// tools/create-spec-hu/supply-chain-hu-adapter.ts — SPEC-046
// Adds supply chain security criteria to HU.md for backend/fullstack/shared specs.
/** Targets that should receive supply chain criteria. */
const SUPPLY_CHAIN_TARGETS = new Set(['backend', 'fullstack', 'shared']);
/** Stack signals indicating artifact publishing. */
const PUBLISH_SIGNALS = [
    'npm publish',
    'pypi',
    'crates.io',
    'maven central',
    'docker',
    'container',
    'release',
];
/** Detect whether the project has supply chain risks warranting criteria. */
function hasSupplyChainRisks(knowledge) {
    if (!knowledge) {
        return false;
    }
    const sc = knowledge.supplyChain;
    if (!sc) {
        return false;
    }
    // Only add criteria when there are critical or warning gaps
    return sc.gaps.some((g) => g.severity === 'critical' || g.severity === 'warning');
}
/** Check if the spec involves public artifact distribution. */
function isPublishingSpec(target, knowledge) {
    if (!SUPPLY_CHAIN_TARGETS.has(target)) {
        return false;
    }
    if (!knowledge) {
        return false;
    }
    const stack = Array.isArray(knowledge.stack) ? knowledge.stack : [];
    const stackLower = stack.map((s) => s.toLowerCase()).join(' ');
    return PUBLISH_SIGNALS.some((sig) => stackLower.includes(sig));
}
/**
 * Build the supply chain criteria section for HU.md.
 * Only emits for backend/fullstack/shared targets with supply chain risks or publishing signals.
 */
export function buildSupplyChainHuSection(target, knowledge) {
    // Only emit for distribution-relevant targets
    if (!SUPPLY_CHAIN_TARGETS.has(target)) {
        return [];
    }
    const hasRisks = hasSupplyChainRisks(knowledge);
    const isPublishing = isPublishingSpec(target, knowledge);
    if (!hasRisks && !isPublishing) {
        return [];
    }
    const sc = knowledge?.supplyChain;
    const lines = ['', '## Supply Chain Security', ''];
    // SBOM criteria
    if (!sc?.sbomPresent || isPublishing) {
        lines.push('- [ ] CI genera SBOM en formato CycloneDX JSON en cada release; el SBOM incluye todos los componentes directos e indirectos con licencia, versión y hash');
        lines.push('- [ ] El SBOM se publica junto al artifact y se registra en el release notes');
        lines.push('- [ ] El SBOM incluye los 7 CISA Minimum Elements: supplier, author, timestamp, name, version, serialNumber, dependencies');
    }
    // SLSA criteria
    if (!sc || sc.slsaLevel === 'L0' || sc.slsaLevel === 'L1') {
        lines.push('- [ ] El pipeline CI genera y publica SLSA provenance L2+: el artifact incluye attestation con builder ID, source digest y timestamp firmados con Sigstore');
        lines.push('- [ ] El job de release tiene `permissions: id-token: write` habilitado para OIDC signing');
    }
    // Dependency/lock file criteria
    if (!sc?.lockfilePresent) {
        lines.push('- [ ] Todos los paquetes npm publicados tienen `npm publish --provenance` habilitado; verificable con `npm audit signatures`');
        lines.push('- [ ] Todas las dependencias están pinneadas a versiones exactas con hash verification en el lockfile');
    }
    // Reproducible builds
    if (isPublishing) {
        lines.push('- [ ] El build es reproducible: dado el mismo source commit y lockfiles, el artifact binario es idéntico bit-a-bit');
    }
    lines.push('');
    return lines;
}
//# sourceMappingURL=supply-chain-hu-adapter.js.map