Lab I — TyphoonCover,
a parametric product end to end

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

/// TyphoonCover — parametric windstorm cover (teaching build).
/// Trigger: authorised oracle reports peak wind for the fixed zone.
/// If kph >= TRIGGER during the window, every holder can claim the fixed payout.
contract TyphoonCover {
    address public immutable insurer;
    address public oracle;                      // authorised reporter

    uint256 public constant PREMIUM     = 0.02 ether;
    uint256 public constant PAYOUT      = 0.2 ether;
    uint32  public constant TRIGGER_KPH = 185;
    uint64  public immutable coverStart;
    uint64  public immutable coverEnd;

    struct Cover { bool active; bool settled; }
    mapping(address => Cover) public covers;
    uint256 public soldCount;
    uint32  public reportedPeakKph;
    bool    public triggered;

    event CoverBought(address indexed holder);
    event WindReported(uint32 kph, bool triggered);
    event PayoutClaimed(address indexed holder, uint256 amount);
    event PremiumRefunded(address indexed holder);

    error WrongPremium();  error SaleClosed();   error AlreadyCovered();
    error NotOracle();     error OutsideWindow(); error NotTriggered();
    error NothingToSettle(); error TooEarly();    error NoDataFailure();

    constructor(address _oracle, uint64 _start, uint64 _end) payable {
        insurer = msg.sender; oracle = _oracle;
        coverStart = _start; coverEnd = _end;      // deployer funds the reserve via VALUE
    }

    /// Sales close when the cover window opens — no buying mid-typhoon.
    function buyCover() external payable {
        if (msg.value != PREMIUM) revert WrongPremium();
        if (block.timestamp >= coverStart) revert SaleClosed();
        if (covers[msg.sender].active) revert AlreadyCovered();
        // solvency-as-code: never sell cover the reserve can't pay
        require(address(this).balance >= (soldCount + 1) * PAYOUT, "capacity exhausted");
        covers[msg.sender] = Cover(true, false);
        soldCount++;
        emit CoverBought(msg.sender);
    }

    /// Oracle reports readings during the window; the max is retained.
    function reportWind(uint32 kph) external {
        if (msg.sender != oracle) revert NotOracle();
        if (block.timestamp < coverStart || block.timestamp > coverEnd) revert OutsideWindow();
        if (kph > reportedPeakKph) reportedPeakKph = kph;
        if (kph >= TRIGGER_KPH) triggered = true;
        emit WindReported(kph, triggered);
    }

    /// Pull-payment claims: each holder claims their own payout (no payout loops — M02 wound #6).
    function claim() external {
        if (!triggered) revert NotTriggered();
        Cover storage c = covers[msg.sender];
        if (!c.active || c.settled) revert NothingToSettle();
        c.settled = true;                               // effects before interaction
        (bool ok, ) = msg.sender.call{value: PAYOUT}("");
        require(ok, "transfer failed");
        emit PayoutClaimed(msg.sender, PAYOUT);
    }

    /// Escape hatch: window closed and the oracle NEVER reported → refund premiums.
    /// An oracle outage must strand the insurer, not the customer.
    function refundOnDataFailure() external {
        if (block.timestamp <= coverEnd + 3 days) revert TooEarly();
        if (reportedPeakKph != 0 || triggered) revert NoDataFailure();
        Cover storage c = covers[msg.sender];
        if (!c.active || c.settled) revert NothingToSettle();
        c.settled = true;
        (bool ok, ) = msg.sender.call{value: PREMIUM}("");
        require(ok, "transfer failed");
        emit PremiumRefunded(msg.sender);
    }

    /// Residual reserve returns to the insurer only after the settlement window.
    function sweep() external {
        require(msg.sender == insurer, "not insurer");
        require(block.timestamp > coverEnd + 30 days, "settlement open");
        (bool ok, ) = insurer.call{value: address(this).balance}("");
        require(ok, "transfer failed");
    }
}