#!/usr/bin/env python
"""Issue a one-time D2 operator invitation. Prints the code exactly once.

Usage:
  python scripts/d2_issue_operator_invite.py --db-path /tmp/amanpay-d2/amanpay.db \
      --tenant event-alpha [--ttl 86400]
"""

from __future__ import annotations

import argparse

from amanpay.identity.cli import emit, open_storage, resolve_tenant_id, snapshot_best_effort
from amanpay.identity.service import IdentityService


def main(argv=None) -> int:
    ap = argparse.ArgumentParser(description="Issue a D2 operator invitation")
    ap.add_argument("--db-path", required=True)
    ap.add_argument("--tenant", required=True, help="tenant id or slug")
    ap.add_argument("--ttl", type=int, default=86400)
    args = ap.parse_args(argv)

    storage = open_storage(args.db_path)
    try:
        ident = IdentityService.from_storage(storage)
        tenant_id = resolve_tenant_id(ident.repo, args.tenant)
        inv, code = ident.invites.create(tenant_id=tenant_id, role="operator",
                                         ttl_seconds=args.ttl)
        gen = snapshot_best_effort(storage)
        emit({"invitation_id": inv.id, "role": "operator", "code": code,
              "expires_at": inv.expires_at, "snapshot_generation": gen,
              "note": "Code shown once — only its hash is stored."})
    finally:
        storage.close()
    return 0


if __name__ == "__main__":
    raise SystemExit(main())