"""Adapter registry. Adapters receive (item, policy, params, config)
in-process, inject the secret through an approved channel, execute a
bounded operation, and return sanitized metadata only."""

from __future__ import annotations

from ..errors import denied


def _load():
    from . import http, ssh, git, cli_profile, browser
    return {
        "http": http.run,
        "ssh": ssh.run,
        "git": git.run,
        "cli-profile": cli_profile.run,
        "browser": browser.run,
    }


def _mods():
    from . import http, ssh, git, cli_profile, browser
    return {
        "http": http,
        "ssh": ssh,
        "git": git,
        "cli-profile": cli_profile,
        "browser": browser,
    }


class _Registry:
    _impl = None

    @classmethod
    def _mod(cls, adapter):
        if cls._impl is None:
            cls._impl = _mods()
        mod = cls._impl.get(adapter)
        if mod is None:
            raise denied(f"unknown adapter {adapter!r}")
        return mod

    @classmethod
    def validate(cls, adapter, item, policy, params, config):
        """Pre-execution policy/argument validation -- runs BEFORE the
        confirmation gate so target errors surface first."""
        mod = cls._mod(adapter)
        fn = getattr(mod, "validate", None)
        if fn:
            fn(item, policy, params, config)

    @classmethod
    def run(cls, adapter, item, policy, params, config):
        return cls._mod(adapter).run(item, policy, params, config)


registry = _Registry()