veredictum 0.1.4

// SPDX-FileCopyrightText: Veredictum contributors
// SPDX-License-Identifier: Apache-2.0

//! The closed vocabularies of the CNF 2.0 schedule.
//!
//! Every enum here is normative and extensible only by schedule release
//! (CNF 2.0 artifact-set design; the outcome kinds carry the schedule
//! language of `CNF platform_test_schedule master04/06/07`). A value outside
//! these enums is unrepresentable in the typed model — the compile-time
//! property the reference runner exists to demonstrate.

use serde::{Deserialize, Serialize};

/// Verdict class of an outcome kind.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum OutcomeClass {
    /// The operation fulfilled its service contract.
    Success,
    /// The operation was refused for the reason the kind names.
    Error,
}

macro_rules! outcome_kinds {
    ($( $(#[$doc:meta])* ($variant:ident, $token:literal, $class:ident) ),+ $(,)?) => {
        /// A protocol-neutral outcome kind — the only expectation language a
        /// case core may speak (wire realization lives in the operation
        /// bindings). Closed enum; extension only by schedule release.
        #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
        pub enum OutcomeKind {
            $( $(#[$doc])* #[serde(rename = $token)] $variant, )+
        }

        impl OutcomeKind {
            /// All kinds, in schedule order (the `vocab/outcomes.yaml` order).
            pub const ALL: &[OutcomeKind] = &[ $(OutcomeKind::$variant,)+ ];

            /// The kind's wire-independent token (`created`, `not_found`, …).
            #[must_use]
            pub fn token(self) -> &'static str {
                match self { $( OutcomeKind::$variant => $token, )+ }
            }

            /// Success or error class.
            #[must_use]
            pub fn class(self) -> OutcomeClass {
                match self { $( OutcomeKind::$variant => OutcomeClass::$class, )+ }
            }

            /// Parse a token.
            #[must_use]
            pub fn from_token(token: &str) -> Option<Self> {
                match token { $( $token => Some(OutcomeKind::$variant), )+ _ => None }
            }
        }
    };
}

outcome_kinds! {
    /// New resource exists ("positive response associated to the successful creation").
    (Created, "created", Success),
    /// Read/query succeeded with content.
    (Ok, "ok", Success),
    /// Fulfilled with no content (e.g. composition logically deleted at the requested time).
    (OkEmpty, "ok_empty", Success),
    /// New version of an existing resource created.
    (Updated, "updated", Success),
    /// Logical delete performed (a new VERSION, `lifecycle_state = openehr::523|deleted|`).
    (Deleted, "deleted", Success),
    /// Definition stored (stored-query PUT — wire 200, not 201).
    (Stored, "stored", Success),
    /// Accepted for later processing, not yet performed — the asynchronous
    /// branch a service MAY answer with instead of completing inline
    /// (ITS-REST `admin_ehr_delete`/`admin_ehr_delete_all`: "The server may
    /// execute this operation asynchronously (e.g. in batches), in which case
    /// returns status `202 Accepted`"). Distinct from `ok_empty`: the request
    /// was taken, the effect is not yet observable.
    (Accepted, "accepted", Success),
    /// Duplicate identity ("an EHR with the provided `ehr_id` … should be unique"; duplicate `template_id`).
    (AlreadyExists, "already_exists", Error),
    /// Target does not exist ("EHR with `<ehr_id>` does not exist").
    (NotFound, "not_found", Error),
    /// `preceding_version_uid` does not exist. Distinct from
    /// `precondition_failed` because case cores speak SM outcomes and the SM
    /// distinguishes an unknown version from a stale one, even where ITS-REST
    /// folds both into one wire answer (overview `Requests_and_responses.md`
    /// §"If-Match and accidental overwrites": a false-evaluating If-Match "MUST
    /// respond with HTTP status code `412 Precondition Failed`"). The fold is a
    /// realization fact recorded per binding, and `exec::outcome` breaks the tie
    /// on the expected member's status while the header assertions still gate.
    (VersionNotFound, "version_not_found", Error),
    /// Version precondition evaluated false (stale `preceding_version_uid`).
    (PreconditionFailed, "precondition_failed", Error),
    /// Required version precondition absent.
    (PreconditionMissing, "precondition_missing", Error),
    /// Semantically invalid content ("information about the errors in the provided COMPOSITION").
    (ValidationFailed, "validation_failed", Error),
    /// Referenced OPT not on the server ("information about the non-existent OPT").
    (TemplateNotFound, "template_not_found", Error),
    /// Content commits against a different `template_id` than the versioned object.
    (TemplateMismatch, "template_mismatch", Error),
    /// Simplified-format commit without template identification.
    (MissingTemplateId, "missing_template_id", Error),
    /// Delete of an already-deleted version.
    (AlreadyDeleted, "already_deleted", Error),
    /// Other uniqueness/state conflict.
    (Conflict, "conflict", Error),
    /// No representation satisfies `Accept`.
    (NotAcceptable, "not_acceptable", Error),
    /// Payload media type unsupported.
    (UnsupportedMedia, "unsupported_media", Error),
    /// Malformed/unprocessable AQL.
    (InvalidQuery, "invalid_query", Error),
    /// Server aborted at max execution time.
    (Timeout, "timeout", Error),
    /// Request lacks valid authentication (the route-table-wide 401 rule).
    (Unauthenticated, "unauthenticated", Error),
    /// Authenticated principal lacks authorization for the operation (403).
    (Forbidden, "forbidden", Error),
    /// The request itself is malformed: syntactically invalid content, an
    /// unparseable identifier, a contradictory or missing required argument
    /// (ITS-REST `Requests_and_responses.md` §HTTP status codes row 400,
    /// "malformed request syntax, syntactically invalid content", and below the
    /// table: "Status code `400` indicates normally a bad request, as well as a
    /// generic client-side error, used when no other `4xx` error code is
    /// appropriate"). Distinct from `validation_failed`, the
    /// well-formed-but-semantically-invalid content branch (422).
    (BadRequest, "bad_request", Error),
    /// The method is known to the service but the target resource does not
    /// support it — including a resource a deployment's configuration has
    /// left serving none (ITS-REST `Requests_and_responses.md` §HTTP status
    /// codes row 405 and §HTTP Methods: "If a method is recognized but not
    /// allowed for the target resource, the response SHOULD be `405 Method
    /// Not Allowed` status code").
    (MethodNotAllowed, "method_not_allowed", Error),
}

/// Which optional case-core blocks are meaningful.
///
/// The schedule defines three kinds (`functional | content | performance`);
/// the performance case-core schema is a separate artifact revision with its
/// own model (`perf.rs`), so this enum closes over the two kinds the assertion
/// machinery validates. No openEHR spec governs the runner's internal schema
/// split — our own design.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum CaseKind {
    /// SM-operation flow case.
    Functional,
    /// Template-parameterized decision-table case (one executor serves both:
    /// a content row is a generate→commit→expect functional execution).
    Content,
}

/// Case lifecycle status. Ids are never reused; a retired case keeps its id.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum CaseStatus {
    /// In force.
    #[default]
    Active,
    /// Kept for id-permanence only; never selected.
    Retired,
    /// Not yet in force; validated but never verdict-bearing.
    Draft,
}

/// The schedule component a case belongs to (the chapter taxonomy).
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
#[serde(rename_all = "SCREAMING_SNAKE_CASE")]
pub enum Component {
    /// EHR lifecycle and `EHR_STATUS` (SM `I_EHR_SERVICE` / `I_EHR_STATUS`).
    Ehr,
    /// COMPOSITION commit/read/versioning (SM `I_EHR_COMPOSITION`).
    EhrComposition,
    /// CONTRIBUTION commit and retrieval (SM `I_EHR_CONTRIBUTION`).
    EhrContribution,
    /// The EHR's FOLDER directory (SM `I_EHR_DIRECTORY`).
    EhrDirectory,
    /// ADL 1.4 template definitions — OPT upload/list/get (SM `I_DEFINITION_ADL14`).
    #[serde(rename = "DEFINITION_ADL14")]
    DefinitionAdl14,
    /// ADL 2 archetype/template definitions (SM `I_DEFINITION_ADL2`).
    #[serde(rename = "DEFINITION_ADL2")]
    DefinitionAdl2,
    /// Stored-query definitions (SM `I_DEFINITION_QUERY`).
    DefinitionQuery,
    /// AQL execution — ad-hoc and stored (SM `I_QUERY_SERVICE`).
    Query,
    /// Demographic parties and relationships (SM `I_DEMOGRAPHIC_SERVICE`).
    Demographic,
    /// The administrative surface (SM `I_ADMIN_SERVICE`).
    Admin,
    /// EHR-Extract / TDD messaging (SM `I_MESSAGE_SERVICE`).
    Messaging,
    /// RM content semantics asserted per data type, independent of one
    /// endpoint — the template-parameterized decision-table chapter.
    Content,
    /// The Simplified Formats sub-specification: FLAT, STRUCTURED, Web Template.
    SimplifiedFormats,
    /// Authentication, authorization and audit behaviour of the served API.
    Security,
    /// Measured performance: the volumetric deployment classes.
    Performance,
}

/// A capability family (the certificate's rating dimensions).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub enum Family {
    /// The platform (CDR) profile family: CORE/STANDARD/OPTIONS.
    Platform,
    /// The proposed Enterprise extension: D/M/X.
    Enterprise,
    /// The Security & Privacy family: SEC-BASIC (higher rungs are future SEC work).
    Security,
}

/// A family-scoped profile tier. Each tier knows its family so a
/// capability-matrix row declaring a foreign tier is a typed error.
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
pub enum Tier {
    /// Platform CORE: the capabilities every conformant CDR must serve.
    #[serde(rename = "CORE")]
    Core,
    /// Platform STANDARD: capabilities expected of a full platform above CORE.
    #[serde(rename = "STANDARD")]
    Standard,
    /// Platform OPTIONS: capabilities a CDR may serve, rated when present.
    #[serde(rename = "OPTIONS")]
    Options,
    /// Security & Privacy basic rung: authentication, authorization, audit.
    #[serde(rename = "SEC-BASIC")]
    SecBasic,
    /// Enterprise D (the proposed Enterprise family's data-management rung).
    #[serde(rename = "D")]
    EnterpriseD,
    /// Enterprise M (the proposed Enterprise family's management rung).
    #[serde(rename = "M")]
    EnterpriseM,
    /// Enterprise X (the proposed Enterprise family's extension rung).
    #[serde(rename = "X")]
    EnterpriseX,
}

impl Tier {
    /// The family this tier is scoped to.
    #[must_use]
    pub fn family(self) -> Family {
        match self {
            Tier::Core | Tier::Standard | Tier::Options => Family::Platform,
            Tier::SecBasic => Family::Security,
            Tier::EnterpriseD | Tier::EnterpriseM | Tier::EnterpriseX => Family::Enterprise,
        }
    }
}

/// The machine-readable handling class of an ambiguity-register entry — the
/// pipeline branches on this (closed enum).
///
/// The `FixedHandling`/`Editorial` boundary turns on one question: did the
/// entry choose anything? `Editorial` records a wording defect with zero
/// behavioural latitude, the corrected reading forced by the surrounding
/// released text. `FixedHandling` records real latitude the entry pinned.
/// Neither changes gating (`verdict.rs` branches identically); the split tells a
/// reader whether re-adjudication could move the behaviour.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum Disposition {
    /// Assert only the part every defensible reading shares (e.g. the one
    /// member both published error-body shapes carry, a `message` string).
    LooseAssert,
    /// Real latitude existed; the entry pins this catalogue's choice,
    /// encoded directly in bindings/cases.
    FixedHandling,
    /// Sibling cases carry `option:` tags; the ICS `options` declaration selects.
    OptionSelect,
    /// Verdicts reported, never gating.
    ReportOnly,
    /// No normative cases; statement-declared behaviour only.
    StatementDeclared,
    /// A wording/typography defect with zero behavioural latitude: the
    /// corrected reading is forced, nothing was chosen.
    Editorial,
}

/// A wire format role (the §8.7 format axes; media types per the ITS-REST
/// `Accept_*`/`ContentType_*` parameter files).
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
pub enum FormatName {
    /// Canonical openEHR JSON (`application/json`).
    #[serde(rename = "canonical-json")]
    CanonicalJson,
    /// Canonical openEHR XML (`application/xml`).
    #[serde(rename = "canonical-xml")]
    CanonicalXml,
    /// Simplified FLAT JSON (`application/openehr.wt.flat+json`).
    #[serde(rename = "wt-flat")]
    WtFlat,
    /// Simplified STRUCTURED JSON (`application/openehr.wt.structured+json`).
    #[serde(rename = "wt-structured")]
    WtStructured,
    /// The Web Template itself (`application/openehr.wt+json`, template GET only).
    #[serde(rename = "wt")]
    Wt,
}

/// A corpus payload format — the wire roles plus the template-source form.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub enum CorpusFormat {
    /// Canonical openEHR JSON payload.
    #[serde(rename = "canonical-json")]
    CanonicalJson,
    /// Canonical openEHR XML payload.
    #[serde(rename = "canonical-xml")]
    CanonicalXml,
    /// Simplified FLAT JSON payload.
    #[serde(rename = "wt-flat")]
    WtFlat,
    /// Simplified STRUCTURED JSON payload.
    #[serde(rename = "wt-structured")]
    WtStructured,
    /// An ADL 1.4 operational template (OPT XML).
    #[serde(rename = "opt-xml")]
    OptXml,
    /// AQL query text (stored-query definitions).
    #[serde(rename = "aql-text")]
    AqlText,
    /// ADL2 artefact source text (archetypes/templates/OPTs in ADL syntax).
    #[serde(rename = "adl2-text")]
    Adl2Text,
    /// ADL 1.4 archetype source text (the `.adl` form the ADL 1.4
    /// archetype-provisioning extension routes exchange as `text/plain`).
    #[serde(rename = "adl14-text")]
    Adl14Text,
    /// A JSON payload delivered BYTE-FOR-BYTE, unparsed.
    ///
    /// `canonical-json` round-trips its source through `serde_json::Value`
    /// before the send, silently repairing every byte-level defect a JSON
    /// document can carry: a repeated member, member ordering, an exotic number
    /// lexeme. Those are wire behaviours the reader must refuse, so this format
    /// loads the file verbatim and the driver writes those bytes as the request
    /// body. The media type still comes from the case/step `format` axis.
    #[serde(rename = "raw-json")]
    RawJson,
}

/// HTTP method of a binding request (the ITS-REST realization layer).
///
/// The vocabulary is the method subset the released overview tabulates
/// (`ITS-REST docs/overview/Requests_and_responses.md` §HTTP Methods: GET,
/// HEAD, POST, PUT, DELETE, OPTIONS) — never a wider HTTP method set.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "UPPERCASE")]
pub enum HttpMethod {
    /// Retrieve a representation of the target resource.
    Get,
    /// Submit a representation to the target resource.
    Post,
    /// Replace the target resource with the enclosed representation.
    Put,
    /// Remove the target resource.
    Delete,
    /// Like `GET`, but the response carries headers only.
    Head,
    /// "Describe the communication options for the target resource"
    /// (`Requests_and_responses.md` §HTTP Methods) — the method the STABLE
    /// System API's one operation is served with.
    Options,
}

/// Parameter-iteration law (`CNF platform_test_schedule master04` iteration
/// semantics: "the pre-conditions and post-conditions apply to the run for X").
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum Iteration {
    /// The master04 law: the whole `requires` block re-established per row.
    ResetPerRow,
    /// Rows execute against one shared server state — required when an
    /// aggregate postcondition spans rows.
    SinglePass,
}

/// The `requires.server` precondition ("The server should be empty (no EHRs,
/// no commits, no OPTs)" — CNF master06).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum ServerState {
    /// No EHRs, no commits, no OPTs.
    Empty,
    /// The case's ground depends on GLOBAL server state (an empty template
    /// list, a globally-absent artefact) that only an exclusively-owned SUT
    /// can establish — on a shared instance the case is not-applicable
    /// (the ixit environment declares exclusivity).
    Exclusive,
    /// The case is indifferent to pre-existing server content.
    Any,
}

/// Adjudicated fixture verdict in the corpus manifest.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum FixtureVerdict {
    /// The fixture is spec-valid: a conformant server must accept it.
    Valid,
    /// The fixture is spec-invalid: a conformant server must refuse it.
    Invalid,
}

/// Runtime placeholder policy for a corpus fixture (the Robot corpus's
/// `__AUTO-GENRATED-BY-TEST__` convention, formalized).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub enum PlaceholderPolicy {
    /// The runner substitutes a fresh random value per use.
    #[serde(rename = "runtime-random")]
    RuntimeRandom,
}

/// The openEHR ITS-XML target namespace a canonical-XML document root must be
/// qualified with (`namespace:` of the `xml_root` assertion).
///
/// The closed set is what ITS-XML publishes: the `Release-1.0.2` schemas carry
/// `targetNamespace="http://schemas.openehr.org/v1"` and the `Release-2.0.0`
/// ones carry `.../v2`, both with `elementFormDefault="qualified"`, so a
/// conforming instance's root is in one of exactly these two namespaces. Which
/// lineage a service serves is implementation-defined (register AMB-169), so
/// [`Self::Published`] is the assertion a case normally makes; the pinned
/// tokens serve a row that has fixed the lineage by other means.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "kebab-case")]
pub enum XmlNamespace {
    /// Either published openEHR ITS-XML target namespace.
    #[serde(rename = "openehr-published")]
    Published,
    /// `http://schemas.openehr.org/v1` — the Release-1.0.2 lineage.
    #[serde(rename = "openehr-v1")]
    V1,
    /// `http://schemas.openehr.org/v2` — the Release-2.0.0 lineage.
    #[serde(rename = "openehr-v2")]
    V2,
}

impl XmlNamespace {
    /// The published token (matches the case-core schema enum).
    #[must_use]
    pub const fn token(self) -> &'static str {
        match self {
            Self::Published => "openehr-published",
            Self::V1 => "openehr-v1",
            Self::V2 => "openehr-v2",
        }
    }

    /// Whether a document's root-element namespace URI satisfies this
    /// expectation.
    #[must_use]
    pub fn accepts(self, uri: &str) -> bool {
        match self {
            Self::Published => uri == Self::V1_URI || uri == Self::V2_URI,
            Self::V1 => uri == Self::V1_URI,
            Self::V2 => uri == Self::V2_URI,
        }
    }

    /// The Release-1.0.2 bundle's target namespace.
    pub const V1_URI: &str = "http://schemas.openehr.org/v1";
    /// The Release-2.0.0 bundle's target namespace.
    pub const V2_URI: &str = "http://schemas.openehr.org/v2";
}

/// A named ignore-set the `equivalent` assertion may resolve
/// (normative per operation/format overlay, never runner-chosen).
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum IgnoreSetName {
    /// The operation's server-assigned paths — enumerated per binding.
    ServerAssigned,
    /// The simplified-formats ctx defaulting set — enumerated once in
    /// `vocab/selectors.yaml` (ITS-REST `simplified_formats` master06 §ctx defaults).
    CtxDefaults,
}

/// Spec-component keys of the `applies` version-applicability map.
#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum SpecComponent {
    /// The Reference Model (`RM`).
    Rm,
    /// The BASE component (foundation + base types).
    Base,
    /// The Archetype Model (`AM`).
    Am,
    /// The Archetype Query Language (`QUERY`).
    Aql,
    /// The REST implementation technology specification (`ITS-REST`).
    ItsRest,
    /// The Terminology component (`TERM`).
    Term,
}

/// The RM `change_type` values the schedule asserts
/// (`RM common §change_control` — `VERSION.commit_audit.change_type`).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "UPPERCASE")]
pub enum ChangeType {
    /// First version of a versioned object.
    Create,
    /// A subsequent, non-deleting version.
    Modify,
    /// The logical-delete version.
    Deleted,
}

/// AQL `RESULT_SET` comparison mode (`match:` of the `result_set` assertion).
///
/// `Set` is bag (multiset) equality — duplicate rows significant, AQL being
/// bag-semantics absent DISTINCT (QUERY `master03-syntax.adoc` §DISTINCT).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum ResultSetMatch {
    /// Legal only when the query totally orders the expected rows
    /// (QUERY master03 §ORDER BY: absent ORDER BY, ordering is undefined).
    Ordered,
    /// Bag equality.
    Set,
    /// Row count only.
    Count,
    /// Every expected row appears (bag-wise); extra rows permitted.
    Contains,
}

/// How a `result_set` assertion compares a scalar cell (`cells:` of the
/// `result_set` assertion).
///
/// The default is [`CellComparison::Lexeme`], the only comparison that can test
/// the write-path preservation sentence of ITS-REST
/// `specifications/docs/overview/Resources.md` §Datetime format: a body
/// date/time "will be preserved as it was sent by the client, and passed to the
/// underlying backend engine as is", stated with no RFC 2119 keyword.
/// [`CellComparison::Instant`] is declared by a case whose cells are read back
/// through a QUERY, where the same section drops to SHOULD-strength
/// ("Retrieval or querying those resources SHOULD return date, datetime, or
/// time values in the (original) format provided by underlying backend engine,
/// avoiding any format change"), so the instant is the fact the row may gate on
/// and the spelling is not.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum CellComparison {
    /// Exact lexeme equality (the default when a case declares no `cells:`).
    #[default]
    Lexeme,
    /// ISO 8601 date/time cells carrying an explicit UTC designator or offset
    /// compare by the instant they denote; every other cell keeps exact
    /// lexeme equality.
    Instant,
}

/// The ITS a binding realizes. Closed to the REST ITS until another ITS
/// binding layer is registered by schedule release.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub enum ItsName {
    /// The openEHR REST API implementation technology specification.
    #[serde(rename = "its-rest")]
    ItsRest,
}

/// The `_type` a CONTRIBUTION member may self-tag with in a case's bundled
/// `versions:` construct.
///
/// ITS-REST `docs/overview/Resources.md` §Resource representation makes
/// `_type` a general metadata attribute whose "value … MUST be the uppercase
/// class name from the RM specification", so a member may carry one. The closed
/// set is the RM `VERSION` family the commit wire can be addressed with: the
/// class the released member schema titles (`schemas/ehr/UpdateVersion.yaml`),
/// the class such a member becomes when committed (RM common
/// `master06-change_control_package.adoc` §Version and its Subtypes), and the
/// sibling subtype a copied version is wrapped in, for which the commit wire
/// declares no shape (register AMB-89).
///
/// A `_type` outside that family is not a schedule value: the released text
/// does not distinguish such a token from any other malformed body.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub enum MemberVersionType {
    /// `UPDATE_VERSION` — the class the released commit-wire member schema
    /// titles (ITS-REST `schemas/ehr/UpdateVersion.yaml`).
    #[serde(rename = "UPDATE_VERSION")]
    Update,
    /// `ORIGINAL_VERSION` — the RM class a committed member becomes.
    #[serde(rename = "ORIGINAL_VERSION")]
    Original,
    /// `IMPORTED_VERSION` — the wrapper of a version received from another
    /// system (RM common master06 §Copying); the commit wire declares no
    /// import shape (register AMB-89).
    #[serde(rename = "IMPORTED_VERSION")]
    Imported,
}

impl MemberVersionType {
    /// Every member `_type` a case may author, in RM order.
    pub const ALL: &[MemberVersionType] = &[
        MemberVersionType::Update,
        MemberVersionType::Original,
        MemberVersionType::Imported,
    ];

    /// The RM class name the token puts on the wire.
    #[must_use]
    pub const fn token(self) -> &'static str {
        match self {
            Self::Update => "UPDATE_VERSION",
            Self::Original => "ORIGINAL_VERSION",
            Self::Imported => "IMPORTED_VERSION",
        }
    }

    /// Parse an authored token.
    #[must_use]
    pub fn from_token(token: &str) -> Option<Self> {
        Self::ALL.iter().copied().find(|t| t.token() == token)
    }
}

/// The `audit_change_type` a CONTRIBUTION member's commit audit reports.
///
/// The closed set is the openEHR `audit_change_type` terminology group verbatim
/// (TERM `SupportTerminology`, group `audit_change_type`; RM common master04's
/// `AUDIT_DETAILS.Change_type_valid` invariant binds `change_type.defining_code`
/// to it), so a mistyped token cannot fall through to `249|creation|` and commit
/// an audit the case never asked for.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub enum MemberChangeType {
    /// `249|creation|` — first version of a versioned object.
    #[serde(rename = "creation")]
    Creation,
    /// `250|amendment|` — a correcting content change.
    #[serde(rename = "amendment")]
    Amendment,
    /// `251|modification|` — a content change to an existing object.
    #[serde(rename = "modification")]
    Modification,
    /// `252|synthesis|` — a version synthesized from other sources.
    #[serde(rename = "synthesis")]
    Synthesis,
    /// `253|unknown|` — provenance of the change is unknown.
    #[serde(rename = "unknown")]
    Unknown,
    /// `523|deleted|` — a logical deletion (the member carries no data).
    #[serde(rename = "deleted")]
    Deleted,
    /// `666|attestation|` — an `ATTESTATION` attached to an existing version,
    /// committing no new version (RM common master06 §Contributions).
    #[serde(rename = "attestation")]
    Attestation,
    /// `816|restoration|` — earlier content restored as a new version.
    #[serde(rename = "restoration")]
    Restoration,
    /// `817|format conversion|` — the same content re-encoded in another
    /// format, committed as a new version.
    #[serde(rename = "format conversion")]
    FormatConversion,
}

impl MemberChangeType {
    /// The whole `audit_change_type` group, in the terminology's own order.
    pub const ALL: &[MemberChangeType] = &[
        MemberChangeType::Creation,
        MemberChangeType::Amendment,
        MemberChangeType::Modification,
        MemberChangeType::Synthesis,
        MemberChangeType::Deleted,
        MemberChangeType::Attestation,
        MemberChangeType::Restoration,
        MemberChangeType::FormatConversion,
        MemberChangeType::Unknown,
    ];

    /// The authored token, which is also the group's English rubric.
    #[must_use]
    pub const fn token(self) -> &'static str {
        match self {
            Self::Creation => "creation",
            Self::Amendment => "amendment",
            Self::Modification => "modification",
            Self::Synthesis => "synthesis",
            Self::Unknown => "unknown",
            Self::Deleted => "deleted",
            Self::Attestation => "attestation",
            Self::Restoration => "restoration",
            Self::FormatConversion => "format conversion",
        }
    }

    /// The openEHR `audit_change_type` code.
    #[must_use]
    pub const fn code(self) -> &'static str {
        match self {
            Self::Creation => "249",
            Self::Amendment => "250",
            Self::Modification => "251",
            Self::Synthesis => "252",
            Self::Unknown => "253",
            Self::Deleted => "523",
            Self::Attestation => "666",
            Self::Restoration => "816",
            Self::FormatConversion => "817",
        }
    }

    /// Parse an authored token.
    #[must_use]
    pub fn from_token(token: &str) -> Option<Self> {
        Self::ALL.iter().copied().find(|c| c.token() == token)
    }
}

/// The `version_lifecycle_state` a CONTRIBUTION member commits with.
///
/// RM common `master06-change_control_package.adoc` §Version Lifecycle fixes
/// the group verbatim: "the possible values are `532|complete|`,
/// `553|incomplete|`, `523|deleted|`, `800|inactive|` and `801|abandoned|`"
/// (TERM `SupportTerminology` group `version_lifecycle_state`). The closed enum
/// is that group; a member probing the out-of-group refusal
/// (`ORIGINAL_VERSION.Lifecycle_state_valid`) authors the whole
/// `ORIGINAL_VERSION` member verbatim instead.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum VersionLifecycleState {
    /// `532|complete|` — a fully authored version.
    Complete,
    /// `553|incomplete|` — partial content committed with relaxed validation
    /// (master06 §Incomplete Content).
    Incomplete,
    /// `523|deleted|` — a logically deleted version (master06 §Logical Deletion).
    Deleted,
    /// `800|inactive|` — content marked no longer valid for use (master06
    /// §Abandoned and Inactive States).
    Inactive,
    /// `801|abandoned|` — incomplete content that lost relevance before
    /// completion (master06 §Abandoned and Inactive States).
    Abandoned,
}

impl VersionLifecycleState {
    /// Every state of the `version_lifecycle_state` group, in master06 order.
    pub const ALL: &[VersionLifecycleState] = &[
        VersionLifecycleState::Complete,
        VersionLifecycleState::Incomplete,
        VersionLifecycleState::Deleted,
        VersionLifecycleState::Inactive,
        VersionLifecycleState::Abandoned,
    ];

    /// The authored token, which is also the group's English rubric.
    #[must_use]
    pub const fn token(self) -> &'static str {
        match self {
            Self::Complete => "complete",
            Self::Incomplete => "incomplete",
            Self::Deleted => "deleted",
            Self::Inactive => "inactive",
            Self::Abandoned => "abandoned",
        }
    }

    /// The openEHR `version_lifecycle_state` code.
    #[must_use]
    pub const fn code(self) -> &'static str {
        match self {
            Self::Complete => "532",
            Self::Incomplete => "553",
            Self::Deleted => "523",
            Self::Inactive => "800",
            Self::Abandoned => "801",
        }
    }

    /// Parse an authored token.
    #[must_use]
    pub fn from_token(token: &str) -> Option<Self> {
        Self::ALL.iter().copied().find(|s| s.token() == token)
    }
}

/// The `X_VERSIONED_*` wrapper class of an EHR-Extract content item — the
/// versioned object a `requires.import` precondition mints its handles from.
///
/// RM `ehr_extract` `master05` types `OPENEHR_CONTENT_ITEM.item` as the
/// `X_VERSIONED_OBJECT` family, one concrete wrapper per versioned-object kind.
/// An extract legitimately carries several at once, so the precondition names
/// which one the case is about rather than guessing from position.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
pub enum XVersionedClass {
    /// `X_VERSIONED_COMPOSITION` — a versioned COMPOSITION.
    #[serde(rename = "X_VERSIONED_COMPOSITION")]
    Composition,
    /// `X_VERSIONED_EHR_STATUS` — the EHR's versioned `EHR_STATUS`.
    #[serde(rename = "X_VERSIONED_EHR_STATUS")]
    EhrStatus,
    /// `X_VERSIONED_EHR_ACCESS` — the EHR's versioned `EHR_ACCESS`.
    #[serde(rename = "X_VERSIONED_EHR_ACCESS")]
    EhrAccess,
    /// `X_VERSIONED_FOLDER` — a versioned directory hierarchy.
    #[serde(rename = "X_VERSIONED_FOLDER")]
    Folder,
    /// `X_VERSIONED_PARTY` — a demographics-chapter party (RM `ehr_extract`
    /// `master09-semantics.adoc` §Creation Semantics).
    #[serde(rename = "X_VERSIONED_PARTY")]
    Party,
}

impl XVersionedClass {
    /// Every wrapper class, in the order the RM tables them.
    pub const ALL: &[XVersionedClass] = &[
        XVersionedClass::Composition,
        XVersionedClass::EhrStatus,
        XVersionedClass::EhrAccess,
        XVersionedClass::Folder,
        XVersionedClass::Party,
    ];

    /// The RM class name.
    #[must_use]
    pub const fn token(self) -> &'static str {
        match self {
            Self::Composition => "X_VERSIONED_COMPOSITION",
            Self::EhrStatus => "X_VERSIONED_EHR_STATUS",
            Self::EhrAccess => "X_VERSIONED_EHR_ACCESS",
            Self::Folder => "X_VERSIONED_FOLDER",
            Self::Party => "X_VERSIONED_PARTY",
        }
    }

    /// Parse an authored token.
    #[must_use]
    pub fn from_token(token: &str) -> Option<Self> {
        Self::ALL.iter().copied().find(|c| c.token() == token)
    }
}

#[cfg(test)]
mod tests {
    use std::collections::BTreeSet;

    use super::*;

    #[test]
    fn outcome_tokens_round_trip() {
        for kind in OutcomeKind::ALL {
            assert_eq!(OutcomeKind::from_token(kind.token()), Some(*kind));
        }
        assert_eq!(OutcomeKind::ALL.len(), 26);
        assert_eq!(OutcomeKind::Created.class(), OutcomeClass::Success);
        assert_eq!(OutcomeKind::Timeout.class(), OutcomeClass::Error);
        assert_eq!(OutcomeKind::Accepted.class(), OutcomeClass::Success);
        assert_eq!(OutcomeKind::BadRequest.class(), OutcomeClass::Error);
        assert_eq!(OutcomeKind::MethodNotAllowed.class(), OutcomeClass::Error);
        for token in ["accepted", "bad_request", "method_not_allowed"] {
            assert!(
                OutcomeKind::from_token(token).is_some(),
                "{token} must parse"
            );
        }
    }

    #[test]
    fn tier_families() {
        assert_eq!(Tier::Core.family(), Family::Platform);
        assert_eq!(Tier::SecBasic.family(), Family::Security);
        assert_eq!(Tier::EnterpriseD.family(), Family::Enterprise);
    }

    #[test]
    fn serde_tokens() {
        let kind: OutcomeKind =
            serde_json::from_value(serde_json::json!("already_exists")).unwrap();
        assert_eq!(kind, OutcomeKind::AlreadyExists);
        let tier: Tier = serde_json::from_value(serde_json::json!("SEC-BASIC")).unwrap();
        assert_eq!(tier, Tier::SecBasic);
        let comp: Component =
            serde_json::from_value(serde_json::json!("DEFINITION_ADL14")).unwrap();
        assert_eq!(comp, Component::DefinitionAdl14);
        let fmt: FormatName = serde_json::from_value(serde_json::json!("wt-flat")).unwrap();
        assert_eq!(fmt, FormatName::WtFlat);
    }

    /// Every `audit_change_type` member carries its own token and code, and the
    /// token parses back. A shared code would commit one change type under
    /// another's identity.
    #[test]
    fn every_audit_change_type_carries_its_own_code_and_round_trips() {
        let tokens: BTreeSet<&str> = MemberChangeType::ALL.iter().map(|c| c.token()).collect();
        let codes: BTreeSet<&str> = MemberChangeType::ALL.iter().map(|c| c.code()).collect();
        assert_eq!(tokens.len(), MemberChangeType::ALL.len());
        assert_eq!(codes.len(), MemberChangeType::ALL.len());
        for change in MemberChangeType::ALL {
            assert_eq!(MemberChangeType::from_token(change.token()), Some(*change));
        }
        assert_eq!(MemberChangeType::Creation.code(), "249");
        assert_eq!(
            MemberChangeType::FormatConversion.token(),
            "format conversion"
        );
    }

    /// Every `version_lifecycle_state` member carries its own token and code,
    /// and the token parses back.
    #[test]
    fn every_version_lifecycle_state_carries_its_own_code_and_round_trips() {
        let codes: BTreeSet<&str> = VersionLifecycleState::ALL
            .iter()
            .map(|s| s.code())
            .collect();
        assert_eq!(codes.len(), VersionLifecycleState::ALL.len());
        for state in VersionLifecycleState::ALL {
            assert_eq!(
                VersionLifecycleState::from_token(state.token()),
                Some(*state)
            );
        }
        assert_eq!(VersionLifecycleState::Complete.code(), "532");
    }

    /// Every `X_VERSIONED_*` class round-trips its RM class name, which is the
    /// spelling the versioned-object routes are addressed with.
    #[test]
    fn every_x_versioned_class_round_trips_its_rm_class_name() {
        for class in XVersionedClass::ALL {
            assert_eq!(XVersionedClass::from_token(class.token()), Some(*class));
            assert!(
                class.token().starts_with("X_VERSIONED_"),
                "{}",
                class.token()
            );
        }
        assert_eq!(XVersionedClass::from_token("X_VERSIONED_NOTHING"), None);
    }

    /// The spec-component keys are the one spelling every `applies` map, every
    /// statement's `spec_versions` and every renderer uses.
    #[test]
    fn every_spec_component_carries_a_distinct_authored_key() {
        let tokens: Vec<&str> = SpecComponent::ALL.iter().map(|c| c.token()).collect();
        assert_eq!(tokens, ["rm", "base", "am", "aql", "its_rest", "term"]);
    }

    /// The XML-namespace expectation renders its published token and accepts
    /// exactly the URIs its lineage names; `openehr-published` accepts both
    /// bundles, each pinned token only its own.
    #[test]
    fn every_xml_namespace_expectation_renders_its_token_and_scopes_its_uris() {
        assert_eq!(XmlNamespace::Published.token(), "openehr-published");
        assert_eq!(XmlNamespace::V1.token(), "openehr-v1");
        assert_eq!(XmlNamespace::V2.token(), "openehr-v2");
        assert!(XmlNamespace::Published.accepts(XmlNamespace::V1_URI));
        assert!(XmlNamespace::Published.accepts(XmlNamespace::V2_URI));
        assert!(XmlNamespace::V1.accepts(XmlNamespace::V1_URI));
        assert!(!XmlNamespace::V1.accepts(XmlNamespace::V2_URI));
        assert!(XmlNamespace::V2.accepts(XmlNamespace::V2_URI));
        assert!(!XmlNamespace::V2.accepts(XmlNamespace::V1_URI));
    }
}

impl CaseKind {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[CaseKind] = &[CaseKind::Functional, CaseKind::Content];
}

impl CaseStatus {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[CaseStatus] = &[CaseStatus::Active, CaseStatus::Retired, CaseStatus::Draft];
}

impl Component {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[Component] = &[
        Component::Ehr,
        Component::EhrComposition,
        Component::EhrContribution,
        Component::EhrDirectory,
        Component::DefinitionAdl14,
        Component::DefinitionAdl2,
        Component::DefinitionQuery,
        Component::Query,
        Component::Demographic,
        Component::Admin,
        Component::Messaging,
        Component::Content,
        Component::SimplifiedFormats,
        Component::Security,
        Component::Performance,
    ];
}

impl Family {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[Family] = &[Family::Platform, Family::Enterprise, Family::Security];
}

impl Tier {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[Tier] = &[
        Tier::Core,
        Tier::Standard,
        Tier::Options,
        Tier::SecBasic,
        Tier::EnterpriseD,
        Tier::EnterpriseM,
        Tier::EnterpriseX,
    ];
}

impl Disposition {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[Disposition] = &[
        Disposition::LooseAssert,
        Disposition::FixedHandling,
        Disposition::OptionSelect,
        Disposition::ReportOnly,
        Disposition::StatementDeclared,
        Disposition::Editorial,
    ];
}

impl FormatName {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[FormatName] = &[
        FormatName::CanonicalJson,
        FormatName::CanonicalXml,
        FormatName::WtFlat,
        FormatName::WtStructured,
        FormatName::Wt,
    ];

    /// The token a record, a report and a rendered row all name this format
    /// by — one spelling, so two surfaces cannot drift apart.
    #[must_use]
    pub const fn token(self) -> &'static str {
        match self {
            FormatName::CanonicalJson => "canonical-json",
            FormatName::CanonicalXml => "canonical-xml",
            FormatName::WtFlat => "wt-flat",
            FormatName::WtStructured => "wt-structured",
            FormatName::Wt => "wt",
        }
    }
}

impl CorpusFormat {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[CorpusFormat] = &[
        CorpusFormat::CanonicalJson,
        CorpusFormat::CanonicalXml,
        CorpusFormat::WtFlat,
        CorpusFormat::WtStructured,
        CorpusFormat::OptXml,
        CorpusFormat::AqlText,
        CorpusFormat::Adl2Text,
        CorpusFormat::Adl14Text,
        CorpusFormat::RawJson,
    ];
}

impl HttpMethod {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[HttpMethod] = &[
        HttpMethod::Get,
        HttpMethod::Post,
        HttpMethod::Put,
        HttpMethod::Delete,
        HttpMethod::Head,
        HttpMethod::Options,
    ];
}

impl Iteration {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[Iteration] = &[Iteration::ResetPerRow, Iteration::SinglePass];
}

impl ServerState {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[ServerState] = &[ServerState::Empty, ServerState::Exclusive, ServerState::Any];
}

impl FixtureVerdict {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[FixtureVerdict] = &[FixtureVerdict::Valid, FixtureVerdict::Invalid];
}

impl PlaceholderPolicy {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[PlaceholderPolicy] = &[PlaceholderPolicy::RuntimeRandom];
}

impl SpecComponent {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[SpecComponent] = &[
        SpecComponent::Rm,
        SpecComponent::Base,
        SpecComponent::Am,
        SpecComponent::Aql,
        SpecComponent::ItsRest,
        SpecComponent::Term,
    ];

    /// The authored key of this component in an `applies` map / a statement's
    /// `spec_versions` — the one spelling every renderer and citation uses.
    #[must_use]
    pub fn token(self) -> &'static str {
        match self {
            SpecComponent::Rm => "rm",
            SpecComponent::Base => "base",
            SpecComponent::Am => "am",
            SpecComponent::Aql => "aql",
            SpecComponent::ItsRest => "its_rest",
            SpecComponent::Term => "term",
        }
    }
}

impl ChangeType {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[ChangeType] = &[ChangeType::Create, ChangeType::Modify, ChangeType::Deleted];
}

impl ResultSetMatch {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[ResultSetMatch] = &[
        ResultSetMatch::Ordered,
        ResultSetMatch::Set,
        ResultSetMatch::Count,
        ResultSetMatch::Contains,
    ];
}

impl CellComparison {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[CellComparison] = &[CellComparison::Lexeme, CellComparison::Instant];
}

impl ItsName {
    /// All variants, in vocabulary order (schema emission derives from this).
    pub const ALL: &[ItsName] = &[ItsName::ItsRest];
}

#[cfg(test)]
mod all_consts_tests {
    use super::*;

    /// Every `ALL` list is exhaustive: a match over the enum with no wildcard
    /// would fail to compile on a new variant, and this test pins the counts
    /// so schema emission can trust the lists.
    #[test]
    fn all_lists_are_exhaustive() {
        assert_eq!(CaseKind::ALL.len(), 2);
        assert_eq!(Component::ALL.len(), 15);
        assert_eq!(Tier::ALL.len(), 7);
        assert_eq!(Disposition::ALL.len(), 6);
        assert_eq!(FormatName::ALL.len(), 5);
        assert_eq!(CorpusFormat::ALL.len(), 9);
    }
}