//! Arguments for `mcptest sbom` (WOR-946).
//!
//! Prints the CycloneDX 1.5 Software Bill of Materials that the build
//! script bakes into the binary at compile time. A reviewer who does not
//! trust an external SBOM file can answer "what does this thing depend
//! on" from the binary itself.

use std::path::PathBuf;

use clap::{Args, ValueEnum};

/// Arguments for `mcptest sbom`.
#[derive(Debug, Args, Default)]
pub struct SbomArgs {
    /// Output format. `cyclonedx` is the raw embedded JSON; `licenses`
    /// is one line per dep with its SPDX expression; `names` is one
    /// line per dep with just name and version.
    #[arg(
        long,
        value_enum,
        value_name = "FORMAT",
        default_value_t = SbomFormat::Cyclonedx
    )]
    pub format: SbomFormat,

    /// Write the output here instead of stdout. Useful for piping the
    /// CycloneDX JSON into a scanner that wants a file path. `--out` is
    /// accepted as a hidden alias for the pre-1.1 spelling.
    #[arg(long, alias = "out", value_name = "PATH")]
    pub output: Option<PathBuf>,

    /// Re-hash the embedded BOM bytes and compare against the SHA-256
    /// computed at build time. Exits 0 on match, 2 on mismatch. Catches
    /// in-memory tampering with the embedded blob; verifying the binary
    /// itself against a published release is a separate step (see
    /// `cosign verify-blob` on the release artifact).
    #[arg(long)]
    pub verify: bool,
}

/// Output format for `mcptest sbom`.
#[derive(Copy, Clone, Debug, Default, PartialEq, Eq, ValueEnum)]
#[value(rename_all = "kebab-case")]
pub enum SbomFormat {
    /// Raw CycloneDX 1.5 JSON, exactly what the build embedded.
    #[default]
    Cyclonedx,
    /// One line per dep: `<name> <version> <SPDX expression>`.
    Licenses,
    /// One line per dep: `<name> <version>`.
    Names,
}
