/*
  StarForth — Steady-State Virtual Machine Runtime

  Copyright (c) 2023–2025 Robert A. James
  All rights reserved.

  This file is part of the StarForth project.

  Licensed under the StarForth License, Version 1.0 (the "License");
  you may not use this file except in compliance with the License.

  You may obtain a copy of the License at:
      https://github.com/star.4th@proton.me/StarForth/LICENSE.txt

  This software is provided "AS IS", WITHOUT WARRANTY OF ANY KIND,
  express or implied, including but not limited to the warranties of
  merchantability, fitness for a particular purpose, and noninfringement.

 See the License for the specific language governing permissions and
 limitations under the License.

 */

/**
 * vm_uuid.h - 128-bit VM identifiers (FABRIC.md punch list item 3.8)
 *
 * Replaces capsule_birth.c's monotonic uint32_t vm_id with a wider,
 * RFC-4122-shaped identifier. NOT real randomness: this kernel has no RNG
 * source at all (checked directly against QEMU 10.2.1's actual CPU feature
 * set -- amd64 RDRAND and riscv64 Zkr are both available, aarch64 has
 * neither RNDR nor any RNG property on any CPU model including "max"), and
 * Captain Bob ruled a uniform fallback across all three ISAs rather than a
 * per-architecture split. Values are generated by a deterministic PRNG
 * (splitmix64) seeded from the Mama capsule's content hash -- the same
 * capsule booted twice produces the same ID sequence, preserving the
 * run-to-run reproducibility this project has relied on everywhere else
 * (the dict_hash regression check after every prior item this session).
 */

#ifndef STARKERNEL_VM_UUID_H
#define STARKERNEL_VM_UUID_H

#ifdef __STARKERNEL__

#include <stdint.h>

typedef struct {
    uint64_t hi;
    uint64_t lo;
} VMUuid;

/*
 * vm_uuid_hera - The fixed, reserved identifier for Hera (patron zero,
 * item 3.6; VM 0 in the pre-item-3.8 scheme). Not drawn from the pool --
 * capsule_birth.c's KILL logic ("Hera cannot be killed") and the fleet
 * heat-fanout parent-chain sentinel (capsule_run.h's `parent_vm_id`
 * comment: "self-referential, parent_vm_id == vm_id == 0") both depend on
 * Hera's id being a fixed, cheaply-comparable value, exactly as 0 was
 * before this item. All-zero.
 */
VMUuid vm_uuid_hera(void);
int    vm_uuid_is_hera(VMUuid id);

/*
 * vm_uuid_none - Sentinel meaning "no id" / "slot not in use." All-ones --
 * NOT all-zero, because all-zero is Hera's reserved value (item 3.8 caught
 * this collision before writing any code that could have repeated the
 * STADIUM_CONTAINS_NONE mistake at a new site).
 */
VMUuid vm_uuid_none(void);
int    vm_uuid_is_none(VMUuid id);

int vm_uuid_equal(VMUuid a, VMUuid b);

/*
 * vm_uuid_pool_init - Seed the generator. Call once, after the Mama
 * capsule's content hash is known (right after capsule_birth_mama()
 * succeeds) and before the first non-Hera VM birth. Idempotent to call
 * again (re-seeds and refills), though nothing does today.
 */
void vm_uuid_pool_init(uint64_t seed);

/*
 * vm_uuid_next - Pop the next id from the pre-filled FIFO pool, refilling
 * with a fresh batch (continuing the same deterministic splitmix64 stream)
 * when empty. If called before vm_uuid_pool_init() (not the intended path),
 * self-seeds from a fixed default rather than returning garbage -- flagged
 * as a safety net, not normal use.
 */
VMUuid vm_uuid_next(void);

/*
 * vm_uuid_format - Writes the RFC-4122-shaped string
 * "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" (36 chars + NUL) into buf.
 * @param buf  Caller-provided buffer, at least 37 bytes.
 */
void vm_uuid_format(VMUuid id, char *buf);

#endif /* __STARKERNEL__ */

#endif /* STARKERNEL_VM_UUID_H */