field :build_receipt_id, :binary_id

    field :target_id, :binary_id

    field :deploy_receipt_id, :binary_id

    field :artifact_link_id, :binary_id

    field :transparency_tier, :string, default: nil

    timestamps(updated_at: false)

  end

      :push_receipt_id,

      :build_receipt_id,

      :target_id,

      :deploy_receipt_id

      :deploy_receipt_id,

      :artifact_link_id,

      :transparency_tier

    ])

    |> validate_required([:repo, :sha, :summary, :category, :source, :entry_at])

    |> validate_format(:sha, ~r/^[0-9a-f]{7,40}$/)

defmodule OpenAgents.Transparency do

  @moduledoc """

  Context helpers for artifact transparency tiers.

  Tiers follow the same `dark/pulse/ledger/glass` naming used by the forge

  visibility levels:

    * `dark`   — nothing public

    * `pulse`  — metadata only

    * `ledger` — content and metadata

    * `glass`  — full access

  """

  import Ecto.Changeset

  alias OpenAgents.Transparency.ArtifactLink

  @tier_rank %{dark: 0, pulse: 1, ledger: 2, glass: 3}

  @tier_strings %{

    "dark" => :dark,

    "pulse" => :pulse,

    "ledger" => :ledger,

    "glass" => :glass

  }

  @capability_min %{

    metadata: :pulse,

    content: :ledger,

    full: :glass

  }

  @doc "All tier atoms, from least to most transparent."

  def tier_atoms, do: [:dark, :pulse, :ledger, :glass]

  @doc """

  The effective tier for `tier_or_link` given `viewer`.

  `viewer` may be a tier atom/string, a map with a `:tier` field, or `nil`.

  A revoked `ArtifactLink` always resolves to `:dark`.

  """

  def effective_tier(%ArtifactLink{revoked_at: nil} = link, viewer) do

    clamp(tier_atom(link.tier), viewer)

  end

  def effective_tier(%ArtifactLink{}, _viewer), do: :dark

  def effective_tier(tier, viewer), do: clamp(tier_atom(tier), viewer)

  @doc """

  Whether `tier_or_link` admits `capability` for `viewer`.

  Capabilities are `:metadata`, `:content`, and `:full`.

  """

  def allows?(tier, capability, viewer) do

    effective = effective_tier(tier, viewer)

    required = Map.get(@capability_min, capability, :dark)

    @tier_rank[effective] >= @tier_rank[required]

  end

  @doc """

  Marks `artifact_link` as revoked by `revoked_by_id` for `reason`.

  Returns a changeset with `revoked_at` and `revocation_tombstone` set.

  """

  def revoke(artifact_link, reason, revoked_by_id) do

    now = DateTime.utc_now()

    change(artifact_link)

    |> put_change(:revoked_at, now)

    |> put_change(:revocation_tombstone, %{

      reason: reason,

      revoked_by_id: revoked_by_id,

      revoked_at: DateTime.to_iso8601(now)

    })

  end

  defp tier_atom(tier) when is_atom(tier) do

    Map.get(@tier_strings, to_string(tier), :dark)

  end

  defp tier_atom(tier) when is_binary(tier) do

    Map.get(@tier_strings, tier, :dark)

  end

  defp tier_atom(_), do: :dark

  defp viewer_tier(%{tier: tier}), do: tier_atom(tier)

  defp viewer_tier(tier) when is_atom(tier) or is_binary(tier), do: tier_atom(tier)

  defp viewer_tier(_), do: nil

  defp clamp(tier, viewer) do

    case viewer_tier(viewer) do

      nil -> tier

      v -> if @tier_rank[v] < @tier_rank[tier], do: v, else: tier

    end

  end

end

defmodule OpenAgents.Transparency.ArtifactLink do

  @moduledoc """

  A durable link between an artifact, the account and repository that own it,

  and a transparency tier. The link is the consent-bearing record for any

  public disclosure of the artifact.

  """

  use Ecto.Schema

  import Ecto.Changeset

  @primary_key {:id, :binary_id, autogenerate: true}

  @foreign_key_type :binary_id

  @timestamps_opts [type: :utc_datetime_usec]

  @artifact_types ~w(changelog release issue build)

  @artifact_refs ~w(sha tag digest path)

  @tiers ~w(dark pulse ledger glass)

  schema "artifact_links" do

    field :account_id, :binary_id

    field :repository_id, :binary_id

    field :artifact_type, :string

    field :artifact_ref, :string

    field :tier, :string

    field :consent, :map, default: %{}

    field :authority_snapshot, :map, default: %{}

    field :revoked_at, :utc_datetime_usec

    field :revocation_tombstone, :map, default: %{}

    timestamps(updated_at: false)

  end

  def artifact_types, do: @artifact_types

  def artifact_refs, do: @artifact_refs

  def tiers, do: @tiers

  def changeset(artifact_link, attrs) do

    artifact_link

    |> cast(attrs, [

      :account_id,

      :repository_id,

      :artifact_type,

      :artifact_ref,

      :tier,

      :consent,

      :authority_snapshot

    ])

    |> validate_required([

      :account_id,

      :repository_id,

      :artifact_type,

      :artifact_ref,

      :tier

    ])

    |> validate_inclusion(:artifact_type, @artifact_types)

    |> validate_inclusion(:artifact_ref, @artifact_refs)

    |> validate_inclusion(:tier, @tiers)

  end

end

defmodule OpenAgents.Repo.Migrations.CreateArtifactLinks do

  use Ecto.Migration

  def change do

    create table(:artifact_links, primary_key: false) do

      add :id, :binary_id, primary_key: true

      add :account_id, references(:accounts, type: :binary_id, on_delete: :nothing), null: false

      add :repository_id, references(:repositories, type: :binary_id, on_delete: :nothing),

        null: false

      add :artifact_type, :string, null: false

      add :artifact_ref, :string, null: false

      add :tier, :string, null: false

      add :consent, :map, null: false, default: %{}

      add :authority_snapshot, :map, null: false, default: %{}

      add :revoked_at, :utc_datetime_usec

      add :revocation_tombstone, :map, null: false, default: %{}

      timestamps(type: :utc_datetime_usec, updated_at: false)

    end

    create index(:artifact_links, [:account_id])

    create index(:artifact_links, [:repository_id])

    create index(:artifact_links, [:artifact_type, :artifact_ref])

    create constraint(:artifact_links, :artifact_links_tier_check,

             check: "tier IN ('dark','pulse','ledger','glass')"

           )

  end

end