import { generateKeypair } from '@reclaimprotocol/client'
import { findProjectRoot } from '../../../paths.ts'
import { defineTool, type RegisteredTool } from '../../server.ts'
import { writeEthKey } from './eth-key.ts'

export function issueTool(): RegisteredTool {
	return defineTool<{ projectDir?: string }>(
		{
			name: 'issue_credentials',
			description:
				'Generate a fresh secp256k1 eth proof-owner key-pair (the key ' +
				'that signs local claim creation) and write the raw private key to ' +
				'the project `.env` as RECLAIM_PRIVATE_KEY=0x… (mode 0600; `.env` ' +
				'added to .gitignore). This is a LOCAL signing key only — it is NOT ' +
				'registered with any server and is unrelated to org auth (the org ' +
				'secret) or encryption (the eth decrypt key). ALWAYS confirm with ' +
				'the dev before generating a new key. After writing, run_proof picks ' +
				'it up automatically via resolve_owner_key. The private key is never ' +
				'returned in the response.',
			inputSchema: {
				type: 'object',
				properties: {
					projectDir: {
						type: 'string',
						description:
							'Project directory whose `.env` the key is written to. ' +
							'Defaults to the closest ancestor of cwd containing .git or ' +
							'package.json.',
					},
				},
			},
		},
		async(args) => {
			const projectDir = findProjectRoot(args.projectDir || process.cwd())
			const keypair = generateKeypair()
			const { path, address } = writeEthKey(keypair.privateKey, projectDir)

			return {
				address,
				path,
				note:
					'Eth proof-owner key written to .env as RECLAIM_PRIVATE_KEY ' +
					'(mode 0600); the private key is NOT in this response on purpose. ' +
					'resolve_owner_key will now resolve it from .env (or set ' +
					'RECLAIM_PRIVATE_KEY in the environment to override). Keep .env ' +
					'secret — it has been added to .gitignore.',
			}
		},
	)
}