// tools/suggest-tooling/supply-chain-catalog.ts — SPEC-046
// Builds supply chain security tooling recommendation lines for suggest_tooling.
import { readFile } from 'node:fs/promises';
let configCache = null;
/** Reset in-memory config cache (for testing). */
export function resetSupplyChainCatalogCache() {
    configCache = null;
}
async function loadConfig() {
    if (configCache) {
        return configCache;
    }
    try {
        const configPath = new URL('../../config/supply-chain-tools.json', import.meta.url);
        const content = await readFile(configPath, 'utf-8');
        configCache = JSON.parse(content);
        return configCache;
    }
    catch {
        return { sbomTools: {}, monitoringTools: {} };
    }
}
/** Map project language to SBOM tool key. */
function getSbomToolKey(language) {
    const lang = language.toLowerCase();
    if (lang === 'typescript' || lang === 'javascript') {
        return 'nodejs';
    }
    if (lang === 'java' || lang === 'kotlin') {
        return 'java';
    }
    if (lang === 'csharp' || lang === 'fsharp') {
        return 'dotnet';
    }
    const direct = ['python', 'go', 'rust'];
    return direct.includes(lang) ? lang : 'generic';
}
/**
 * Detect if a project has supply chain issues that warrant tooling recommendations.
 * Returns true when there are known gaps in the supply chain posture.
 */
export function hasSupplyChainGaps(knowledge) {
    const sc = knowledge.supplyChain;
    if (!sc) {
        return false;
    }
    return sc.gaps.length > 0 || !sc.sbomPresent || !sc.lockfilePresent || sc.slsaLevel === 'L0';
}
/**
 * Build supply chain tooling recommendation lines.
 * Only emits when supply chain gaps are detected.
 */
export async function buildSupplyChainToolingLines(knowledge) {
    if (!hasSupplyChainGaps(knowledge)) {
        return [];
    }
    const config = await loadConfig();
    const sc = knowledge.supplyChain;
    const lines = ['## Supply Chain Security', ''];
    if (sc) {
        lines.push(`**SLSA Level:** ${sc.slsaLevel} | **SBOM:** ${sc.sbomPresent ? 'present' : 'missing'} | **Lock file:** ${sc.lockfilePresent ? 'present' : 'missing'}`);
        lines.push('');
    }
    // SBOM recommendations
    if (!sc?.sbomPresent) {
        const toolKey = getSbomToolKey(knowledge.language);
        const sbomTool = config.sbomTools[toolKey] ?? config.sbomTools.generic;
        if (sbomTool) {
            lines.push('### SBOM Generation');
            lines.push('');
            lines.push(`**Primary:** \`${sbomTool.name}\``);
            if (sbomTool.alternative) {
                lines.push(`**Alternative:** \`${sbomTool.alternative}\` (universal, any language)`);
            }
            lines.push('');
            lines.push('**CI command:**');
            lines.push(`\`\`\`bash\n${sbomTool.command}\n\`\`\``);
            lines.push(`- Docs: ${sbomTool.docsUrl}`);
            lines.push('');
        }
    }
    // SLSA recommendations
    if (!sc || sc.slsaLevel === 'L0' || sc.slsaLevel === 'L1') {
        lines.push('### SLSA Provenance (recommended: L2+)');
        lines.push('');
        lines.push('**GitHub Actions:** `actions/attest-build-provenance` — achieves SLSA L2, no extra tools');
        lines.push('```yaml\n- uses: actions/attest-build-provenance@v1\n  with:\n    subject-path: dist/\n```');
        lines.push('Requires: `permissions: id-token: write` in the job');
        lines.push('- Docs: https://github.com/actions/attest-build-provenance');
        lines.push('');
        lines.push('**For SLSA L3 (hermetic):** `slsa-framework/slsa-github-generator` — fully isolated build');
        lines.push('- Docs: https://github.com/slsa-framework/slsa-github-generator');
        lines.push('');
    }
    // Dependency monitoring
    lines.push('### Continuous Dependency Monitoring');
    lines.push('');
    const monitoring = config.monitoringTools;
    for (const [, entry] of Object.entries(monitoring)) {
        lines.push(`**${entry.name}** — ${entry.description}`);
        lines.push(`- Docs: ${entry.docsUrl}`);
    }
    lines.push('');
    return lines;
}
//# sourceMappingURL=supply-chain-catalog.js.map