#!/usr/bin/env nu
# switch_to_vm_ops/run.nu — start keeper-daemon and verify it processes the pending backlog

def main [
    --workspace: string = ""
    --ops-vm-host: string = ""
    --dry-run
]: nothing -> nothing {
    let ws      = if ($workspace | is-not-empty)   { $workspace }   else { $env.PLAYBOOK_PARAM_WORKSPACE?   | default "" }
    let vm_host = if ($ops_vm_host | is-not-empty) { $ops_vm_host } else { $env.PLAYBOOK_PARAM_OPS_VM_HOST? | default "" }

    if ($ws | is-empty)      { error make { msg: "workspace is required" } }
    if ($vm_host | is-empty) { error make { msg: "ops-vm-host is required" } }

    let playbook_dir = $env.PLAYBOOK_DIR? | default ($env.FILE_PWD | path expand)

    print $"[switch_to_vm_ops] workspace=($ws)  ops-vm=($vm_host)  dry-run=($dry_run)"
    print ""

    # Step 1: validate policy
    print "[step 1/6] validating keeper policy..."
    let policy_r = do { ^nu ($playbook_dir | path join "steps/validate_policy.nu") --workspace $ws (if $dry_run { "--dry-run" } else { "" }) } | complete
    if $policy_r.exit_code != 0 {
        error make { msg: $"Policy validation failed — cannot switch to vm-ops with invalid policy: ($policy_r.stderr | str trim)" }
    }
    print $policy_r.stdout

    # Step 2: sync policy repo
    print "[step 2/6] syncing policy repo to ops-vm..."
    let sync_r = do { ^nu ($playbook_dir | path join "steps/sync_policy_repo.nu") --workspace $ws --ops-vm-host $vm_host (if $dry_run { "--dry-run" } else { "" }) } | complete
    if $sync_r.exit_code != 0 {
        error make { msg: $"Policy sync failed: ($sync_r.stderr | str trim)" }
    }
    print $sync_r.stdout

    # Step 3: start keeper daemon
    print "[step 3/6] starting keeper-daemon..."
    let start_r = do { ^nu ($playbook_dir | path join "steps/start_keeper.nu") --ops-vm-host $vm_host (if $dry_run { "--dry-run" } else { "" }) } | complete
    if $start_r.exit_code != 0 {
        error make { msg: $"Failed to start keeper-daemon: ($start_r.stderr | str trim)" }
    }
    print $start_r.stdout

    # Step 4: verify health
    print "[step 4/6] verifying keeper-daemon health..."
    let health_r = do { ^nu ($playbook_dir | path join "steps/verify_keeper_health.nu") --ops-vm-host $vm_host (if $dry_run { "--dry-run" } else { "" }) } | complete
    if $health_r.exit_code != 0 {
        error make { msg: $"keeper-daemon health check failed: ($health_r.stderr | str trim)" }
    }
    print $health_r.stdout

    # Step 5: verify backlog
    print "[step 5/6] verifying backlog processing..."
    let backlog_r = do { ^nu ($playbook_dir | path join "steps/verify_backlog.nu") --workspace $ws (if $dry_run { "--dry-run" } else { "" }) } | complete
    if $backlog_r.exit_code != 0 {
        print $"  WARNING: backlog verification: ($backlog_r.stderr | str trim)"
    } else {
        print $backlog_r.stdout
    }

    # Step 6: emit audit
    print "[step 6/6] emitting mode-switch audit event..."
    let audit_r = do { ^nu ($playbook_dir | path join "steps/emit_audit.nu") --workspace $ws --event-type "mode_switch" --new-mode "vm-ops" (if $dry_run { "--dry-run" } else { "" }) } | complete
    if $audit_r.exit_code != 0 { print $"  WARNING: audit emit failed: ($audit_r.stderr | str trim)" }

    print ""
    print "[switch_to_vm_ops] complete"
    print "Verify: keeper status should show mode=auto"
}