#!/usr/bin/env nu
# switch_to_operator_only/run.nu — orchestrates the playbook step sequence

def main [
    --workspace: string = ""   # Target workspace (required unless PLAYBOOK_PARAM_WORKSPACE is set)
    --ops-vm-host: string = "" # ops-vm SSH host (required unless PLAYBOOK_PARAM_OPS_VM_HOST set)
    --dry-run                  # Simulate steps without side effects
]: nothing -> nothing {
    let ws      = if ($workspace | is-not-empty)    { $workspace }    else { $env.PLAYBOOK_PARAM_WORKSPACE?   | default "" }
    let vm_host = if ($ops_vm_host | is-not-empty)  { $ops_vm_host }  else { $env.PLAYBOOK_PARAM_OPS_VM_HOST? | default "" }

    if ($ws | is-empty)      { error make { msg: "workspace is required (--workspace or PLAYBOOK_PARAM_WORKSPACE)" } }
    if ($vm_host | is-empty) { error make { msg: "ops-vm-host is required (--ops-vm-host or PLAYBOOK_PARAM_OPS_VM_HOST)" } }

    let playbook_dir = $env.PLAYBOOK_DIR? | default ($env.FILE_PWD | path expand)

    print $"[switch_to_operator_only] workspace=($ws)  ops-vm=($vm_host)  dry-run=($dry_run)"
    print ""

    # Step 1: check queue depth
    print "[step 1/4] check pending queue depth..."
    let queue_result = do { ^nu ($playbook_dir | path join "steps/check_queue.nu") --workspace $ws (if $dry_run { "--dry-run" } else { "" }) } | complete
    if $queue_result.exit_code != 0 {
        print $"  WARNING: queue check failed: ($queue_result.stderr | str trim)"
    } else {
        print $queue_result.stdout
    }

    # Step 2: stop keeper daemon
    print "[step 2/4] stopping keeper-daemon on ($vm_host)..."
    let stop_result = do { ^nu ($playbook_dir | path join "steps/stop_keeper.nu") --ops-vm-host $vm_host (if $dry_run { "--dry-run" } else { "" }) } | complete
    if $stop_result.exit_code != 0 {
        error make { msg: $"Failed to stop keeper-daemon: ($stop_result.stderr | str trim)" }
    }
    print $stop_result.stdout

    # Step 3: verify queue accumulating
    print "[step 3/4] verifying queue accumulates without auto-sign..."
    let verify_result = do { ^nu ($playbook_dir | path join "steps/verify_queue_accumulating.nu") --workspace $ws (if $dry_run { "--dry-run" } else { "" }) } | complete
    if $verify_result.exit_code != 0 {
        print $"  WARNING: verification step failed: ($verify_result.stderr | str trim)"
    } else {
        print $verify_result.stdout
    }

    # Step 4: emit audit event
    print "[step 4/4] emitting mode-switch audit event..."
    let audit_result = do { ^nu ($playbook_dir | path join "steps/emit_audit.nu") --workspace $ws --event-type "mode_switch" --new-mode "operator-only" (if $dry_run { "--dry-run" } else { "" }) } | complete
    if $audit_result.exit_code != 0 {
        print $"  WARNING: audit emit failed: ($audit_result.stderr | str trim)"
    }

    print ""
    print "[switch_to_operator_only] complete"
    print "Verify: keeper status should show mode=operator-only"
}