#ifndef BOKF_CLIENT_H
#define BOKF_CLIENT_H

#include <stdint.h>

/* Thin protocol client shared by bokfctl and bokftui. Connects to a unix
   socket path, "tcp:host:port" (plaintext) or "tls:host:port". The TLS
   client verifies the certificate chain and host name; BOKFD_TLS_CA adds a
   PEM file to the trust store (for private CAs and tests). */

struct client_conn {
    int fd;
    void *ssl;
    void *ctx;
};

int client_connect(const char *target, struct client_conn *out);
void client_close(struct client_conn *c);
int client_send_line(struct client_conn *c, const char *line);
char *client_read_line(struct client_conn *c);

/* Human-readable reason for the last failed call. */
const char *client_last_error(void);

char *client_make_request(const char *cmd, const char *session, int64_t org,
                          const char *args_json, const char *id);
char *client_make_login_args(const char *user, const char *password);

/* Sends one command and returns the raw response line (malloc'd), or NULL
   on a transport error. */
char *client_rpc(struct client_conn *c, const char *cmd, const char *session,
                 int64_t org, const char *args_json);

/* Password login. Returns 0 and sets *session_out on success; on failure
   returns -1 and sets *err_out to the response line or an error message. */
int client_login(struct client_conn *c, const char *user, const char *password,
                 char **session_out, char **err_out);

/* Convenience: true when the response line has "ok":true. */
int client_ok(const char *response);
/* Extract result.session into buf; returns 0 on success. */
int client_session_from(const char *response, char *buf, unsigned long cap);

#endif