#!/usr/bin/env nu
def main [
    --workspace: string = ""
    --key-type: string = ""
    --dry-run
]: nothing -> nothing {
    let ws    = if ($workspace | is-not-empty) { $workspace } else { $env.PLAYBOOK_PARAM_WORKSPACE? | default "" }
    let ktype = if ($key_type  | is-not-empty) { $key_type }  else { $env.PLAYBOOK_PARAM_KEY_TYPE?  | default "" }

    if ($ws | is-empty) { error make { msg: "workspace is required" } }

    if $dry_run {
        print $"[dry-run] would verify ($ktype) signing continuity for workspace ($ws)"
        return
    }

    match $ktype {
        "ops-controller" => {
            let rollout_r = do { ^kubectl rollout status deployment/ops-controller --namespace "ops-system" --timeout=120s } | complete
            if $rollout_r.exit_code != 0 {
                print $"WARNING: ops-controller rollout not stable: ($rollout_r.stderr | str trim)"
                return
            }
            print "ops-controller rollout stable"

            let stream = $"OPS_PENDING_(($ws | str upcase))"
            let nats_r = do { ^nats stream info $stream --json } | complete
            if $nats_r.exit_code != 0 {
                print "WARNING: cannot verify NATS stream connectivity after key rotation"
            } else {
                let depth = $nats_r.stdout | from json | get state.messages
                print $"NATS stream ($stream) reachable — pending ops: ($depth)"
            }
        }
        "keeper" => {
            let health_r = do { ^ssh $"($env.PLAYBOOK_PARAM_OPS_VM_HOST? | default "ops-vm")" "curl -sf http://127.0.0.1:9081/health" } | complete
            if $health_r.exit_code != 0 {
                print "WARNING: keeper health endpoint not responding after key rotation"
            } else {
                print "keeper health: OK"
                print $health_r.stdout
            }
        }
        "operator" => {
            print "operator key rotation continuity: verified at sign_delegation_patch step (quorum threshold maintained)"
        }
        _ => { print $"WARNING: no continuity check defined for key-type ($ktype)" }
    }
}