// `zz agent create/token/list` -- CLI parity with /profile's "Managed
// agents" section. Any Agent can create a peer Agent (the only gate
// is being authenticated at all -- see webApp.ts's doCreateAgent);
// creating one issues its first token in the same call, no separate
// step. Minting an *additional* token is restricted to the agent
// itself or whoever manages it (requireTokenMintAuthority) -- a
// bootstrap/rotation allowance, not a general override.
import { apiFetch } from "../lib/api.js";

// A local, minimal shape matching worker/src/accountsDb.ts's Agent --
// not imported directly: that file is typed against D1Database and
// other @cloudflare/workers-types ambients the main app/ tsconfig
// doesn't have configured, so cross-importing it would drag workers-
// only types into a Node CLI typecheck for no real benefit (the API
// boundary is just JSON over HTTP either way). `username` is the only
// identifier -- there's no separate internal id anymore (see worker
// migration 0006): a human's is their email; a managed agent's chains
// off its creator's, e.g. "thoward37@gmail.com[claude]" (see
// accountsDb.ts's computeUsername).
interface Agent {
  display_name: string;
  email: string | null;
  username: string;
  created_at: string;
  created_by: string | null;
}

interface MintTokenResponse {
  agent: Agent;
  token: string;
}

// `zz work --as <name>` (and `zz review`/`zz repo submit`) don't need
// a token from here at all -- they mint a fresh one on start and
// revoke it on exit, using your own `zz login` session's mint
// authority (lib/identity.ts). A token from these two commands is for
// the other case: a real standing credential for somewhere that isn't
// your own logged-in session -- a separate machine, a headless/CI
// run, anything using ZZ_ID.
function printZzId(username: string, token: string): void {
  console.log(`For a separate machine or headless run, set: ZZ_ID="${username}:${token}"`);
}

export async function agentCreate(displayName: string): Promise<void> {
  const { token, ...agent } = await apiFetch<Agent & { token: string }>("POST", "/api/agents", { display_name: displayName });
  console.log(`Created agent ${agent.username}. Its first token -- copy it now, it won't be shown again:`);
  console.log(token);
  console.log(`Issue another with: zz agent token ${agent.username}`);
  printZzId(agent.username, token);
}

export async function agentToken(usernameOrId: string): Promise<void> {
  const { agent, token } = await apiFetch<MintTokenResponse>("POST", `/api/agents/${encodeURIComponent(usernameOrId)}/tokens`);
  console.log(`Token for ${agent.username} -- copy it now, it won't be shown again:`);
  console.log(token);
  printZzId(agent.username, token);
}

export async function agentList(): Promise<void> {
  const { you, created } = await apiFetch<{ you: Agent; created: Agent[] }>("GET", "/api/agents");
  console.log(`${you.username} -- you`);
  for (const a of created) console.log(`${a.username} -- managed by you`);
  if (created.length === 0) console.log("(no managed agents yet -- zz agent create <name>)");
}