/* Copyright (c) 2026 Juhapekka Piiroinen <jp@1337.fi>
 * All Rights Reserved.
 * AmoosedWeb project: https://amoosed.com
 *
 * OWNER-SIDE EXPERIMENT. Local review installs are not a public SDK or a
 * stable 1.0 ABI.
 */
#ifndef AMOOSEDWEB_COMPILER_PREVIEW_C_H
#define AMOOSEDWEB_COMPILER_PREVIEW_C_H

#include <stdint.h>
#if defined(_WIN32)
# define AMWC_PREVIEW_CALL __cdecl
# if defined(AMWC_PREVIEW_C_BUILD)
#  define AMWC_PREVIEW_API __declspec(dllexport)
# else
#  define AMWC_PREVIEW_API __declspec(dllimport)
# endif
#else
# define AMWC_PREVIEW_CALL
# define AMWC_PREVIEW_API __attribute__((visibility("default")))
#endif
#ifdef __cplusplus
extern "C" {
#endif

#define AMWC_PREVIEW_ABI_REVISION 9u
#define AMWC_PREVIEW_CAP_BUILD_SITE UINT64_C(0x0001)
#define AMWC_PREVIEW_CAP_VERIFY_SITE UINT64_C(0x0002)
#define AMWC_PREVIEW_CAP_EXTERNAL_INDEX UINT64_C(0x0004)
#define AMWC_PREVIEW_CAP_MEMBER_CONTENT UINT64_C(0x0008)
#define AMWC_PREVIEW_CAP_OPERATION_CANCEL UINT64_C(0x0010)
#define AMWC_PREVIEW_CAP_BUILD_PROGRESS UINT64_C(0x0020)
#define AMWC_PREVIEW_CAP_AUDIO_FILE UINT64_C(0x0040)
#define AMWC_PREVIEW_BUILD_SITE_VERIFIED 1u
#define AMWC_PREVIEW_BUILD_CREDENTIALS_PUBLISHED 2u
#define AMWC_PREVIEW_BUILD_SITE_STAGED 3u
#define AMWC_PREVIEW_OK 0
#define AMWC_PREVIEW_INVALID_ARGUMENT 1
#define AMWC_PREVIEW_INVALID_STATE 2
#define AMWC_PREVIEW_BAD_FORMAT 3
#define AMWC_PREVIEW_AUTHENTICATION_FAILED 4
#define AMWC_PREVIEW_VERIFICATION_FAILED 5
#define AMWC_PREVIEW_INPUT_ERROR 6
#define AMWC_PREVIEW_UNSUPPORTED 7
#define AMWC_PREVIEW_CANCELLED 8
#define AMWC_PREVIEW_INTERNAL_ERROR 9
#define AMWC_PREVIEW_BUILD_FAILED 10
#define AMWC_PREVIEW_OUTPUT_EXISTS 11
#define AMWC_PREVIEW_OUTPUT_ERROR 12
#define AMWC_PREVIEW_BUFFER_TOO_SMALL 13

typedef struct amwc_preview_operation amwc_preview_operation;
/* Invoked synchronously on the build thread. CONTEXT remains caller-owned
 * until the build returns. The callback may cancel its operation, but must
 * not release it, re-enter a build with it, or throw across the C boundary.
 * SITE_STAGED means the staged bytes are ready for verification, not trusted.
 * The credential phase means the private directory is temporarily visible;
 * cancellation at that phase removes it before the build returns. */
typedef void (AMWC_PREVIEW_CALL *amwc_preview_build_progress)(
    uint32_t phase, void* context);
AMWC_PREVIEW_API uint32_t AMWC_PREVIEW_CALL amwc_preview_abi_revision(void);
/* Report compiled capabilities, independent of project configuration. Both
 * outputs are required and are set to zero on invalid arguments. These bit
 * assignments remain preview-only until a stable compiler ABI is frozen. */
AMWC_PREVIEW_API int32_t AMWC_PREVIEW_CALL amwc_preview_query(
    uint32_t* out_revision, uint64_t* out_capabilities);
/* Prepare before dispatch. A second thread may cancel. Single-use; release
 * only after the worker call returns. A failed prepare sets *out to NULL. */
AMWC_PREVIEW_API int32_t AMWC_PREVIEW_CALL amwc_preview_operation_prepare(
    amwc_preview_operation** out);
/* Configure before dispatch, without concurrent access to this operation.
 * NULL disables notifications. Verification calls never invoke this callback.
 * Returns INVALID_STATE after an operation has been consumed. */
AMWC_PREVIEW_API int32_t AMWC_PREVIEW_CALL amwc_preview_operation_set_build_progress(
    amwc_preview_operation* operation, amwc_preview_build_progress callback,
    void* context);
AMWC_PREVIEW_API void AMWC_PREVIEW_CALL amwc_preview_operation_cancel(
    amwc_preview_operation* operation);
AMWC_PREVIEW_API void AMWC_PREVIEW_CALL amwc_preview_operation_release(
    amwc_preview_operation* operation);
/* Verify a local complete site or carrier-only overlay. SITE is an absolute,
 * strict UTF-8 path without embedded NUL. Credential bytes are AMWKEY1 text
 * or a packed ICO (NULL/zero selects the hosted favicon). A member key is
 * NULL/zero or exactly 32 raw bytes. Inputs remain owned by the caller until
 * the synchronous call returns. The function publishes no recovered bytes.
 * On failure *out_resources is zero. ERROR is optional (NULL/zero), bounded,
 * and never contains credentials or member content. Operations are consumed
 * by a call, including failed calls. */
AMWC_PREVIEW_API int32_t AMWC_PREVIEW_CALL amwc_preview_verify_site(
    amwc_preview_operation* operation,
    const char* site_utf8, uint64_t site_length,
    const uint8_t* credential, uint64_t credential_length,
    const uint8_t* member_key, uint64_t member_key_length,
    uint64_t* out_resources, char* error, uint64_t error_capacity);
/* Build a public hosted full site from an authored project and a site-owned
 * runtime directory. Every path is absolute strict UTF-8 and length-delimited.
 * The destination must not exist. It checks cancellation before publication,
 * between bundle parts, during WAV encoding, and during verification. Other
 * individual codec calls may finish before cancellation is observed. No site
 * is published on failure or cancellation.
 * The operation is consumed even if argument validation fails. */
AMWC_PREVIEW_API int32_t AMWC_PREVIEW_CALL amwc_preview_build_hosted_site(
    amwc_preview_operation* operation,
    const char* project_utf8, uint64_t project_length,
    const char* runtime_utf8, uint64_t runtime_length,
    const char* output_utf8, uint64_t output_length,
    char* error, uint64_t error_capacity);
/* Build a hosted or external-index site, optionally with member resources.
 * PRIVATE_OUTPUT and INDEX_KEY must be supplied together for an external
 * edition, or both absent for a hosted edition. Keys are raw 32-byte inputs,
 * never command-line arguments. A member key is optional. All input memory
 * stays caller-owned until return; the library clears its key copies. The
 * project configuration must agree with supplied keys and edition. A failed
 * or cancelled build publishes neither destination. Existing site or private
 * output paths return OUTPUT_EXISTS. Authored format, input, verification,
 * and output failures have distinct statuses where the native core can prove
 * their category. BUILD_FAILED remains for unclassified build failures. These
 * preview categories are not frozen. */
AMWC_PREVIEW_API int32_t AMWC_PREVIEW_CALL amwc_preview_build_site(
    amwc_preview_operation* operation,
    const char* project_utf8, uint64_t project_length,
    const char* runtime_utf8, uint64_t runtime_length,
    const char* output_utf8, uint64_t output_length,
    const char* private_output_utf8, uint64_t private_output_length,
    const uint8_t* member_key, uint64_t member_key_length,
    const uint8_t* index_key, uint64_t index_key_length,
    char* error, uint64_t error_capacity);
/* Encode one self-contained standalone WAV with a fresh platform-generated
 * nonce. This does not use a website index or member key. PLAINTEXT is 1-4068
 * bytes; MEDIA_KEY is exactly 32 raw bytes. NULL OUTPUT with zero CAPACITY
 * queries the WAV length. A short buffer returns BUFFER_TOO_SMALL and sets
 * *REQUIRED. Other failures clear *REQUIRED. OUTPUT is unchanged unless the
 * whole WAV fits and encoding succeeds. A length query performs a complete
 * encode with a fresh nonce; a later copy call creates a different valid WAV.
 * This synchronous local call is not cancellable. Caller memory remains owned
 * by the caller and valid until return. */
AMWC_PREVIEW_API int32_t AMWC_PREVIEW_CALL amwc_preview_audio_encode_file(
    const uint8_t* plaintext, uint64_t plaintext_length,
    const uint8_t* media_key, uint64_t media_key_length,
    uint8_t* output, uint64_t capacity, uint64_t* required,
    char* error, uint64_t error_capacity);

#ifdef __cplusplus
}
#endif
#endif