#!/usr/bin/env node
import { createHash, createPublicKey, verify } from 'node:crypto';
import { execFileSync, spawnSync } from 'node:child_process';
import { lstat, mkdir, readFile, writeFile } from 'node:fs/promises';
import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
import { pathToFileURL } from 'node:url';

import { canonicalValueBytes } from '../src/security/canonical-digest.ts';

const sha256Pattern = /^[a-f0-9]{64}$/u;
const datePattern = /^\d{4}-\d{2}-\d{2}$/u;
const reportNames = [
  'npm-audit-production.json',
  'npm-audit-development.json',
  'licenses.json',
  'sbom.cdx.json',
  'medium-triage.json',
  'execution-security.json',
];
const allowedLicenses = new Set([
  '0BSD', 'Apache-2.0', 'BlueOak-1.0.0', 'BSD-2-Clause', 'BSD-3-Clause', 'CC0-1.0', 'ISC', 'MIT', 'Python-2.0', 'Unlicense',
]);

const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
const isObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value);
const exactKeys = (value, keys) => isObject(value) && JSON.stringify(Object.keys(value).sort()) === JSON.stringify([...keys].sort());

async function safeRead(path, label) {
  const stats = await lstat(path);
  if (!stats.isFile() || stats.isSymbolicLink() || stats.nlink !== 1) throw new Error(`${label} must be one regular non-linked file.`);
  return readFile(path);
}

function parseJson(bytes, label) {
  try { return JSON.parse(bytes.toString('utf8')); } catch { throw new Error(`${label} is not valid JSON.`); }
}

function parseAudit(report, scope) {
  if (!isObject(report) || report.auditReportVersion !== 2 || !isObject(report.vulnerabilities)) {
    throw new Error(`${scope} npm audit evidence has an unsupported schema.`);
  }
  const findings = [];
  for (const [key, raw] of Object.entries(report.vulnerabilities)) {
    if (!isObject(raw) || raw.name !== key || !['info', 'low', 'moderate', 'high', 'critical'].includes(raw.severity) || typeof raw.range !== 'string') {
      throw new Error(`${scope} npm audit evidence contains an invalid finding.`);
    }
    findings.push({ scope, package: key, severity: raw.severity, range: raw.range });
  }
  return findings.sort((left, right) => `${left.scope}\0${left.package}`.localeCompare(`${right.scope}\0${right.package}`, 'en'));
}

function parseTriage(value, today) {
  if (!exactKeys(value, ['schema', 'findings']) || value.schema !== 'portfolio-medium-vulnerability-triage/v1' || !Array.isArray(value.findings)) {
    throw new Error('Medium vulnerability triage has an invalid envelope.');
  }
  const records = new Map();
  for (const finding of value.findings) {
    if (!exactKeys(finding, ['scope', 'package', 'severity', 'range', 'disposition', 'rationale', 'owner', 'reviewBy']) ||
        !['production', 'development'].includes(finding.scope) || finding.severity !== 'moderate' || finding.disposition !== 'accepted' ||
        typeof finding.package !== 'string' || finding.package.length === 0 || typeof finding.range !== 'string' || finding.range.length === 0 ||
        typeof finding.rationale !== 'string' || finding.rationale.trim().length < 20 || typeof finding.owner !== 'string' || finding.owner.trim().length === 0 ||
        typeof finding.reviewBy !== 'string' || !datePattern.test(finding.reviewBy) || finding.reviewBy < today) {
      throw new Error('Medium vulnerability triage contains an invalid, expired, or incomplete record.');
    }
    const key = `${finding.scope}\0${finding.package}\0${finding.range}`;
    if (records.has(key)) throw new Error('Medium vulnerability triage contains duplicate records.');
    records.set(key, finding);
  }
  return records;
}

function verifyLicenses(value, allowlist) {
  if (!isObject(value) || Object.keys(value).length === 0) throw new Error('License evidence is empty or invalid.');
  for (const [dependency, record] of Object.entries(value)) {
    if (!isObject(record) || typeof record.licenses !== 'string' || !allowlist.has(record.licenses)) {
      throw new Error(`Dependency ${dependency} has a missing or forbidden license.`);
    }
  }
  return Object.keys(value).length;
}

function verifySbom(value, packageJson) {
  if (!isObject(value) || value.bomFormat !== 'CycloneDX' || !/^1\.(?:5|6)$/u.test(value.specVersion) || value.version !== 1 ||
      !isObject(value.metadata) || !isObject(value.metadata.component) || value.metadata.component.type !== 'application' ||
      value.metadata.component.name !== packageJson.name || value.metadata.component.version !== packageJson.version ||
      (value.components !== undefined && !Array.isArray(value.components))) {
    throw new Error('CycloneDX SBOM is invalid or does not describe this package.');
  }
  const identities = new Set();
  for (const component of value.components ?? []) {
    if (!isObject(component) || typeof component.type !== 'string' || typeof component.name !== 'string' || typeof component.version !== 'string') {
      throw new Error('CycloneDX SBOM contains an invalid component.');
    }
    const identity = typeof component['bom-ref'] === 'string' ? component['bom-ref'] : `${component.type}\0${component.name}\0${component.version}`;
    if (identities.has(identity)) throw new Error('CycloneDX SBOM contains duplicate component identities.');
    identities.add(identity);
  }
  return identities.size;
}

function verifyToolProvenance(toolVersions, packageJson, packageLock) {
  if (!exactKeys(toolVersions, ['npm', 'cyclonedxNpm', 'licenseChecker']) ||
      typeof toolVersions.npm !== 'string' || !/^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$/u.test(toolVersions.npm)) {
    throw new Error('Supply-chain tool provenance is incomplete.');
  }
  const tools = [
    ['cyclonedxNpm', '@cyclonedx/cyclonedx-npm'],
    ['licenseChecker', 'license-checker-rseidelsohn'],
  ];
  for (const [field, dependency] of tools) {
    const locked = packageLock.packages?.[`node_modules/${dependency}`];
    if (typeof toolVersions[field] !== 'string' || toolVersions[field] !== locked?.version ||
        packageJson.devDependencies?.[dependency] !== locked.version || typeof locked.integrity !== 'string' || !locked.integrity.startsWith('sha512-')) {
      throw new Error(`Pinned ${dependency} tool provenance does not match the integrity-bound lockfile.`);
    }
  }
}

function timestamp(value, label) {
  if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/u.test(value) || Number.isNaN(Date.parse(value))) {
    throw new Error(`${label} must be a UTC RFC 3339 timestamp.`);
  }
  return value;
}

async function verifyExecutionSecurity(envelope, trustPath, now) {
  const trust = parseJson(await safeRead(resolve(trustPath), 'Execution evidence trust policy'), 'Execution evidence trust policy');
  if (!exactKeys(trust, ['schema', 'keyId', 'issuerEpoch', 'scope', 'publicKeyPem', 'revoked', 'expectedImageRoles']) ||
      trust.schema !== 'portfolio-execution-evidence-trust/v1' || trust.scope !== 'portfolio-execution-security-evidence/v1' ||
      typeof trust.keyId !== 'string' || !Number.isSafeInteger(trust.issuerEpoch) || trust.issuerEpoch < 1 ||
      typeof trust.publicKeyPem !== 'string' || trust.revoked !== false || !Array.isArray(trust.expectedImageRoles) ||
      trust.expectedImageRoles.length === 0 || trust.expectedImageRoles.some((role) => typeof role !== 'string') ||
      new Set(trust.expectedImageRoles).size !== trust.expectedImageRoles.length) {
    throw new Error('Execution evidence trust policy is invalid or revoked.');
  }
  if (!exactKeys(envelope, ['schema', 'payload', 'signature']) || envelope.schema !== 'portfolio-execution-security-evidence-envelope/v1' ||
      !isObject(envelope.payload) || !isObject(envelope.signature)) throw new Error('Execution security evidence envelope is invalid.');
  const payload = envelope.payload;
  if (!exactKeys(payload, ['schema', 'keyId', 'issuerEpoch', 'scope', 'generatedAt', 'expiresAt', 'images', 'nativeTools', 'repository']) ||
      payload.schema !== 'portfolio-execution-security-evidence/v1' || payload.scope !== trust.scope || payload.keyId !== trust.keyId ||
      payload.issuerEpoch !== trust.issuerEpoch || !Array.isArray(payload.images) || !Array.isArray(payload.nativeTools) || !isObject(payload.repository)) {
    throw new Error('Execution security evidence payload is invalid.');
  }
  const generatedAt = timestamp(payload.generatedAt, 'Execution evidence generatedAt');
  const expiresAt = timestamp(payload.expiresAt, 'Execution evidence expiresAt');
  const current = timestamp(now, 'Execution evidence current time');
  if (Date.parse(generatedAt) > Date.parse(current) || Date.parse(current) >= Date.parse(expiresAt)) throw new Error('Execution security evidence is expired or not yet valid.');
  const expectedRoles = [...trust.expectedImageRoles].sort();
  const roles = [];
  for (const image of payload.images) {
    if (!exactKeys(image, ['role', 'image', 'provenanceVerified', 'critical', 'high']) || typeof image.role !== 'string' ||
        typeof image.image !== 'string' || !/@sha256:[a-f0-9]{64}$/u.test(image.image) || image.provenanceVerified !== true ||
        !Number.isSafeInteger(image.critical) || !Number.isSafeInteger(image.high) || image.critical < 0 || image.high < 0) {
      throw new Error('Execution image provenance evidence is invalid or unsigned.');
    }
    if (image.critical > 0 || image.high > 0) throw new Error('Execution image is blocked by Critical/High vulnerabilities.');
    roles.push(image.role);
  }
  if (JSON.stringify(roles.sort()) !== JSON.stringify(expectedRoles)) throw new Error('Execution image role closure is incomplete or duplicated.');
  if (payload.nativeTools.length === 0) throw new Error('Native tool security evidence is empty.');
  const nativeNames = new Set();
  for (const tool of payload.nativeTools) {
    if (!exactKeys(tool, ['name', 'version', 'sha256', 'signatureVerified', 'critical', 'high']) || typeof tool.name !== 'string' ||
        typeof tool.version !== 'string' || !sha256Pattern.test(tool.sha256) || tool.signatureVerified !== true ||
        !Number.isSafeInteger(tool.critical) || !Number.isSafeInteger(tool.high) || tool.critical < 0 || tool.high < 0 || nativeNames.has(tool.name)) {
      throw new Error('Native tool provenance evidence is invalid or unsigned.');
    }
    if (tool.critical > 0 || tool.high > 0) throw new Error('Native tool is blocked by Critical/High vulnerabilities.');
    nativeNames.add(tool.name);
  }
  const repository = payload.repository;
  if (!exactKeys(repository, ['commitSha', 'secretScanPassed', 'historyScanPassed', 'ciActionsPinned', 'distributionNoticesComplete']) ||
      typeof repository.commitSha !== 'string' || !/^[a-f0-9]{40}$/u.test(repository.commitSha) || repository.secretScanPassed !== true ||
      repository.historyScanPassed !== true || repository.ciActionsPinned !== true || repository.distributionNoticesComplete !== true) {
    throw new Error('Repository secret/history/CI/distribution security evidence is incomplete.');
  }
  const signature = envelope.signature;
  if (!exactKeys(signature, ['algorithm', 'encoding', 'value']) || signature.algorithm !== 'Ed25519' || signature.encoding !== 'base64url-nopad' ||
      typeof signature.value !== 'string' || !/^[A-Za-z0-9_-]+$/u.test(signature.value)) throw new Error('Execution security evidence signature is invalid.');
  let publicKey;
  try { publicKey = createPublicKey(trust.publicKeyPem); } catch { throw new Error('Execution evidence public key is invalid.'); }
  if (!verify(null, canonicalValueBytes(payload), publicKey, Buffer.from(signature.value, 'base64url'))) {
    throw new Error('Execution security evidence signature verification failed.');
  }
  return { imageCount: roles.length, nativeToolCount: nativeNames.size };
}

function assertTracked(projectRoot, triagePath) {
  const rel = relative(projectRoot, triagePath);
  if (rel === '' || rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)) throw new Error('Committed Medium triage must be inside the project root.');
  try {
    execFileSync('git', ['ls-files', '--error-unmatch', '--', rel], { cwd: projectRoot, stdio: 'ignore' });
  } catch {
    throw new Error('Medium vulnerability triage must be committed to Git before release.');
  }
}

export async function verifySupplyChainEvidence(options) {
  const projectRoot = resolve(options.projectRoot);
  const evidenceDir = resolve(options.evidenceDir);
  const today = options.today ?? new Date().toISOString().slice(0, 10);
  if (!datePattern.test(today)) throw new Error('Trusted supply-chain date must be YYYY-MM-DD.');
  const packageJsonBytes = await safeRead(resolve(projectRoot, 'package.json'), 'package.json');
  const packageLockBytes = await safeRead(resolve(projectRoot, 'package-lock.json'), 'package-lock.json');
  const packageJson = parseJson(packageJsonBytes, 'package.json');
  const packageLock = parseJson(packageLockBytes, 'package-lock.json');
  if (!isObject(packageJson) || !isObject(packageLock) || packageLock.lockfileVersion !== 3 || packageLock.name !== packageJson.name || packageLock.version !== packageJson.version) {
    throw new Error('package.json and package-lock.json are not a clean matching npm lock pair.');
  }
  const manifest = parseJson(await safeRead(resolve(evidenceDir, 'evidence-manifest.json'), 'Supply-chain evidence manifest'), 'Supply-chain evidence manifest');
  if (!exactKeys(manifest, ['schema', 'packageJsonSha256', 'packageLockSha256', 'reports', 'toolVersions']) ||
      manifest.schema !== 'portfolio-supply-chain-evidence/v1' || manifest.packageJsonSha256 !== sha256(packageJsonBytes) ||
      manifest.packageLockSha256 !== sha256(packageLockBytes) || !isObject(manifest.reports) || !isObject(manifest.toolVersions) ||
      JSON.stringify(Object.keys(manifest.reports).sort()) !== JSON.stringify([...reportNames].sort())) {
    throw new Error('Supply-chain evidence manifest or lockfile digest is invalid.');
  }
  verifyToolProvenance(manifest.toolVersions, packageJson, packageLock);
  const reports = {};
  for (const name of reportNames) {
    const bytes = await safeRead(resolve(evidenceDir, name), `Supply-chain report ${name}`);
    if (!sha256Pattern.test(manifest.reports[name]) || manifest.reports[name] !== sha256(bytes)) throw new Error(`Supply-chain report digest mismatch: ${name}`);
    reports[name] = parseJson(bytes, name);
  }
  const production = parseAudit(reports['npm-audit-production.json'], 'production');
  const development = parseAudit(reports['npm-audit-development.json'], 'development');
  const all = [...production, ...development];
  const critical = all.filter((finding) => finding.severity === 'critical').length;
  const high = all.filter((finding) => finding.severity === 'high').length;
  if (critical > 0 || high > 0) throw new Error(`Supply chain is blocked by ${critical} Critical and ${high} High finding(s).`);
  const mediumFindings = all.filter((finding) => finding.severity === 'moderate');
  const triage = parseTriage(reports['medium-triage.json'], today);
  const expectedTriage = new Set(mediumFindings.map((finding) => `${finding.scope}\0${finding.package}\0${finding.range}`));
  if (triage.size !== expectedTriage.size || [...expectedTriage].some((key) => !triage.has(key))) {
    throw new Error('Every Medium finding requires one exact current triage record, with no stale extras.');
  }
  if (options.requireTrackedTriage !== false && mediumFindings.length > 0) assertTracked(projectRoot, resolve(evidenceDir, 'medium-triage.json'));
  const licenseCount = verifyLicenses(reports['licenses.json'], options.allowedLicenses ?? allowedLicenses);
  const componentCount = verifySbom(reports['sbom.cdx.json'], packageJson);
  if (typeof options.toolTrustPolicyPath !== 'string') throw new Error('Execution evidence trust policy is required.');
  const execution = await verifyExecutionSecurity(reports['execution-security.json'], options.toolTrustPolicyPath, options.now ?? new Date().toISOString());
  return { schema: 'portfolio-supply-chain-verification/v1', critical, high, medium: mediumFindings.length, licenseCount, componentCount,
    executionImages: execution.imageCount, nativeTools: execution.nativeToolCount,
    packageLockSha256: manifest.packageLockSha256, evidenceManifestSha256: sha256(await safeRead(resolve(evidenceDir, 'evidence-manifest.json'), 'Supply-chain evidence manifest')) };
}

function runTool(command, args, cwd, options = {}) {
  const result = spawnSync(command, args, { cwd, encoding: 'utf8', env: { PATH: process.env.PATH ?? '', LANG: 'C.UTF-8', LC_ALL: 'C.UTF-8', NO_COLOR: '1' }, maxBuffer: 64 * 1024 * 1024 });
  if (result.error || (!options.allowAuditExit && result.status !== 0) || (options.allowAuditExit && ![0, 1].includes(result.status))) {
    throw new Error(`${command} ${args[0] ?? ''} failed without producing trusted evidence.`);
  }
  return result.stdout;
}

async function collectEvidence(projectRoot, evidenceDir, triagePath, executionSecurityPath) {
  await mkdir(evidenceDir, { recursive: false });
  const beforePackage = await safeRead(resolve(projectRoot, 'package.json'), 'package.json');
  const beforeLock = await safeRead(resolve(projectRoot, 'package-lock.json'), 'package-lock.json');
  const npmVersion = runTool('npm', ['--version'], projectRoot).trim();
  runTool('npm', ['ci', '--ignore-scripts'], projectRoot);
  const productionAudit = runTool('npm', ['audit', '--omit=dev', '--json'], projectRoot, { allowAuditExit: true });
  const developmentAudit = runTool('npm', ['audit', '--json'], projectRoot, { allowAuditExit: true });
  const licenseBin = resolve(projectRoot, 'node_modules/.bin/license-checker-rseidelsohn');
  const cyclonedxBin = resolve(projectRoot, 'node_modules/.bin/cyclonedx-npm');
  const licenses = runTool(licenseBin, ['--json'], projectRoot);
  const sbomPath = resolve(evidenceDir, 'sbom.cdx.json');
  runTool(cyclonedxBin, ['--output-file', sbomPath, '--output-format', 'JSON', '--spec-version', '1.6'], projectRoot);
  const afterPackage = await safeRead(resolve(projectRoot, 'package.json'), 'package.json');
  const afterLock = await safeRead(resolve(projectRoot, 'package-lock.json'), 'package-lock.json');
  if (sha256(beforePackage) !== sha256(afterPackage) || sha256(beforeLock) !== sha256(afterLock)) throw new Error('npm ci changed package metadata or lockfile.');
  const triage = await safeRead(triagePath, 'Committed Medium triage');
  const executionSecurity = await safeRead(executionSecurityPath, 'Signed execution security evidence');
  const output = {
    'npm-audit-production.json': Buffer.from(productionAudit), 'npm-audit-development.json': Buffer.from(developmentAudit),
    'licenses.json': Buffer.from(licenses), 'sbom.cdx.json': await safeRead(sbomPath, 'Generated CycloneDX SBOM'), 'medium-triage.json': triage,
    'execution-security.json': executionSecurity,
  };
  for (const [name, bytes] of Object.entries(output)) if (name !== 'sbom.cdx.json') await writeFile(resolve(evidenceDir, name), bytes, { flag: 'wx', mode: 0o400 });
  const lock = parseJson(beforeLock, 'package-lock.json');
  const manifest = { schema: 'portfolio-supply-chain-evidence/v1', packageJsonSha256: sha256(beforePackage), packageLockSha256: sha256(beforeLock),
    reports: Object.fromEntries(reportNames.map((name) => [name, sha256(output[name])])), toolVersions: { npm: npmVersion,
      cyclonedxNpm: lock.packages?.['node_modules/@cyclonedx/cyclonedx-npm']?.version, licenseChecker: lock.packages?.['node_modules/license-checker-rseidelsohn']?.version } };
  await writeFile(resolve(evidenceDir, 'evidence-manifest.json'), `${JSON.stringify(manifest, null, 2)}\n`, { flag: 'wx', mode: 0o400 });
}

function parseArguments(args) {
  const command = args.shift();
  const values = { alternate: [] };
  for (let index = 0; index < args.length; index += 2) {
    const key = args[index]; const value = args[index + 1];
    if (!key?.startsWith('--') || !value || Object.hasOwn(values, key.slice(2))) throw new Error('Supply-chain arguments must be unique complete name/value pairs.');
    values[key.slice(2)] = value;
  }
  return { command, values };
}

async function main() {
  const { command, values } = parseArguments(process.argv.slice(2));
  const projectRoot = resolve(values.project ?? '.');
  const evidenceDir = resolve(values.evidence ?? 'release-evidence/supply-chain');
  if (command === 'collect') {
    if (values['allow-registry-network'] !== 'yes') throw new Error('Collection requires --allow-registry-network yes in a credentialless registry-only sandbox.');
    if (!values.triage) throw new Error('Collection requires --triage <committed-record>.');
    if (!values['execution-security']) throw new Error('Collection requires --execution-security <signed-evidence>.');
    await collectEvidence(projectRoot, evidenceDir, resolve(values.triage), resolve(values['execution-security']));
  } else if (command !== 'verify') throw new Error('Usage: supply-chain-check.mjs <collect|verify> --project <root> --evidence <dir>.');
  if (!values['tool-trust-policy']) throw new Error('Verification requires --tool-trust-policy <protected-policy>.');
  process.stdout.write(`${JSON.stringify(await verifySupplyChainEvidence({ projectRoot, evidenceDir, today: values.today, now: values.now, toolTrustPolicyPath: resolve(values['tool-trust-policy']) }))}\n`);
}

if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  main().catch((error) => { process.stderr.write(`Supply-chain verification failed: ${error instanceof Error ? error.message : 'unknown error'}\n`); process.exitCode = 1; });
}