#!/usr/bin/env python
"""List pseudonymous D2 accounts for a tenant (no secrets, no credential material).

Usage:
  python scripts/d2_list_accounts.py --db-path /tmp/amanpay-d2/amanpay.db --tenant event-alpha
"""

from __future__ import annotations

import argparse

from amanpay.identity.cli import emit, open_storage, resolve_tenant_id
from amanpay.identity.repository import D2Repository


def main(argv=None) -> int:
    ap = argparse.ArgumentParser(description="List D2 accounts (safe projection)")
    ap.add_argument("--db-path", required=True)
    ap.add_argument("--tenant", required=True, help="tenant id or slug")
    ap.add_argument("--include-deleted", action="store_true")
    args = ap.parse_args(argv)

    storage = open_storage(args.db_path)
    try:
        repo = D2Repository(storage.db)
        tenant_id = resolve_tenant_id(repo, args.tenant)
        accounts = []
        for u in repo.list_users(tenant_id, include_deleted=args.include_deleted):
            accounts.append({
                "id": u.id, "public_handle": u.public_handle, "display_alias": u.display_alias,
                "role": u.role, "status": u.status,
                "passkey_count": repo.count_active_credentials(u.id),
                "created_at": u.created_at,
            })  # never public keys / handles-hash / session material
        emit({"tenant_id": tenant_id, "count": len(accounts), "accounts": accounts})
    finally:
        storage.close()
    return 0


if __name__ == "__main__":
    raise SystemExit(main())