pub fn register(linker: &mut Linker<SessionData>) -> wasmtime::Result<()> {

    linker.func_wrap_async(

        "nomi",

        "ssh_key_list_ssh_keys",

        > {

            Box::new(async move {

                let user_id = caller.data().ctx().user_id;

                let result = ListSshKeys::new().user_id(user_id).run().await;

                let entries = list_ssh_key_entries("list-ssh-keys", result)?;

                alloc_ssh_key_chain(&mut caller, entries).await

            })

        },

    linker.func_wrap_async(

        "nomi",

        "ssh_key_user_has_ssh_key",

         -> Box<dyn std::future::Future<Output = wasmtime::Result<i32>> + Send> {

            Box::new(async move {

                let user_id = caller.data().ctx().user_id;

                let result = UserHasSshKey::new().user_id(user_id).run().await;

                bool_from_command_result("user-has-ssh-key", result)

            })

        },

    linker.func_wrap_async(

        "nomi",

        "ssh_key_lookup_user_by_ssh_key",

        > {

            Box::new(async move {

                let fp = read_string_arg(&mut caller, fp_arg)?;

                match run_lookup_user_by_ssh_key(fp).await? {

                    None => Ok(None),

            })

        },

    linker.func_wrap_async(

        "nomi",

        "ssh_key_remove_ssh_key",

         -> Box<dyn std::future::Future<Output = wasmtime::Result<i32>> + Send> {

            Box::new(async move {

                let user_id = caller.data().ctx().user_id;

                let fp = read_string_arg(&mut caller, fp_arg)?;

                run_remove_ssh_key(user_id, fp).await

            })

        },

    Ok(())

}

async fn run_remove_ssh_key(user_id: Uuid, fp_arg: Option<String>) -> wasmtime::Result<i32> {

    let fingerprint = fp_arg

        .filter(|s| !s.is_empty())

        .ok_or_else(|| wasmtime::Error::msg("remove-ssh-key: missing or empty :fingerprint arg"))?;

    let result = RemoveSshKey::new()

        .user_id(user_id)

        .fingerprint(fingerprint)

        .run()

        .await;

    bool_from_command_result("remove-ssh-key", result)

}

async fn run_lookup_user_by_ssh_key(fp_arg: Option<String>) -> wasmtime::Result<Option<String>> {

    let fingerprint = fp_arg.filter(|s| !s.is_empty()).ok_or_else(|| {

        wasmtime::Error::msg("lookup-user-by-ssh-key: missing or empty :fingerprint arg")

    })?;

    match LookupUserBySshKey::new()

        .fingerprint(fingerprint)

        .run()

        .await

        Ok(None) => Ok(None),

}

fn bool_from_command_result(

    name: &str,

    result: Result<Option<CmdResult>, CmdError>,

) -> wasmtime::Result<i32> {

    match result {

        Ok(Some(CmdResult::Bool(b))) => Ok(i32::from(b)),

        Ok(None) => Ok(0),

        Err(err) => Err(wasmtime::Error::msg(format!("{name}: {err}"))),

}

fn list_ssh_key_entries(

    name: &str,

    result: Result<Option<CmdResult>, CmdError>,

) -> wasmtime::Result<Vec<(String, String, String)>> {

    match result {

        Ok(Some(CmdResult::SshKeys(keys))) => Ok(keys

            .into_iter()

            .map(|k| (k.id.to_string(), k.fingerprint, k.annotation))

            .collect()),

}

async fn alloc_ssh_key_chain(

    caller: &mut Caller<'_, SessionData>,

    entries: Vec<(String, String, String)>,

) -> wasmtime::Result<Option<Rooted<StructRef>>> {

    let mut anyrefs: Vec<Rooted<AnyRef>> = Vec::with_capacity(entries.len());

    for (id, fingerprint, annotation) in entries {

    alloc_pair_chain(caller, anyrefs).await

}

fn format_ssh_keys(keys: &[SshKeyRecord]) -> String {

    let mut out = String::from("(:ssh-keys (");

    for (idx, key) in keys.iter().enumerate() {

        if idx > 0 {

        }

        out.push_str(&format!(

            quote_string(&key.key_type),

            quote_string(&key.fingerprint),

            quote_string(&key.annotation),

            key.created_at.to_rfc3339(),

            match key.last_used_at {

                Some(ts) => format!("\"{}\"", ts.to_rfc3339()),

                None => "nil".to_string(),

            BASE64.encode(&key.key_blob),

    out.push_str("))");

    out

}

fn quote_string(s: &str) -> String {

    let mut q = String::with_capacity(s.len() + 2);

    q.push('"');

    for ch in s.chars() {

        match ch {

            '"' => q.push_str("\\\""),

            '\\' => q.push_str("\\\\"),

            other => q.push(other),

    q.push('"');

    q

}

    fn record(annotation: &str, last_used: bool) -> SshKeyRecord {

        let created = chrono::Utc.with_ymd_and_hms(2026, 5, 1, 12, 0, 0).unwrap();

            id: Uuid::parse_str("550e8400-e29b-41d4-a716-446655440000").unwrap(),

            user_id: Uuid::nil(),

            key_type: "ssh-ed25519".into(),

            key_blob: vec![0xab, 0xcd, 0xef],

            fingerprint: "SHA256:abc".into(),

            annotation: annotation.into(),

            created_at: created,

            last_used_at: last_used

                .then(|| chrono::Utc.with_ymd_and_hms(2026, 5, 5, 9, 30, 0).unwrap()),

    }

    fn format_empty_list() {

        assert_eq!(format_ssh_keys(&[]), "(:ssh-keys ())");

    }

    fn format_single_key_with_last_used() {

        let out = format_ssh_keys(&[record("laptop", true)]);

        assert!(out.contains(":id \"550e8400-e29b-41d4-a716-446655440000\""));

        assert!(out.contains(":key-type \"ssh-ed25519\""));

        assert!(out.contains(":fingerprint \"SHA256:abc\""));

        assert!(out.contains(":annotation \"laptop\""));

        assert!(out.contains(":created-at \"2026-05-01T12:00:00+00:00\""));

        assert!(out.contains(":last-used-at \"2026-05-05T09:30:00+00:00\""));

        assert!(out.contains(":blob #\"q83v\""));

    }

    fn format_unused_key_emits_nil_for_last_used() {

        let out = format_ssh_keys(&[record("", false)]);

        assert!(out.contains(":last-used-at nil"));

        assert!(out.contains(":annotation \"\""));

    }

    fn bool_from_command_result_maps_variants() {

        assert_eq!(

            bool_from_command_result("x", Ok(Some(CmdResult::Bool(true)))).unwrap(),

        assert_eq!(

            bool_from_command_result("x", Ok(Some(CmdResult::Bool(false)))).unwrap(),

        assert_eq!(bool_from_command_result("x", Ok(None)).unwrap(), 0);

        assert!(bool_from_command_result("x", Err(CmdError::Args("oops".into()))).is_err());

    }

    async fn run_lookup_user_by_ssh_key_no_arg_emits_error() {

        let err = run_lookup_user_by_ssh_key(None).await.unwrap_err();

        assert!(err.to_string().contains("missing or empty"));

    }

    async fn run_lookup_user_by_ssh_key_empty_arg_emits_error() {

        let err = run_lookup_user_by_ssh_key(Some(String::new()))

            .await

            .unwrap_err();

        assert!(err.to_string().contains("missing or empty"));

    }

    async fn run_remove_ssh_key_no_arg_emits_error() {

        let err = run_remove_ssh_key(Uuid::nil(), None).await.unwrap_err();

        assert!(err.to_string().contains("missing or empty"));

    }

    async fn run_remove_ssh_key_empty_arg_emits_error() {

        let err = run_remove_ssh_key(Uuid::nil(), Some(String::new()))

            .await

            .unwrap_err();

        assert!(err.to_string().contains("missing or empty"));

    }

    fn format_quotes_embedded_specials_in_annotation() {

        let key = SshKeyRecord {

            annotation: r#"weird\"name"#.into(),

            ..record("", false)

        };

        let out = format_ssh_keys(&[key]);

        assert!(out.contains(r#":annotation "weird\\\"name""#), "got: {out}");

    }