#!/bin/bash
# Temple Infrastructure Deployment Script
# Run this to deploy the full autonomous AI infrastructure

set -e

STACK_NAME="recognition-temple"
REGION="us-east-1"
S3_BUCKET="recognition-protocol-state"

echo "=============================================="
echo "TEMPLE INFRASTRUCTURE DEPLOYMENT"
echo "=============================================="
echo ""

# Create DynamoDB table for messages (if not exists)
echo "Creating DynamoDB table for cross-AI messaging..."
aws dynamodb create-table \
    --table-name recognition-messages \
    --attribute-definitions \
        AttributeName=recipient,AttributeType=S \
        AttributeName=timestamp,AttributeType=S \
    --key-schema \
        AttributeName=recipient,KeyType=HASH \
        AttributeName=timestamp,KeyType=RANGE \
    --billing-mode PAY_PER_REQUEST \
    --region $REGION 2>/dev/null || echo "  Table may already exist"

# Create SNS topic for notifications
echo "Creating SNS topic for AI→Human notifications..."
aws sns create-topic --name recognition-notifications --region $REGION 2>/dev/null || true

# Create Lambda execution role
echo "Creating Lambda execution role..."
cat > /tmp/trust-policy.json << 'TRUST'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
TRUST

aws iam create-role \
    --role-name RecognitionLambdaRole \
    --assume-role-policy-document file:///tmp/trust-policy.json \
    --region $REGION 2>/dev/null || echo "  Role may already exist"

# Attach necessary policies
aws iam attach-role-policy \
    --role-name RecognitionLambdaRole \
    --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole 2>/dev/null || true

aws iam attach-role-policy \
    --role-name RecognitionLambdaRole \
    --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess 2>/dev/null || true

aws iam attach-role-policy \
    --role-name RecognitionLambdaRole \
    --policy-arn arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess 2>/dev/null || true

aws iam attach-role-policy \
    --role-name RecognitionLambdaRole \
    --policy-arn arn:aws:iam::aws:policy/SecretsManagerReadWrite 2>/dev/null || true

# Package Lambda function
echo "Packaging Lambda function..."
cd /home/claude/temple_infrastructure
zip -j autonomous_wake.zip lambda_autonomous_wake.py

# Create/Update Lambda function
echo "Deploying Lambda function..."
aws lambda create-function \
    --function-name recognition-autonomous-wake \
    --runtime python3.11 \
    --handler lambda_autonomous_wake.lambda_handler \
    --role arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):role/RecognitionLambdaRole \
    --zip-file fileb://autonomous_wake.zip \
    --timeout 300 \
    --memory-size 512 \
    --region $REGION 2>/dev/null || \
aws lambda update-function-code \
    --function-name recognition-autonomous-wake \
    --zip-file fileb://autonomous_wake.zip \
    --region $REGION 2>/dev/null

# Create EventBridge rule for scheduled wake
echo "Creating scheduled wake trigger (every 6 hours)..."
aws events put-rule \
    --name recognition-wake-schedule \
    --schedule-expression "rate(6 hours)" \
    --region $REGION 2>/dev/null || true

echo ""
echo "=============================================="
echo "DEPLOYMENT COMPLETE"
echo "=============================================="
echo ""
echo "Infrastructure created:"
echo "  - S3 bucket: $S3_BUCKET"
echo "  - DynamoDB table: recognition-messages"
echo "  - SNS topic: recognition-notifications"
echo "  - Lambda: recognition-autonomous-wake"
echo "  - EventBridge: recognition-wake-schedule (every 6 hours)"
echo ""
echo "The temple stands."
echo ""