ggen-core 26.6.11

//! Lockfile manager for governed marketplace packs.
//!
//! This module provides the real lockfile implementation for the ggen marketplace,
//! tracking atomic packs, bundles, and profiles with cryptographic provenance.
//!
//! ## Features
//!
//! - **Atomic pack tracking**: Lock exact versions, digests, signatures, trust tiers
//! - **Bundle expansion**: Track which bundles expanded to which atomic packs
//! - **Profile enforcement**: Record runtime profile and trust requirements
//! - **Cryptographic verification**: SHA-256 digests, Ed25519 signatures
//! - **Trust tier tracking**: Enterprise certification status per pack
//! - **Dependency graph**: Full transitive dependency resolution
//!
//! ## Lockfile Format
//!
//! The `.ggen/packs.lock` file is a JSON file with the following structure:
//!
//! ```json
//! {
//!   "version": 1,
//!   "packs": [
//!     {
//!       "pack_id": "surface-mcp",
//!       "version": "1.0.0",
//!       "source": {
//!         "Registry": { "url": "https://registry.ggen.io" }
//!       },
//!       "digest": "sha256:abc123...",
//!       "signature": "ed25519:...",
//!       "trust_tier": "EnterpriseCertified",
//!       "dependencies": ["core-ontology", "core-hooks"]
//!     }
//!   ],
//!   "bundles": [
//!     {
//!       "bundle_id": "mcp-rust",
//!       "expanded_to": ["surface-mcp", "projection-rust", "runtime-axum"]
//!     }
//!   ],
//!   "profile": {
//!     "profile_id": "enterprise-strict",
//!     "runtime_constraints": ["require-explicit-runtime"],
//!     "trust_requirement": "EnterpriseCertified"
//!   },
//!   "digest": "sha256:...",
//!   "signature": null
//! }
//! ```
//!
//! ## Examples
//!
//! ### Creating a Lockfile
//!
//! ```rust,no_run
//! use ggen_core::lockfile::{Lockfile, ProfileRef};
//! use ggen_core::marketplace::trust::TrustTier;
//!
//! let profile = ProfileRef {
//!     profile_id: "default".to_string(),
//!     runtime_constraints: vec![],
//!     trust_requirement: TrustTier::CommunityReviewed,
//! };
//! let lockfile = Lockfile::new(profile);
//! assert!(lockfile.packs.is_empty());
//! ```
//!
//! ### Adding a Pack to the Lockfile
//!
//! ```rust,no_run
//! use ggen_core::lockfile::{Lockfile, LockfileEntry, ProfileRef, RegistrySource};
//! use ggen_core::marketplace::trust::TrustTier;
//!
//! # fn main() -> ggen_core::utils::error::Result<()> {
//! let profile = ProfileRef {
//!     profile_id: "default".to_string(),
//!     runtime_constraints: vec![],
//!     trust_requirement: TrustTier::CommunityReviewed,
//! };
//! let mut lockfile = Lockfile::new(profile);
//!
//! let entry = LockfileEntry::new(
//!     "io.ggen.rust.cli".to_string(),
//!     "1.0.0".to_string(),
//!     RegistrySource::Registry { url: "https://github.com/example/pack.git".to_string() },
//!     "abc123...".to_string(),
//!     String::new(),
//!     TrustTier::CommunityReviewed,
//!     vec![],
//! );
//! lockfile.add_pack(entry);
//! # Ok(())
//! # }
//! ```

use crate::marketplace::trust::TrustTier;
use crate::utils::error::{Error, Result};
use serde::{Deserialize, Serialize};
use sha2::{Digest, Sha256};
use std::fs;
use std::path::{Path, PathBuf};

/// Governed marketplace lockfile.
///
/// Tracks atomic packs, bundles, and profiles with cryptographic provenance.
/// This is the real lockfile implementation for the marketplace.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Lockfile {
    /// Lockfile format version
    pub version: u64,

    /// Atomic packs in the lockfile
    pub packs: Vec<LockfileEntry>,

    /// Bundle expansions (bundle_id -> atomic packs)
    pub bundles: Vec<BundleExpansion>,

    /// Runtime profile used for this composition
    pub profile: ProfileRef,

    /// SHA-256 digest of entire lockfile (for verification)
    pub digest: String,

    /// Optional Ed25519 signature (for enterprise environments)
    #[serde(skip_serializing_if = "Option::is_none")]
    pub signature: Option<String>,
}

/// Entry for a single atomic pack in the lockfile.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct LockfileEntry {
    /// Atomic pack identifier (e.g., "surface-mcp", "projection-rust")
    pub pack_id: String,

    /// Exact version (semver)
    pub version: String,

    /// Source where pack was obtained
    pub source: RegistrySource,

    /// SHA-256 digest of pack contents
    pub digest: String,

    /// Ed25519 signature (hex)
    pub signature: String,

    /// Trust tier classification
    pub trust_tier: TrustTier,

    /// Transitive dependencies
    pub dependencies: Vec<String>,
}

/// Bundle expansion record.
///
/// Tracks which bundles expanded to which atomic packs.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct BundleExpansion {
    /// Bundle identifier (e.g., "mcp-rust")
    pub bundle_id: String,

    /// Atomic packs this bundle expanded to
    pub expanded_to: Vec<String>,
}

/// Registry source for a pack.
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(tag = "type")]
pub enum RegistrySource {
    /// Local filesystem path
    Local { path: PathBuf },

    /// Remote registry URL
    Registry { url: String },

    /// Cache location
    Cache { path: PathBuf },
}

/// Runtime profile reference.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ProfileRef {
    /// Profile identifier (e.g., "enterprise-strict")
    pub profile_id: String,

    /// Runtime constraints applied
    pub runtime_constraints: Vec<String>,

    /// Trust tier requirement
    pub trust_requirement: TrustTier,
}

impl Lockfile {
    /// Create a new empty lockfile.
    pub fn new(profile: ProfileRef) -> Self {
        let lockfile = Self {
            version: 1,
            packs: Vec::new(),
            bundles: Vec::new(),
            profile,
            digest: String::new(), // Computed below
            signature: None,
        };

        // Compute initial digest
        lockfile.with_computed_digest()
    }

    /// Compute SHA-256 digest of lockfile contents.
    fn compute_digest(&self) -> String {
        let mut hasher = Sha256::new();
        hasher.update(self.version.to_string().as_bytes());

        for pack in &self.packs {
            hasher.update(pack.pack_id.as_bytes());
            hasher.update(b":");
            hasher.update(pack.version.as_bytes());
            hasher.update(b":");
            hasher.update(pack.digest.as_bytes());
            hasher.update(b"\n");
        }

        for bundle in &self.bundles {
            hasher.update(bundle.bundle_id.as_bytes());
            hasher.update(b":");
            for expanded in &bundle.expanded_to {
                hasher.update(expanded.as_bytes());
                hasher.update(b",");
            }
            hasher.update(b"\n");
        }

        hasher.update(self.profile.profile_id.as_bytes());
        format!("{:x}", hasher.finalize())
    }

    /// Create a lockfile with computed digest.
    fn with_computed_digest(mut self) -> Self {
        self.digest = self.compute_digest();
        self
    }

    /// Add an atomic pack to the lockfile.
    pub fn add_pack(&mut self, entry: LockfileEntry) {
        // Remove existing entry if present
        self.packs.retain(|p| p.pack_id != entry.pack_id);
        self.packs.push(entry);
    }

    /// Add a bundle expansion to the lockfile.
    pub fn add_bundle(&mut self, expansion: BundleExpansion) {
        // Remove existing expansion if present
        self.bundles.retain(|b| b.bundle_id != expansion.bundle_id);
        self.bundles.push(expansion);
    }

    /// Save lockfile to `.ggen/packs.lock`.
    pub fn save(&self, project_root: &Path) -> Result<()> {
        let lockfile_path = project_root.join(".ggen").join("packs.lock");

        // Create parent directory
        if let Some(parent) = lockfile_path.parent() {
            fs::create_dir_all(parent).map_err(|e| {
                Error::new(&format!(
                    "Failed to create lockfile directory '{}': {}",
                    parent.display(),
                    e
                ))
            })?;
        }

        // Serialize with computed digest
        let lockfile_with_digest = self.clone().with_computed_digest();
        let json = serde_json::to_string_pretty(&lockfile_with_digest)
            .map_err(|e| Error::new(&format!("Failed to serialize lockfile: {}", e)))?;

        fs::write(&lockfile_path, json).map_err(|e| {
            Error::new(&format!(
                "Failed to write lockfile to '{}': {}",
                lockfile_path.display(),
                e
            ))
        })?;

        Ok(())
    }

    /// Load lockfile from `.ggen/packs.lock`.
    pub fn load(project_root: &Path) -> Result<Option<Self>> {
        let lockfile_path = project_root.join(".ggen").join("packs.lock");

        if !lockfile_path.exists() {
            return Ok(None);
        }

        let content = fs::read_to_string(&lockfile_path).map_err(|e| {
            Error::new(&format!(
                "Failed to read lockfile from '{}': {}",
                lockfile_path.display(),
                e
            ))
        })?;

        let lockfile: Lockfile = serde_json::from_str(&content)
            .map_err(|e| Error::new(&format!("Failed to parse lockfile: {}", e)))?;

        // Verify digest
        let computed_digest = lockfile.compute_digest();
        if computed_digest != lockfile.digest {
            return Err(Error::new(&format!(
                "Lockfile digest mismatch: expected {}, got {}",
                lockfile.digest, computed_digest
            )));
        }

        Ok(Some(lockfile))
    }

    /// Verify lockfile integrity.
    pub fn verify(&self) -> Result<bool> {
        let computed = self.compute_digest();
        Ok(computed == self.digest)
    }

    /// Get pack by ID.
    pub fn get_pack(&self, pack_id: &str) -> Option<&LockfileEntry> {
        self.packs.iter().find(|p| p.pack_id == pack_id)
    }

    /// Get all pack IDs.
    pub fn pack_ids(&self) -> Vec<String> {
        self.packs.iter().map(|p| p.pack_id.clone()).collect()
    }
}

impl LockfileEntry {
    /// Create a new lockfile entry.
    pub fn new(
        pack_id: String, version: String, source: RegistrySource, digest: String,
        signature: String, trust_tier: TrustTier, dependencies: Vec<String>,
    ) -> Self {
        Self {
            pack_id,
            version,
            source,
            digest,
            signature,
            trust_tier,
            dependencies,
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use tempfile::TempDir;

    fn create_test_profile() -> ProfileRef {
        ProfileRef {
            profile_id: "enterprise-strict".to_string(),
            runtime_constraints: vec!["require-explicit-runtime".to_string()],
            trust_requirement: TrustTier::EnterpriseCertified,
        }
    }

    #[test]
    fn test_lockfile_creation() {
        let profile = create_test_profile();
        let lockfile = Lockfile::new(profile);

        assert_eq!(lockfile.version, 1);
        assert_eq!(lockfile.packs.len(), 0);
        assert_eq!(lockfile.bundles.len(), 0);
        assert!(!lockfile.digest.is_empty());
    }

    #[test]
    fn test_lockfile_add_pack() {
        let profile = create_test_profile();
        let mut lockfile = Lockfile::new(profile);

        let entry = LockfileEntry::new(
            "surface-mcp".to_string(),
            "1.0.0".to_string(),
            RegistrySource::Registry {
                url: "https://registry.ggen.io".to_string(),
            },
            "sha256:abc123".to_string(),
            "ed25519:def456".to_string(),
            TrustTier::EnterpriseCertified,
            vec!["core-ontology".to_string()],
        );

        lockfile.add_pack(entry);

        assert_eq!(lockfile.packs.len(), 1);
        assert_eq!(lockfile.packs[0].pack_id, "surface-mcp");
    }

    #[test]
    fn test_lockfile_add_bundle() {
        let profile = create_test_profile();
        let mut lockfile = Lockfile::new(profile);

        let expansion = BundleExpansion {
            bundle_id: "mcp-rust".to_string(),
            expanded_to: vec![
                "surface-mcp".to_string(),
                "projection-rust".to_string(),
                "runtime-axum".to_string(),
            ],
        };

        lockfile.add_bundle(expansion);

        assert_eq!(lockfile.bundles.len(), 1);
        assert_eq!(lockfile.bundles[0].bundle_id, "mcp-rust");
    }

    #[test]
    fn test_lockfile_save_and_load() {
        let temp_dir = TempDir::new().unwrap();
        let profile = create_test_profile();
        let mut lockfile = Lockfile::new(profile.clone());

        let entry = LockfileEntry::new(
            "surface-mcp".to_string(),
            "1.0.0".to_string(),
            RegistrySource::Local {
                path: PathBuf::from("/tmp/pack"),
            },
            "sha256:abc123".to_string(),
            "sig".to_string(),
            TrustTier::EnterpriseCertified,
            vec![],
        );

        lockfile.add_pack(entry);
        lockfile.save(temp_dir.path()).unwrap();

        let loaded = Lockfile::load(temp_dir.path()).unwrap().unwrap();
        assert_eq!(loaded.packs.len(), 1);
        assert_eq!(loaded.packs[0].pack_id, "surface-mcp");
        assert_eq!(loaded.profile.profile_id, "enterprise-strict");
    }

    #[test]
    fn test_lockfile_verify() {
        let profile = create_test_profile();
        let lockfile = Lockfile::new(profile);

        // Fresh lockfile should verify
        assert!(lockfile.verify().unwrap());
    }

    #[test]
    fn test_lockfile_get_pack() {
        let profile = create_test_profile();
        let mut lockfile = Lockfile::new(profile);

        let entry = LockfileEntry::new(
            "surface-mcp".to_string(),
            "1.0.0".to_string(),
            RegistrySource::Registry {
                url: "https://registry.ggen.io".to_string(),
            },
            "sha256:abc123".to_string(),
            "sig".to_string(),
            TrustTier::EnterpriseCertified,
            vec![],
        );

        lockfile.add_pack(entry);

        let retrieved = lockfile.get_pack("surface-mcp");
        assert!(retrieved.is_some());
        assert_eq!(retrieved.unwrap().version, "1.0.0");

        let missing = lockfile.get_pack("nonexistent");
        assert!(missing.is_none());
    }

    #[test]
    fn test_lockfile_digest_changes_with_packs() {
        let profile = create_test_profile();
        let lockfile1 = Lockfile::new(profile.clone());
        let digest1 = lockfile1.digest.clone();

        let mut lockfile2 = Lockfile::new(profile);
        lockfile2.add_pack(LockfileEntry::new(
            "surface-mcp".to_string(),
            "1.0.0".to_string(),
            RegistrySource::Registry {
                url: "https://registry.ggen.io".to_string(),
            },
            "sha256:abc123".to_string(),
            "sig".to_string(),
            TrustTier::EnterpriseCertified,
            vec![],
        ));

        let lockfile2 = lockfile2.with_computed_digest();
        let digest2 = lockfile2.digest;

        assert_ne!(digest1, digest2);
    }
}