etdl_compiler/codegen/

rust.rs

use etdl_parser::ast::{BackoffStrategy, Condition, EtlDocument, EventTree, Node};
use etdl_parser::asyncapi::AsyncApiRegistry;
use etdl_parser::ecel;
use std::collections::BTreeMap;

use crate::validate::Diagnostic;

use super::{CodeGenerator, GeneratedFile};

pub struct RustCodeGenerator {
    pub version: String,
}

/// Everything condition/path codegen needs beyond the immediate node being
/// rendered: the document (for cross-references), the fault-tree
/// probabilities, the AsyncAPI registry (schema lookups for `length()`'s
/// array-vs-string choice and `message.headers.*` coercion), and the
/// enclosing tree's initiating message reference — ECEL only ever sees
/// "the message that triggered the tree" (spec §6.1/§6.3), a single
/// reference constant for the whole handler function being generated.
/// Bundled to avoid a 6+ positional-parameter signature on every codegen
/// function in this recursive call chain.
struct CodegenCtx<'a> {
    doc: &'a EtlDocument,
    fault_tree_probs: &'a BTreeMap<String, f64>,
    registry: &'a AsyncApiRegistry,
    message_ref: &'a etdl_parser::ast::MessageRef,
}

impl Default for RustCodeGenerator {
    fn default() -> Self {
        Self::new()
    }
}

impl RustCodeGenerator {
    pub fn new() -> Self {
        RustCodeGenerator {
            version: env!("CARGO_PKG_VERSION").to_string(),
        }
    }
}

impl CodeGenerator for RustCodeGenerator {
    fn target_name(&self) -> &'static str {
        "rust"
    }

    fn generate_all(
        &self,
        doc: &EtlDocument,
        fault_tree_probs: &BTreeMap<String, f64>,
        registry: &AsyncApiRegistry,
        stem: &str,
        _diagnostics: &mut Vec<Diagnostic>,
    ) -> Result<Vec<GeneratedFile>, String> {
        let mut output = String::new();

        output.push_str(&format!(
            "// AUTOGENERATED BY ETDL COMPILER v{} - DO NOT EDIT DIRECTLY\n\n",
            self.version
        ));

        let imports = collect_imports(doc);
        output.push_str(&imports);
        output.push('\n');

        let inline_types = generate_inline_message_types(doc);
        if !inline_types.is_empty() {
            output.push_str(&inline_types);
        }

        let constants = generate_fault_tree_constants(doc, fault_tree_probs);
        output.push_str(&constants);

        for tree in doc.event_trees.values() {
            let ctx = CodegenCtx {
                doc,
                fault_tree_probs,
                registry,
                message_ref: &tree.initiating_event.message,
            };
            let handler_code = generate_event_tree_handler(&ctx, tree)?;
            output.push_str(&handler_code);
            output.push('\n');
        }

        Ok(vec![GeneratedFile::new(format!("{stem}.rs"), output)])
    }
}

fn collect_imports(doc: &EtlDocument) -> String {
    let mut imports = String::from(
        "use std::time::Duration;\n\
         use etdl_core::BranchMonitor;\n\
         use etdl_core::condition::{contains, matches};\n\
         use etdl_core::publisher::Publisher;\n\
         use etdl_core::retry::{RetryPolicy, BackoffStrategy};\n\
         use etdl_core::WorkflowError;\n\
         use serde::Serialize;\n",
    );

    let mut alias_set: BTreeMap<String, bool> = BTreeMap::new();

    for tree in doc.event_trees.values() {
        if let etdl_parser::ast::MessageRef::External(ref ext_ref) = tree.initiating_event.message
        {
            alias_set.insert(ext_ref.alias.clone(), true);
        }

        for node in tree.nodes.values() {
            match node {
                Node::Operation(op) => {
                    if let Some(etdl_parser::ast::MessageRef::External(ref ext_ref)) = op.emits {
                        alias_set.insert(ext_ref.alias.clone(), true);
                    }
                }
                Node::Consequence(cons) => {
                    if let Some(etdl_parser::ast::ChannelRef::External(ref ext_ref)) =
                        cons.channel
                    {
                        alias_set.insert(ext_ref.alias.clone(), true);
                    }
                    if let Some(etdl_parser::ast::MessageRef::External(ref ext_ref)) =
                        cons.message
                    {
                        alias_set.insert(ext_ref.alias.clone(), true);
                    }
                }
                _ => {}
            }
        }
    }

    for alias in alias_set.keys() {
        let mod_name = alias.replace('-', "_");
        imports.push_str(&format!("use {}::messages::*;\n", mod_name));
    }

    imports
}

fn generate_fault_tree_constants(
    doc: &EtlDocument,
    fault_tree_probs: &BTreeMap<String, f64>,
) -> String {
    let mut output = String::new();

    for tree in doc.event_trees.values() {
        for (node_id, node) in &tree.nodes {
            if let Node::Operation(op) = node {
                if let Some(ref ps) = op.on_failure_probability_source {
                    if let Some((ft_id, prob)) = find_fault_tree_prob(ps, fault_tree_probs) {
                        output.push_str(&format!(
                            "// Computed from faultTrees.{}.topEvent at build time (Section 5.16)\n",
                            ft_id
                        ));
                        let const_name =
                            to_upper_snake(&format!("{}_failure_probability", node_id));
                        output.push_str(&format!("const {}: f64 = {:.6};\n\n", const_name, prob));
                    }
                }
            }
        }
    }

    output
}

/// Resolve an `onFailureProbabilitySource` internal reference to its fault-tree
/// top-event probability. The pointer is `#/faultTrees/<id>/topEvent`; the
/// referenced fault-tree id selects the probability from the resolver output.
fn find_fault_tree_prob(
    ps: &etdl_parser::ast::InternalRef,
    fault_tree_probs: &BTreeMap<String, f64>,
) -> Option<(String, f64)> {
    let ft_id = extract_ft_id(&ps.pointer);
    fault_tree_probs.get(&ft_id).map(|&v| (ft_id.clone(), v))
}

fn generate_event_tree_handler(ctx: &CodegenCtx, tree: &EventTree) -> Result<String, String> {
    let mut output = String::new();

    let fn_name = format!("handle_{}", to_snake_case(&tree.initiating_event.id));
    let message_type = ref_to_rust_type(&tree.initiating_event.message);

    output.push_str(&format!(
        "pub async fn {}(message: {}, publisher: &dyn Publisher) -> Result<(), WorkflowError> {{\n",
        fn_name, message_type
    ));

    let first_barrier = find_first_barrier(tree);
    let monitor_name = first_barrier
        .map(to_snake_case)
        .unwrap_or_else(|| "monitor".to_string());

    output.push_str(&format!(
        "    let mut {} = BranchMonitor::new(\"{}\");\n\n",
        monitor_name,
        first_barrier.unwrap_or("root")
    ));

    let start_node_id = &tree.initiating_event.next;
    let body = generate_node_code(ctx, tree, start_node_id, 1, &monitor_name)?;
    output.push_str(&body);

    output.push_str("    Ok(())\n");
    output.push_str("}\n");

    Ok(output)
}

fn find_first_barrier(tree: &EventTree) -> Option<&str> {
    let mut current = &tree.initiating_event.next;
    loop {
        match tree.nodes.get(current.as_str()) {
            Some(Node::Barrier(_)) => return Some(current.as_str()),
            Some(Node::Operation(op)) => {
                current = &op.next;
            }
            Some(Node::Consequence(_)) => return None,
            None => return None,
        }
    }
}

fn generate_node_code(
    ctx: &CodegenCtx,
    tree: &EventTree,
    node_id: &str,
    depth: usize,
    monitor_name: &str,
) -> Result<String, String> {
    let node = tree
        .nodes
        .get(node_id)
        .ok_or_else(|| format!("node '{}' not found", node_id))?;

    match node {
        Node::Barrier(barrier) => {
            generate_barrier_code(ctx, tree, node_id, barrier, depth, monitor_name)
        }
        Node::Operation(op) => generate_operation_code(ctx, tree, node_id, op, depth, monitor_name),
        Node::Consequence(cons) => generate_consequence_code(cons, depth),
    }
}

fn generate_barrier_code(
    ctx: &CodegenCtx,
    tree: &EventTree,
    node_id: &str,
    barrier: &etdl_parser::ast::Barrier,
    depth: usize,
    monitor_name: &str,
) -> Result<String, String> {
    let indent = "    ".repeat(depth);
    let mut output = String::new();

    for (i, branch) in barrier.branches.iter().enumerate() {
        if i == 0 {
            if branch.condition == Condition::Default {
                let prob = get_branch_prob(branch, node_id, ctx.fault_tree_probs);
                if let Some(p) = prob {
                    output.push_str(&format!(
                        "{}    {}.record_branch(\"{}\", {:.6});\n",
                        indent, monitor_name, branch.outcome, p
                    ));
                }
                let body = generate_node_code(ctx, tree, &branch.next, depth + 1, monitor_name)?;
                output.push_str(&body);
            } else {
                let cond = condition_to_rust_code(ctx, &branch.condition);
                output.push_str(&format!("{}if {} {{\n", indent, cond));

                let prob = get_branch_prob(branch, node_id, ctx.fault_tree_probs);
                if let Some(p) = prob {
                    output.push_str(&format!(
                        "{}    {}.record_branch(\"{}\", {:.6});\n",
                        indent, monitor_name, branch.outcome, p
                    ));
                }

                let body = generate_node_code(ctx, tree, &branch.next, depth + 1, monitor_name)?;
                output.push_str(&body);
                output.push_str(&format!("{}}}", indent));
            }
        } else if branch.condition == Condition::Default {
            output.push_str(" else {\n");

            let prob = get_branch_prob(branch, node_id, ctx.fault_tree_probs);
            if let Some(p) = prob {
                output.push_str(&format!(
                    "{}    {}.record_branch(\"{}\", {:.6});\n",
                    indent, monitor_name, branch.outcome, p
                ));
            }

            let body = generate_node_code(ctx, tree, &branch.next, depth + 1, monitor_name)?;
            output.push_str(&body);
            output.push_str(&format!("{}}}\n", indent));
        } else {
            let cond = condition_to_rust_code(ctx, &branch.condition);
            output.push_str(&format!(" else if {} {{\n", cond));

            let prob = get_branch_prob(branch, node_id, ctx.fault_tree_probs);
            if let Some(p) = prob {
                output.push_str(&format!(
                    "{}    {}.record_branch(\"{}\", {:.6});\n",
                    indent, monitor_name, branch.outcome, p
                ));
            }

            let body = generate_node_code(ctx, tree, &branch.next, depth + 1, monitor_name)?;
            output.push_str(&body);
            output.push_str(&format!("{}}}", indent));
        }
    }

    Ok(output)
}

fn generate_operation_code(
    ctx: &CodegenCtx,
    tree: &EventTree,
    node_id: &str,
    op: &etdl_parser::ast::Operation,
    depth: usize,
    monitor_name: &str,
) -> Result<String, String> {
    let indent = "    ".repeat(depth);
    let mut output = String::new();

    let handler_name = to_snake_case(&op.handler);
    let timeout = op.timeout_ms.unwrap_or(5000);

    if let Some(ref retry) = op.retry_policy {
        let strategy = match retry
            .backoff_strategy
            .as_ref()
            .unwrap_or(&BackoffStrategy::Fixed)
        {
            BackoffStrategy::Exponential => "BackoffStrategy::Exponential",
            BackoffStrategy::Fixed => "BackoffStrategy::Fixed",
        };
        output.push_str(&format!(
            "{}let retry = RetryPolicy {{\n\
             {}    max_attempts: {},\n\
             {}    backoff_ms: {},\n\
             {}    strategy: {},\n\
             {}}};\n",
            indent, indent, retry.max_attempts, indent, retry.backoff_ms, indent, strategy, indent
        ));
        output.push_str(&format!(
            "{}match retry.execute(|| {}(&message), Duration::from_millis({})).await {{\n",
            indent, handler_name, timeout
        ));
    } else {
        output.push_str(&format!(
            "{}match {}(&message).await {{\n",
            indent, handler_name
        ));
    }

    output.push_str(&format!("{}    Ok(_result) => {{\n", indent));

    // Record a success on the SAME SLA key `record_failure` (in the `Err`
    // arm below) uses, so that key's rolling window sees both outcomes
    // instead of only ever seeing failures — an operation that failed
    // `sla::MIN_OBSERVATIONS` times over its lifetime otherwise triggered
    // an unconditional false SLA anomaly regardless of its actual overall
    // failure rate (observed frequency was permanently 1.0). See
    // `BranchMonitor::record_success`'s doc comment.
    if op.on_failure.is_some() {
        if let Some(ref ps) = op.on_failure_probability_source {
            let const_name = to_upper_snake(&format!("{}_failure_probability", node_id));
            let prob_exists = find_fault_tree_prob(ps, ctx.fault_tree_probs).is_some();
            if prob_exists {
                output.push_str(&format!(
                    "{}        {}.record_success(\"{}\", Some({}));\n",
                    indent, monitor_name, node_id, const_name
                ));
            } else {
                output.push_str(&format!(
                    "{}        {}.record_success(\"{}\", None);\n",
                    indent, monitor_name, node_id
                ));
            }
        }
    }

    let next_node = tree.nodes.get(&op.next);
    match next_node {
        Some(Node::Consequence(cons)) => {
            emit_send(cons, "_result", &indent, &mut output);
        }
        Some(_) => {
            generate_node_code(ctx, tree, &op.next, depth + 2, monitor_name)
                .map(|body| output.push_str(&body))?;
        }
        None => {}
    }

    output.push_str(&format!("{}    }}\n", indent));

    if let Some(ref _on_failure_id) = op.on_failure {
        output.push_str(&format!("{}    Err(err) => {{\n", indent));

        if let Some(ref ps) = op.on_failure_probability_source {
            let const_name = to_upper_snake(&format!("{}_failure_probability", node_id));
            let prob_exists = find_fault_tree_prob(ps, ctx.fault_tree_probs).is_some();
            if prob_exists {
                output.push_str(&format!(
                    "{}        {}.record_failure(\"{}\", &err, Some({}));\n",
                    indent, monitor_name, node_id, const_name
                ));
            } else {
                output.push_str(&format!(
                    "{}        {}.record_failure(\"{}\", &err, None);\n",
                    indent, monitor_name, node_id
                ));
            }
        } else {
            output.push_str(&format!(
                "{}        {}.record_failure(\"{}\", &err, None);\n",
                indent, monitor_name, node_id
            ));
        }

        let on_failure_id = op.on_failure.as_ref().unwrap();
        match tree.nodes.get(on_failure_id) {
            Some(Node::Consequence(cons)) => {
                emit_send(cons, "message", &indent, &mut output);
            }
            _ => {
                generate_node_code(ctx, tree, on_failure_id, depth + 2, monitor_name)
                    .map(|body| output.push_str(&body))?;
            }
        }

        output.push_str(&format!("{}    }}\n", indent));
    } else {
        output.push_str(&format!(
            "{}    Err(err) => return Err(WorkflowError::new(format!(\"{{}}\", err))),\n",
            indent
        ));
    }

    output.push_str(&format!("{}}}\n", indent));

    Ok(output)
}

/// Emit a `publisher.publish(...)` call for a `send` consequence.
fn emit_send(
    cons: &etdl_parser::ast::Consequence,
    payload_expr: &str,
    indent: &str,
    output: &mut String,
) {
    match cons.consequence_operation {
        etdl_parser::ast::ConsequenceOperation::Send => {
            if let Some(ref channel_ref) = cons.channel {
                let channel_name = channel_ref_name(channel_ref);
                output.push_str(&format!(
                    "{}        publisher.publish(\"{}\", &etdl_core::serde_json::to_value({}).map_err(|e| WorkflowError::new(format!(\"{{}}\", e)))?)?;\n",
                    indent, channel_name, payload_expr
                ));
            }
        }
        etdl_parser::ast::ConsequenceOperation::Terminate => {}
    }
}

fn generate_consequence_code(
    cons: &etdl_parser::ast::Consequence,
    depth: usize,
) -> Result<String, String> {
    let indent = "    ".repeat(depth);
    let mut output = String::new();

    match cons.consequence_operation {
        etdl_parser::ast::ConsequenceOperation::Send => {
            if let Some(ref channel_ref) = cons.channel {
                let channel_name = channel_ref_name(channel_ref);
                output.push_str(&format!(
                    "{}publisher.publish(\"{}\", &etdl_core::serde_json::to_value(message).map_err(|e| WorkflowError::new(format!(\"{{}}\", e)))?)?;\n",
                    indent, channel_name
                ));
            }
        }
        etdl_parser::ast::ConsequenceOperation::Terminate => {}
    }

    if depth == 1 {
        output.push_str(&format!("{}Ok(())\n", indent));
    }

    Ok(output)
}

fn condition_to_rust_code(ctx: &CodegenCtx, condition: &Condition) -> String {
    match condition {
        Condition::Default => "true".to_string(),
        Condition::Expr(expr) => render_bool_expr(ctx, expr),
    }
}

fn render_bool_expr(ctx: &CodegenCtx, expr: &ecel::BoolExpr) -> String {
    use ecel::BoolExpr as B;
    match expr {
        B::And(a, b) => format!(
            "({}) && ({})",
            render_bool_expr(ctx, a),
            render_bool_expr(ctx, b)
        ),
        B::Or(a, b) => format!(
            "({}) || ({})",
            render_bool_expr(ctx, a),
            render_bool_expr(ctx, b)
        ),
        B::Not(a) => format!("!({})", render_bool_expr(ctx, a)),
        B::Comparison(cmp) => render_comparison(ctx, cmp),
        B::Quantifier(q) => render_quantifier(ctx, q),
        B::Defined(path) => render_defined(path),
    }
}

/// Which of ECEL's two root paths (spec §6.3) a `message.*` path resolves
/// under — decided purely syntactically (the segment right after
/// `message`), never requiring schema access.
enum PathRoot {
    Payload,
    Headers,
}

fn path_root(path: &ecel::PathExpr) -> PathRoot {
    match path.segments.get(1) {
        Some(ecel::PathSegment::Field(name)) if name == "headers" => PathRoot::Headers,
        _ => PathRoot::Payload,
    }
}

fn path_has_wildcard(path: &ecel::PathExpr) -> bool {
    path.segments
        .iter()
        .any(|s| matches!(s, ecel::PathSegment::Wildcard))
}

/// A hint for which concrete Rust primitive a headers value should coerce
/// to, inferred from the comparator's other operand (a literal's type, or a
/// built-in function's known argument/result type) — never from schema
/// access, unlike payload paths (which don't need coercion at all: they're
/// already concretely typed Rust struct fields).
#[derive(Clone, Copy)]
enum ScalarHint {
    /// Numeric, but the concrete Rust type is ambiguous (could be `i64` or
    /// `f64` depending on the schema) — leave a literal operand as a bare,
    /// untyped-integer token and let Rust infer its type from context,
    /// exactly like the pre-existing (unhinted) behavior.
    Number,
    /// Numeric *and* guaranteed to be a concrete `f64` at this point
    /// (an arithmetic result, `abs()`, `length()`, or a headers scalar) —
    /// a literal operand on the other side of the comparison must render
    /// as an explicit `f64` literal, or `f64 > <untyped-int-literal>`
    /// fails to compile (Rust never coerces between numeric types).
    NumberF64,
    String,
    Bool,
    Unknown,
}

fn operand_scalar_hint(operand: &ecel::Operand) -> ScalarHint {
    use ecel::{Literal as L, ValueExpr as V};
    match operand {
        ecel::Operand::Literal(L::Number(_)) => ScalarHint::Number,
        ecel::Operand::Literal(L::String(_)) => ScalarHint::String,
        ecel::Operand::Literal(L::Bool(_)) => ScalarHint::Bool,
        ecel::Operand::Value(V::Number(_)) => ScalarHint::Number,
        ecel::Operand::Value(V::Add(_, _))
        | ecel::Operand::Value(V::Sub(_, _))
        | ecel::Operand::Value(V::Mul(_, _))
        | ecel::Operand::Value(V::Div(_, _)) => ScalarHint::NumberF64,
        ecel::Operand::Value(V::Call(func, _)) => match func {
            ecel::FuncName::Length | ecel::FuncName::Abs => ScalarHint::NumberF64,
            ecel::FuncName::Lower | ecel::FuncName::Upper => ScalarHint::String,
        },
        ecel::Operand::Value(V::Path(path)) if matches!(path_root(path), PathRoot::Headers) => {
            ScalarHint::Unknown
        }
        _ => ScalarHint::Unknown,
    }
}

/// Payload-only: direct Rust struct-field access (`message.payload.foo.bar`,
/// snake_cased) — unchanged from the pre-existing, well-tested behavior.
/// Never called on a headers-rooted path (those go through
/// `render_headers_chain`/`render_headers_scalar` instead, since `headers`
/// stays an untyped `Option<serde_json::Value>` regardless of which kind of
/// Message Reference produced `message` — see the codegen implementation
/// plan's Context section).
fn render_payload_path(path: &ecel::PathExpr) -> String {
    let mut out = String::from("message");
    for seg in path.segments.iter().skip(1) {
        match seg {
            ecel::PathSegment::Field(name) => {
                out.push('.');
                out.push_str(&to_snake_case(name));
            }
            ecel::PathSegment::Wildcard => {}
            ecel::PathSegment::Index(idx) => out.push_str(&format!("[{}]", idx)),
            ecel::PathSegment::QuotedKey(name) => out.push_str(&format!("[\"{}\"]", name)),
        }
    }
    out
}

struct PathParts {
    path_prefix: String,
    remaining_path: String,
}

/// Payload-only wildcard-aware path split (segments before/after the first
/// `[*]`), for quantification codegen (`.iter().any/all(...)`, spec §6.4).
fn build_payload_path_parts(path: &ecel::PathExpr) -> PathParts {
    let segments = &path.segments;
    let mut pre_wildcard = Vec::new();
    let mut post_wildcard = Vec::new();
    let mut has_wildcard = false;

    for (i, seg) in segments.iter().enumerate() {
        if i == 0 {
            continue;
        }
        if has_wildcard {
            post_wildcard.push(seg.clone());
        } else if matches!(seg, ecel::PathSegment::Wildcard) {
            has_wildcard = true;
        } else {
            pre_wildcard.push(seg.clone());
        }
    }

    let mut prefix = String::from("message");
    for seg in &pre_wildcard {
        match seg {
            ecel::PathSegment::Field(name) => {
                prefix.push('.');
                prefix.push_str(&to_snake_case(name));
            }
            ecel::PathSegment::Index(idx) => prefix.push_str(&format!("[{}]", idx)),
            ecel::PathSegment::QuotedKey(name) => prefix.push_str(&format!("[\"{}\"]", name)),
            _ => {}
        }
    }

    let mut suffix = String::new();
    for seg in &post_wildcard {
        match seg {
            ecel::PathSegment::Field(name) => {
                suffix.push('.');
                suffix.push_str(&to_snake_case(name));
            }
            ecel::PathSegment::Index(idx) => suffix.push_str(&format!("[{}]", idx)),
            ecel::PathSegment::QuotedKey(name) => suffix.push_str(&format!("[\"{}\"]", name)),
            _ => {}
        }
    }

    PathParts {
        path_prefix: prefix,
        remaining_path: suffix,
    }
}

/// Builds a `message.headers.as_ref().and_then(|v| v.get("field").cloned())...`
/// chain for a headers-rooted path, yielding `Option<serde_json::Value>`.
/// Uses each segment's *original* name (never snake_cased) — this indexes a
/// runtime JSON object by its real key, not a Rust struct field.
fn render_headers_chain(path: &ecel::PathExpr) -> String {
    let mut expr = String::from("message.headers.as_ref()");
    for seg in path.segments.iter().skip(2) {
        let key = match seg {
            ecel::PathSegment::Field(name) | ecel::PathSegment::QuotedKey(name) => {
                format!("\"{}\"", name)
            }
            ecel::PathSegment::Index(idx) => idx.to_string(),
            ecel::PathSegment::Wildcard => continue,
        };
        expr = format!("{}.and_then(|v| v.get({}).cloned())", expr, key);
    }
    expr
}

/// Coerces a headers chain to a concrete Rust scalar, defaulting on absence
/// — this is the actual bug fix: `message.headers.*` previously rendered as
/// direct field access (`message.headers.trace_id`), which cannot compile
/// since `headers` is `Option<serde_json::Value>`, not a struct.
fn render_headers_scalar(path: &ecel::PathExpr, hint: ScalarHint) -> String {
    let chain = render_headers_chain(path);
    match hint {
        ScalarHint::Number | ScalarHint::NumberF64 => {
            format!("({}.and_then(|v| v.as_f64())).unwrap_or(0.0)", chain)
        }
        ScalarHint::Bool => format!("({}.and_then(|v| v.as_bool())).unwrap_or(false)", chain),
        // `Value::as_str()` returns `Option<&str>` borrowed from its
        // receiver — since the chain above `.cloned()`s at every hop, that
        // receiver is a value owned by the `and_then` closure itself, so a
        // borrow from it can't escape the closure (E0515). Cloning into an
        // owned `String` sidesteps that; comparing an owned `String`
        // against a `&str` literal still works directly via `PartialEq`.
        ScalarHint::String | ScalarHint::Unknown => format!(
            "({}.and_then(|v| v.as_str().map(|s| s.to_string()))).unwrap_or_default()",
            chain
        ),
    }
}

/// `== null` / `!= null` against a headers path can't reuse the payload
/// `Option<T> != None` trick (headers values are `serde_json::Value`, where
/// "absent" and "explicitly JSON null" are different runtime states) —
/// treat both as "is null" here, consistent with `defined()` (spec §6.4.1)
/// being the construct that actually distinguishes the two.
fn render_headers_null_test(path: &ecel::PathExpr, negate: bool) -> String {
    let is_null = format!(
        "({}).map(|v| v.is_null()).unwrap_or(true)",
        render_headers_chain(path)
    );
    if negate {
        format!("!({})", is_null)
    } else {
        is_null
    }
}

/// `defined(path)` (spec §6.4.1). For headers, the `.get()` chain already
/// carries presence information directly (`.is_some()`). For payload, a
/// field may be a required (non-`Option`) Rust type or an `Option<T>` one
/// depending on the schema — rather than needing schema access to pick
/// between `.is_some()` and a literal `true`, round-trip the whole payload
/// through `serde_json` once: that erases the `Option<T>`-vs-`T` distinction
/// uniformly (a required field always serializes present-and-non-null; an
/// absent optional one does not), so one code shape is correct either way.
fn render_defined(path: &ecel::PathExpr) -> String {
    match path_root(path) {
        PathRoot::Headers => format!("({}).is_some()", render_headers_chain(path)),
        PathRoot::Payload => {
            let mut expr = String::from("serde_json::to_value(&message.payload).ok()");
            for seg in path.segments.iter().skip(2) {
                let key = match seg {
                    ecel::PathSegment::Field(name) | ecel::PathSegment::QuotedKey(name) => {
                        format!("\"{}\"", name)
                    }
                    ecel::PathSegment::Index(idx) => idx.to_string(),
                    ecel::PathSegment::Wildcard => continue,
                };
                expr = format!("{}.and_then(|v| v.get({}).cloned())", expr, key);
            }
            format!("({}).is_some_and(|v| !v.is_null())", expr)
        }
    }
}

fn render_quantifier(ctx: &CodegenCtx, q: &ecel::QuantifierExpr) -> String {
    // The inner comparison's `[*]` refers to the quantified array (spec
    // §6.4) — reuse the same wildcard-split machinery a bare comparison's
    // implicit-`all` case already uses, just parameterized on `any`/`all`.
    if let ecel::Operand::Value(ecel::ValueExpr::Path(path_expr)) = &q.comparison.left {
        if path_has_wildcard(path_expr) && matches!(path_root(path_expr), PathRoot::Payload) {
            let parts = build_payload_path_parts(path_expr);
            let right = render_operand(ctx, &q.comparison.right, ScalarHint::Number);
            let op = comparator_str(&q.comparison.op);
            let method = match q.kind {
                ecel::QuantifierKind::Any => "any",
                ecel::QuantifierKind::All => "all",
            };
            return format!(
                "{}.iter().{}(|item| item{} {} {})",
                parts.path_prefix, method, parts.remaining_path, op, right
            );
        }
    }
    // No wildcard where the grammar expects one — a validly type-checked
    // document (spec §6.4) never reaches this; degrade to the plain
    // comparison rather than emitting nonsense.
    render_comparison(ctx, &q.comparison)
}

fn render_comparison(ctx: &CodegenCtx, cmp: &ecel::Comparison) -> String {
    use ecel::Comparator as C;

    if matches!(cmp.op, C::Eq | C::Neq) {
        if let (ecel::Operand::Value(ecel::ValueExpr::Path(path)), ecel::Operand::Literal(ecel::Literal::Null)) =
            (&cmp.left, &cmp.right)
        {
            if matches!(path_root(path), PathRoot::Headers) {
                return render_headers_null_test(path, matches!(cmp.op, C::Neq));
            }
        }
    }

    match cmp.op {
        // `in` and `matches` lower to etdl_core::condition helpers.
        C::In => {
            let left = render_operand(ctx, &cmp.left, ScalarHint::Unknown);
            let right = render_operand(ctx, &cmp.right, ScalarHint::Unknown);
            format!("etdl_core::condition::contains(&{}, &{})", right, left)
        }
        C::Matches => {
            // `etdl_core::condition::matches` takes `value: &str`. A path
            // (payload or headers) renders as an owned `String` expression
            // — a payload field directly (typically `String`), a headers
            // path via `render_headers_scalar`'s owned-`String` coercion
            // (§ its own doc comment: `Value::as_str()` borrows from a
            // value the chain already owns, so it clones to `String`
            // instead) — either way it must be borrowed (`&expr`) so
            // `&String -> &str` deref coercion applies at the call site. A
            // literal already renders as a `&'static str` and must NOT be
            // re-borrowed.
            let left = match &cmp.left {
                ecel::Operand::Value(ecel::ValueExpr::Path(path)) => {
                    let rendered = match path_root(path) {
                        PathRoot::Payload => render_payload_path(path),
                        PathRoot::Headers => render_headers_scalar(path, ScalarHint::String),
                    };
                    format!("&{}", rendered)
                }
                _ => render_operand(ctx, &cmp.left, ScalarHint::String),
            };
            let right = render_operand(ctx, &cmp.right, ScalarHint::String);
            format!("etdl_core::condition::matches({}, {})", left, right)
        }
        _ => {
            if let ecel::Operand::Value(ecel::ValueExpr::Path(path_expr)) = &cmp.left {
                if path_has_wildcard(path_expr) && matches!(path_root(path_expr), PathRoot::Payload)
                {
                    // Wildcard path on the left: quantify over the array
                    // (implicit universal quantification, spec §6.4).
                    let parts = build_payload_path_parts(path_expr);
                    let right = render_operand(ctx, &cmp.right, ScalarHint::Number);
                    let op = comparator_str(&cmp.op);
                    return format!(
                        "{}.iter().all(|item| item{} {} {})",
                        parts.path_prefix, parts.remaining_path, op, right
                    );
                }
            }
            let left_hint = operand_scalar_hint(&cmp.right);
            let right_hint = operand_scalar_hint(&cmp.left);
            let l = render_operand(ctx, &cmp.left, left_hint);
            let r = render_operand(ctx, &cmp.right, right_hint);
            let op = comparator_str(&cmp.op);
            format!("{} {} {}", l, op, r)
        }
    }
}

fn render_operand(ctx: &CodegenCtx, operand: &ecel::Operand, hint: ScalarHint) -> String {
    match operand {
        // A bare numeric literal renders as an untyped-integer token by
        // default, letting Rust infer its type from context (`i64`, `f64`,
        // ...) — but when the *other* side is a guaranteed-`f64` value
        // (arithmetic, `abs()`, `length()`), that inference fails
        // (`f64 > 0` doesn't compile: Rust never coerces between numeric
        // types), so an explicit `f64` literal is required here instead.
        ecel::Operand::Literal(ecel::Literal::Number(n)) if matches!(hint, ScalarHint::NumberF64) => {
            format!("{}f64", n)
        }
        ecel::Operand::Value(v) => render_value_expr(ctx, v, hint),
        ecel::Operand::Literal(lit) => literal_to_val_str(lit),
    }
}

fn render_value_expr(ctx: &CodegenCtx, expr: &ecel::ValueExpr, hint: ScalarHint) -> String {
    use ecel::{FuncName as F, ValueExpr as V};
    match expr {
        V::Path(path) => match path_root(path) {
            PathRoot::Payload => render_payload_path(path),
            PathRoot::Headers => render_headers_scalar(path, hint),
        },
        V::Number(n) if matches!(hint, ScalarHint::NumberF64) => format!("{}f64", n),
        V::Number(n) => n.to_string(),
        V::Call(func, arg) => {
            let arg_hint = match func {
                F::Abs => ScalarHint::NumberF64,
                F::Lower | F::Upper => ScalarHint::String,
                F::Length => ScalarHint::Unknown,
            };
            // A function's argument is used as a bare method-call receiver
            // (`(<arg>).abs()`, `(<arg>).to_ascii_lowercase()`, ...), which
            // an `Option<T>` payload field can't be — unlike a plain
            // comparison operand (unaffected, pre-existing behavior), this
            // needs unwrapping.
            let arg_code = match arg.as_ref() {
                V::Path(path) if matches!(path_root(path), PathRoot::Payload) => {
                    render_payload_scalar(ctx, path)
                }
                _ => render_value_expr(ctx, arg, arg_hint),
            };
            match func {
                F::Length => render_length_call(ctx, arg, &arg_code),
                F::Abs => format!("({}).abs()", arg_code),
                F::Lower => format!("({}).to_ascii_lowercase()", arg_code),
                F::Upper => format!("({}).to_ascii_uppercase()", arg_code),
            }
        }
        V::Add(a, b) => format!("(({}) + ({}))", as_f64_expr(ctx, a), as_f64_expr(ctx, b)),
        V::Sub(a, b) => format!("(({}) - ({}))", as_f64_expr(ctx, a), as_f64_expr(ctx, b)),
        V::Mul(a, b) => format!("(({}) * ({}))", as_f64_expr(ctx, a), as_f64_expr(ctx, b)),
        V::Div(a, b) => format!("(({}) / ({}))", as_f64_expr(ctx, a), as_f64_expr(ctx, b)),
    }
}

/// A payload path rendered as a concrete (never `Option`-wrapped) value —
/// for use as an arithmetic leaf or a function-call receiver, neither of
/// which compile against `Option<T>`. Checks the resolved schema's
/// `required` array (via the same `is_path_required` built for `defined()`
/// in the schema-resolution pass) and defaults an absent optional field to
/// its type's `Default` (`0`/`0.0` for numbers, `""` for strings) — ECEL's
/// type system has no distinct "nullable number" (§6.7), so this is the
/// same "absent numeric input contributes nothing" convention the
/// reliability crate already uses elsewhere in this codebase, not a new
/// invention. An unresolvable path (registry lookup failure) is treated as
/// required/non-optional, preserving the pre-existing direct-access
/// behavior rather than guessing.
fn render_payload_scalar(ctx: &CodegenCtx, path: &ecel::PathExpr) -> String {
    let base = render_payload_path(path);
    let is_optional = ctx
        .registry
        .is_path_required(ctx.doc, ctx.message_ref, &path.segments)
        .ok()
        .flatten()
        == Some(false);
    if is_optional {
        format!("{}.clone().unwrap_or_default()", base)
    } else {
        base
    }
}

/// Renders any `value-expr` as an `f64`-typed Rust expression. Every
/// arithmetic leaf goes through this (spec §6.5's `+`/`-`/`*`/`/`) so an
/// `i64` payload field (JSON `integer`) and an `f64` one (JSON `number`)
/// combine without a Rust type mismatch — ECEL's type system unifies both
/// as one `Number` runtime type (§6.7); Rust needs one concrete type
/// picked to actually add them, so arithmetic always computes in `f64`.
/// This only casts *inside* an arithmetic sub-tree — a bare `path-expr`/
/// `number` operand with no arithmetic operator (`render_value_expr`,
/// called everywhere else) is untouched, so ordinary, non-arithmetic
/// comparison codegen keeps generating exactly what it always has.
fn as_f64_expr(ctx: &CodegenCtx, expr: &ecel::ValueExpr) -> String {
    use ecel::ValueExpr as V;
    match expr {
        V::Number(n) => format!("{}f64", n),
        V::Path(path) if matches!(path_root(path), PathRoot::Payload) => {
            format!("({} as f64)", render_payload_scalar(ctx, path))
        }
        V::Path(_) => render_value_expr(ctx, expr, ScalarHint::Number),
        V::Call(_, _) => render_value_expr(ctx, expr, ScalarHint::Number),
        V::Add(a, b) => format!("(({}) + ({}))", as_f64_expr(ctx, a), as_f64_expr(ctx, b)),
        V::Sub(a, b) => format!("(({}) - ({}))", as_f64_expr(ctx, a), as_f64_expr(ctx, b)),
        V::Mul(a, b) => format!("(({}) * ({}))", as_f64_expr(ctx, a), as_f64_expr(ctx, b)),
        V::Div(a, b) => format!("(({}) / ({}))", as_f64_expr(ctx, a), as_f64_expr(ctx, b)),
    }
}

/// `length()`'s result depends on whether its argument is a `string`
/// (UTF-8 codepoint count, spec §6.5.1 — not Rust `.len()`'s byte count) or
/// an `array` (element count). Resolving that needs a schema lookup — the
/// one place in this module that still consults `ctx.registry` — for a
/// non-payload or unresolvable argument, default to the string form.
fn render_length_call(ctx: &CodegenCtx, arg: &ecel::ValueExpr, arg_code: &str) -> String {
    let is_array = match arg {
        ecel::ValueExpr::Path(path) if matches!(path_root(path), PathRoot::Payload) => ctx
            .registry
            .get_schema_for_message_ref(ctx.doc, ctx.message_ref, &path.segments)
            .ok()
            .flatten()
            .and_then(|schema| schema.get("type").and_then(|t| t.as_str().map(String::from)))
            .as_deref()
            == Some("array"),
        _ => false,
    };
    if is_array {
        format!("({}.len() as f64)", arg_code)
    } else {
        format!("({}.chars().count() as f64)", arg_code)
    }
}

fn literal_to_val_str(lit: &ecel::Literal) -> String {
    match lit {
        ecel::Literal::Number(n) => n.to_string(),
        ecel::Literal::String(s) => format!("\"{}\"", s),
        ecel::Literal::Bool(b) => b.to_string(),
        ecel::Literal::Null => "None".to_string(),
        ecel::Literal::Array(items) => {
            let inner: Vec<String> = items.iter().map(literal_to_val_str).collect();
            format!("vec![{}]", inner.join(", "))
        }
    }
}

/// Emit the comparison operator. `in` and `matches` are not Rust syntax, so they
/// are emitted as calls to `etdl_core` helper functions. The helpers take the
/// operands on the right (path value and literal) so the generated expression is
/// `etdl_core::condition::contains(<path>, <literal>)` for `in` and
/// `etdl_core::condition::matches(<path>, "<re2>")` for `matches`.
fn comparator_str(op: &ecel::Comparator) -> &str {
    match op {
        ecel::Comparator::Eq => "==",
        ecel::Comparator::Neq => "!=",
        ecel::Comparator::Gte => ">=",
        ecel::Comparator::Lte => "<=",
        ecel::Comparator::Gt => ">",
        ecel::Comparator::Lt => "<",
        ecel::Comparator::In => "in",
        ecel::Comparator::Matches => "matches",
    }
}

fn ref_to_rust_type(msg_ref: &etdl_parser::ast::MessageRef) -> String {
    let pointer = match msg_ref {
        etdl_parser::ast::MessageRef::External(r) => &r.pointer,
        etdl_parser::ast::MessageRef::Internal(r) => &r.pointer,
    };
    extract_last_segment_str(pointer)
}

/// The channel-name string a `publisher.publish(...)` call uses: for an
/// External Reference, the last JSON Pointer segment (matching the
/// pre-existing convention for message types); for a bare channel-name
/// string (Section 5.3.5, only valid when the document has no
/// `asyncapi_imports`), the literal name itself, unmodified — it is a
/// runtime channel address, not a Rust identifier.
fn channel_ref_name(channel_ref: &etdl_parser::ast::ChannelRef) -> String {
    match channel_ref {
        etdl_parser::ast::ChannelRef::External(ext_ref) => {
            extract_last_segment_str(&ext_ref.pointer)
        }
        etdl_parser::ast::ChannelRef::Bare(name) => name.clone(),
    }
}

fn extract_last_segment_str(pointer: &str) -> String {
    let parts: Vec<&str> = pointer.split('/').collect();
    let last = parts.last().unwrap_or(&"Unknown");
    to_pascal_case(last)
}

/// Collects the `<id>`s of every Internal Message Reference
/// (`#/components/messages/<id>`) used anywhere in `doc`, so their inline
/// Message Schema Objects can have matching Rust types generated (there is
/// no external, AsyncAPI-toolchain-generated module to import them from,
/// unlike an External Reference's `{alias}::messages::*`).
fn collect_internal_message_ids(doc: &EtlDocument) -> std::collections::BTreeSet<String> {
    use etdl_parser::ast::MessageRef;

    fn note(msg_ref: &MessageRef, ids: &mut std::collections::BTreeSet<String>) {
        if let MessageRef::Internal(int_ref) = msg_ref {
            if let Some(id) = int_ref.pointer.strip_prefix("#/components/messages/") {
                ids.insert(id.to_string());
            }
        }
    }

    let mut ids = std::collections::BTreeSet::new();

    for tree in doc.event_trees.values() {
        note(&tree.initiating_event.message, &mut ids);

        for node in tree.nodes.values() {
            match node {
                Node::Operation(op) => {
                    if let Some(ref m) = op.emits {
                        note(m, &mut ids);
                    }
                }
                Node::Consequence(cons) => {
                    if let Some(ref m) = cons.message {
                        note(m, &mut ids);
                    }
                }
                _ => {}
            }
        }
    }

    if let Some(ref fault_trees) = doc.fault_trees {
        for ft in fault_trees.values() {
            if let Some(ref m) = ft.top_event.message {
                note(m, &mut ids);
            }
            for be in ft.basic_events.values() {
                if let Some(ref m) = be.message {
                    note(m, &mut ids);
                }
            }
        }
    }

    ids
}

/// Generates a Rust struct (and any nested structs its object-typed
/// properties need) for every inline `components.messages.<id>` entry
/// actually referenced via an Internal Message Reference somewhere in
/// `doc`. The top-level struct for `<id>` is named `to_pascal_case(<id>)`,
/// matching `ref_to_rust_type`'s naming for the same reference.
fn generate_inline_message_types(doc: &EtlDocument) -> String {
    let ids = collect_internal_message_ids(doc);
    if ids.is_empty() {
        return String::new();
    }

    let messages = doc.components.as_ref().and_then(|c| c.messages.as_ref());

    let mut output = String::new();
    for id in &ids {
        let Some(message) = messages.and_then(|m| m.get(id)) else {
            continue;
        };
        generate_message_envelope(id, message, &mut output);
    }
    output
}

/// Emits the message envelope type for one inline `components.messages.<id>`
/// entry: a `pub struct <Name> { payload: <Name>Payload, headers: Option<...> }`,
/// matching the `{payload, headers}` shape an External Reference's
/// AsyncAPI-toolchain-generated type already has (see
/// `etdl-compiler/tests/gencheck/src/messages.rs`'s stubs) — this is what
/// makes `message.payload.<field>` path codegen (`build_path_expression`)
/// work identically regardless of which kind of Message Reference produced
/// `message`.
fn generate_message_envelope(id: &str, message: &etdl_parser::ast::Message, output: &mut String) {
    let type_name = to_pascal_case(id);
    let payload_type_name = format!("{}Payload", type_name);
    let payload: serde_json::Value =
        serde_json::to_value(&message.payload).unwrap_or(serde_json::Value::Null);

    let mut nested = String::new();
    let payload_rust_type = schema_to_rust_type(&payload_type_name, &payload, &mut nested);
    output.push_str(&nested);

    output.push_str("#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]\n");
    output.push_str(&format!("pub struct {} {{\n", type_name));
    output.push_str(&format!("    pub payload: {},\n", payload_rust_type));
    output.push_str("    #[serde(default)]\n");
    output.push_str("    pub headers: Option<serde_json::Value>,\n");
    output.push_str("}\n\n");
}

/// Emits a `pub struct <name> { ... }` for an object-typed JSON Schema
/// (`schema.properties`), deriving `Serialize`/`Deserialize`. A property
/// listed in `schema.required` becomes a non-optional field; any other
/// property becomes `Option<T>` with `#[serde(default)]`. A schema with no
/// `properties` (or a non-object schema) falls back to a
/// `serde_json::Value`-wrapping newtype, so the type always exists even
/// when the schema is too loose to model precisely.
fn generate_struct_from_schema(name: &str, schema: &serde_json::Value, output: &mut String) {
    let Some(properties) = schema.get("properties").and_then(|p| p.as_object()) else {
        output.push_str(&format!(
            "#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]\npub struct {}(pub serde_json::Value);\n\n",
            name
        ));
        return;
    };

    let required: std::collections::BTreeSet<&str> = schema
        .get("required")
        .and_then(|r| r.as_array())
        .map(|arr| arr.iter().filter_map(|v| v.as_str()).collect())
        .unwrap_or_default();

    let mut nested = String::new();
    let mut fields = String::new();

    for (field_name, field_schema) in properties {
        let snake = to_snake_case(field_name);
        let nested_type_name = format!("{}{}", name, to_pascal_case(field_name));
        let rust_type = schema_to_rust_type(&nested_type_name, field_schema, &mut nested);
        let is_required = required.contains(field_name.as_str());

        if snake != *field_name {
            fields.push_str(&format!("    #[serde(rename = \"{}\")]\n", field_name));
        }

        if is_required {
            fields.push_str(&format!("    pub {}: {},\n", snake, rust_type));
        } else {
            fields.push_str("    #[serde(default)]\n");
            fields.push_str(&format!("    pub {}: Option<{}>,\n", snake, rust_type));
        }
    }

    output.push_str(&nested);
    output.push_str("#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]\n");
    output.push_str(&format!("pub struct {} {{\n", name));
    output.push_str(&fields);
    output.push_str("}\n\n");
}

/// Maps a JSON Schema fragment to a Rust type, generating a nested struct
/// (appended to `nested`) for an object-typed property under
/// `candidate_name`. Anything not representable as a concrete Rust type
/// (missing/unrecognized `type`) falls back to `serde_json::Value`.
fn schema_to_rust_type(candidate_name: &str, schema: &serde_json::Value, nested: &mut String) -> String {
    match schema.get("type").and_then(|t| t.as_str()) {
        Some("string") => "String".to_string(),
        Some("integer") => "i64".to_string(),
        Some("number") => "f64".to_string(),
        Some("boolean") => "bool".to_string(),
        Some("array") => {
            let item_type = match schema.get("items") {
                Some(items_schema) => {
                    schema_to_rust_type(&format!("{}Item", candidate_name), items_schema, nested)
                }
                None => "serde_json::Value".to_string(),
            };
            format!("Vec<{}>", item_type)
        }
        Some("object") => {
            if schema.get("properties").is_some() {
                generate_struct_from_schema(candidate_name, schema, nested);
                candidate_name.to_string()
            } else {
                "serde_json::Value".to_string()
            }
        }
        _ => "serde_json::Value".to_string(),
    }
}

fn get_branch_prob(
    branch: &etdl_parser::ast::Branch,
    _node_id: &str,
    fault_tree_probs: &BTreeMap<String, f64>,
) -> Option<f64> {
    if let Some(ref ps) = branch.probability_source {
        let ft_id = extract_ft_id(&ps.pointer);
        return fault_tree_probs.get(&ft_id).copied();
    }
    branch.effective_probability()
}

fn extract_ft_id(pointer: &str) -> String {
    pointer
        .trim_start_matches("#/faultTrees/")
        .trim_end_matches("/topEvent")
        .to_string()
}

fn to_snake_case(s: &str) -> String {
    let mut result = String::new();
    for (i, c) in s.chars().enumerate() {
        if c.is_uppercase() {
            if i > 0 {
                result.push('_');
            }
            result.push(c.to_lowercase().next().unwrap());
        } else {
            result.push(c);
        }
    }
    result
}

fn to_upper_snake(s: &str) -> String {
    let snake = to_snake_case(s);
    snake.to_uppercase()
}

fn to_pascal_case(s: &str) -> String {
    let mut result = String::new();
    let mut capitalize = true;
    for c in s.chars() {
        if c == '_' || c == '-' || c == ' ' {
            capitalize = true;
        } else if capitalize {
            result.extend(c.to_uppercase());
            capitalize = false;
        } else {
            result.push(c);
        }
    }
    result
}

#[cfg(test)]
mod tests {
    use super::*;
    use etdl_parser::ast::{EtlDocument, InternalRef};

    fn parse(yaml: &str) -> EtlDocument {
        serde_yaml::from_str(yaml).expect("valid yaml")
    }

    fn multi_ft_doc() -> EtlDocument {
        parse(
            r##"
etdl: "1.0.0"
info:
  title: "MultiFT"
  version: "1.0.0"
  domain: "D"
asyncapi_imports: {}
eventTrees:
  T:
    initiatingEvent:
      id: I
      message: "a#/m"
      next: O
    nodes:
      O:
        type: operation
        action: execute
        handler: "h"
        next: C
        onFailure: FC
        onFailureProbabilitySource: "#/faultTrees/B/topEvent"
      C:
        type: consequence
        operation: terminate
      FC:
        type: consequence
        operation: terminate
faultTrees:
  A:
    topEvent:
      id: A1
      description: "a"
      rootCause: AE
    basicEvents:
      AE:
        description: "ae"
        probability: 0.9
  B:
    topEvent:
      id: B1
      description: "b"
      rootCause: BE
    basicEvents:
      BE:
        description: "be"
        probability: 0.01
"##,
        )
    }

    #[test]
    fn find_fault_tree_prob_selects_by_pointer() {
        let doc = multi_ft_doc();
        let probs = crate::fault_tree::resolve_fault_trees(&doc, &mut Vec::new());
        assert_eq!(probs["A"], 0.9);
        assert_eq!(probs["B"], 0.01);

        // The pointer selects tree B, not the first map entry (A).
        let ps = InternalRef {
            pointer: "#/faultTrees/B/topEvent".to_string(),
        };
        let (id, prob) = find_fault_tree_prob(&ps, &probs).expect("resolves");
        assert_eq!(id, "B");
        assert!((prob - 0.01).abs() < 1e-9);
    }

    #[test]
    fn generated_constants_use_correct_tree() {
        let doc = multi_ft_doc();
        let probs = crate::fault_tree::resolve_fault_trees(&doc, &mut Vec::new());
        let constants = generate_fault_tree_constants(&doc, &probs);
        assert!(constants.contains("faultTrees.B.topEvent"));
        assert!(constants.contains("= 0.010000"));
        assert!(!constants.contains("faultTrees.A.topEvent"));
    }

    /// A minimal, schema-free fixture for condition-codegen tests: none of
    /// them exercise `length()` on a payload path (the one place codegen
    /// still consults `ctx.registry`), so an empty registry and an
    /// unresolvable message reference are fine — every other rendering
    /// path in this module is purely syntactic.
    fn test_fixture() -> (EtlDocument, BTreeMap<String, f64>, AsyncApiRegistry, etdl_parser::ast::MessageRef)
    {
        let doc = multi_ft_doc();
        let probs = BTreeMap::new();
        let registry = AsyncApiRegistry::new();
        let message_ref = etdl_parser::ast::MessageRef::Internal(etdl_parser::ast::InternalRef {
            pointer: "#/components/messages/Test".to_string(),
        });
        (doc, probs, registry, message_ref)
    }

    fn render(condition_src: &str) -> String {
        let cond = etdl_parser::ecel::parse_condition(condition_src).unwrap();
        let (doc, probs, registry, message_ref) = test_fixture();
        let ctx = CodegenCtx {
            doc: &doc,
            fault_tree_probs: &probs,
            registry: &registry,
            message_ref: &message_ref,
        };
        condition_to_rust_code(&ctx, &cond)
    }

    #[test]
    fn in_operator_lowers_to_contains() {
        let code = render("message.payload.status in [\"PAID\", \"AUTHORIZED\"]");
        assert!(
            code.contains("etdl_core::condition::contains"),
            "got: {}",
            code
        );
        assert!(code.contains("\"PAID\""));
    }

    #[test]
    fn matches_operator_lowers_to_regex() {
        let code = render("message.payload.reference matches \"^ORD-[0-9]{8}$\"");
        assert!(
            code.contains("etdl_core::condition::matches"),
            "got: {}",
            code
        );
    }

    #[test]
    fn comparison_emits_valid_rust() {
        let code = render("message.payload.amount >= 10000");
        assert_eq!(code, "message.payload.amount >= 10000");
    }

    // --- new grammar: boolean combinators ---

    #[test]
    fn and_lowers_to_rust_ampersand() {
        let code = render("message.payload.a > 0 && message.payload.b > 0");
        assert_eq!(
            code,
            "(message.payload.a > 0) && (message.payload.b > 0)"
        );
    }

    #[test]
    fn or_lowers_to_rust_pipe() {
        let code = render("message.payload.a > 0 || message.payload.b > 0");
        assert_eq!(
            code,
            "(message.payload.a > 0) || (message.payload.b > 0)"
        );
    }

    #[test]
    fn not_lowers_to_rust_bang() {
        let code = render("!(message.payload.ok == true)");
        assert_eq!(code, "!(message.payload.ok == true)");
    }

    // --- new grammar: arithmetic ---

    #[test]
    fn arithmetic_casts_to_f64() {
        let code = render("message.payload.subtotal - message.payload.discount > 0");
        assert_eq!(
            code,
            "(((message.payload.subtotal as f64)) - ((message.payload.discount as f64))) > 0f64"
        );
    }

    // --- new grammar: built-in functions ---

    #[test]
    fn abs_lowers_to_method_call() {
        let code = render("abs(message.payload.delta) < 1");
        assert_eq!(code, "(message.payload.delta).abs() < 1f64");
    }

    #[test]
    fn lower_lowers_to_ascii_method() {
        let code = render("lower(message.payload.status) == \"paid\"");
        assert_eq!(
            code,
            "(message.payload.status).to_ascii_lowercase() == \"paid\""
        );
    }

    // --- new grammar: defined() ---

    #[test]
    fn defined_on_payload_round_trips_through_json() {
        let code = render("defined(message.payload.discountCode)");
        assert!(code.contains("serde_json::to_value(&message.payload)"));
        assert!(code.contains("\"discountCode\""));
        assert!(code.contains("is_some_and"));
    }

    #[test]
    fn defined_on_headers_checks_the_get_chain() {
        let code = render("defined(message.headers.traceId)");
        assert_eq!(
            code,
            "(message.headers.as_ref().and_then(|v| v.get(\"traceId\").cloned())).is_some()"
        );
    }

    // --- the actual bug fix: message.headers.* used to emit direct field
    // access (`message.headers.trace_id`), which cannot compile since
    // `headers` is `Option<serde_json::Value>`, not a struct. ---

    #[test]
    fn headers_comparison_does_not_emit_direct_field_access() {
        let code = render("message.headers.traceId != null");
        assert!(
            !code.contains("message.headers.trace_id"),
            "regressed to direct-field-access codegen: {}",
            code
        );
        assert!(code.contains("message.headers.as_ref()"), "got: {}", code);
    }

    #[test]
    fn headers_string_comparison_coerces_via_as_str() {
        let code = render("message.headers.apiVersion == \"2\"");
        assert!(code.contains(".as_str()"), "got: {}", code);
        assert!(code.contains("\"apiVersion\""), "got: {}", code);
    }

    #[test]
    fn headers_null_check_treats_absent_as_null() {
        let code = render("message.headers.traceId != null");
        assert!(code.contains("is_null()"), "got: {}", code);
        assert!(code.starts_with("!("), "expected negated null-test, got: {}", code);
    }

    // --- explicit quantifiers reuse the wildcard `.iter()` machinery ---

    #[test]
    fn explicit_any_lowers_to_iter_any() {
        let code = render("any(message.payload.items, message.payload.items[*].qty > 0)");
        assert!(code.contains(".iter().any(|item|"), "got: {}", code);
    }

    #[test]
    fn explicit_all_lowers_to_iter_all() {
        let code = render("all(message.payload.items, message.payload.items[*].qty > 0)");
        assert!(code.contains(".iter().all(|item|"), "got: {}", code);
    }
}