// Package aifin registers Wind AIFin Market over AgentTeam's shared guarded MCP
// runtime. It exposes only thirteen named, read-only Actions across five fixed
// endpoint families.
package aifin

import (
	"fmt"

	"github.com/tidbcloud/AgentTeam/internal/extension"
	"github.com/tidbcloud/AgentTeam/internal/extension/registry"
	"github.com/tidbcloud/AgentTeam/internal/extension/runner"
)

const (
	// Domain is the immutable Extension identity.
	Domain = "aifinmarket"
	// Revision identifies the first guarded static MCP implementation.
	Revision = "aifinmarket-mcp-v1"
)

// Extension composes the provider with the bounded, least-privilege
// five-endpoint Probe validator.
func Extension(
	credentials runner.CredentialSource,
) (extension.Extension, error) {
	clients, err := newMCPClients(nil)
	if err != nil {
		return extension.Extension{}, err
	}
	executor, err := newExecutor(credentials, clients)
	if err != nil {
		return extension.Extension{}, fmt.Errorf(
			"wind AIFin Market: build executor: %w",
			err,
		)
	}
	return extension.Extension{
		Definition: Definition(),
		Implementation: runner.Implementation{
			Executor:            executor,
			Revision:            Revision,
			ConnectionPolicy:    registry.ConnectionRequired,
			Auth:                AuthSpec(),
			ValidateCredentials: ValidateCredentials,
		},
		Distribution: extension.Distribution{
			AppID:                     "app_aifinmarket",
			AppSlug:                   Domain,
			DefaultName:               Domain,
			DefaultEnabled:            true,
			IconURL:                   "/app-icons/aifinmarket.svg",
			GenericProviderConnection: true,
		},
	}, nil
}

// AuthSpec declares one installation-scoped WIND_API_KEY sent only as a
// Bearer credential by the shared MCP transport.
func AuthSpec() runner.AuthSpec {
	return runner.AuthSpec{
		Kind: runner.AuthBearer,
		Fields: []runner.CredentialField{
			runner.APIKeyField(
				"Wind API Key",
				"The WIND_API_KEY from your Wind AIFin Market account.",
			),
		},
	}
}