// tools/generate-tests/generators/supply-chain-test-generator.ts — SPEC-046
// Generates supply chain validation runbook and test definitions.
/**
 * Returns true when the project has supply chain gaps detected.
 */
export function isSupplyChainProject(knowledge) {
    const sc = knowledge.supplyChain;
    if (!sc) {
        return false;
    }
    return sc.gaps.length > 0 || !sc.sbomPresent || !sc.lockfilePresent;
}
/**
 * Generate supply chain test definitions (integration-level runbook items).
 */
export function generateSupplyChainTestDefs(title, testDir) {
    return [
        {
            name: `${title} — Supply Chain: lockfile is up to date with manifest`,
            type: 'integration',
            file: `${testDir}/supply-chain/`,
            description: 'Verify `npm ci` (or equivalent) does not fail — lockfile is consistent with package.json',
            priority: 'critical',
            automatable: true,
        },
        {
            name: `${title} — Supply Chain: no deprecated direct dependencies`,
            type: 'integration',
            file: `${testDir}/supply-chain/`,
            description: 'Verify no directly-listed packages are marked as deprecated in the registry',
            priority: 'high',
            automatable: true,
        },
        {
            name: `${title} — Supply Chain: audit returns 0 high/critical vulnerabilities`,
            type: 'integration',
            file: `${testDir}/supply-chain/`,
            description: 'Run `npm audit --audit-level=high` (or equivalent) and verify exit code 0',
            priority: 'critical',
            automatable: true,
        },
    ];
}
/** Generate the Node.js/npm runbook content. */
function generateNodeRunbook(title, slug) {
    return `# Supply Chain Validation Runbook — ${title}
## Purpose
Verify the supply chain integrity of the \`${slug}\` artifact.
Run these commands in CI on every release or PR targeting main.

## 1. Lock File Consistency
\`\`\`bash
# Ensure lockfile is in sync with package.json
npm ci --dry-run 2>&1 | grep -c "npm warn lockfile" || echo "Lock file is consistent"
\`\`\`
**Pass condition:** \`npm ci\` exits 0 with no lockfile warnings.

## 2. Deprecated Packages
\`\`\`bash
# List all deprecated direct dependencies
npm ls --depth=0 --json 2>/dev/null | jq '.dependencies | to_entries[] | select(.value.deprecated) | .key'
\`\`\`
**Pass condition:** Output is empty (no deprecated packages).

## 3. Vulnerability Audit
\`\`\`bash
# Fail on high/critical vulnerabilities
npm audit --audit-level=high
\`\`\`
**Pass condition:** Exit code 0.

## 4. SBOM Validation (if syft is installed)
\`\`\`bash
# Generate SBOM and verify it includes all direct dependencies
syft . -o cyclonedx-json=sbom.json
jq '.components | length' sbom.json
\`\`\`
**Pass condition:** Component count is >= direct dependency count.

## 5. SLSA Provenance (GitHub Actions only)
\`\`\`bash
# Verify attestation bundle exists for the artifact
gh attestation verify <artifact> --repo <owner>/<repo>
\`\`\`
**Pass condition:** Attestation is verified by Sigstore.

## References
- https://slsa.dev/spec/v1.0/
- https://www.cisa.gov/resources-tools/resources/software-bill-materials-sbom
- https://docs.npmjs.com/cli/v9/commands/npm-audit
`;
}
/** Generate a generic (non-Node) shell runbook. */
function generateGenericRunbook(title, slug, language) {
    const auditCmd = language === 'python'
        ? 'pip-audit --requirement requirements.txt'
        : language === 'go'
            ? 'govulncheck ./...'
            : language === 'rust'
                ? 'cargo audit'
                : 'dependency-check --project . --scan .';
    return `# Supply Chain Validation Runbook — ${title}
## Purpose
Verify supply chain integrity of the \`${slug}\` project (${language}).

## 1. Lock File Check
\`\`\`bash
# Verify lock file is present and committed
ls -la ${language === 'python' ? 'poetry.lock' : language === 'go' ? 'go.sum' : language === 'rust' ? 'Cargo.lock' : 'package-lock.json'}
\`\`\`
**Pass condition:** File exists and is not empty.

## 2. Vulnerability Scan
\`\`\`bash
${auditCmd}
\`\`\`
**Pass condition:** Exit code 0 (no high/critical vulnerabilities).

## 3. SBOM Generation
\`\`\`bash
syft . -o cyclonedx-json=sbom.json
jq '.metadata.timestamp' sbom.json
\`\`\`
**Pass condition:** SBOM is generated with a valid timestamp.

## References
- https://slsa.dev/spec/v1.0/
- https://www.cisa.gov/resources-tools/resources/software-bill-materials-sbom
`;
}
/** Get file extension for the runbook (always Markdown regardless of language). */
function getRunbookExtension(_language) {
    return 'md';
}
/**
 * Generate supply chain runbook test files for the project.
 * Returns one Markdown runbook with shell commands verifiable in CI.
 */
export function generateSupplyChainTestFiles(spec, testDir, language, autoGenerate) {
    const slug = spec.id.toLowerCase().replace(/[^a-z0-9]/g, '-');
    const ext = getRunbookExtension(language);
    const content = language === 'typescript' || language === 'javascript'
        ? generateNodeRunbook(spec.title, slug)
        : generateGenericRunbook(spec.title, slug, language);
    return [
        {
            path: `${testDir}/supply-chain/${slug}.supply-chain.${ext}`,
            framework: 'shell',
            content,
            ready: autoGenerate,
        },
    ];
}
//# sourceMappingURL=supply-chain-test-generator.js.map