Bridge.eph

-- SPDX-License-Identifier: MPL-2.0
-- Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath)
--
-- Bridge.eph — IPC command handlers for Game Server Admin
--
-- Each handler receives a JSON payload from the Gossamer frontend,
-- dispatches to the Zig FFI layer, and returns a JSON response.
-- Capability tokens are borrowed (not consumed) for each operation.

module GSA.Core.Bridge

import GSA.Core.Types
import GSA.Core.Capabilities
import GSA.Core.GrooveClient

-- =============================================================================
-- JSON helpers — thin wrappers around Zig FFI JSON operations
-- =============================================================================

fn jsonField(payload: String, field: String) -> String =
  __ffi("json_field", payload, field)

fn jsonOk(data: String) -> String =
  "{\"ok\":true,\"data\":" ++ data ++ "}"

fn jsonError(msg: String) -> String =
  "{\"ok\":false,\"error\":\"" ++ msg ++ "\"}"

fn jsonBool(b: Bool) -> String =
  if b then "true" else "false"

-- =============================================================================
-- Server Browser panel handlers
-- =============================================================================

-- List all managed servers from VeriSimDB.
-- VQL: SELECT * FROM octads WHERE semantic.game_type IS NOT NULL
fn handleListServers(payload: String, caps: &GsaCapSet) -> String =
  let vql = "SELECT document, semantic, temporal FROM octads LIMIT 100" in
  let result = __ffi("gossamer_gsa_verisimdb_query", vql) in
  if result == "" then
    jsonError("VeriSimDB query failed — is gsa-verisimdb running?")
  else
    jsonOk(result)

-- Probe a new server by host:port.
-- Payload: {"host": "1.2.3.4", "port": 27015}
fn handleProbeServer(payload: String, caps: &GsaCapSet) -> String =
  let host = jsonField(payload, "host") in
  let port = jsonField(payload, "port") in
  if host == "" then
    jsonError("Missing 'host' in probe request")
  else {
    let result = __ffi("gossamer_gsa_probe", host, port) in
    if result < 1000 then
      jsonError("Probe failed: " ++ __ffi("gossamer_gsa_last_error"))
    else {
      -- Fingerprint succeeded, extract config
      let profile_id = jsonField(result, "game_id") in
      let config_a2ml = __ffi("gossamer_gsa_extract_config", result, profile_id) in
      jsonOk("{\"probe\":" ++ result ++ ",\"config\":" ++ config_a2ml ++ "}")
    }
  }

-- Add a probed server to VeriSimDB management.
-- Payload: {"server_id": "valheim-1", "probe_result": {...}, "config": {...}}
fn handleAddServer(payload: String, caps: &GsaCapSet) -> String =
  let server_id = jsonField(payload, "server_id") in
  let probe_json = jsonField(payload, "probe_result") in
  let config_json = jsonField(payload, "config") in
  if server_id == "" then
    jsonError("Missing 'server_id'")
  else {
    -- Store as VeriSimDB octad
    let octad_json = __ffi("gossamer_gsa_build_octad", server_id, probe_json, config_json) in
    let store_result = __ffi("gossamer_gsa_verisimdb_store", octad_json) in
    if store_result < 0 then
      jsonError("Failed to store in VeriSimDB: " ++ __ffi("gossamer_gsa_last_error"))
    else
      jsonOk("{\"server_id\":\"" ++ server_id ++ "\",\"stored\":true}")
  }

-- Remove a server from VeriSimDB management.
-- Payload: {"server_id": "valheim-1"}
fn handleRemoveServer(payload: String, caps: &GsaCapSet) -> String =
  let server_id = jsonField(payload, "server_id") in
  let result = __ffi("gossamer_gsa_verisimdb_delete", server_id) in
  if result != 0 then
    jsonError("Failed to remove: " ++ __ffi("gossamer_gsa_last_error"))
  else
    jsonOk("{\"server_id\":\"" ++ server_id ++ "\",\"removed\":true}")

-- List available game profiles.
fn handleListProfiles(payload: String) -> String =
  let profiles = __ffi("gossamer_gsa_list_profiles") in
  jsonOk(profiles)

-- =============================================================================
-- Config Editor panel handlers
-- =============================================================================

-- Get the current config for a server as A2ML.
-- Payload: {"server_id": "valheim-1"}
fn handleGetConfig(payload: String, caps: &GsaCapSet) -> String =
  let server_id = jsonField(payload, "server_id") in
  if server_id == "" then
    jsonError("Missing 'server_id'")
  else {
    -- Look up server in VeriSimDB to get connection details
    let server_info = __ffi("gossamer_gsa_verisimdb_query",
      "SELECT document, semantic FROM octads WHERE id = '" ++ server_id ++ "'") in
    if server_info == "" then
      jsonError("Server not found: " ++ server_id)
    else {
      -- Extract game_id and profile
      let game_id = jsonField(server_info, "game_id") in
      let host = jsonField(server_info, "host") in
      let port = jsonField(server_info, "port") in

      -- Probe to get fresh config
      let handle = __ffi("gossamer_gsa_probe", host, port) in
      let config_a2ml = __ffi("gossamer_gsa_extract_config", handle, game_id) in

      -- Also get stored config for drift comparison
      let stored = jsonField(server_info, "document") in

      jsonOk("{\"live\":" ++ config_a2ml ++ ",\"stored\":\"" ++ stored ++ "\"}")
    }
  }

-- Apply config changes to a server.
-- Payload: {"server_id": "valheim-1", "changes": [{"key": "...", "value": "..."}]}
fn handleSetConfig(payload: String, caps: &GsaCapSet) -> String =
  let server_id = jsonField(payload, "server_id") in
  let changes = jsonField(payload, "changes") in
  if server_id == "" then
    jsonError("Missing 'server_id'")
  else {
    -- Apply changes via FFI (writes to server, updates VeriSimDB)
    let result = __ffi("gossamer_gsa_apply_config", server_id, changes) in
    if result != 0 then
      jsonError("Config apply failed: " ++ __ffi("gossamer_gsa_last_error"))
    else {
      -- Record provenance
      let prov = "{\"event_type\":\"config_change\",\"actor\":\"gsa-gui\",\"description\":\"Config modified via GUI\"}" in
      __ffi("gossamer_gsa_verisimdb_provenance", server_id, prov);
      jsonOk("{\"server_id\":\"" ++ server_id ++ "\",\"applied\":true,\"change_count\":" ++ changes ++ "}")
    }
  }

-- Revert config to the VeriSimDB stored version.
-- Payload: {"server_id": "valheim-1"}
fn handleRevertConfig(payload: String, caps: &GsaCapSet) -> String =
  let server_id = jsonField(payload, "server_id") in
  let stored = __ffi("gossamer_gsa_verisimdb_query",
    "SELECT document FROM octads WHERE id = '" ++ server_id ++ "'") in
  if stored == "" then
    jsonError("No stored config for: " ++ server_id)
  else {
    let result = __ffi("gossamer_gsa_apply_stored_config", server_id, stored) in
    if result != 0 then
      jsonError("Revert failed: " ++ __ffi("gossamer_gsa_last_error"))
    else {
      let prov = "{\"event_type\":\"config_revert\",\"actor\":\"gsa-gui\",\"description\":\"Config reverted to stored version\"}" in
      __ffi("gossamer_gsa_verisimdb_provenance", server_id, prov);
      jsonOk("{\"server_id\":\"" ++ server_id ++ "\",\"reverted\":true}")
    }
  }

-- =============================================================================
-- Server Actions panel handler
-- =============================================================================

-- Execute a server action (start/stop/restart/status/logs/update/backup).
-- Payload: {"server_id": "valheim-1", "action": "restart"}
fn handleServerAction(payload: String, caps: &GsaCapSet) -> String =
  let server_id = jsonField(payload, "server_id") in
  let action = jsonField(payload, "action") in
  if server_id == "" || action == "" then
    jsonError("Missing 'server_id' or 'action'")
  else {
    let action_json = "{\"server_id\":\"" ++ server_id ++ "\",\"action\":\"" ++ action ++ "\"}" in
    let result = __ffi("gossamer_gsa_server_action", 0, action_json) in
    if result == "" then
      jsonError("Action failed: " ++ __ffi("gossamer_gsa_last_error"))
    else {
      -- Record provenance for state-changing actions
      if action == "start" || action == "stop" || action == "restart" || action == "update" then {
        let prov = "{\"event_type\":\"server_action\",\"actor\":\"gsa-gui\",\"description\":\"" ++ action ++ " via GUI\"}" in
        __ffi("gossamer_gsa_verisimdb_provenance", server_id, prov)
      } else ();
      jsonOk(result)
    }
  }

-- =============================================================================
-- Live Logs panel handler
-- =============================================================================

-- Get recent log lines for a server.
-- Payload: {"server_id": "valheim-1", "lines": 100}
fn handleGetLogs(payload: String, caps: &GsaCapSet) -> String =
  let server_id = jsonField(payload, "server_id") in
  let lines = jsonField(payload, "lines") in
  let line_count = if lines == "" then "100" else lines in
  if server_id == "" then
    jsonError("Missing 'server_id'")
  else {
    let result = __ffi("gossamer_gsa_get_logs", 0, line_count) in
    if result == "" then
      jsonError("Log retrieval failed: " ++ __ffi("gossamer_gsa_last_error"))
    else
      jsonOk("{\"server_id\":\"" ++ server_id ++ "\",\"lines\":" ++ result ++ "}")
  }

-- =============================================================================
-- Health Dashboard panel handlers
-- =============================================================================

-- Get overall health status of all managed servers.
fn handleGetHealth(payload: String, caps: &GsaCapSet) -> String =
  let result = __ffi("gossamer_gsa_verisimdb_health") in
  if result != 0 then
    jsonError("VeriSimDB health check failed")
  else {
    let drift_status = __ffi("gossamer_gsa_verisimdb_drift_all") in
    jsonOk("{\"verisimdb_healthy\":" ++ jsonBool(result == 0) ++ ",\"drift\":" ++ drift_status ++ "}")
  }

-- Get drift report for a specific server.
-- Payload: {"server_id": "valheim-1"}
fn handleGetDrift(payload: String, caps: &GsaCapSet) -> String =
  let server_id = jsonField(payload, "server_id") in
  if server_id == "" then
    jsonError("Missing 'server_id'")
  else {
    let drift = __ffi("gossamer_gsa_verisimdb_drift", server_id) in
    if drift == "" then
      jsonError("Drift check failed for: " ++ server_id)
    else
      jsonOk(drift)
  }

-- =============================================================================
-- Config History panel handlers
-- =============================================================================

-- Get config version history for a server.
-- Payload: {"server_id": "valheim-1", "limit": 50}
fn handleGetHistory(payload: String, caps: &GsaCapSet) -> String =
  let server_id = jsonField(payload, "server_id") in
  let limit = jsonField(payload, "limit") in
  let limit_val = if limit == "" then "50" else limit in
  if server_id == "" then
    jsonError("Missing 'server_id'")
  else {
    -- Query temporal modality for version history
    let vql = "SELECT temporal, provenance FROM octads WHERE id = '" ++ server_id ++ "' LIMIT " ++ limit_val in
    let result = __ffi("gossamer_gsa_verisimdb_query", vql) in
    if result == "" then
      jsonError("History query failed")
    else
      jsonOk(result)
  }

-- Rollback config to a specific version.
-- Payload: {"server_id": "valheim-1", "version": 3}
fn handleRollbackConfig(payload: String, caps: &GsaCapSet) -> String =
  let server_id = jsonField(payload, "server_id") in
  let version = jsonField(payload, "version") in
  if server_id == "" || version == "" then
    jsonError("Missing 'server_id' or 'version'")
  else {
    -- Fetch historical version from temporal modality
    let vql = "SELECT document FROM octads WHERE id = '" ++ server_id ++ "' AT VERSION " ++ version in
    let historical = __ffi("gossamer_gsa_verisimdb_query", vql) in
    if historical == "" then
      jsonError("Version " ++ version ++ " not found for: " ++ server_id)
    else {
      -- Apply historical config
      let result = __ffi("gossamer_gsa_apply_stored_config", server_id, historical) in
      if result != 0 then
        jsonError("Rollback failed: " ++ __ffi("gossamer_gsa_last_error"))
      else {
        let prov = "{\"event_type\":\"config_rollback\",\"actor\":\"gsa-gui\",\"description\":\"Rolled back to version " ++ version ++ "\"}" in
        __ffi("gossamer_gsa_verisimdb_provenance", server_id, prov);
        jsonOk("{\"server_id\":\"" ++ server_id ++ "\",\"rolled_back_to\":" ++ version ++ "}")
      }
    }
  }

-- =============================================================================
-- Cross-Server Search panel handler
-- =============================================================================

-- Search across all managed servers using VQL.
-- Payload: {"query": "MaxPlayers > 32", "mode": "text|vector|vql"}
fn handleSearch(payload: String, caps: &GsaCapSet) -> String =
  let query = jsonField(payload, "query") in
  let mode = jsonField(payload, "mode") in
  if query == "" then
    jsonError("Missing 'query'")
  else {
    let vql = match mode {
      "text"   -> "SEARCH TEXT '" ++ query ++ "' LIMIT 50",
      "vector" -> "SEARCH VECTOR " ++ query ++ " LIMIT 20",
      "vql"    -> query,
      _        -> "SEARCH TEXT '" ++ query ++ "' LIMIT 50"
    } in
    let result = __ffi("gossamer_gsa_verisimdb_query", vql) in
    if result == "" then
      jsonError("Search failed: " ++ __ffi("gossamer_gsa_last_error"))
    else
      jsonOk("{\"query\":\"" ++ query ++ "\",\"mode\":\"" ++ mode ++ "\",\"results\":" ++ result ++ "}")
  }

-- =============================================================================
-- Steam search handler
-- =============================================================================

-- Search Steam for game server tools by name.
-- Uses the Steam Web API to find dedicated server AppIDs.
-- Payload: {"query": "valheim"}
fn handleSearchSteam(payload: String, caps: &GsaCapSet) -> String =
  let query = jsonField(payload, "query") in
  if query == "" then
    jsonError("Missing 'query'")
  else {
    let result = __ffi("gossamer_gsa_steam_search", query) in
    if result == "" then
      jsonOk("[]")
    else
      jsonOk(result)
  }

-- =============================================================================
-- Config path loading handler
-- =============================================================================

-- Load a config from a user-specified file path.
-- Used when the auto-detected config path fails and the user provides one.
-- Payload: {"server_id": "...", "config_path": "/path/to/config"}
fn handleLoadConfigFromPath(payload: String, caps: &GsaCapSet) -> String =
  let server_id = jsonField(payload, "server_id") in
  let config_path = jsonField(payload, "config_path") in
  if server_id == "" then
    jsonError("Missing 'server_id'")
  else if config_path == "" then
    jsonError("Missing 'config_path'")
  else {
    let result = __ffi("gossamer_gsa_load_config_path", server_id, config_path) in
    if result == "" then
      jsonError("Failed to load config from " ++ config_path ++ ": " ++ __ffi("gossamer_gsa_last_error"))
    else {
      -- Update VeriSimDB with the new config path
      let update = "{\"config_path\":\"" ++ config_path ++ "\"}" in
      __ffi("gossamer_gsa_verisimdb_update", server_id, "semantic", update);
      jsonOk(result)
    }
  }

-- =============================================================================
-- File browser handler (Gossamer native dialog)
-- =============================================================================

-- Open a native file dialog and return the selected path.
-- Payload: {"title": "Select Config File"}
fn handleBrowseFile(payload: String) -> String =
  let title = jsonField(payload, "title") in
  let result = __ffi("gossamer_file_dialog", title) in
  if result == "" then
    jsonError("No file selected")
  else
    jsonOk("\"" ++ result ++ "\"")

-- =============================================================================
-- Server uninstall handler
-- =============================================================================

-- Uninstall a server: stop it, optionally remove files, delete from VeriSimDB.
-- Payload: {"server_id": "...", "keep_history": true, "uninstall": true}
fn handleUninstallServer(payload: String, caps: &GsaCapSet) -> String =
  let server_id = jsonField(payload, "server_id") in
  let keep_history = jsonField(payload, "keep_history") in
  if server_id == "" then
    jsonError("Missing 'server_id'")
  else {
    -- Stop the server first
    __ffi("gossamer_gsa_server_action", server_id, "stop");
    -- Remove server files if uninstall flag is set
    let uninstall = jsonField(payload, "uninstall") in
    if uninstall == "true" then
      __ffi("gossamer_gsa_remove_server_files", server_id)
    else ();
    -- Remove from VeriSimDB (keep history if requested)
    if keep_history == "true" then {
      let prov = "{\"event_type\":\"uninstalled\",\"actor\":\"gsa-gui\",\"description\":\"Server uninstalled, history preserved\"}" in
      __ffi("gossamer_gsa_verisimdb_provenance", server_id, prov);
      __ffi("gossamer_gsa_verisimdb_archive", server_id)
    }
    else
      __ffi("gossamer_gsa_verisimdb_delete", server_id);
    jsonOk("{\"server_id\":\"" ++ server_id ++ "\",\"uninstalled\":true}")
  }

-- =============================================================================
-- Groove voice alerting handlers (Burble integration)
-- =============================================================================

-- Discover available Groove targets (Burble, Vext).
-- Call at startup or when the user clicks "Reconnect Voice".
-- Payload: {} (no parameters needed)
fn handleGrooveDiscover(payload: String, caps: &GsaCapSet) -> String =
  let result = discover(caps) in
  match result {
    Ok -> {
      -- Return status of all known targets
      let burble_status = status("burble") in
      let vext_status = status("vext") in
      jsonOk("{\"burble\":" ++ burble_status ++ ",\"vext\":" ++ vext_status ++ "}")
    },
    Error(msg) ->
      jsonError("Groove discovery failed: " ++ msg)
  }

-- Send an alert through Groove to Burble.
-- Payload: {"severity": "warning", "server_id": "valheim-1", "message": "..."}
fn handleGrooveAlert(payload: String, caps: &GsaCapSet) -> String =
  let severity_str = jsonField(payload, "severity") in
  let server_id = jsonField(payload, "server_id") in
  let message = jsonField(payload, "message") in
  if server_id == "" || message == "" then
    jsonError("Missing 'server_id' or 'message'")
  else {
    let severity = match severity_str {
      "info"      -> SevInfo,
      "warning"   -> SevWarning,
      "critical"  -> SevCritical,
      "emergency" -> SevEmergency,
      _           -> SevWarning
    } in
    let result = alert(severity, server_id, message, caps) in
    match result {
      Ok -> jsonOk("{\"sent\":true,\"target\":\"groove\"}"),
      Error(msg) -> jsonError("Groove alert failed: " ++ msg)
    }
  }

-- Check Groove connection status for a specific target.
-- Payload: {"target": "burble"} or {"target": "vext"}
fn handleGrooveStatus(payload: String) -> String =
  let target_name = jsonField(payload, "target") in
  if target_name == "" then
    jsonError("Missing 'target' (expected 'burble' or 'vext')")
  else {
    let target_status = status(target_name) in
    jsonOk(target_status)
  }

-- Send a TTS alert through Groove to Burble.
-- Payload: {"text": "Server valheim-1 is down"}
fn handleGrooveTTS(payload: String, caps: &GsaCapSet) -> String =
  let text = jsonField(payload, "text") in
  if text == "" then
    jsonError("Missing 'text' for TTS alert")
  else {
    let result = ttsAlert(text, caps) in
    match result {
      Ok -> jsonOk("{\"spoken\":true}"),
      Error(msg) -> jsonError("Groove TTS failed: " ++ msg)
    }
  }

-- Trigger a drift-based voice alert for a server.
-- Queries VeriSimDB for drift, then alerts via Groove if threshold exceeded.
-- Payload: {"server_id": "valheim-1"}
fn handleGrooveDriftAlert(payload: String, caps: &GsaCapSet) -> String =
  let server_id = jsonField(payload, "server_id") in
  if server_id == "" then
    jsonError("Missing 'server_id'")
  else {
    -- Get drift from VeriSimDB
    let drift_json = __ffi("gossamer_gsa_verisimdb_drift", server_id) in
    if drift_json == "" then
      jsonError("Could not retrieve drift for: " ++ server_id)
    else {
      let drift_val = jsonField(drift_json, "config_drift") in
      let drift = __ffi("parse_float", drift_val) in
      let result = alertOnDrift(server_id, drift, caps) in
      match result {
        Ok -> jsonOk("{\"server_id\":\"" ++ server_id ++ "\",\"drift\":" ++ drift_val ++ ",\"alerted\":true}"),
        Error(msg) -> jsonError("Drift alert failed: " ++ msg)
      }
    }
  }

-- =============================================================================
-- Profile management handler
-- =============================================================================

-- Add a new game profile from A2ML text.
-- Payload: {"a2ml": "@game-profile(...): ... @end"}
fn handleAddProfile(payload: String) -> String =
  let a2ml = jsonField(payload, "a2ml") in
  if a2ml == "" then
    jsonError("Missing 'a2ml' profile definition")
  else {
    let result = __ffi("gossamer_gsa_add_profile", a2ml) in
    if result != 0 then
      jsonError("Profile registration failed: " ++ __ffi("gossamer_gsa_last_error"))
    else
      jsonOk("{\"registered\":true}")
  }

-- =============================================================================
-- Nexus Setup panel handlers (Wizard steps 2, 5, 6, 7)
-- =============================================================================

-- Resolve a Steam vanity URL to a Steam64 ID and player name.
-- Wraps gossamer_gsa_steam_resolve_vanity + gossamer_gsa_steam_player_info.
-- Payload: {"vanity_url": "pengie5"}
-- Returns: {"steam_id": "...", "name": "...", "profile_url": "..."}
fn handleSteamResolveVanity(payload: String) -> String =
  let vanity = jsonField(payload, "vanity_url") in
  if vanity == "" then
    jsonError("Missing 'vanity_url'")
  else {
    -- Resolve vanity → Steam64 ID
    let resolve_result = __ffi("gossamer_gsa_steam_resolve_vanity", vanity) in
    if resolve_result < 0 then
      jsonError("Vanity URL not found: " ++ vanity)
    else {
      let steam_id = __ffi("gossamer_gsa_steam_get_result", resolve_result, "steam_id") in
      if steam_id == "" then
        jsonError("Could not resolve vanity: " ++ vanity)
      else {
        -- Fetch player summary for display name
        let player_result = __ffi("gossamer_gsa_steam_player_info", steam_id) in
        let name        = __ffi("gossamer_gsa_steam_get_result", player_result, "name") in
        let profile_url = __ffi("gossamer_gsa_steam_get_result", player_result, "profile_url") in
        jsonOk("{\"steam_id\":\"" ++ steam_id ++ "\",\"name\":\"" ++ name ++
               "\",\"profile_url\":\"" ++ profile_url ++ "\"}")
      }
    }
  }

-- Fetch Steam player info by Steam64 ID.
-- Payload: {"steam_id": "76561198149527024"}
-- Returns: {"steam_id": "...", "name": "...", "profile_url": "..."}
fn handleSteamPlayerInfo(payload: String) -> String =
  let steam_id = jsonField(payload, "steam_id") in
  if steam_id == "" then
    jsonError("Missing 'steam_id'")
  else {
    let result  = __ffi("gossamer_gsa_steam_player_info", steam_id) in
    let name    = __ffi("gossamer_gsa_steam_get_result", result, "name") in
    let profile = __ffi("gossamer_gsa_steam_get_result", result, "profile_url") in
    jsonOk("{\"steam_id\":\"" ++ steam_id ++ "\",\"name\":\"" ++ name ++
           "\",\"profile_url\":\"" ++ profile ++ "\"}")
  }

-- Kick off SteamCMD authenticated download for a game profile on a target host.
-- Runs scripts/steam-stage.sh with the given credentials; returns when complete.
-- Payload: {"profile_id":"cryofall","steam_user":"...","steam_pass":"...","target_host":"..."}
-- Returns: {"ok":true,"bytes_transferred":...} or error
fn handleNexusStageFiles(payload: String, caps: &GsaCapSet) -> String =
  let profile_id  = jsonField(payload, "profile_id") in
  let steam_user  = jsonField(payload, "steam_user") in
  let steam_pass  = jsonField(payload, "steam_pass") in
  let target_host = jsonField(payload, "target_host") in
  if profile_id == "" || steam_user == "" || steam_pass == "" then
    jsonError("Missing required field (profile_id, steam_user, steam_pass)")
  else {
    let env_json = "{\"STEAM_USER\":\"" ++ steam_user ++
                   "\",\"PROVISION_TARGET_HOST\":\"" ++ target_host ++ "\"}" in
    let result = __ffi("gossamer_gsa_run_script", "scripts/steam-stage.sh", profile_id, env_json, steam_pass) in
    if result != 0 then
      jsonError("Staging failed: " ++ __ffi("gossamer_gsa_last_error"))
    else {
      let prov = "{\"event_type\":\"nexus_stage\",\"actor\":\"gsa-gui\",\"description\":\"SteamCMD stage for " ++ profile_id ++ " on " ++ target_host ++ "\"}" in
      __ffi("gossamer_gsa_verisimdb_provenance", profile_id, prov);
      jsonOk("{\"ok\":true,\"profile_id\":\"" ++ profile_id ++ "\"}")
    }
  }

-- Run the schema-driven provisioner (scripts/provision-server.sh) for a profile.
-- Applies full server config including operators before provisioning.
-- Payload: {"profile_id":"cryofall","target_host":"...","ssh_user":"root",
--           "server_config":{...},"operators":[{"steam_id":"...","name":"..."}]}
-- Returns: {"ok":true,"server_id":"..."} or error
fn handleNexusProvision(payload: String, caps: &GsaCapSet) -> String =
  let profile_id  = jsonField(payload, "profile_id") in
  let target_host = jsonField(payload, "target_host") in
  let ssh_user    = jsonField(payload, "ssh_user") in
  let config_json = jsonField(payload, "server_config") in
  let ops_json    = jsonField(payload, "operators") in
  if profile_id == "" then
    jsonError("Missing 'profile_id'")
  else {
    -- Write config to a temp Settings.xml from the form values
    let write_result = __ffi("gossamer_gsa_write_server_config", profile_id, config_json, ops_json) in
    if write_result < 0 then
      jsonError("Failed to write server config: " ++ __ffi("gossamer_gsa_last_error"))
    else {
      let env_json = "{\"PROVISION_TARGET_HOST\":\"" ++ target_host ++
                     "\",\"PROVISION_SSH_USER\":\"" ++ ssh_user ++ "\"}" in
      let result = __ffi("gossamer_gsa_run_script", "scripts/provision-server.sh", profile_id, env_json, "") in
      if result != 0 then
        jsonError("Provisioner failed: " ++ __ffi("gossamer_gsa_last_error"))
      else {
        -- Register in VeriSimDB
        let server_id = profile_id ++ "-" ++ target_host in
        let octad = "{\"id\":\"" ++ server_id ++ "\",\"game_id\":\"" ++ profile_id ++
                    "\",\"host\":\"" ++ target_host ++ "\",\"managed\":true}" in
        __ffi("gossamer_gsa_verisimdb_store", octad);
        let prov = "{\"event_type\":\"nexus_provision\",\"actor\":\"gsa-gui\",\"description\":\"Provisioned " ++ profile_id ++ " on " ++ target_host ++ "\"}" in
        __ffi("gossamer_gsa_verisimdb_provenance", server_id, prov);
        jsonOk("{\"ok\":true,\"server_id\":\"" ++ server_id ++ "\"}")
      }
    }
  }

-- Probe the server and confirm VeriSimDB registration after provisioning.
-- Payload: {"profile_id":"cryofall","target_host":"209.42.26.106","game_port":6000}
-- Returns: {"ok":true,"verisimdb_registered":true,"dns_name":"cryofall.jewell.nexus","probe_result":{...}}
fn handleNexusVerify(payload: String, caps: &GsaCapSet) -> String =
  let profile_id  = jsonField(payload, "profile_id") in
  let target_host = jsonField(payload, "target_host") in
  let game_port   = jsonField(payload, "game_port") in
  if target_host == "" then
    jsonError("Missing 'target_host'")
  else {
    -- Probe the live server
    let probe = __ffi("gossamer_gsa_probe", target_host, game_port) in
    let server_id = profile_id ++ "-" ++ target_host in
    -- Check VeriSimDB registration
    let vdb_check = __ffi("gossamer_gsa_verisimdb_query",
      "SELECT id FROM octads WHERE id = '" ++ server_id ++ "'") in
    let registered = if vdb_check != "" then "true" else "false" in
    if probe < 1000 then
      -- Not yet reachable — partial ok (provisioned but not responding yet)
      jsonOk("{\"ok\":false,\"verisimdb_registered\":" ++ registered ++
             ",\"error\":\"Server not yet responding on UDP " ++ game_port ++ "\"}")
    else {
      let prov = "{\"event_type\":\"nexus_verify\",\"actor\":\"gsa-gui\",\"description\":\"Post-provision probe succeeded\"}" in
      __ffi("gossamer_gsa_verisimdb_provenance", server_id, prov);
      jsonOk("{\"ok\":true,\"verisimdb_registered\":" ++ registered ++
             ",\"probe_result\":" ++ __ffi("gossamer_gsa_probe_result_json", probe) ++ "}")
    }
  }