#!/usr/bin/env bash
set -euo pipefail

# Validate the managed-production Control Panel handoff without printing secrets.
# The harness preflight adds Vault Transit, S3 Object Lock and digest-pinned
# images to the original TLS/OIDC/nginx contract.

ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"
ENV_FILE="${CASAN_CP_PROD_ENV:-$ROOT/infra/production/casan-prod.env}"

bash "$ROOT/packages/casan-harness/scripts/bash/production-preflight.sh" "$ENV_FILE"
echo "CP_PROD_READINESS_PASS production_preflight=true"