#pragma once
/**
* @file RNT_C_API.h
* @brief C-callable surface over the RNT manager pipeline for OCaml ctypes.
*
* All types are opaque void pointers on the C side; the implementation casts
* them to the appropriate C++ types internally. Callers must never dereference
* handle or cursor pointers directly.
*
* ## Memory contract
* - Strings returned via out-parameters (char**) are heap-allocated by the
* API and must be released with rnt_free_string().
* - Payloads returned via (uint8_t**, size_t*) are heap-allocated and must
* be released with rnt_free_bytes().
* - Handles and cursors are owned by the caller and must be closed before
* the program exits.
*
* ## Error convention
* - Functions returning int use 0 for success and a negative value for error.
* - Functions returning a pointer return NULL on failure.
*
* ## Thread safety
* This API is **not thread-safe**. The global runtime (g_rt) is a single
* in-process instance; all callers share the same ObjectManager and storage
* backend. The expected usage model is a single OCaml thread (or domain)
* driving the API at a time. If concurrent access is needed in the future,
* a per-object or per-relation mutex strategy should be introduced.
*
* @todo Implement AUTH_CLAIM::READ/WRITE enforcement in rnt_open_handle once
* PermissionsManager::Access is wired to a real policy engine. Currently
* all handles open with full access regardless of the claims parameter.
*/
#include <stddef.h>
#include <stdint.h>
#include "Api.h"
#ifdef __cplusplus
extern "C" {
#endif
/** Opaque handle to a registry object opened through HandlerManager. */
typedef void* rnt_handle_t;
/** Opaque cursor over a relation, driven by the VM or used directly. */
typedef void* rnt_cursor_t;
/* ------------------------------------------------------------------ */
/* Runtime lifecycle */
/* ------------------------------------------------------------------ */
/**
* @brief Initializes the RNT runtime with the selected storage backend.
*
* Must be called before any other API function. Once the runtime is
* successfully initialized, subsequent calls are no-ops and return 0.
* If initialization fails (returns negative), the call may be retried
* with corrected parameters — the runtime is left in a clean state.
*
* @param driver Storage driver to use: "sqlite" or "memory".
* "sqlite" persists data to @p storage_path.
* "memory" keeps all data in process memory (ignores
* @p storage_path); intended for tests.
* @param storage_path File path for the SQLite database, or ":memory:" for
* an ephemeral SQLite store. Ignored when driver is
* "memory".
* @return 0 on success, negative on error.
*/
NT_API int rnt_init(const char* driver, const char* storage_path);
/* ------------------------------------------------------------------ */
/* Authentication */
/* ------------------------------------------------------------------ */
/**
* @brief Runs PermissionsManager::Firewall for a connection.
*
* @param auth_method "plain_text" or "certificate".
* @param claims_out Set to a heap-allocated, newline-separated claim string.
* Release with rnt_free_string(). NULL on error.
* @return 0 on success, negative when authentication is rejected.
*/
NT_API int rnt_firewall(const char* auth_method, char** claims_out);
/* ------------------------------------------------------------------ */
/* Session lifecycle */
/* ------------------------------------------------------------------ */
/**
* @brief Opens a session and registers it at /system/sessions/<hash>.
*
* The runtime mints a random 256-bit hex hash for the session; the caller
* has no influence over the value. The returned string is the opaque
* identifier required by every other rnt_session_* call.
*
* @param connection_context Caller-owned pointer carried on the session.
* The runtime treats it as opaque; ownership of
* the pointee remains with the caller.
* @param session_hash_out Set to a heap-allocated 64-char hex string.
* Release with rnt_free_string().
* @return 0 on success, negative on error.
*/
NT_API int rnt_session_open(void* connection_context, char** session_hash_out);
/**
* @brief Closes a session, unregistering it from /system/sessions/<hash>.
*
* After this call the session hash is invalid; subsequent rnt_session_* or
* resolver lookups against it will fail. Branch overrides held by the
* session are dropped.
*
* @param session_hash Hash returned by rnt_session_open.
* @return 0 on success, negative when the hash does not match an active session.
*/
NT_API int rnt_session_close(const char* session_hash);
/**
* @brief Sets a per-session override for a branch.
*
* While the override is in effect, paths resolved through
* /system/sessions/<hash>/branches/<branch_name>/... point at
* /system/snapshots/<target_hash>/... regardless of where the global branch
* HEAD currently sits. Pass an empty string for @p target_hash to remove
* the override and resume falling back to the global branch.
*
* Non-empty target hashes must correspond to an existing
* /system/snapshots/<target_hash> entry; otherwise the call fails.
*
* @param session_hash Session identifier.
* @param branch_name Branch the override applies to (e.g. "main").
* @param target_hash Snapshot hash to bind, or "" to clear.
* @return 0 on success, negative on error.
*/
NT_API int rnt_session_set_branch(const char* session_hash,
const char* branch_name,
const char* target_hash);
/* ------------------------------------------------------------------ */
/* Handle lifecycle */
/* ------------------------------------------------------------------ */
/**
* @brief Opens a handle to the object at the given slash-separated path.
*
* Runs the full HandlerManager::Open pipeline:
* ObjectManager::Find → PermissionsManager::Access →
* IdentityManager::CanOpen → LifecycleManager::Contention →
* LifecycleManager::Monitor.
*
* @param path Slash-separated logical path, e.g. "/system/branches/main".
* @param claims Claim string returned by rnt_firewall (may be NULL).
* @return Handle pointer, or NULL when the path is not found or access is denied.
*/
NT_API rnt_handle_t rnt_open_handle(const char* path, const char* claims);
/**
* @brief Closes a handle, running HandlerManager::Close and Unmonitor.
* @return 0 on success, negative on error.
*/
NT_API int rnt_close_handle(rnt_handle_t handle);
/**
* @brief Reads the current branch-tree root hash from a BRANCH object.
*
* Only valid for handles opened on BRANCH objects. The returned string is
* the merkle_root of the BRANCH_TREE this branch currently points at — a
* `Merkle<std::string>` root mapping mg_name → mg_hash. An empty string
* indicates an unborn branch with no commits yet.
*
* @param handle Handle to a BRANCH object.
* @param target_hash_out Set to a heap-allocated copy of the target hash
* (possibly empty). Release with rnt_free_string().
* @return 0 on success, negative when the handle is not a BRANCH.
*/
NT_API int rnt_branch_target(rnt_handle_t handle, char** target_hash_out);
/**
* @brief Atomically advances a branch to point at a new branch-tree root.
*
* The new hash must already exist as a content-addressed blob in the KV
* store — branch-tree roots are produced by mutating calls (rnt_link_tuple,
* rnt_register_relation, …) and cannot be invented externally. Pass an
* empty string to reset the branch to unborn.
*
* Write exclusion is structural: BRANCH objects carry @c exclusive=true in
* their object_type, so LifecycleManager::Contention prevents a second handle
* from being opened while a writer holds the branch. AUTH_CLAIM::WRITE is not
* checked at the C API boundary.
*
* @param branch_path Slash-separated branch path, e.g. "/system/branches/main".
* @param new_hash Branch-tree root to advance to (64-char lowercase hex),
* or "" to reset to unborn.
* @return 0 on success, negative when the branch is not found, the type is
* not BRANCH, or @p new_hash is non-empty but no matching blob
* exists in the KV store.
*/
NT_API int rnt_branch_advance(const char* branch_path, const char* new_hash);
/* ------------------------------------------------------------------ */
/* Object registration */
/* ------------------------------------------------------------------ */
/**
* @brief Registers a RELATION object at the given path.
*
* Idempotent: if an object already exists at the path, the call succeeds
* without re-registering.
*
* @param path Slash-separated path of the form
* "/system/branches/<branch>/multigroups/<mg>/relations/<rel>".
* @return 0 on success, negative on error.
*/
NT_API int rnt_register_relation(const char* path);
/**
* @brief Registers a BRANCH object at the given path pointing at a branch-tree root.
*
* If a BRANCH already exists at this path, returns 0 without modifying it.
* When @p target_hash is non-NULL and non-empty it must already exist as a
* content-addressed blob in the KV store (produced by an earlier mutation
* through the same runtime); otherwise the call fails. Pass NULL or "" to
* register an unborn branch.
*
* @param path Slash-separated path, e.g. "/system/branches/main".
* @param target_hash Branch-tree root this branch points at (may be NULL
* or "" for unborn).
* @return 0 on success, negative on error.
*/
NT_API int rnt_register_branch(const char* path, const char* target_hash);
/**
* @brief Lists all relations of a specific multigroup under a branch.
*
* Returns a newline-delimited string of "name\troot_hash" pairs, one per
* relation in the named multigroup at the branch's current tree. An unborn
* branch or an mg absent from the branch tree yields an empty string. The
* caller must release the string with rnt_free_string().
*
* @param branch_mg_path Slash-separated path of the form
* "/system/branches/<name>/multigroups/<mg>".
* @param out Set to a heap-allocated "name\troot\n" string.
* Release with rnt_free_string(). NULL on error.
* @return 0 on success, negative when the path shape is wrong or the branch
* is not found.
*/
NT_API int rnt_list_relations(const char* branch_mg_path, char** out);
/**
* @brief Lists all multigroups bound to a branch.
*
* Reads the branch-tree root from `/system/branches/<name>` and pages each
* (mg_name, mg_hash) entry. Returns "name\thash\n" lines. Unborn branches
* yield an empty string.
*
* @param branch_path Slash-separated branch path, e.g. "/system/branches/main".
* @param out Heap-allocated string; release with rnt_free_string().
* @return 0 on success, negative when the branch is not found.
*/
NT_API int rnt_list_branch_multigroups(const char* branch_path, char** out);
/**
* @brief Lists all relations stored in a specific snapshot.
*
* Reads the multigroup codec directly from the snapshot at
* /system/snapshots/<snapshot_hash> without following any branch HEAD.
* Use this when the desired snapshot hash is already known (e.g. detached
* checkout). Returns the same "name\troot_hash\n" format as rnt_list_relations.
*
* @param snapshot_hash 64-char hex hash of the snapshot.
* @param out Set to heap-allocated string. Release with rnt_free_string().
* @return 0 on success, negative when the snapshot is not registered.
*/
NT_API int rnt_list_snapshot_relations(const char* snapshot_hash, char** out);
/* ------------------------------------------------------------------ */
/* Tuple storage */
/* ------------------------------------------------------------------ */
/**
* @brief Stores a tuple and links it to the relation at the given path.
*
* Tuples are encoded as a flat key=value string, one attribute per line:
* "name=Blathers\nprofession=Museum Curator\n"
* Attributes are sorted by name before hashing to ensure content-addressing
* is order-independent.
*
* @param relation_path Slash-separated relation path.
* @param kv_attrs Newline-delimited "key=value" attribute string.
* @param hash_out Set to the 64-character hex SHA-256 hash of the tuple.
* Release with rnt_free_string(). NULL on error.
* @return 0 on success, negative on error.
*/
NT_API int rnt_link_tuple(const char* relation_path,
const char* kv_attrs,
char** hash_out);
/**
* @brief Removes a tuple from the relation's Merkle tree and tuple store.
*
* Calls Merkle::Remove on the relation's current root and updates
* ObjectManager::Relation::merkle_root atomically. The tuple bytes remain in
* the KV store (they may be referenced by older snapshots); only the
* membership in the current tree is removed.
*
* @param relation_path Slash-separated relation path.
* @param tuple_hash 64-character hex SHA-256 of the tuple to remove.
* @return 0 on success, negative when the relation is not found.
*/
NT_API int rnt_unlink_tuple(const char* relation_path, const char* tuple_hash);
/**
* @brief Resets a relation's Merkle root to the empty-tree state.
*
* Sets ObjectManager::Relation::merkle_root to the empty string. Existing
* tuple bytes remain in the KV store. After this call the relation contains
* no tuples from the perspective of cursor iteration.
*
* @param relation_path Slash-separated relation path.
* @return 0 on success, negative when the relation is not found.
*/
NT_API int rnt_clear_relation(const char* relation_path);
/**
* @brief Returns the current Merkle root hash for a relation.
*
* OCaml calls this after rnt_link_tuple or rnt_unlink_tuple to read the
* updated root back and store it in the in-memory multigroup (tree_pointer).
* An empty string is returned for a relation that contains no tuples.
*
* @param relation_path Slash-separated relation path.
* @param root_hash_out Set to the 64-character hex root hash, or to an empty
* heap-allocated string for an empty relation.
* Release with rnt_free_string().
* @return 0 on success, negative when the relation is not found.
*/
NT_API int rnt_relation_root(const char* relation_path, char** root_hash_out);
/* ------------------------------------------------------------------ */
/* Cursor and VM */
/* ------------------------------------------------------------------ */
/**
* @brief Opens a cursor on the relation referenced by handle.
*
* The returned cursor is positioned before the first tuple. Advance it with
* rnt_cursor_next(). The cursor must be closed with rnt_cursor_close() before
* closing the handle.
*
* @param handle Open RELATION handle.
* @return Cursor pointer, or NULL on error.
*/
NT_API rnt_cursor_t rnt_cursor_open(rnt_handle_t handle);
/**
* @brief Advances the cursor and returns the next tuple as a kv string.
*
* The tuple is encoded as a newline-delimited "key=value" string matching the
* format accepted by rnt_link_tuple:
* "name=Blathers\nprofession=Museum Curator\n"
*
* @param cursor Open cursor.
* @param tuple_out Set to a heap-allocated kv string, or NULL when exhausted.
* Release with rnt_free_string() when non-NULL.
* @return 1 when a tuple was returned, 0 when exhausted, negative on error.
*/
NT_API int rnt_cursor_next(rnt_cursor_t cursor, char** tuple_out);
/**
* @brief Closes a cursor and releases its resources.
* @return 0 on success, negative on error.
*/
NT_API int rnt_cursor_close(rnt_cursor_t cursor);
/* ------------------------------------------------------------------ */
/* VM plan builder */
/* ------------------------------------------------------------------ */
/** Opaque plan node tree, built incrementally via rnt_plan_* calls. */
typedef void* rnt_plan_t;
/**
* @brief Creates a SCAN plan node that reads all tuples from a stored relation.
*
* Opens a RELATION handle and cursor internally. Both are transferred to the
* plan and released when the resulting VM cursor is closed.
*
* @param relation_path Absolute slash-separated path to the relation, e.g.
* "/system/branches/main/multigroups/warehouse/relations/public:users".
* @return Plan node, or NULL when the relation does not exist or cannot be opened.
*/
NT_API rnt_plan_t rnt_plan_scan(const char* relation_path);
/**
* @brief Creates a nested-loop JOIN plan node.
*
* Takes ownership of both @p left and @p right. On success the caller must not
* free either child; they are released when the returned plan is freed or
* executed. On failure (NULL return) both children are freed.
*
* @return Plan node, or NULL on error.
*/
NT_API rnt_plan_t rnt_plan_join(rnt_plan_t left, rnt_plan_t right);
/**
* @brief Creates a TAKE plan node that limits output to at most @p limit tuples.
*
* Takes ownership of @p source. On failure @p source is freed.
*
* @return Plan node, or NULL on error.
*/
NT_API rnt_plan_t rnt_plan_take(rnt_plan_t source, size_t limit);
/**
* @brief Releases a plan that was built but not yet executed.
*
* Closes any open cursors and handles owned by the plan tree, then frees all
* nodes. Safe to call with NULL. Do NOT call after rnt_vm_execute_plan —
* that function takes ownership.
*/
NT_API void rnt_plan_free(rnt_plan_t plan);
/**
* @brief Executes a plan tree and returns a streaming VM cursor.
*
* Takes ownership of @p plan; the caller must not call rnt_plan_free after this.
* The returned cursor is advanced with rnt_vm_cursor_next() and must be closed
* with rnt_vm_cursor_close(), which also releases all plan resources.
*
* @return VM cursor, or NULL when the plan is NULL.
*/
NT_API rnt_cursor_t rnt_vm_execute_plan(rnt_plan_t plan);
/**
* @brief Advances a VM cursor and returns the next merged tuple as a kv string.
*
* Same encoding and return-value semantics as rnt_cursor_next.
*
* @param vm_cursor Cursor returned by rnt_vm_execute_plan.
* @param tuple_out Set to a heap-allocated kv string, or NULL when exhausted.
* Release with rnt_free_string() when non-NULL.
* @return 1 when a tuple was returned, 0 when exhausted, negative on error.
*/
NT_API int rnt_vm_cursor_next(rnt_cursor_t vm_cursor, char** tuple_out);
/**
* @brief Closes a VM cursor, releases all plan nodes, cursors, and handles.
* @return 0 on success, negative on error.
*/
NT_API int rnt_vm_cursor_close(rnt_cursor_t vm_cursor);
/* ------------------------------------------------------------------ */
/* Memory management */
/* ------------------------------------------------------------------ */
/** @brief Releases a string allocated by the API. Safe to call with NULL. */
NT_API void rnt_free_string(char* s);
/** @brief Releases a byte buffer allocated by the API. Safe to call with NULL. */
NT_API void rnt_free_bytes(uint8_t* p);
#ifdef __cplusplus
}
#endif
