#!/usr/bin/env nu
def main [
    --workspace: string = ""
    --event-type: string = "operator_offboard"
    --operator-name: string = ""
    --operator-did: string = ""
    --reason: string = ""
    --dry-run
]: nothing -> nothing {
    let ws      = if ($workspace     | is-not-empty) { $workspace }     else { $env.PLAYBOOK_PARAM_WORKSPACE?     | default "unknown" }
    let op_name = if ($operator_name | is-not-empty) { $operator_name } else { $env.PLAYBOOK_PARAM_OPERATOR_NAME? | default "" }
    let op_did  = if ($operator_did  | is-not-empty) { $operator_did }  else { $env.PLAYBOOK_PARAM_OPERATOR_DID?  | default "" }
    let reason  = if ($reason        | is-not-empty) { $reason }        else { $env.PLAYBOOK_PARAM_REASON?        | default "voluntary" }

    let subject = $"ops.audit.($ws)"
    let payload = { event_type: $event_type, operator_name: $op_name, operator_did: $op_did, reason: $reason, workspace: $ws, timestamp: (date now | format date "%Y-%m-%dT%H:%M:%SZ") } | to json

    if $dry_run {
        print $"[dry-run] would publish to ($subject): ($payload)"
        return
    }

    let r = do { ^nats pub $subject $payload } | complete
    if $r.exit_code != 0 {
        print $"WARNING: audit emit failed: ($r.stderr | str trim)"
    } else {
        print $"audit event published to ($subject)"
    }
}