# All source trees and recursive locks are fetched by Nix at exact retained
# revisions. No authoring-directory overlay or externally assembled schema.
{
  repository,
  commit,
  kind,
  generator,
  contractOnly ? false,
  workspaceId ? null,
  platformSourceJSON ? null,
  system ? builtins.currentSystem,
}:
let
  pkgs = import (/. + "@nixpkgs@") {
    inherit system;
    config = { };
    overlays = [ ];
  };
  protocol = builtins.storePath generator;
  sourceKey = source: "${source.kind}:${source.repository}@${source.commit}";
  fetch =
    source:
    builtins.fetchGit {
      url = source.repository;
      rev = source.commit;
      ref = "refs/tags/quixos-reachability/${source.commit}";
      shallow = true;
    };
  # Memoize by exact source identity. A diamond-shaped dependency graph must
  # not recursively evaluate every path through the same imported subtree.
  loadSource =
    source:
    let
      directory = fetch source;
      lockSource = import ./lock-source.nix { source = directory; };
      lockFile = pkgs.runCommand "qx-source-lock.json" { } ''
        ${protocol}/bin/quixos-lock-check ${lockSource}/quixos.lock > "$out"
      '';
      lock = builtins.fromJSON (builtins.readFile lockFile);
    in
    source // { inherit directory lock; };
  sourceEntry = source: {
    key = sourceKey source;
    value = loadSource source;
  };
  sourceGraph = builtins.genericClosure {
    startSet = [ (sourceEntry { inherit kind repository commit; }) ];
    operator =
      entry:
      map (
        resource: sourceEntry (resource.source // { inherit (resource) kind; })
      ) entry.value.lock.resources;
  };
  nodeTable = builtins.listToAttrs (
    map (entry: {
      name = entry.key;
      value = entry.value // {
        children = map (
          resource:
          nodeTable.${sourceKey (resource.source // { inherit (resource) kind; })}
          // {
            inherit (resource) binding;
          }
        ) entry.value.lock.resources;
      };
    }) sourceGraph
  );
  root = nodeTable.${sourceKey { inherit kind repository commit; }};
  configuration =
    if builtins.pathExists (root.directory + "/quixos.check.json") then
      builtins.fromJSON (builtins.readFile (root.directory + "/quixos.check.json"))
    else
      { };
  execution = (configuration.backend or "typescript") == "execution";
  platformSource = if platformSourceJSON == null then null else builtins.fromJSON platformSourceJSON;
  runtime =
    if platformSource == null then
      builtins.getFlake (
        "git+${root.lock.quixos.repository}?rev=${root.lock.quixos.commit}&ref=refs/tags/quixos-reachability/${root.lock.quixos.commit}"
      )
    else
      assert platformSource.repository == root.lock.quixos.repository;
      assert platformSource.commit == root.lock.quixos.commit;
      # getFlake accepts a context-free flake reference. storePath first checks
      # presence; the resulting flake retains its immutable source as an input.
      # Dropping string context here does not permit an authored mutable path.
      builtins.getFlake (
        builtins.unsafeDiscardStringContext "path:${builtins.storePath platformSource.directory}"
      );
  runtimePackages = runtime.packages.${system};
  resourceClosure =
    includeBuild: node:
    map (entry: entry.value) (
      builtins.genericClosure {
        startSet = pkgs.lib.optional (includeBuild || node.kind != "build") {
          key = sourceKey node;
          value = node;
        };
        operator =
          entry:
          map (child: {
            key = sourceKey child;
            value = child;
          }) (builtins.filter (child: includeBuild || child.kind != "build") entry.value.children);
      }
    );
  capabilityFlatten = resourceClosure false;
  # Frontends are an explicit build choice. The capability assembler itself
  # neither discovers React contracts nor loads executable package code.
  queryFrontends =
    node:
    pkgs.lib.unique (
      pkgs.lib.concatMap (
        node:
        let
          config = node.directory + "/quixos.check.json";
        in
        if builtins.pathExists config then
          (builtins.fromJSON (builtins.readFile config)).queryFrontends or [ ]
        else
          [ ]
      ) (capabilityFlatten node)
    );
  queryGeneratorFlags =
    node:
    if queryFrontends node == [ ] then
      ""
    else if queryFrontends node == [ "react" ] then
      "--query-generator ${protocol}/libexec/quixos-protocol/react-query-generator.mjs"
    else
      throw "Unsupported query frontend selection: ${builtins.toJSON (queryFrontends node)}";
  snapshots =
    node:
    pkgs.writeText "qx-nix-source-graph.json" (
      builtins.toJSON {
        resources = map (node: {
          inherit (node)
            kind
            repository
            commit
            directory
            ;
        }) (builtins.filter (entry: entry.kind != "workspace") (resourceClosure true node));
      }
    );
  # Each resource is checked once per exact source/closure/frontend/toolchain.
  # Composition imports these compiler outputs; authoring receipts are never
  # build inputs. Missing entries in ordinary CLI use take the full check path.
  compiledNodes = builtins.mapAttrs (_: node: compileNode node) nodeTable;
  compile = node: compiledNodes.${sourceKey node};
  checkedResources =
    node:
    pkgs.writeText "qx-checked-resources.json" (
      builtins.toJSON (
        map
          (dependency: {
            inherit (dependency) kind repository commit;
            artifact = compile dependency;
          })
          (
            builtins.filter (
              dependency:
              dependency.kind != "workspace"
              && dependency.kind != "build"
              && sourceKey dependency != sourceKey node
            ) (resourceClosure true node)
          )
      )
    );
  compileNode =
    node:
    pkgs.runCommand "qx-${node.kind}-contract" { QUIXOS_TRACE_PROFILE = "1"; } ''
      mkdir -p "$out"
      ${
        if node.kind == "workspace" then
          ''
            ${protocol}/bin/quixos-workspace-compile --root ${node.directory} \
              ${queryGeneratorFlags root} \
              --checked-resources ${checkedResources node} \
              --source-root-commit ${pkgs.lib.escapeShellArg node.commit} \
              ${
                pkgs.lib.optionalString (
                  workspaceId != null
                ) "--workspace-id ${pkgs.lib.escapeShellArg workspaceId}"
              } \
              --checkout-root "$TMPDIR/checkouts" --snapshot-map ${snapshots node} \
              --graph-out "$out/graph.json" --schemas-out "$out/package-schemas.json" \
              ${
                pkgs.lib.optionalString (execution && kind == "workspace")
                  ''--execution-plan-out "$out/execution-plan.json" --build-contexts-out "$out/build-contexts.json"''
              } > "$out/candidate.json"
          ''
        else
          ''
            ${protocol}/bin/quixos-resource-compile --root ${node.directory} \
              ${queryGeneratorFlags root} \
              --checked-resources ${checkedResources node} \
              --kind ${node.kind} --repository ${pkgs.lib.escapeShellArg node.repository} \
              --commit ${pkgs.lib.escapeShellArg node.commit} \
              --checkout-root "$TMPDIR/checkouts" --snapshot-map ${snapshots node} --snapshot-only true \
              --graph-out "$out/graph.json" --schema-out "$out/bindings.json" > "$out/candidate.json"
          ''
      }
    '';
  contract = compile root;
  # Parse shared workspace outputs once. Repeating fromJSON in every package
  # makes composition quadratic in package count and in the serialized world.
  workspacePackages = builtins.listToAttrs (
    map
      (pkg: {
        name = sourceKey (pkg.source // { kind = "package"; });
        value = pkg;
      })
      (builtins.fromJSON (builtins.readFile "${contract}/execution-plan.json"))
      .definition.bindingSchema.packages
  );
  workspaceContexts = builtins.fromJSON (builtins.readFile "${contract}/build-contexts.json");
  buildDependencies =
    node:
    builtins.listToAttrs (
      map (dependency: {
        name = dependency.binding;
        value = {
          src = dependency.directory;
          source = { inherit (dependency) repository commit; };
          flake = builtins.getFlake "git+${dependency.repository}?rev=${dependency.commit}&ref=refs/tags/quixos-reachability/${dependency.commit}";
        };
      }) (builtins.filter (dependency: dependency.kind == "build") node.children)
    );
  reactContracts =
    node: moduleInterfaces:
    let
      interfaces = builtins.attrValues (
        builtins.listToAttrs (
          map (dependency: {
            name = sourceKey dependency;
            value = dependency;
          }) (builtins.filter (dependency: dependency.kind == "interface") (capabilityFlatten node))
        )
      );
    in
    pkgs.lib.concatMap (
      dependency:
      if !builtins.pathExists (dependency.directory + "/flake.nix") then
        [ ]
      else
        let
          source = builtins.getFlake "git+${dependency.repository}?rev=${dependency.commit}&ref=refs/tags/quixos-reachability/${dependency.commit}";
          build = source.quixosInterfaces.${system}.reactTypes or null;
        in
        if build == null then
          [ ]
        else if
          !(builtins.any (
            entry:
            let
              resource = builtins.fromJSON (builtins.readFile "${compile dependency}/candidate.json");
            in
            entry.revisionId == resource.revision.revisionId
            || (entry.definitionId or null) == resource.revision.revisionId
          ) moduleInterfaces)
        then
          [ ]
        else
          [
            (build {
              interface = "${compile dependency}/candidate.json";
              generator = protocol;
              typescript = runtimePackages.camino-replica-core.dependencies;
              reactSdk = runtimePackages.camino-react;
              dependencies = buildDependencies dependency;
            })
          ]
    ) interfaces;
  checkPackage =
    node:
    let
      compiled = compile node;
      candidate =
        if execution && kind == "workspace" then
          {
            revision =
              workspacePackages.${sourceKey node}
              or (throw "Source package missing from workspace compilation: ${node.repository}");
          }
        else
          builtins.fromJSON (builtins.readFile "${compiled}/candidate.json");
      buildContext = import ./package-context.nix {
        inherit pkgs protocol;
        contexts = if kind == "workspace" then "${contract}/build-contexts.json" else null;
        contextData =
          if execution && kind == "workspace" then
            workspaceContexts.${candidate.revision.revisionId}
          else
            null;
        plan = "${compiled}/bindings.json";
        packageRevisionId = candidate.revision.revisionId;
      };
      buildContract = builtins.fromJSON (builtins.readFile buildContext.buildContract);
      componentEntries = if execution then buildContract.definition.package.components or [ ] else [ ];
      package = builtins.getFlake (
        "git+${node.repository}?rev=${node.commit}&ref=refs/tags/quixos-reachability/${node.commit}"
      );
      checked =
        if execution then
          package.quixosPackages.${system}.checkedArtifacts
            or (throw "Package ${node.repository} lacks checkedArtifacts; execution workspaces cannot import legacy servers.")
        else
          package.quixosPackages.${system}.checkedServer
            or (throw "Package ${node.repository} lacks checkedServer; use the supported package scaffold.");
      artifact = checked (
        if execution then
          buildContext
          // {
            generator = protocol;
            core = runtimePackages.camino-replica-core;
            sharedRuntime = runtimePackages.camino-shared-runtime;
            typescript = runtimePackages.camino-replica-core.dependencies;
            packageRevisionId = candidate.revision.revisionId;
            dependencies = buildDependencies node;
            buildEnvironment = {
              inherit pkgs system;
              nixpkgsSource = toString pkgs.path;
              narHash = "@nixpkgsNarHash@";
            };
          }
          // pkgs.lib.optionalAttrs (componentEntries != [ ]) {
            react = {
              sdk = runtimePackages.camino-react;
              runtime = runtimePackages.camino-react-runtime;
              contracts = reactContracts node buildContract.definition.moduleInterfaces;
            };
          }
        else
          {
            schema =
              if kind == "workspace" then
                pkgs.writeText "package-specialization-schema.json" (
                  builtins.toJSON
                    (builtins.fromJSON (builtins.readFile "${contract}/package-schemas.json"))
                    .${candidate.revision.revisionId}
                )
              else
                "${compiled}/bindings.json";
            generator = protocol;
            packageRevisionId = candidate.revision.revisionId;
          }
      );
    in
    {
      packageRevisionId = candidate.revision.revisionId;
      artifactPath = artifact;
    };
  checks =
    if contractOnly then
      [ ]
    else
      map checkPackage (
        builtins.filter
          (node: node.kind == "package" && (kind == "workspace" || sourceKey node == sourceKey root))
          (
            builtins.attrValues (
              builtins.listToAttrs (
                map (node: {
                  name = sourceKey node;
                  value = node;
                }) (capabilityFlatten root)
              )
            )
          )
      );
  manifest = pkgs.writeText "qx-candidate-checks.json" (builtins.toJSON checks);
  bindingOptions = pkgs.writeText "qx-typescript-options.json" (
    builtins.toJSON (
      (builtins.fromJSON (builtins.readFile "${root.directory}/quixos.check.json")).options or { }
    )
  );
in
assert
  workspaceId == null
  || (
    kind == "workspace"
    && builtins.isString workspaceId
    && builtins.match "[a-zA-Z0-9][a-zA-Z0-9:._-]{0,255}" workspaceId != null
  );
pkgs.runCommand (if contractOnly then "qx-contract" else "qx-checked-candidate") { } ''
  mkdir -p "$out"
  cp ${
    builtins.toFile "qx-candidate-source.json" (builtins.toJSON { inherit repository commit kind; })
  } "$out/source.json"
  cp ${contract}/candidate.json "$out/candidate.json"
  cp ${contract}/graph.json "$out/graph.json"
  cp ${manifest} "$out/checks.json"
  ${pkgs.lib.optionalString (execution && kind == "workspace") ''
    ${
      if builtins.pathExists "${root.directory}/quixos.entry.json" then
        ''
          cp ${root.directory}/quixos.entry.json "$out/entry.json"
        ''
      else
        ''
          echo null > "$out/entry.json"
        ''
    }
    cp ${contract}/execution-plan.json "$out/execution-plan.json"
    ${pkgs.lib.optionalString (!contractOnly) ''
      ${pkgs.nodejs_24}/bin/node ${./check-execution.mjs} \
        ${protocol}/libexec/quixos-protocol/execution-world.mjs \
        "$out/execution-plan.json" "$out/checks.json" "$out"
      mkdir -p "$out/bin"
      cat > "$out/bin/run-isolated" <<EOF
      #!${pkgs.runtimeShell}
      exec ${runtimePackages.camino-isolated-workspace}/bin/camino-isolated-workspace "$out" "\$@"
      EOF
      chmod +x "$out/bin/run-isolated"
    ''}
  ''}
  ${pkgs.lib.optionalString (
    kind != "workspace"
  ) ''cp ${contract}/bindings.json "$out/bindings.json"''}
  ${pkgs.lib.optionalString (execution && kind == "package" && !contractOnly) ''
    ${pkgs.nodejs_24}/bin/node ${./check-package.mjs} \
      ${protocol}/libexec/quixos-protocol/execution-world.mjs ${contract}/bindings.json \
      "$out/checks.json" "$out"
  ''}
  ${pkgs.lib.optionalString (kind == "package" && !execution) ''
    ${protocol}/bin/quixos-codegen-ts ${contract}/bindings.json \
      ${pkgs.lib.escapeShellArg (builtins.fromJSON (builtins.readFile "${contract}/candidate.json")).revision.revisionId} \
      "$out/bindings.ts" ${bindingOptions}
  ''}
''