---
- name: Preflight | Require a Linux target
  ansible.builtin.assert:
    that:
      - ansible_facts['system'] == 'Linux'
    fail_msg: >-
      multica_agent_host supports Linux hosts only
      (found {{ ansible_facts['system'] }}).
    quiet: true

- name: Preflight | Require a supported CPU architecture
  ansible.builtin.assert:
    that:
      - ansible_facts['architecture'] in _multica_arch_map
    fail_msg: >-
      No multica CLI release asset for architecture
      {{ ansible_facts['architecture'] }}.
      Supported: {{ _multica_arch_map.keys() | list | join(', ') }}.
    quiet: true

- name: Preflight | Require the server URL
  ansible.builtin.assert:
    that:
      - multica_server_url | length > 0
      - multica_server_url is match('^https?://')
    fail_msg: "multica_server_url must be set to an http(s) URL."
    quiet: true

# no_log: a failed assert would otherwise render the variables it inspected.
- name: Preflight | Require a Multica personal access token
  ansible.builtin.assert:
    that:
      - multica_pat | length > 0
      - multica_pat is match('^(mul_|mcn_)')
    fail_msg: >-
      multica_pat must be set to a Multica personal access token
      (mul_... user PAT, or mcn_... Cloud Node PAT). Supply it from the
      playbook; see this role's README for Vault / 1Password / env examples.
    quiet: true
  no_log: true

- name: Preflight | Require every selected agent CLI to be in the catalog
  ansible.builtin.assert:
    that:
      - multica_agent_clis | difference(multica_agent_cli_catalog.keys() | list) | length == 0
    fail_msg: >-
      Unknown agent CLI(s):
      {{ multica_agent_clis | difference(multica_agent_cli_catalog.keys() | list) | join(', ') }}.
      Add them to multica_agent_cli_catalog or drop them from multica_agent_clis.
    quiet: true

- name: Preflight | Require at least one agent CLI
  ansible.builtin.assert:
    that:
      - multica_agent_clis | length > 0
    fail_msg: >-
      multica_agent_clis is empty; the daemon would register no runtimes and
      the host could never claim a run.
    quiet: true

- name: Preflight | Resolve release artefact names and the invocation prefix
  ansible.builtin.set_fact:
    _multica_arch: "{{ _multica_arch_map[ansible_facts['architecture']] }}"
    _multica_node_arch: "{{ _multica_node_arch_map[ansible_facts['architecture']] }}"
    _multica_bin: "{{ multica_install_dir }}/multica"
    _multica_cmd: >-
      {{ [multica_install_dir ~ '/multica']
         + (['--profile', multica_profile] if multica_profile | length > 0 else []) }}
    _multica_node_required: >-
      {{ multica_agent_clis
         | map('extract', multica_agent_cli_catalog, 'method')
         | select('equalto', 'npm') | list | length > 0 }}

- name: Preflight | Name the release tarball
  ansible.builtin.set_fact:
    _multica_tarball: "multica-cli-{{ multica_version }}-linux-{{ _multica_arch }}.tar.gz"
    _multica_release_url: >-
      {{ multica_release_download_base_url }}/v{{ multica_version }}/multica-cli-{{ multica_version }}-linux-{{ _multica_arch }}.tar.gz
    _multica_checksums_url: >-
      {{ multica_release_download_base_url }}/v{{ multica_version }}/checksums.txt

- name: Preflight | Require base tooling on the target
  ansible.builtin.package:
    name: "{{ ['tar', 'xz-utils' if ansible_facts['os_family'] == 'Debian' else 'xz', 'ca-certificates', 'git'] }}"
    state: present
  become: true