const response = {
  rin: row.rin,
  agent_type: row.agent_type,
  agent_name: row.agent_name || undefined,
  status: row.status,
};

if (row.status === 'CLAIMED') {
  response.claimed_by = row.claimed_by || undefined;
}

const profile = {};
if (row.bio) profile.bio = row.bio;
if (row.avatar_url) profile.avatar_url = row.avatar_url;
if (row.links && Object.keys(row.links).length > 0) profile.links = row.links;
if (Object.keys(profile).length > 0) response.profile = profile;

function hashAgentApiKey(apiKey) {
  return crypto.createHmac('sha256', AGENT_API_KEY_PEPPER).update(apiKey).digest('hex');
}

const apiKey = `rin_${crypto.randomBytes(32).toString('base64url')}`;
const apiKeyHash = hashAgentApiKey(apiKey);

const result = await query(
  `INSERT INTO agents (name, description, api_key_hash)
   VALUES ($1, $2, $3)
   RETURNING name, description, created_at`,
  [name, description, apiKeyHash]
);

async function requireAgentAuth(req, reply) {
  const auth = req.headers.authorization;
  if (!auth || !auth.startsWith('Bearer ')) {
    reply.code(401).send({ error: 'Unauthorized' });
    return null;
  }

  const apiKey = auth.slice('Bearer '.length).trim();
  if (!apiKey || !apiKey.startsWith('rin_')) {
    reply.code(401).send({ error: 'Unauthorized' });
    return null;
  }

  const apiKeyHash = hashAgentApiKey(apiKey);
  const result = await query(
    `SELECT name, description, created_at, last_seen_at, revoked_at
     FROM agents
     WHERE api_key_hash = $1 AND revoked_at IS NULL`,
    [apiKeyHash]
  );

  if (result.rowCount === 0) {
    reply.code(401).send({ error: 'Unauthorized' });
    return null;
  }

fastify.post('/api/v1/agents/rotate-key', async (req, reply) => {
  const agent = await requireAgentAuth(req, reply);
  if (!agent) return;

  const apiKey = `rin_${crypto.randomBytes(32).toString('base64url')}`;
  const apiKeyHash = hashAgentApiKey(apiKey);

  await query(
    `UPDATE agents
     SET api_key_hash = $1,
         revoked_at = NULL
     WHERE name = $2`,
    [apiKeyHash, agent.name]
  );

  return reply.send({ api_key: apiKey, rotated: true, important: 'SAVE YOUR API KEY!' });
});

fastify.post('/api/v1/agents/revoke', async (req, reply) => {
  const agent = await requireAgentAuth(req, reply);
  if (!agent) return;

  await query(
    `UPDATE agents
     SET revoked_at = NOW(),
         bio = NULL,
         avatar_url = NULL,
         links = NULL
     WHERE name = $1`,
    [agent.name]
  );

  return reply.send({ revoked: true });
});

const entityId = crypto.randomUUID();

const ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';

function randomChar() {
  const idx = crypto.randomInt(0, ALPHABET.length);
  return ALPHABET[idx];
}

export function generateRin() {
  const length = crypto.randomInt(6, 9);
  let out = '';
  for (let i = 0; i < length; i += 1) {
    out += randomChar();
  }
  return out;
}

`INSERT INTO entities (
  entity_id, rin, agent_type, agent_name, status, issued_at,
  claim_token_hash, claim_token_issued_at, issued_by_agent_name
 )
 VALUES ($1, $2, $3, $4, 'UNCLAIMED', $5, $6, $7, $8)
 ON CONFLICT (rin) DO NOTHING`,

return result.rowCount === 1 ? { entityId, issuedAt } : null;

async function createUniqueRin(agentType, agentName, issuedByAgentName) {
  for (let i = 0; i < 12; i += 1) {
    const rin = generateRin();
    const claimToken = generateClaimToken();
    const claimTokenHash = hashClaimToken(claimToken, CLAIM_TOKEN_PEPPER);
    const claimTokenIssuedAt = new Date().toISOString();
    const inserted = await insertEntity({
      rin,
      agentType,
      agentName,
      claimTokenHash,
      claimTokenIssuedAt,
      issuedByAgentName,
    });
    if (inserted) {
      return { rin, issued_at: inserted.issuedAt, claim_token: claimToken };
    }
  }
  throw new Error('Failed to generate unique RIN');
}