export type SecurityControlStatus = "ready" | "degraded";

const PUBLIC_DISCOVERY_COLLECTOR_IDS = new Set([
  "k8s_replicasets",
  "k8s_nodes",
  "k8s_pods",
  "k8s_deployments",
  "k8s_statefulsets",
  "k8s_daemonsets",
  "k8s_services",
  "k8s_configmaps",
  "k8s_persistentvolumeclaims",
  "k8s_ingresses",
  "k8s_cronjobs",
  "prometheus_targets",
  "database_catalog",
  "ai_catalog",
  "gitea_bundle_backup",
  "gitea_ci",
  "domain_tls_inventory",
]);

export type SecurityControlPlaneSummary = {
  source_count: number;
  ready_source_count: number;
  unavailable_source_count: number;
  managed_asset_count: number;
  expected_asset_type_count: number;
  present_asset_type_count: number;
  asset_type_coverage_percent: number;
  scope_count: number;
  controlled_scope_count: number;
  unowned_asset_count: number;
  stale_asset_count: number;
  orphan_asset_count: number;
  relationship_count: number;
  package_digest_unpinned_count?: number;
  forbidden_github_supply_chain_asset_count?: number;
  certificate_live_unverified_count?: number;
  certificate_live_unhealthy_count?: number;
  automation_coverage_green_percent: number;
  automation_coverage_unknown_count: number;
  compliance_violation_count: number;
  compliance_unknown_count: number;
  nist_controlled_percent: number;
  security_program_domain_count: number;
  security_program_controlled_domain_count: number;
  security_program_controlled_percent: number;
  overall_security_completion_percent: number;
  siem_stage_count: number;
  siem_observed_stage_count: number;
  siem_stage_coverage_percent: number;
  ai_loop_stage_count: number;
  ai_loop_observed_stage_count: number;
  ai_loop_stage_coverage_percent: number;
  verified_remediation_receipt_count_24h: number;
  active_work_item_count: number;
};

export type SecurityControlPlaneFunction = {
  function_id: string;
  label: string;
  controlled_percent: number;
  status: string;
};

export type SecurityControlPlaneStage = {
  stage_id: string;
  label: string;
  status: "observed" | "missing";
  evidence_count_24h?: number;
  receipt_count_24h?: number;
};

export type SecurityControlPlaneScope = {
  scope_id: string;
  label: string;
  managed_asset_count: number;
  expected_type_count: number;
  present_type_count: number;
  missing_type_count: number;
  type_coverage_percent: number;
  status: string;
};

export type SecurityControlPlaneWorkItem = {
  work_item_id: string;
  priority: string;
  control_id: string;
  title: string;
  gap_count: number;
  status: string;
  next_action: string;
  order?: number;
  gap_percent?: number;
};

export type SecurityControlPlaneSupplyChain = {
  package_asset_count: number;
  package_inventory_evidenced: boolean;
  package_digest_pinned_count: number;
  package_digest_unpinned_count: number;
  forbidden_github_supply_chain_asset_count: number;
  github_freeze_compliant: boolean;
  runtime_image_policy_compliant: boolean;
  raw_image_identity_returned: false;
  registry_api_called: false;
  github_api_used: false;
};

export type SecurityControlPlaneCertificateInventory = {
  certificate_asset_count: number;
  live_tls_verified_count: number;
  live_tls_evidenced_count?: number;
  live_tls_healthy_count?: number;
  live_tls_unverified_count: number;
  live_tls_unhealthy_count?: number;
  live_tls_health_proven: boolean;
  raw_certificate_path_returned: false;
  certificate_material_read: false;
  private_key_material_read: false;
};

export type SecurityStrictRuntimeCompletion = {
  schema_version: "ai_agent_strict_runtime_completion_v2";
  runtime_contract_schema_version: "ai_automation_runtime_completion_contract_v2";
  contract_compatible: boolean;
  completion_percent: number;
  required_stage_count: number;
  present_stage_count: number;
  missing_stage_count: number;
  same_run_correlation: boolean;
  full_trace_same_run_correlation_proven: boolean;
  execution_loop_closed: boolean;
  closed: boolean;
  reason_code: string | null;
  cache_fallback_active: boolean;
  raw_run_identity_returned: false;
  raw_stage_receipts_returned: false;
};

export type SecurityAssetControlPlanePayload = {
  schema_version: "iwooos_security_asset_control_plane_v1";
  generated_at: string;
  status: SecurityControlStatus;
  source_status: string;
  reason_code?: string;
  summary: SecurityControlPlaneSummary;
  discovery: {
    latest_status: string;
    latest_scan_depth: string;
    latest_started_at: string | null;
    latest_ended_at: string | null;
    latest_success_at: string | null;
    age_seconds: number | null;
    freshness_slo_seconds: number;
    fresh: boolean;
    latest_total_assets: number;
    new_assets: number;
    modified_assets: number;
    disappeared_assets: number;
    failure_reason_code: string | null;
    failed_collector_count: number;
    failed_collector_ids: string[];
    raw_error_returned: false;
  };
  asset_scopes: SecurityControlPlaneScope[];
  nist_csf_functions: SecurityControlPlaneFunction[];
  security_program_domains: Array<{
    domain_id: string;
    label: string;
    controlled_percent: number;
    status: string;
    evidence_count: number;
    gap_code: string | null;
  }>;
  completion: {
    method: "equal_weighted_runtime_conservative_v1";
    dimension_count: number;
    overall_percent: number;
    strict_runtime_closure_percent: number;
    dimensions: Array<{
      dimension_id: string;
      completion_percent: number;
    }>;
  };
  siem: {
    pipeline: SecurityControlPlaneStage[];
    incident_total_24h?: number;
    open_incident_count_24h?: number;
    resolved_incident_count_24h?: number;
    noisy_rule_count?: number;
    mean_time_to_resolve_minutes_24h?: number | null;
  };
  ai_automation: {
    stages: SecurityControlPlaneStage[];
    aggregate_stage_coverage_percent: number;
    accepted_ai_trace_count: number;
    verified_remediation_receipt_count: number;
    rollback_receipt_count: number;
    failed_operation_count: number;
    same_run_closed_loop_proven: boolean;
    same_run_closed_loop_count: number;
    strict_runtime_completion: SecurityStrictRuntimeCompletion;
  };
  security_audit: {
    k8s_execution_audit_count_24h: number;
    k8s_execution_failure_count_24h: number;
    mcp_tool_audit_count_24h: number;
    mcp_tool_failure_count_24h: number;
    asset_change_event_count_24h: number;
    automation_operation_count_24h: number;
    automation_failure_count_24h: number;
    ai_trace_count_24h: number;
    accepted_ai_trace_count_24h: number;
    immutable_external_audit_store_evidenced: boolean;
  };
  supply_chain?: SecurityControlPlaneSupplyChain;
  certificate_inventory?: SecurityControlPlaneCertificateInventory;
  source_health: Array<{
    source_id: string;
    status: "ready" | "unavailable";
    reason_code: string | null;
  }>;
  work_items: SecurityControlPlaneWorkItem[];
  boundaries: {
    aggregate_only: boolean;
    raw_asset_identity_returned: boolean;
    raw_event_payload_returned: boolean;
    raw_discovery_error_returned: boolean;
    secret_value_collection_allowed: boolean;
    live_scan_triggered: boolean;
    runtime_action_triggered: boolean;
    completion_requires_same_run_receipts: boolean;
  };
};

function isRecord(value: unknown): value is Record<string, unknown> {
  return typeof value === "object" && value !== null && !Array.isArray(value);
}

export function isSecurityAssetControlPlanePayload(
  value: unknown,
): value is SecurityAssetControlPlanePayload {
  if (!isRecord(value)) return false;
  if (value.schema_version !== "iwooos_security_asset_control_plane_v1")
    return false;
  if (!isRecord(value.summary) || !isRecord(value.boundaries)) return false;
  if (
    !isRecord(value.discovery) ||
    !Array.isArray(value.discovery.failed_collector_ids) ||
    !value.discovery.failed_collector_ids.every(
      (collectorId) =>
        typeof collectorId === "string" &&
        PUBLIC_DISCOVERY_COLLECTOR_IDS.has(collectorId),
    ) ||
    typeof value.discovery.failed_collector_count !== "number" ||
    value.discovery.failed_collector_count !==
      value.discovery.failed_collector_ids.length ||
    value.discovery.raw_error_returned !== false
  ) {
    return false;
  }
  if (
    !Array.isArray(value.asset_scopes) ||
    !Array.isArray(value.nist_csf_functions) ||
    !Array.isArray(value.security_program_domains)
  ) {
    return false;
  }
  if (!isRecord(value.siem) || !Array.isArray(value.siem.pipeline))
    return false;
  if (
    !isRecord(value.ai_automation) ||
    !Array.isArray(value.ai_automation.stages)
  ) {
    return false;
  }
  const strictRuntime = value.ai_automation.strict_runtime_completion;
  if (
    !isRecord(strictRuntime) ||
    strictRuntime.schema_version !== "ai_agent_strict_runtime_completion_v2" ||
    strictRuntime.runtime_contract_schema_version !==
      "ai_automation_runtime_completion_contract_v2" ||
    typeof strictRuntime.contract_compatible !== "boolean" ||
    typeof strictRuntime.completion_percent !== "number" ||
    typeof strictRuntime.required_stage_count !== "number" ||
    typeof strictRuntime.present_stage_count !== "number" ||
    typeof strictRuntime.missing_stage_count !== "number" ||
    typeof strictRuntime.same_run_correlation !== "boolean" ||
    typeof strictRuntime.full_trace_same_run_correlation_proven !== "boolean" ||
    typeof strictRuntime.execution_loop_closed !== "boolean" ||
    typeof strictRuntime.closed !== "boolean" ||
    typeof strictRuntime.cache_fallback_active !== "boolean" ||
    !(
      strictRuntime.reason_code === null ||
      typeof strictRuntime.reason_code === "string"
    ) ||
    strictRuntime.raw_run_identity_returned !== false ||
    strictRuntime.raw_stage_receipts_returned !== false ||
    strictRuntime.required_stage_count !== 18 ||
    strictRuntime.present_stage_count < 0 ||
    strictRuntime.present_stage_count > strictRuntime.required_stage_count ||
    strictRuntime.missing_stage_count !==
      strictRuntime.required_stage_count - strictRuntime.present_stage_count ||
    value.ai_automation.same_run_closed_loop_proven !== strictRuntime.closed ||
    (strictRuntime.closed &&
      (!strictRuntime.contract_compatible ||
        strictRuntime.completion_percent !== 100 ||
        !strictRuntime.same_run_correlation ||
        !strictRuntime.full_trace_same_run_correlation_proven ||
        !strictRuntime.execution_loop_closed)) ||
    (!strictRuntime.closed && strictRuntime.completion_percent !== 0)
  ) {
    return false;
  }
  if (value.supply_chain !== undefined) {
    if (!isRecord(value.supply_chain)) return false;
    if (
      typeof value.supply_chain.package_asset_count !== "number" ||
      typeof value.supply_chain.package_inventory_evidenced !== "boolean" ||
      typeof value.supply_chain.package_digest_pinned_count !== "number" ||
      typeof value.supply_chain.package_digest_unpinned_count !== "number" ||
      typeof value.supply_chain.forbidden_github_supply_chain_asset_count !==
        "number" ||
      typeof value.supply_chain.github_freeze_compliant !== "boolean" ||
      typeof value.supply_chain.runtime_image_policy_compliant !== "boolean" ||
      value.supply_chain.raw_image_identity_returned !== false ||
      value.supply_chain.registry_api_called !== false ||
      value.supply_chain.github_api_used !== false
    ) {
      return false;
    }
  }
  if (value.certificate_inventory !== undefined) {
    if (!isRecord(value.certificate_inventory)) return false;
    if (
      typeof value.certificate_inventory.certificate_asset_count !== "number" ||
      typeof value.certificate_inventory.live_tls_verified_count !== "number" ||
      (value.certificate_inventory.live_tls_evidenced_count !== undefined &&
        typeof value.certificate_inventory.live_tls_evidenced_count !==
          "number") ||
      (value.certificate_inventory.live_tls_healthy_count !== undefined &&
        typeof value.certificate_inventory.live_tls_healthy_count !==
          "number") ||
      typeof value.certificate_inventory.live_tls_unverified_count !==
        "number" ||
      (value.certificate_inventory.live_tls_unhealthy_count !== undefined &&
        typeof value.certificate_inventory.live_tls_unhealthy_count !==
          "number") ||
      typeof value.certificate_inventory.live_tls_health_proven !== "boolean" ||
      value.certificate_inventory.raw_certificate_path_returned !== false ||
      value.certificate_inventory.certificate_material_read !== false ||
      value.certificate_inventory.private_key_material_read !== false
    ) {
      return false;
    }
  }
  return (
    typeof value.summary.managed_asset_count === "number" &&
    typeof value.summary.source_count === "number" &&
    Array.isArray(value.source_health) &&
    typeof value.summary.nist_controlled_percent === "number" &&
    typeof value.summary.overall_security_completion_percent === "number" &&
    isRecord(value.completion) &&
    value.completion.method === "equal_weighted_runtime_conservative_v1" &&
    Array.isArray(value.completion.dimensions) &&
    value.boundaries.aggregate_only === true &&
    value.boundaries.raw_asset_identity_returned === false &&
    value.boundaries.raw_event_payload_returned === false &&
    value.boundaries.raw_discovery_error_returned === false &&
    value.boundaries.secret_value_collection_allowed === false &&
    value.boundaries.live_scan_triggered === false &&
    value.boundaries.runtime_action_triggered === false
  );
}

export type SecurityControlPlaneTone = "healthy" | "warning" | "critical";

export function securityControlPlaneTone(
  payload: SecurityAssetControlPlanePayload,
): SecurityControlPlaneTone {
  if (payload.status !== "ready" || !payload.discovery.fresh) return "critical";
  if (
    !payload.supply_chain ||
    !payload.supply_chain.package_inventory_evidenced ||
    payload.supply_chain.package_digest_unpinned_count > 0 ||
    payload.supply_chain.forbidden_github_supply_chain_asset_count > 0 ||
    !payload.supply_chain.runtime_image_policy_compliant
  ) {
    return "critical";
  }
  if (
    !payload.certificate_inventory ||
    payload.certificate_inventory.certificate_asset_count === 0 ||
    payload.certificate_inventory.live_tls_unverified_count > 0 ||
    (payload.certificate_inventory.live_tls_unhealthy_count ?? 0) > 0 ||
    !payload.certificate_inventory.live_tls_health_proven
  ) {
    return "critical";
  }
  if (
    payload.summary.compliance_violation_count > 0 ||
    payload.summary.nist_controlled_percent < 50 ||
    payload.summary.siem_stage_coverage_percent < 50 ||
    payload.summary.ai_loop_stage_coverage_percent < 50
  ) {
    return "critical";
  }
  if (
    payload.summary.unowned_asset_count > 0 ||
    payload.summary.orphan_asset_count > 0 ||
    payload.summary.automation_coverage_unknown_count > 0 ||
    payload.summary.compliance_unknown_count > 0 ||
    !payload.ai_automation.same_run_closed_loop_proven
  ) {
    return "warning";
  }
  return "healthy";
}

export function topSecurityControlPlaneWorkItems(
  payload: SecurityAssetControlPlanePayload,
  limit = 3,
): SecurityControlPlaneWorkItem[] {
  const rank: Record<string, number> = { P0: 0, P1: 1, P2: 2, P3: 3 };
  return [...payload.work_items]
    .sort(
      (left, right) =>
        (rank[left.priority] ?? 99) - (rank[right.priority] ?? 99) ||
        (left.order ?? 999) - (right.order ?? 999) ||
        left.work_item_id.localeCompare(right.work_item_id),
    )
    .slice(0, Math.max(0, limit));
}