alma 0.1.1

use super::{PluginIdentity, PluginRevocationReason};
use std::{
    fmt::{Display, Formatter},
    num::NonZeroUsize,
};

/// Redacted runtime event.
#[derive(Clone, Debug, Eq, PartialEq)]
pub struct PluginOperationalEvent {
    /// Scope and kind, with unscoped events restricted to pre-identity failure classes.
    inner: PluginOperationalEventInner,
}

/// Scope-correct operational event payload.
#[derive(Clone, Debug, Eq, PartialEq)]
enum PluginOperationalEventInner {
    /// Event that can be attributed to one plugin.
    Scoped {
        /// Event-scoped identity.
        identity: PluginIdentity,
        /// Payload-free event kind.
        kind: PluginOperationalEventKind,
    },
    /// Runtime failure before a plugin identity exists.
    UnscopedRuntimeFailure {
        /// Closed runtime failure class.
        failure: PluginOperationalRuntimeFailure,
    },
    /// Queue saturation outside plugin-attributed publication.
    UnscopedQueueSaturated {
        /// Queue class.
        queue: PluginOperationalQueue,
        /// Queue cap.
        limit: NonZeroUsize,
    },
}

impl PluginOperationalEvent {
    /// Successful load.
    #[must_use]
    pub fn load(identity: &PluginIdentity) -> Self {
        Self::scoped(identity, PluginOperationalEventKind::Load)
    }

    /// Unload.
    #[must_use]
    pub fn unload(identity: &PluginIdentity) -> Self {
        Self::scoped(identity, PluginOperationalEventKind::Unload)
    }

    /// Revocation.
    #[must_use]
    pub fn revocation(identity: &PluginIdentity, reason: PluginRevocationReason) -> Self {
        Self::scoped(identity, PluginOperationalEventKind::Revocation { reason })
    }

    /// Denied import.
    #[must_use]
    pub fn denied_import(identity: &PluginIdentity, import: PluginOperationalImport) -> Self {
        Self::scoped(
            identity,
            PluginOperationalEventKind::DeniedImport { import },
        )
    }

    /// Host import rejected for a non-authorization reason.
    #[must_use]
    pub fn rejected_import(
        identity: &PluginIdentity,
        import: PluginOperationalImport,
        reason: PluginOperationalImportRejection,
    ) -> Self {
        Self::scoped(
            identity,
            PluginOperationalEventKind::ImportRejected { import, reason },
        )
    }

    /// Runtime timeout.
    #[must_use]
    pub fn timeout(identity: &PluginIdentity, timeout_ms: u64) -> Self {
        Self::scoped(identity, PluginOperationalEventKind::Timeout { timeout_ms })
    }

    /// Guest export trap.
    #[must_use]
    pub fn guest_trap(identity: &PluginIdentity, export: PluginOperationalExport) -> Self {
        Self::scoped(identity, PluginOperationalEventKind::GuestTrap { export })
    }

    /// Plugin-scoped runtime failure.
    #[must_use]
    pub fn runtime_failure(
        identity: &PluginIdentity,
        failure: PluginOperationalRuntimeFailure,
    ) -> Self {
        Self::scoped(
            identity,
            PluginOperationalEventKind::RuntimeFailure { failure },
        )
    }

    /// Runtime failure before a plugin identity is available.
    #[must_use]
    pub const fn unscoped_runtime_failure(failure: PluginOperationalRuntimeFailure) -> Self {
        Self {
            inner: PluginOperationalEventInner::UnscopedRuntimeFailure { failure },
        }
    }

    /// Queue saturation without identity attribution.
    #[must_use]
    pub const fn queue_saturated(queue: PluginOperationalQueue, limit: NonZeroUsize) -> Self {
        Self {
            inner: PluginOperationalEventInner::UnscopedQueueSaturated { queue, limit },
        }
    }

    /// Queue saturation for a rejected plugin update.
    #[must_use]
    pub fn queue_saturated_for(
        identity: &PluginIdentity,
        queue: PluginOperationalQueue,
        limit: NonZeroUsize,
    ) -> Self {
        Self::scoped(
            identity,
            PluginOperationalEventKind::QueueSaturated { queue, limit },
        )
    }

    /// Event-scoped identity for display and serialization.
    #[must_use]
    pub fn identity(&self) -> Option<&str> {
        self.identity_proof().map(PluginIdentity::as_str)
    }

    /// Validated event-scoped identity.
    #[must_use]
    pub const fn identity_proof(&self) -> Option<&PluginIdentity> {
        match &self.inner {
            PluginOperationalEventInner::Scoped { identity, .. } => Some(identity),
            PluginOperationalEventInner::UnscopedRuntimeFailure { .. }
            | PluginOperationalEventInner::UnscopedQueueSaturated { .. } => None,
        }
    }

    /// Payload-free event kind.
    #[must_use]
    pub const fn kind(&self) -> PluginOperationalEventKind {
        match &self.inner {
            PluginOperationalEventInner::Scoped { kind, .. } => *kind,
            PluginOperationalEventInner::UnscopedRuntimeFailure { failure } => {
                PluginOperationalEventKind::RuntimeFailure { failure: *failure }
            }
            PluginOperationalEventInner::UnscopedQueueSaturated { queue, limit } => {
                PluginOperationalEventKind::QueueSaturated {
                    queue: *queue,
                    limit: *limit,
                }
            }
        }
    }

    /// Builds an identity-scoped event without payload disclosure.
    fn scoped(identity: &PluginIdentity, kind: PluginOperationalEventKind) -> Self {
        Self {
            inner: PluginOperationalEventInner::Scoped {
                identity: identity.clone(),
                kind,
            },
        }
    }
}

impl Display for PluginOperationalEvent {
    fn fmt(&self, formatter: &mut Formatter<'_>) -> std::fmt::Result {
        match &self.inner {
            PluginOperationalEventInner::Scoped {
                identity,
                kind: PluginOperationalEventKind::Load,
            } => {
                write!(formatter, "plugin {:?} loaded", identity.as_str())
            }
            PluginOperationalEventInner::Scoped {
                identity,
                kind: PluginOperationalEventKind::Unload,
            } => {
                write!(formatter, "plugin {:?} unloaded", identity.as_str())
            }
            PluginOperationalEventInner::Scoped {
                identity,
                kind: PluginOperationalEventKind::Revocation { reason },
            } => {
                write!(
                    formatter,
                    "plugin {:?} revoked for {reason}",
                    identity.as_str()
                )
            }
            PluginOperationalEventInner::Scoped {
                identity,
                kind: PluginOperationalEventKind::DeniedImport { import },
            } => {
                write!(
                    formatter,
                    "plugin {:?} denied import {import}",
                    identity.as_str()
                )
            }
            PluginOperationalEventInner::Scoped {
                identity,
                kind: PluginOperationalEventKind::ImportRejected { import, reason },
            } => {
                write!(
                    formatter,
                    "plugin {:?} rejected import {import}: {reason}",
                    identity.as_str()
                )
            }
            PluginOperationalEventInner::Scoped {
                identity,
                kind: PluginOperationalEventKind::Timeout { timeout_ms },
            } => {
                write!(
                    formatter,
                    "plugin {:?} timed out after {timeout_ms} ms",
                    identity.as_str()
                )
            }
            PluginOperationalEventInner::Scoped {
                identity,
                kind: PluginOperationalEventKind::GuestTrap { export },
            } => {
                write!(
                    formatter,
                    "plugin {:?} export {export} trapped",
                    identity.as_str()
                )
            }
            PluginOperationalEventInner::Scoped {
                identity,
                kind: PluginOperationalEventKind::RuntimeFailure { failure },
            } => {
                write!(
                    formatter,
                    "plugin {:?} runtime failure: {failure}",
                    identity.as_str()
                )
            }
            PluginOperationalEventInner::Scoped {
                identity,
                kind: PluginOperationalEventKind::QueueSaturated { queue, limit },
            } => {
                write!(
                    formatter,
                    "plugin {:?} saturated {queue} queue at {limit}",
                    identity.as_str()
                )
            }
            PluginOperationalEventInner::UnscopedRuntimeFailure { failure } => {
                write!(formatter, "plugin runtime failure: {failure}")
            }
            PluginOperationalEventInner::UnscopedQueueSaturated { queue, limit } => {
                write!(formatter, "plugin {queue} queue saturated at {limit}")
            }
        }
    }
}

/// Payload-free event kind.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum PluginOperationalEventKind {
    /// Runtime load.
    Load,
    /// Runtime unload.
    Unload,
    /// Runtime authority revoked.
    Revocation {
        /// Redacted reason.
        reason: PluginRevocationReason,
    },
    /// Host import denied.
    DeniedImport {
        /// Import class.
        import: PluginOperationalImport,
    },
    /// Host import failed after capability authorization.
    ImportRejected {
        /// Import class.
        import: PluginOperationalImport,
        /// Closed rejection shape.
        reason: PluginOperationalImportRejection,
    },
    /// Guest execution timeout.
    Timeout {
        /// Deadline in milliseconds.
        timeout_ms: u64,
    },
    /// Guest execution trapped.
    GuestTrap {
        /// Export that trapped.
        export: PluginOperationalExport,
    },
    /// Runtime failure outside host-import and guest-domain failures.
    RuntimeFailure {
        /// Closed runtime failure class.
        failure: PluginOperationalRuntimeFailure,
    },
    /// Bounded queue rejected work.
    QueueSaturated {
        /// Queue class.
        queue: PluginOperationalQueue,
        /// Queue cap.
        limit: NonZeroUsize,
    },
}

/// Closed runtime failure diagnostic vocabulary.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum PluginOperationalRuntimeFailure {
    /// Runtime engine setup.
    Engine,
    /// Runtime epoch driver setup.
    RuntimeTimer,
    /// Component validation or compilation.
    Component,
    /// Host import linker construction.
    Linker,
    /// Component instantiation.
    Instantiate,
    /// Host-width runtime limit projection.
    Limit,
    /// Lifecycle export lookup.
    Export,
    /// Canonical ABI cleanup after guest return.
    PostReturn,
    /// Fuel setup before guest execution.
    Fuel,
    /// Deadline setup before guest execution.
    Timer,
    /// Runtime instance and host state came from different plugins.
    InstanceStateMismatch,
    /// Runtime instance and caller-held task batch came from different plugins.
    BatchIdentityMismatch,
}

impl PluginOperationalRuntimeFailure {
    /// Stable redacted failure class text.
    #[must_use]
    pub const fn as_str(self) -> &'static str {
        match self {
            Self::Engine => "engine",
            Self::RuntimeTimer => "runtime-timer",
            Self::Component => "component",
            Self::Linker => "linker",
            Self::Instantiate => "instantiate",
            Self::Limit => "limit",
            Self::Export => "export",
            Self::PostReturn => "post-return",
            Self::Fuel => "fuel",
            Self::Timer => "timer",
            Self::InstanceStateMismatch => "instance-state-mismatch",
            Self::BatchIdentityMismatch => "batch-identity-mismatch",
        }
    }
}

impl Display for PluginOperationalRuntimeFailure {
    fn fmt(&self, formatter: &mut Formatter<'_>) -> std::fmt::Result {
        formatter.write_str(self.as_str())
    }
}

/// Closed guest export diagnostic vocabulary.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum PluginOperationalExport {
    /// `load`.
    Load,
    /// `update`.
    Update,
}

impl PluginOperationalExport {
    /// Stable redacted export name.
    #[must_use]
    pub const fn as_str(self) -> &'static str {
        match self {
            Self::Load => "load",
            Self::Update => "update",
        }
    }
}

impl Display for PluginOperationalExport {
    fn fmt(&self, formatter: &mut Formatter<'_>) -> std::fmt::Result {
        formatter.write_str(self.as_str())
    }
}

/// Closed host-import diagnostic vocabulary.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum PluginOperationalImport {
    /// Generic setup-time host import boundary.
    HostImport,
    /// Cleanup of update-scoped resources after guest return.
    UpdateResourceCleanup,
    /// `status.publish`.
    StatusPublish,
    /// `buffer.observe`.
    BufferObserve,
    /// `buffer.propose_edit`.
    BufferProposeEdit,
    /// `workspace.artifact_write`.
    WorkspaceArtifactWrite,
    /// `workspace.observe` task start.
    WorkspaceObserveStart,
    /// `workspace.observe` task poll.
    WorkspaceObservePoll,
    /// `workspace.observe` task take.
    WorkspaceObserveTake,
    /// Canonical ABI drop for `workspace-observe-task`.
    WorkspaceObserveTaskDrop,
    /// Canonical ABI drop for `buffer-handle`.
    BufferHandleDrop,
    /// Canonical ABI drop for `view-handle`.
    ViewHandleDrop,
}

impl PluginOperationalImport {
    /// Stable redacted import name.
    #[must_use]
    pub const fn as_str(self) -> &'static str {
        match self {
            Self::HostImport => "host-import",
            Self::UpdateResourceCleanup => "update-resource-cleanup",
            Self::StatusPublish => "status.publish",
            Self::BufferObserve => "buffer.observe",
            Self::BufferProposeEdit => "buffer.propose_edit",
            Self::WorkspaceArtifactWrite => "workspace.artifact_write",
            Self::WorkspaceObserveStart => "workspace.observe.start",
            Self::WorkspaceObservePoll => "workspace.observe.poll",
            Self::WorkspaceObserveTake => "workspace.observe.take",
            Self::WorkspaceObserveTaskDrop => "workspace-observe-task.drop",
            Self::BufferHandleDrop => "buffer-handle.drop",
            Self::ViewHandleDrop => "view-handle.drop",
        }
    }
}

impl Display for PluginOperationalImport {
    fn fmt(&self, formatter: &mut Formatter<'_>) -> std::fmt::Result {
        formatter.write_str(self.as_str())
    }
}

/// Bounded queue class.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum PluginOperationalQueue {
    /// ECS publication.
    Intent,
    /// Host-visible proposal lane.
    ProposalLane,
    /// Workspace I/O worker.
    WorkspaceIo,
    /// Workspace observation task queue.
    WorkspaceObserveTask,
}

impl PluginOperationalQueue {
    /// Stable redacted queue class text.
    #[must_use]
    pub const fn as_str(self) -> &'static str {
        match self {
            Self::Intent => "intent",
            Self::ProposalLane => "proposal-lane",
            Self::WorkspaceIo => "workspace-io",
            Self::WorkspaceObserveTask => "workspace-observe-task",
        }
    }
}

impl Display for PluginOperationalQueue {
    fn fmt(&self, formatter: &mut Formatter<'_>) -> std::fmt::Result {
        formatter.write_str(self.as_str())
    }
}

/// Redacted host-import rejection shape.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum PluginOperationalImportRejection {
    /// Host import state combines different plugin identities.
    HostStateMismatch,
    /// Host-owned handle resolution failed.
    Handle,
    /// Pending effect queue rejected the request.
    EffectQueue,
    /// Pending workspace I/O queue rejected the request.
    WorkspaceIoQueue,
    /// Pending workspace observation task queue rejected the request.
    WorkspaceObserveTaskQueue,
    /// Buffer observation failed after authorization.
    Observation,
    /// Guest-owned data failed validation.
    Decode,
    /// Component-model resource lookup failed.
    ResourceHandle,
    /// The import ran without an active update session.
    SessionMissing,
    /// The import attempted to create a nested active update session.
    SessionAlreadyActive,
    /// The edit proposal lacked observed revision provenance.
    MissingObservedRevision,
}

impl PluginOperationalImportRejection {
    /// Stable redacted import rejection text.
    #[must_use]
    pub const fn as_str(self) -> &'static str {
        match self {
            Self::HostStateMismatch => "host-state-mismatch",
            Self::Handle => "handle",
            Self::EffectQueue => "effect-queue",
            Self::WorkspaceIoQueue => "workspace-io-queue",
            Self::WorkspaceObserveTaskQueue => "workspace-observe-task-queue",
            Self::Observation => "observation",
            Self::Decode => "decode",
            Self::ResourceHandle => "resource-handle",
            Self::SessionMissing => "session-missing",
            Self::SessionAlreadyActive => "session-already-active",
            Self::MissingObservedRevision => "missing-observed-revision",
        }
    }
}

impl Display for PluginOperationalImportRejection {
    fn fmt(&self, formatter: &mut Formatter<'_>) -> std::fmt::Result {
        formatter.write_str(self.as_str())
    }
}

#[cfg(test)]
mod tests {
    use super::{
        PluginOperationalEvent, PluginOperationalExport, PluginOperationalImport,
        PluginOperationalImportRejection, PluginOperationalQueue, PluginOperationalRuntimeFailure,
    };
    use crate::plugin::{PluginIdentity, PluginRevocationReason};
    use std::num::NonZeroUsize;

    fn count_limit(value: usize) -> NonZeroUsize {
        NonZeroUsize::new(value).expect("test queue limit should be non-zero")
    }

    #[test]
    fn operational_events_are_redacted() {
        let identity = identity("formatter");
        let event = PluginOperationalEvent::denied_import(
            &identity,
            PluginOperationalImport::StatusPublish,
        );

        assert_eq!(event.identity(), Some("formatter"));
        assert_eq!(
            event.identity_proof().map(PluginIdentity::as_str),
            Some("formatter")
        );
        assert!(!format!("{event:?}").contains("secret"));
        assert!(!event.to_string().contains("secret"));
    }

    #[test]
    fn queue_saturation_event_has_no_payload() {
        let event = PluginOperationalEvent::queue_saturated(
            PluginOperationalQueue::WorkspaceIo,
            count_limit(1),
        );

        assert_eq!(event.identity(), None);
        assert_eq!(
            event.to_string(),
            "plugin workspace-io queue saturated at 1"
        );
    }

    #[test]
    fn scoped_queue_saturation_keeps_payload_redacted() {
        let identity = identity("formatter");
        let event = PluginOperationalEvent::queue_saturated_for(
            &identity,
            PluginOperationalQueue::Intent,
            count_limit(1),
        );

        assert_eq!(event.identity(), Some("formatter"));
        assert!(!format!("{event:?}").contains("workspace bytes"));
        assert_eq!(
            event.to_string(),
            "plugin \"formatter\" saturated intent queue at 1"
        );
    }

    #[test]
    fn import_rejection_event_has_closed_redacted_reason() {
        let identity = identity("formatter");
        let event = PluginOperationalEvent::rejected_import(
            &identity,
            PluginOperationalImport::WorkspaceArtifactWrite,
            PluginOperationalImportRejection::Decode,
        );

        assert_eq!(event.identity(), Some("formatter"));
        assert_eq!(
            event.to_string(),
            "plugin \"formatter\" rejected import workspace.artifact_write: decode"
        );
        assert!(!format!("{event:?}").contains("docs/secret.txt"));
        assert!(!event.to_string().contains("docs/secret.txt"));
    }

    #[test]
    fn revocation_event_has_closed_redacted_reason() {
        let identity = identity("formatter");
        let event =
            PluginOperationalEvent::revocation(&identity, PluginRevocationReason::GrantsChanged);

        assert_eq!(event.identity(), Some("formatter"));
        assert_eq!(
            event.to_string(),
            "plugin \"formatter\" revoked for grants-changed"
        );
        assert!(!format!("{event:?}").contains("secret"));
        assert!(!event.to_string().contains("secret"));
    }

    #[test]
    fn operational_queue_classes_have_stable_redacted_text() {
        for (queue, expected) in [
            (PluginOperationalQueue::Intent, "intent"),
            (PluginOperationalQueue::ProposalLane, "proposal-lane"),
            (PluginOperationalQueue::WorkspaceIo, "workspace-io"),
            (
                PluginOperationalQueue::WorkspaceObserveTask,
                "workspace-observe-task",
            ),
        ] {
            assert_eq!(queue.as_str(), expected);
            assert_eq!(queue.to_string(), expected);
        }
    }

    #[test]
    fn operational_import_classes_have_stable_redacted_text() {
        for (import, expected) in [
            (PluginOperationalImport::HostImport, "host-import"),
            (
                PluginOperationalImport::UpdateResourceCleanup,
                "update-resource-cleanup",
            ),
            (PluginOperationalImport::StatusPublish, "status.publish"),
            (PluginOperationalImport::BufferObserve, "buffer.observe"),
            (
                PluginOperationalImport::BufferProposeEdit,
                "buffer.propose_edit",
            ),
            (
                PluginOperationalImport::WorkspaceArtifactWrite,
                "workspace.artifact_write",
            ),
            (
                PluginOperationalImport::WorkspaceObserveStart,
                "workspace.observe.start",
            ),
            (
                PluginOperationalImport::WorkspaceObservePoll,
                "workspace.observe.poll",
            ),
            (
                PluginOperationalImport::WorkspaceObserveTake,
                "workspace.observe.take",
            ),
            (
                PluginOperationalImport::WorkspaceObserveTaskDrop,
                "workspace-observe-task.drop",
            ),
            (
                PluginOperationalImport::BufferHandleDrop,
                "buffer-handle.drop",
            ),
            (PluginOperationalImport::ViewHandleDrop, "view-handle.drop"),
        ] {
            assert_eq!(import.as_str(), expected);
            assert_eq!(import.to_string(), expected);
        }
    }

    #[test]
    fn import_rejection_reasons_have_stable_redacted_text() {
        for (reason, expected) in [
            (
                PluginOperationalImportRejection::HostStateMismatch,
                "host-state-mismatch",
            ),
            (PluginOperationalImportRejection::Handle, "handle"),
            (
                PluginOperationalImportRejection::EffectQueue,
                "effect-queue",
            ),
            (
                PluginOperationalImportRejection::WorkspaceIoQueue,
                "workspace-io-queue",
            ),
            (
                PluginOperationalImportRejection::WorkspaceObserveTaskQueue,
                "workspace-observe-task-queue",
            ),
            (PluginOperationalImportRejection::Observation, "observation"),
            (PluginOperationalImportRejection::Decode, "decode"),
            (
                PluginOperationalImportRejection::ResourceHandle,
                "resource-handle",
            ),
            (
                PluginOperationalImportRejection::SessionMissing,
                "session-missing",
            ),
            (
                PluginOperationalImportRejection::SessionAlreadyActive,
                "session-already-active",
            ),
            (
                PluginOperationalImportRejection::MissingObservedRevision,
                "missing-observed-revision",
            ),
        ] {
            assert_eq!(reason.as_str(), expected);
            assert_eq!(reason.to_string(), expected);
        }
    }

    #[test]
    fn guest_trap_event_has_closed_redacted_export() {
        let identity = identity("formatter");
        let event = PluginOperationalEvent::guest_trap(&identity, PluginOperationalExport::Update);

        assert_eq!(event.identity(), Some("formatter"));
        assert_eq!(
            event.to_string(),
            "plugin \"formatter\" export update trapped"
        );
        assert!(!format!("{event:?}").contains("secret"));
        assert!(!event.to_string().contains("secret"));
    }

    #[test]
    fn runtime_failure_event_has_closed_redacted_reason() {
        let identity = identity("formatter");
        let event = PluginOperationalEvent::runtime_failure(
            &identity,
            PluginOperationalRuntimeFailure::Fuel,
        );

        assert_eq!(event.identity(), Some("formatter"));
        assert_eq!(
            event.to_string(),
            "plugin \"formatter\" runtime failure: fuel"
        );
        assert_eq!(
            PluginOperationalRuntimeFailure::BatchIdentityMismatch.as_str(),
            "batch-identity-mismatch"
        );
        assert!(!format!("{event:?}").contains("secret"));
        assert!(!event.to_string().contains("secret"));
    }

    #[test]
    fn unscoped_runtime_failure_event_has_closed_redacted_reason() {
        let event = PluginOperationalEvent::unscoped_runtime_failure(
            PluginOperationalRuntimeFailure::Engine,
        );

        assert_eq!(event.identity(), None);
        assert_eq!(event.to_string(), "plugin runtime failure: engine");
    }

    fn identity(identity: &str) -> PluginIdentity {
        PluginIdentity::try_new(identity).expect("test identity should validate")
    }
}