/**
 * Pack Publish Workflow (orchestrator across W2.3 + W1.4).
 *
 * Pulls together the auto-pack generator (W2.3) and the pack version store
 * (W1.4) into a single customer happy-path:
 *
 *   1. Customer scans an agent (W2.1 / W2.2 / W4.3 produce AgentManifest).
 *   2. Scanner + auto-pack generator emits proposedRules.
 *   3. Customer reviews + selects acceptedRules.
 *   4. publishGeneratedPack(...) authors the pack, publishes a version,
 *      optionally activates it (or sets shadow mode for a soft rollout),
 *      and returns the result + the version events.
 *
 * Pure orchestration — uses already-tested W1.4 + W2.3 modules. No HTTP,
 * no IO beyond what the version store itself does (in-memory by default).
 *
 * @connexum/ai-governance  F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12
 */
import { autoGenerateCompanyPack, } from './auto-pack-generator.js';
import { PackVersionStore, } from './pack-versioning.js';
import { validatePackInput } from './pack-rule-validator.js';
/**
 * Thrown when validatePackInput() returns errors (ERROR-severity issues
 * in the auto-generated pack). The report is preserved so the caller / UI
 * can surface the specific issues to the customer.
 */
export class PackValidationError extends Error {
    report;
    constructor(message, report) {
        super(message);
        this.name = 'PackValidationError';
        this.report = report;
    }
}
/**
 * End-to-end happy-path: scan -> auto-pack -> publish -> (activate | shadow).
 * Returns the AutoPackResult, the resulting PackVersionRecord, and every
 * PackVersionEvent emitted during this call (for audit forwarding).
 */
export function publishGeneratedPack(input) {
    if (!input.publishedBy || input.publishedBy.trim() === '') {
        throw new Error('publishGeneratedPack: publishedBy is required (audit)');
    }
    const events = [];
    const versionStore = input.versionStore ?? new PackVersionStore((e) => events.push(e));
    // If the caller passed their own store, we still capture events emitted
    // from THIS call by sub-classing the sink. Cheapest: re-fire through
    // a local sink wrapper. The caller's store has its own sink.
    // For local-only stores we already attached the sink at construction.
    const autoPack = autoGenerateCompanyPack(input.manifest, input.autoPack);
    // Schema-gate the pack BEFORE persisting a version. Errors block the publish;
    // warnings are surfaced in the result for the UI/CLI to render.
    const validation = validatePackInput({
        id: autoPack.pack.id,
        version: autoPack.pack.version,
        orgId: input.manifest.agentId ? `org-${input.manifest.agentId}` : undefined,
        rules: autoPack.acceptedRules,
        isolation: autoPack.pack.requiresActionIsolation,
    });
    if (!validation.ok) {
        throw new PackValidationError(`publishGeneratedPack: schema validation failed with ${validation.errors.length} error(s)`, validation);
    }
    let versionRecord = versionStore.publishVersion(autoPack.pack, input.publishedBy, input.changelog ?? buildDefaultChangelog(autoPack));
    const postPublish = input.postPublish ?? 'draft';
    if (postPublish === 'active') {
        versionRecord = versionStore.setActive(autoPack.pack.id, autoPack.pack.version, input.publishedBy);
    }
    else if (postPublish === 'shadow') {
        versionRecord = versionStore.setShadow(autoPack.pack.id, autoPack.pack.version, input.publishedBy);
    }
    return { autoPack, versionRecord, events, validation };
}
function buildDefaultChangelog(autoPack) {
    const c = autoPack.scanReport.countsBySeverity;
    return (`Auto-published from OWASP Agentic scan. ` +
        `Findings: CRIT=${c.CRIT} HIGH=${c.HIGH} MED=${c.MED} LOW=${c.LOW}. ` +
        `Build-structure score: ${autoPack.scanReport.buildStructureScore}. ` +
        `Rules accepted: ${autoPack.acceptedRules.length} / ${autoPack.proposedRules.length}.`);
}
//# sourceMappingURL=pack-publish-workflow.js.map