///|
/// Walk through the preflight API on one deliberately broken envelope.
///
/// The envelope below has a plausible shape but three separate defects: the
/// metadata expired in 2024, one target path escapes the target directory, and
/// one digest is far too short to be a SHA-256 hash. Run it with:
///
/// ```sh
/// moon run --target wasm-gc examples/demo
/// ```
fn main {
  let expired = targets("2024-01-01T00:00:00Z", "../app.bin", "abcd")
  println("== expired, unsafe path and short digest ==")
  let expired_report = @tuf.preflight_at_report(
    expired, "targets", "2026-09-24T12:00:00Z",
  )
  // The rendered form is convenient for logs; the structured accessors are what
  // a pipeline branches on. Both are shown here so the example exercises the
  // public API a consumer would actually use.
  for finding in expired_report.findings() {
    match finding.severity() {
      Error => println("error " + finding.code() + " at " + finding.location())
      Warning =>
        println("warn  " + finding.code() + " at " + finding.location())
    }
  }
  println("rendered:\n" + expired_report.render())
  let report = expired_report
  println(
    "errors=" +
    report.error_count().to_string() +
    " warnings=" +
    report.warning_count().to_string() +
    " ok=" +
    report.ok().to_string(),
  )
  println("")
  let healthy = targets(
    "2030-06-01T12:30:00Z", "app.bin", "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
  )
  println("== well-formed envelope ==")
  let healthy_report = @tuf.preflight_at_report(
    healthy, "targets", "2026-09-24T12:00:00Z",
  )
  println(healthy_report.render())
  println("")
  println("== timestamp/snapshot/targets version agreement ==")
  let timestamp = envelope(
    "{\"_type\":\"timestamp\",\"version\":7,\"expires\":\"2030-06-01T12:30:00Z\",\"meta\":{\"snapshot.json\":{\"version\":8}}}",
  )
  let snapshot = envelope(
    "{\"_type\":\"snapshot\",\"version\":8,\"expires\":\"2030-06-01T12:30:00Z\",\"meta\":{\"targets.json\":{\"version\":3}}}",
  )
  for
    issue in @tuf.preflight_bundle(
      timestamp, snapshot, healthy, "2026-09-24T12:00:00Z",
    ) {
    println("- " + issue)
  }
  println("(no output above means the three documents agree)")
}

///|
/// A `targets` envelope built from the three parameters the demo varies.
fn targets(expires : String, name : String, digest : String) -> String {
  envelope(
    "{\"_type\":\"targets\",\"version\":3,\"expires\":\"" +
    expires +
    "\",\"targets\":{\"" +
    name +
    "\":{\"length\":1024,\"hashes\":{\"sha256\":\"" +
    digest +
    "\"}}}}",
  )
}

///|
/// Wrap the JSON text of a `signed` object in a signature envelope, stamping
/// the TUF specification version the demo metadata is written against.
///
/// The signature values are placeholders: this library never verifies them.
fn envelope(body : String) -> String {
  "{\"signed\":{\"spec_version\":\"1.0.31\"," +
  body[1:].to_owned() +
  ",\"signatures\":[{\"keyid\":\"demo-key\",\"sig\":\"demo-only\"}]}"
}