#!/bin/bash
set -euo pipefail
umask 077
unset VERCEL_PROJECT_ID VERCEL_ORG_ID
export VERCEL_TELEMETRY_DISABLED=1 NO_UPDATE_NOTIFIER=1
GS_RECOVER_DIR="$HOME/Downloads/gemsignal-live.cUR7Ok"
GS_RECOVER_TEAM='cordearos-projects-21287756'
cd "$GS_RECOVER_DIR"
v() { npx --yes vercel@59.16.0 "$@"; }
node --input-type=module <<'JS'
import fs from 'node:fs';import crypto from 'node:crypto';
const p=JSON.parse(fs.readFileSync('.vercel/project.json'));
if(p.projectId!=='prj_Eb2ofP8qEgEDEp5J4u7uugZtxJvQ'||p.orgId!=='team_UTCt2CDSGCYbEp3IV7KhCJzT')throw Error('This source folder is not the verified GemSignal project.');
const hash=b=>crypto.createHash('sha256').update(b).digest('hex');
const live=await fetch('https://gemsignal.lol/app.js',{redirect:'error',cache:'no-store',signal:AbortSignal.timeout(20000)});
if(!live.ok||hash(Buffer.from(await live.arrayBuffer()))!==hash(fs.readFileSync('public/app.js')))throw Error('The current website differs from this source. Update the local GemSignal source before resetting.');
JS
v project inspect gemsignal --scope "$GS_RECOVER_TEAM"
printf '\nReplace the GemSignal owner email and password using your authenticated Vercel account.\nSaved history, provider keys and notification settings are preserved. Existing login sessions will expire.\n'
trap 'unset GS_RECOVER_PASSWORD GS_RECOVER_CONFIRM GS_RECOVER_RECORD GS_OWNER_EMAIL' EXIT
read -r -p 'New GemSignal owner email: ' GS_OWNER_EMAIL
export GS_OWNER_EMAIL
read -r -s -p 'New password (at least 12 characters): ' GS_RECOVER_PASSWORD
printf '\n'
read -r -s -p 'Confirm new password: ' GS_RECOVER_CONFIRM
printf '\n'
if [ "$GS_RECOVER_PASSWORD" != "$GS_RECOVER_CONFIRM" ]; then echo 'Passwords differ. Nothing was changed.'; exit 1; fi
GS_RECOVER_RECORD=$(printf '%s' "$GS_RECOVER_PASSWORD" | node scripts/create-owner-login.mjs)
unset GS_RECOVER_PASSWORD GS_RECOVER_CONFIRM
printf '%s' "$GS_RECOVER_RECORD" | v env add GEMSIGNAL_OWNER_LOGIN production --force --sensitive --scope "$GS_RECOVER_TEAM"
unset GS_RECOVER_RECORD GS_OWNER_EMAIL
echo 'New owner login saved in Vercel. Deploying it now. If deployment fails, run the deploy command again from this source folder.'
v deploy --prod --yes --scope "$GS_RECOVER_TEAM"
echo 'Open https://gemsignal.lol and sign in using the new email and password.'
echo 'If you receive a database/service error, retain that message; a login reset does not repair database availability.'