#!/usr/bin/env bash
# Compatibility entry point: metadata-only recovery guide; never export roots.
set +x
set -euo pipefail

CONFIRM=false
case "${1:-}" in
    ""|--reprint|--help) [[ $# -le 1 ]] || exit 2 ;;
    --confirm) [[ $# -eq 1 ]] || exit 2; CONFIRM=true ;;
    *) printf '%s\n' 'ERROR: secret-export arguments are retired; see docs/security-bootstrap-age-custody.md.' >&2; exit 2 ;;
esac

if [[ "$CONFIRM" == true && ( ! -t 0 || ! -t 1 ) ]]; then
    printf '%s\n' 'ERROR: recovery acknowledgment requires an attended terminal.' >&2
    exit 2
fi

cat <<'GUIDE'
NetKingdom recovery guide (non-secret)

The private age key stays in the operator password safe or offline custody.
This command never reads, generates or displays that key or any password.
The encrypted ops bundle holds service recovery material; it does not hold
its own decryption key. Preserve an off-host copy and keep the key separately.

Before acknowledging a newly created bundle:
1. Store the exact encrypted bundle off-host.
2. In the approved isolated recovery workspace, use the custody unlock helper
   to verify that the independently held key can decrypt that bundle.
3. Confirm the needed service recovery files are present without printing them.
4. Remove decrypted drill files and retain only the non-secret drill receipt.

For an actual incident, use the scoped owner recovery procedure. An old
bootstrap snapshot may contain superseded passwords. Guide output or a human
acknowledgment is not a native restore test or evidence of current credentials.
See docs/security-bootstrap-age-custody.md and docs/security-bootstrap-king-credential-kit.md.
GUIDE

if [[ "$CONFIRM" == true ]]; then
    printf '%s' 'After completing those steps, type STORED AND VERIFIED: ' >&2
    IFS= read -r answer || exit 2
    [[ "$answer" == 'STORED AND VERIFIED' ]] || { printf '%s\n' 'ERROR: custody acknowledgment not received.' >&2; exit 2; }
    unset answer
    printf '%s\n' 'Recovery handoff acknowledged by the operator; retain the independent drill receipt.'
fi