/**
 * Generic mcpctl resource. Round-trips ANY mcpctl resource kind through the
 * dynamic provider: give it a `kind`, a `name`, an opaque `spec` (sent
 * verbatim to mcpd, which validates it), and an `mcpd` connection.
 *
 *   new mcpctl.McpctlResource("my-server", {
 *     kind: "server",
 *     name: "my-server",
 *     spec: { image: "...", transport: "stdio", ... },
 *     mcpd: { url, token },
 *   });
 */
import * as pulumi from '@pulumi/pulumi';
import { mcpctlProvider } from './provider';

/** mcpd connection + auth. `token` should be a Pulumi secret. */
export interface McpdConnInput {
  url: pulumi.Input<string>;
  token: pulumi.Input<string>;
  timeoutMs?: pulumi.Input<number>;
}

export interface McpctlResourceArgs {
  /** Singular resource kind, e.g. "llm", "server", "project", "secret". */
  kind: pulumi.Input<string>;
  /** Human name — the upsert key (must be unique for the kind). */
  name: pulumi.Input<string>;
  /** Resource body sent verbatim to mcpd (mcpd's Zod schema validates it). */
  spec: pulumi.Input<Record<string, unknown>>;
  /** Target daemon + credentials. */
  mcpd: pulumi.Input<McpdConnInput>;
}

export class McpctlResource extends pulumi.dynamic.Resource {
  /** mcpd's own resource id (CUID) for the managed row. */
  public readonly resourceId!: pulumi.Output<string>;

  constructor(name: string, args: McpctlResourceArgs, opts?: pulumi.CustomResourceOptions) {
    super(
      mcpctlProvider,
      name,
      { ...args, resourceId: undefined },
      {
        ...opts,
        // The connection carries a bearer token — keep it encrypted in state.
        additionalSecretOutputs: [...(opts?.additionalSecretOutputs ?? []), 'mcpd'],
      },
    );
  }
}
