#!/usr/bin/env nu
def main [
    --workspace: string = ""
    --key-type: string = ""
    --dry-run
]: nothing -> nothing {
    let ws    = if ($workspace | is-not-empty) { $workspace } else { $env.PLAYBOOK_PARAM_WORKSPACE? | default "" }
    let ktype = if ($key_type  | is-not-empty) { $key_type }  else { $env.PLAYBOOK_PARAM_KEY_TYPE?  | default "" }

    if ($ws | is-empty) { error make { msg: "workspace is required" } }

    let repo = $"state-($ws)"

    if $dry_run {
        print $"[dry-run] would await quorum signatures on pending delegation patch in ($repo)"
        return
    }

    let list_r = do { ^rad patch list --repo $repo --state open --json } | complete
    if $list_r.exit_code != 0 {
        error make { msg: $"Cannot list open patches on ($repo): ($list_r.stderr | str trim)" }
    }

    let patches = $list_r.stdout | from json
    let delegation_patches = $patches | where { |p|
        ($p.title? | default "" | str contains "Rotate") and ($p.title? | default "" | str contains $ktype)
    }

    if ($delegation_patches | is-empty) {
        error make { msg: $"No open delegation patch found for ($ktype) in ($repo). Propose one first." }
    }

    let patch_id = $delegation_patches | first | get id
    print $"Found delegation patch ($patch_id) — initiating quorum sign flow"

    let sign_r = do { ^rad patch review $patch_id --repo $repo --accept } | complete
    if $sign_r.exit_code != 0 {
        error make { msg: $"Failed to sign delegation patch ($patch_id): ($sign_r.stderr | str trim)" }
    }

    print $"Signed delegation patch ($patch_id). Remaining quorum members must also sign via: rad patch review ($patch_id) --repo ($repo) --accept"
    print $sign_r.stdout
}