//! `spectra agent`: agents as their owner's delegates (spec §8.1).

//!

//! `add` makes the agent's key pair in its own home, prints the one `oxy`

//! command that makes it the owner's, and records the agent only once the

//! owner's identity delegates to it. There is no agent without an owner.

use super::identity::{owner_home, refresh_owner};

use super::{marks, ui, Ctx};

use anyhow::{bail, Context, Result};

use spectra_core::ids::now_ms;

use spectra_core::keys::{home_identity, KeyPair};

use spectra_core::ledger::Ledger;

use spectra_core::principals::{identity_payload, signed_event, Principal, Principals, DEFAULT_SCOPES, DELEGATION_SCOPE};

use std::path::PathBuf;

use std::time::Duration;

pub const KINDS: &[&str] = &["claude-code", "antigravity", "kimi-code", "codex", "other"];

pub struct Add {

    pub name: String,

    pub kind: String,

    pub project: String,

    pub home: PathBuf,

    pub uid: Option<u32>,

    pub learn_uid: bool,

    pub wait_secs: u64,

    pub owner_home: Option<PathBuf>,

}

pub async fn add(ctx: &Ctx, a: Add) -> Result<i32> {

    if !valid_name(&a.name) {

        bail!("an agent's name is lower-case letters, digits and dashes, starting with a letter or digit, at most 64");

    }

    if !KINDS.contains(&a.kind.as_str()) {

        bail!("--kind is one of {}", KINDS.join(", "));

    }

    {

        let ledger = Ledger::open_read_only(&ctx.db()?).await?;

        let p = Principals::load(&ledger).await?;

        if p.agent_key(&a.name).is_some() {

            bail!("an agent named {} already exists (spectra agent list)", a.name);

        }

    }

    let home = owner_home(ctx, a.owner_home.clone());

    // The agent's key, made once in its own home and reused if `add` is run again.

    let agent = if a.home.join("keys").exists() {

        KeyPair::load_home(&a.home).with_context(|| format!("reading the agent's key in {}", a.home.display()))?

    } else {

        let pair = KeyPair::create_home(&a.home, &a.name, "")?;

        println!("{} {}  {}", ui::done("Created"), ui::subject(format!("{}'s key", a.name)), ui::path(a.home.display()));

        pair

    };

    let delegated = |id: &oxy_core::identity::Identity| id.delegates_to(&agent.key, DELEGATION_SCOPE, now_ms());

    if !delegated(&home_identity(&home)?) {

        println!("{} {}", ui::caution(), ui::warn(format!("{} is not yours yet: delegate to its key, as yourself:", a.name)));

        println!(

            "    {}",

            ui::id(format!(

                "oxy identity delegate add {} --scope changes --expires 8h",

                a.home.join("keys").join(format!("{}.identity", agent.key.to_hex())).display()

            ))

        );

        let spin = ui::spinner(&format!(

            "waiting for your delegation to {} (up to {} s; Ctrl-C stops, and running this again resumes)",

            a.name, a.wait_secs

        ));

        let deadline = std::time::Instant::now() + Duration::from_secs(a.wait_secs);

        loop {

            if home_identity(&home).is_ok_and(|id| delegated(&id)) {

                spin.clear();

                break;

            }

            if std::time::Instant::now() >= deadline {

                spin.clear();

                bail!("{}'s key is not delegated yet: run the command above, then this again", a.name);

            }

            tokio::time::sleep(Duration::from_secs(2)).await;

        }

    }

    let ledger = ctx.writer().await?;

    refresh_owner(&ledger, &home).await?;

    let owner = KeyPair::load_home(&home)?;

    let mut p = identity_payload(&agent.identity);

    p["name"] = a.name.clone().into();

    p["kind"] = a.kind.into();

    p["project"] = a.project.into();

    p["home"] = a.home.display().to_string().into();

    p["owner"] = owner.key.to_hex().into();

    p["owner_name"] = owner.identity.name.clone().into();

    p["scopes"] = DEFAULT_SCOPES.into();

    if let Some(u) = a.uid {

        p["uid"] = u.into();

    }

    p["learn_uid"] = a.learn_uid.into();

    let d = owner.identity.delegate(&agent.key).context("the delegation vanished")?;

    p["delegation"] = serde_json::json!({ "scope": d.scope.names(), "expires": d.expires });

    ledger.append_one(signed_event(&owner, "human", "agent.added", p)).await?;

    ledger.checkpoint().await?;

    println!("{} {}{}{}", ui::done("Added"), ui::subject(&a.name), ui::sep(), ui::author(format!("{}'s agent", owner.identity.name)));

    println!("{}", ui::kv("key", ui::hash(agent.key.to_hex())));

    let until = d.expires.map(|e| format!(" until {}", super::format::when(e))).unwrap_or_default();

    println!("{}", ui::kv("delegated", format!("{}{until}", d.scope.names().join(","))));

    println!("  {} {} {}", ui::note(), ui::dim("connect its client with"), ui::id(format!("spectra mcp --agent {}", a.name)));

    Ok(0)

}

pub async fn list(ctx: &Ctx, json: bool) -> Result<i32> {

    let ledger = Ledger::open_read_only(&ctx.db()?).await?;

    let p = Principals::load(&ledger).await?;

    let rows: Vec<(String, String, String, String, Option<i64>)> =

        sqlx::query_as("SELECT name, key, kind, project, disabled_ms FROM agents ORDER BY name").fetch_all(ledger.pool()).await?;

    let owner = p.owner();

    let now = now_ms();

    let mut out = Vec::new();

    for (name, key, kind, project, disabled) in rows {

        let k = oxy_core::hash::ObjectRef::from_hex(&key).context("a stored key")?;

        let state = match p.principal(&k, now) {

            Ok(_) => "ok".to_string(),

            Err(why) => why,

        };

        let expires = owner.and_then(|o| o.delegate(&k)).and_then(|d| d.expires);

        let who = match p.principal(&k, now) {

            Ok(pr @ Principal::Agent { .. }) => pr.display(),

            _ => format!("{name} · {}'s agent", owner.map(|o| o.name.as_str()).unwrap_or("?")),

        };

        out.push(serde_json::json!({ "name": name, "display": who, "key": key, "kind": kind, "project": project, "state": state, "delegation_expires": expires, "disabled": disabled.is_some() }));

    }

    if json {

        println!("{}", serde_json::Value::Array(out));

        return Ok(0);

    }

    if out.is_empty() {

        println!("{} {}", ui::note(), ui::dim("no agents yet: spectra agent add NAME --kind KIND --project PROJECT --home DIR"));

    }

    for a in out {

        let state = a["state"].as_str().unwrap_or("");

        let until = a["delegation_expires"].as_u64().map(|e| format!("{}until {}", ui::sep(), super::format::when(e))).unwrap_or_default();

        let display = a["display"].as_str().unwrap_or("");

        let (name, owner) = display.split_once(" · ").unwrap_or((display, ""));

        println!("{} {}{}{}", marks::health(state), ui::subject(name), ui::sep(), ui::author(owner));

        println!(

            "  {}",

            ui::dim(format!(

                "{}{}{}{}{}{until}",

                a["kind"].as_str().unwrap_or(""),

                ui::sep(),

                a["project"].as_str().unwrap_or(""),

                ui::sep(),

                &a["key"].as_str().unwrap_or("")[..12]

            ))

        );

        if state != "ok" {

            println!("  {} {}", ui::caution(), ui::warn(state));

        }

    }

    Ok(0)

}

pub async fn disable(ctx: &Ctx, name: &str, owner_home_flag: Option<PathBuf>) -> Result<i32> {

    let ledger = ctx.writer().await?;

    let p = Principals::load(&ledger).await?;

    p.agent_key(name).with_context(|| format!("no agent named {name}"))?;

    let home = owner_home(ctx, owner_home_flag);

    refresh_owner(&ledger, &home).await?;

    let owner = KeyPair::load_home(&home)?;

    ledger.append_one(signed_event(&owner, "human", "agent.disabled", serde_json::json!({ "name": name }))).await?;

    ledger.checkpoint().await?;

    println!("{} {}", ui::done("Disabled"), ui::subject(name));

    println!("  {} {}", ui::note(), ui::dim("its key is refused from now on; earlier events keep their signatures"));

    Ok(0)

}

pub fn valid_name(n: &str) -> bool {

    !n.is_empty()

        && n.len() <= 64

        && n.bytes().next().is_some_and(|b| b.is_ascii_lowercase() || b.is_ascii_digit())

        && n.bytes().all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'-')

}