# All source trees and recursive locks are fetched by Nix at exact retained
# revisions. No authoring-directory overlay or externally assembled schema.
{ repository, commit, kind, generator, contractOnly ? false, system ? builtins.currentSystem }:
let
  pkgs = import (/. + "@nixpkgs@") { inherit system; };
  protocol = builtins.storePath generator;
  sourceKey = source: "${source.kind}:${source.repository}@${source.commit}";
  fetch = source: builtins.fetchGit {
    url = source.repository;
    rev = source.commit;
    ref = "refs/tags/quixos-reachability/${source.commit}";
    shallow = true;
  };
  load = ancestors: source:
    if builtins.elem (sourceKey source) ancestors then
      throw "Source dependency cycle at ${sourceKey source}"
    else if builtins.length ancestors >= 100 then
      throw "Source dependency depth exceeds 100"
    else let
      directory = fetch source;
      lockFile = pkgs.runCommand "qx-source-lock.json" { } ''
        ${protocol}/bin/quixos-lock-check ${directory}/quixos.lock > "$out"
      '';
      lock = builtins.fromJSON (builtins.readFile lockFile);
      children = map (entry: load (ancestors ++ [ (sourceKey source) ]) (entry.source // { inherit (entry) kind; })) lock.resources;
    in source // { inherit directory children; };
  root = load [ ] { inherit kind repository commit; };
  flatten = node: [ node ] ++ pkgs.lib.concatMap flatten node.children;
  nodes = builtins.attrValues (builtins.listToAttrs (map (node: {
    name = sourceKey node; value = node;
  }) (flatten root)));
  snapshots = pkgs.writeText "qx-nix-source-graph.json" (builtins.toJSON {
    resources = map (node: { inherit (node) kind repository commit directory; })
      (builtins.filter (node: node.kind != "workspace") nodes);
  });
  compile = node: pkgs.runCommand "qx-${node.kind}-contract" { } ''
    mkdir -p "$out"
    ${if node.kind == "workspace" then ''
      ${protocol}/bin/quixos-workspace-compile --root ${node.directory} \
        --source-root-commit ${pkgs.lib.escapeShellArg node.commit} \
        --checkout-root "$TMPDIR/checkouts" --snapshot-map ${snapshots} \
        --graph-out "$out/graph.json" > "$out/candidate.json"
    '' else ''
      ${protocol}/bin/quixos-resource-compile --root ${node.directory} \
        --kind ${node.kind} --repository ${pkgs.lib.escapeShellArg node.repository} \
        --commit ${pkgs.lib.escapeShellArg node.commit} \
        --checkout-root "$TMPDIR/checkouts" --snapshot-map ${snapshots} --snapshot-only true \
        --graph-out "$out/graph.json" --schema-out "$out/bindings.json" > "$out/candidate.json"
    ''}
  '';
  contract = compile root;
  checkPackage = node: let
    compiled = compile node;
    candidate = builtins.fromJSON (builtins.readFile "${compiled}/candidate.json");
    package = builtins.getFlake ("git+${node.repository}?rev=${node.commit}&ref=refs/tags/quixos-reachability/${node.commit}");
    checked = package.quixosPackages.${system}.checkedServer or
      (throw "Package ${node.repository} lacks checkedServer; use the supported package scaffold.");
    artifact = checked {
      schema = "${compiled}/bindings.json";
      generator = protocol;
      packageRevisionId = candidate.revision.revisionId;
    };
  in { packageRevisionId = candidate.revision.revisionId; artifactPath = artifact; };
  checks = if contractOnly then [ ] else map checkPackage (builtins.filter (node: node.kind == "package") nodes);
  manifest = pkgs.writeText "qx-candidate-checks.json" (builtins.toJSON checks);
  bindingOptions = pkgs.writeText "qx-typescript-options.json" (builtins.toJSON
    ((builtins.fromJSON (builtins.readFile "${root.directory}/quixos.check.json")).options or { }));
in pkgs.runCommand (if contractOnly then "qx-contract" else "qx-checked-candidate") { } ''
  mkdir -p "$out"
  cp ${contract}/candidate.json "$out/candidate.json"
  cp ${contract}/graph.json "$out/graph.json"
  cp ${manifest} "$out/checks.json"
  ${pkgs.lib.optionalString (kind != "workspace") ''cp ${contract}/bindings.json "$out/bindings.json"''}
  ${pkgs.lib.optionalString (kind == "package") ''
    ${protocol}/bin/quixos-codegen-ts ${contract}/bindings.json \
      ${pkgs.lib.escapeShellArg (builtins.fromJSON (builtins.readFile "${contract}/candidate.json")).revision.revisionId} \
      "$out/bindings.ts" ${bindingOptions}
  ''}
''