ahri_tre_app/

browser_domain_discovery.rs

use crate::browser_study_discovery::{BrowserStudyDiscoverySource, browser_study_facts};
use crate::cursor_integrity::hmac_sha256;
use ahri_tre_protocol::{
    ProtocolVersion, PublicUuid,
    domain::{
        BrowserDomainCollectionFilters, BrowserDomainCollectionRequest,
        BrowserDomainCollectionResponse, BrowserDomainDetailRequest, BrowserDomainDetailResponse,
        BrowserDomainEmptyState, BrowserDomainPageMetadata, BrowserDomainRecord,
        BrowserDomainStudyCollectionRequest, BrowserDomainStudyCollectionResponse,
        BrowserDomainTextFilter, BrowserDomainVariableCollectionRequest,
        BrowserDomainVariableCollectionResponse, BrowserDomainVariableDetail,
        BrowserDomainVariableDetailRequest, BrowserDomainVariableDetailResponse,
        BrowserDomainVariableRecord, BrowserDomainVariableVocabulary, BrowserVocabularyDetail,
        BrowserVocabularyDetailRequest, BrowserVocabularyDetailResponse,
        BrowserVocabularyItemCollectionRequest, BrowserVocabularyItemCollectionResponse,
        BrowserVocabularyItemRecord, BrowserVocabularyMappingCollectionRequest,
        BrowserVocabularyMappingCollectionResponse, BrowserVocabularyMappingEndpoint,
        BrowserVocabularyMappingRecord,
    },
    refs::{DomainRef, TagRef, TagScope, TagSummary, VariableRef, VocabularyRef},
};
use ahri_tre_types::{DomainId, VariableId, VocabularyId};
use serde::{Deserialize, Serialize};
use sha2::{Digest, Sha256};
use std::fmt;
use std::sync::OnceLock;
use thiserror::Error;
use uuid::Uuid;

const DEFAULT_LIMIT: u16 = 100;
const MAX_LIMIT: u16 = 500;
const COLLECTION: &str = "domains";
const ORDERING: &str = "name_identity_v1";
const ORDERING_DESCRIPTION: &str =
    "Case-insensitive Domain name ascending, then stable Domain identity ascending.";
const STUDY_ORDERING_DESCRIPTION: &str =
    "Case-insensitive Study name ascending, then stable Study identity ascending.";
static CURSOR_MAC_KEY: OnceLock<[u8; 16]> = OnceLock::new();
const DOMAIN_STUDIES_COLLECTION: &str = "domain_studies";
const DOMAIN_VARIABLES_COLLECTION: &str = "domain_variables";
const VARIABLE_ORDERING_DESCRIPTION: &str =
    "Case-insensitive Variable name ascending, then stable Variable identity ascending.";
const VOCABULARY_ITEMS_COLLECTION: &str = "vocabulary_items";
const VOCABULARY_ITEM_ORDERING: &str = "code_identity_v1";
const VOCABULARY_ITEM_ORDERING_DESCRIPTION: &str =
    "Public integer code ascending, then stable Vocabulary item identity ascending.";
const VOCABULARY_MAPPINGS_COLLECTION: &str = "vocabulary_mappings";
const VOCABULARY_MAPPING_ORDERING: &str = "source_target_identity_v1";
const VOCABULARY_MAPPING_ORDERING_DESCRIPTION: &str = "Source Vocabulary identity, source item code and identity, target Vocabulary identity, target item code and identity, then stable mapping identity ascending.";

#[derive(Debug, Error, Clone, PartialEq, Eq)]
pub enum BrowserDomainDiscoveryError {
    #[error("invalid catalogue reference")]
    InvalidReference(Box<ahri_tre_protocol::ProtocolError>),
    #[error("selected datastore identity is invalid")]
    InvalidDatastoreIdentity,
    #[error("selected datastore is unavailable")]
    DatastoreUnavailable,
    #[error("selected datastore is unavailable for associated Study discovery")]
    StudyDatastoreUnavailable,
    #[error("browser Domain discovery authority is unavailable")]
    AuthorityUnavailable,
    #[error("Domain was not found")]
    DomainNotFound,
    #[error("Variable was not found")]
    VariableNotFound,
    #[error("Vocabulary was not found")]
    VocabularyNotFound,
    #[error("page request is invalid")]
    InvalidPage,
    #[error("Domain collection filters are invalid")]
    InvalidFilters,
    #[error("cursor is invalid or does not match this collection")]
    InvalidCursor,
    #[error("cursor is stale")]
    StaleCursor,
    #[error("protocol version is unsupported")]
    UnsupportedVersion,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct BrowserDomainSourceRecord {
    pub domain: ahri_tre_pgmeta::PgDomainReadModel,
    pub tags: Vec<ahri_tre_pgmeta::PgTagReadModel>,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct BrowserDomainVariableSourceRecord {
    pub variable: ahri_tre_pgmeta::PgVariableReadModel,
    pub vocabulary: Option<ahri_tre_pgmeta::PgVocabularyReadModel>,
    pub tags: Vec<ahri_tre_pgmeta::PgTagReadModel>,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct BrowserVocabularySource {
    pub vocabulary: ahri_tre_pgmeta::PgVocabularyReadModel,
    pub items: Vec<ahri_tre_pgmeta::PgVocabularyItemReadModel>,
    pub mappings: Vec<BrowserVocabularyMappingSourceRecord>,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct BrowserVocabularyMappingSourceRecord {
    pub mapping: ahri_tre_pgmeta::PgVocabularyMappingReadModel,
    pub from_item: ahri_tre_pgmeta::PgVocabularyItemReadModel,
    pub from_domain_id: DomainId,
    pub to_item: ahri_tre_pgmeta::PgVocabularyItemReadModel,
    pub to_domain_id: DomainId,
}

/// Metadata-only capability consumed by Domain and Vocabulary browser workflows.
pub trait BrowserDomainDiscoveryCapability: fmt::Debug + Send + Sync {
    fn discover_domains(
        &self,
        datastore_id: PublicUuid,
    ) -> Result<Vec<BrowserDomainSourceRecord>, BrowserDomainDiscoveryError>;

    fn discover_domain_studies(
        &self,
        datastore_id: PublicUuid,
        domain_id: DomainId,
    ) -> Result<BrowserStudyDiscoverySource, BrowserDomainDiscoveryError>;

    fn discover_domain_variables(
        &self,
        datastore_id: PublicUuid,
        domain_id: DomainId,
    ) -> Result<Vec<BrowserDomainVariableSourceRecord>, BrowserDomainDiscoveryError>;

    fn discover_vocabulary(
        &self,
        datastore_id: PublicUuid,
        vocabulary_id: VocabularyId,
        include_items: bool,
        include_mappings: bool,
    ) -> Result<Option<BrowserVocabularySource>, BrowserDomainDiscoveryError>;
}

pub fn list_browser_domains(
    capability: &dyn BrowserDomainDiscoveryCapability,
    request: &BrowserDomainCollectionRequest,
) -> Result<BrowserDomainCollectionResponse, BrowserDomainDiscoveryError> {
    for tag in &request.filters.any_tags {
        crate::browser_catalogue_search::validate_tag(request.datastore_id, tag)
            .map_err(|error| BrowserDomainDiscoveryError::InvalidReference(Box::new(error)))?;
    }
    collection_response(
        capability.discover_domains(request.datastore_id)?,
        request.datastore_id,
        request.filters.clone(),
        Some(request.page.limit),
        request.page.cursor.as_deref(),
        request.requested_protocol_version.as_deref(),
    )
}

pub fn get_browser_domain(
    capability: &dyn BrowserDomainDiscoveryCapability,
    request: &BrowserDomainDetailRequest,
) -> Result<BrowserDomainDetailResponse, BrowserDomainDiscoveryError> {
    request
        .domain
        .validate_context(
            request.datastore_id,
            ahri_tre_protocol::refs::ObjectKind::Domain,
        )
        .map_err(|error| BrowserDomainDiscoveryError::InvalidReference(Box::new(error)))?;
    detail_response(
        capability.discover_domains(request.datastore_id)?,
        request.datastore_id,
        request.domain.id,
        request.requested_protocol_version.as_deref(),
    )
}

pub fn list_browser_domain_studies(
    capability: &dyn BrowserDomainDiscoveryCapability,
    request: &BrowserDomainStudyCollectionRequest,
) -> Result<BrowserDomainStudyCollectionResponse, BrowserDomainDiscoveryError> {
    request
        .domain
        .validate_context(
            request.datastore_id,
            ahri_tre_protocol::refs::ObjectKind::Domain,
        )
        .map_err(|error| BrowserDomainDiscoveryError::InvalidReference(Box::new(error)))?;
    get_browser_domain(
        capability,
        &BrowserDomainDetailRequest {
            datastore_id: request.datastore_id,
            domain: request.domain,
            requested_protocol_version: request.requested_protocol_version.clone(),
        },
    )?;
    let domain_id =
        internal_domain_id(request.domain.id).ok_or(BrowserDomainDiscoveryError::DomainNotFound)?;
    study_collection_response(
        capability.discover_domain_studies(request.datastore_id, domain_id)?,
        request.domain.id,
        Some(request.page.limit),
        request.page.cursor.as_deref(),
        request.requested_protocol_version.as_deref(),
    )
}

pub fn list_browser_domain_variables(
    capability: &dyn BrowserDomainDiscoveryCapability,
    request: &BrowserDomainVariableCollectionRequest,
) -> Result<BrowserDomainVariableCollectionResponse, BrowserDomainDiscoveryError> {
    request
        .domain
        .validate_context(
            request.datastore_id,
            ahri_tre_protocol::refs::ObjectKind::Domain,
        )
        .map_err(|error| BrowserDomainDiscoveryError::InvalidReference(Box::new(error)))?;
    ensure_browser_domain(capability, request.datastore_id, request.domain.id)?;
    let domain_id =
        internal_domain_id(request.domain.id).ok_or(BrowserDomainDiscoveryError::DomainNotFound)?;
    variable_collection_response(
        capability.discover_domain_variables(request.datastore_id, domain_id)?,
        request.datastore_id,
        request.domain.id,
        Some(request.page.limit),
        request.page.cursor.as_deref(),
        None,
    )
}

pub fn get_browser_domain_variable(
    capability: &dyn BrowserDomainDiscoveryCapability,
    request: &BrowserDomainVariableDetailRequest,
) -> Result<BrowserDomainVariableDetailResponse, BrowserDomainDiscoveryError> {
    request
        .variable
        .validate_context(
            request.datastore_id,
            ahri_tre_protocol::refs::ObjectKind::Variable,
        )
        .map_err(|error| BrowserDomainDiscoveryError::InvalidReference(Box::new(error)))?;

    request
        .domain
        .validate_context(
            request.datastore_id,
            ahri_tre_protocol::refs::ObjectKind::Domain,
        )
        .map_err(|error| BrowserDomainDiscoveryError::InvalidReference(Box::new(error)))?;
    ensure_browser_domain(capability, request.datastore_id, request.domain.id)?;
    let domain_id =
        internal_domain_id(request.domain.id).ok_or(BrowserDomainDiscoveryError::DomainNotFound)?;
    variable_detail_response(
        capability.discover_domain_variables(request.datastore_id, domain_id)?,
        request.datastore_id,
        request.domain.id,
        request.variable.id,
        None,
    )
}

pub fn get_browser_vocabulary(
    capability: &dyn BrowserDomainDiscoveryCapability,
    request: &BrowserVocabularyDetailRequest,
) -> Result<BrowserVocabularyDetailResponse, BrowserDomainDiscoveryError> {
    request
        .vocabulary
        .validate_context(
            request.datastore_id,
            ahri_tre_protocol::refs::ObjectKind::Vocabulary,
        )
        .map_err(|error| BrowserDomainDiscoveryError::InvalidReference(Box::new(error)))?;

    request
        .domain
        .validate_context(
            request.datastore_id,
            ahri_tre_protocol::refs::ObjectKind::Domain,
        )
        .map_err(|error| BrowserDomainDiscoveryError::InvalidReference(Box::new(error)))?;
    let source = discover_browser_vocabulary(
        capability,
        request.datastore_id,
        request.domain.id,
        request.vocabulary.id,
        false,
        false,
    )?;
    vocabulary_detail_response(
        source,
        request.datastore_id,
        request.domain.id,
        request.vocabulary.id,
    )
}

pub fn list_browser_vocabulary_items(
    capability: &dyn BrowserDomainDiscoveryCapability,
    request: &BrowserVocabularyItemCollectionRequest,
) -> Result<BrowserVocabularyItemCollectionResponse, BrowserDomainDiscoveryError> {
    request
        .vocabulary
        .validate_context(
            request.datastore_id,
            ahri_tre_protocol::refs::ObjectKind::Vocabulary,
        )
        .map_err(|error| BrowserDomainDiscoveryError::InvalidReference(Box::new(error)))?;

    request
        .domain
        .validate_context(
            request.datastore_id,
            ahri_tre_protocol::refs::ObjectKind::Domain,
        )
        .map_err(|error| BrowserDomainDiscoveryError::InvalidReference(Box::new(error)))?;
    let source = discover_browser_vocabulary(
        capability,
        request.datastore_id,
        request.domain.id,
        request.vocabulary.id,
        true,
        false,
    )?;
    vocabulary_item_collection_response(
        source,
        request.datastore_id,
        request.domain.id,
        request.vocabulary.id,
        Some(request.page.limit),
        request.page.cursor.as_deref(),
    )
}

pub fn list_browser_vocabulary_mappings(
    capability: &dyn BrowserDomainDiscoveryCapability,
    request: &BrowserVocabularyMappingCollectionRequest,
) -> Result<BrowserVocabularyMappingCollectionResponse, BrowserDomainDiscoveryError> {
    request
        .vocabulary
        .validate_context(
            request.datastore_id,
            ahri_tre_protocol::refs::ObjectKind::Vocabulary,
        )
        .map_err(|error| BrowserDomainDiscoveryError::InvalidReference(Box::new(error)))?;

    request
        .domain
        .validate_context(
            request.datastore_id,
            ahri_tre_protocol::refs::ObjectKind::Domain,
        )
        .map_err(|error| BrowserDomainDiscoveryError::InvalidReference(Box::new(error)))?;
    let source = discover_browser_vocabulary(
        capability,
        request.datastore_id,
        request.domain.id,
        request.vocabulary.id,
        false,
        true,
    )?;
    vocabulary_mapping_collection_response(
        source,
        request.datastore_id,
        request.domain.id,
        request.vocabulary.id,
        Some(request.page.limit),
        request.page.cursor.as_deref(),
    )
}

fn ensure_browser_domain(
    capability: &dyn BrowserDomainDiscoveryCapability,
    datastore_id: PublicUuid,
    domain_id: PublicUuid,
) -> Result<(), BrowserDomainDiscoveryError> {
    detail_response(
        capability.discover_domains(datastore_id)?,
        datastore_id,
        domain_id,
        None,
    )?;
    Ok(())
}

fn discover_browser_vocabulary(
    capability: &dyn BrowserDomainDiscoveryCapability,
    datastore_id: PublicUuid,
    domain_id: PublicUuid,
    vocabulary_id: PublicUuid,
    include_items: bool,
    include_mappings: bool,
) -> Result<BrowserVocabularySource, BrowserDomainDiscoveryError> {
    ensure_browser_domain(capability, datastore_id, domain_id)?;
    let internal = internal_vocabulary_id(vocabulary_id)
        .ok_or(BrowserDomainDiscoveryError::VocabularyNotFound)?;
    capability
        .discover_vocabulary(datastore_id, internal, include_items, include_mappings)?
        .ok_or(BrowserDomainDiscoveryError::VocabularyNotFound)
}

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
enum Direction {
    Forward,
    Backward,
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
struct Cursor {
    datastore_id: PublicUuid,
    collection: String,
    limit: u16,
    ordering: String,
    direction: Direction,
    boundary: usize,
    protocol_version: String,
    snapshot: String,
    #[serde(default)]
    filters: BrowserDomainCollectionFilters,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    domain_id: Option<PublicUuid>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    vocabulary_id: Option<PublicUuid>,
    integrity: String,
}

pub fn collection_response(
    mut source: Vec<BrowserDomainSourceRecord>,
    datastore_id: PublicUuid,
    mut filters: BrowserDomainCollectionFilters,
    limit: Option<u16>,
    raw_cursor: Option<&str>,
    requested_version: Option<&str>,
) -> Result<BrowserDomainCollectionResponse, BrowserDomainDiscoveryError> {
    for tag in &filters.any_tags {
        crate::browser_catalogue_search::validate_tag(datastore_id, tag)
            .map_err(|error| BrowserDomainDiscoveryError::InvalidReference(Box::new(error)))?;
    }
    let mut validation_request = BrowserDomainCollectionRequest {
        datastore_id,
        filters,
        page: ahri_tre_protocol::pagination::PageRequest::default(),
        requested_protocol_version: requested_version.map(str::to_owned),
    };
    validation_request
        .normalize_and_validate()
        .map_err(|_| BrowserDomainDiscoveryError::InvalidFilters)?;
    filters = validation_request.filters;
    let version = requested_version
        .map(ProtocolVersion::parse)
        .transpose()
        .map_err(|_| BrowserDomainDiscoveryError::UnsupportedVersion)?
        .unwrap_or_default();
    version
        .ensure_supported(&ProtocolVersion::current())
        .map_err(|_| BrowserDomainDiscoveryError::UnsupportedVersion)?;
    let limit = limit.unwrap_or(DEFAULT_LIMIT);
    if limit == 0 || limit > MAX_LIMIT {
        return Err(BrowserDomainDiscoveryError::InvalidPage);
    }
    source.retain(|record| domain_matches_filters(record, &filters));
    source.sort_by(|a, b| {
        a.domain
            .name
            .to_lowercase()
            .cmp(&b.domain.name.to_lowercase())
            .then(a.domain.domain_id.0.cmp(&b.domain.domain_id.0))
    });
    let snapshot = snapshot(&source);
    let (start, direction) = match raw_cursor {
        None => (0, Direction::Forward),
        Some(raw) => {
            let cursor = decode_cursor(raw)?;
            if cursor.datastore_id != datastore_id
                || cursor.collection != COLLECTION
                || cursor.limit != limit
                || cursor.ordering != ORDERING
                || cursor.protocol_version != version.to_string()
                || cursor.filters != filters
                || cursor.domain_id.is_some()
                || cursor.integrity != integrity(&cursor)
            {
                return Err(BrowserDomainDiscoveryError::InvalidCursor);
            }
            if cursor.snapshot != snapshot {
                return Err(BrowserDomainDiscoveryError::StaleCursor);
            }
            if cursor.boundary == 0 || cursor.boundary >= source.len() {
                return Err(BrowserDomainDiscoveryError::InvalidCursor);
            }
            (cursor.boundary, cursor.direction)
        }
    };
    let start = match direction {
        Direction::Forward => start.min(source.len()),
        Direction::Backward => start.saturating_sub(limit as usize),
    };
    let end = (start + limit as usize).min(source.len());
    let domains = source[start..end]
        .iter()
        .cloned()
        .map(|value| project(datastore_id, value))
        .collect::<Vec<_>>();
    let returned_count = domains.len();
    let previous_cursor = (start > 0).then(|| {
        encode_cursor(domain_cursor(
            datastore_id,
            limit,
            Direction::Backward,
            start,
            &version,
            &snapshot,
            &filters,
        ))
    });
    let next_cursor = (end < source.len()).then(|| {
        encode_cursor(domain_cursor(
            datastore_id,
            limit,
            Direction::Forward,
            end,
            &version,
            &snapshot,
            &filters,
        ))
    });
    Ok(BrowserDomainCollectionResponse {
        protocol_version: version.clone(),
        datastore_id,
        filters: filters.clone(),
        returned_count,
        has_more: next_cursor.is_some(),
        empty_state: domains.is_empty().then(|| {
            if filters == BrowserDomainCollectionFilters::default() {
                BrowserDomainEmptyState {
                    code: "no_domains".into(),
                    message: "No Domains are available in this datastore.".into(),
                }
            } else {
                BrowserDomainEmptyState {
                    code: "no_matching_browser_visible_domains".into(),
                    message: "No browser-visible Domains match the active filters.".into(),
                }
            }
        }),
        page: BrowserDomainPageMetadata {
            limit,
            returned: returned_count,
            ordering: ORDERING.into(),
            ordering_description: ORDERING_DESCRIPTION.into(),
            previous_cursor,
            next_cursor,
        },
        domains,
    })
}

fn domain_matches_filters(
    record: &BrowserDomainSourceRecord,
    filters: &BrowserDomainCollectionFilters,
) -> bool {
    let text_matches = filters.text.as_ref().is_none_or(|text| {
        domain_text_values(record).any(|candidate| domain_text_matches(candidate, text))
    });
    let tag_matches = filters.any_tags.is_empty()
        || record.tags.iter().any(|tag| {
            filters
                .any_tags
                .iter()
                .any(|selector| domain_tag_matches(tag, selector))
        });
    text_matches && tag_matches
}

fn domain_text_values(record: &BrowserDomainSourceRecord) -> impl Iterator<Item = &str> {
    std::iter::once(record.domain.name.as_str())
        .chain(record.domain.description.as_deref())
        .chain(record.domain.uri.as_deref())
}

fn domain_text_matches(candidate: &str, filter: &BrowserDomainTextFilter) -> bool {
    let candidate = candidate.to_lowercase();
    let value = filter.value.to_lowercase();
    match filter.mode {
        ahri_tre_protocol::search::TextMode::Exact => candidate == value,
        ahri_tre_protocol::search::TextMode::Prefix => candidate.starts_with(&value),
        ahri_tre_protocol::search::TextMode::Contains => candidate.contains(&value),
    }
}

fn domain_tag_matches(
    tag: &ahri_tre_pgmeta::PgTagReadModel,
    selector: &ahri_tre_protocol::refs::TagSelector,
) -> bool {
    match selector {
        ahri_tre_protocol::refs::TagSelector::Id { tag: expected } => {
            ahri_tre_protocol::refs::encode_scoped_integer_ref("tag", tag.tag_id) == expected.id
        }
        ahri_tre_protocol::refs::TagSelector::Label { scope, label } => {
            *scope == TagScope::Global && tag.name == label.as_str()
        }
    }
}

pub fn detail_response(
    source: Vec<BrowserDomainSourceRecord>,
    datastore_id: PublicUuid,
    domain_id: PublicUuid,
    requested_version: Option<&str>,
) -> Result<BrowserDomainDetailResponse, BrowserDomainDiscoveryError> {
    let version = requested_version
        .map(ProtocolVersion::parse)
        .transpose()
        .map_err(|_| BrowserDomainDiscoveryError::UnsupportedVersion)?
        .unwrap_or_default();
    version
        .ensure_supported(&ProtocolVersion::current())
        .map_err(|_| BrowserDomainDiscoveryError::UnsupportedVersion)?;
    let record = source
        .into_iter()
        .find(|record| public_domain_id(record.domain.domain_id) == domain_id)
        .ok_or(BrowserDomainDiscoveryError::DomainNotFound)?;
    Ok(BrowserDomainDetailResponse {
        protocol_version: version,
        datastore_id,
        domain: project(datastore_id, record),
    })
}

pub fn study_collection_response(
    source: BrowserStudyDiscoverySource,
    domain_id: PublicUuid,
    limit: Option<u16>,
    raw_cursor: Option<&str>,
    requested_version: Option<&str>,
) -> Result<BrowserDomainStudyCollectionResponse, BrowserDomainDiscoveryError> {
    let version = requested_version
        .map(ProtocolVersion::parse)
        .transpose()
        .map_err(|_| BrowserDomainDiscoveryError::UnsupportedVersion)?
        .unwrap_or_default();
    version
        .ensure_supported(&ProtocolVersion::current())
        .map_err(|_| BrowserDomainDiscoveryError::UnsupportedVersion)?;
    let limit = limit.unwrap_or(DEFAULT_LIMIT);
    if limit == 0 || limit > MAX_LIMIT {
        return Err(BrowserDomainDiscoveryError::InvalidPage);
    }
    let datastore_id = source.datastore_id;
    let mut studies = source
        .studies
        .into_iter()
        .map(|record| browser_study_facts(datastore_id, &record))
        .collect::<Vec<_>>();
    studies.sort_by(|a, b| {
        a.name
            .to_lowercase()
            .cmp(&b.name.to_lowercase())
            .then(a.study.id.to_string().cmp(&b.study.id.to_string()))
    });
    let snapshot = study_snapshot(&studies);
    let (boundary, direction) = match raw_cursor {
        None => (0, Direction::Forward),
        Some(raw) => {
            let cursor = decode_cursor(raw)?;
            if cursor.datastore_id != datastore_id
                || cursor.collection != DOMAIN_STUDIES_COLLECTION
                || cursor.domain_id != Some(domain_id)
                || cursor.limit != limit
                || cursor.ordering != ORDERING
                || cursor.protocol_version != version.to_string()
                || cursor.integrity != integrity(&cursor)
            {
                return Err(BrowserDomainDiscoveryError::InvalidCursor);
            }
            if cursor.snapshot != snapshot {
                return Err(BrowserDomainDiscoveryError::StaleCursor);
            }
            if cursor.boundary == 0 || cursor.boundary >= studies.len() {
                return Err(BrowserDomainDiscoveryError::InvalidCursor);
            }
            (cursor.boundary, cursor.direction)
        }
    };
    let start = match direction {
        Direction::Forward => boundary.min(studies.len()),
        Direction::Backward => boundary.saturating_sub(limit as usize),
    };
    let end = (start + limit as usize).min(studies.len());
    let page_studies = studies[start..end].to_vec();
    let make_cursor = |direction, boundary| {
        let mut value = cursor(
            datastore_id,
            limit,
            direction,
            boundary,
            &version,
            &snapshot,
        );
        value.collection = DOMAIN_STUDIES_COLLECTION.into();
        value.domain_id = Some(domain_id);
        value.integrity = integrity(&value);
        encode_cursor(value)
    };
    Ok(BrowserDomainStudyCollectionResponse {
        protocol_version: version.clone(),
        datastore_id,
        domain: DomainRef {
            datastore_id,
            kind: ahri_tre_protocol::refs::ObjectKind::Domain,
            id: domain_id,
        },
        empty_state: page_studies.is_empty().then(|| BrowserDomainEmptyState {
            code: "no_domain_studies".into(),
            message: "No Studies are associated with this Domain.".into(),
        }),
        page: BrowserDomainPageMetadata {
            limit,
            returned: page_studies.len(),
            ordering: ORDERING.into(),
            ordering_description: STUDY_ORDERING_DESCRIPTION.into(),
            previous_cursor: (start > 0).then(|| make_cursor(Direction::Backward, start)),
            next_cursor: (end < studies.len()).then(|| make_cursor(Direction::Forward, end)),
        },
        studies: page_studies,
    })
}

pub fn variable_collection_response(
    mut source: Vec<BrowserDomainVariableSourceRecord>,
    datastore_id: PublicUuid,
    domain_id: PublicUuid,
    limit: Option<u16>,
    raw_cursor: Option<&str>,
    requested_version: Option<&str>,
) -> Result<BrowserDomainVariableCollectionResponse, BrowserDomainDiscoveryError> {
    let version = requested_version
        .map(ProtocolVersion::parse)
        .transpose()
        .map_err(|_| BrowserDomainDiscoveryError::UnsupportedVersion)?
        .unwrap_or_default();
    version
        .ensure_supported(&ProtocolVersion::current())
        .map_err(|_| BrowserDomainDiscoveryError::UnsupportedVersion)?;
    let limit = limit.unwrap_or(DEFAULT_LIMIT);
    if limit == 0 || limit > MAX_LIMIT {
        return Err(BrowserDomainDiscoveryError::InvalidPage);
    }
    source.sort_by(|a, b| {
        a.variable
            .name
            .to_lowercase()
            .cmp(&b.variable.name.to_lowercase())
            .then(a.variable.variable_id.0.cmp(&b.variable.variable_id.0))
    });
    let projected = source
        .iter()
        .map(|source| variable_record(datastore_id, source))
        .collect::<Vec<_>>();
    let snapshot = digest(&projected);
    let (boundary, direction) = match raw_cursor {
        None => (0, Direction::Forward),
        Some(raw) => {
            let cursor = decode_cursor(raw)?;
            if cursor.datastore_id != datastore_id
                || cursor.collection != DOMAIN_VARIABLES_COLLECTION
                || cursor.domain_id != Some(domain_id)
                || cursor.limit != limit
                || cursor.ordering != ORDERING
                || cursor.protocol_version != version.to_string()
                || cursor.integrity != integrity(&cursor)
            {
                return Err(BrowserDomainDiscoveryError::InvalidCursor);
            }
            if cursor.snapshot != snapshot {
                return Err(BrowserDomainDiscoveryError::StaleCursor);
            }
            if cursor.boundary == 0 || cursor.boundary >= projected.len() {
                return Err(BrowserDomainDiscoveryError::InvalidCursor);
            }
            (cursor.boundary, cursor.direction)
        }
    };
    let start = match direction {
        Direction::Forward => boundary.min(projected.len()),
        Direction::Backward => boundary.saturating_sub(limit as usize),
    };
    let end = (start + limit as usize).min(projected.len());
    let make_cursor = |direction, boundary| {
        let mut value = cursor(
            datastore_id,
            limit,
            direction,
            boundary,
            &version,
            &snapshot,
        );
        value.collection = DOMAIN_VARIABLES_COLLECTION.into();
        value.domain_id = Some(domain_id);
        value.integrity = integrity(&value);
        encode_cursor(value)
    };
    let variables = projected[start..end].to_vec();
    Ok(BrowserDomainVariableCollectionResponse {
        protocol_version: version.clone(),
        datastore_id,
        domain: DomainRef {
            datastore_id,
            kind: ahri_tre_protocol::refs::ObjectKind::Domain,
            id: domain_id,
        },
        empty_state: variables.is_empty().then(|| BrowserDomainEmptyState {
            code: "no_domain_variables".into(),
            message: "No Variables belong to this Domain.".into(),
        }),
        page: BrowserDomainPageMetadata {
            limit,
            returned: variables.len(),
            ordering: ORDERING.into(),
            ordering_description: VARIABLE_ORDERING_DESCRIPTION.into(),
            previous_cursor: (start > 0).then(|| make_cursor(Direction::Backward, start)),
            next_cursor: (end < projected.len()).then(|| make_cursor(Direction::Forward, end)),
        },
        variables,
    })
}

pub fn variable_detail_response(
    source: Vec<BrowserDomainVariableSourceRecord>,
    datastore_id: PublicUuid,
    domain_id: PublicUuid,
    variable_id: PublicUuid,
    requested_version: Option<&str>,
) -> Result<BrowserDomainVariableDetailResponse, BrowserDomainDiscoveryError> {
    let version = requested_version
        .map(ProtocolVersion::parse)
        .transpose()
        .map_err(|_| BrowserDomainDiscoveryError::UnsupportedVersion)?
        .unwrap_or_default();
    version
        .ensure_supported(&ProtocolVersion::current())
        .map_err(|_| BrowserDomainDiscoveryError::UnsupportedVersion)?;
    let source = source
        .into_iter()
        .find(|record| public_variable_id(record.variable.variable_id) == variable_id)
        .ok_or(BrowserDomainDiscoveryError::VariableNotFound)?;
    let facts = variable_record(datastore_id, &source);
    Ok(BrowserDomainVariableDetailResponse {
        protocol_version: version,
        datastore_id,
        variable: BrowserDomainVariableDetail {
            facts,
            domain: DomainRef {
                datastore_id,
                kind: ahri_tre_protocol::refs::ObjectKind::Domain,
                id: domain_id,
            },
            value_format: source.variable.value_format,
            tags: project_tags(datastore_id, source.tags),
            ontology_namespace: source.variable.ontology_namespace,
            ontology_class: source.variable.ontology_class,
        },
    })
}

pub fn vocabulary_detail_response(
    source: BrowserVocabularySource,
    datastore_id: PublicUuid,
    domain_id: PublicUuid,
    vocabulary_id: PublicUuid,
) -> Result<BrowserVocabularyDetailResponse, BrowserDomainDiscoveryError> {
    if public_vocabulary_id(source.vocabulary.vocabulary_id) != vocabulary_id
        || public_domain_id(source.vocabulary.domain_id) != domain_id
    {
        return Err(BrowserDomainDiscoveryError::VocabularyNotFound);
    }
    Ok(BrowserVocabularyDetailResponse {
        protocol_version: ProtocolVersion::default(),
        datastore_id,
        vocabulary: BrowserVocabularyDetail {
            vocabulary: VocabularyRef {
                datastore_id,
                kind: ahri_tre_protocol::refs::ObjectKind::Vocabulary,
                id: vocabulary_id,
            },
            domain: DomainRef {
                datastore_id,
                kind: ahri_tre_protocol::refs::ObjectKind::Domain,
                id: domain_id,
            },
            name: source.vocabulary.name,
            description: source.vocabulary.description,
        },
    })
}

pub fn vocabulary_item_collection_response(
    mut source: BrowserVocabularySource,
    datastore_id: PublicUuid,
    domain_id: PublicUuid,
    vocabulary_id: PublicUuid,
    limit: Option<u16>,
    raw_cursor: Option<&str>,
) -> Result<BrowserVocabularyItemCollectionResponse, BrowserDomainDiscoveryError> {
    if public_vocabulary_id(source.vocabulary.vocabulary_id) != vocabulary_id
        || public_domain_id(source.vocabulary.domain_id) != domain_id
    {
        return Err(BrowserDomainDiscoveryError::VocabularyNotFound);
    }
    let version = ProtocolVersion::default();
    let limit = limit.unwrap_or(DEFAULT_LIMIT);
    if limit == 0 || limit > MAX_LIMIT {
        return Err(BrowserDomainDiscoveryError::InvalidPage);
    }
    source
        .items
        .sort_by_key(|item| (item.value, item.vocabulary_item_id.0));
    let projected = source
        .items
        .into_iter()
        .map(|item| BrowserVocabularyItemRecord {
            item: ahri_tre_protocol::refs::ObjectRef {
                datastore_id,
                kind: ahri_tre_protocol::refs::ObjectKind::VocabularyItem,
                id: ahri_tre_protocol::refs::encode_scoped_integer_ref(
                    "vocabulary_item",
                    item.vocabulary_item_id.0,
                ),
            },
            code: item.value,
            label: item.code,
            definition: item.description,
        })
        .collect::<Vec<_>>();
    let snapshot = digest(&projected);
    let (boundary, direction) = match raw_cursor {
        None => (0, Direction::Forward),
        Some(raw) => {
            let cursor = decode_cursor(raw)?;
            if cursor.datastore_id != datastore_id
                || cursor.collection != VOCABULARY_ITEMS_COLLECTION
                || cursor.domain_id != Some(domain_id)
                || cursor.vocabulary_id != Some(vocabulary_id)
                || cursor.limit != limit
                || cursor.ordering != VOCABULARY_ITEM_ORDERING
                || cursor.protocol_version != version.to_string()
                || cursor.integrity != integrity(&cursor)
            {
                return Err(BrowserDomainDiscoveryError::InvalidCursor);
            }
            if cursor.snapshot != snapshot {
                return Err(BrowserDomainDiscoveryError::StaleCursor);
            }
            if cursor.boundary == 0 || cursor.boundary >= projected.len() {
                return Err(BrowserDomainDiscoveryError::InvalidCursor);
            }
            (cursor.boundary, cursor.direction)
        }
    };
    let start = match direction {
        Direction::Forward => boundary.min(projected.len()),
        Direction::Backward => boundary.saturating_sub(limit as usize),
    };
    let end = (start + limit as usize).min(projected.len());
    let make_cursor = |direction, boundary| {
        let mut value = cursor(
            datastore_id,
            limit,
            direction,
            boundary,
            &version,
            &snapshot,
        );
        value.collection = VOCABULARY_ITEMS_COLLECTION.into();
        value.ordering = VOCABULARY_ITEM_ORDERING.into();
        value.domain_id = Some(domain_id);
        value.vocabulary_id = Some(vocabulary_id);
        value.integrity = integrity(&value);
        encode_cursor(value)
    };
    let items = projected[start..end].to_vec();
    Ok(BrowserVocabularyItemCollectionResponse {
        protocol_version: version.clone(),
        datastore_id,
        domain: DomainRef {
            datastore_id,
            kind: ahri_tre_protocol::refs::ObjectKind::Domain,
            id: domain_id,
        },
        vocabulary: VocabularyRef {
            datastore_id,
            kind: ahri_tre_protocol::refs::ObjectKind::Vocabulary,
            id: vocabulary_id,
        },
        empty_state: items.is_empty().then(|| BrowserDomainEmptyState {
            code: "no_vocabulary_items".into(),
            message: "This Vocabulary has no categories.".into(),
        }),
        page: BrowserDomainPageMetadata {
            limit,
            returned: items.len(),
            ordering: VOCABULARY_ITEM_ORDERING.into(),
            ordering_description: VOCABULARY_ITEM_ORDERING_DESCRIPTION.into(),
            previous_cursor: (start > 0).then(|| make_cursor(Direction::Backward, start)),
            next_cursor: (end < projected.len()).then(|| make_cursor(Direction::Forward, end)),
        },
        items,
    })
}

pub fn vocabulary_mapping_collection_response(
    mut source: BrowserVocabularySource,
    datastore_id: PublicUuid,
    domain_id: PublicUuid,
    vocabulary_id: PublicUuid,
    limit: Option<u16>,
    raw_cursor: Option<&str>,
) -> Result<BrowserVocabularyMappingCollectionResponse, BrowserDomainDiscoveryError> {
    if public_vocabulary_id(source.vocabulary.vocabulary_id) != vocabulary_id
        || public_domain_id(source.vocabulary.domain_id) != domain_id
    {
        return Err(BrowserDomainDiscoveryError::VocabularyNotFound);
    }
    let version = ProtocolVersion::default();
    let limit = limit.unwrap_or(DEFAULT_LIMIT);
    if limit == 0 || limit > MAX_LIMIT {
        return Err(BrowserDomainDiscoveryError::InvalidPage);
    }
    source.mappings.retain(|mapping| {
        mapping.from_item.vocabulary_id == source.vocabulary.vocabulary_id
            || mapping.to_item.vocabulary_id == source.vocabulary.vocabulary_id
    });
    source.mappings.sort_by_key(|mapping| {
        (
            mapping.from_item.vocabulary_id.0,
            mapping.from_item.value,
            mapping.from_item.vocabulary_item_id.0,
            mapping.to_item.vocabulary_id.0,
            mapping.to_item.value,
            mapping.to_item.vocabulary_item_id.0,
            mapping.mapping.vocabulary_mapping_id,
        )
    });
    let projected = source
        .mappings
        .into_iter()
        .map(|mapping| BrowserVocabularyMappingRecord {
            mapping: ahri_tre_protocol::refs::ObjectRef {
                datastore_id,
                kind: ahri_tre_protocol::refs::ObjectKind::VocabularyMapping,
                id: ahri_tre_protocol::refs::encode_scoped_integer_ref(
                    "vocabulary_mapping",
                    mapping.mapping.vocabulary_mapping_id,
                ),
            },
            source: mapping_endpoint(datastore_id, mapping.from_item, mapping.from_domain_id),
            target: mapping_endpoint(datastore_id, mapping.to_item, mapping.to_domain_id),
        })
        .collect::<Vec<_>>();
    let snapshot = digest(&projected);
    let (boundary, direction) = match raw_cursor {
        None => (0, Direction::Forward),
        Some(raw) => {
            let cursor = decode_cursor(raw)?;
            if cursor.datastore_id != datastore_id
                || cursor.collection != VOCABULARY_MAPPINGS_COLLECTION
                || cursor.domain_id != Some(domain_id)
                || cursor.vocabulary_id != Some(vocabulary_id)
                || cursor.limit != limit
                || cursor.ordering != VOCABULARY_MAPPING_ORDERING
                || cursor.protocol_version != version.to_string()
                || cursor.integrity != integrity(&cursor)
            {
                return Err(BrowserDomainDiscoveryError::InvalidCursor);
            }
            if cursor.snapshot != snapshot {
                return Err(BrowserDomainDiscoveryError::StaleCursor);
            }
            if cursor.boundary == 0 || cursor.boundary >= projected.len() {
                return Err(BrowserDomainDiscoveryError::InvalidCursor);
            }
            (cursor.boundary, cursor.direction)
        }
    };
    let start = match direction {
        Direction::Forward => boundary.min(projected.len()),
        Direction::Backward => boundary.saturating_sub(limit as usize),
    };
    let end = (start + limit as usize).min(projected.len());
    let make_cursor = |direction, boundary| {
        let mut value = cursor(
            datastore_id,
            limit,
            direction,
            boundary,
            &version,
            &snapshot,
        );
        value.collection = VOCABULARY_MAPPINGS_COLLECTION.into();
        value.ordering = VOCABULARY_MAPPING_ORDERING.into();
        value.domain_id = Some(domain_id);
        value.vocabulary_id = Some(vocabulary_id);
        value.integrity = integrity(&value);
        encode_cursor(value)
    };
    let mappings = projected[start..end].to_vec();
    Ok(BrowserVocabularyMappingCollectionResponse {
        protocol_version: version.clone(),
        datastore_id,
        domain: DomainRef {
            datastore_id,
            kind: ahri_tre_protocol::refs::ObjectKind::Domain,
            id: domain_id,
        },
        vocabulary: VocabularyRef {
            datastore_id,
            kind: ahri_tre_protocol::refs::ObjectKind::Vocabulary,
            id: vocabulary_id,
        },
        empty_state: mappings.is_empty().then(|| BrowserDomainEmptyState {
            code: "no_vocabulary_mappings".into(),
            message: "This Vocabulary has no mappings.".into(),
        }),
        page: BrowserDomainPageMetadata {
            limit,
            returned: mappings.len(),
            ordering: VOCABULARY_MAPPING_ORDERING.into(),
            ordering_description: VOCABULARY_MAPPING_ORDERING_DESCRIPTION.into(),
            previous_cursor: (start > 0).then(|| make_cursor(Direction::Backward, start)),
            next_cursor: (end < projected.len()).then(|| make_cursor(Direction::Forward, end)),
        },
        mappings,
    })
}

fn mapping_endpoint(
    datastore_id: PublicUuid,
    item: ahri_tre_pgmeta::PgVocabularyItemReadModel,
    domain_id: DomainId,
) -> BrowserVocabularyMappingEndpoint {
    BrowserVocabularyMappingEndpoint {
        domain: DomainRef {
            datastore_id,
            kind: ahri_tre_protocol::refs::ObjectKind::Domain,
            id: public_domain_id(domain_id),
        },
        vocabulary: VocabularyRef {
            datastore_id,
            kind: ahri_tre_protocol::refs::ObjectKind::Vocabulary,
            id: public_vocabulary_id(item.vocabulary_id),
        },
        item: ahri_tre_protocol::refs::ObjectRef {
            datastore_id,
            kind: ahri_tre_protocol::refs::ObjectKind::VocabularyItem,
            id: ahri_tre_protocol::refs::encode_scoped_integer_ref(
                "vocabulary_item",
                item.vocabulary_item_id.0,
            ),
        },
        code: item.value,
        label: item.code,
    }
}

fn variable_record(
    datastore_id: PublicUuid,
    source: &BrowserDomainVariableSourceRecord,
) -> BrowserDomainVariableRecord {
    BrowserDomainVariableRecord {
        variable: VariableRef {
            datastore_id,
            kind: ahri_tre_protocol::refs::ObjectKind::Variable,
            id: public_variable_id(source.variable.variable_id),
        },
        name: source.variable.name.clone(),
        value_type: source.variable.value_type.clone(),
        description: source.variable.description.clone(),
        vocabulary: source
            .vocabulary
            .as_ref()
            .map(|v| BrowserDomainVariableVocabulary {
                vocabulary: VocabularyRef {
                    datastore_id,
                    kind: ahri_tre_protocol::refs::ObjectKind::Vocabulary,
                    id: ahri_tre_protocol::refs::encode_scoped_integer_ref(
                        "vocabulary",
                        v.vocabulary_id.0,
                    ),
                },
                name: v.name.clone(),
            }),
    }
}

fn digest<T: Serialize>(value: &T) -> String {
    Sha256::digest(serde_json::to_vec(value).expect("snapshot serializes"))
        .iter()
        .map(|byte| format!("{byte:02x}"))
        .collect()
}

fn project_tags(
    datastore_id: PublicUuid,
    tags: Vec<ahri_tre_pgmeta::PgTagReadModel>,
) -> Vec<TagSummary> {
    tags.into_iter()
        .map(|tag| TagSummary {
            tag: TagRef {
                datastore_id,
                kind: ahri_tre_protocol::refs::ObjectKind::Tag,
                id: ahri_tre_protocol::refs::encode_scoped_integer_ref("tag", tag.tag_id),
            },
            scope: TagScope::Global,
            label: tag.name,
        })
        .collect()
}

pub fn public_variable_id(id: VariableId) -> PublicUuid {
    ahri_tre_protocol::refs::encode_scoped_integer_ref("variable", id.0)
}
pub fn public_vocabulary_id(id: VocabularyId) -> PublicUuid {
    ahri_tre_protocol::refs::encode_scoped_integer_ref("vocabulary", id.0)
}
pub fn internal_vocabulary_id(id: PublicUuid) -> Option<VocabularyId> {
    ahri_tre_protocol::refs::decode_scoped_integer_ref("vocabulary", id).map(VocabularyId)
}

fn project(datastore_id: PublicUuid, record: BrowserDomainSourceRecord) -> BrowserDomainRecord {
    BrowserDomainRecord {
        domain: DomainRef {
            datastore_id,
            kind: ahri_tre_protocol::refs::ObjectKind::Domain,
            id: public_domain_id(record.domain.domain_id),
        },
        name: record.domain.name,
        description: record.domain.description,
        uri: record.domain.uri,
        tags: record
            .tags
            .into_iter()
            .map(|tag| TagSummary {
                tag: TagRef {
                    datastore_id,
                    kind: ahri_tre_protocol::refs::ObjectKind::Tag,
                    id: ahri_tre_protocol::refs::encode_scoped_integer_ref("tag", tag.tag_id),
                },
                scope: TagScope::Global,
                label: tag.name,
            })
            .collect(),
    }
}
pub fn public_domain_id(id: DomainId) -> PublicUuid {
    ahri_tre_protocol::refs::encode_scoped_integer_ref("domain", id.0)
}
pub fn internal_domain_id(id: PublicUuid) -> Option<DomainId> {
    ahri_tre_protocol::refs::decode_scoped_integer_ref("domain", id).map(DomainId)
}

fn snapshot(source: &[BrowserDomainSourceRecord]) -> String {
    let mut hash = 0xcbf29ce484222325_u64;
    for byte in serde_json::to_vec(
        &source
            .iter()
            .map(|r| {
                (
                    &r.domain.name,
                    r.domain.domain_id.0,
                    &r.domain.description,
                    &r.domain.uri,
                    r.tags
                        .iter()
                        .map(|t| (&t.name, t.tag_id))
                        .collect::<Vec<_>>(),
                )
            })
            .collect::<Vec<_>>(),
    )
    .expect("snapshot serializes")
    {
        hash ^= u64::from(byte);
        hash = hash.wrapping_mul(0x100000001b3);
    }
    format!("{hash:016x}")
}
fn study_snapshot(source: &[ahri_tre_protocol::study::BrowserStudyFacts]) -> String {
    let bytes = serde_json::to_vec(source).expect("Study snapshot serializes");
    let digest = Sha256::digest(bytes);
    digest.iter().map(|byte| format!("{byte:02x}")).collect()
}
fn cursor(
    datastore_id: PublicUuid,
    limit: u16,
    direction: Direction,
    boundary: usize,
    version: &ProtocolVersion,
    snapshot: &str,
) -> Cursor {
    let mut value = Cursor {
        datastore_id,
        collection: COLLECTION.into(),
        limit,
        ordering: ORDERING.into(),
        direction,
        boundary,
        protocol_version: version.to_string(),
        snapshot: snapshot.into(),
        filters: BrowserDomainCollectionFilters::default(),
        domain_id: None,
        vocabulary_id: None,
        integrity: String::new(),
    };
    value.integrity = integrity(&value);
    value
}

fn domain_cursor(
    datastore_id: PublicUuid,
    limit: u16,
    direction: Direction,
    boundary: usize,
    version: &ProtocolVersion,
    snapshot: &str,
    filters: &BrowserDomainCollectionFilters,
) -> Cursor {
    let mut value = cursor(datastore_id, limit, direction, boundary, version, snapshot);
    value.filters = filters.clone();
    value.integrity = integrity(&value);
    value
}
fn integrity(cursor: &Cursor) -> String {
    let text = format!(
        "{}|{}|{}|{}|{:?}|{}|{}|{}|{:?}|{:?}|{:?}",
        cursor.datastore_id,
        cursor.collection,
        cursor.limit,
        cursor.ordering,
        cursor.direction,
        cursor.boundary,
        cursor.protocol_version,
        cursor.snapshot,
        cursor.domain_id,
        cursor.vocabulary_id,
        cursor.filters
    );
    hmac_sha256(cursor_mac_key(), text.as_bytes())
        .into_iter()
        .map(|byte| format!("{byte:02x}"))
        .collect()
}

fn cursor_mac_key() -> &'static [u8; 16] {
    CURSOR_MAC_KEY.get_or_init(|| *Uuid::new_v4().as_bytes())
}

fn encode_cursor(cursor: Cursor) -> String {
    serde_json::to_vec(&cursor)
        .expect("cursor serializes")
        .into_iter()
        .map(|byte| format!("{byte:02x}"))
        .collect()
}
fn decode_cursor(raw: &str) -> Result<Cursor, BrowserDomainDiscoveryError> {
    if !raw.len().is_multiple_of(2) {
        return Err(BrowserDomainDiscoveryError::InvalidCursor);
    }
    let bytes = (0..raw.len())
        .step_by(2)
        .map(|index| {
            u8::from_str_radix(&raw[index..index + 2], 16)
                .map_err(|_| BrowserDomainDiscoveryError::InvalidCursor)
        })
        .collect::<Result<Vec<_>, _>>()?;
    serde_json::from_slice(&bytes).map_err(|_| BrowserDomainDiscoveryError::InvalidCursor)
}

#[cfg(test)]
mod tests {
    use super::*;
    use ahri_tre_types::{KeyRole, StudyId, ValueTypeId, VocabularyId};
    fn record(id: i64, name: &str) -> BrowserDomainSourceRecord {
        BrowserDomainSourceRecord {
            domain: ahri_tre_pgmeta::PgDomainReadModel {
                domain_id: DomainId(id),
                name: name.into(),
                uri: Some(format!("https://example.test/{id}")),
                description: Some(format!("Domain {id}")),
            },
            tags: vec![],
        }
    }
    fn tagged_record(
        id: i64,
        name: &str,
        description: &str,
        tag_id: i64,
        tag: &str,
    ) -> BrowserDomainSourceRecord {
        let mut record = record(id, name);
        record.domain.description = Some(description.into());
        record.tags.push(ahri_tre_pgmeta::PgTagReadModel {
            tag_id,
            name: tag.into(),
        });
        record
    }

    #[test]
    fn filters_domains_before_ordering_and_paging_with_bound_cursors() {
        let datastore_id = PublicUuid::from_uuid(Uuid::from_u128(42));
        let filters = ahri_tre_protocol::domain::BrowserDomainCollectionFilters {
            text: Some(ahri_tre_protocol::domain::BrowserDomainTextFilter {
                mode: ahri_tre_protocol::search::TextMode::Contains,
                value: "  health  ".into(),
            }),
            any_tags: vec![ahri_tre_protocol::refs::TagSelector::Label {
                scope: TagScope::Global,
                label: ahri_tre_protocol::PublicName::new("population").unwrap(),
            }],
        };
        let source = vec![
            tagged_record(1, "Alpha", "Health", 2, "other"),
            tagged_record(2, "Beta", "Other", 1, "population"),
            tagged_record(3, "Gamma", "Health records", 1, "population"),
            tagged_record(4, "Zulu", "Health systems", 1, "population"),
        ];

        let response =
            collection_response(source.clone(), datastore_id, filters, Some(1), None, None)
                .unwrap();

        assert_eq!(response.domains[0].name, "Gamma");
        assert_eq!(response.returned_count, 1);
        assert!(response.has_more);
        assert_eq!(response.filters.text.as_ref().unwrap().value, "health");

        let mismatch = collection_response(
            source,
            datastore_id,
            ahri_tre_protocol::domain::BrowserDomainCollectionFilters::default(),
            Some(1),
            response.page.next_cursor.as_deref(),
            None,
        );
        assert_eq!(
            mismatch.unwrap_err(),
            BrowserDomainDiscoveryError::InvalidCursor
        );

        let cursor = response.page.next_cursor.as_deref().unwrap();
        for mismatch in [
            collection_response(
                vec![
                    tagged_record(3, "Gamma", "Health records", 1, "population"),
                    tagged_record(4, "Zulu", "Health systems", 1, "population"),
                ],
                PublicUuid::from_uuid(Uuid::from_u128(43)),
                response.filters.clone(),
                Some(1),
                Some(cursor),
                None,
            ),
            collection_response(
                vec![
                    tagged_record(3, "Gamma", "Health records", 1, "population"),
                    tagged_record(4, "Zulu", "Health systems", 1, "population"),
                ],
                datastore_id,
                response.filters.clone(),
                Some(2),
                Some(cursor),
                None,
            ),
        ] {
            assert_eq!(
                mismatch.unwrap_err(),
                BrowserDomainDiscoveryError::InvalidCursor
            );
        }

        let mut decoded = decode_cursor(cursor).unwrap();
        decoded.collection = DOMAIN_VARIABLES_COLLECTION.into();
        decoded.integrity = integrity(&decoded);
        assert_eq!(
            collection_response(
                vec![
                    tagged_record(3, "Gamma", "Health records", 1, "population"),
                    tagged_record(4, "Zulu", "Health systems", 1, "population"),
                ],
                datastore_id,
                response.filters.clone(),
                Some(1),
                Some(&encode_cursor(decoded)),
                None,
            )
            .unwrap_err(),
            BrowserDomainDiscoveryError::InvalidCursor
        );

        let mut decoded = decode_cursor(cursor).unwrap();
        decoded.protocol_version = "1.0.1".into();
        decoded.integrity = integrity(&decoded);
        assert_eq!(
            collection_response(
                vec![
                    tagged_record(3, "Gamma", "Health records", 1, "population"),
                    tagged_record(4, "Zulu", "Health systems", 1, "population"),
                ],
                datastore_id,
                response.filters,
                Some(1),
                Some(&encode_cursor(decoded)),
                None,
            )
            .unwrap_err(),
            BrowserDomainDiscoveryError::InvalidCursor
        );
    }

    #[test]
    fn domain_text_filter_is_unicode_case_insensitive() {
        let response = collection_response(
            vec![tagged_record(
                1,
                "Research",
                "ÉTUDE health",
                1,
                "population",
            )],
            PublicUuid::from_uuid(Uuid::from_u128(42)),
            BrowserDomainCollectionFilters {
                text: Some(BrowserDomainTextFilter {
                    mode: ahri_tre_protocol::search::TextMode::Contains,
                    value: "étude".into(),
                }),
                any_tags: vec![],
            },
            Some(10),
            None,
            None,
        )
        .unwrap();

        assert_eq!(response.returned_count, 1);
    }
    #[test]
    fn traverses_forward_and_backward_without_totals() {
        let id = PublicUuid::from_uuid(Uuid::from_u128(42));
        let source = vec![record(3, "Zulu"), record(1, "Alpha"), record(2, "Beta")];
        let first = collection_response(
            source.clone(),
            id,
            BrowserDomainCollectionFilters::default(),
            Some(2),
            None,
            None,
        )
        .unwrap();
        assert_eq!(
            first
                .domains
                .iter()
                .map(|d| d.name.as_str())
                .collect::<Vec<_>>(),
            vec!["Alpha", "Beta"]
        );
        assert!(first.page.previous_cursor.is_none());
        let second = collection_response(
            source.clone(),
            id,
            BrowserDomainCollectionFilters::default(),
            Some(2),
            first.page.next_cursor.as_deref(),
            None,
        )
        .unwrap();
        assert_eq!(second.domains[0].name, "Zulu");
        assert!(second.page.next_cursor.is_none());
        let back = collection_response(
            source,
            id,
            BrowserDomainCollectionFilters::default(),
            Some(2),
            second.page.previous_cursor.as_deref(),
            None,
        )
        .unwrap();
        assert_eq!(back.domains[0].name, "Alpha");
    }
    #[test]
    fn rejects_mismatched_and_stale_cursors() {
        let id = PublicUuid::from_uuid(Uuid::from_u128(42));
        let first = collection_response(
            vec![record(1, "Alpha"), record(2, "Beta")],
            id,
            BrowserDomainCollectionFilters::default(),
            Some(1),
            None,
            None,
        )
        .unwrap();
        let raw = first.page.next_cursor.as_deref();
        assert_eq!(
            collection_response(
                vec![record(1, "Alpha"), record(2, "Beta")],
                id,
                BrowserDomainCollectionFilters::default(),
                Some(2),
                raw,
                None
            )
            .unwrap_err(),
            BrowserDomainDiscoveryError::InvalidCursor
        );
        assert_eq!(
            collection_response(
                vec![record(1, "Alpha"), record(2, "Changed")],
                id,
                BrowserDomainCollectionFilters::default(),
                Some(1),
                raw,
                None
            )
            .unwrap_err(),
            BrowserDomainDiscoveryError::StaleCursor
        );
    }
    #[test]
    fn detail_contains_only_canonical_facts() {
        let id = PublicUuid::from_uuid(Uuid::from_u128(42));
        let response = detail_response(
            vec![record(7, "Health")],
            id,
            public_domain_id(DomainId(7)),
            None,
        )
        .unwrap();
        let json = serde_json::to_value(response).unwrap();
        assert_eq!(json["domain"]["name"], "Health");
        assert!(json["domain"].get("studies").is_none());
        assert!(json["domain"].get("variables").is_none());
    }

    #[test]
    fn domain_studies_are_association_scoped_and_parent_bound() {
        let datastore_id = PublicUuid::from_uuid(Uuid::from_u128(42));
        let selected = public_domain_id(DomainId(7));
        let other = public_domain_id(DomainId(8));
        let source = BrowserStudyDiscoverySource {
            datastore_id,
            studies: vec![study_record(3, "Zulu", 7), study_record(1, "Alpha", 7)],
        };
        let first =
            study_collection_response(source.clone(), selected, Some(1), None, None).unwrap();
        assert_eq!(first.studies[0].name, "Alpha");
        assert!(
            serde_json::to_value(&first.studies[0])
                .unwrap()
                .get("access_request")
                .is_none()
        );
        let cursor = first.page.next_cursor.as_deref().unwrap();
        let second =
            study_collection_response(source.clone(), selected, Some(1), Some(cursor), None)
                .unwrap();
        assert_eq!(second.studies[0].name, "Zulu");
        let previous = second.page.previous_cursor.as_deref().unwrap();
        let backward =
            study_collection_response(source.clone(), selected, Some(1), Some(previous), None)
                .unwrap();
        assert_eq!(backward.studies[0].name, "Alpha");
        assert_eq!(
            study_collection_response(source.clone(), other, Some(1), Some(cursor), None)
                .unwrap_err(),
            BrowserDomainDiscoveryError::InvalidCursor
        );
        let mut changed = source;
        changed.studies[1].study.name = "Changed".into();
        assert_eq!(
            study_collection_response(changed, selected, Some(1), Some(cursor), None).unwrap_err(),
            BrowserDomainDiscoveryError::StaleCursor
        );
    }

    #[test]
    fn domain_variables_are_canonical_paginated_and_parent_bound() {
        let datastore = PublicUuid::from_uuid(Uuid::from_u128(42));
        let domain = public_domain_id(DomainId(7));
        let other = public_domain_id(DomainId(8));
        let source = vec![
            variable_record_source(2, "Zulu", 7),
            variable_record_source(1, "Alpha", 7),
        ];
        let first =
            variable_collection_response(source.clone(), datastore, domain, Some(1), None, None)
                .unwrap();
        assert_eq!(first.variables[0].name, "Alpha");
        let json = serde_json::to_value(&first.variables[0]).unwrap();
        assert!(json.get("key_role").is_none());
        assert!(json.get("row_role").is_none());
        assert!(json.get("note").is_none());
        let cursor = first.page.next_cursor.as_deref().unwrap();
        assert_eq!(
            variable_collection_response(
                source.clone(),
                datastore,
                other,
                Some(1),
                Some(cursor),
                None
            )
            .unwrap_err(),
            BrowserDomainDiscoveryError::InvalidCursor
        );
        let mut changed = source.clone();
        changed[1].variable.name = "Changed".into();
        assert_eq!(
            variable_collection_response(changed, datastore, domain, Some(1), Some(cursor), None)
                .unwrap_err(),
            BrowserDomainDiscoveryError::StaleCursor
        );
        let detail = variable_detail_response(
            source,
            datastore,
            domain,
            public_variable_id(VariableId(1)),
            None,
        )
        .unwrap();
        let json = serde_json::to_value(detail).unwrap();
        assert_eq!(json["variable"]["domain"]["id"], domain.to_string());
        assert!(json["variable"].get("dataset").is_none());
        assert!(json["variable"].get("note").is_none());
    }

    #[test]
    fn vocabulary_categories_preserve_meaning_and_support_bound_traversal() {
        let datastore = PublicUuid::from_uuid(Uuid::from_u128(42));
        let domain = public_domain_id(DomainId(7));
        let vocabulary = public_vocabulary_id(VocabularyId(9));
        let source = vocabulary_source();
        let detail =
            vocabulary_detail_response(source.clone(), datastore, domain, vocabulary).unwrap();
        assert_eq!(detail.vocabulary.name, "Status");
        let first = vocabulary_item_collection_response(
            source.clone(),
            datastore,
            domain,
            vocabulary,
            Some(1),
            None,
        )
        .unwrap();
        assert_eq!(first.items[0].code, 10);
        assert_eq!(first.items[0].label, "Open");
        assert_eq!(first.items[0].definition.as_deref(), Some("Currently open"));
        let json = serde_json::to_value(&first.items[0]).unwrap();
        assert!(json.get("value").is_none());
        assert!(json.get("description").is_none());
        assert!(json.get("frequency").is_none());
        let next = first.page.next_cursor.as_deref().unwrap();
        let second = vocabulary_item_collection_response(
            source.clone(),
            datastore,
            domain,
            vocabulary,
            Some(1),
            Some(next),
        )
        .unwrap();
        assert_eq!(second.items[0].label, "Closed");
        assert!(second.items[0].definition.is_none());
        assert!(second.page.next_cursor.is_none());
        let previous = second.page.previous_cursor.as_deref().unwrap();
        assert_eq!(
            vocabulary_item_collection_response(
                source.clone(),
                datastore,
                domain,
                vocabulary,
                Some(1),
                Some(previous)
            )
            .unwrap()
            .items[0]
                .label,
            "Open"
        );
        let other = public_vocabulary_id(VocabularyId(8));
        assert_eq!(
            vocabulary_item_collection_response(
                source.clone(),
                datastore,
                domain,
                other,
                Some(1),
                Some(next)
            )
            .unwrap_err(),
            BrowserDomainDiscoveryError::VocabularyNotFound
        );
        let mut changed = source;
        changed.items[0].code = "Changed".into();
        assert_eq!(
            vocabulary_item_collection_response(
                changed,
                datastore,
                domain,
                vocabulary,
                Some(1),
                Some(next)
            )
            .unwrap_err(),
            BrowserDomainDiscoveryError::StaleCursor
        );
    }

    #[test]
    fn vocabulary_mappings_preserve_direction_cross_domain_identity_and_traversal() {
        let datastore = PublicUuid::from_uuid(Uuid::from_u128(42));
        let domain = public_domain_id(DomainId(7));
        let vocabulary = public_vocabulary_id(VocabularyId(9));
        let source = vocabulary_mapping_source();
        let first = vocabulary_mapping_collection_response(
            source.clone(),
            datastore,
            domain,
            vocabulary,
            Some(1),
            None,
        )
        .unwrap();
        assert_eq!(first.mappings.len(), 1);
        assert_eq!(first.mappings[0].source.code, 10);
        assert_eq!(first.mappings[0].source.label, "Open");
        assert_eq!(first.mappings[0].target.code, 20);
        assert_eq!(first.mappings[0].target.label, "Done");
        assert_eq!(first.mappings[0].source.domain.id, domain);
        assert_eq!(
            first.mappings[0].target.domain.id,
            public_domain_id(DomainId(8))
        );
        assert_ne!(
            first.mappings[0].source.vocabulary.id,
            first.mappings[0].target.vocabulary.id
        );
        let json = serde_json::to_value(&first.mappings[0]).unwrap();
        assert!(json.get("from_value").is_none());
        assert!(json.get("to_code").is_none());
        assert!(json["source"].get("definition").is_none());
        let next = first.page.next_cursor.as_deref().unwrap();
        let terminal = vocabulary_mapping_collection_response(
            source.clone(),
            datastore,
            domain,
            vocabulary,
            Some(1),
            Some(next),
        )
        .unwrap();
        assert_eq!(terminal.mappings[0].source.label, "Closed");
        assert!(terminal.page.previous_cursor.is_some());
        assert!(terminal.page.next_cursor.is_some());
        let final_cursor = terminal.page.next_cursor.as_deref().unwrap();
        let final_page = vocabulary_mapping_collection_response(
            source.clone(),
            datastore,
            domain,
            vocabulary,
            Some(1),
            Some(final_cursor),
        )
        .unwrap();
        assert_eq!(
            final_page.mappings[0].source.vocabulary.id,
            public_vocabulary_id(VocabularyId(12))
        );
        assert_eq!(final_page.mappings[0].target.vocabulary.id, vocabulary);
        assert_eq!(
            final_page.mappings[0].source.domain.id,
            public_domain_id(DomainId(8))
        );
        assert_eq!(final_page.mappings[0].target.domain.id, domain);
        assert!(final_page.page.next_cursor.is_none());
        let previous = final_page.page.previous_cursor.as_deref().unwrap();
        assert_eq!(
            vocabulary_mapping_collection_response(
                source.clone(),
                datastore,
                domain,
                vocabulary,
                Some(1),
                Some(previous),
            )
            .unwrap()
            .mappings[0]
                .source
                .label,
            "Closed"
        );
        let mut empty = source.clone();
        empty.mappings.clear();
        let empty = vocabulary_mapping_collection_response(
            empty, datastore, domain, vocabulary, None, None,
        )
        .unwrap();
        assert!(empty.mappings.is_empty());
        assert_eq!(empty.empty_state.unwrap().code, "no_vocabulary_mappings");
        assert_eq!(
            vocabulary_mapping_collection_response(
                source.clone(),
                datastore,
                public_domain_id(DomainId(8)),
                vocabulary,
                Some(1),
                None,
            )
            .unwrap_err(),
            BrowserDomainDiscoveryError::VocabularyNotFound
        );
        let other = public_vocabulary_id(VocabularyId(8));
        assert_eq!(
            vocabulary_mapping_collection_response(
                source.clone(),
                datastore,
                domain,
                other,
                Some(1),
                Some(next),
            )
            .unwrap_err(),
            BrowserDomainDiscoveryError::VocabularyNotFound
        );
        let mut changed = source;
        changed.mappings[0].to_item.code = "Changed".into();
        assert_eq!(
            vocabulary_mapping_collection_response(
                changed.clone(),
                datastore,
                domain,
                vocabulary,
                Some(1),
                Some(next),
            )
            .unwrap_err(),
            BrowserDomainDiscoveryError::StaleCursor
        );
        changed.mappings[0].to_item.code = "Done".into();
        changed.mappings[0].to_domain_id = DomainId(9);
        assert_eq!(
            vocabulary_mapping_collection_response(
                changed,
                datastore,
                domain,
                vocabulary,
                Some(1),
                Some(next),
            )
            .unwrap_err(),
            BrowserDomainDiscoveryError::StaleCursor
        );
    }

    fn vocabulary_source() -> BrowserVocabularySource {
        BrowserVocabularySource {
            vocabulary: ahri_tre_pgmeta::PgVocabularyReadModel {
                vocabulary_id: VocabularyId(9),
                domain_id: DomainId(7),
                name: "Status".into(),
                description: Some("Canonical status".into()),
            },
            items: vec![
                ahri_tre_pgmeta::PgVocabularyItemReadModel {
                    vocabulary_item_id: ahri_tre_types::VocabularyItemId(2),
                    vocabulary_id: VocabularyId(9),
                    value: 10,
                    code: "Closed".into(),
                    description: None,
                },
                ahri_tre_pgmeta::PgVocabularyItemReadModel {
                    vocabulary_item_id: ahri_tre_types::VocabularyItemId(1),
                    vocabulary_id: VocabularyId(9),
                    value: 10,
                    code: "Open".into(),
                    description: Some("Currently open".into()),
                },
            ],
            mappings: vec![],
        }
    }

    fn vocabulary_mapping_source() -> BrowserVocabularySource {
        let mut source = vocabulary_source();
        source.items = vec![];
        source.mappings = vec![
            BrowserVocabularyMappingSourceRecord {
                mapping: ahri_tre_pgmeta::PgVocabularyMappingReadModel {
                    vocabulary_mapping_id: 2,
                    from_vocabulary_item: ahri_tre_types::VocabularyItemId(1),
                    to_vocabulary_item: ahri_tre_types::VocabularyItemId(4),
                },
                from_item: ahri_tre_pgmeta::PgVocabularyItemReadModel {
                    vocabulary_item_id: ahri_tre_types::VocabularyItemId(1),
                    vocabulary_id: VocabularyId(9),
                    value: 10,
                    code: "Open".into(),
                    description: Some("Not projected here".into()),
                },
                from_domain_id: DomainId(7),
                to_item: ahri_tre_pgmeta::PgVocabularyItemReadModel {
                    vocabulary_item_id: ahri_tre_types::VocabularyItemId(4),
                    vocabulary_id: VocabularyId(12),
                    value: 20,
                    code: "Done".into(),
                    description: Some("Also not projected here".into()),
                },
                to_domain_id: DomainId(8),
            },
            BrowserVocabularyMappingSourceRecord {
                mapping: ahri_tre_pgmeta::PgVocabularyMappingReadModel {
                    vocabulary_mapping_id: 3,
                    from_vocabulary_item: ahri_tre_types::VocabularyItemId(3),
                    to_vocabulary_item: ahri_tre_types::VocabularyItemId(5),
                },
                from_item: ahri_tre_pgmeta::PgVocabularyItemReadModel {
                    vocabulary_item_id: ahri_tre_types::VocabularyItemId(3),
                    vocabulary_id: VocabularyId(9),
                    value: 10,
                    code: "Closed".into(),
                    description: None,
                },
                from_domain_id: DomainId(7),
                to_item: ahri_tre_pgmeta::PgVocabularyItemReadModel {
                    vocabulary_item_id: ahri_tre_types::VocabularyItemId(5),
                    vocabulary_id: VocabularyId(12),
                    value: 21,
                    code: "Pending".into(),
                    description: None,
                },
                to_domain_id: DomainId(8),
            },
            BrowserVocabularyMappingSourceRecord {
                mapping: ahri_tre_pgmeta::PgVocabularyMappingReadModel {
                    vocabulary_mapping_id: 1,
                    from_vocabulary_item: ahri_tre_types::VocabularyItemId(6),
                    to_vocabulary_item: ahri_tre_types::VocabularyItemId(2),
                },
                from_item: ahri_tre_pgmeta::PgVocabularyItemReadModel {
                    vocabulary_item_id: ahri_tre_types::VocabularyItemId(6),
                    vocabulary_id: VocabularyId(12),
                    value: 30,
                    code: "Referred".into(),
                    description: None,
                },
                from_domain_id: DomainId(8),
                to_item: ahri_tre_pgmeta::PgVocabularyItemReadModel {
                    vocabulary_item_id: ahri_tre_types::VocabularyItemId(2),
                    vocabulary_id: VocabularyId(9),
                    value: 10,
                    code: "Open".into(),
                    description: None,
                },
                to_domain_id: DomainId(7),
            },
        ];
        source
    }

    fn variable_record_source(
        id: i64,
        name: &str,
        domain: i64,
    ) -> BrowserDomainVariableSourceRecord {
        BrowserDomainVariableSourceRecord {
            variable: ahri_tre_pgmeta::PgVariableReadModel {
                variable_id: VariableId(id),
                domain_id: DomainId(domain),
                name: name.into(),
                value_type_id: ValueTypeId(1),
                value_type: "xsd:string".into(),
                value_format: Some("token".into()),
                vocabulary_id: Some(VocabularyId(9)),
                key_role: KeyRole::Record,
                description: Some(format!("{name} description")),
                note: Some("protected".into()),
                ontology_namespace: Some("https://example.test/ontology/".into()),
                ontology_class: Some("C1".into()),
            },
            vocabulary: Some(ahri_tre_pgmeta::PgVocabularyReadModel {
                vocabulary_id: VocabularyId(9),
                domain_id: DomainId(domain),
                name: "Status".into(),
                description: None,
            }),
            tags: vec![],
        }
    }

    fn study_record(
        id: u128,
        name: &str,
        domain_id: i64,
    ) -> crate::browser_study_discovery::BrowserStudyDiscoverySourceRecord {
        crate::browser_study_discovery::BrowserStudyDiscoverySourceRecord {
            study: ahri_tre_pgmeta::PgStudyReadModel {
                study_id: StudyId(Uuid::from_u128(id)),
                name: name.into(),
                description: Some(format!("{name} description")),
                documentation: None,
                agent_instructions: Some("private".into()),
                external_id: None,
                study_type_id: None,
                date_created: None,
                created_by: Some("private@example.org".into()),
            },
            domains: vec![ahri_tre_pgmeta::PgDomainReadModel {
                domain_id: DomainId(domain_id),
                name: format!("Domain {domain_id}"),
                uri: None,
                description: None,
            }],
            tags: vec![],
            access_conditions: vec![],
        }
    }
}