arcature-cli 2026.1.1

//! Typed errors for UAG (Unified Application Graph) loading in the CLI.
//!
//! No raw `String` errors (AGENTS.md §18). [`SchemaError`] covers exactly
//! the failures the UAG load path can encounter: a manifest that cannot be
//! read, one that cannot be parsed, one whose schema version is
//! incompatible, and the shell-out to `arcature-metadata` failing. There
//! are no "future-proof" variants.
//!
//! The error deliberately **does not carry the upstream JSON parse message
//! verbatim** for the parse failure: a malformed manifest may include
//! attacker-influenced content (a hand-edited `.arcature/app-manifest.json`),
//! and the redaction discipline (`arcature_observe::redact`) is to classify
//! rather than relay. It records the path and the serde error kind via the
//! source chain (preserved for diagnostics) without surfacing the raw
//! upstream text in the `Display` that an MCP client would see.

use std::fmt;
use std::path::PathBuf;

/// A typed failure loading or validating a UAG manifest.
#[derive(Debug)]
pub(crate) enum SchemaError {
    /// Reading the manifest file from disk failed.
    ReadManifest {
        path: PathBuf,
        source: std::io::Error,
    },
    /// The manifest could not be parsed as a [`Uag`] JSON artifact.
    ParseManifest {
        path: PathBuf,
        source: serde_json::Error,
    },
    /// The manifest's `schema_version` does not match the CLI's
    /// [`SCHEMA_VERSION`]. The CLI rejects an incompatible artifact rather
    /// than guessing at a newer/older format (ADR-0006 §2).
    IncompatibleSchema { found: u32, expected: u32 },
    /// Shelling out to `arcature-metadata` to produce a fresh UAG failed.
    /// Carries the captured process-error summary; the full upstream
    /// `Display` is summarized to avoid relaying potentially
    /// secret-bearing or hostile stdout verbatim.
    RunMetadata(String),
}

impl fmt::Display for SchemaError {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            Self::ReadManifest { path, .. } => {
                write!(f, "cannot read UAG manifest at {}", path.display())
            }
            Self::ParseManifest { path, .. } => {
                write!(
                    f,
                    "UAG manifest at {} is not valid UAG JSON",
                    path.display()
                )
            }
            Self::IncompatibleSchema { found, expected } => write!(
                f,
                "UAG manifest schema version {found} is incompatible with this CLI (expected {expected})"
            ),
            Self::RunMetadata(summary) => {
                write!(f, "cannot produce a fresh UAG: {summary}")
            }
        }
    }
}

impl std::error::Error for SchemaError {
    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
        match self {
            Self::ReadManifest { source, .. } => Some(source),
            Self::ParseManifest { source, .. } => Some(source),
            Self::IncompatibleSchema { .. } | Self::RunMetadata(_) => None,
        }
    }
}

#[cfg(test)]
pub(crate) mod tests {
    use super::*;

    /// Shared assertion used by both this module's tests and the loader's
    /// tests so the error `Display` contract is checked once, centrally.
    pub(crate) fn assert_display_stable() {
        let read = SchemaError::ReadManifest {
            path: PathBuf::from("/x/app-manifest.json"),
            source: std::io::Error::new(std::io::ErrorKind::NotFound, "missing"),
        };
        assert!(
            read.to_string().contains("cannot read UAG manifest"),
            "{}",
            read
        );

        let parse = SchemaError::ParseManifest {
            path: PathBuf::from("/x/app-manifest.json"),
            source: serde_json::from_str::<serde_json::Value>("bad").unwrap_err(),
        };
        assert!(
            parse.to_string().contains("not valid UAG JSON"),
            "{}",
            parse
        );

        let incompat = SchemaError::IncompatibleSchema {
            found: 99,
            expected: 1,
        };
        assert!(
            incompat.to_string().contains("incompatible"),
            "{}",
            incompat
        );

        let run = SchemaError::RunMetadata("boom".to_owned());
        assert!(run.to_string().contains("fresh UAG"), "{}", run);
    }

    #[test]
    fn display_covers_all_variants() {
        assert_display_stable();
    }

    #[test]
    fn parse_manifest_preserves_source_chain() {
        let err = SchemaError::ParseManifest {
            path: PathBuf::from("/x/m.json"),
            source: serde_json::from_str::<serde_json::Value>("bad").unwrap_err(),
        };
        assert!(std::error::Error::source(&err).is_some());
    }
}