onetaskgraph_plugin_api/

work.rs

//! The work items every source is normalised into.

use chrono::{DateTime, Utc};
use schemars::{JsonSchema, Schema, SchemaGenerator, json_schema};
use serde::{Deserialize, Serialize};
use serde_json::Value;
use std::collections::BTreeMap;

use crate::{NativeId, SourceName};

/// One unit of work as a source reports it.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
pub struct Task {
    /// The source's own opaque identifier.
    pub id: NativeId,
    /// The short handle the backend shows people, beside [`id`](Self::id) and never
    /// instead of it — a Linear issue's `ENG-123`, a GitHub issue's `1043`.
    ///
    /// **It is human-facing and it may change.** A Linear issue moved between teams gets a
    /// new identifier and a GitHub issue transferred between repositories gets a new
    /// number, so nothing stores this in place of [`id`](Self::id) and nothing matches on
    /// it: `id` is what everything stores and matches on, and this is what a person says
    /// out loud.
    ///
    /// Absent by default, so a source that predates this field — and every source with no
    /// separate handle of its own — reads as `None`, which means *this backend has no
    /// short handle for this task* rather than *the handle is the id*. A source never
    /// copies [`id`](Self::id) here.
    ///
    /// **Read-only.** A source derives it on a read and never stores one it is handed: a
    /// task arriving on an [`ItemWrite`](crate::ItemWrite) may still hold its source's key,
    /// and a destination ignores it.
    // llmlint: ignore[invalid_states_unrepresentable] The answer `Task::url` and `Project::url` below already record: this crate's field types are the contract itself, and the contract approving this field states its shape as `Option<String>`. A backend's handle is also the one value this product never parses, matches on or resolves by — `id` does all three — so the confusion a newtype prevents is confusion no code here can act on.
    #[serde(default)]
    pub key: Option<String>,
    /// The one-line summary a user recognises the task by.
    pub title: String,
    /// The long-form body, when the source has one.
    pub content: Option<String>,
    /// The source's status, normalised and preserved.
    pub status: Status,
    /// The task's priority; `none` means none is set, and a source that cannot hold one
    /// reports `none`.
    ///
    /// Defaulted when a document omits it, so a task written before this field existed —
    /// and every task of a plugin that predates it — reads as [`Priority::None`]. Always
    /// written, so a reader never has to tell an absent member from a `none` one. Whether a
    /// source can hold one at all is [`Capabilities::priority`](crate::Capabilities::priority),
    /// and the engine never hands a source declaring it cannot a priority other than `none`.
    #[serde(default)]
    pub priority: Priority,
    /// Inline rather than by id: a source returning a task already knows them.
    pub labels: Vec<Label>,
    /// `None` is a first-class case — an orphan task — not an edge case.
    pub project: Option<NativeId>,
    /// Where a human can open this task.
    // llmlint: ignore[invalid_states_unrepresentable] SECOND PERMITTED REASON — this restates at a new site the justification already recorded at `Capabilities.max_page_size` (capability.rs) and `PageRequest.limit` (query.rs), and in AGENTS.md's "The plugin contract": this crate's field types ARE the approved contract, six undispatched nodes compile against `Option<String>` here, and only the contract's owner may narrow one. No code change is available that clears this without editing that frozen surface.
    // llmlint: ignore[boundary_inputs_validated] parsing this into a URL type would narrow the same frozen surface, and would add a URL dependency to the crate AGENTS.md says to keep still ("Keep the api crate still" — every change here re-tests every plugin). A plugin that returns a string this interface cannot represent is what `SourceError::Malformed` is for. Contract owner's call; recorded in AGENTS.md, "The plugin contract".
    pub url: Option<String>,
    /// Where this task is, when the source says (see [`Location`]).
    ///
    /// Absent by default, so a source that predates this field — and every source that
    /// simply does not say — reads as `None`, which means *the source did not say where
    /// this is* rather than *this is nowhere*. It neither replaces nor derives from
    /// [`url`](Self::url), which goes on meaning exactly what it always did.
    #[serde(default)]
    pub location: Option<Location>,
    /// When the source says the task was created.
    pub created_at: Option<DateTime<Utc>>,
    /// When the source says the task last changed.
    pub updated_at: Option<DateTime<Utc>>,
    /// Caller-defined attributes, preserving their JSON types.
    ///
    /// Keys are free-form, with two reserved prefixes: `onetaskgraph.` belongs to this
    /// product — [`Repository::METADATA_KEY`] and [`DependencyEdge::RECORDED_KEY`] are
    /// the two every source honours, and [`ItemKind::METADATA_KEY`] is one plugin's —
    /// and `onepipeline.` belongs to that consumer. Every other key is the caller's, and
    /// a source returns it exactly as it holds it.
    #[serde(default)]
    pub metadata: BTreeMap<String, Value>,
    /// Normalized repository origins this task concerns, in source order and without
    /// repeats.
    #[serde(default, deserialize_with = "unique_repositories")]
    pub repositories: Vec<Repository>,
    /// The tasks this one delivers: finishing this task finishes them.
    ///
    /// Each entry is a [`TaskRef`] — `<source>:<native>` names a task of any source, and a
    /// bare native id names a task of the source holding this one — with no repeats and
    /// never this task itself. Empty by default, and left out of the wire when empty, so a
    /// reader written before the field existed reads exactly what it read before.
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    #[schemars(!skip_serializing_if)]
    pub delivers: Vec<TaskRef>,
    /// Every task that delivers this one, by qualified id: the reverse of [`Self::delivers`].
    ///
    /// **Owned by the store, not by a source record and not by a copy.** The engine keeps it
    /// in step whenever it writes a task's `delivers`, through
    /// [`TaskSource::set_delivered_by`](crate::TaskSource::set_delivered_by); a source holds
    /// and reports it, and a copy keeps the destination's own rather than taking the
    /// source's. Empty by default and left out of the wire when empty, as `delivers` is.
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    #[schemars(!skip_serializing_if)]
    pub delivered_by: Vec<TaskRef>,
    /// The task's change token: an opaque value its source gives so a reader can tell whether
    /// the task changed without reading it whole.
    ///
    /// **Two equal versions of one task from one source mean nothing in it has changed** — its
    /// title, body, status, priority, labels, project fields, metadata, edges and comments,
    /// comments added, edited and deleted included. A source that cannot promise all of that
    /// for a task leaves this absent, which means *always read it*. What each plugin keys its
    /// token on, and which change kinds it covers, is stated per plugin in
    /// `docs/plugin-protocol.md` §4.13d.
    ///
    /// Opaque to every caller: nothing compares one but for equality, and the one reader that
    /// looks inside is the source that gave it, through
    /// [`TaskSource::order_versions`](crate::TaskSource::order_versions). Absent by default and left out of the wire when absent, so a source written
    /// before it existed is read as giving none.
    ///
    /// **Read-only.** A source derives it on a read and never stores one it is handed: a task
    /// arriving on an [`ItemWrite`](crate::ItemWrite) may still hold its source's token, and a
    /// destination ignores it.
    // llmlint: ignore[invalid_states_unrepresentable] The contract this lands states the token as an opaque string so the next node's cache and both SDKs carry it unread; a typed token would make every plugin's format part of this crate, which AGENTS.md asks to keep still. The one reader that parses it, its own source's `TaskSource::order_versions`, answers `None` for any value it cannot parse.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub version: Option<String>,
    /// Who may read this task, as it was declared (see [`Classification`]).
    ///
    /// Defaulted and left out of the wire while `public`, so a task written before this
    /// field existed reads as public and a reader written before it reads what it always
    /// read. It is the *declared* classification: the engine tightens it by the task's own
    /// repositories — any private or unknown one makes the task private — before it decides
    /// where the task may be written, and nothing written here can loosen that. The project
    /// a task is filed under never tightens it: a task's visibility is its own.
    #[serde(default, skip_serializing_if = "Classification::is_public")]
    #[schemars(!skip_serializing_if)]
    pub classification: Classification,
    /// Every person the task is assigned to, as its source names a person — a GitHub login, a
    /// Linear display name, the string as given in a folder or in memory — in the order the
    /// source holds them; empty means unassigned.
    ///
    /// **Present only for a source that opted in** with `config.assignees: true`
    /// ([`Capabilities::assignees`](crate::Capabilities::assignees) `native`): every other
    /// source leaves it absent, and it is left out of the wire when absent, so a task of a
    /// source that has not opted in reads, and is written, exactly as it was before the field
    /// existed. On a write, absent leaves the item's assignees as they are, and present
    /// replaces them with exactly the people it names — the engine never hands a source more
    /// than one.
    // llmlint: ignore[invalid_states_unrepresentable] A read holds every person the destination holds — a GitHub issue may carry several — so the read field is a list; the one-person write is the engine's rule, refused before any source is asked (`EngineError::SeveralAssignees`), and keeping one field for both is what lets a source compare a write's answer with what it asked for without a second shape. Absent is a distinct state from empty: a source that never opted in, versus an unassigned item of one that did.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub assignees: Option<Vec<String>>,
}

/// Whether two lists of assignees name the same people, whatever their order.
#[must_use]
pub(crate) fn same_assignees(left: &[String], right: &[String]) -> bool {
    let left: std::collections::BTreeSet<&str> = left.iter().map(String::as_str).collect();
    let right: std::collections::BTreeSet<&str> = right.iter().map(String::as_str).collect();
    left == right
}

/// A grouping of tasks, shaped like a [`Task`] without a parent of its own.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
pub struct Project {
    /// The source's own opaque identifier.
    pub id: NativeId,
    /// The one-line summary a user recognises the project by.
    pub title: String,
    /// The long-form body, when the source has one.
    pub content: Option<String>,
    /// The source's status, normalised and preserved.
    pub status: Status,
    /// Inline rather than by id, for the same reason as on [`Task`].
    pub labels: Vec<Label>,
    /// Where a human can open this project.
    // llmlint: ignore[invalid_states_unrepresentable] SECOND PERMITTED REASON — this restates at a new site the justification already recorded at `Capabilities.max_page_size` (capability.rs) and `PageRequest.limit` (query.rs), and in AGENTS.md's "The plugin contract": this crate's field types ARE the approved contract, six undispatched nodes compile against `Option<String>` here, and only the contract's owner may narrow one. No code change is available that clears this without editing that frozen surface.
    // llmlint: ignore[boundary_inputs_validated] parsing this into a URL type would narrow the same frozen surface, and would add a URL dependency to the crate AGENTS.md says to keep still ("Keep the api crate still" — every change here re-tests every plugin). A plugin that returns a string this interface cannot represent is what `SourceError::Malformed` is for. Contract owner's call; recorded in AGENTS.md, "The plugin contract".
    pub url: Option<String>,
    /// Where this project is, on exactly the terms of [`Task::location`].
    #[serde(default)]
    pub location: Option<Location>,
    /// When the source says the project was created.
    pub created_at: Option<DateTime<Utc>>,
    /// When the source says the project last changed.
    pub updated_at: Option<DateTime<Utc>>,
    /// Caller-defined attributes, preserving their JSON types, on the same terms as
    /// [`Task::metadata`].
    #[serde(default)]
    pub metadata: BTreeMap<String, Value>,
    /// Normalized repository origins this project concerns, in source order and without
    /// repeats.
    #[serde(default, deserialize_with = "unique_repositories")]
    pub repositories: Vec<Repository>,
    /// The project's change token, on exactly the terms of [`Task::version`]: two equal
    /// versions of one project from one source mean nothing its source's
    /// [`ProjectVersionCoverage`](crate::ProjectVersionCoverage) covers has changed, and a
    /// source that cannot promise that leaves it absent, which means *always read it*.
    /// Absent by default and left out of the wire when absent.
    // llmlint: ignore[invalid_states_unrepresentable] As `Task::version`: the token is opaque to every caller, so the cache and both SDKs carry it unread, and the one reader that parses it — its own source's `TaskSource::order_versions` — answers `None` for any value it cannot parse.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub version: Option<String>,
    /// Who may read this project, as it was declared, on the terms of
    /// [`Task::classification`]. A project holding a private task or document is private
    /// however this reads, and the engine records it so when it writes the project.
    #[serde(default, skip_serializing_if = "Classification::is_public")]
    #[schemars(!skip_serializing_if)]
    pub classification: Classification,
}

/// One piece of information that lives in a project and is not work.
///
/// A document carries **no status** and **no dependencies**, and both omissions are the
/// contract rather than an oversight: a document is not work, so it has no place in a
/// status filter and no place in a dependency graph. [`ItemKind`] therefore gains no
/// document variant — that enum names what a dependency endpoint points at, and nothing
/// may point at a document.
///
/// A source says whether it has documents at all through
/// [`Capabilities::documents`](crate::Capabilities::documents), and one that says it has
/// none is never asked for one.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
pub struct Document {
    /// The source's own opaque identifier.
    pub id: NativeId,
    /// The one-line summary a person recognises it by.
    pub title: String,
    /// The long-form body, when the source has one.
    pub content: Option<String>,
    /// The project it lives in; `None` is an orphan document, exactly as it is on a
    /// [`Task`].
    pub project: Option<NativeId>,
    /// Inline, on the same terms as a [`Task`]'s.
    pub labels: Vec<Label>,
    /// Where a person can open it, on the same terms as a [`Task`]'s.
    // llmlint: ignore[invalid_states_unrepresentable] SECOND PERMITTED REASON — this restates at a new site the justification already recorded at `Task::url` and `Project::url` in this module, at `Capabilities.max_page_size` (capability.rs) and `PageRequest.limit` (query.rs), and in AGENTS.md's "The plugin contract": this crate's field types ARE the approved contract, this field is `Option<String>` because a task's and a project's are, and only the contract's owner may narrow one. Narrowing it here alone would leave the three entities describing the same thing in two different types.
    // llmlint: ignore[boundary_inputs_validated] parsing this into a URL type would narrow the same frozen surface, and would add a URL dependency to the crate AGENTS.md says to keep still ("Keep the api crate still" — every change here re-tests every plugin). A plugin that returns a string this interface cannot represent is what `SourceError::Malformed` is for. Contract owner's call; recorded in AGENTS.md, "The plugin contract".
    pub url: Option<String>,
    /// Where it is, when the source says (see [`Location`]).
    #[serde(default)]
    pub location: Option<Location>,
    /// When the source says it was created.
    pub created_at: Option<DateTime<Utc>>,
    /// When the source says it last changed.
    pub updated_at: Option<DateTime<Utc>>,
    /// Caller-defined attributes, preserving their JSON types, with the same reserved
    /// prefixes [`Task::metadata`] carries.
    #[serde(default)]
    pub metadata: BTreeMap<String, Value>,
    /// Normalized repository origins this document concerns, in source order and without
    /// repeats, as a [`Task`]'s.
    #[serde(default, deserialize_with = "unique_repositories")]
    pub repositories: Vec<Repository>,
    /// The document's change token, on exactly the terms of [`Task::version`] and of what its
    /// source's [`DocumentVersionCoverage`](crate::DocumentVersionCoverage) covers. Absent by
    /// default and left out of the wire when absent.
    // llmlint: ignore[invalid_states_unrepresentable] As `Task::version`: the token is opaque to every caller, so the cache and both SDKs carry it unread, and the one reader that parses it — its own source's `TaskSource::order_versions` — answers `None` for any value it cannot parse.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub version: Option<String>,
    /// Who may read this document, as it was declared, on the terms of
    /// [`Task::classification`] — except that a document filed under a private project is
    /// private, however this reads.
    #[serde(default, skip_serializing_if = "Classification::is_public")]
    #[schemars(!skip_serializing_if)]
    pub classification: Classification,
}

/// Who may read an item: anybody, or only those who may read where it is kept.
///
/// Two values, ordered so the stricter is the greater: [`strictest`](Self::strictest) of
/// any two is the one an item they both describe carries. Nothing combines them any other
/// way, which is what makes an explicit `public` unable to loosen a private repository, or
/// a document's private project — a classification only ever tightens. A task's project
/// never tightens the task.
///
/// It is recorded on the item and travels with it. A source whose backend has no notion of
/// its own records it under [`Self::METADATA_KEY`], exactly as it records
/// [`Repository::METADATA_KEY`], and only while it is `private`: an item without it is
/// public, so every item written before this existed reads as it did.
#[derive(
    Debug,
    Clone,
    Copy,
    Default,
    PartialEq,
    Eq,
    PartialOrd,
    Ord,
    Hash,
    Serialize,
    Deserialize,
    JsonSchema,
)]
#[serde(rename_all = "kebab-case")]
pub enum Classification {
    /// Anybody who may read the destination may read it.
    #[default]
    Public,
    /// It may be written only to a destination verified private, and nothing of it may
    /// reach a public one.
    Private,
}

impl Classification {
    /// The reserved metadata key a source records a private classification under when its
    /// backend has no notion of its own.
    ///
    /// Spelled once, here, for the reason [`Repository::METADATA_KEY`] is.
    pub const METADATA_KEY: &'static str = "onetaskgraph.classification";

    /// Whether this is [`Public`](Self::Public) — the value left out of the wire.
    #[must_use]
    // serde's `skip_serializing_if` calls its predicate with a reference to the field, so this
    // takes `&self` although the type is `Copy`.
    #[allow(clippy::trivially_copy_pass_by_ref)]
    pub fn is_public(&self) -> bool {
        *self == Self::Public
    }

    /// The stricter of the two.
    #[must_use]
    pub fn strictest(self, other: Self) -> Self {
        self.max(other)
    }

    /// The value as the wire spells it: `public` or `private`.
    #[must_use]
    pub const fn as_str(self) -> &'static str {
        match self {
            Self::Public => "public",
            Self::Private => "private",
        }
    }

    /// The classification a source records under [`Self::METADATA_KEY`], or `public` when
    /// it records none.
    ///
    /// # Errors
    ///
    /// Returns a message when the key holds anything but one of the two spellings.
    pub fn from_metadata(metadata: &BTreeMap<String, Value>) -> Result<Self, String> {
        match metadata.get(Self::METADATA_KEY) {
            None => Ok(Self::Public),
            Some(value) => serde_json::from_value(value.clone()).map_err(|_| {
                format!(
                    "{} is {value}; it accepts only \"public\" or \"private\"",
                    Self::METADATA_KEY
                )
            }),
        }
    }

    /// Record this classification in `metadata` under [`Self::METADATA_KEY`]: present while
    /// private, absent while public.
    pub fn record(self, metadata: &mut BTreeMap<String, Value>) {
        if self.is_public() {
            metadata.remove(Self::METADATA_KEY);
        } else {
            metadata.insert(Self::METADATA_KEY.to_owned(), Value::from(self.as_str()));
        }
    }
}

impl std::fmt::Display for Classification {
    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        formatter.write_str(self.as_str())
    }
}

impl std::str::FromStr for Classification {
    type Err = String;

    fn from_str(value: &str) -> Result<Self, Self::Err> {
        match value {
            "public" => Ok(Self::Public),
            "private" => Ok(Self::Private),
            _ => Err(format!(
                "{value:?} is not a classification; a classification is public or private"
            )),
        }
    }
}

/// Where an entity is, in the one form a consumer can act on without knowing the backend.
///
/// Externally tagged with exactly two variants, so the JSON is `{"url": "https://…"}` or
/// `{"path": "/home/…"}` and a consumer tells them apart by which key is present. A reader
/// handed one of these knows what to *do* with it — open a link, or print a path and read
/// the file out — which is what a bare string could not have said.
///
/// It carries no third case on purpose. `None` on the field is the third case, and it
/// means the source did not say where the entity is, which is not the same as saying it is
/// nowhere.
///
/// This does **not** redefine, replace or derive from the `url` field of [`Task`],
/// [`Project`] or [`Document`]: a source that reports a web URL there goes on reporting
/// it, and every existing consumer sees exactly what it saw.
#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize, JsonSchema)]
#[serde(rename_all = "kebab-case")]
pub enum Location {
    /// The entity lives at an external website, and this is a link a reader can open.
    // llmlint: ignore[invalid_states_unrepresentable] SECOND PERMITTED REASON — this restates at a new site the justification already recorded at `Task::url` and `Project::url` in this module, at `Capabilities.max_page_size` (capability.rs) and `PageRequest.limit` (query.rs): this crate's field types ARE the approved contract, and this variant is a `String` because the `url` field it sits beside is one. Narrowing it here alone would leave two members describing a web address in two different types, which is worse than the state it would remove.
    // llmlint: ignore[boundary_inputs_validated] parsing this into a URL type would add a URL dependency to the crate AGENTS.md says to keep still ("Keep the api crate still" — every change here rebuilds and re-tests every plugin), and would narrow a frozen surface only the contract's owner may narrow. A plugin returning a string this interface cannot represent is what `SourceError::Malformed` is for, exactly as it is for `Task::url`.
    Url(String),
    /// The entity is a file on the machine the source runs on, and this is that file's
    /// absolute path, so a reader can print the path or read the contents out.
    // llmlint: ignore[invalid_states_unrepresentable] SECOND PERMITTED REASON — the reason the variant above carries, plus one of this variant's own: a typed path here would be `std::path::PathBuf`, whose parsing is the *reading* platform's while this string is the *source's*. A plugin on Linux reporting an absolute path to an engine on Windows must have that path survive byte for byte, so the type that would make a relative path unrepresentable is the type that would corrupt a correct one.
    // llmlint: ignore[boundary_inputs_validated] validating absoluteness here would answer the question with the wrong machine's rules, for the reason above — this side cannot know what "absolute" means on the host the plugin runs on. The absoluteness this documents is an obligation on the source, and a source that breaks it is `SourceError::Malformed` to the reader that acts on the path.
    Path(String),
}

/// A repository identified by its normalized origin, without a URL scheme or `.git` suffix.
#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize, JsonSchema)]
#[serde(try_from = "String", into = "String")]
pub struct Repository(String);

impl Repository {
    /// The reserved metadata key a source reads these origins from when its backend has
    /// no notion of its own.
    ///
    /// The key is spelled once, here, because every plugin has to agree on it: a source
    /// that invented its own spelling would hold work nothing else could read.
    pub const METADATA_KEY: &'static str = "onetaskgraph.repositories";

    /// The normalized `host/owner/name` origin.
    #[must_use]
    pub fn as_str(&self) -> &str {
        &self.0
    }

    /// The origins a source records under [`Self::METADATA_KEY`], or none.
    ///
    /// # Errors
    ///
    /// Returns a message when the key holds something other than a duplicate-free list
    /// of normalized origins.
    pub fn from_metadata(metadata: &BTreeMap<String, Value>) -> Result<Vec<Self>, String> {
        let Some(value) = metadata.get(Self::METADATA_KEY) else {
            return Ok(Vec::new());
        };
        let origins: Vec<Self> = serde_json::from_value(value.clone()).map_err(|error| {
            format!(
                "{} is not a list of repository origins: {error}",
                Self::METADATA_KEY
            )
        })?;
        Self::unique(origins)
    }

    /// The same origins, in the order given, once it is established none repeats.
    ///
    /// # Errors
    ///
    /// Returns a message naming the first origin that appears twice.
    pub fn unique(origins: Vec<Self>) -> Result<Vec<Self>, String> {
        let mut seen = std::collections::BTreeSet::new();
        for origin in &origins {
            if !seen.insert(origin.as_str()) {
                return Err(format!(
                    "{:?} is listed twice; a repository list names each origin once",
                    origin.as_str()
                ));
            }
        }
        Ok(origins)
    }
}

fn unique_repositories<'de, D>(deserializer: D) -> Result<Vec<Repository>, D::Error>
where
    D: serde::Deserializer<'de>,
{
    Repository::unique(Vec::<Repository>::deserialize(deserializer)?)
        .map_err(serde::de::Error::custom)
}

impl TryFrom<String> for Repository {
    type Error = String;

    fn try_from(origin: String) -> Result<Self, Self::Error> {
        let valid = !origin.is_empty()
            && !origin.contains("://")
            && !origin.ends_with(".git")
            && !origin.chars().any(char::is_whitespace)
            && origin.split('/').count() >= 3
            && origin
                .split('/')
                .all(|part| !part.is_empty() && part != "." && part != "..");
        valid.then_some(Self(origin.clone())).ok_or_else(|| format!(
            "{origin:?} is not a normalized repository origin; use host/owner/name without a scheme or .git suffix"
        ))
    }
}

impl From<Repository> for String {
    fn from(repository: Repository) -> Self {
        repository.0
    }
}

/// One task named by another task's [`Task::delivers`] or [`Task::delivered_by`].
///
/// A string with one of two spellings, decided the way a [`DependencyEndpoint`] decides it:
/// one holding a colon is `<source>:<native>` and names a task of any source, and one
/// without is a bare native id naming a task of the source that holds the list. So a
/// native id holding a colon cannot be named bare, exactly as it cannot in
/// `onetaskgraph.depends_on`.
#[derive(
    Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize, Deserialize, JsonSchema,
)]
#[serde(try_from = "String", into = "String")]
pub struct TaskRef(String);

impl TaskRef {
    /// The reserved metadata key a source records [`Task::delivers`] under when its backend
    /// has no notion of its own.
    ///
    /// Spelled once, here, for the reason [`Repository::METADATA_KEY`] is.
    pub const DELIVERS_KEY: &'static str = "onetaskgraph.delivers";

    /// The reserved metadata key a source records [`Task::delivered_by`] under when its
    /// backend has no notion of its own.
    pub const DELIVERED_BY_KEY: &'static str = "onetaskgraph.delivered_by";

    /// One entry, once it is established it is a task id.
    ///
    /// # Errors
    ///
    /// Returns a message saying why when the id is empty, or when it is qualified with a
    /// source name that breaks the pattern or with no native id after the colon.
    pub fn new(id: impl Into<String>) -> Result<Self, String> {
        let id = id.into();
        if id.is_empty() {
            return Err("an empty string names no task".to_owned());
        }
        if let Some((source, native)) = id.split_once(':') {
            SourceName::new(source).map_err(|error| error.to_string())?;
            if native.is_empty() {
                return Err(format!("{id:?} names a source and no task in it"));
            }
        }
        Ok(Self(id))
    }

    /// The qualified entry naming `native` in `source`.
    #[must_use]
    pub fn qualified(source: &SourceName, native: &NativeId) -> Self {
        Self(format!("{source}:{native}"))
    }

    /// The entry as it is spelled.
    #[must_use]
    pub fn as_str(&self) -> &str {
        &self.0
    }

    /// Whether the entry names its source in writing.
    #[must_use]
    pub fn is_qualified(&self) -> bool {
        self.0.contains(':')
    }

    /// The source and the native id this entry names, reading a bare entry as naming a task
    /// of `near_source`.
    #[must_use]
    pub fn parts<'a>(&'a self, near_source: &'a str) -> (&'a str, &'a str) {
        self.0
            .split_once(':')
            .unwrap_or((near_source, self.0.as_str()))
    }

    /// This entry qualified, reading a bare one as naming a task of `near_source`.
    #[must_use]
    pub fn in_source(&self, near_source: &SourceName) -> Self {
        if self.is_qualified() {
            return self.clone();
        }
        Self(format!("{near_source}:{}", self.0))
    }

    /// The entries of one task's list, once it is established that none names the task
    /// itself and none repeats.
    ///
    /// `field` is what the list is called where it is stored, for the message. `near` is the
    /// task holding the list and `near_source` the configured name of the source holding it,
    /// which is what tells `T-1` and `work:T-1` apart as the same task. A source that does
    /// not know its own name passes `None`, and then only a bare entry can be recognised as
    /// naming this task or one of the other entries.
    ///
    /// # Errors
    ///
    /// Returns a message naming the task and the entry.
    pub fn listed(
        field: &str,
        near: &NativeId,
        near_source: Option<&SourceName>,
        entries: Vec<Self>,
    ) -> Result<Vec<Self>, String> {
        let normal = |entry: &Self| match near_source {
            Some(source) => entry.in_source(source).0,
            None => entry.0.clone(),
        };
        let this = match near_source {
            Some(source) => Self::qualified(source, near).0,
            None => near.0.clone(),
        };
        let mut seen: Vec<(String, &Self)> = Vec::with_capacity(entries.len());
        for entry in &entries {
            let named = normal(entry);
            if named == this {
                return Err(format!(
                    "{field} on task {near} names {entry}, which is that task itself; a task \
                     cannot be listed in its own {field}"
                ));
            }
            if let Some((_, first)) = seen.iter().find(|(held, _)| *held == named) {
                return Err(format!(
                    "{field} on task {near} names {entry} more than once (as {first} and \
                     {entry}); name each task once"
                ));
            }
            seen.push((named, entry));
        }
        Ok(entries)
    }

    /// The entries one task's list holds, read out of the JSON a source stores it as.
    ///
    /// `value` is `None` when the source holds no list at all, which is the empty one.
    ///
    /// # Errors
    ///
    /// Returns a message naming the task and the entry when the value is not a list, when an
    /// entry is not a task id, or when [`Self::listed`] refuses the list.
    pub fn from_value(
        field: &str,
        near: &NativeId,
        near_source: Option<&SourceName>,
        value: Option<&Value>,
    ) -> Result<Vec<Self>, String> {
        let Some(value) = value else {
            return Ok(Vec::new());
        };
        let Some(held) = value.as_array() else {
            return Err(format!(
                "{field} on task {near} is {value}, which is not a list of task ids"
            ));
        };
        let entries = held
            .iter()
            .map(|entry| {
                entry
                    .as_str()
                    .ok_or_else(|| "it is not a string".to_owned())
                    .and_then(Self::new)
                    .map_err(|why| {
                        format!(
                            "{field} on task {near} holds {entry}, which is not a task id: {why}"
                        )
                    })
            })
            .collect::<Result<Vec<_>, _>>()?;
        Self::listed(field, near, near_source, entries)
    }
}

impl TryFrom<String> for TaskRef {
    type Error = String;

    fn try_from(id: String) -> Result<Self, Self::Error> {
        Self::new(id)
    }
}

impl From<TaskRef> for String {
    fn from(entry: TaskRef) -> Self {
        entry.0
    }
}

impl std::fmt::Display for TaskRef {
    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        self.0.fmt(formatter)
    }
}

/// A tag a source attaches to work.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
pub struct Label {
    /// The source's own opaque identifier.
    pub id: NativeId,
    /// What a user filtering across sources actually types.
    pub name: String,
    /// The source's own colour for the label, when it has one.
    pub color: Option<String>,
}

/// A source's status, kept in both normalised and original form.
///
/// `category` is what every filter compares against; `name` is the source's own
/// wording, preserved so display never flattens "In Review" into "In Progress".
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
pub struct Status {
    /// The normalised value filters compare against.
    pub category: StatusCategory,
    /// The source's own label for this status.
    pub name: String,
}

/// The normalised status vocabulary shared across every source.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize, JsonSchema)]
#[serde(rename_all = "kebab-case")]
pub enum StatusCategory {
    /// Written down but not yet committed to as work.
    Draft,
    /// Known about, not yet accepted as ready to work.
    Backlog,
    /// Accepted and ready to be picked up, and nothing has claimed it.
    Todo,
    /// Claimed by work that will do it, and not yet started.
    Queued,
    /// Being worked on.
    InProgress,
    /// Finished.
    Done,
    /// Abandoned.
    Cancelled,
    /// The source reported a status this vocabulary cannot place.
    Unknown,
}

/// How much a task matters, in the one vocabulary every source is normalised into.
///
/// Five values, most pressing first after [`None`](Self::None): Linear's own priority has
/// exactly these, and a source whose backend has none of its own maps its representation
/// onto them. `none` is a value rather than an absent field, because "no priority is set" is
/// something a person sets — writing `none` clears a priority — and a reader tells it apart
/// from nothing by the value alone.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Default, Serialize, Deserialize, JsonSchema)]
#[serde(rename_all = "kebab-case")]
pub enum Priority {
    /// No priority is set.
    #[default]
    None,
    /// Drop everything for it.
    Urgent,
    /// Next, before the rest.
    High,
    /// In its turn.
    Medium,
    /// When there is nothing more pressing.
    Low,
}

impl Priority {
    /// Every value, in the order the vocabulary lists them.
    pub const ALL: [Self; 5] = [
        Self::None,
        Self::Urgent,
        Self::High,
        Self::Medium,
        Self::Low,
    ];

    /// The value as the wire spells it: `none`, `urgent`, `high`, `medium` or `low`.
    #[must_use]
    pub const fn as_str(self) -> &'static str {
        match self {
            Self::None => "none",
            Self::Urgent => "urgent",
            Self::High => "high",
            Self::Medium => "medium",
            Self::Low => "low",
        }
    }
}

impl std::fmt::Display for Priority {
    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        formatter.write_str(self.as_str())
    }
}

impl std::str::FromStr for Priority {
    type Err = String;

    fn from_str(value: &str) -> Result<Self, Self::Err> {
        Self::ALL
            .into_iter()
            .find(|priority| priority.as_str() == value)
            .ok_or_else(|| {
                format!(
                    "{value:?} is not a priority; a priority is one of none, urgent, high, \
                     medium or low"
                )
            })
    }
}

/// A dependency between two work items.
///
/// An endpoint may name another source. Keeping that far id on the near item is work data
/// owned by its plugin, not an engine-side index or mirror; the engine reports it without
/// resolving or fetching the far item.
///
/// A source uses its backend's own relationship wherever that relationship can name the
/// far end, so the backend knows the graph and its own interface draws it. Where it
/// cannot — a far end in another source, which no backend relates — the source reads
/// [`Self::recorded`] from the near item instead. Only the forward direction is ever
/// recorded; the reverse of a recorded edge is derived, exactly as a
/// [`ForwardOnly`](crate::DependencySupport::ForwardOnly) source's reverse is.
#[derive(Debug, Clone, PartialEq, Serialize, Deserialize, JsonSchema)]
pub struct DependencyEdge {
    /// The item the edge starts at, and the one that **depends on** the other.
    ///
    /// This is the orientation every source reports in, whichever way its own backend
    /// spells the relationship: a GitHub `blockedBy` connection read for `ENG-1` yields
    /// `from: ENG-1`, because `ENG-1` is what depends.
    pub from: DependencyEndpoint,
    /// The item the edge points at, and the one that must finish first.
    pub to: DependencyEndpoint,
    /// What the edge means.
    pub kind: DependencyKind,
}

impl DependencyEdge {
    /// The reserved metadata key a near item records a far end under.
    ///
    /// Spelled once, here, for the reason [`Repository::METADATA_KEY`] is: a plugin that
    /// invented its own spelling would record a plan nothing else could read.
    pub const RECORDED_KEY: &'static str = "onetaskgraph.depends_on";

    /// The forward edges `near` records under [`Self::RECORDED_KEY`], or none.
    ///
    /// The key holds a list of endpoints — a bare string is a native id naming a task,
    /// `{"id": "<source>:<native>", "kind": "project"}` names any item of any source, and
    /// `{"designator": "<plugin>/<hex>", "id": "<native>", "kind": "task"}` names an item of
    /// whichever tracker that designator is, conveying nothing about it.
    /// Each becomes one `blocks` edge from `near` to that endpoint.
    ///
    /// `natively_names` is the kind of item the near item's **own backend** can relate it
    /// to — `Some(ItemKind::Task)` for a GitHub issue, whose `blockedBy` connection holds
    /// issues; `None` for a GitHub draft, which has no such connection at all. An endpoint
    /// of that kind naming an item of `near_source` is refused, because it names an item
    /// the backend itself could hold, and the rule this key exists to serve is the
    /// backend's own relationship first. Naming one's own source is what an unqualified id
    /// does implicitly and what `<near_source>:<native>` does in writing, so both are
    /// refused: which of the two spellings a plan happened to use says nothing about where
    /// the edge belongs.
    ///
    /// An endpoint qualified to a *different* source is never refused. That is the whole
    /// case this key is for: no backend relates an id in a system it knows nothing about.
    ///
    /// # Errors
    ///
    /// Returns a message when the key holds anything other than a list of endpoints, or
    /// holds one the near item's own backend was supposed to name.
    pub fn recorded(
        metadata: &BTreeMap<String, Value>,
        near: &NativeId,
        near_kind: ItemKind,
        near_source: &SourceName,
        natively_names: Option<ItemKind>,
    ) -> Result<Vec<Self>, String> {
        let Some(value) = metadata.get(Self::RECORDED_KEY) else {
            return Ok(Vec::new());
        };
        let far: Vec<DependencyEndpoint> =
            serde_json::from_value(value.clone()).map_err(|error| {
                format!(
                    "{} is not a list of dependency endpoints: {error}",
                    Self::RECORDED_KEY
                )
            })?;
        far.into_iter()
            .map(|to| {
                // An opaque far end names a tracker rather than a source, which is never one
                // this backend relates.
                let names_this_source = to.designator().is_none()
                    && to
                        .source()
                        .is_none_or(|source| source == near_source.as_str());
                if names_this_source && natively_names == Some(to.kind) {
                    return Err(format!(
                        "{key} on {near} records {to}, which this source can relate \
                         natively; record it as this backend's own dependency and keep \
                         {key} for a far end no relationship here can name",
                        key = Self::RECORDED_KEY
                    ));
                }
                Ok(Self {
                    from: DependencyEndpoint::from_native(near.clone(), near_kind),
                    to,
                    kind: DependencyKind::Blocks,
                })
            })
            .collect()
    }
}

/// One endpoint of a dependency edge.
///
/// Three forms: a native id of the source reporting it, a qualified `<source>:<native>` id,
/// and the **opaque** form — a [`Designator`] naming the tracker that holds the item and the
/// item's native id there, which names a private item from a public one while conveying
/// nothing about it.
#[derive(Debug, Clone, PartialEq, Eq, Hash)]
pub struct DependencyEndpoint {
    /// A qualified `<source>:<native>` id, a legacy native id which the engine qualifies to
    /// the source reporting the edge, or a designator with a native id.
    id: EndpointIdentity,
    /// Whether the endpoint names a task or a project.
    pub kind: ItemKind,
}

#[derive(Debug, Clone, PartialEq, Eq, Hash)]
enum EndpointIdentity {
    Native(String),
    Qualified(String),
    Opaque { designator: Designator, id: String },
}

impl EndpointIdentity {
    fn as_str(&self) -> &str {
        match self {
            Self::Native(id) | Self::Qualified(id) | Self::Opaque { id, .. } => id,
        }
    }

    fn into_string(self) -> String {
        match self {
            Self::Native(id) | Self::Qualified(id) | Self::Opaque { id, .. } => id,
        }
    }
}

/// The keys the opaque form of a [`DependencyEndpoint`] holds, and the only ones.
pub(crate) const OPAQUE_ENDPOINT_KEYS: [&str; 3] = ["designator", "id", "kind"];

/// Names a tracker without conveying anything about it: `<plugin>/<64 lowercase hex>`, the
/// SHA-256 of `<plugin>\n<identifier>` over the backend's own opaque identifier of itself —
/// a Linear workspace's organization id, a GitHub Project's node id — or, for a plugin whose
/// backend has none, `alias/<public_alias>`, the alias every host's configuration of that
/// tracker declares identically.
///
/// The one spelling, validated wherever one is built or read, so a stored opaque edge cannot
/// carry anything a designator does not.
#[derive(Debug, Clone, PartialEq, Eq, Hash, PartialOrd, Ord, Serialize)]
#[serde(transparent)]
pub struct Designator(String);

/// The pattern every [`Designator`] matches, as the schema publishes it. What
/// [`Designator::try_from`] accepts is reconciled with it by `tests/designator_pattern.rs` in
/// `onetaskgraph-core`, over the schema the bundle emits.
pub(crate) const DESIGNATOR_PATTERN: &str =
    "^(alias/[A-Za-z0-9_-]{16,64}|[a-z0-9][a-z0-9-]*/[0-9a-f]{64})$";

impl JsonSchema for Designator {
    fn schema_name() -> std::borrow::Cow<'static, str> {
        "Designator".into()
    }

    fn json_schema(_generator: &mut SchemaGenerator) -> Schema {
        json_schema!({
            "description": "A tracker, named without conveying anything about it: `<plugin>/` and the hex SHA-256 of `<plugin>\n<backend identifier>`, or `alias/<public_alias>`.",
            "type": "string",
            "pattern": DESIGNATOR_PATTERN
        })
    }
}

impl Designator {
    /// The prefix of a designator built from a configured `public_alias`.
    pub const ALIAS_PREFIX: &'static str = "alias";

    /// The designator of a backend `plugin` identifies by `identifier`, its own opaque
    /// identifier of itself.
    ///
    /// # Errors
    ///
    /// A message when `plugin` is not a plugin kind's spelling — the pattern a source name
    /// matches — or is [`Self::ALIAS_PREFIX`], which an alias designator's prefix is.
    pub fn of_backend(plugin: &str, identifier: &str) -> Result<Self, String> {
        use sha2::{Digest, Sha256};
        use std::fmt::Write as _;
        if plugin == Self::ALIAS_PREFIX || SourceName::new(plugin).is_err() {
            return Err(format!(
                "{plugin:?} cannot prefix a designator: a plugin kind is lower-case letters, \
                 digits and dashes, and not {:?}",
                Self::ALIAS_PREFIX
            ));
        }
        let mut hex = String::with_capacity(64);
        for byte in Sha256::digest(format!("{plugin}\n{identifier}").as_bytes()) {
            write!(hex, "{byte:02x}").expect("writing to a String cannot fail");
        }
        Ok(Self(format!("{plugin}/{hex}")))
    }

    /// The designator of a tracker whose configuration declares `alias` as its
    /// `public_alias`.
    ///
    /// # Errors
    ///
    /// A message naming the pattern when `alias` is not one.
    pub fn of_alias(alias: &str) -> Result<Self, String> {
        if Self::is_public_alias(alias) {
            Ok(Self(format!("{}/{alias}", Self::ALIAS_PREFIX)))
        } else {
            Err(format!(
                "a public_alias is 16 to 64 of A-Z, a-z, 0-9, `_` and `-` \
                 (^[A-Za-z0-9_-]{{16,64}}$), and this one is {} characters of something else",
                alias.chars().count()
            ))
        }
    }

    /// Whether `alias` is a valid `public_alias`: `^[A-Za-z0-9_-]{16,64}$`.
    #[must_use]
    pub fn is_public_alias(alias: &str) -> bool {
        (16..=64).contains(&alias.len())
            && alias
                .bytes()
                .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'))
    }

    /// The designator as it is spelled.
    #[must_use]
    pub fn as_str(&self) -> &str {
        &self.0
    }

    /// What comes before the `/`: the plugin whose backend it digests, or
    /// [`Self::ALIAS_PREFIX`].
    #[must_use]
    pub fn prefix(&self) -> &str {
        self.0.split_once('/').map_or("", |(prefix, _)| prefix)
    }

    /// Whether it was built from a configured `public_alias`.
    #[must_use]
    pub fn is_alias(&self) -> bool {
        self.prefix() == Self::ALIAS_PREFIX
    }
}

impl TryFrom<String> for Designator {
    type Error = String;

    fn try_from(value: String) -> Result<Self, Self::Error> {
        let refused =
            || "a designator is `<plugin>/<64 lowercase hex>` or `alias/<public_alias>`".to_owned();
        let (prefix, rest) = value.split_once('/').ok_or_else(refused)?;
        if prefix == Self::ALIAS_PREFIX {
            return Self::of_alias(rest);
        }
        let plugin = SourceName::new(prefix).is_ok();
        let digest = rest.len() == 64
            && rest
                .bytes()
                .all(|byte| byte.is_ascii_digit() || (b'a'..=b'f').contains(&byte));
        if plugin && digest {
            Ok(Self(value))
        } else {
            Err(refused())
        }
    }
}

impl<'de> Deserialize<'de> for Designator {
    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
    where
        D: serde::Deserializer<'de>,
    {
        Self::try_from(String::deserialize(deserializer)?).map_err(serde::de::Error::custom)
    }
}

impl std::fmt::Display for Designator {
    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        formatter.write_str(&self.0)
    }
}

impl Serialize for DependencyEndpoint {
    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
    where
        S: serde::Serializer,
    {
        #[derive(Serialize)]
        struct Wire<'a> {
            #[serde(skip_serializing_if = "Option::is_none")]
            designator: Option<&'a Designator>,
            id: &'a str,
            kind: ItemKind,
        }
        Wire {
            designator: self.designator(),
            id: self.id(),
            kind: self.kind,
        }
        .serialize(serializer)
    }
}

impl JsonSchema for DependencyEndpoint {
    fn schema_name() -> std::borrow::Cow<'static, str> {
        "DependencyEndpoint".into()
    }

    fn json_schema(_generator: &mut SchemaGenerator) -> Schema {
        json_schema!({
            "description": "A dependency endpoint. A bare string is a native id of the source reporting it, and this decoding reads one as a task; a reader that knows the level it was written at — a source's own configuration, say — may read it at that level instead. An object with a `designator` is the opaque form: the item's native id in the tracker the designator names, which a reader resolves to whichever configured source that tracker is.",
            "oneOf": [
                {"type": "string", "minLength": 1},
                {
                    "type": "object",
                    "additionalProperties": false,
                    "required": ["id", "kind"],
                    "properties": {
                        "id": {"type": "string", "minLength": 1},
                        "kind": {"type": "string", "enum": ["task", "project"]}
                    }
                },
                {
                    "type": "object",
                    "additionalProperties": false,
                    "required": ["designator", "id", "kind"],
                    "properties": {
                        "designator": {"type": "string", "pattern": DESIGNATOR_PATTERN},
                        "id": {"type": "string", "minLength": 1},
                        "kind": {"type": "string", "enum": ["task", "project"]}
                    }
                }
            ]
        })
    }
}

impl DependencyEndpoint {
    /// Builds an endpoint from a serialized id, validating a qualified id when present.
    ///
    /// # Errors
    ///
    /// Returns an error for an empty id or a malformed `<source>:<native>` id.
    pub fn new(id: String, kind: ItemKind) -> Result<Self, String> {
        let is_qualified = id.contains(':');
        let id = valid_endpoint_id(id)?;
        Ok(Self {
            id: if is_qualified {
                EndpointIdentity::Qualified(id)
            } else {
                EndpointIdentity::Native(id)
            },
            kind,
        })
    }

    /// The opaque endpoint naming `id`, an item's native id in the tracker `designator` names.
    ///
    /// # Errors
    ///
    /// Returns an error for an empty id.
    pub fn opaque(designator: Designator, id: String, kind: ItemKind) -> Result<Self, String> {
        if id.is_empty() {
            return Err("a dependency endpoint id cannot be empty".into());
        }
        Ok(Self {
            id: EndpointIdentity::Opaque { designator, id },
            kind,
        })
    }

    /// Reads an endpoint from any of its three JSON forms, naming what about an object
    /// makes it none of them.
    ///
    /// Unlike deserialization, which reads what a store already holds, this is for what a
    /// caller asks to be written: an object carrying a key beyond `designator`, `id` and `kind` —
    /// a title, a team, a URL — is refused with [`EndpointRefusal::Key`] naming that key, and
    /// never its value.
    ///
    /// # Errors
    ///
    /// [`EndpointRefusal`].
    pub fn from_value(value: &Value) -> Result<Self, EndpointRefusal> {
        if let Value::Object(entries) = value
            && let Some(key) = entries
                .keys()
                .find(|key| !OPAQUE_ENDPOINT_KEYS.contains(&key.as_str()))
        {
            return Err(EndpointRefusal::Key(key.clone()));
        }
        // Serde's diagnostic can repeat what it was given — an unknown `kind`, an id — so it is
        // not carried.
        serde_json::from_value(value.clone()).map_err(|_| EndpointRefusal::Malformed)
    }

    /// Builds an endpoint from a source-native id, whose contents are deliberately opaque.
    #[must_use]
    pub fn from_native(id: NativeId, kind: ItemKind) -> Self {
        Self {
            id: EndpointIdentity::Native(id.0),
            kind,
        }
    }

    /// The serialized native or qualified id — for the opaque form, the native id in the
    /// tracker [`Self::designator`] names.
    #[must_use]
    pub fn id(&self) -> &str {
        self.id.as_str()
    }

    /// Consumes the endpoint and returns its serialized id.
    #[must_use]
    pub fn into_id(self) -> String {
        self.id.into_string()
    }

    /// Whether the id was explicitly supplied as a qualified endpoint.
    #[must_use]
    pub fn is_qualified(&self) -> bool {
        matches!(self.id, EndpointIdentity::Qualified(_))
    }

    /// The source segment of a qualified id, or `None` for a native or an opaque one.
    ///
    /// A native id belongs to whichever source reports it, so `None` reads as "this
    /// source" rather than "no source" — ask [`Self::is_native`] before reading it that way,
    /// because an opaque endpoint names no source of this configuration either.
    #[must_use]
    pub fn source(&self) -> Option<&str> {
        match &self.id {
            EndpointIdentity::Qualified(id) => id.split_once(':').map(|(source, _)| source),
            EndpointIdentity::Native(_) | EndpointIdentity::Opaque { .. } => None,
        }
    }

    /// Whether the id is a native id of the source reporting it: neither qualified nor
    /// opaque.
    #[must_use]
    pub fn is_native(&self) -> bool {
        matches!(self.id, EndpointIdentity::Native(_))
    }

    /// The tracker an opaque endpoint names, or `None` for the other two forms.
    #[must_use]
    pub fn designator(&self) -> Option<&Designator> {
        match &self.id {
            EndpointIdentity::Opaque { designator, .. } => Some(designator),
            EndpointIdentity::Native(_) | EndpointIdentity::Qualified(_) => None,
        }
    }
}

impl<'de> Deserialize<'de> for DependencyEndpoint {
    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
    where
        D: serde::Deserializer<'de>,
    {
        #[derive(Deserialize)]
        #[serde(deny_unknown_fields)]
        struct Opaque {
            designator: Designator,
            id: String,
            kind: ItemKind,
        }
        #[derive(Deserialize)]
        #[serde(untagged)]
        enum Wire {
            Legacy(String),
            Endpoint { id: String, kind: ItemKind },
        }
        let value = Value::deserialize(deserializer)?;
        // An object naming a designator is the opaque form and nothing else, so a malformed
        // one is refused rather than read as the qualified form with a key ignored.
        if value.get("designator").is_some() {
            let Opaque {
                designator,
                id,
                kind,
            } = serde_json::from_value(value).map_err(serde::de::Error::custom)?;
            return Self::opaque(designator, id, kind).map_err(serde::de::Error::custom);
        }
        match Wire::deserialize(value).map_err(serde::de::Error::custom)? {
            Wire::Legacy(id) => {
                if id.is_empty() {
                    return Err(serde::de::Error::custom(
                        "a dependency endpoint id cannot be empty",
                    ));
                }
                Ok(Self::from_native(NativeId(id), ItemKind::Task))
            }
            Wire::Endpoint { id, kind } => Self::new(id, kind).map_err(serde::de::Error::custom),
        }
    }
}

fn valid_endpoint_id(id: String) -> Result<String, String> {
    if id.is_empty() {
        return Err("a dependency endpoint id cannot be empty".into());
    }
    if let Some((source, native)) = id.split_once(':') {
        crate::SourceName::new(source).map_err(|error| error.to_string())?;
        if native.is_empty() {
            return Err("a qualified dependency endpoint must name a native id".into());
        }
    }
    Ok(id)
}

/// Why [`DependencyEndpoint::from_value`] refused what a caller asked to be written. Neither
/// variant carries a value the caller gave, so a refusal can be printed anywhere.
#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
pub enum EndpointRefusal {
    /// The object carries this key beyond `designator`, `id` and `kind`.
    #[error(
        "a dependency endpoint object carries `{0}`; it holds only `designator`, `id` and `kind`"
    )]
    Key(String),
    /// It is none of the three forms.
    #[error(
        "not a dependency endpoint: give a native id, a qualified `<source>:<native id>`, or an \
         object of `designator`, `id` and `kind`"
    )]
    Malformed,
}

impl std::fmt::Display for DependencyEndpoint {
    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        match &self.id {
            EndpointIdentity::Opaque { designator, id } => write!(formatter, "{designator}:{id}"),
            EndpointIdentity::Native(id) | EndpointIdentity::Qualified(id) => id.fmt(formatter),
        }
    }
}

/// An opaque endpoint names an item of another tracker, so it never equals a native id of the
/// source comparing it, whatever id it holds.
impl PartialEq<NativeId> for DependencyEndpoint {
    fn eq(&self, other: &NativeId) -> bool {
        self.designator().is_none() && self.id() == other.0
    }
}

/// The kind of work item named by a dependency endpoint.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize, JsonSchema)]
#[serde(rename_all = "kebab-case")]
pub enum ItemKind {
    /// A task.
    Task,
    /// A project.
    Project,
}

impl ItemKind {
    /// The reserved metadata key an item is marked with when its backend cannot say
    /// which kind it is.
    ///
    /// Spelled once, here, for the reason [`Repository::METADATA_KEY`] is: a key under
    /// this product's prefix belongs to the product, and a plugin inventing its own
    /// spelling would collide with the next one to want it.
    ///
    /// Unlike the other two reserved keys, this one obliges **no** source. A backend that
    /// knows its own kinds — folders, native projects — never reads or writes it, and
    /// passes it through as ordinary caller metadata with its JSON type intact, exactly
    /// as it passes through every other key it does not own. `github-projects` is the one
    /// source that needs it, because a GitHub Projects board holds only issues and an
    /// empty project is indistinguishable from a task without it.
    pub const METADATA_KEY: &'static str = "onetaskgraph.item_kind";

    /// The value this kind is marked with under [`Self::METADATA_KEY`].
    #[must_use]
    pub const fn marker(self) -> &'static str {
        match self {
            Self::Task => "task",
            Self::Project => "project",
        }
    }

    /// The kind `metadata` marks, or `None` when it carries no marker at all.
    ///
    /// # Errors
    ///
    /// Returns a message when [`Self::METADATA_KEY`] holds anything other than the two
    /// markers [`Self::marker`] spells.
    pub fn from_metadata(metadata: &BTreeMap<String, Value>) -> Result<Option<Self>, String> {
        let Some(value) = metadata.get(Self::METADATA_KEY) else {
            return Ok(None);
        };
        match value.as_str() {
            Some(marker) if marker == Self::Task.marker() => Ok(Some(Self::Task)),
            Some(marker) if marker == Self::Project.marker() => Ok(Some(Self::Project)),
            _ => Err(format!(
                "{} is {value}; it accepts only {:?} or {:?}",
                Self::METADATA_KEY,
                Self::Project.marker(),
                Self::Task.marker()
            )),
        }
    }
}

/// What a [`DependencyEdge`] means.
///
/// Both variants are read in the one direction [`DependencyEdge::from`] fixes: `from`
/// depends on `to`. This enum said the opposite of that until the orientation was settled,
/// which is why it is spelled out twice rather than once.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize, JsonSchema)]
#[serde(rename_all = "kebab-case")]
pub enum DependencyKind {
    /// `from` depends on `to`, and `to` must finish before `from` can.
    // llmlint: ignore[names_match_behavior] `"blocks"` is the approved serialized value, spelled in docs/plugin-protocol.md §4.8 and both generated SDKs; the variant names the kind of dependency, and `from`/`to` carry the direction. Renaming it is a wire change and the contract owner's call.
    Blocks,
    /// `from` and `to` are linked without an ordering.
    Related,
}

/// Which way a dependency query walks the graph.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize, JsonSchema)]
#[serde(rename_all = "kebab-case")]
pub enum Direction {
    /// What this item depends on — the forward edges every source can report.
    DependsOn,
    /// What depends on this item — emulated by the engine for a
    /// [`ForwardOnly`](crate::DependencySupport::ForwardOnly) source.
    DependedOnBy,
}