import { spawnSync } from "node:child_process";
import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
import path from "node:path";

type Document = Record<string, unknown>;

function isRecord(value: unknown): value is Document {
  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
}

async function readDocument(file: string): Promise<Document> {
  const parsed: unknown = JSON.parse(await readFile(file, "utf8"));
  if (!isRecord(parsed)) throw new Error(`${file} must be a JSON object`);
  return parsed;
}

const fixtureDirectory = path.resolve(".tmp/supply-chain-provider-fixture");
await rm(fixtureDirectory, { recursive: true, force: true });
await mkdir(fixtureDirectory, { recursive: true });
const inventory = await readDocument(
  "artifacts/release/dependency-inventory.json",
);
const verification = await readDocument(
  "artifacts/security/supply-chain-verification.json",
);
const vulnerabilityPath = path.join(
  fixtureDirectory,
  "vulnerability-report.json",
);
const attestationPath = path.join(fixtureDirectory, "attestation.json");
await writeFile(
  vulnerabilityPath,
  `${JSON.stringify(
    {
      schemaVersion: 1,
      provider: "fixture-scanner",
      scannedLockfileSha256: inventory.lockfileSha256,
      generatedAt: "2026-07-26T00:00:00.000Z",
      findings: [],
    },
    null,
    2,
  )}\n`,
);
await writeFile(
  attestationPath,
  `${JSON.stringify(
    {
      schemaVersion: 1,
      provider: "fixture-attestor",
      signer: "fixture-workload-identity",
      subject: {
        name: "dist",
        digest: { sha256: verification.distSha256 },
      },
    },
    null,
    2,
  )}\n`,
);
const providerRun = spawnSync(
  "node",
  ["scripts/generate-supply-chain.ts"],
  {
    env: {
      ...process.env,
      VULNERABILITY_REPORT_PATH: vulnerabilityPath,
      PROVENANCE_ATTESTATION_PATH: attestationPath,
    },
    encoding: "utf8",
  },
);
let promotionStatus = "MISSING";
if (providerRun.status === 0) {
  const providerVerification = await readDocument(
    "artifacts/security/supply-chain-verification.json",
  );
  promotionStatus =
    typeof providerVerification.promotionStatus === "string"
      ? providerVerification.promotionStatus
      : "MISSING";
}
const restore = spawnSync(
  "node",
  ["scripts/generate-supply-chain.ts"],
  { encoding: "utf8" },
);
await rm(fixtureDirectory, { recursive: true, force: true });
const passed =
  providerRun.status === 0 &&
  promotionStatus === "PASS" &&
  restore.status === 0;
await writeFile(
  "artifacts/security/supply-chain-provider-fixtures.json",
  `${JSON.stringify(
    {
      schemaVersion: 1,
      providerAccepted: providerRun.status === 0,
      promotionStatus,
      unverifiedDefaultRestored: restore.status === 0,
      status: passed ? "PASS" : "FAIL",
    },
    null,
    2,
  )}\n`,
);
if (!passed) {
  const detail =
    providerRun.stderr ||
    restore.stderr ||
    providerRun.stdout ||
    restore.stdout ||
    `providerStatus=${String(providerRun.status)}, promotionStatus=${promotionStatus}, restoreStatus=${String(restore.status)}`;
  process.stderr.write(
    `Supply-chain provider fixture failed: ${detail}\n`,
  );
  process.exit(1);
}
process.stdout.write(
  "Supply-chain provider fixture: verified PASS and unconfigured default restored\n",
);