#!/usr/bin/env pwsh
# CASAN L5 Tool Registry Gate - PowerShell port of tool-registry-gate.sh
# Usage:
#   tool-registry-gate.ps1 <tool-id> [idempotency-key]
#
# Exit codes: 0=approved, 2=denied, 64=usage error

param(
    [Parameter(Mandatory=$true, Position=0)][string]$ToolId,
    [Parameter(Position=1)][string]$IdempotencyKey = ""
)

$ErrorActionPreference = "Stop"

$scriptDir   = Split-Path $MyInvocation.MyCommand.Path -Parent
$projectRoot = (Resolve-Path (Join-Path $scriptDir "../../..")).Path
$registry    = Join-Path $projectRoot ".specify/level5/tool-registry.yaml"
$logDir      = Join-Path $projectRoot ".specify/logs/level5"
$txLog       = Join-Path $logDir "tool-registry.jsonl"
$toolCallLog = Join-Path $projectRoot ".specify/logs/audit/tool-calls.jsonl"

if (!(Test-Path $logDir))    { New-Item -ItemType Directory -Force -Path $logDir | Out-Null }
if (!(Test-Path (Split-Path $toolCallLog -Parent))) { New-Item -ItemType Directory -Force -Path (Split-Path $toolCallLog -Parent) | Out-Null }

function New-TraceId {
    try { return [System.Guid]::NewGuid().ToString("D") } catch { return "tool-$(Get-Date -Format 'yyyyMMddHHmmss')-$PID" }
}

if (!(Test-Path $registry)) {
    Write-Error "TOOL_REGISTRY_ERROR: registry not found at $registry"
    exit 1
}

$traceId   = New-TraceId
$timestamp = (Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")

# ── Parse YAML registry (simple line-based parser) ─────────────────────────
$yamlText  = Get-Content $registry -Raw
$toolBlocks = $yamlText -split "\n\s*-\s+id:\s+"
$tools = @{}
foreach ($block in $toolBlocks[1..($toolBlocks.Count-1)]) {
    $lines = $block -split "`n"
    $tid   = $lines[0].Trim()
    $attrs = @{ id = $tid }
    foreach ($line in $lines[1..($lines.Count-1)]) {
        if ($line -match '^\s{4}(\w[^:]+):\s+(.+)$') {
            $k = $Matches[1].Trim(); $v = $Matches[2].Trim().Trim('"')
            $attrs[$k] = $v
        }
    }
    $tools[$tid] = $attrs
}

$tool = $tools[$ToolId]
if (!$tool) {
    $line = "{`"timestamp`":`"$timestamp`",`"trace_id`":`"$traceId`",`"harness`":`"L5-tool-registry`",`"tool_id`":`"$ToolId`",`"decision`":`"denied`",`"reason`":`"unknown_tool`"}"
    Add-Content -Path $txLog -Value $line -Encoding UTF8
    Write-Error "TOOL_DENIED unknown_tool=$ToolId"
    exit 2
}

$sideEffect   = $tool["side_effect"] -eq "true"
$idemRequired = $tool["idempotency_required"] -eq "true"
$riskLevel    = $tool["risk_level"]
$owner        = $tool["owner"]

$decision = "approved"
$reason   = "registered"

if ($sideEffect -and $idemRequired -and [string]::IsNullOrEmpty($IdempotencyKey)) {
    $decision = "denied"
    $reason   = "missing_idempotency_key"
}

$record = "{`"timestamp`":`"$timestamp`",`"trace_id`":`"$traceId`",`"harness`":`"L5-tool-registry`",`"tool_id`":`"$ToolId`",`"owner`":`"$owner`",`"risk_level`":`"$riskLevel`",`"side_effect`":$($sideEffect.ToString().ToLower()),`"idempotency_required`":$($idemRequired.ToString().ToLower()),`"idempotency_key_present`":$(-not [string]::IsNullOrEmpty($IdempotencyKey) | ForEach-Object { $_.ToString().ToLower() }),`"decision`":`"$decision`",`"reason`":`"$reason`"}"
Add-Content -Path $txLog -Value $record -Encoding UTF8

# Per-call audit in tool-calls.jsonl (H2 audit requirement)
$auditLine = "{`"timestamp`":`"$timestamp`",`"trace_id`":`"$traceId`",`"tool`":`"$ToolId`",`"idempotency_key`":`"$IdempotencyKey`",`"decision`":`"$decision`",`"reason`":`"$reason`",`"risk_level`":`"$riskLevel`",`"owner`":`"$owner`"}"
Add-Content -Path $toolCallLog -Value $auditLine -Encoding UTF8

Write-Output "TOOL_$($decision.ToUpper()) tool=$ToolId reason=$reason"

if ($decision -ne "approved") {
    Write-Error "TOOL_REGISTRY_DENIED: '$ToolId' — $reason. Set CASAN_IDEMPOTENCY_KEY env var."
    exit 2
}

exit 0