//! `OperatorCommand` — per `data_model.md §4 Action / piloting entities`.
//!
//! Every operator command carries an authenticated envelope. The signature
//! scheme is open (architecture.md Q9); `operator_bridge::internal::auth`
//! validates the envelope before any handler sees the decoded payload.

use chrono::{DateTime, Utc};
use serde::{Deserialize, Serialize};
use uuid::Uuid;

#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum OperatorCommandKind {
    ConfirmPoi,
    DeclinePoi,
    StartTargetFollow,
    ReleaseTargetFollow,
    AcknowledgeBitDegraded,
    SafetyOverride,
    MissionAbort,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct OperatorCommand {
    pub command_id: Uuid,
    pub session_token: String,
    pub sequence_number: u64,
    pub issued_at_wallclock: DateTime<Utc>,
    pub kind: OperatorCommandKind,
    pub payload: serde_json::Value,
    /// Signature over (session_token, sequence_number, kind, payload). Scheme
    /// TBD per architecture.md Q9.
    pub signature: Vec<u8>,
}
