import {
	buildHostApprovalUrl,
	listWakeSecretsForStatus,
	WEBHOOK_HOST,
	type WakeSecretMeta,
} from './registry.ts'

/**
 * Return grokBotWake secret metadata (names, scopes, allowed hosts). Never values.
 *
 * Call via `import secretStatus from 'kody:@kentcdodds/grok-bot/secret-status'`.
 * Uses direct `secretList` / stamp-optimistic package-bucket fallbacks only —
 * no subscription dispatch.
 */
export default async function secretStatus(): Promise<{
	secrets: WakeSecretMeta[]
	needsHostApproval: Array<{ name: string; scope: string; approvalUrl: string }>
}> {
	const secrets = (await listWakeSecretsForStatus()) ?? []
	const needsHostApproval = secrets
		.filter((secret) => !secret.allowed_hosts.includes(WEBHOOK_HOST))
		.map((secret) => ({
			name: secret.name,
			scope: secret.scope,
			approvalUrl: buildHostApprovalUrl({
				scope: secret.scope || 'user',
				secretName: secret.name,
			}),
		}))
	return { secrets, needsHostApproval }
}