#!/usr/bin/env bash
# Bootstrap handoff to the identity owner's isolated archive verifier.
set -euo pipefail
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
if [[ $# == 0 || "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
  cat <<'EOF'
Usage: bin/railiance identity-recovery --transfer-receipt PATH --receipt NEW_PATH

Run through net-kingdom/sso-mfa/bootstrap/sops-custody-unlock.sh --prompt
with the independently held railiance-backup age key. Requires an independently
retrieved ciphertext and its safe transfer receipt, age, Docker and the pinned
PostgreSQL image. Default owner checkout: sibling net-kingdom; set
NETKINGDOM_RECOVERY_ROOT to an explicitly reviewed alternative checkout.

This decrypts only into disposable local storage and verifies the full manifest,
SQLite/key pairs and native PostgreSQL restore. It does not restore production,
contact SSO or prove full identity authentication/audit continuity.
See docs/identity-recovery.md for the bootstrap ordering and custody handoff.
EOF
  exit 0
fi
OWNER="${NETKINGDOM_RECOVERY_ROOT:-${ROOT}/../net-kingdom}"
CHECKER="${OWNER}/tools/bootstrap-recovery/verify-identity.py"
if [[ ! -f "$CHECKER" || ! -f "${OWNER}/tools/bootstrap-recovery/identity-backup-profile.json" ]]; then
  echo 'Missing reviewed NetKingdom recovery checkout; see docs/identity-recovery.md.' >&2
  exit 1
fi
exec python3 "$CHECKER" "$@"
