import { join } from 'node:path'
import { findProjectRoot } from '../../../paths.ts'
import { defineTool, type RegisteredTool } from '../../server.ts'
import { ENV_FILE, resolveEthKey } from './eth-key.ts'

/**
 * Decide which eth proof-owner key `run_proof` should sign with, BEFORE
 * calling it. The key is a raw 0x-hex Ethereum private key, resolved (no
 * `~/.reclaim` cache) from:
 *   1. `RECLAIM_PRIVATE_KEY` in the MCP env
 *   2. a `RECLAIM_PRIVATE_KEY=0x…` line in the project `.env`
 *   3. a file at `RECLAIM_PRIVATE_KEY_FILE` holding the raw hex
 *   4. none → ask the dev to generate (issue_credentials) or provide one
 *      (import_credentials), then call again.
 * Never returns the private key — only the derived address.
 */
export function resolveOwnerKeyTool(): RegisteredTool {
	return defineTool<Record<string, never>>(
		{
			name: 'resolve_owner_key',
			description:
				'Resolve which eth proof-owner key run_proof should sign with — ' +
				'call this BEFORE run_proof. Checks, in order: RECLAIM_PRIVATE_KEY ' +
				'in the MCP env, a RECLAIM_PRIVATE_KEY=0x… line in the project .env, ' +
				'then a file at RECLAIM_PRIVATE_KEY_FILE holding the raw hex. ' +
				'Returns { ready: true, address, source } when one is ' +
				'available — pass `address` to run_proof as `ownerAddress`. ' +
				'Returns { ready: false } ' +
				'when none exists: then ask the dev to generate one ' +
				'(issue_credentials) or import one they already hold ' +
				'(import_credentials, accepts 0x-hex or a key-file path), and call ' +
				'resolve_owner_key again. Never exposes the private key.',
			inputSchema: { type: 'object', properties: {} },
		},
		async() => {
			const projectDir = findProjectRoot(process.cwd())
			const resolved = resolveEthKey(projectDir)
			if(resolved) {
				return {
					ready: true,
					address: resolved.address,
					source: resolved.source,
					...(resolved.path ? { path: resolved.path } : {}),
				}
			}

			return {
				ready: false,
				message:
					'No eth proof-owner key available — no RECLAIM_PRIVATE_KEY in the ' +
					`env, no RECLAIM_PRIVATE_KEY in ${join(projectDir, ENV_FILE)}, and ` +
					'no RECLAIM_PRIVATE_KEY_FILE. Ask the dev to generate one via ' +
					'issue_credentials, or import one they already hold via ' +
					'import_credentials (0x-hex or a key-file path). Then call ' +
					'resolve_owner_key again and pass its address to run_proof as ' +
					'ownerAddress.',
			}
		},
	)
}