

  verify:production:
    desc: App-first smoke against the deployed instance (create tenant -> KB -> reindex -> RAG search -> destroy; bugs/057 §6.3)
    cmds:
      - bash scripts/verify-production.sh {{.CLI_ARGS}}

  rollback:postgres:
    desc: Flip bchat-crdb back to Neon Postgres (demo capability; bugs/057 §6.4) — needs DATABASE_URL secret + Neon RAG envs
    cmds:
      - fly secrets set DATABASE_URL="$DATABASE_URL" --app bchat-crdb
      - fly secrets unset COCKROACH_DSN --app bchat-crdb
      - fly -a bchat-crdb deploy -c fly_pg-rollback.toml
      - task verify:production

  crdb:harden:
    desc: Restrict CockroachDB Cloud allowlist to a Fly egress IP (~$3.60/mo; bugs/057 §6.5)
    cmds:
      - |
        CLUSTER="${COCKROACH_CLUSTER:-hackathon-demo}"
        echo "=== CockroachDB networking hardening ==="
        IP=$(fly ips allocate-egress -a bchat-crdb 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -1)
        if [ -z "$IP" ]; then
          echo "ERROR: failed to allocate Fly egress IP"; exit 1
        fi
        echo "Egress IP: $IP"
        ccloud cluster networking allowlist create "$CLUSTER" "$IP/32" --sql --ui --name fly-egress || exit 1
        ccloud cluster networking allowlist delete "$CLUSTER" 0.0.0.0/0 --yes || echo "WARN: 0.0.0.0/0 removal failed"
        echo "Verifying connectivity from this host..."
        if ! ccloud cluster sql "$CLUSTER" -e "SELECT 1;" 2>/dev/null; then
          echo "ERROR: connectivity broken — reverting"
          ccloud cluster networking allowlist delete "$CLUSTER" "$IP/32" --yes
          ccloud cluster networking allowlist create "$CLUSTER" 0.0.0.0/0 --sql --ui --name all
          echo "Reverted to 0.0.0.0/0. Connectivity was broken after egress IP allocation."
          exit 1
        fi
        echo "Hardening complete: only $IP/32 allowlisted"