export type FreeBetaBoundaryOperation =
  | "create_pairing"
  | "claim_pairing"
  | "cancel_pairing"
  | "connect_device"
  | "revoke_host";

export const FREE_BETA_ACCESS_BOUNDARY: ReadonlyArray<{
  operation: FreeBetaBoundaryOperation;
  requiresCurrentEntitlement: boolean;
  preservesExistingHost: boolean;
}> = [
  { operation: "create_pairing", requiresCurrentEntitlement: true, preservesExistingHost: true },
  { operation: "claim_pairing", requiresCurrentEntitlement: true, preservesExistingHost: true },
  { operation: "cancel_pairing", requiresCurrentEntitlement: false, preservesExistingHost: true },
  { operation: "connect_device", requiresCurrentEntitlement: false, preservesExistingHost: true },
  { operation: "revoke_host", requiresCurrentEntitlement: false, preservesExistingHost: false },
] as const;

/**
 * Existing claimed devices remain authenticated after a free policy or invite
 * ends. Entitlement gates new pairing and claim operations instead of silently
 * revoking an already issued device credential.
 */
export const AUTHENTICATE_ACTIVE_DEVICE_SQL = `
  UPDATE device_credentials
  SET last_used_at = ?1
  WHERE host_id = ?2 AND token_hash = ?3 AND status = 'active'
    AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > ?1)
    AND EXISTS (
      SELECT 1 FROM hosts
      WHERE id = ?2 AND lifecycle = 'active' AND slot_state = 'active'
    )
`;

/** Security exits intentionally have no entitlement predicate. */
export const REVOKE_ACTIVE_DEVICE_CREDENTIALS_SQL = `
  UPDATE device_credentials
  SET status = 'revoked', revoked_at = ?1
  WHERE host_id = ?2 AND status = 'active'
`;

export const DEACTIVATE_OWNED_HOST_SQL = `
  UPDATE hosts
  SET lifecycle = 'deactivated', slot_state = 'released',
      connection_state = 'offline', deactivated_at = ?1
  WHERE id = ?2 AND account_id = ?3 AND lifecycle = 'active'
`;