import { buildMcpAttackPathReview } from './mcp/index.js';
import { combineSubscriptions } from './ui-read-model-helpers.js';
export function createSecurityObservabilityReadModels(runtimeServices, options = {}) {
    const { runtimeStore } = runtimeServices;
    return {
        security: {
            getSnapshot() {
                const audit = runtimeServices.tokenAuditor.auditAll(Date.now());
                const mcpServers = [...runtimeStore.getState().mcp.servers.values()].map((server) => ({
                    name: server.name,
                    role: server.role,
                    trustMode: server.trustMode,
                    allowedPaths: server.allowedPaths,
                    allowedHosts: server.allowedHosts,
                    schemaFreshness: server.schemaFreshness,
                    quarantineReason: server.quarantineReason,
                    quarantineDetail: server.quarantineDetail,
                    connected: server.status === 'connected' || server.status === 'degraded',
                }));
                const recentMcpDecisions = runtimeServices.mcpRegistry.listRecentSecurityDecisions(8);
                const attackPathReview = buildMcpAttackPathReview({
                    servers: mcpServers,
                    recentDecisions: recentMcpDecisions,
                });
                const plugins = runtimeServices.pluginManager.list();
                const policySnapshot = runtimeServices.policyRuntimeState.getSnapshot();
                const snapshot = {
                    managed: runtimeServices.tokenAuditor.isManaged,
                    totalTokens: runtimeServices.tokenAuditor.tokenCount,
                    results: audit.results,
                    blocked: audit.blocked,
                    scopeViolations: audit.scopeViolations,
                    rotationWarnings: audit.rotationWarnings,
                    rotationOverdue: audit.rotationOverdue,
                    lastAuditAt: audit.capturedAt,
                    capturedAt: new Date().toISOString(),
                };
                return {
                    audit: snapshot,
                    policy: {
                        preflightStatus: policySnapshot.lastPreflightReview?.status ?? 'n/a',
                        preflightIssueCount: policySnapshot.lastPreflightReview?.issueCount ?? 0,
                        lintFindingCount: policySnapshot.lintFindings.length,
                    },
                    deniedPermissions: runtimeStore.getState().permissions.denialCount,
                    incidents: options.forensicsRegistry?.getAll() ?? [],
                    latestIncident: options.forensicsRegistry?.latest() ?? null,
                    mcpServers,
                    recentMcpDecisions,
                    attackPathReview,
                    plugins,
                    quarantinedPlugins: plugins.filter((plugin) => plugin.quarantined),
                    untrustedPlugins: plugins.filter((plugin) => plugin.trustTier === 'untrusted'),
                };
            },
            subscribe(listener) {
                const unsubs = [
                    runtimeStore.subscribe(listener),
                    runtimeServices.pluginManager.subscribe(listener),
                    runtimeServices.policyRuntimeState.subscribe(listener),
                ];
                if (options.forensicsRegistry) {
                    unsubs.push(options.forensicsRegistry.subscribe(listener));
                }
                return combineSubscriptions(...unsubs);
            },
        },
        mcp: {
            getSnapshot() {
                const state = runtimeStore.getState().mcp;
                const servers = [...state.servers.values()]
                    .map((server) => ({
                    name: server.name,
                    role: server.role,
                    trustMode: server.trustMode,
                    status: server.status,
                    schemaFreshness: server.schemaFreshness,
                    toolCount: server.toolCount,
                    lastError: server.lastError,
                    quarantineReason: server.quarantineReason,
                    quarantineDetail: server.quarantineDetail,
                }))
                    .sort((a, b) => a.name.localeCompare(b.name));
                return {
                    servers,
                    connectedServerNames: state.connectedServerNames,
                    availableToolCount: state.availableToolCount,
                    totalCalls: state.totalCalls,
                    totalErrors: state.totalErrors,
                    recentDecisions: runtimeServices.mcpRegistry.listRecentSecurityDecisions(8),
                };
            },
            subscribe(listener) {
                return runtimeStore.subscribe(listener);
            },
        },
        localAuth: {
            getSnapshot() {
                const snapshot = runtimeServices.localUserAuthManager.inspect();
                return {
                    bootstrapCredentialPresent: snapshot.bootstrapCredentialPresent,
                    userCount: snapshot.userCount,
                    sessionCount: snapshot.sessionCount,
                };
            },
            subscribe() {
                return () => { };
            },
        },
    };
}
