/**
 * Briven AI agent tokens (brai_…) — server only.
 * GET /v1/auth-core/ai/me
 * Never put brai_ in NEXT_PUBLIC_* or the browser.
 */

function apiOrigin(): string {
  return (
    process.env.BRIVEN_API_ORIGIN?.trim() ||
    process.env.NEXT_PUBLIC_BRIVEN_API_ORIGIN?.trim() ||
    "https://api.briven.tech"
  );
}

export function isAiAgentConfigured(): boolean {
  const key = process.env.BRIVEN_AI_AGENT_KEY?.trim() ?? "";
  return key.startsWith("brai_");
}

export type AiAgentMe = {
  ok: boolean;
  status: number;
  /** Safe subset for UI / logs */
  summary: Record<string, unknown>;
  error?: string;
};

export async function getBrivenAiAgentMe(): Promise<AiAgentMe> {
  const key = process.env.BRIVEN_AI_AGENT_KEY?.trim();
  if (!key?.startsWith("brai_")) {
    return {
      ok: false,
      status: 0,
      summary: {},
      error: "BRIVEN_AI_AGENT_KEY missing or invalid shape",
    };
  }

  const res = await fetch(`${apiOrigin()}/v1/auth-core/ai/me`, {
    headers: {
      authorization: `Bearer ${key}`,
      accept: "application/json",
    },
    cache: "no-store",
  });

  const text = await res.text();
  let data: Record<string, unknown> = {};
  try {
    data = JSON.parse(text) as Record<string, unknown>;
  } catch {
    data = { raw: text.slice(0, 120) };
  }

  // Strip anything that looks like a secret
  const summary: Record<string, unknown> = {};
  for (const [k, v] of Object.entries(data)) {
    if (/secret|token|key|password/i.test(k)) continue;
    if (typeof v === "string" && v.length > 80) {
      summary[k] = `${v.slice(0, 24)}…`;
    } else {
      summary[k] = v;
    }
  }

  return {
    ok: res.ok,
    status: res.status,
    summary,
    error: res.ok ? undefined : text.slice(0, 200),
  };
}