import { readFileSync } from 'node:fs'
import { findProjectRoot } from '../../../paths.ts'
import { defineTool, type RegisteredTool } from '../../server.ts'
import { writeEthKey } from './eth-key.ts'

export function importTool(): RegisteredTool {
	return defineTool<{
		privateKey?: string
		keyFile?: string
		projectDir?: string
	}>(
		{
			name: 'import_credentials',
			description:
				'Import an eth proof-owner key the dev already holds and persist it ' +
				'to the project `.env` as RECLAIM_PRIVATE_KEY=0x… (mode 0600; `.env` ' +
				'added to .gitignore). Provide EITHER `privateKey` (raw 0x-hex, 64 ' +
				'chars) OR `keyFile` (path to a file holding the raw 0x-hex key). ' +
				'The address is derived locally; the private key is never ' +
				'returned. This is a local signing key only (not registered ' +
				'with any server, ' +
				'unrelated to org auth or encryption).',
			inputSchema: {
				type: 'object',
				properties: {
					privateKey: {
						type: 'string',
						pattern: '^0x?[0-9a-fA-F]{64}$',
						description:
							'Raw Ethereum private key, 0x-prefixed hex (64 hex chars).',
					},
					keyFile: {
						type: 'string',
						description:
							'Path to a file containing the raw 0x-hex private key ' +
							'(absolute or project-relative).',
					},
					projectDir: {
						type: 'string',
						description:
							'Project directory whose `.env` the key is written to. ' +
							'Defaults to the closest ancestor of cwd containing .git or ' +
							'package.json.',
					},
				},
			},
		},
		async(args) => {
			if(!args.privateKey && !args.keyFile) {
				throw new Error('Provide either `privateKey` (0x-hex) or `keyFile`.')
			}

			if(args.privateKey && args.keyFile) {
				throw new Error('Provide only one of `privateKey` or `keyFile`.')
			}

			const projectDir = findProjectRoot(args.projectDir || process.cwd())
			const privateKeyHex = args.keyFile
				? readFileSync(args.keyFile, 'utf8')
				: args.privateKey!
			const { path, address } = writeEthKey(privateKeyHex, projectDir)

			return {
				address,
				path,
				note:
					'Eth proof-owner key written to .env as RECLAIM_PRIVATE_KEY ' +
					'(mode 0600). resolve_owner_key resolves it from .env. Keep .env ' +
					'secret — it has been added to .gitignore.',
			}
		},
	)
}