package tools

import "github.com/modelcontextprotocol/go-sdk/mcp"

const instructions = "Digests-only timestamping. " +
	"Public HTTP (mcp.verae.ai / mcp.veraetime.net): stamp writes need Authorization: Bearer " +
	"<xVerae- key or VeraeTime JWT> — no host-login fallback. " +
	"When VERAE_MCP_EDGE_URL is set, global stamps meter on zap.verae.ai (same billing as PrintIt/Zapier). " +
	"New accounts: tool signup (POST /auth/signup) or portal createUser; admin create_user for operators. " +
	"login is disabled on the public HTTP server. " +
	"Grok Build: bearer_token_file with raw xVerae- or JWT, or -transport stdio. Do not paste tokens into chat."

// NewServer builds an MCP server with the full Verae timestamping tool set.
func NewServer(d *Deps) *mcp.Server {
	s := mcp.NewServer(&mcp.Implementation{
		Name:    "verae-timestamping",
		Version: "0.1.0",
	}, &mcp.ServerOptions{
		Instructions: instructions,
	})
	Register(s, d)
	return s
}

// Register adds stamp, stamp_batch, verify, hash_report, signup, login, session, create_user.
func Register(s *mcp.Server, d *Deps) {
	if d == nil {
		d = &Deps{}
	}
	mcp.AddTool(s, &mcp.Tool{
		Name:        "stamp",
		Description: "Commit a SHA-256. scope=local is the leaf file ledger. scope=global posts the digest to api.veraetime.net and reuses the first CID unless restamp is true. Optional metadata is sent as a verae-meta-git/1 history; blank values do not delete fields.",
	}, d.stamp)
	mcp.AddTool(s, &mcp.Tool{
		Name:        "stamp_batch",
		Description: "Commit up to 500 SHA-256 digests at once. scope=global (default) needs your Verae API key and charges each new digest to your account (your own repeats are free); returns one receipt entry per digest, in order, with the credits charged and your balance.",
	}, d.stampBatch)
	mcp.AddTool(s, &mcp.Tool{
		Name:        "verify",
		Description: "Check a receipt. want_scope=global asks api.veraetime.net (central source of truth).",
	}, d.verify)
	mcp.AddTool(s, &mcp.Tool{
		Name:        "hash_report",
		Description: "JSON-array history of receipts for one SHA-256 (Carfax).",
	}, d.hashReport)
	mcp.AddTool(s, &mcp.Tool{
		Name: "signup",
		Description: "Self-serve create a VeraeTime user (POST /auth/signup, role=user). " +
			"No Authorization required on the public server. Does not return a JWT — " +
			"use a client login or portal to obtain a bearer for stamp.",
	}, d.signup)
	mcp.AddTool(s, &mcp.Tool{
		Name:        "login",
		Description: "Log in to api.veraetime.net. Stores the JWT on this host and does not return it. Disabled on the public HTTP server.",
	}, d.login)
	mcp.AddTool(s, &mcp.Tool{
		Name:        "session",
		Description: "Validate the caller's VeraeTime JWT (Authorization: Bearer). Returns valid, username, role, and expires_at.",
	}, d.session)
	mcp.AddTool(s, &mcp.Tool{
		Name: "create_user",
		Description: "Admin create a VeraeTime user (POST /auth/users / Swagger Auth/createUser). " +
			"Requires Authorization: Bearer of an admin. Used by operators and edge provision; " +
			"self-serve MCP clients should use signup.",
	}, d.createUser)
}