bundle

type Bundle struct {
	Manifest   *Manifest
	Lock       *pack.AgentLock
	LockJSON   []byte
	PolicyYAML []byte
	SBOM       []byte
	// contains filtered or unexported fields
}

type BundleConfig struct {
	// ProjectDir is the source directory to include as source/ entries.
	ProjectDir string
	// Manifest is the manifest to write (manifest_signature is added by Write).
	Manifest *Manifest
	// Lock is the signed agent lockfile.
	Lock *pack.AgentLock
	// PolicyYAML is the raw policy.yaml bytes (exact sidecar, never re-marshaled).
	PolicyYAML []byte
	// SBOM is the raw SPDX JSON bytes.
	SBOM []byte
	// ImageDir is an optional OCI image layout directory to include as image/.
	ImageDir string
	// Ignore filters source/ collection (export uses export-specific matcher).
	Ignore *pack.IgnoreMatcher
	// ExtraFiles are written under extra/ and listed in manifest.extra_files.
	ExtraFiles []pack.BuildFile
	// PublisherKey is the ECDSA private key used to sign the manifest.
	PublisherKey interface{} // *ecdsa.PrivateKey — use interface to avoid import
	// SourceDateEpoch is the fixed timestamp for deterministic tar entries.
	SourceDateEpoch time.Time
}

type BundleResult struct {
	// BundleDigest is the SHA-256 of the final .agentpaas file bytes (hex).
	BundleDigest string
	// Path is the path to the written file (empty when writing to io.Writer).
	Path string
	// FileCount is the total number of entries in the bundle.
	FileCount int
	// TotalBytes is the final size in bytes.
	TotalBytes int64
}

type ConsentCardMode int

type ConsentCardOpts struct {
	Mode         ConsentCardMode
	AgentName    string
	AgentVersion string
	// PolicyDiffLines are locally computed structural diff lines (changed-policy updates).
	PolicyDiffLines []string
	// LocallyVerifiedHops maps hop index → true for hops verified against local state.
	LocallyVerifiedHops map[int]bool
}

type CredentialRequirement struct {
	ID          string `json:"id"`
	Type        string `json:"type"`
	Header      string `json:"header,omitempty"`
	Destination string `json:"destination,omitempty"`
}

type ErrCapExceeded struct {
	Cap string
	Got int64
	Max int64
}

type ErrPathRejected struct {
	Path   string
	Reason string
}

type ErrUnsupported struct {
	What string
}

type InspectHeader struct {
	File                string `json:"file"`
	SizeBytes           int64  `json:"size_bytes"`
	BundleDigest        string `json:"bundle_digest"`
	BundleSchemaVersion int    `json:"bundle_schema_version"`
	LockSchemaVersion   int    `json:"lock_schema_version"`
	AgentName           string `json:"agent_name"`
	AgentVersion        string `json:"agent_version"`
}

type InspectPublisher struct {
	Name               string `json:"name"`
	Fingerprint        string `json:"fingerprint"`
	FingerprintDisplay string `json:"fingerprint_display"`
	TrustDisclaimer    string `json:"trust_disclaimer"`
}

type InspectReport struct {
	Header         InspectHeader          `json:"header"`
	Integrity      *VerifyReport          `json:"integrity"`
	Verified       bool                   `json:"verified"`
	Publisher      *InspectPublisher      `json:"publisher,omitempty"`
	Provenance     *pack.ProvenanceReport `json:"provenance,omitempty"`
	ProvenanceText string                 `json:"provenance_text,omitempty"`
	PolicySummary  []PolicySummaryLine    `json:"policy_summary,omitempty"`
	PolicyLints    []PolicyLint           `json:"policy_lints,omitempty"`
	Requirements   *InspectRequirements   `json:"requirements,omitempty"`
	SBOM           *SBOMSummary           `json:"sbom,omitempty"`
	ExtraFiles     []ManifestExtraFile    `json:"extra_files,omitempty"`
}

type InspectRequirements struct {
	Credentials []CredentialRequirement `json:"credentials"`
	LLMProvider string                  `json:"llm_provider"`
	Image       string                  `json:"image"`
	Platform    string                  `json:"platform"`
}

type Manifest struct {
	BundleSchemaVersion int                   `json:"bundle_schema_version"`
	Publisher           ManifestPublisherInfo `json:"publisher"`
	Contents            ManifestContents      `json:"contents"`
	CreatedAt           time.Time             `json:"created_at"`
	// ManifestSignature is the ECDSA signature over the canonical JSON,
	// excluding this field. Base64-encoded.
	ManifestSignature string `json:"manifest_signature,omitempty"`
	// ExtraFiles lists --include paths digest-pinned but excluded from source digest.
	ExtraFiles []ManifestExtraFile `json:"extra_files,omitempty"`
}

type ManifestContents struct {
	Lock   ManifestDigestEntry `json:"lock"`
	Policy ManifestDigestEntry `json:"policy"`
	SBOM   ManifestDigestEntry `json:"sbom"`
	Source ManifestDigestEntry `json:"source"`
	Image  *ManifestImageEntry `json:"image,omitempty"`
}

type ManifestDigestEntry struct {
	Digest string `json:"digest"`
}

type ManifestExtraFile struct {
	Path   string `json:"path"`
	Digest string `json:"digest"`
	Bytes  int64  `json:"bytes"`
}

type ManifestImageEntry struct {
	Digest   string `json:"digest"`
	Platform string `json:"platform"`
}

type ManifestPublisherInfo struct {
	Name         string `json:"name"`
	Fingerprint  string `json:"fingerprint"`
	PublicKeyPEM string `json:"public_key_pem"`
}

type PolicyLint struct {
	Code    string `json:"code"`
	Message string `json:"message"`
}

type PolicySummaryLine struct {
	Section string `json:"section"`
	Detail  string `json:"detail"`
}

type SBOMSummary struct {
	PackageCount int      `json:"package_count"`
	TopLevelDeps []string `json:"top_level_deps"`
	ParseWarning string   `json:"parse_warning,omitempty"`
}

type VerifyCheck struct {
	Name   string `json:"name"`
	Passed bool   `json:"passed"`
	Detail string `json:"detail"`
}

type VerifyReport struct {
	Verified bool          `json:"verified"`
	Checks   []VerifyCheck `json:"checks"`
}