//// Turnkey app-platform defaults and presets contracts for M58.

import gleam/int
import gleam/list
import gleam/string

pub const snapshot_version = 1

/// Override seam for one platform domain.
pub type PresetSeam {
  AuthSeam
  AdminSeam
  BillingSeam
  PolicySeam
  EmailSeam
  QueueSeam
}

/// Explicit override seam contract.
pub type OverrideHook {
  OverrideHook(
    seam: PresetSeam,
    module: String,
    hook: String,
    rationale: String,
  )
}

/// Secure auth defaults.
pub type AuthDefaults {
  AuthDefaults(
    provider_module: String,
    session_ttl_minutes: Int,
    mfa_required: Bool,
    passkeys_required: Bool,
    password_min_length: Int,
  )
}

/// Secure admin defaults.
pub type AdminDefaults {
  AdminDefaults(
    provider_module: String,
    audit_sink_module: String,
    approval_required: Bool,
    break_glass_role: String,
  )
}

/// Secure billing defaults.
pub type BillingDefaults {
  BillingDefaults(
    provider_module: String,
    webhook_verification: Bool,
    dunning_enabled: Bool,
    idempotency_required: Bool,
  )
}

/// Secure policy defaults.
pub type PolicyDefaults {
  PolicyDefaults(
    provider_module: String,
    deny_by_default: Bool,
    tenant_scoped: Bool,
    decision_trace_enabled: Bool,
  )
}

/// Secure email defaults.
pub type EmailDefaults {
  EmailDefaults(
    provider_module: String,
    domain_authentication_required: Bool,
    suppression_list_enabled: Bool,
    signed_templates_required: Bool,
  )
}

/// Secure queue defaults.
pub type QueueDefaults {
  QueueDefaults(
    provider_module: String,
    max_attempts: Int,
    dead_letter_enabled: Bool,
    idempotency_required: Bool,
    replay_checkpoint_required: Bool,
  )
}

/// Production-shaped starter preset.
pub type StarterPreset {
  StarterPreset(
    name: String,
    scaffold_command: String,
    auth: AuthDefaults,
    admin: AdminDefaults,
    billing: BillingDefaults,
    policy: PolicyDefaults,
    email: EmailDefaults,
    queue: QueueDefaults,
    override_hooks: List(OverrideHook),
    requires_framework_internal_edits: Bool,
  )
}

/// Critical platform flow certified by deterministic fixtures.
pub type CriticalFlow {
  SignupWithMfaFlow
  AdminBreakGlassApprovalFlow
  BillingWebhookReconciliationFlow
  PolicyDeniedAuditTrailFlow
  EmailVerificationDeliveryFlow
  QueueReplayRecoveryFlow
}

/// Deterministic reference app scenario for M58.
pub type ReferenceScenario {
  ReferenceScenario(
    name: String,
    preset: StarterPreset,
    flows: List(CriticalFlow),
    seed: String,
  )
}

/// Stable M58 profile version label.
pub fn profile_version_label() -> String {
  "m58.profile.v" <> int.to_string(snapshot_version)
}

/// Secure SaaS starter preset.
pub fn secure_saas_preset() -> StarterPreset {
  StarterPreset(
    name: "secure_saas",
    scaffold_command: "lightspeed new acme_portal --preset secure_saas",
    auth: AuthDefaults(
      provider_module: "MyApp.Auth.Password",
      session_ttl_minutes: 480,
      mfa_required: True,
      passkeys_required: True,
      password_min_length: 14,
    ),
    admin: AdminDefaults(
      provider_module: "MyApp.Admin.Console",
      audit_sink_module: "MyApp.Admin.AuditSink",
      approval_required: True,
      break_glass_role: "platform_admin",
    ),
    billing: BillingDefaults(
      provider_module: "MyApp.Billing.Stripe",
      webhook_verification: True,
      dunning_enabled: True,
      idempotency_required: True,
    ),
    policy: PolicyDefaults(
      provider_module: "MyApp.Policy.Rbac",
      deny_by_default: True,
      tenant_scoped: True,
      decision_trace_enabled: True,
    ),
    email: EmailDefaults(
      provider_module: "MyApp.Email.Transactional",
      domain_authentication_required: True,
      suppression_list_enabled: True,
      signed_templates_required: True,
    ),
    queue: QueueDefaults(
      provider_module: "MyApp.Queue.Worker",
      max_attempts: 6,
      dead_letter_enabled: True,
      idempotency_required: True,
      replay_checkpoint_required: True,
    ),
    override_hooks: default_override_hooks(),
    requires_framework_internal_edits: False,
  )
}

/// Secure marketplace starter preset.
pub fn secure_marketplace_preset() -> StarterPreset {
  StarterPreset(
    name: "secure_marketplace",
    scaffold_command: "lightspeed new market_hub --preset secure_marketplace",
    auth: AuthDefaults(
      provider_module: "MyApp.Auth.Oidc",
      session_ttl_minutes: 360,
      mfa_required: True,
      passkeys_required: True,
      password_min_length: 12,
    ),
    admin: AdminDefaults(
      provider_module: "MyApp.Admin.Backoffice",
      audit_sink_module: "MyApp.Admin.AuditSink",
      approval_required: True,
      break_glass_role: "market_admin",
    ),
    billing: BillingDefaults(
      provider_module: "MyApp.Billing.Hybrid",
      webhook_verification: True,
      dunning_enabled: True,
      idempotency_required: True,
    ),
    policy: PolicyDefaults(
      provider_module: "MyApp.Policy.Abac",
      deny_by_default: True,
      tenant_scoped: True,
      decision_trace_enabled: True,
    ),
    email: EmailDefaults(
      provider_module: "MyApp.Email.Transactional",
      domain_authentication_required: True,
      suppression_list_enabled: True,
      signed_templates_required: True,
    ),
    queue: QueueDefaults(
      provider_module: "MyApp.Queue.Worker",
      max_attempts: 5,
      dead_letter_enabled: True,
      idempotency_required: True,
      replay_checkpoint_required: True,
    ),
    override_hooks: default_override_hooks(),
    requires_framework_internal_edits: False,
  )
}

/// Secure operations-heavy starter preset.
pub fn secure_operations_preset() -> StarterPreset {
  StarterPreset(
    name: "secure_operations",
    scaffold_command: "lightspeed new ops_center --preset secure_operations",
    auth: AuthDefaults(
      provider_module: "MyApp.Auth.Password",
      session_ttl_minutes: 720,
      mfa_required: True,
      passkeys_required: True,
      password_min_length: 16,
    ),
    admin: AdminDefaults(
      provider_module: "MyApp.Admin.Console",
      audit_sink_module: "MyApp.Admin.AuditSink",
      approval_required: True,
      break_glass_role: "ops_super_admin",
    ),
    billing: BillingDefaults(
      provider_module: "MyApp.Billing.Paddle",
      webhook_verification: True,
      dunning_enabled: True,
      idempotency_required: True,
    ),
    policy: PolicyDefaults(
      provider_module: "MyApp.Policy.Rbac",
      deny_by_default: True,
      tenant_scoped: True,
      decision_trace_enabled: True,
    ),
    email: EmailDefaults(
      provider_module: "MyApp.Email.Transactional",
      domain_authentication_required: True,
      suppression_list_enabled: True,
      signed_templates_required: True,
    ),
    queue: QueueDefaults(
      provider_module: "MyApp.Queue.Worker",
      max_attempts: 8,
      dead_letter_enabled: True,
      idempotency_required: True,
      replay_checkpoint_required: True,
    ),
    override_hooks: default_override_hooks(),
    requires_framework_internal_edits: False,
  )
}

/// Deterministic M58 reference presets.
pub fn reference_presets() -> List(StarterPreset) {
  [
    secure_saas_preset(),
    secure_marketplace_preset(),
    secure_operations_preset(),
  ]
}

/// Required critical flows for M58 certification.
pub fn required_critical_flows() -> List(CriticalFlow) {
  [
    SignupWithMfaFlow,
    AdminBreakGlassApprovalFlow,
    BillingWebhookReconciliationFlow,
    PolicyDeniedAuditTrailFlow,
    EmailVerificationDeliveryFlow,
    QueueReplayRecoveryFlow,
  ]
}

/// Deterministic reference scenarios for fixture certification.
pub fn reference_scenarios() -> List(ReferenceScenario) {
  let flows = required_critical_flows()

  [
    ReferenceScenario(
      name: "saas_secure_baseline",
      preset: secure_saas_preset(),
      flows: flows,
      seed: "m58-saas-001",
    ),
    ReferenceScenario(
      name: "marketplace_secure_baseline",
      preset: secure_marketplace_preset(),
      flows: flows,
      seed: "m58-market-001",
    ),
    ReferenceScenario(
      name: "operations_secure_baseline",
      preset: secure_operations_preset(),
      flows: flows,
      seed: "m58-ops-001",
    ),
  ]
}

/// Preset name accessor.
pub fn name(preset: StarterPreset) -> String {
  preset.name
}

/// One-command scaffold accessor.
pub fn scaffold_command(preset: StarterPreset) -> String {
  preset.scaffold_command
}

/// Override hooks accessor.
pub fn override_hooks(preset: StarterPreset) -> List(OverrideHook) {
  preset.override_hooks
}

/// Framework-internal-edits accessor.
pub fn requires_framework_internal_edits(preset: StarterPreset) -> Bool {
  preset.requires_framework_internal_edits
}

/// Scenario name accessor.
pub fn scenario_name(scenario: ReferenceScenario) -> String {
  scenario.name
}

/// Scenario flows accessor.
pub fn scenario_flows(scenario: ReferenceScenario) -> List(CriticalFlow) {
  scenario.flows
}

/// Scenario preset accessor.
pub fn scenario_preset(scenario: ReferenceScenario) -> StarterPreset {
  scenario.preset
}

/// Critical flow label.
pub fn flow_label(flow: CriticalFlow) -> String {
  case flow {
    SignupWithMfaFlow -> "signup_with_mfa"
    AdminBreakGlassApprovalFlow -> "admin_break_glass_approval"
    BillingWebhookReconciliationFlow -> "billing_webhook_reconciliation"
    PolicyDeniedAuditTrailFlow -> "policy_denied_audit_trail"
    EmailVerificationDeliveryFlow -> "email_verification_delivery"
    QueueReplayRecoveryFlow -> "queue_replay_recovery"
  }
}

/// Override seam label.
pub fn seam_label(seam: PresetSeam) -> String {
  case seam {
    AuthSeam -> "auth"
    AdminSeam -> "admin"
    BillingSeam -> "billing"
    PolicySeam -> "policy"
    EmailSeam -> "email"
    QueueSeam -> "queue"
  }
}

/// Build one override hook.
pub fn override_hook(
  seam: PresetSeam,
  module: String,
  hook: String,
  rationale: String,
) -> OverrideHook {
  OverrideHook(seam: seam, module: module, hook: hook, rationale: rationale)
}

/// Add one override hook when missing.
pub fn with_override_hook(
  preset: StarterPreset,
  new_hook: OverrideHook,
) -> StarterPreset {
  StarterPreset(
    ..preset,
    override_hooks: append_override_if_missing(preset.override_hooks, new_hook),
  )
}

/// Validate one starter preset contract.
pub fn valid(preset: StarterPreset) -> Bool {
  preset.name != ""
  && starter_scaffold_ready(preset)
  && auth_valid(preset.auth)
  && admin_valid(preset.admin)
  && billing_valid(preset.billing)
  && policy_valid(preset.policy)
  && email_valid(preset.email)
  && queue_valid(preset.queue)
  && override_hooks_valid(preset.override_hooks)
  && has_explicit_override_seams(preset)
}

/// True when secure defaults are prewired.
pub fn secure_defaults(preset: StarterPreset) -> Bool {
  preset.auth.mfa_required
  && preset.auth.passkeys_required
  && preset.auth.password_min_length >= 12
  && preset.admin.approval_required
  && preset.admin.break_glass_role != ""
  && preset.billing.webhook_verification
  && preset.billing.idempotency_required
  && preset.policy.deny_by_default
  && preset.policy.tenant_scoped
  && preset.policy.decision_trace_enabled
  && preset.email.domain_authentication_required
  && preset.email.signed_templates_required
  && preset.email.suppression_list_enabled
  && preset.queue.dead_letter_enabled
  && preset.queue.idempotency_required
  && preset.queue.replay_checkpoint_required
}

/// True when scaffold command represents one safe starter invocation.
pub fn starter_scaffold_ready(preset: StarterPreset) -> Bool {
  let command = preset.scaffold_command

  command != ""
  && string.starts_with(command, "lightspeed new ")
  && string.length(command) > 20
  && !string.contains(command, "&&")
  && !string.contains(command, "||")
  && !string.contains(command, ";")
  && !string.contains(command, "|")
}

/// True when overrides avoid framework internals edits.
pub fn override_without_internal_edits(preset: StarterPreset) -> Bool {
  !preset.requires_framework_internal_edits
  && hooks_external(preset.override_hooks)
}

/// True when every seam has at least one explicit override hook.
pub fn has_explicit_override_seams(preset: StarterPreset) -> Bool {
  seam_present(preset.override_hooks, AuthSeam)
  && seam_present(preset.override_hooks, AdminSeam)
  && seam_present(preset.override_hooks, BillingSeam)
  && seam_present(preset.override_hooks, PolicySeam)
  && seam_present(preset.override_hooks, EmailSeam)
  && seam_present(preset.override_hooks, QueueSeam)
}

/// True when one preset is ready as secure turnkey baseline.
pub fn scaffoldable_secure_baseline(preset: StarterPreset) -> Bool {
  valid(preset)
  && secure_defaults(preset)
  && override_without_internal_edits(preset)
}

/// True when one critical flow is supported by preset defaults.
pub fn supports_flow(preset: StarterPreset, flow: CriticalFlow) -> Bool {
  case flow {
    SignupWithMfaFlow ->
      preset.auth.mfa_required
      && preset.auth.passkeys_required
      && preset.auth.password_min_length >= 12
    AdminBreakGlassApprovalFlow ->
      preset.admin.approval_required
      && preset.admin.break_glass_role != ""
      && preset.admin.audit_sink_module != ""
    BillingWebhookReconciliationFlow ->
      preset.billing.webhook_verification
      && preset.billing.idempotency_required
      && preset.billing.dunning_enabled
    PolicyDeniedAuditTrailFlow ->
      preset.policy.deny_by_default
      && preset.policy.tenant_scoped
      && preset.policy.decision_trace_enabled
    EmailVerificationDeliveryFlow ->
      preset.email.domain_authentication_required
      && preset.email.suppression_list_enabled
      && preset.email.signed_templates_required
    QueueReplayRecoveryFlow ->
      preset.queue.dead_letter_enabled
      && preset.queue.idempotency_required
      && preset.queue.replay_checkpoint_required
      && preset.queue.max_attempts >= 3
  }
}

/// True when one reference scenario is certified.
pub fn scenario_certified(scenario: ReferenceScenario) -> Bool {
  scenario.name != ""
  && scenario.seed != ""
  && scaffoldable_secure_baseline(scenario.preset)
  && flow_list_supported(scenario.preset, scenario.flows)
}

/// Stable override surface signature for one preset.
pub fn override_surface_signature(preset: StarterPreset) -> String {
  let entries = list.map(preset.override_hooks, override_hook_label)
  join_with(",", entries)
}

/// Stable critical-flow support signature for one preset.
pub fn critical_flow_signature(preset: StarterPreset) -> String {
  let entries =
    list.map(required_critical_flows(), fn(flow) {
      flow_label(flow) <> "=" <> bool_label(supports_flow(preset, flow))
    })

  join_with(",", entries)
}

/// Stable preset signature.
pub fn signature(preset: StarterPreset) -> String {
  "preset:"
  <> preset.name
  <> "|scaffold="
  <> preset.scaffold_command
  <> "|auth="
  <> auth_signature(preset.auth)
  <> "|admin="
  <> admin_signature(preset.admin)
  <> "|billing="
  <> billing_signature(preset.billing)
  <> "|policy="
  <> policy_signature(preset.policy)
  <> "|email="
  <> email_signature(preset.email)
  <> "|queue="
  <> queue_signature(preset.queue)
  <> "|override_surface="
  <> override_surface_signature(preset)
  <> "|internal_edits="
  <> bool_label(preset.requires_framework_internal_edits)
}

/// Stable scenario signature.
pub fn scenario_signature(scenario: ReferenceScenario) -> String {
  "scenario:"
  <> scenario.name
  <> "|seed="
  <> scenario.seed
  <> "|preset="
  <> signature(scenario.preset)
  <> "|flows="
  <> critical_flow_signature(scenario.preset)
}

/// Deterministic fixture snapshots for M58 drift gates.
pub fn fixture_snapshots() -> List(#(String, String)) {
  list.map(reference_presets(), fn(preset) { #(preset.name, signature(preset)) })
}

/// Deterministic M58 snapshot signature.
pub fn snapshot_signature() -> String {
  let entries =
    list.map(fixture_snapshots(), fn(entry) {
      let #(label, value) = entry
      label <> "=" <> value
    })

  profile_version_label() <> "|" <> join_with(";", entries)
}

fn default_override_hooks() -> List(OverrideHook) {
  [
    override_hook(
      AuthSeam,
      "MyApp.Platform.AuthOverrides",
      "resolve_login_policy",
      "adapt login/session controls for external identity boundaries",
    ),
    override_hook(
      AdminSeam,
      "MyApp.Platform.AdminOverrides",
      "authorize_break_glass",
      "require org-specific approval constraints for admin escalation",
    ),
    override_hook(
      BillingSeam,
      "MyApp.Platform.BillingOverrides",
      "transform_invoice_webhook",
      "map provider webhook payloads to tenant billing policy",
    ),
    override_hook(
      PolicySeam,
      "MyApp.Platform.PolicyOverrides",
      "resolve_policy_context",
      "inject domain scope attributes for policy decisions",
    ),
    override_hook(
      EmailSeam,
      "MyApp.Platform.EmailOverrides",
      "customize_delivery_channel",
      "route signed templates through tenant delivery controls",
    ),
    override_hook(
      QueueSeam,
      "MyApp.Platform.QueueOverrides",
      "route_retry_backoff",
      "map retry strategy to tenant/class-specific queue policy",
    ),
  ]
}

fn flow_list_supported(
  preset: StarterPreset,
  flows: List(CriticalFlow),
) -> Bool {
  case flows {
    [] -> True
    [flow, ..rest] ->
      supports_flow(preset, flow) && flow_list_supported(preset, rest)
  }
}

fn append_override_if_missing(
  overrides: List(OverrideHook),
  new_hook: OverrideHook,
) -> List(OverrideHook) {
  case overrides {
    [] -> [new_hook]
    [existing, ..rest] ->
      case override_hook_equal(existing, new_hook) {
        True -> overrides
        False -> [existing, ..append_override_if_missing(rest, new_hook)]
      }
  }
}

fn override_hook_equal(left: OverrideHook, right: OverrideHook) -> Bool {
  left.seam == right.seam
  && left.module == right.module
  && left.hook == right.hook
}

fn auth_valid(defaults: AuthDefaults) -> Bool {
  defaults.provider_module != ""
  && defaults.session_ttl_minutes >= 60
  && defaults.password_min_length >= 12
}

fn admin_valid(defaults: AdminDefaults) -> Bool {
  defaults.provider_module != ""
  && defaults.audit_sink_module != ""
  && defaults.break_glass_role != ""
}

fn billing_valid(defaults: BillingDefaults) -> Bool {
  defaults.provider_module != ""
  && defaults.webhook_verification
  && defaults.idempotency_required
}

fn policy_valid(defaults: PolicyDefaults) -> Bool {
  defaults.provider_module != ""
  && defaults.deny_by_default
  && defaults.tenant_scoped
}

fn email_valid(defaults: EmailDefaults) -> Bool {
  defaults.provider_module != ""
  && defaults.domain_authentication_required
  && defaults.signed_templates_required
}

fn queue_valid(defaults: QueueDefaults) -> Bool {
  defaults.provider_module != ""
  && defaults.max_attempts >= 3
  && defaults.dead_letter_enabled
  && defaults.idempotency_required
}

fn override_hooks_valid(overrides: List(OverrideHook)) -> Bool {
  case overrides {
    [] -> True
    [override, ..rest] ->
      override_hook_valid(override) && override_hooks_valid(rest)
  }
}

fn override_hook_valid(override: OverrideHook) -> Bool {
  override.module != "" && override.hook != "" && override.rationale != ""
}

fn hooks_external(overrides: List(OverrideHook)) -> Bool {
  case overrides {
    [] -> True
    [override, ..rest] ->
      override_module_external(override.module) && hooks_external(rest)
  }
}

fn override_module_external(module: String) -> Bool {
  !string.contains(module, "lightspeed/framework")
  && !string.contains(module, "lightspeed/component")
  && !string.contains(module, "lightspeed/platform")
}

fn seam_present(overrides: List(OverrideHook), seam: PresetSeam) -> Bool {
  case overrides {
    [] -> False
    [override, ..rest] ->
      case override.seam == seam {
        True -> True
        False -> seam_present(rest, seam)
      }
  }
}

fn override_hook_label(override: OverrideHook) -> String {
  seam_label(override.seam) <> ":" <> override.module <> "#" <> override.hook
}

fn auth_signature(defaults: AuthDefaults) -> String {
  defaults.provider_module
  <> ":ttl="
  <> int.to_string(defaults.session_ttl_minutes)
  <> ":mfa="
  <> bool_label(defaults.mfa_required)
  <> ":passkeys="
  <> bool_label(defaults.passkeys_required)
  <> ":pwd_min="
  <> int.to_string(defaults.password_min_length)
}

fn admin_signature(defaults: AdminDefaults) -> String {
  defaults.provider_module
  <> ":audit="
  <> defaults.audit_sink_module
  <> ":approval="
  <> bool_label(defaults.approval_required)
  <> ":break_glass="
  <> defaults.break_glass_role
}

fn billing_signature(defaults: BillingDefaults) -> String {
  defaults.provider_module
  <> ":webhook="
  <> bool_label(defaults.webhook_verification)
  <> ":dunning="
  <> bool_label(defaults.dunning_enabled)
  <> ":idempotency="
  <> bool_label(defaults.idempotency_required)
}

fn policy_signature(defaults: PolicyDefaults) -> String {
  defaults.provider_module
  <> ":deny_by_default="
  <> bool_label(defaults.deny_by_default)
  <> ":tenant_scoped="
  <> bool_label(defaults.tenant_scoped)
  <> ":trace="
  <> bool_label(defaults.decision_trace_enabled)
}

fn email_signature(defaults: EmailDefaults) -> String {
  defaults.provider_module
  <> ":domain_auth="
  <> bool_label(defaults.domain_authentication_required)
  <> ":suppression_list="
  <> bool_label(defaults.suppression_list_enabled)
  <> ":signed_templates="
  <> bool_label(defaults.signed_templates_required)
}

fn queue_signature(defaults: QueueDefaults) -> String {
  defaults.provider_module
  <> ":max_attempts="
  <> int.to_string(defaults.max_attempts)
  <> ":dead_letter="
  <> bool_label(defaults.dead_letter_enabled)
  <> ":idempotency="
  <> bool_label(defaults.idempotency_required)
  <> ":replay_checkpoint="
  <> bool_label(defaults.replay_checkpoint_required)
}

fn bool_label(value: Bool) -> String {
  case value {
    True -> "true"
    False -> "false"
  }
}

fn join_with(separator: String, values: List(String)) -> String {
  case values {
    [] -> ""
    [first, ..rest] ->
      list.fold(rest, first, fn(accumulator, value) {
        accumulator <> separator <> value
      })
  }
}