// Which account the agent is logged in as (novox/hq ADR 0183): not in the token, but in the agent's
// own state file beside the home, `~/.claude.json` → `oauthAccount`. Read, never written.

import { readFileSync } from "node:fs";

export interface Identity {
  readonly accountUuid: string;
  readonly emailAddress?: string;
  readonly organizationUuid?: string;
}

export function readIdentity(stateFile: string): Identity | null {
  try {
    const raw = JSON.parse(readFileSync(stateFile, "utf8")) as { oauthAccount?: Record<string, unknown> };
    const a = raw.oauthAccount;
    if (!a || typeof a.accountUuid !== "string") return null;
    return {
      accountUuid: a.accountUuid,
      emailAddress: typeof a.emailAddress === "string" ? a.emailAddress : undefined,
      organizationUuid: typeof a.organizationUuid === "string" ? a.organizationUuid : undefined,
    };
  } catch {
    return null;
  }
}