#!/bin/bash

################################################################################################################
#                                                                                                              #
# WARNING: This file is automatically generated                                                                #
# DO NOT modify this file directly as it will be overwritten                                                 #
#                                                                                                              #
# Particle-OS apt-layer Tool                                                                                 #
# Generated on: 2025-07-11 12:27:50                                                                 #
#                                                                                                              #
################################################################################################################

set -euo pipefail

# Particle-OS apt-layer Tool - Self-contained version
# This script contains all components merged into a single file
# Enhanced version with container support, multiple package managers, and LIVE SYSTEM LAYERING
# Inspired by Vanilla OS Apx approach, ParticleOS apt-layer, and rpm-ostree live layering


# Version: 25.07.11
# Particle-OS apt-layer Tool
# Enhanced with Container Support and LIVE SYSTEM LAYERING


# Fallback logging functions (always defined first)
# Color definitions
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
CYAN='\033[0;36m'
PURPLE='\033[0;35m'
NC='\033[0m'

log_info() { 
    local message="$1"
    local script_name="${2:-apt-layer}"
    echo -e "${BLUE}[INFO]${NC} [$script_name] $message"
}
log_debug() { 
    local message="$1"
    local script_name="${2:-apt-layer}"
    echo -e "${YELLOW}[DEBUG]${NC} [$script_name] $message"
}
log_error() { 
    local message="$1"
    local script_name="${2:-apt-layer}"
    echo -e "${RED}[ERROR]${NC} [$script_name] $message" >&2
}
log_warning() { 
    local message="$1"
    local script_name="${2:-apt-layer}"
    echo -e "${YELLOW}[WARNING]${NC} [$script_name] $message" >&2
}
log_success() { 
    local message="$1"
    local script_name="${2:-apt-layer}"
    echo -e "${GREEN}[SUCCESS]${NC} [$script_name] $message"
}
log_layer() { 
    local message="$1"
    local script_name="${2:-apt-layer}"
    echo -e "${PURPLE}[LAYER]${NC} [$script_name] $message"
}
log_transaction() { 
    local message="$1"
    local script_name="${2:-apt-layer}"
    echo -e "${CYAN}[TRANSACTION]${NC} [$script_name] $message"
}


# Source Particle-OS configuration (if available)
if [[ -f "/usr/local/etc/particle-config.sh" ]]; then
    source "/usr/local/etc/particle-config.sh"
    log_info "Loaded Particle-OS configuration" "apt-layer"
else
    log_warning "Particle-OS configuration not found, using defaults" "apt-layer"
fi


# ============================================================================
# Header and Shared Functions
# ============================================================================
# Utility functions for Particle-OS apt-layer Tool
# These functions provide system introspection and core utilities

# Fallback logging functions (in case particle-config.sh is not available)
if ! declare -F log_info >/dev/null 2>&1; then
    log_info() {
        local message="$1"
        local script_name="${2:-apt-layer}"
        echo "[INFO] $message"
    }
fi

if ! declare -F log_warning >/dev/null 2>&1; then
    log_warning() {
        local message="$1"
        local script_name="${2:-apt-layer}"
        echo "[WARNING] $message"
    }
fi

if ! declare -F log_error >/dev/null 2>&1; then
    log_error() {
        local message="$1"
        local script_name="${2:-apt-layer}"
        echo "[ERROR] $message" >&2
    }
fi

if ! declare -F log_success >/dev/null 2>&1; then
    log_success() {
        local message="$1"
        local script_name="${2:-apt-layer}"
        echo "[SUCCESS] $message"
    }
fi

if ! declare -F log_debug >/dev/null 2>&1; then
    log_debug() {
        local message="$1"
        local script_name="${2:-apt-layer}"
        echo "[DEBUG] $message"
    }
fi

if ! declare -F log_transaction >/dev/null 2>&1; then
    log_transaction() {
        local message="$1"
        local script_name="${2:-apt-layer}"
        echo "[TRANSACTION] $message"
    }
fi

if ! declare -F log_layer >/dev/null 2>&1; then
    log_layer() {
        local message="$1"
        local script_name="${2:-apt-layer}"
        echo "[LAYER] $message"
    }
fi

# Global variables for cleanup
CLEANUP_DIRS=()
CLEANUP_MOUNTS=()
CLEANUP_FILES=()

# Workspace and directory variables
WORKSPACE="/var/lib/particle-os"
BUILD_DIR="/var/lib/particle-os/build"
LIVE_OVERLAY_DIR="/var/lib/particle-os/live-overlay"
COMPOSEFS_DIR="/var/lib/particle-os/composefs"
COMPOSEFS_SCRIPT="/usr/local/bin/composefs"
CONTAINER_RUNTIME="podman"

# Transaction state variables
TRANSACTION_ID=""
TRANSACTION_PHASE=""
TRANSACTION_TARGET=""
TRANSACTION_BACKUP=""
TRANSACTION_TEMP_DIRS=()
TRANSACTION_STATE="/var/lib/particle-os/transaction-state"
TRANSACTION_LOG="/var/lib/particle-os/transaction.log"

# Trap for cleanup on exit
cleanup_on_exit() {
    local exit_code=$?
    
    if [[ -n "$TRANSACTION_ID" ]]; then
        log_transaction "Cleaning up transaction $TRANSACTION_ID (exit code: $exit_code)" "apt-layer"
        
        # Clean up temporary directories
        for temp_dir in "${TRANSACTION_TEMP_DIRS[@]}"; do
            if [[ -d "$temp_dir" ]]; then
                log_debug "Cleaning up temporary directory: $temp_dir" "apt-layer"
                rm -rf "$temp_dir" 2>/dev/null || true
            fi
        done
        
        # If transaction failed, attempt rollback
        if [[ $exit_code -ne 0 ]] && [[ -n "$TRANSACTION_BACKUP" ]]; then
            log_warning "Transaction failed, attempting rollback..." "apt-layer"
            rollback_transaction
        fi
        
        # Clear transaction state
        clear_transaction_state
    fi
    
    # Clean up any remaining mounts
    cleanup_mounts
    
    exit $exit_code
}

trap cleanup_on_exit EXIT INT TERM

# SECURITY: Validate and sanitize input paths
validate_path() {
    local path="$1"
    local type="$2"
    
    # Check for null or empty paths
    if [[ -z "$path" ]]; then
        log_error "Empty $type path provided" "apt-layer"
        exit 1
    fi
    
    # Check for path traversal attempts
    if [[ "$path" =~ \.\. ]]; then
        log_error "Path traversal attempt detected in $type: $path" "apt-layer"
        exit 1
    fi
    
    # Check for absolute paths only (for source directories and mount points)
    if [[ "$type" == "source_dir" || "$type" == "mount_point" ]]; then
        if [[ ! "$path" =~ ^/ ]]; then
            log_error "$type must be an absolute path: $path" "apt-layer"
            exit 1
        fi
    fi
    
    # Validate characters (alphanumeric, hyphens, underscores, slashes, dots)
    if [[ ! "$path" =~ ^[a-zA-Z0-9/._-]+$ ]]; then
        log_error "Invalid characters in $type: $path" "apt-layer"
        exit 1
    fi
    
    echo "$path"
}

# SECURITY: Validate image name (alphanumeric, hyphens, underscores only)
validate_image_name() {
    local name="$1"
    
    if [[ -z "$name" ]]; then
        log_error "Empty image name provided" "apt-layer"
        exit 1
    fi
    
    if [[ ! "$name" =~ ^[a-zA-Z0-9/_-]+$ ]]; then
        log_error "Invalid image name: $name (only alphanumeric, hyphens, underscores, and slashes allowed)" "apt-layer"
        exit 1
    fi
    
    echo "$name"
}

# Check if running as root
check_root() {
    if [[ $EUID -ne 0 ]]; then
        log_error "This script must be run as root" "apt-layer"
        exit 1
    fi
}

# Initialize workspace
init_workspace() {
    log_info "Initializing Particle-OS workspace..." "apt-layer"
    
    mkdir -p "$WORKSPACE"
    mkdir -p "$BUILD_DIR"
    mkdir -p "$LIVE_OVERLAY_DIR"
    
    # Ensure ComposeFS directory exists
    if [[ ! -d "$COMPOSEFS_DIR" ]]; then
        log_info "ComposeFS directory not found, initializing..." "apt-layer"
        if [[ -f "$COMPOSEFS_SCRIPT" ]]; then
            # Run composefs-alternative.sh status to initialize directories
            "$COMPOSEFS_SCRIPT" status >/dev/null 2>&1 || true
        fi
    fi
    
    log_success "Workspace initialized: $WORKSPACE" "apt-layer"
}

# ComposeFS helper functions
composefs_create() {
    local image_name="$1"
    local source_dir="$2"
    
    log_debug "Creating ComposeFS image: $image_name from $source_dir" "apt-layer"
    
    if ! "$COMPOSEFS_SCRIPT" create "$image_name" "$source_dir"; then
        log_error "Failed to create ComposeFS image: $image_name" "apt-layer"
        return 1
    fi
    
    log_success "ComposeFS image created: $image_name" "apt-layer"
    return 0
}

composefs_mount() {
    local image_name="$1"
    local mount_point="$2"
    
    log_debug "Mounting ComposeFS image: $image_name to $mount_point" "apt-layer"
    
    if ! "$COMPOSEFS_SCRIPT" mount "$image_name" "$mount_point"; then
        log_error "Failed to mount ComposeFS image: $image_name to $mount_point" "apt-layer"
        return 1
    fi
    
    log_success "ComposeFS image mounted: $image_name to $mount_point" "apt-layer"
    return 0
}

composefs_unmount() {
    local mount_point="$1"
    
    log_debug "Unmounting ComposeFS image from: $mount_point" "apt-layer"
    
    if ! "$COMPOSEFS_SCRIPT" unmount "$mount_point"; then
        log_error "Failed to unmount ComposeFS image from: $mount_point" "apt-layer"
        return 1
    fi
    
    log_success "ComposeFS image unmounted from: $mount_point" "apt-layer"
    return 0
}

composefs_list_images() {
    log_debug "Listing ComposeFS images" "apt-layer"
    "$COMPOSEFS_SCRIPT" list-images
}

composefs_image_exists() {
    local image_name="$1"
    
    # Check if image exists by trying to list it
    if "$COMPOSEFS_SCRIPT" list-images | grep -q "^$image_name$"; then
        return 0
    else
        return 1
    fi
}

composefs_remove_image() {
    local image_name="$1"
    
    log_debug "Removing ComposeFS image: $image_name" "apt-layer"
    
    if ! "$COMPOSEFS_SCRIPT" remove "$image_name"; then
        log_error "Failed to remove ComposeFS image: $image_name" "apt-layer"
        return 1
    fi
    
    log_success "ComposeFS image removed: $image_name" "apt-layer"
    return 0
}

# List all available branches/images
list_branches() {
    log_info "Listing available ComposeFS images/branches..." "apt-layer"
    
    if ! composefs_list_images; then
        log_error "Failed to list ComposeFS images" "apt-layer"
        return 1
    fi
    
    return 0
}

# Show information about a specific branch/image
show_branch_info() {
    local image_name="$1"
    
    log_info "Showing information for image: $image_name" "apt-layer"
    
    if ! composefs_image_exists "$image_name"; then
        log_error "Image not found: $image_name" "apt-layer"
        return 1
    fi
    
    # Get basic image information
    echo "Image: $image_name"
    echo "Status: Available"
    
    # Try to get more detailed information if available
    if [[ -f "$COMPOSEFS_DIR/$image_name/info.json" ]]; then
        echo "Details:"
        jq -r '.' "$COMPOSEFS_DIR/$image_name/info.json" 2>/dev/null || echo "  (Unable to parse info.json)"
    fi
    
    return 0
}

# Remove an image (alias for composefs_remove_image)
remove_image() {
    local image_name="$1"
    
    log_info "Removing image: $image_name" "apt-layer"
    
    if ! composefs_remove_image "$image_name"; then
        log_error "Failed to remove image: $image_name" "apt-layer"
        return 1
    fi
    
    return 0
}

composefs_get_status() {
    log_debug "Getting ComposeFS status" "apt-layer"
    "$COMPOSEFS_SCRIPT" status
}

# Atomic directory operations
atomic_directory_swap() {
    local source="$1"
    local target="$2"
    local backup="$3"
    
    log_debug "Performing atomic directory swap: $source -> $target (backup: $backup)" "apt-layer"
    
    # Create backup if specified
    if [[ -n "$backup" ]] && [[ -d "$target" ]]; then
        if ! mv "$target" "$backup"; then
            log_error "Failed to create backup: $target -> $backup" "apt-layer"
            return 1
        fi
        log_debug "Backup created: $target -> $backup" "apt-layer"
    fi
    
    # Move source to target
    if ! mv "$source" "$target"; then
        log_error "Failed to move source to target: $source -> $target" "apt-layer"
        
        # Restore backup if it exists
        if [[ -n "$backup" ]] && [[ -d "$backup" ]]; then
            log_warning "Restoring backup after failed move" "apt-layer"
            mv "$backup" "$target" 2>/dev/null || true
        fi
        
        return 1
    fi
    
    log_debug "Atomic directory swap completed: $source -> $target" "apt-layer"
    return 0
}

# Cleanup mounts
cleanup_mounts() {
    log_debug "Cleaning up mounts" "apt-layer"
    
    for mount in "${CLEANUP_MOUNTS[@]}"; do
        if mountpoint -q "$mount" 2>/dev/null; then
            log_debug "Unmounting: $mount" "apt-layer"
            umount "$mount" 2>/dev/null || log_warning "Failed to unmount: $mount" "apt-layer"
        fi
    done
}

# Get system information
get_system_info() {
    echo "Kernel: $(uname -r)"
    echo "Architecture: $(uname -m)"
    echo "Available modules:"
    if modprobe -n squashfs >/dev/null 2>&1; then
        echo "  â squashfs module available"
    else
        echo "  â squashfs module not available"
    fi
    if modprobe -n overlay >/dev/null 2>&1; then
        echo "  â overlay module available"
    else
        echo "  â overlay module not available"
    fi
}

# Calculate disk usage
calculate_disk_usage() {
    local path="$1"
    local size
    size=$(du -sb "$path" 2>/dev/null | cut -f1 || echo "0")
    local size_mb=$((size / 1024 / 1024))
    echo "$size_mb"
}

# Get available space
get_available_space() {
    local path="$1"
    local available_space
    available_space=$(df "$path" | tail -1 | awk '{print $4}')
    local available_space_mb=$((available_space * 1024 / 1024 / 1024))
    echo "$available_space_mb"
} 

# --- END OF SCRIPTLET: 00-header.sh ---

# ============================================================================
# Dependency Checking and Validation
# ============================================================================
# Dependency checking and validation for Ubuntu uBlue apt-layer Tool
check_dependencies() {
    log_info "Checking dependencies..." "apt-layer"
    
    local missing_deps=()
    
    # Core dependencies
    for dep in chroot apt-get; do
        if ! command -v "$dep" >/dev/null 2>&1; then
            missing_deps+=("$dep")
        fi
    done
    
    # Check for container runtime if container mode is requested
    if [[ "${1:-}" == "--container" ]] && ! command -v "$CONTAINER_RUNTIME" >/dev/null 2>&1; then
        missing_deps+=("$CONTAINER_RUNTIME")
    fi
    
    # Check for composefs-alternative.sh
    if [[ ! -f "$COMPOSEFS_SCRIPT" ]]; then
        missing_deps+=("composefs-alternative.sh")
        log_warning "composefs-alternative.sh not found at $COMPOSEFS_SCRIPT" "apt-layer"
        log_info "Please ensure composefs-alternative.sh is installed and accessible" "apt-layer"
    elif [[ ! -x "$COMPOSEFS_SCRIPT" ]]; then
        missing_deps+=("composefs-alternative.sh (not executable)")
        log_warning "composefs-alternative.sh not executable at $COMPOSEFS_SCRIPT" "apt-layer"
        log_info "Please ensure composefs-alternative.sh has execute permissions" "apt-layer"
    fi
    
    # Check for kernel modules
    check_kernel_modules
    
    if [ ${#missing_deps[@]} -ne 0 ]; then
        log_error "Missing dependencies: ${missing_deps[*]}" "apt-layer"
        log_info "Install missing packages with: sudo apt install -y ${missing_deps[*]}" "apt-layer"
        exit 1
    fi
    
    log_success "All dependencies found" "apt-layer"
}

# Check kernel modules
check_kernel_modules() {
    log_info "Checking kernel modules..." "apt-layer"
    
    local missing_modules=()
    
    # Check for squashfs module
    if ! modprobe -n squashfs >/dev/null 2>&1; then
        missing_modules+=("squashfs")
    fi
    
    # Check for overlay module
    if ! modprobe -n overlay >/dev/null 2>&1; then
        missing_modules+=("overlay")
    fi
    
    if [ ${#missing_modules[@]} -ne 0 ]; then
        log_warning "Missing kernel modules: ${missing_modules[*]}" "apt-layer"
        log_info "Load modules with: sudo modprobe ${missing_modules[*]}" "apt-layer"
        log_info "Or install with: sudo apt install linux-modules-extra-$(uname -r)" "apt-layer"
    else
        log_success "All required kernel modules available" "apt-layer"
    fi
}

# Check for OCI integration script
check_oci_integration() {
    local oci_script="/usr/local/bin/oci-integration.sh"
    
    if [[ -f "$oci_script" ]] && [[ -x "$oci_script" ]]; then
        log_debug "OCI integration script found: $oci_script" "apt-layer"
        return 0
    else
        log_warning "OCI integration script not found or not executable: $oci_script" "apt-layer"
        log_info "OCI export/import features will not be available" "apt-layer"
        return 1
    fi
}

# Check for bootloader integration script
check_bootloader_integration() {
    local bootloader_script="/usr/local/bin/bootloader-integration.sh"
    
    if [[ -f "$bootloader_script" ]] && [[ -x "$bootloader_script" ]]; then
        log_debug "Bootloader integration script found: $bootloader_script" "apt-layer"
        return 0
    else
        log_warning "Bootloader integration script not found or not executable: $bootloader_script" "apt-layer"
        log_info "Automatic bootloader integration will not be available" "apt-layer"
        return 1
    fi
}

# Validate package names
validate_package_names() {
    local packages=("$@")
    local invalid_packages=()
    
    for package in "${packages[@]}"; do
        # Check for basic package name format
        if [[ ! "$package" =~ ^[a-zA-Z0-9][a-zA-Z0-9+.-]*$ ]]; then
            invalid_packages+=("$package")
        fi
    done
    
    if [ ${#invalid_packages[@]} -ne 0 ]; then
        log_error "Invalid package names: ${invalid_packages[*]}" "apt-layer"
        log_info "Package names must contain only alphanumeric characters, +, -, and ." "apt-layer"
        return 1
    fi
    
    return 0
}

# Check available disk space
check_disk_space() {
    local required_space_mb="$1"
    local target_dir="${2:-$WORKSPACE}"
    
    local available_space_mb
    available_space_mb=$(get_available_space "$target_dir")
    
    if [[ $available_space_mb -lt $required_space_mb ]]; then
        log_error "Insufficient disk space: ${available_space_mb}MB available, need ${required_space_mb}MB" "apt-layer"
        return 1
    fi
    
    log_debug "Disk space check passed: ${available_space_mb}MB available" "apt-layer"
    return 0
}

# Check if system is in a bootable state
check_system_state() {
    log_info "Checking system state..." "apt-layer"
    
    # Check if running from a live system
    if [[ -f "/run/ostree-booted" ]]; then
        log_info "System is running from OSTree/ComposeFS" "apt-layer"
        return 0
    fi
    
    # Check if running from a traditional system
    if [[ -f "/etc/os-release" ]]; then
        log_info "System is running from traditional filesystem" "apt-layer"
        return 0
    fi
    
    log_warning "Unable to determine system state" "apt-layer"
    return 1
} 

# --- END OF SCRIPTLET: 01-dependencies.sh ---

# ============================================================================
# Transaction Management
# ============================================================================
# Transaction management for Ubuntu uBlue apt-layer Tool
# Provides atomic operations with automatic rollback and recovery

# Transaction management functions
start_transaction() {
    local operation="$1"
    local target="$2"
    
    TRANSACTION_ID=$(date +%Y%m%d_%H%M%S)_$$
    TRANSACTION_PHASE="started"
    TRANSACTION_TARGET="$target"
    
    log_transaction "Starting transaction $TRANSACTION_ID: $operation -> $target" "apt-layer"
    
    # Save transaction state
    save_transaction_state
    
    # Log transaction start
    echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) - START - $TRANSACTION_ID - $operation - $target" >> "$TRANSACTION_LOG"
}

update_transaction_phase() {
    local phase="$1"
    
    TRANSACTION_PHASE="$phase"
    
    log_transaction "Transaction $TRANSACTION_ID phase: $phase" "apt-layer"
    
    # Update transaction state
    save_transaction_state
    
    # Log phase update
    echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) - PHASE - $TRANSACTION_ID - $phase" >> "$TRANSACTION_LOG"
}

commit_transaction() {
    log_transaction "Committing transaction $TRANSACTION_ID" "apt-layer"
    
    # Log successful completion
    echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) - COMMIT - $TRANSACTION_ID - SUCCESS" >> "$TRANSACTION_LOG"
    
    # Clear transaction state
    clear_transaction_state
    
    log_success "Transaction $TRANSACTION_ID completed successfully" "apt-layer"
}

rollback_transaction() {
    log_transaction "Rolling back transaction $TRANSACTION_ID" "apt-layer"
    
    if [[ -n "$TRANSACTION_BACKUP" ]] && [[ -d "$TRANSACTION_BACKUP" ]]; then
        log_info "Restoring from backup: $TRANSACTION_BACKUP" "apt-layer"
        
        # Restore from backup
        if atomic_directory_swap "$TRANSACTION_BACKUP" "$TRANSACTION_TARGET" ""; then
            log_success "Rollback completed successfully" "apt-layer"
        else
            log_error "Rollback failed - manual intervention may be required" "apt-layer"
        fi
    else
        log_warning "No backup available for rollback" "apt-layer"
    fi
    
    # Log rollback
    echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) - ROLLBACK - $TRANSACTION_ID - $TRANSACTION_PHASE" >> "$TRANSACTION_LOG"
    
    # Clear transaction state
    clear_transaction_state
}

save_transaction_state() {
    if [[ -n "$TRANSACTION_ID" ]]; then
        cat > "$TRANSACTION_STATE" << EOF
TRANSACTION_ID="$TRANSACTION_ID"
TRANSACTION_PHASE="$TRANSACTION_PHASE"
TRANSACTION_TARGET="$TRANSACTION_TARGET"
TRANSACTION_BACKUP="$TRANSACTION_BACKUP"
TRANSACTION_TEMP_DIRS=(${TRANSACTION_TEMP_DIRS[*]})
EOF
    fi
}

clear_transaction_state() {
    TRANSACTION_ID=""
    TRANSACTION_PHASE=""
    TRANSACTION_TARGET=""
    TRANSACTION_BACKUP=""
    TRANSACTION_TEMP_DIRS=()
    
    # Remove state file
    rm -f "$TRANSACTION_STATE"
}

load_transaction_state() {
    if [[ -f "$TRANSACTION_STATE" ]]; then
        source "$TRANSACTION_STATE"
        return 0
    else
        return 1
    fi
}

check_incomplete_transactions() {
    log_info "Checking for incomplete transactions..." "apt-layer"
    
    if load_transaction_state; then
        log_warning "Found incomplete transaction: $TRANSACTION_ID (phase: $TRANSACTION_PHASE)" "apt-layer"
        log_info "Target: $TRANSACTION_TARGET" "apt-layer"
        
        if [[ -n "$TRANSACTION_BACKUP" ]] && [[ -d "$TRANSACTION_BACKUP" ]]; then
            log_info "Backup available: $TRANSACTION_BACKUP" "apt-layer"
        fi
        
        # Ask user what to do
        echo
        echo "Incomplete transaction detected. Choose an action:"
        echo "1) Attempt rollback (recommended)"
        echo "2) Continue transaction (risky)"
        echo "3) Clear transaction state (manual cleanup required)"
        echo "4) Exit"
        echo
        read -p "Enter choice (1-4): " choice
        
        case "$choice" in
            1)
                log_info "Attempting rollback..." "apt-layer"
                rollback_transaction
                ;;
            2)
                log_warning "Continuing incomplete transaction..." "apt-layer"
                log_info "Transaction will resume from phase: $TRANSACTION_PHASE" "apt-layer"
                ;;
            3)
                log_warning "Clearing transaction state..." "apt-layer"
                clear_transaction_state
                ;;
            4)
                log_info "Exiting..." "apt-layer"
                exit 0
                ;;
            *)
                log_error "Invalid choice, exiting..." "apt-layer"
                exit 1
                ;;
        esac
    else
        log_info "No incomplete transactions found" "apt-layer"
    fi
}

# Dry run functionality for package installation
dry_run_apt_install() {
    local packages=("$@")
    local chroot_dir="${1:-}"
    
    log_info "Performing dry run for packages: ${packages[*]}" "apt-layer"
    
    local apt_cmd
    if [[ -n "$chroot_dir" ]]; then
        apt_cmd="chroot '$chroot_dir' apt-get install --simulate"
    else
        apt_cmd="apt-get install --simulate"
    fi
    
    # Add packages to command
    apt_cmd+=" ${packages[*]}"
    
    log_debug "Running: $apt_cmd" "apt-layer"
    
    # Execute dry run
    if eval "$apt_cmd" >/dev/null 2>&1; then
        log_success "Dry run completed successfully - no conflicts detected" "apt-layer"
        return 0
    else
        log_error "Dry run failed - potential conflicts detected" "apt-layer"
        log_info "Run the command manually to see detailed output:" "apt-layer"
        log_info "$apt_cmd" "apt-layer"
        return 1
    fi
}

# Transaction logging utilities
log_transaction_event() {
    local event="$1"
    local details="$2"
    
    echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) - $event - $TRANSACTION_ID - $details" >> "$TRANSACTION_LOG"
}

# Transaction validation
validate_transaction_state() {
    if [[ -z "$TRANSACTION_ID" ]]; then
        log_error "No active transaction" "apt-layer"
        return 1
    fi
    
    if [[ -z "$TRANSACTION_TARGET" ]]; then
        log_error "Transaction target not set" "apt-layer"
        return 1
    fi
    
    return 0
}

# Transaction cleanup utilities
add_temp_directory() {
    local temp_dir="$1"
    TRANSACTION_TEMP_DIRS+=("$temp_dir")
    save_transaction_state
}

add_backup_path() {
    local backup_path="$1"
    TRANSACTION_BACKUP="$backup_path"
    save_transaction_state
} 

# --- END OF SCRIPTLET: 02-transactions.sh ---

# ============================================================================
# Traditional Layer Creation
# ============================================================================
# Traditional layer creation for Ubuntu uBlue apt-layer Tool
# Provides chroot-based package installation for layer creation

# Create traditional layer
create_layer() {
    local base_image="$1"
    local new_image="$2"
    shift 2
    local packages=("$@")

    log_layer "Creating traditional layer: $new_image" "apt-layer"
    log_info "Base image: $base_image" "apt-layer"
    log_info "Packages to install: ${packages[*]}" "apt-layer"

    # Start transaction
    start_transaction "create_layer" "$new_image"

    # Check if base image exists
    if ! composefs_image_exists "$base_image"; then
        log_error "Base image '$base_image' not found" "apt-layer"
        log_info "Available images:" "apt-layer"
        composefs_list_images
        exit 1
    fi

    # Prepare temp_layer_dir
    local temp_layer_dir="$BUILD_DIR/temp-layer-$(basename "$new_image")-${TRANSACTION_ID}"
    local final_layer_dir="$BUILD_DIR/layer-$(basename "$new_image")"
    local backup_dir="$BUILD_DIR/backup-layer-$(basename "$new_image")-${TRANSACTION_ID}"
    add_temp_directory "$temp_layer_dir"
    add_temp_directory "$backup_dir"
    rm -rf "$temp_layer_dir" 2>/dev/null || true
    mkdir -p "$temp_layer_dir"

    update_transaction_phase "checkout_base"
    
    # Mount base image to temp_layer_dir
    log_info "Mounting base image..." "apt-layer"
    if ! composefs_mount "$base_image" "$temp_layer_dir"; then
        log_error "Failed to mount base image" "apt-layer"
        exit 1
    fi

    update_transaction_phase "setup_chroot"
    
    # Set up chroot environment
    log_info "Setting up chroot environment..." "apt-layer"
    mount --bind /proc "$temp_layer_dir/proc"
    mount --bind /sys "$temp_layer_dir/sys"
    mount --bind /dev "$temp_layer_dir/dev"
    
    # Copy host's resolv.conf for internet access
    cp /etc/resolv.conf "$temp_layer_dir/etc/resolv.conf" 2>/dev/null || true
    
    # Ensure /run exists and is writable
    mkdir -p "$temp_layer_dir/run"
    chmod 755 "$temp_layer_dir/run"
    
    # Set non-interactive environment for apt
    export DEBIAN_FRONTEND=noninteractive

    update_transaction_phase "dry_run_check"
    
    # Perform dry run to check for conflicts
    log_info "Performing dry run to check for package conflicts..." "apt-layer"
    if ! dry_run_apt_install "$temp_layer_dir" "${packages[@]}"; then
        log_error "Dry run failed - package conflicts detected" "apt-layer"
        log_info "Please resolve conflicts before proceeding" "apt-layer"
        exit 1
    fi

    update_transaction_phase "install_packages"
    
    # Install packages in chroot
    log_info "Installing packages in chroot..." "apt-layer"
    if ! chroot "$temp_layer_dir" apt-get update; then
        log_error "Failed to update package lists in chroot" "apt-layer"
        exit 1
    fi
    
    if ! chroot "$temp_layer_dir" apt-get install -y "${packages[@]}"; then
        log_error "Failed to install packages in chroot" "apt-layer"
        exit 1
    fi
    
    # Clean up package cache
    chroot "$temp_layer_dir" apt-get clean
    chroot "$temp_layer_dir" apt-get autoremove -y

    update_transaction_phase "cleanup_mounts"
    
    # Clean up mounts
    umount "$temp_layer_dir/proc" 2>/dev/null || true
    umount "$temp_layer_dir/sys" 2>/dev/null || true
    umount "$temp_layer_dir/dev" 2>/dev/null || true
    
    # Remove temporary resolv.conf
    rm -f "$temp_layer_dir/etc/resolv.conf"

    update_transaction_phase "atomic_swap"
    
    # Perform atomic directory swap
    if [[ -d "$final_layer_dir" ]]; then
        log_debug "Backing up existing layer directory" "apt-layer"
        if ! atomic_directory_swap "$final_layer_dir" "$backup_dir" ""; then
            log_error "Failed to backup existing layer directory" "apt-layer"
            exit 1
        fi
        add_backup_path "$backup_dir"
    fi
    
    # Move temporary directory to final location
    if ! atomic_directory_swap "$temp_layer_dir" "$final_layer_dir" ""; then
        log_error "Failed to perform atomic directory swap" "apt-layer"
        exit 1
    fi

    update_transaction_phase "create_commit"
    
    # Create ComposeFS image from the final layer directory
    log_info "Creating ComposeFS image..." "apt-layer"
    if ! composefs_create "$new_image" "$final_layer_dir"; then
        log_error "Failed to create ComposeFS image" "apt-layer"
        exit 1
    fi

    # Commit transaction
    commit_transaction
    
    log_success "Traditional layer created successfully: $new_image" "apt-layer"
}

# Setup chroot environment for package installation
setup_chroot_environment() {
    local chroot_dir="$1"
    
    log_debug "Setting up chroot environment: $chroot_dir" "apt-layer"
    
    # Create necessary directories
    mkdir -p "$chroot_dir"/{proc,sys,dev,run}
    
    # Mount essential filesystems
    mount --bind /proc "$chroot_dir/proc"
    mount --bind /sys "$chroot_dir/sys"
    mount --bind /dev "$chroot_dir/dev"
    
    # Copy DNS configuration
    cp /etc/resolv.conf "$chroot_dir/etc/resolv.conf" 2>/dev/null || true
    
    # Set proper permissions
    chmod 755 "$chroot_dir/run"
    
    # Set environment variables
    export DEBIAN_FRONTEND=noninteractive
    
    log_debug "Chroot environment setup completed" "apt-layer"
}

# Cleanup chroot environment
cleanup_chroot_environment() {
    local chroot_dir="$1"
    
    log_debug "Cleaning up chroot environment: $chroot_dir" "apt-layer"
    
    # Unmount filesystems
    umount "$chroot_dir/proc" 2>/dev/null || true
    umount "$chroot_dir/sys" 2>/dev/null || true
    umount "$chroot_dir/dev" 2>/dev/null || true
    
    # Remove temporary files
    rm -f "$chroot_dir/etc/resolv.conf"
    
    log_debug "Chroot environment cleanup completed" "apt-layer"
}

# Install packages in chroot with error handling
install_packages_in_chroot() {
    local chroot_dir="$1"
    shift
    local packages=("$@")
    
    log_info "Installing packages in chroot: ${packages[*]}" "apt-layer"
    
    # Update package lists
    if ! chroot "$chroot_dir" apt-get update; then
        log_error "Failed to update package lists in chroot" "apt-layer"
        return 1
    fi
    
    # Install packages
    if ! chroot "$chroot_dir" apt-get install -y "${packages[@]}"; then
        log_error "Failed to install packages in chroot" "apt-layer"
        return 1
    fi
    
    # Clean up
    chroot "$chroot_dir" apt-get clean
    chroot "$chroot_dir" apt-get autoremove -y
    
    log_success "Packages installed successfully in chroot" "apt-layer"
    return 0
}

# Validate chroot environment
validate_chroot_environment() {
    local chroot_dir="$1"
    
    log_debug "Validating chroot environment: $chroot_dir" "apt-layer"
    
    # Check if chroot directory exists
    if [[ ! -d "$chroot_dir" ]]; then
        log_error "Chroot directory does not exist: $chroot_dir" "apt-layer"
        return 1
    fi
    
    # Check if essential directories exist
    for dir in bin lib usr etc; do
        if [[ ! -d "$chroot_dir/$dir" ]]; then
            log_error "Essential directory missing in chroot: $dir" "apt-layer"
            return 1
        fi
    done
    
    # Check if apt is available
    if [[ ! -x "$chroot_dir/usr/bin/apt-get" ]]; then
        log_error "apt-get not found in chroot environment" "apt-layer"
        return 1
    fi
    
    log_debug "Chroot environment validation passed" "apt-layer"
    return 0
} 

# --- END OF SCRIPTLET: 03-traditional.sh ---

# ============================================================================
# Container-based Layer Creation (Apx-style)
# ============================================================================
# Container-based layer creation for Ubuntu uBlue apt-layer Tool
# Provides Apx-style isolated container installation with ComposeFS backend

# Container runtime detection and configuration
detect_container_runtime() {
    log_info "Detecting container runtime" "apt-layer"
    
    # Check for podman first (preferred for rootless)
    if command -v podman &> /dev/null; then
        CONTAINER_RUNTIME="podman"
        log_info "Using podman as container runtime" "apt-layer"
        return 0
    fi
    
    # Fallback to docker
    if command -v docker &> /dev/null; then
        CONTAINER_RUNTIME="docker"
        log_info "Using docker as container runtime" "apt-layer"
        return 0
    fi
    
    # Check for systemd-nspawn as last resort
    if command -v systemd-nspawn &> /dev/null; then
        CONTAINER_RUNTIME="systemd-nspawn"
        log_info "Using systemd-nspawn as container runtime" "apt-layer"
        return 0
    fi
    
    log_error "No supported container runtime found (podman, docker, or systemd-nspawn)" "apt-layer"
    return 1
}

# Enhanced container runtime detection with validation
init_container_system() {
    log_info "Initializing container system" "apt-layer"
    
    # Detect container runtime
    if ! detect_container_runtime; then
        return 1
    fi
    
    # Validate container runtime
    if ! validate_container_runtime "$CONTAINER_RUNTIME"; then
        return 1
    fi
    
    # Ensure workspace directories exist
    mkdir -p "$WORKSPACE"/{images,temp,containers}
    
    log_success "Container system initialized with runtime: $CONTAINER_RUNTIME" "apt-layer"
    return 0
}

# Validate container runtime capabilities
validate_container_runtime() {
    local runtime="$1"
    
    log_info "Validating container runtime: $runtime" "apt-layer"
    
    case "$runtime" in
        podman)
            if ! podman info &> /dev/null; then
                log_error "podman is not properly configured" "apt-layer"
                return 1
            fi
            ;;
        docker)
            if ! docker info &> /dev/null; then
                log_error "docker is not properly configured" "apt-layer"
                return 1
            fi
            ;;
        systemd-nspawn)
            # systemd-nspawn doesn't need special validation
            ;;
        *)
            log_error "Unsupported container runtime: $runtime" "apt-layer"
            return 1
            ;;
    esac
    
    log_success "Container runtime validation passed" "apt-layer"
    return 0
}

# Determine if base image is ComposeFS or OCI
is_composefs_image() {
    local base_image="$1"
    
    # Check if it's a ComposeFS image path
    if [[ "$base_image" == *"/"* ]] && [[ -d "$WORKSPACE/images/$base_image" ]]; then
        return 0  # True - it's a ComposeFS image
    fi
    
    return 1  # False - it's likely an OCI image
}

# Export ComposeFS image to OCI format for container use
export_composefs_to_oci() {
    local composefs_image="$1"
    local temp_oci_dir="$2"
    
    log_info "Exporting ComposeFS image to OCI format: $composefs_image" "apt-layer"
    
    # Create temporary OCI directory structure
    mkdir -p "$temp_oci_dir"/{blobs,refs}
    
    # Use ComposeFS backend to export (placeholder for now)
    # This will be fully implemented when 06-oci-integration.sh is complete
    if [[ -f "$COMPOSEFS_SCRIPT" ]]; then
        # Temporary: mount and copy filesystem
        local mount_point="$temp_oci_dir/mount"
        mkdir -p "$mount_point"
        
        if mount_composefs_image "$composefs_image" "$mount_point"; then
            # Create a simple OCI-like structure
            mkdir -p "$temp_oci_dir/rootfs"
            cp -a "$mount_point"/* "$temp_oci_dir/rootfs/" 2>/dev/null || true
            umount "$mount_point" 2>/dev/null || true
            log_success "ComposeFS image exported to OCI format" "apt-layer"
            return 0
        else
            log_error "Failed to mount ComposeFS image for export" "apt-layer"
            return 1
        fi
    else
        log_error "ComposeFS script not found for export" "apt-layer"
        return 1
    fi
}

# Create base container image for layer creation
create_base_container_image() {
    local base_image="$1"
    local container_name="$2"
    
    log_info "Creating base container image: $base_image" "apt-layer"
    
    # Determine if base_image is ComposeFS or OCI
    if is_composefs_image "$base_image"; then
        log_info "Base image is ComposeFS image: $base_image" "apt-layer"
        
        # Export ComposeFS image to OCI format for container use
        local temp_oci_dir="$WORKSPACE/temp/oci-export-$$"
        if ! export_composefs_to_oci "$base_image" "$temp_oci_dir"; then
            log_error "Failed to export ComposeFS image to OCI format" "apt-layer"
            return 1
        fi
        
        # Use the exported OCI image
        log_success "ComposeFS image exported and ready for container use" "apt-layer"
        return 0
    else
        log_info "Base image is OCI image: $base_image" "apt-layer"
        
        # Pull standard OCI image if needed
        case "$CONTAINER_RUNTIME" in
            podman)
                if ! podman image exists "$base_image"; then
                    log_info "Pulling OCI image: $base_image" "apt-layer"
                    podman pull "$base_image"
                fi
                ;;
            docker)
                if ! docker image ls "$base_image" &> /dev/null; then
                    log_info "Pulling OCI image: $base_image" "apt-layer"
                    docker pull "$base_image"
                fi
                ;;
            systemd-nspawn)
                # systemd-nspawn uses host filesystem
                log_info "Using host filesystem for systemd-nspawn" "apt-layer"
                ;;
        esac
        
        log_success "OCI base image ready: $base_image" "apt-layer"
        return 0
    fi
}

# Container-based package installation
container_install_packages() {
    local base_image="$1"
    local new_image="$2"
    local packages=("${@:3}")
    
    log_info "Container-based package installation: ${packages[*]}" "apt-layer"
    
    # Create temporary container name
    local container_name="apt-layer-$(date +%s)-$$"
    local temp_dir="$WORKSPACE/temp/$container_name"
    
    # Ensure temp directory exists
    mkdir -p "$temp_dir"
    
    # Start transaction
    start_transaction "container-install-$container_name"
    
    # Create base container image
    if ! create_base_container_image "$base_image" "$container_name"; then
        rollback_transaction
        return 1
    fi
    
    # Run package installation in container
    case "$CONTAINER_RUNTIME" in
        podman)
            if ! run_podman_install "$base_image" "$container_name" "$temp_dir" "${packages[@]}"; then
                rollback_transaction
                return 1
            fi
            ;;
        docker)
            if ! run_docker_install "$base_image" "$container_name" "$temp_dir" "${packages[@]}"; then
                rollback_transaction
                return 1
            fi
            ;;
        systemd-nspawn)
            if ! run_nspawn_install "$base_image" "$container_name" "$temp_dir" "${packages[@]}"; then
                rollback_transaction
                return 1
            fi
            ;;
    esac
    
    # Create ComposeFS layer from container changes
    if ! create_composefs_layer "$temp_dir" "$new_image"; then
        rollback_transaction
        return 1
    fi
    
    # Commit transaction
    commit_transaction
    
    # Cleanup
    cleanup_container_artifacts "$container_name" "$temp_dir"
    
    log_success "Container-based package installation completed" "apt-layer"
    return 0
}

# Podman-based package installation
run_podman_install() {
    local base_image="$1"
    local container_name="$2"
    local temp_dir="$3"
    shift 3
    local packages=("$@")
    
    log_info "Running podman-based installation" "apt-layer"
    
    # Create container from base image
    local container_id
    if [[ -d "$WORKSPACE/images/$base_image" ]]; then
        # Use ComposeFS image as base
        container_id=$(podman create --name "$container_name" \
            --mount type=bind,source="$WORKSPACE/images/$base_image",target=/ \
            --mount type=bind,source="$temp_dir",target=/output \
            ubuntu:24.04 /bin/bash)
    else
        # Use standard Ubuntu image
        container_id=$(podman create --name "$container_name" \
            --mount type=bind,source="$temp_dir",target=/output \
            ubuntu:24.04 /bin/bash)
    fi
    
    if [[ -z "$container_id" ]]; then
        log_error "Failed to create podman container" "apt-layer"
        return 1
    fi
    
    # Start container and install packages
    if ! podman start "$container_name"; then
        log_error "Failed to start podman container" "apt-layer"
        podman rm "$container_name" 2>/dev/null || true
        return 1
    fi
    
    # Install packages
    local install_cmd="apt-get update && apt-get install -y ${packages[*]} && apt-get clean"
    if ! podman exec "$container_name" /bin/bash -c "$install_cmd"; then
        log_error "Package installation failed in podman container" "apt-layer"
        podman stop "$container_name" 2>/dev/null || true
        podman rm "$container_name" 2>/dev/null || true
        return 1
    fi
    
    # Export container filesystem
    if ! podman export "$container_name" | tar -x -C "$temp_dir"; then
        log_error "Failed to export podman container filesystem" "apt-layer"
        podman stop "$container_name" 2>/dev/null || true
        podman rm "$container_name" 2>/dev/null || true
        return 1
    fi
    
    # Cleanup container
    podman stop "$container_name" 2>/dev/null || true
    podman rm "$container_name" 2>/dev/null || true
    
    log_success "Podman-based installation completed" "apt-layer"
    return 0
}

# Docker-based package installation
run_docker_install() {
    local base_image="$1"
    local container_name="$2"
    local temp_dir="$3"
    shift 3
    local packages=("$@")
    
    log_info "Running docker-based installation" "apt-layer"
    
    # Create container from base image
    local container_id
    if [[ -d "$WORKSPACE/images/$base_image" ]]; then
        # Use ComposeFS image as base
        container_id=$(docker create --name "$container_name" \
            -v "$WORKSPACE/images/$base_image:/" \
            -v "$temp_dir:/output" \
            ubuntu:24.04 /bin/bash)
    else
        # Use standard Ubuntu image
        container_id=$(docker create --name "$container_name" \
            -v "$temp_dir:/output" \
            ubuntu:24.04 /bin/bash)
    fi
    
    if [[ -z "$container_id" ]]; then
        log_error "Failed to create docker container" "apt-layer"
        return 1
    fi
    
    # Start container and install packages
    if ! docker start "$container_name"; then
        log_error "Failed to start docker container" "apt-layer"
        docker rm "$container_name" 2>/dev/null || true
        return 1
    fi
    
    # Install packages
    local install_cmd="apt-get update && apt-get install -y ${packages[*]} && apt-get clean"
    if ! docker exec "$container_name" /bin/bash -c "$install_cmd"; then
        log_error "Package installation failed in docker container" "apt-layer"
        docker stop "$container_name" 2>/dev/null || true
        docker rm "$container_name" 2>/dev/null || true
        return 1
    fi
    
    # Export container filesystem
    if ! docker export "$container_name" | tar -x -C "$temp_dir"; then
        log_error "Failed to export docker container filesystem" "apt-layer"
        docker stop "$container_name" 2>/dev/null || true
        docker rm "$container_name" 2>/dev/null || true
        return 1
    fi
    
    # Cleanup container
    docker stop "$container_name" 2>/dev/null || true
    docker rm "$container_name" 2>/dev/null || true
    
    log_success "Docker-based installation completed" "apt-layer"
    return 0
}

# systemd-nspawn-based package installation
run_nspawn_install() {
    local base_image="$1"
    local container_name="$2"
    local temp_dir="$3"
    shift 3
    local packages=("$@")
    
    log_info "Running systemd-nspawn-based installation" "apt-layer"
    
    # Create container directory
    local container_dir="$temp_dir/container"
    mkdir -p "$container_dir"
    
    # Set up base filesystem
    if [[ -d "$WORKSPACE/images/$base_image" ]]; then
        # Use ComposeFS image as base
        log_info "Using ComposeFS image as base for nspawn" "apt-layer"
        # Mount ComposeFS image and copy contents
        local mount_point="$temp_dir/mount"
        mkdir -p "$mount_point"
        
        if ! mount_composefs_image "$base_image" "$mount_point"; then
            log_error "Failed to mount ComposeFS image for nspawn" "apt-layer"
            return 1
        fi
        
        # Copy filesystem
        if ! cp -a "$mount_point"/* "$container_dir/"; then
            log_error "Failed to copy filesystem for nspawn" "apt-layer"
            umount "$mount_point" 2>/dev/null || true
            return 1
        fi
        
        umount "$mount_point" 2>/dev/null || true
    else
        # Use host filesystem as base
        log_info "Using host filesystem as base for nspawn" "apt-layer"
        # Create minimal container structure
        mkdir -p "$container_dir"/{bin,lib,lib64,usr,etc,var}
        # Copy essential files from host
        cp -a /bin/bash "$container_dir/bin/"
        cp -a /lib/x86_64-linux-gnu "$container_dir/lib/"
        cp -a /usr/bin/apt-get "$container_dir/usr/bin/"
        # Add minimal /etc structure
        echo "deb http://archive.ubuntu.com/ubuntu/ jammy main" > "$container_dir/etc/apt/sources.list"
    fi
    
    # Run package installation in nspawn container
    local install_cmd="apt-get update && apt-get install -y ${packages[*]} && apt-get clean"
    if ! systemd-nspawn -D "$container_dir" /bin/bash -c "$install_cmd"; then
        log_error "Package installation failed in nspawn container" "apt-layer"
        return 1
    fi
    
    # Move container contents to temp_dir
    mv "$container_dir"/* "$temp_dir/" 2>/dev/null || true
    
    log_success "systemd-nspawn-based installation completed" "apt-layer"
    return 0
}

# Create ComposeFS layer from container changes
create_composefs_layer() {
    local temp_dir="$1"
    local new_image="$2"
    
    log_info "Creating ComposeFS layer from container changes" "apt-layer"
    
    # Ensure new image directory exists
    local image_dir="$WORKSPACE/images/$new_image"
    mkdir -p "$image_dir"
    
    # Use ComposeFS backend to create layer
    if ! "$COMPOSEFS_SCRIPT" create "$new_image" "$temp_dir"; then
        log_error "Failed to create ComposeFS layer" "apt-layer"
        return 1
    fi
    
    log_success "ComposeFS layer created: $new_image" "apt-layer"
    return 0
}

# Cleanup container artifacts
cleanup_container_artifacts() {
    local container_name="$1"
    local temp_dir="$2"
    
    log_info "Cleaning up container artifacts" "apt-layer"
    
    # Remove temporary directory
    if [[ -d "$temp_dir" ]]; then
        rm -rf "$temp_dir"
    fi
    
    # Cleanup any remaining containers (safety)
    case "$CONTAINER_RUNTIME" in
        podman)
            podman rm "$container_name" 2>/dev/null || true
            ;;
        docker)
            docker rm "$container_name" 2>/dev/null || true
            ;;
    esac
    
    log_success "Container artifacts cleaned up" "apt-layer"
}

# Container-based layer removal
container_remove_layer() {
    local image_name="$1"
    
    log_info "Removing container-based layer: $image_name" "apt-layer"
    
    # Use ComposeFS backend to remove layer
    if ! "$COMPOSEFS_SCRIPT" remove "$image_name"; then
        log_error "Failed to remove ComposeFS layer" "apt-layer"
        return 1
    fi
    
    log_success "Container-based layer removed: $image_name" "apt-layer"
    return 0
}

# Container-based layer listing
container_list_layers() {
    log_info "Listing container-based layers" "apt-layer"
    
    # Use ComposeFS backend to list layers
    if ! "$COMPOSEFS_SCRIPT" list-images; then
        log_error "Failed to list ComposeFS layers" "apt-layer"
        return 1
    fi
    
    return 0
}

# Container-based layer information
container_layer_info() {
    local image_name="$1"
    
    log_info "Getting container-based layer info: $image_name" "apt-layer"
    
    # Use ComposeFS backend to get layer info
    if ! "$COMPOSEFS_SCRIPT" info "$image_name"; then
        log_error "Failed to get ComposeFS layer info" "apt-layer"
        return 1
    fi
    
    return 0
}

# Container-based layer mounting
container_mount_layer() {
    local image_name="$1"
    local mount_point="$2"
    
    log_info "Mounting container-based layer: $image_name at $mount_point" "apt-layer"
    
    # Use ComposeFS backend to mount layer
    if ! "$COMPOSEFS_SCRIPT" mount "$image_name" "$mount_point"; then
        log_error "Failed to mount ComposeFS layer" "apt-layer"
        return 1
    fi
    
    log_success "Container-based layer mounted: $image_name at $mount_point" "apt-layer"
    return 0
}

# Container-based layer unmounting
container_unmount_layer() {
    local mount_point="$1"
    
    log_info "Unmounting container-based layer at: $mount_point" "apt-layer"
    
    # Use ComposeFS backend to unmount layer
    if ! "$COMPOSEFS_SCRIPT" unmount "$mount_point"; then
        log_error "Failed to unmount ComposeFS layer" "apt-layer"
        return 1
    fi
    
    log_success "Container-based layer unmounted: $mount_point" "apt-layer"
    return 0
}

# Container runtime status check
container_status() {
    log_info "Checking container runtime status" "apt-layer"
    
    echo "=== Container Runtime Status ==="
    echo "Runtime: $CONTAINER_RUNTIME"
    
    case "$CONTAINER_RUNTIME" in
        podman)
            echo "Podman version: $(podman --version 2>/dev/null || echo 'Not available')"
            echo "Podman info: $(podman info --format json 2>/dev/null | jq -r '.host.arch // "Unknown"' 2>/dev/null || echo 'Unknown')"
            ;;
        docker)
            echo "Docker version: $(docker --version 2>/dev/null || echo 'Not available')"
            echo "Docker info: $(docker info --format '{{.Architecture}}' 2>/dev/null || echo 'Unknown')"
            ;;
        systemd-nspawn)
            echo "systemd-nspawn version: $(systemd-nspawn --version 2>/dev/null || echo 'Not available')"
            ;;
    esac
    
    echo ""
    echo "=== ComposeFS Backend Status ==="
    if [[ -f "$COMPOSEFS_SCRIPT" ]]; then
        echo "ComposeFS script: $COMPOSEFS_SCRIPT"
        echo "ComposeFS version: $("$COMPOSEFS_SCRIPT" --version 2>/dev/null || echo 'Version info not available')"
    else
        echo "ComposeFS script: Not found at $COMPOSEFS_SCRIPT"
    fi
    
    echo ""
    echo "=== Available Container Images ==="
    container_list_layers
}

 

# --- END OF SCRIPTLET: 04-container.sh ---

# ============================================================================
# OCI Export/Import Integration
# ============================================================================
# OCI Integration for Ubuntu uBlue apt-layer Tool
# Provides ComposeFS â OCI export/import functionality for container-based layer creation

# OCI registry configuration
declare -A OCI_REGISTRY_CONFIG
OCI_REGISTRY_CONFIG["default_registry"]="docker.io"
OCI_REGISTRY_CONFIG["auth_file"]="$HOME/.docker/config.json"
OCI_REGISTRY_CONFIG["insecure_registries"]=""
OCI_REGISTRY_CONFIG["registry_mirrors"]=""

# OCI image format validation
validate_oci_image_name() {
    local image_name="$1"
    
    log_debug "Validating OCI image name: $image_name" "apt-layer"
    
    # Check for empty name
    if [[ -z "$image_name" ]]; then
        log_error "Empty OCI image name provided" "apt-layer"
        return 1
    fi
    
    # Validate OCI image name format (registry/repository:tag)
    if [[ ! "$image_name" =~ ^[a-zA-Z0-9][a-zA-Z0-9._-]*/[a-zA-Z0-9][a-zA-Z0-9._-]*(:[a-zA-Z0-9._-]*)?$ ]] && \
       [[ ! "$image_name" =~ ^[a-zA-Z0-9][a-zA-Z0-9._-]*(:[a-zA-Z0-9._-]*)?$ ]]; then
        log_error "Invalid OCI image name format: $image_name" "apt-layer"
        log_error "Expected format: [registry/]repository[:tag]" "apt-layer"
        return 1
    fi
    
    log_success "OCI image name validated: $image_name" "apt-layer"
    return 0
}

# Initialize OCI integration system
init_oci_system() {
    log_info "Initializing OCI integration system" "apt-layer"
    
    # Ensure OCI workspace directories exist
    local oci_workspace="${OCI_WORKSPACE_DIR:-$WORKSPACE/oci}"
    local oci_temp="${OCI_TEMP_DIR:-$oci_workspace/temp}"
    local oci_cache="${OCI_CACHE_DIR:-$oci_workspace/cache}"
    local oci_export="${OCI_EXPORT_DIR:-$oci_workspace/export}"
    local oci_import="${OCI_IMPORT_DIR:-$oci_workspace/import}"
    
    mkdir -p "$oci_workspace"
    mkdir -p "$oci_temp"
    mkdir -p "$oci_cache"
    mkdir -p "$oci_export"
    mkdir -p "$oci_import"
    
    # Check for OCI tools
    local missing_tools=()
    
    # Check for skopeo (preferred for OCI operations)
    if ! command -v skopeo &> /dev/null; then
        missing_tools+=("skopeo")
    fi
    
    # Check for podman (fallback for OCI operations)
    if ! command -v podman &> /dev/null; then
        missing_tools+=("podman")
    fi
    
    # Check for docker (alternative fallback)
    if ! command -v docker &> /dev/null; then
        missing_tools+=("docker")
    fi
    
    if [[ ${#missing_tools[@]} -eq 3 ]]; then
        log_error "No OCI tools found (skopeo, podman, or docker required)" "apt-layer"
        return 1
    fi
    
    # Set preferred OCI tool
    if command -v skopeo &> /dev/null; then
        OCI_TOOL="skopeo"
        log_info "Using skopeo for OCI operations" "apt-layer"
    elif command -v podman &> /dev/null; then
        OCI_TOOL="podman"
        log_info "Using podman for OCI operations" "apt-layer"
    else
        OCI_TOOL="docker"
        log_info "Using docker for OCI operations" "apt-layer"
    fi
    
    log_success "OCI integration system initialized with $OCI_TOOL" "apt-layer"
    return 0
}

# Export ComposeFS image to OCI format
export_oci_image() {
    local composefs_image="$1"
    local oci_image_name="$2"
    local temp_dir="${3:-$WORKSPACE/oci/export/$(date +%s)-$$}"
    
    log_info "Exporting ComposeFS image to OCI: $composefs_image -> $oci_image_name" "apt-layer"
    
    # Validate inputs
    if [[ -z "$composefs_image" ]] || [[ -z "$oci_image_name" ]]; then
        log_error "Missing required arguments for export_oci_image" "apt-layer"
        return 1
    fi
    
    if ! validate_oci_image_name "$oci_image_name"; then
        return 1
    fi
    
    # Check if ComposeFS image exists
    if ! "$COMPOSEFS_SCRIPT" info "$composefs_image" >/dev/null 2>&1; then
        log_error "ComposeFS image not found: $composefs_image" "apt-layer"
        return 1
    fi
    
    # Create temporary directory
    mkdir -p "$temp_dir"
    local cleanup_temp=1
    
    # Start transaction
    start_transaction "export-oci-$composefs_image"
    
    # Mount ComposeFS image
    local mount_point="$temp_dir/mount"
    mkdir -p "$mount_point"
    
    update_transaction_phase "mounting_composefs_image"
    if ! "$COMPOSEFS_SCRIPT" mount "$composefs_image" "$mount_point"; then
        log_error "Failed to mount ComposeFS image: $composefs_image" "apt-layer"
        rollback_transaction
        return 1
    fi
    
    # Create OCI image structure
    local oci_dir="$temp_dir/oci"
    mkdir -p "$oci_dir"
    
    update_transaction_phase "creating_oci_structure"
    if ! create_oci_image_structure "$mount_point" "$oci_dir" "$oci_image_name"; then
        log_error "Failed to create OCI image structure" "apt-layer"
        rollback_transaction
        return 1
    fi
    
    # Push OCI image to registry
    update_transaction_phase "pushing_oci_image"
    if ! push_oci_image "$oci_dir" "$oci_image_name"; then
        log_error "Failed to push OCI image: $oci_image_name" "apt-layer"
        rollback_transaction
        return 1
    fi
    
    # Unmount ComposeFS image
    "$COMPOSEFS_SCRIPT" unmount "$mount_point" 2>/dev/null || true
    
    commit_transaction
    log_success "ComposeFS image exported to OCI: $oci_image_name" "apt-layer"
    
    # Cleanup
    if [[ $cleanup_temp -eq 1 ]]; then
        rm -rf "$temp_dir"
    fi
    
    return 0
}

# Create OCI image structure from filesystem
create_oci_image_structure() {
    local source_dir="$1"
    local oci_dir="$2"
    local image_name="$3"
    
    log_debug "Creating OCI image structure from: $source_dir" "apt-layer"
    
    # Create OCI directory structure
    mkdir -p "$oci_dir"/{blobs,refs}
    
    # Create manifest
    local manifest_file="$oci_dir/manifest.json"
    local config_file="$oci_dir/config.json"
    
    # Generate image configuration
    cat > "$config_file" << EOF
{
    "architecture": "amd64",
    "config": {
        "Hostname": "",
        "Domainname": "",
        "User": "",
        "AttachStdin": false,
        "AttachStdout": false,
        "AttachStderr": false,
        "Tty": false,
        "OpenStdin": false,
        "StdinOnce": false,
        "Env": null,
        "Cmd": null,
        "Image": "",
        "Volumes": null,
        "WorkingDir": "",
        "Entrypoint": null,
        "OnBuild": null,
        "Labels": {
            "org.opencontainers.image.title": "$image_name",
            "org.opencontainers.image.description": "Exported from ComposeFS image",
            "org.opencontainers.image.created": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
        }
    },
    "container": "",
    "container_config": {
        "Hostname": "",
        "Domainname": "",
        "User": "",
        "AttachStdin": false,
        "AttachStdout": false,
        "AttachStderr": false,
        "Tty": false,
        "OpenStdin": false,
        "StdinOnce": false,
        "Env": null,
        "Cmd": null,
        "Image": "",
        "Volumes": null,
        "WorkingDir": "",
        "Entrypoint": null,
        "OnBuild": null,
        "Labels": null
    },
    "created": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "docker_version": "20.10.0",
    "history": [
        {
            "created": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
            "created_by": "apt-layer export_oci_image",
            "comment": "Exported from ComposeFS image"
        }
    ],
    "os": "linux",
    "rootfs": {
        "type": "layers",
        "diff_ids": []
    }
}
EOF
    
    # Create layer from source directory
    local layer_file="$oci_dir/layer.tar"
    if ! tar -cf "$layer_file" -C "$source_dir" .; then
        log_error "Failed to create layer tarball" "apt-layer"
        return 1
    fi
    
    # Calculate layer digest
    local layer_digest
    layer_digest=$(sha256sum "$layer_file" | cut -d' ' -f1)
    local layer_blob="$oci_dir/blobs/sha256/$layer_digest"
    
    # Move layer to blobs directory
    mkdir -p "$(dirname "$layer_blob")"
    mv "$layer_file" "$layer_blob"
    
    # Update config with layer diff_id
    local diff_id="sha256:$layer_digest"
    jq ".rootfs.diff_ids = [\"$diff_id\"]" "$config_file" > "$config_file.tmp" && mv "$config_file.tmp" "$config_file"
    
    # Calculate config digest
    local config_digest
    config_digest=$(sha256sum "$config_file" | cut -d' ' -f1)
    local config_blob="$oci_dir/blobs/sha256/$config_digest"
    
    # Move config to blobs directory
    mkdir -p "$(dirname "$config_blob")"
    mv "$config_file" "$config_blob"
    
    # Create manifest
    cat > "$manifest_file" << EOF
[
    {
        "Config": "blobs/sha256/$config_digest",
        "RepoTags": ["$image_name"],
        "Layers": ["blobs/sha256/$layer_digest"]
    }
]
EOF
    
    log_success "OCI image structure created" "apt-layer"
    return 0
}

# Push OCI image to registry
push_oci_image() {
    local oci_dir="$1"
    local image_name="$2"
    
    log_debug "Pushing OCI image: $image_name" "apt-layer"
    
    case "$OCI_TOOL" in
        skopeo)
            if ! skopeo copy "dir:$oci_dir" "docker://$image_name"; then
                log_error "Failed to push image with skopeo" "apt-layer"
                return 1
            fi
            ;;
        podman)
            if ! podman load -i "$oci_dir/manifest.json" && \
               ! podman tag "$(podman images --format '{{.ID}}' | head -1)" "$image_name" && \
               ! podman push "$image_name"; then
                log_error "Failed to push image with podman" "apt-layer"
                return 1
            fi
            ;;
        docker)
            if ! docker load -i "$oci_dir/manifest.json" && \
               ! docker tag "$(docker images --format '{{.ID}}' | head -1)" "$image_name" && \
               ! docker push "$image_name"; then
                log_error "Failed to push image with docker" "apt-layer"
                return 1
            fi
            ;;
    esac
    
    log_success "OCI image pushed: $image_name" "apt-layer"
    return 0
}

# Import OCI image as ComposeFS image
import_oci_image() {
    local oci_image_name="$1"
    local composefs_image="$2"
    local temp_dir="${3:-$WORKSPACE/oci/import/$(date +%s)-$$}"
    
    log_info "Importing OCI image as ComposeFS: $oci_image_name -> $composefs_image" "apt-layer"
    
    # Validate inputs
    if [[ -z "$oci_image_name" ]] || [[ -z "$composefs_image" ]]; then
        log_error "Missing required arguments for import_oci_image" "apt-layer"
        return 1
    fi
    
    if ! validate_oci_image_name "$oci_image_name"; then
        return 1
    fi
    
    # Create temporary directory
    mkdir -p "$temp_dir"
    local cleanup_temp=1
    
    # Start transaction
    start_transaction "import-oci-$oci_image_name"
    
    # Pull OCI image
    update_transaction_phase "pulling_oci_image"
    if ! pull_oci_image "$oci_image_name" "$temp_dir"; then
        log_error "Failed to pull OCI image: $oci_image_name" "apt-layer"
        rollback_transaction
        return 1
    fi
    
    # Extract image filesystem
    update_transaction_phase "extracting_image_filesystem"
    local rootfs_dir="$temp_dir/rootfs"
    if ! extract_oci_filesystem "$temp_dir" "$rootfs_dir"; then
        log_error "Failed to extract OCI filesystem" "apt-layer"
        rollback_transaction
        return 1
    fi
    
    # Create ComposeFS image from extracted filesystem
    update_transaction_phase "creating_composefs_image"
    if ! "$COMPOSEFS_SCRIPT" create "$composefs_image" "$rootfs_dir"; then
        log_error "Failed to create ComposeFS image: $composefs_image" "apt-layer"
        rollback_transaction
        return 1
    fi
    
    commit_transaction
    log_success "OCI image imported as ComposeFS: $composefs_image" "apt-layer"
    
    # Cleanup
    if [[ $cleanup_temp -eq 1 ]]; then
        rm -rf "$temp_dir"
    fi
    
    return 0
}

# Pull OCI image from registry
pull_oci_image() {
    local image_name="$1"
    local temp_dir="$2"
    
    log_debug "Pulling OCI image: $image_name" "apt-layer"
    
    case "$OCI_TOOL" in
        skopeo)
            if ! skopeo copy "docker://$image_name" "dir:$temp_dir"; then
                log_error "Failed to pull image with skopeo" "apt-layer"
                return 1
            fi
            ;;
        podman)
            if ! podman pull "$image_name" && \
               ! podman save "$image_name" -o "$temp_dir/image.tar"; then
                log_error "Failed to pull image with podman" "apt-layer"
                return 1
            fi
            ;;
        docker)
            if ! docker pull "$image_name" && \
               ! docker save "$image_name" -o "$temp_dir/image.tar"; then
                log_error "Failed to pull image with docker" "apt-layer"
                return 1
            fi
            ;;
    esac
    
    log_success "OCI image pulled: $image_name" "apt-layer"
    return 0
}

# Extract filesystem from OCI image
extract_oci_filesystem() {
    local oci_dir="$1"
    local rootfs_dir="$2"
    
    log_debug "Extracting OCI filesystem to: $rootfs_dir" "apt-layer"
    
    mkdir -p "$rootfs_dir"
    
    # Handle different OCI tool outputs
    if [[ -f "$oci_dir/manifest.json" ]]; then
        # skopeo output
        local layer_file
        layer_file=$(jq -r '.[0].Layers[0]' "$oci_dir/manifest.json")
        if [[ -f "$oci_dir/$layer_file" ]]; then
            tar -xf "$oci_dir/$layer_file" -C "$rootfs_dir"
        else
            log_error "Layer file not found: $oci_dir/$layer_file" "apt-layer"
            return 1
        fi
    elif [[ -f "$oci_dir/image.tar" ]]; then
        # podman/docker output
        tar -xf "$oci_dir/image.tar" -C "$rootfs_dir"
        # Find and extract the layer
        local layer_file
        layer_file=$(find "$rootfs_dir" -name "*.tar" | head -1)
        if [[ -n "$layer_file" ]]; then
            mkdir -p "$rootfs_dir.tmp"
            tar -xf "$layer_file" -C "$rootfs_dir.tmp"
            mv "$rootfs_dir.tmp"/* "$rootfs_dir/"
            rmdir "$rootfs_dir.tmp"
        fi
    else
        log_error "No valid OCI image structure found" "apt-layer"
        return 1
    fi
    
    log_success "OCI filesystem extracted" "apt-layer"
    return 0
}

# List available OCI images
list_oci_images() {
    log_info "Listing available OCI images" "apt-layer"
    
    case "$OCI_TOOL" in
        skopeo)
            # skopeo doesn't have a direct list command, use registry API
            log_warning "OCI image listing not fully supported with skopeo" "apt-layer"
            ;;
        podman)
            podman images --format "table {{.Repository}}:{{.Tag}}\t{{.ID}}\t{{.CreatedAt}}\t{{.Size}}"
            ;;
        docker)
            docker images --format "table {{.Repository}}:{{.Tag}}\t{{.ID}}\t{{.CreatedAt}}\t{{.Size}}"
            ;;
    esac
}

# Get OCI image information
get_oci_image_info() {
    local image_name="$1"
    
    log_info "Getting OCI image info: $image_name" "apt-layer"
    
    if ! validate_oci_image_name "$image_name"; then
        return 1
    fi
    
    case "$OCI_TOOL" in
        skopeo)
            skopeo inspect "docker://$image_name"
            ;;
        podman)
            podman inspect "$image_name"
            ;;
        docker)
            docker inspect "$image_name"
            ;;
    esac
}

# Remove OCI image
remove_oci_image() {
    local image_name="$1"
    
    log_info "Removing OCI image: $image_name" "apt-layer"
    
    if ! validate_oci_image_name "$image_name"; then
        return 1
    fi
    
    case "$OCI_TOOL" in
        skopeo)
            log_warning "Image removal not supported with skopeo" "apt-layer"
            return 1
            ;;
        podman)
            if ! podman rmi "$image_name"; then
                log_error "Failed to remove image with podman" "apt-layer"
                return 1
            fi
            ;;
        docker)
            if ! docker rmi "$image_name"; then
                log_error "Failed to remove image with docker" "apt-layer"
                return 1
            fi
            ;;
    esac
    
    log_success "OCI image removed: $image_name" "apt-layer"
    return 0
}

# OCI system status
oci_status() {
    log_info "OCI Integration System Status" "apt-layer"
    
    echo "=== OCI Tool Configuration ==="
    echo "Preferred tool: $OCI_TOOL"
    echo "Available tools:"
    command -v skopeo &> /dev/null && echo "  â skopeo"
    command -v podman &> /dev/null && echo "  â podman"
    command -v docker &> /dev/null && echo "  â docker"
    
    echo ""
    echo "=== OCI Workspace ==="
    echo "OCI directory: ${OCI_WORKSPACE_DIR:-$WORKSPACE/oci}"
    echo "Export directory: ${OCI_EXPORT_DIR:-$WORKSPACE/oci/export}"
    echo "Import directory: ${OCI_IMPORT_DIR:-$WORKSPACE/oci/import}"
    echo "Cache directory: ${OCI_CACHE_DIR:-$WORKSPACE/oci/cache}"
    
    echo ""
    echo "=== ComposeFS Backend ==="
    if [[ -f "$COMPOSEFS_SCRIPT" ]]; then
        echo "ComposeFS script: $COMPOSEFS_SCRIPT"
        echo "ComposeFS version: $("$COMPOSEFS_SCRIPT" --version 2>/dev/null || echo 'Version info not available')"
    else
        echo "ComposeFS script: Not found at $COMPOSEFS_SCRIPT"
    fi
    
    echo ""
    echo "=== Available OCI Images ==="
    list_oci_images
} 

# --- END OF SCRIPTLET: 06-oci-integration.sh ---

# ============================================================================
# Atomic Deployment System
# ============================================================================
# Atomic deployment system for Ubuntu uBlue apt-layer Tool
# Implements commit-based state management and true system upgrades (not package upgrades)

# Atomic deployment state management
DEPLOYMENT_DB="/var/lib/particle-os/deployments.json"
CURRENT_DEPLOYMENT_FILE="/var/lib/particle-os/current-deployment"
PENDING_DEPLOYMENT_FILE="/var/lib/particle-os/pending-deployment"
DEPLOYMENT_HISTORY_DIR="/var/lib/particle-os/history"

# Initialize deployment database
init_deployment_db() {
    log_info "Initializing atomic deployment database..." "apt-layer"
    
    mkdir -p "$DEPLOYMENT_HISTORY_DIR"
    
    # Create deployment database if it doesn't exist
    if [[ ! -f "$DEPLOYMENT_DB" ]]; then
        cat > "$DEPLOYMENT_DB" << 'EOF'
{
  "deployments": {},
  "current_deployment": null,
  "pending_deployment": null,
  "deployment_counter": 0,
  "created": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
}
EOF
        log_success "Deployment database initialized" "apt-layer"
    fi
    
    # Ensure deployment files exist
    touch "$CURRENT_DEPLOYMENT_FILE"
    touch "$PENDING_DEPLOYMENT_FILE"
}

# Create a new deployment commit
create_deployment_commit() {
    local base_image="$1"
    local layers=("${@:2}")
    local commit_message="${COMMIT_MESSAGE:-System update}"
    
    local commit_id="commit-$(date +%Y%m%d-%H%M%S)-$$"
    local commit_data
    
    log_info "Creating deployment commit: $commit_id" "apt-layer"
    
    # Create commit metadata
    commit_data=$(cat << 'EOF'
{
  "commit_id": "$commit_id",
  "base_image": "$base_image",
  "layers": [$(printf '"%s"' "${layers[@]}" | tr '\n' ',' | sed 's/,$//')],
  "commit_message": "$commit_message",
  "created": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "parent_commit": "$(get_current_deployment)",
  "composefs_image": "${commit_id}.composefs"
}
EOF
)
    
    # Add to deployment database
    jq --arg commit_id "$commit_id" \
       --argjson commit_data "$commit_data" \
       '.deployments[$commit_id] = $commit_data | .deployment_counter += 1' \
       "$DEPLOYMENT_DB" > "${DEPLOYMENT_DB}.tmp" && mv "${DEPLOYMENT_DB}.tmp" "$DEPLOYMENT_DB"
    
    # Create deployment history file
    echo "$commit_data" > "$DEPLOYMENT_HISTORY_DIR/$commit_id.json"
    
    log_success "Deployment commit created: $commit_id" "apt-layer"
    echo "$commit_id"
}

# Get current deployment
get_current_deployment() {
    if [[ -f "$CURRENT_DEPLOYMENT_FILE" ]]; then
        cat "$CURRENT_DEPLOYMENT_FILE" 2>/dev/null || echo ""
    else
        echo ""
    fi
}

# Get pending deployment
get_pending_deployment() {
    if [[ -f "$PENDING_DEPLOYMENT_FILE" ]]; then
        cat "$PENDING_DEPLOYMENT_FILE" 2>/dev/null || echo ""
    else
        echo ""
    fi
}

# Set current deployment
set_current_deployment() {
    local commit_id="$1"
    echo "$commit_id" > "$CURRENT_DEPLOYMENT_FILE"
    
    # Update deployment database
    jq --arg commit_id "$commit_id" '.current_deployment = $commit_id' \
       "$DEPLOYMENT_DB" > "${DEPLOYMENT_DB}.tmp" && mv "${DEPLOYMENT_DB}.tmp" "$DEPLOYMENT_DB"
    
    log_info "Current deployment set to: $commit_id" "apt-layer"
}

# Set pending deployment
set_pending_deployment() {
    local commit_id="$1"
    echo "$commit_id" > "$PENDING_DEPLOYMENT_FILE"
    
    # Update deployment database
    jq --arg commit_id "$commit_id" '.pending_deployment = $commit_id' \
       "$DEPLOYMENT_DB" > "${DEPLOYMENT_DB}.tmp" && mv "${DEPLOYMENT_DB}.tmp" "$DEPLOYMENT_DB"
    
    log_info "Pending deployment set to: $commit_id" "apt-layer"
}

# Clear pending deployment
clear_pending_deployment() {
    echo "" > "$PENDING_DEPLOYMENT_FILE"
    
    # Update deployment database
    jq '.pending_deployment = null' \
       "$DEPLOYMENT_DB" > "${DEPLOYMENT_DB}.tmp" && mv "${DEPLOYMENT_DB}.tmp" "$DEPLOYMENT_DB"
    
    log_info "Pending deployment cleared" "apt-layer"
}

# Atomic deployment function
atomic_deploy() {
    local commit_id="$1"
    local deployment_dir="/var/lib/particle-os/deployments/${commit_id}"
    local boot_dir="/boot/loader/entries"
    
    log_info "Performing atomic deployment: $commit_id" "apt-layer"
    
    # Validate commit exists
    if ! jq -e ".deployments[\"$commit_id\"]" "$DEPLOYMENT_DB" >/dev/null 2>&1; then
        log_error "Commit not found: $commit_id" "apt-layer"
        return 1
    fi
    
    # Get commit data
    local commit_data
    commit_data=$(jq -r ".deployments[\"$commit_id\"]" "$DEPLOYMENT_DB")
    local composefs_image
    composefs_image=$(echo "$commit_data" | jq -r '.composefs_image')
    
    # Create deployment directory
    mkdir -p "$deployment_dir"
    
    # Mount the ComposeFS image
    if ! composefs_mount "$composefs_image" "$deployment_dir"; then
        log_error "Failed to mount ComposeFS image for deployment" "apt-layer"
        return 1
    fi
    
    # Apply kernel arguments to deployment
    apply_kernel_args_to_deployment "$commit_id"
    
    # Create bootloader entry
    create_bootloader_entry "$commit_id" "$deployment_dir"
    
    # Set as pending deployment (will activate on next boot)
    set_pending_deployment "$commit_id"
    
    log_success "Atomic deployment prepared: $commit_id" "apt-layer"
    log_info "Reboot to activate deployment" "apt-layer"
    return 0
}

# True system upgrade (not package upgrade)
system_upgrade() {
    local new_base_image="${1:-}"
    local current_layers=()
    
    log_info "Performing true system upgrade..." "apt-layer"
    
    # Get current deployment
    local current_commit
    current_commit=$(get_current_deployment)
    
    if [[ -n "$current_commit" ]]; then
        # Get current layers from deployment
        current_layers=($(jq -r ".deployments[\"$current_commit\"].layers[]" "$DEPLOYMENT_DB" 2>/dev/null || true))
        log_info "Current layers: ${current_layers[*]}" "apt-layer"
    fi
    
    # If no new base specified, try to find one
    if [[ -z "$new_base_image" ]]; then
        new_base_image=$(find_newer_base_image)
        if [[ -z "$new_base_image" ]]; then
            log_info "No newer base image found" "apt-layer"
            return 0
        fi
    fi
    
    log_info "Upgrading to base image: $new_base_image" "apt-layer"
    
    # Rebase existing layers on new base
    local rebased_layers=()
    for layer in "${current_layers[@]}"; do
        local new_layer="${layer}-rebased-$(date +%Y%m%d)"
        log_info "Rebasing layer: $layer -> $new_layer" "apt-layer"
        
        if "$0" --rebase "$layer" "$new_base_image" "$new_layer"; then
            rebased_layers+=("$new_layer")
        else
            log_error "Failed to rebase layer: $layer" "apt-layer"
            return 1
        fi
    done
    
    # Create new deployment commit
    local commit_id
    commit_id=$(create_deployment_commit "$new_base_image" "${rebased_layers[@]}")
    
    # Perform atomic deployment
    if atomic_deploy "$commit_id"; then
        log_success "System upgrade completed successfully" "apt-layer"
        return 0
    else
        log_error "System upgrade failed" "apt-layer"
        return 1
    fi
}

# Find newer base image
find_newer_base_image() {
    local current_base
    current_base=$(jq -r ".deployments[\"$(get_current_deployment)\"].base_image" "$DEPLOYMENT_DB" 2>/dev/null || echo "")
    
    if [[ -z "$current_base" ]]; then
        log_warning "No current base image found" "apt-layer"
        return 1
    fi
    
    # List available base images and find newer ones
    local available_bases
    available_bases=($(composefs_list_images | grep "^ubuntu-ublue/base/" | sort -V))
    
    for base in "${available_bases[@]}"; do
        if [[ "$base" > "$current_base" ]]; then
            echo "$base"
            return 0
        fi
    done
    
    return 1
}

# Create bootloader entry
create_bootloader_entry() {
    local commit_id="$1"
    local deployment_dir="$2"
    
    log_info "Creating bootloader entry for: $commit_id" "apt-layer"
    
    # Initialize bootloader system
    init_bootloader_on_startup
    
    # Create bootloader entry using the comprehensive bootloader system
    if create_bootloader_entry "$commit_id" "$deployment_dir" "Ubuntu uBlue ($commit_id)"; then
        log_success "Bootloader entry created for: $commit_id" "apt-layer"
        return 0
    else
        log_error "Failed to create bootloader entry for: $commit_id" "apt-layer"
        return 1
    fi
}

# Show atomic deployment status
atomic_status() {
    local current_deployment
    current_deployment=$(get_current_deployment)
    local pending_deployment
    pending_deployment=$(get_pending_deployment)
    
    echo "=== Atomic Deployment Status ==="
    echo "Current Deployment: ${current_deployment:-none}"
    echo "Pending Deployment: ${pending_deployment:-none}"
    
    if [[ -n "$current_deployment" ]]; then
        local commit_data
        commit_data=$(jq -r ".deployments[\"$current_deployment\"]" "$DEPLOYMENT_DB" 2>/dev/null || echo "{}")
        
        if [[ "$commit_data" != "{}" ]]; then
            echo "Deployment Type: $(echo "$commit_data" | jq -r '.commit_message')"
            echo "Base Image: $(echo "$commit_data" | jq -r '.base_image')"
            echo "Created: $(echo "$commit_data" | jq -r '.created')"
            echo "Layers: $(echo "$commit_data" | jq -r '.layers | join(", ")')"
        fi
    fi
    
    if [[ -n "$pending_deployment" ]]; then
        echo "â ï¸  Pending deployment will activate on next boot"
    fi
}

# List all deployments
list_deployments() {
    echo "=== Deployment History ==="
    
    local deployments
    deployments=($(jq -r '.deployments | keys[]' "$DEPLOYMENT_DB" 2>/dev/null | sort -r))
    
    for commit_id in "${deployments[@]}"; do
        local commit_data
        commit_data=$(jq -r ".deployments[\"$commit_id\"]" "$DEPLOYMENT_DB")
        
        local status=""
        if [[ "$commit_id" == "$(get_current_deployment)" ]]; then
            status=" [CURRENT]"
        elif [[ "$commit_id" == "$(get_pending_deployment)" ]]; then
            status=" [PENDING]"
        fi
        
        echo "$commit_id$status"
        echo "  Message: $(echo "$commit_data" | jq -r '.commit_message')"
        echo "  Created: $(echo "$commit_data" | jq -r '.created')"
        echo "  Base: $(echo "$commit_data" | jq -r '.base_image')"
        echo ""
    done
}

# Rollback to specific commit
commit_rollback() {
    local target_commit="$1"
    
    log_info "Rolling back to commit: $target_commit" "apt-layer"
    
    # Validate target commit exists
    if ! jq -e ".deployments[\"$target_commit\"]" "$DEPLOYMENT_DB" >/dev/null 2>&1; then
        log_error "Target commit not found: $target_commit" "apt-layer"
        return 1
    fi
    
    # Perform atomic deployment to target commit
    if atomic_deploy "$target_commit"; then
        log_success "Rollback prepared to: $target_commit" "apt-layer"
        log_info "Reboot to activate rollback" "apt-layer"
        return 0
    else
        log_error "Rollback failed" "apt-layer"
        return 1
    fi
} 

# --- END OF SCRIPTLET: 09-atomic-deployment.sh ---

# ============================================================================
# rpm-ostree Compatibility Layer
# ============================================================================
# rpm-ostree compatibility layer for Ubuntu uBlue apt-layer Tool
# Provides 1:1 command compatibility with rpm-ostree

# rpm-ostree install compatibility
rpm_ostree_install() {
    local packages=("$@")
    
    log_info "rpm-ostree install compatibility: ${packages[*]}" "apt-layer"
    
    # Use live overlay for package installation
    if ! apt-layer --live-install "${packages[@]}"; then
        log_error "rpm-ostree install failed" "apt-layer"
        return 1
    fi
    
    log_success "rpm-ostree install completed successfully" "apt-layer"
    return 0
}

# rpm-ostree upgrade compatibility
rpm_ostree_upgrade() {
    log_info "rpm-ostree upgrade compatibility" "apt-layer"
    
    # Use true system upgrade (not package upgrade)
    if ! system_upgrade; then
        log_error "rpm-ostree upgrade failed" "apt-layer"
        return 1
    fi
    
    log_success "rpm-ostree upgrade completed successfully" "apt-layer"
    return 0
}

# rpm-ostree rebase compatibility
rpm_ostree_rebase() {
    local new_base="$1"
    
    log_info "rpm-ostree rebase compatibility: $new_base" "apt-layer"
    
    # Use intelligent rebase with conflict resolution
    if ! intelligent_rebase "$new_base"; then
        log_error "rpm-ostree rebase failed" "apt-layer"
        return 1
    fi
    
    log_success "rpm-ostree rebase completed successfully" "apt-layer"
    return 0
}

# rpm-ostree rollback compatibility
rpm_ostree_rollback() {
    local target_commit="${1:-}"
    
    log_info "rpm-ostree rollback compatibility: ${target_commit:-latest}" "apt-layer"
    
    if [[ -z "$target_commit" ]]; then
        # Rollback to previous deployment
        target_commit=$(get_previous_deployment)
        if [[ -z "$target_commit" ]]; then
            log_error "No previous deployment found for rollback" "apt-layer"
            return 1
        fi
    fi
    
    # Use commit-based rollback
    if ! commit_rollback "$target_commit"; then
        log_error "rpm-ostree rollback failed" "apt-layer"
        return 1
    fi
    
    log_success "rpm-ostree rollback completed successfully" "apt-layer"
    return 0
}

# rpm-ostree status compatibility
rpm_ostree_status() {
    log_info "rpm-ostree status compatibility" "apt-layer"
    
    # Show atomic deployment status
    atomic_status
    
    # Show live overlay status
    echo ""
    echo "=== Live Overlay Status ==="
    apt-layer --live-overlay status
    
    # Show package diff if pending deployment
    local pending_deployment
    pending_deployment=$(get_pending_deployment)
    if [[ -n "$pending_deployment" ]]; then
        echo ""
        echo "=== Pending Changes ==="
        show_package_diff "$(get_current_deployment)" "$pending_deployment"
    fi
}

# rpm-ostree diff compatibility
rpm_ostree_diff() {
    local from_commit="${1:-}"
    local to_commit="${2:-}"
    
    log_info "rpm-ostree diff compatibility: $from_commit -> $to_commit" "apt-layer"
    
    # If no commits specified, compare current to pending
    if [[ -z "$from_commit" ]]; then
        from_commit=$(get_current_deployment)
    fi
    if [[ -z "$to_commit" ]]; then
        to_commit=$(get_pending_deployment)
        if [[ -z "$to_commit" ]]; then
            log_error "No target commit specified and no pending deployment" "apt-layer"
            return 1
        fi
    fi
    
    # Show package-level diff
    show_package_diff "$from_commit" "$to_commit"
}

# rpm-ostree db list compatibility
rpm_ostree_db_list() {
    log_info "rpm-ostree db list compatibility" "apt-layer"
    
    # List all deployments
    list_deployments
}

# rpm-ostree db diff compatibility
rpm_ostree_db_diff() {
    local from_commit="${1:-}"
    local to_commit="${2:-}"
    
    log_info "rpm-ostree db diff compatibility: $from_commit -> $to_commit" "apt-layer"
    
    # If no commits specified, compare current to pending
    if [[ -z "$from_commit" ]]; then
        from_commit=$(get_current_deployment)
    fi
    if [[ -z "$to_commit" ]]; then
        to_commit=$(get_pending_deployment)
        if [[ -z "$to_commit" ]]; then
            log_error "No target commit specified and no pending deployment" "apt-layer"
            return 1
        fi
    fi
    
    # Show detailed package diff
    show_detailed_package_diff "$from_commit" "$to_commit"
}

# rpm-ostree cleanup compatibility
rpm_ostree_cleanup() {
    local purge="${1:-}"
    
    log_info "rpm-ostree cleanup compatibility: purge=$purge" "apt-layer"
    
    # Clean up old deployments
    cleanup_old_deployments
    
    # Clean up old ComposeFS images
    cleanup_old_composefs_images
    
    if [[ "$purge" == "--purge" ]]; then
        # Also clean up old bootloader entries
        cleanup_old_bootloader_entries
    fi
    
    log_success "rpm-ostree cleanup completed successfully" "apt-layer"
}

# rpm-ostree cancel compatibility
rpm_ostree_cancel() {
    log_info "rpm-ostree cancel compatibility" "apt-layer"
    
    # Clear pending deployment
    clear_pending_deployment
    
    # Clean up live overlay
    apt-layer --live-overlay stop
    
    log_success "rpm-ostree cancel completed successfully" "apt-layer"
}

# rpm-ostree initramfs compatibility
rpm_ostree_initramfs() {
    local action="${1:-}"
    
    log_info "rpm-ostree initramfs compatibility: $action" "apt-layer"
    
    case "$action" in
        --enable)
            enable_initramfs_rebuild
            ;;
        --disable)
            disable_initramfs_rebuild
            ;;
        --rebuild)
            rebuild_initramfs
            ;;
        *)
            log_error "Invalid initramfs action: $action" "apt-layer"
            return 1
            ;;
    esac
}

# rpm-ostree kargs compatibility
rpm_ostree_kargs() {
    local action="${1:-}"
    shift
    
    log_info "rpm-ostree kargs compatibility: $action" "apt-layer"
    
    case "$action" in
        --get)
            get_kernel_args
            ;;
        --set)
            set_kernel_args "$@"
            ;;
        --append)
            append_kernel_args "$@"
            ;;
        --delete)
            delete_kernel_args "$@"
            ;;
        --reset)
            reset_kernel_args
            ;;
        *)
            log_error "Invalid kargs action: $action" "apt-layer"
            return 1
            ;;
    esac
}

# rpm-ostree usroverlay compatibility
rpm_ostree_usroverlay() {
    local action="${1:-}"
    
    log_info "rpm-ostree usroverlay compatibility: $action" "apt-layer"
    
    case "$action" in
        --mount)
            mount_usr_overlay
            ;;
        --unmount)
            unmount_usr_overlay
            ;;
        --status)
            usr_overlay_status
            ;;
        *)
            log_error "Invalid usroverlay action: $action" "apt-layer"
            return 1
            ;;
    esac
}

# rpm-ostree composefs compatibility
rpm_ostree_composefs() {
    local action="${1:-}"
    shift
    
    log_info "rpm-ostree composefs compatibility: $action" "apt-layer"
    
    case "$action" in
        --mount)
            composefs_mount "$@"
            ;;
        --unmount)
            composefs_unmount "$@"
            ;;
        --list)
            composefs_list_images
            ;;
        --info)
            composefs_image_info "$@"
            ;;
        *)
            log_error "Invalid composefs action: $action" "apt-layer"
            return 1
            ;;
    esac
}

# Helper functions for rpm-ostree compatibility

# Get previous deployment
get_previous_deployment() {
    local current_deployment
    current_deployment=$(get_current_deployment)
    
    if [[ -n "$current_deployment" ]]; then
        local parent_commit
        parent_commit=$(jq -r ".deployments[\"$current_deployment\"].parent_commit" "$DEPLOYMENT_DB" 2>/dev/null || echo "")
        echo "$parent_commit"
    fi
}

# Show package diff between commits
show_package_diff() {
    local from_commit="$1"
    local to_commit="$2"
    
    log_info "Showing package diff: $from_commit -> $to_commit" "apt-layer"
    
    # Get package lists from both commits
    local from_packages=()
    local to_packages=()
    
    if [[ -n "$from_commit" ]]; then
        from_packages=($(get_packages_from_commit "$from_commit"))
    fi
    
    if [[ -n "$to_commit" ]]; then
        to_packages=($(get_packages_from_commit "$to_commit"))
    fi
    
    # Calculate differences
    local added_packages=()
    local removed_packages=()
    local updated_packages=()
    
    # Find added packages
    for pkg in "${to_packages[@]}"; do
        if [[ ! " ${from_packages[*]} " =~ " ${pkg} " ]]; then
            added_packages+=("$pkg")
        fi
    done
    
    # Find removed packages
    for pkg in "${from_packages[@]}"; do
        if [[ ! " ${to_packages[*]} " =~ " ${pkg} " ]]; then
            removed_packages+=("$pkg")
        fi
    done
    
    # Show results
    if [[ ${#added_packages[@]} -gt 0 ]]; then
        echo "Added packages:"
        printf "  %s\n" "${added_packages[@]}"
    fi
    
    if [[ ${#removed_packages[@]} -gt 0 ]]; then
        echo "Removed packages:"
        printf "  %s\n" "${removed_packages[@]}"
    fi
    
    if [[ ${#added_packages[@]} -eq 0 ]] && [[ ${#removed_packages[@]} -eq 0 ]]; then
        echo "No package changes detected"
    fi
}

# Get packages from commit
get_packages_from_commit() {
    local commit_id="$1"
    local composefs_image
    
    # Get ComposeFS image name
    composefs_image=$(jq -r ".deployments[\"$commit_id\"].composefs_image" "$DEPLOYMENT_DB" 2>/dev/null || echo "")
    
    if [[ -z "$composefs_image" ]]; then
        return 1
    fi
    
    # Mount and extract package list
    local temp_mount="/tmp/apt-layer-commit-$$"
    mkdir -p "$temp_mount"
    
    if composefs_mount "$composefs_image" "$temp_mount"; then
        # Extract package list
        chroot "$temp_mount" dpkg -l | grep '^ii' | awk '{print $2}' 2>/dev/null || true
        
        # Cleanup
        composefs_unmount "$temp_mount"
        rmdir "$temp_mount"
    fi
}

# Cleanup functions
cleanup_old_deployments() {
    log_info "Cleaning up old deployments..." "apt-layer"
    
    # Keep last 5 deployments
    local deployments
    deployments=($(jq -r '.deployments | keys[]' "$DEPLOYMENT_DB" 2>/dev/null | sort -r | tail -n +6))
    
    for commit_id in "${deployments[@]}"; do
        log_info "Removing old deployment: $commit_id" "apt-layer"
        
        # Remove from database
        jq --arg commit_id "$commit_id" 'del(.deployments[$commit_id])' \
           "$DEPLOYMENT_DB" > "${DEPLOYMENT_DB}.tmp" && mv "${DEPLOYMENT_DB}.tmp" "$DEPLOYMENT_DB"
        
        # Remove history file
        rm -f "$DEPLOYMENT_HISTORY_DIR/$commit_id.json"
        
        # Remove deployment directory
        rm -rf "/var/lib/particle-os/deployments/$commit_id"
    done
}

cleanup_old_composefs_images() {
    log_info "Cleaning up old ComposeFS images..." "apt-layer"
    
    # Get list of images still referenced by deployments
    local referenced_images
    referenced_images=($(jq -r '.deployments[].composefs_image' "$DEPLOYMENT_DB" 2>/dev/null || true))
    
    # Get all ComposeFS images
    local all_images
    all_images=($(composefs_list_images))
    
    # Remove unreferenced images
    for image in "${all_images[@]}"; do
        if [[ ! " ${referenced_images[*]} " =~ " ${image} " ]]; then
            log_info "Removing unreferenced image: $image" "apt-layer"
            composefs_remove_image "$image"
        fi
    done
}

cleanup_old_bootloader_entries() {
    log_info "Cleaning up old bootloader entries..." "apt-layer"
    
    # Get current and pending deployments
    local current_deployment
    current_deployment=$(get_current_deployment)
    local pending_deployment
    pending_deployment=$(get_pending_deployment)
    
    # Remove old bootloader entries
    local boot_dir="/boot/loader/entries"
    for entry in "$boot_dir"/apt-layer-*.conf; do
        if [[ -f "$entry" ]]; then
            local commit_id
            commit_id=$(basename "$entry" .conf | sed 's/apt-layer-//')
            
            # Keep current and pending deployments
            if [[ "$commit_id" != "$current_deployment" ]] && [[ "$commit_id" != "$pending_deployment" ]]; then
                log_info "Removing old bootloader entry: $entry" "apt-layer"
                rm -f "$entry"
            fi
        fi
    done
} 

# --- END OF SCRIPTLET: 10-rpm-ostree-compat.sh ---

# ============================================================================
# Live Overlay System (rpm-ostree style)
# ============================================================================

# Ubuntu uBlue apt-layer Live Overlay System
# Implements live system layering similar to rpm-ostree
# Uses overlayfs for live package installation and management

# =============================================================================
# LIVE OVERLAY SYSTEM FUNCTIONS
# =============================================================================

# Live overlay state file (with fallbacks for when particle-config.sh is not loaded)
LIVE_OVERLAY_STATE_FILE="${UBLUE_ROOT:-/var/lib/particle-os}/live-overlay.state"
LIVE_OVERLAY_MOUNT_POINT="${UBLUE_ROOT:-/var/lib/particle-os}/live-overlay/mount"
LIVE_OVERLAY_PACKAGE_LOG="${UBLUE_LOG_DIR:-/var/log/ubuntu-ublue}/live-overlay-packages.log"

# Initialize live overlay system
init_live_overlay_system() {
    log_info "Initializing live overlay system" "apt-layer"
    
    # Create live overlay directories
    mkdir -p "${UBLUE_LIVE_OVERLAY_DIR:-/var/lib/particle-os/live-overlay}" "${UBLUE_LIVE_UPPER_DIR:-/var/lib/particle-os/live-overlay/upper}" "${UBLUE_LIVE_WORK_DIR:-/var/lib/particle-os/live-overlay/work}"
    mkdir -p "$LIVE_OVERLAY_MOUNT_POINT"
    
    # Set proper permissions
    chmod 755 "${UBLUE_LIVE_OVERLAY_DIR:-/var/lib/particle-os/live-overlay}"
    chmod 700 "${UBLUE_LIVE_UPPER_DIR:-/var/lib/particle-os/live-overlay/upper}" "${UBLUE_LIVE_WORK_DIR:-/var/lib/particle-os/live-overlay/work}"
    
    # Initialize package log if it doesn't exist
    if [[ ! -f "$LIVE_OVERLAY_PACKAGE_LOG" ]]; then
        touch "$LIVE_OVERLAY_PACKAGE_LOG"
        chmod 644 "$LIVE_OVERLAY_PACKAGE_LOG"
    fi
    
    log_success "Live overlay system initialized" "apt-layer"
}

# Check if live overlay is active
is_live_overlay_active() {
    if [[ -f "$LIVE_OVERLAY_STATE_FILE" ]]; then
        local state
        state=$(cat "$LIVE_OVERLAY_STATE_FILE" 2>/dev/null || echo "")
        [[ "$state" == "active" ]]
    else
        false
    fi
}

# Check if system supports live overlay
check_live_overlay_support() {
    local errors=0
    
    # Check for overlay module
    if ! modprobe -n overlay >/dev/null 2>&1; then
        log_error "Overlay module not available" "apt-layer"
        errors=$((errors + 1))
    fi
    
    # Check for overlayfs mount support
    if ! mount -t overlay overlay -o "lowerdir=/tmp,upperdir=/tmp,workdir=/tmp" /tmp/overlay-test 2>/dev/null; then
        log_error "Overlayfs mount not supported" "apt-layer"
        errors=$((errors + 1))
    else
        umount /tmp/overlay-test 2>/dev/null
        rmdir /tmp/overlay-test 2>/dev/null
    fi
    
    # Check for read-only root filesystem
    if ! is_root_readonly; then
        log_warning "Root filesystem is not read-only - live overlay may not be necessary" "apt-layer"
    fi
    
    if [[ $errors -gt 0 ]]; then
        return 1
    fi
    
    return 0
}

# Check if root filesystem is read-only
is_root_readonly() {
    local root_mount
    root_mount=$(findmnt -n -o OPTIONS / | grep -o "ro" || echo "")
    [[ -n "$root_mount" ]]
}

# Start live overlay
start_live_overlay() {
    log_info "Starting live overlay system" "apt-layer"
    
    # Check if already active
    if is_live_overlay_active; then
        log_warning "Live overlay is already active" "apt-layer"
        return 0
    fi
    
    # Check system support
    if ! check_live_overlay_support; then
        log_error "System does not support live overlay" "apt-layer"
        return 1
    fi
    
    # Initialize system
    init_live_overlay_system
    
    # Create overlay mount
    log_info "Creating overlay mount" "apt-layer"
    if mount -t overlay overlay -o "lowerdir=/,upperdir=${UBLUE_LIVE_UPPER_DIR:-/var/lib/particle-os/live-overlay/upper},workdir=${UBLUE_LIVE_WORK_DIR:-/var/lib/particle-os/live-overlay/work}" "$LIVE_OVERLAY_MOUNT_POINT"; then
        log_success "Overlay mount created successfully" "apt-layer"
        
        # Mark overlay as active
        echo "active" > "$LIVE_OVERLAY_STATE_FILE"
        
        log_success "Live overlay started successfully" "apt-layer"
        log_info "Changes will be applied to overlay and can be committed or rolled back" "apt-layer"
        
        return 0
    else
        log_error "Failed to create overlay mount" "apt-layer"
        return 1
    fi
}

# Stop live overlay
stop_live_overlay() {
    log_info "Stopping live overlay system" "apt-layer"
    
    # Check if overlay is active
    if ! is_live_overlay_active; then
        log_warning "Live overlay is not active" "apt-layer"
        return 0
    fi
    
    # Check for active processes
    if check_active_processes; then
        log_warning "Active processes detected - overlay will persist until processes complete" "apt-layer"
        return 0
    fi
    
    # Unmount overlay
    log_info "Unmounting overlay" "apt-layer"
    if umount "$LIVE_OVERLAY_MOUNT_POINT"; then
        log_success "Overlay unmounted successfully" "apt-layer"
        
        # Remove state file
        rm -f "$LIVE_OVERLAY_STATE_FILE"
        
        log_success "Live overlay stopped successfully" "apt-layer"
        return 0
    else
        log_error "Failed to unmount overlay" "apt-layer"
        return 1
    fi
}

# Check for active processes that might prevent unmounting
check_active_processes() {
    # Check for package manager processes
    if pgrep -f "apt|dpkg|apt-get" >/dev/null 2>&1; then
        return 0
    fi
    
    # Check for processes using the overlay mount
    if lsof "$LIVE_OVERLAY_MOUNT_POINT" >/dev/null 2>&1; then
        return 0
    fi
    
    return 1
}

# Get live overlay status
get_live_overlay_status() {
    echo "=== Live Overlay Status ==="
    
    if is_live_overlay_active; then
        log_success "â Live overlay is ACTIVE" "apt-layer"
        
        # Show mount details
        if mountpoint -q "$LIVE_OVERLAY_MOUNT_POINT"; then
            log_info "Overlay mount point: $LIVE_OVERLAY_MOUNT_POINT" "apt-layer"
            
                    # Show overlay usage
        if [[ -d "${UBLUE_LIVE_UPPER_DIR:-/var/lib/particle-os/live-overlay/upper}" ]]; then
            local usage=$(du -sh "${UBLUE_LIVE_UPPER_DIR:-/var/lib/particle-os/live-overlay/upper}" 2>/dev/null | cut -f1 || echo "unknown")
            log_info "Overlay usage: $usage" "apt-layer"
        fi
            
            # Show installed packages
            if [[ -f "$LIVE_OVERLAY_PACKAGE_LOG" ]]; then
                local package_count=$(wc -l < "$LIVE_OVERLAY_PACKAGE_LOG" 2>/dev/null || echo "0")
                log_info "Packages installed in overlay: $package_count" "apt-layer"
            fi
        else
            log_warning "â ï¸  Overlay mount point not mounted" "apt-layer"
        fi
        
        # Check for active processes
        if check_active_processes; then
            log_warning "â ï¸  Active processes detected - overlay cannot be stopped" "apt-layer"
        fi
    else
        log_info "â¹ Live overlay is not active" "apt-layer"
        
        # Check if system supports live overlay
        if check_live_overlay_support >/dev/null 2>&1; then
            log_info "â¹ System supports live overlay" "apt-layer"
            log_info "Use '--live-overlay start' to start live overlay" "apt-layer"
        else
            log_warning "â ï¸  System does not support live overlay" "apt-layer"
        fi
    fi
    
    echo ""
}

# Install packages in live overlay
live_install() {
    local packages=("$@")
    
    log_info "Installing packages in live overlay: ${packages[*]}" "apt-layer"
    
    # Check if overlay is active
    if ! is_live_overlay_active; then
        log_error "Live overlay is not active" "apt-layer"
        log_info "Use '--live-overlay start' to start live overlay first" "apt-layer"
        return 1
    fi
    
    # Check for root privileges
    if [[ $EUID -ne 0 ]]; then
        log_error "Root privileges required for live installation" "apt-layer"
        return 1
    fi
    
    # Update package lists in overlay
    log_info "Updating package lists in overlay" "apt-layer"
    if ! chroot "$LIVE_OVERLAY_MOUNT_POINT" apt-get update; then
        log_error "Failed to update package lists" "apt-layer"
        return 1
    fi
    
    # Install packages in overlay
    log_info "Installing packages in overlay" "apt-layer"
    if chroot "$LIVE_OVERLAY_MOUNT_POINT" apt-get install -y "${packages[@]}"; then
        log_success "Packages installed successfully in overlay" "apt-layer"
        
        # Log installed packages
        for package in "${packages[@]}"; do
            echo "$(date '+%Y-%m-%d %H:%M:%S') - INSTALLED: $package" >> "$LIVE_OVERLAY_PACKAGE_LOG"
        done
        
        log_info "Changes are applied to overlay and can be committed or rolled back" "apt-layer"
        return 0
    else
        log_error "Failed to install packages in overlay" "apt-layer"
        return 1
    fi
}

# Manage live overlay
manage_live_overlay() {
    local action="$1"
    shift
    local options=("$@")
    
    case "$action" in
        "start")
            start_live_overlay
            ;;
        "stop")
            stop_live_overlay
            ;;
        "status")
            get_live_overlay_status
            ;;
        "commit")
            local message="${options[0]:-Live overlay changes}"
            commit_live_overlay "$message"
            ;;
        "rollback")
            rollback_live_overlay
            ;;
        "list")
            list_live_overlay_packages
            ;;
        "clean")
            clean_live_overlay
            ;;
        *)
            log_error "Unknown live overlay action: $action" "apt-layer"
            log_info "Valid actions: start, stop, status, commit, rollback, list, clean" "apt-layer"
            return 1
            ;;
    esac
}

# Commit live overlay changes
commit_live_overlay() {
    local message="$1"
    
    log_info "Committing live overlay changes: $message" "apt-layer"
    
    # Check if overlay is active
    if ! is_live_overlay_active; then
        log_error "Live overlay is not active" "apt-layer"
        return 1
    fi
    
    # Check if there are changes to commit
    if ! has_overlay_changes; then
        log_warning "No changes to commit" "apt-layer"
        return 0
    fi
    
    # Create new ComposeFS layer from overlay changes
    local timestamp=$(date '+%Y%m%d_%H%M%S')
    local layer_name="live-overlay-commit-${timestamp}"
    
    log_info "Creating new layer: $layer_name" "apt-layer"
    
    # Create layer from overlay changes
    if create_layer_from_overlay "$layer_name" "$message"; then
        log_success "Live overlay changes committed as layer: $layer_name" "apt-layer"
        
        # Clean up overlay
        clean_live_overlay
        
        return 0
    else
        log_error "Failed to commit live overlay changes" "apt-layer"
        return 1
    fi
}

# Check if overlay has changes
has_overlay_changes() {
    if [[ -d "${UBLUE_LIVE_UPPER_DIR:-/var/lib/particle-os/live-overlay/upper}" ]]; then
        # Check if upper directory has any content
        if [[ -n "$(find "${UBLUE_LIVE_UPPER_DIR:-/var/lib/particle-os/live-overlay/upper}" -mindepth 1 -maxdepth 1 2>/dev/null)" ]]; then
            return 0
        fi
    fi
    
    return 1
}

# Create layer from overlay changes
create_layer_from_overlay() {
    local layer_name="$1"
    local message="$2"
    
    # Create temporary directory for layer
    local temp_layer_dir="${UBLUE_TEMP_DIR:-/var/lib/particle-os/temp}/live-layer-${layer_name}"
    mkdir -p "$temp_layer_dir"
    
    # Copy overlay changes to temporary directory
    log_info "Copying overlay changes to temporary layer" "apt-layer"
    if ! cp -a "${UBLUE_LIVE_UPPER_DIR:-/var/lib/particle-os/live-overlay/upper}"/* "$temp_layer_dir/" 2>/dev/null; then
        log_error "Failed to copy overlay changes" "apt-layer"
        rm -rf "$temp_layer_dir"
        return 1
    fi
    
    # Create ComposeFS layer
    log_info "Creating ComposeFS layer from overlay changes" "apt-layer"
    if ! create_composefs_layer "$temp_layer_dir" "$layer_name" "$message"; then
        log_error "Failed to create ComposeFS layer" "apt-layer"
        rm -rf "$temp_layer_dir"
        return 1
    fi
    
    # Clean up temporary directory
    rm -rf "$temp_layer_dir"
    
    return 0
}

# Create ComposeFS layer from directory
create_composefs_layer() {
    local source_dir="$1"
    local layer_name="$2"
    local message="$3"
    
    # Use composefs-alternative to create layer
    if command -v composefs-alternative >/dev/null 2>&1; then
        if composefs-alternative create-layer "$source_dir" "$layer_name" "$message"; then
            return 0
        fi
    fi
    
    # Fallback: create simple squashfs layer
    local layer_file="${UBLUE_BUILD_DIR:-/var/lib/particle-os/build}/${layer_name}.squashfs"
    mkdir -p "$(dirname "$layer_file")"
    
    if mksquashfs "$source_dir" "$layer_file" -comp "${UBLUE_SQUASHFS_COMPRESSION:-xz}" -b "${UBLUE_SQUASHFS_BLOCK_SIZE:-1M}"; then
        log_success "Created squashfs layer: $layer_file" "apt-layer"
        return 0
    else
        log_error "Failed to create squashfs layer" "apt-layer"
        return 1
    fi
}

# Rollback live overlay changes
rollback_live_overlay() {
    log_info "Rolling back live overlay changes" "apt-layer"
    
    # Check if overlay is active
    if ! is_live_overlay_active; then
        log_error "Live overlay is not active" "apt-layer"
        return 1
    fi
    
    # Stop overlay (this will discard changes)
    if stop_live_overlay; then
        log_success "Live overlay changes rolled back successfully" "apt-layer"
        return 0
    else
        log_error "Failed to rollback live overlay changes" "apt-layer"
        return 1
    fi
}

# List packages installed in live overlay
list_live_overlay_packages() {
    log_info "Listing packages installed in live overlay" "apt-layer"
    
    if [[ -f "$LIVE_OVERLAY_PACKAGE_LOG" ]]; then
        if [[ -s "$LIVE_OVERLAY_PACKAGE_LOG" ]]; then
            echo "=== Packages Installed in Live Overlay ==="
            cat "$LIVE_OVERLAY_PACKAGE_LOG"
            echo ""
        else
            log_info "No packages installed in live overlay" "apt-layer"
        fi
    else
        log_info "No package log found" "apt-layer"
    fi
}

# Clean live overlay
clean_live_overlay() {
    log_info "Cleaning live overlay" "apt-layer"
    
    # Stop overlay if active
    if is_live_overlay_active; then
        stop_live_overlay
    fi
    
    # Clean up overlay directories
    rm -rf "${UBLUE_LIVE_UPPER_DIR:-/var/lib/particle-os/live-overlay/upper}"/* "${UBLUE_LIVE_WORK_DIR:-/var/lib/particle-os/live-overlay/work}"/* 2>/dev/null
    
    # Clean up package log
    rm -f "$LIVE_OVERLAY_PACKAGE_LOG"
    
    # Remove state file
    rm -f "$LIVE_OVERLAY_STATE_FILE"
    
    log_success "Live overlay cleaned successfully" "apt-layer"
}

# =============================================================================
# INTEGRATION FUNCTIONS
# =============================================================================

# Initialize live overlay system on script startup
init_live_overlay_on_startup() {
    # Only initialize if not already done
    if [[ ! -d "${UBLUE_LIVE_OVERLAY_DIR:-/var/lib/particle-os/live-overlay}" ]]; then
        init_live_overlay_system
    fi
}

# Cleanup live overlay on script exit
cleanup_live_overlay_on_exit() {
    # Only cleanup if overlay is active and no processes are using it
    if is_live_overlay_active && ! check_active_processes; then
        log_info "Cleaning up live overlay on exit" "apt-layer"
        stop_live_overlay
    fi
}

# Register cleanup function
trap cleanup_live_overlay_on_exit EXIT 

# --- END OF SCRIPTLET: 05-live-overlay.sh ---

# ============================================================================
# Bootloader Integration (UEFI/GRUB/systemd-boot)
# ============================================================================

# Ubuntu uBlue apt-layer Bootloader Integration
# Provides comprehensive bootloader management for immutable deployments
# Supports UEFI, GRUB, systemd-boot, and kernel argument management

# =============================================================================
# BOOTLOADER SYSTEM FUNCTIONS
# =============================================================================

# Bootloader configuration (with fallbacks for when particle-config.sh is not loaded)
BOOTLOADER_CONFIG_DIR="${UBLUE_CONFIG_DIR:-/etc/ubuntu-ublue}/bootloader"
BOOTLOADER_STATE_DIR="${UBLUE_ROOT:-/var/lib/particle-os}/bootloader"
BOOTLOADER_ENTRIES_DIR="$BOOTLOADER_STATE_DIR/entries"
BOOTLOADER_BACKUP_DIR="$BOOTLOADER_STATE_DIR/backups"
KARGS_CONFIG_DIR="${UBLUE_CONFIG_DIR:-/etc/ubuntu-ublue}/kargs"
KARGS_STATE_FILE="$BOOTLOADER_STATE_DIR/kargs.json"

# Initialize bootloader system
init_bootloader_system() {
    log_info "Initializing bootloader system" "apt-layer"
    
    # Create bootloader directories
    mkdir -p "$BOOTLOADER_CONFIG_DIR" "$BOOTLOADER_STATE_DIR" "$BOOTLOADER_ENTRIES_DIR" "$BOOTLOADER_BACKUP_DIR"
    mkdir -p "$KARGS_CONFIG_DIR"
    
    # Set proper permissions
    chmod 755 "$BOOTLOADER_CONFIG_DIR" "$BOOTLOADER_STATE_DIR"
    chmod 700 "$BOOTLOADER_ENTRIES_DIR" "$BOOTLOADER_BACKUP_DIR"
    
    # Initialize kernel arguments state if it doesn't exist
    if [[ ! -f "$KARGS_STATE_FILE" ]]; then
        echo '{"current": [], "pending": [], "history": []}' > "$KARGS_STATE_FILE"
        chmod 644 "$KARGS_STATE_FILE"
    fi
    
    log_success "Bootloader system initialized" "apt-layer"
}

# Detect bootloader type
detect_bootloader_type() {
    log_debug "Detecting bootloader type" "apt-layer"
    
    # Check for UEFI
    if [[ -d "/sys/firmware/efi" ]]; then
        log_info "UEFI system detected" "apt-layer"
        
        # Check for systemd-boot (preferred for UEFI)
        if command -v bootctl &>/dev/null && [[ -d "/boot/loader" ]]; then
            echo "systemd-boot"
            return 0
        fi
        
        # Check for GRUB UEFI
        if command -v grub-install &>/dev/null && [[ -f "/boot/grub/grub.cfg" ]]; then
            echo "grub-uefi"
            return 0
        fi
        
        # Generic UEFI
        echo "uefi"
        return 0
    fi
    
    # Check for legacy BIOS bootloaders
    if command -v grub-install &>/dev/null && [[ -f "/boot/grub/grub.cfg" ]]; then
        echo "grub-legacy"
        return 0
    fi
    
    if command -v lilo &>/dev/null; then
        echo "lilo"
        return 0
    fi
    
    if command -v syslinux &>/dev/null; then
        echo "syslinux"
        return 0
    fi
    
    log_warning "No supported bootloader detected" "apt-layer"
    echo "unknown"
    return 1
}

# Check if secure boot is enabled
is_secure_boot_enabled() {
    if [[ -d "/sys/firmware/efi" ]]; then
        if command -v mokutil &>/dev/null; then
            if mokutil --sb-state 2>/dev/null | grep -q "SecureBoot enabled"; then
                return 0
            fi
        fi
        
        # Alternative check via efivar
        if [[ -f "/sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c" ]]; then
            local secure_boot_value
            secure_boot_value=$(od -An -tu1 /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c 2>/dev/null | tr -d ' ' | tail -c1)
            if [[ "$secure_boot_value" == "1" ]]; then
                return 0
            fi
        fi
    fi
    
    return 1
}

# Get current kernel arguments
get_current_kernel_args() {
    local kernel_args
    kernel_args=$(cat /proc/cmdline 2>/dev/null || echo "")
    echo "$kernel_args"
}

# Parse kernel arguments into array
parse_kernel_args() {
    local cmdline="$1"
    local args=()
    
    # Split cmdline into individual arguments
    while IFS= read -r -d '' arg; do
        if [[ -n "$arg" ]]; then
            args+=("$arg")
        fi
    done < <(echo -n "$cmdline" | tr ' ' '\0')
    
    echo "${args[@]}"
}

# Add kernel argument
add_kernel_arg() {
    local arg="$1"
    
    if [[ -z "$arg" ]]; then
        log_error "No kernel argument provided" "apt-layer"
        return 1
    fi
    
    log_info "Adding kernel argument: $arg" "apt-layer"
    
    # Read current kernel arguments state
    local current_args
    current_args=$(jq -r '.current[]?' "$KARGS_STATE_FILE" 2>/dev/null || echo "")
    
    # Check if argument already exists
    if echo "$current_args" | grep -q "^$arg$"; then
        log_warning "Kernel argument already exists: $arg" "apt-layer"
        return 0
    fi
    
    # Add to pending arguments
    local pending_args
    pending_args=$(jq -r '.pending[]?' "$KARGS_STATE_FILE" 2>/dev/null || echo "")
    
    if echo "$pending_args" | grep -q "^$arg$"; then
        log_warning "Kernel argument already pending: $arg" "apt-layer"
        return 0
    fi
    
    # Update state file
    jq --arg arg "$arg" '.pending += [$arg]' "$KARGS_STATE_FILE" > "$KARGS_STATE_FILE.tmp" && \
    mv "$KARGS_STATE_FILE.tmp" "$KARGS_STATE_FILE"
    
    log_success "Kernel argument added to pending: $arg" "apt-layer"
    return 0
}

# Remove kernel argument
remove_kernel_arg() {
    local arg="$1"
    
    if [[ -z "$arg" ]]; then
        log_error "No kernel argument provided" "apt-layer"
        return 1
    fi
    
    log_info "Removing kernel argument: $arg" "apt-layer"
    
    # Remove from pending arguments
    jq --arg arg "$arg" '(.pending | map(select(. != $arg))) as $new_pending | .pending = $new_pending' "$KARGS_STATE_FILE" > "$KARGS_STATE_FILE.tmp" && \
    mv "$KARGS_STATE_FILE.tmp" "$KARGS_STATE_FILE"
    
    log_success "Kernel argument removed from pending: $arg" "apt-layer"
    return 0
}

# List kernel arguments
list_kernel_args() {
    log_info "Listing kernel arguments" "apt-layer"
    
    echo "=== Current Kernel Arguments ==="
    local current_args
    current_args=$(get_current_kernel_args)
    if [[ -n "$current_args" ]]; then
        echo "$current_args" | tr ' ' '\n' | while read -r arg; do
            if [[ -n "$arg" ]]; then
                echo "  $arg"
            fi
        done
    else
        log_info "No current kernel arguments found" "apt-layer"
    fi
    
    echo ""
    echo "=== Pending Kernel Arguments ==="
    local pending_args
    pending_args=$(jq -r '.pending[]?' "$KARGS_STATE_FILE" 2>/dev/null || echo "")
    if [[ -n "$pending_args" ]]; then
        echo "$pending_args" | while read -r arg; do
            if [[ -n "$arg" ]]; then
                echo "  $arg (pending)"
            fi
        done
    else
        log_info "No pending kernel arguments" "apt-layer"
    fi
    
    echo ""
}

# Clear pending kernel arguments
clear_pending_kargs() {
    log_info "Clearing pending kernel arguments" "apt-layer"
    
    jq '.pending = []' "$KARGS_STATE_FILE" > "$KARGS_STATE_FILE.tmp" && \
    mv "$KARGS_STATE_FILE.tmp" "$KARGS_STATE_FILE"
    
    log_success "Pending kernel arguments cleared" "apt-layer"
}

# Apply kernel arguments to deployment
apply_kernel_args_to_deployment() {
    local deployment_id="$1"
    
    if [[ -z "$deployment_id" ]]; then
        log_error "No deployment ID provided" "apt-layer"
        return 1
    fi
    
    log_info "Applying kernel arguments to deployment: $deployment_id" "apt-layer"
    
    # Get pending kernel arguments
    local pending_args
    pending_args=$(jq -r '.pending[]?' "$KARGS_STATE_FILE" 2>/dev/null || echo "")
    
    if [[ -z "$pending_args" ]]; then
        log_info "No pending kernel arguments to apply" "apt-layer"
        return 0
    fi
    
    # Create kernel arguments configuration for deployment
    local kargs_config="$BOOTLOADER_ENTRIES_DIR/${deployment_id}.kargs"
    echo "# Kernel arguments for deployment: $deployment_id" > "$kargs_config"
    echo "# Generated on: $(date)" >> "$kargs_config"
    echo "" >> "$kargs_config"
    
    echo "$pending_args" | while read -r arg; do
        if [[ -n "$arg" ]]; then
            echo "$arg" >> "$kargs_config"
        fi
    done
    
    # Move pending arguments to current and clear pending
    local current_args
    current_args=$(jq -r '.current[]?' "$KARGS_STATE_FILE" 2>/dev/null || echo "")
    
    # Combine current and pending arguments
    local all_args=()
    while IFS= read -r arg; do
        if [[ -n "$arg" ]]; then
            all_args+=("$arg")
        fi
    done < <(echo "$current_args")
    
    while IFS= read -r arg; do
        if [[ -n "$arg" ]]; then
            all_args+=("$arg")
        fi
    done < <(echo "$pending_args")
    
    # Update state file
    local args_json
    args_json=$(printf '%s\n' "${all_args[@]}" | jq -R . | jq -s .)
    jq --argjson current "$args_json" '.current = $current | .pending = []' "$KARGS_STATE_FILE" > "$KARGS_STATE_FILE.tmp" && \
    mv "$KARGS_STATE_FILE.tmp" "$KARGS_STATE_FILE"
    
    log_success "Kernel arguments applied to deployment: $deployment_id" "apt-layer"
    return 0
}

# Create bootloader entry for deployment
create_bootloader_entry() {
    local deployment_id="$1"
    local deployment_dir="$2"
    local title="${3:-Ubuntu uBlue}"
    
    if [[ -z "$deployment_id" ]] || [[ -z "$deployment_dir" ]]; then
        log_error "Deployment ID and directory required" "apt-layer"
        return 1
    fi
    
    log_info "Creating bootloader entry for deployment: $deployment_id" "apt-layer"
    
    # Detect bootloader type
    local bootloader_type
    bootloader_type=$(detect_bootloader_type)
    
    case "$bootloader_type" in
        "systemd-boot")
            create_systemd_boot_entry "$deployment_id" "$deployment_dir" "$title"
            ;;
        "grub-uefi"|"grub-legacy")
            create_grub_boot_entry "$deployment_id" "$deployment_dir" "$title"
            ;;
        "uefi")
            create_uefi_boot_entry "$deployment_id" "$deployment_dir" "$title"
            ;;
        *)
            log_warning "Unsupported bootloader type: $bootloader_type" "apt-layer"
            return 1
            ;;
    esac
    
    return 0
}

# Create systemd-boot entry
create_systemd_boot_entry() {
    local deployment_id="$1"
    local deployment_dir="$2"
    local title="$3"
    
    log_info "Creating systemd-boot entry" "apt-layer"
    
    local entry_file="/boot/loader/entries/${deployment_id}.conf"
    local kernel_path="$deployment_dir/vmlinuz"
    local initrd_path="$deployment_dir/initrd.img"
    
    # Check if kernel and initrd exist
    if [[ ! -f "$kernel_path" ]]; then
        log_error "Kernel not found: $kernel_path" "apt-layer"
        return 1
    fi
    
    if [[ ! -f "$initrd_path" ]]; then
        log_error "Initrd not found: $initrd_path" "apt-layer"
        return 1
    fi
    
    # Get kernel arguments
    local kargs_file="$BOOTLOADER_ENTRIES_DIR/${deployment_id}.kargs"
    local kargs=""
    if [[ -f "$kargs_file" ]]; then
        kargs=$(cat "$kargs_file" | grep -v '^#' | tr '\n' ' ')
    fi
    
    # Create systemd-boot entry
    cat > "$entry_file" << EOF
title $title ($deployment_id)
linux $kernel_path
initrd $initrd_path
options root=UUID=$(get_root_uuid) ro $kargs
EOF
    
    log_success "systemd-boot entry created: $entry_file" "apt-layer"
    return 0
}

# Create GRUB boot entry
create_grub_boot_entry() {
    local deployment_id="$1"
    local deployment_dir="$2"
    local title="$3"
    
    log_info "Creating GRUB boot entry" "apt-layer"
    
    # This would typically involve updating /etc/default/grub and running update-grub
    # For now, we'll create a custom GRUB configuration snippet
    local grub_config_dir="/etc/grub.d"
    local grub_script="$grub_config_dir/10_${deployment_id}"
    
    if [[ ! -d "$grub_config_dir" ]]; then
        log_error "GRUB configuration directory not found: $grub_config_dir" "apt-layer"
        return 1
    fi
    
    # Get kernel arguments
    local kargs_file="$BOOTLOADER_ENTRIES_DIR/${deployment_id}.kargs"
    local kargs=""
    if [[ -f "$kargs_file" ]]; then
        kargs=$(cat "$kargs_file" | grep -v '^#' | tr '\n' ' ')
    fi
    
    # Create GRUB script
    cat > "$grub_script" << EOF
#!/bin/sh
exec tail -n +3 \$0
menuentry '$title ($deployment_id)' {
    linux $deployment_dir/vmlinuz root=UUID=$(get_root_uuid) ro $kargs
    initrd $deployment_dir/initrd.img
}
EOF
    
    chmod +x "$grub_script"
    
    # Update GRUB configuration
    if command -v update-grub &>/dev/null; then
        if update-grub; then
            log_success "GRUB configuration updated" "apt-layer"
        else
            log_warning "Failed to update GRUB configuration" "apt-layer"
        fi
    fi
    
    log_success "GRUB boot entry created: $grub_script" "apt-layer"
    return 0
}

# Create UEFI boot entry
create_uefi_boot_entry() {
    local deployment_id="$1"
    local deployment_dir="$2"
    local title="$3"
    
    log_info "Creating UEFI boot entry" "apt-layer"
    
    if ! command -v efibootmgr &>/dev/null; then
        log_error "efibootmgr not available" "apt-layer"
        return 1
    fi
    
    # Find EFI partition
    local efi_partition
    efi_partition=$(find_efi_partition)
    if [[ -z "$efi_partition" ]]; then
        log_error "EFI partition not found" "apt-layer"
        return 1
    fi
    
    # Get kernel arguments
    local kargs_file="$BOOTLOADER_ENTRIES_DIR/${deployment_id}.kargs"
    local kargs=""
    if [[ -f "$kargs_file" ]]; then
        kargs=$(cat "$kargs_file" | grep -v '^#' | tr '\n' ' ')
    fi
    
    # Create UEFI boot entry
    local kernel_path="$deployment_dir/vmlinuz"
    local boot_args="root=UUID=$(get_root_uuid) ro $kargs"
    
    if efibootmgr --create --disk "$efi_partition" --part 1 --label "$title ($deployment_id)" --loader "$kernel_path" --unicode "$boot_args"; then
        log_success "UEFI boot entry created" "apt-layer"
        return 0
    else
        log_error "Failed to create UEFI boot entry" "apt-layer"
        return 1
    fi
}

# Get root device UUID
get_root_uuid() {
    local root_device
    root_device=$(findmnt -n -o SOURCE /)
    
    if [[ -n "$root_device" ]]; then
        blkid -s UUID -o value "$root_device" 2>/dev/null || echo "unknown"
    else
        echo "unknown"
    fi
}

# Find EFI partition
find_efi_partition() {
    # Look for EFI partition in /proc/partitions
    local efi_partition
    efi_partition=$(lsblk -n -o NAME,MOUNTPOINT,FSTYPE | grep -E '/boot/efi|/efi' | awk '{print $1}' | head -1)
    
    if [[ -n "$efi_partition" ]]; then
        echo "/dev/$efi_partition"
    else
        # Fallback: look for EFI partition by filesystem type
        lsblk -n -o NAME,FSTYPE | grep vfat | awk '{print "/dev/" $1}' | head -1
    fi
}

# Set default boot entry
set_default_boot_entry() {
    local deployment_id="$1"
    
    if [[ -z "$deployment_id" ]]; then
        log_error "Deployment ID required" "apt-layer"
        return 1
    fi
    
    log_info "Setting default boot entry: $deployment_id" "apt-layer"
    
    # Detect bootloader type
    local bootloader_type
    bootloader_type=$(detect_bootloader_type)
    
    case "$bootloader_type" in
        "systemd-boot")
            set_systemd_boot_default "$deployment_id"
            ;;
        "grub-uefi"|"grub-legacy")
            set_grub_default "$deployment_id"
            ;;
        "uefi")
            set_uefi_default "$deployment_id"
            ;;
        *)
            log_warning "Unsupported bootloader type: $bootloader_type" "apt-layer"
            return 1
            ;;
    esac
    
    return 0
}

# Set systemd-boot default
set_systemd_boot_default() {
    local deployment_id="$1"
    
    local loader_conf="/boot/loader/loader.conf"
    local entry_file="/boot/loader/entries/${deployment_id}.conf"
    
    if [[ ! -f "$entry_file" ]]; then
        log_error "Boot entry not found: $entry_file" "apt-layer"
        return 1
    fi
    
    # Update loader.conf
    if [[ -f "$loader_conf" ]]; then
        # Backup original
        cp "$loader_conf" "$loader_conf.backup"
        
        # Update default entry
        sed -i "s/^default.*/default $deployment_id/" "$loader_conf" 2>/dev/null || \
        echo "default $deployment_id" >> "$loader_conf"
    else
        # Create loader.conf
        cat > "$loader_conf" << EOF
default $deployment_id
timeout 5
editor no
EOF
    fi
    
    log_success "systemd-boot default set to: $deployment_id" "apt-layer"
    return 0
}

# Set GRUB default
set_grub_default() {
    local deployment_id="$1"
    
    local grub_default="/etc/default/grub"
    
    if [[ -f "$grub_default" ]]; then
        # Backup original
        cp "$grub_default" "$grub_default.backup"
        
        # Update default entry
        sed -i "s/^GRUB_DEFAULT.*/GRUB_DEFAULT=\"$deployment_id\"/" "$grub_default" 2>/dev/null || \
        echo "GRUB_DEFAULT=\"$deployment_id\"" >> "$grub_default"
        
        # Update GRUB configuration
        if command -v update-grub &>/dev/null; then
            if update-grub; then
                log_success "GRUB default set to: $deployment_id" "apt-layer"
                return 0
            else
                log_error "Failed to update GRUB configuration" "apt-layer"
                return 1
            fi
        fi
    else
        log_error "GRUB default configuration not found: $grub_default" "apt-layer"
        return 1
    fi
}

# Set UEFI default
set_uefi_default() {
    local deployment_id="$1"
    
    if ! command -v efibootmgr &>/dev/null; then
        log_error "efibootmgr not available" "apt-layer"
        return 1
    fi
    
    # Find boot entry
    local boot_entry
    boot_entry=$(efibootmgr | grep "$deployment_id" | head -1 | sed 's/Boot\([0-9a-fA-F]*\).*/\1/')
    
    if [[ -n "$boot_entry" ]]; then
        if efibootmgr --bootnext "$boot_entry"; then
            log_success "UEFI default set to: $deployment_id" "apt-layer"
            return 0
        else
            log_error "Failed to set UEFI default" "apt-layer"
            return 1
        fi
    else
        log_error "UEFI boot entry not found: $deployment_id" "apt-layer"
        return 1
    fi
}

# List boot entries
list_boot_entries() {
    log_info "Listing boot entries" "apt-layer"
    
    # Detect bootloader type
    local bootloader_type
    bootloader_type=$(detect_bootloader_type)
    
    echo "=== Boot Entries ($bootloader_type) ==="
    
    case "$bootloader_type" in
        "systemd-boot")
            list_systemd_boot_entries
            ;;
        "grub-uefi"|"grub-legacy")
            list_grub_entries
            ;;
        "uefi")
            list_uefi_entries
            ;;
        *)
            log_warning "Unsupported bootloader type: $bootloader_type" "apt-layer"
            ;;
    esac
    
    echo ""
}

# List systemd-boot entries
list_systemd_boot_entries() {
    local entries_dir="/boot/loader/entries"
    
    if [[ -d "$entries_dir" ]]; then
        for entry in "$entries_dir"/*.conf; do
            if [[ -f "$entry" ]]; then
                local title
                title=$(grep "^title" "$entry" | cut -d' ' -f2- | head -1)
                local deployment_id
                deployment_id=$(basename "$entry" .conf)
                echo "  $deployment_id: $title"
            fi
        done
    else
        log_info "No systemd-boot entries found" "apt-layer"
    fi
}

# List GRUB entries
list_grub_entries() {
    local grub_cfg="/boot/grub/grub.cfg"
    
    if [[ -f "$grub_cfg" ]]; then
        grep -A1 "menuentry" "$grub_cfg" | grep -E "(menuentry|ubuntu-ublue)" | while read -r line; do
            if [[ "$line" =~ menuentry ]]; then
                local title
                title=$(echo "$line" | sed 's/.*menuentry '\''\([^'\'']*\)'\''.*/\1/')
                echo "  $title"
            fi
        done
    else
        log_info "No GRUB entries found" "apt-layer"
    fi
}

# List UEFI entries
list_uefi_entries() {
    if command -v efibootmgr &>/dev/null; then
        efibootmgr | grep -E "Boot[0-9a-fA-F]*" | while read -r line; do
            local boot_id
            boot_id=$(echo "$line" | sed 's/Boot\([0-9a-fA-F]*\).*/\1/')
            local title
            title=$(echo "$line" | sed 's/.*\* \(.*\)/\1/')
            echo "  $boot_id: $title"
        done
    else
        log_info "efibootmgr not available" "apt-layer"
    fi
}

# Remove boot entry
remove_boot_entry() {
    local deployment_id="$1"
    
    if [[ -z "$deployment_id" ]]; then
        log_error "Deployment ID required" "apt-layer"
        return 1
    fi
    
    log_info "Removing boot entry: $deployment_id" "apt-layer"
    
    # Detect bootloader type
    local bootloader_type
    bootloader_type=$(detect_bootloader_type)
    
    case "$bootloader_type" in
        "systemd-boot")
            remove_systemd_boot_entry "$deployment_id"
            ;;
        "grub-uefi"|"grub-legacy")
            remove_grub_entry "$deployment_id"
            ;;
        "uefi")
            remove_uefi_entry "$deployment_id"
            ;;
        *)
            log_warning "Unsupported bootloader type: $bootloader_type" "apt-layer"
            return 1
            ;;
    esac
    
    return 0
}

# Remove systemd-boot entry
remove_systemd_boot_entry() {
    local deployment_id="$1"
    
    local entry_file="/boot/loader/entries/${deployment_id}.conf"
    
    if [[ -f "$entry_file" ]]; then
        if rm "$entry_file"; then
            log_success "systemd-boot entry removed: $deployment_id" "apt-layer"
            return 0
        else
            log_error "Failed to remove systemd-boot entry" "apt-layer"
            return 1
        fi
    else
        log_warning "systemd-boot entry not found: $deployment_id" "apt-layer"
        return 0
    fi
}

# Remove GRUB entry
remove_grub_entry() {
    local deployment_id="$1"
    
    local grub_script="/etc/grub.d/10_${deployment_id}"
    
    if [[ -f "$grub_script" ]]; then
        if rm "$grub_script"; then
            log_success "GRUB entry removed: $deployment_id" "apt-layer"
            
            # Update GRUB configuration
            if command -v update-grub &>/dev/null; then
                update-grub
            fi
            
            return 0
        else
            log_error "Failed to remove GRUB entry" "apt-layer"
            return 1
        fi
    else
        log_warning "GRUB entry not found: $deployment_id" "apt-layer"
        return 0
    fi
}

# Remove UEFI entry
remove_uefi_entry() {
    local deployment_id="$1"
    
    if ! command -v efibootmgr &>/dev/null; then
        log_error "efibootmgr not available" "apt-layer"
        return 1
    fi
    
    # Find boot entry
    local boot_entry
    boot_entry=$(efibootmgr | grep "$deployment_id" | head -1 | sed 's/Boot\([0-9a-fA-F]*\).*/\1/')
    
    if [[ -n "$boot_entry" ]]; then
        if efibootmgr --bootnum "$boot_entry" --delete-bootnum; then
            log_success "UEFI entry removed: $deployment_id" "apt-layer"
            return 0
        else
            log_error "Failed to remove UEFI entry" "apt-layer"
            return 1
        fi
    else
        log_warning "UEFI entry not found: $deployment_id" "apt-layer"
        return 0
    fi
}

# Get bootloader status
get_bootloader_status() {
    log_info "Getting bootloader status" "apt-layer"
    
    echo "=== Bootloader Status ==="
    
    # Detect bootloader type
    local bootloader_type
    bootloader_type=$(detect_bootloader_type)
    echo "Bootloader Type: $bootloader_type"
    
    # Check secure boot status
    if is_secure_boot_enabled; then
        echo "Secure Boot: Enabled"
    else
        echo "Secure Boot: Disabled"
    fi
    
    # Show current kernel arguments
    echo ""
    echo "Current Kernel Arguments:"
    local current_args
    current_args=$(get_current_kernel_args)
    if [[ -n "$current_args" ]]; then
        echo "$current_args" | tr ' ' '\n' | while read -r arg; do
            if [[ -n "$arg" ]]; then
                echo "  $arg"
            fi
        done
    else
        echo "  None"
    fi
    
    # Show pending kernel arguments
    echo ""
    echo "Pending Kernel Arguments:"
    local pending_args
    pending_args=$(jq -r '.pending[]?' "$KARGS_STATE_FILE" 2>/dev/null || echo "")
    if [[ -n "$pending_args" ]]; then
        echo "$pending_args" | while read -r arg; do
            if [[ -n "$arg" ]]; then
                echo "  $arg (pending)"
            fi
        done
    else
        echo "  None"
    fi
    
    echo ""
}

# =============================================================================
# INTEGRATION FUNCTIONS
# =============================================================================

# Initialize bootloader system on script startup
init_bootloader_on_startup() {
    # Only initialize if not already done
    if [[ ! -d "$BOOTLOADER_STATE_DIR" ]]; then
        init_bootloader_system
    fi
}

# Cleanup bootloader on script exit
cleanup_bootloader_on_exit() {
    # Clean up temporary files
    rm -f "$KARGS_STATE_FILE.tmp" 2>/dev/null || true
}

# Register cleanup function
trap cleanup_bootloader_on_exit EXIT 

# --- END OF SCRIPTLET: 07-bootloader.sh ---

# ============================================================================
# Advanced Package Management (Enterprise Features)
# ============================================================================

# Ubuntu uBlue apt-layer Advanced Package Management
# Provides enterprise-grade package management with multi-user support, security features,
# and advanced dependency resolution for production deployments

# =============================================================================
# ADVANCED PACKAGE MANAGEMENT FUNCTIONS
# =============================================================================

# Advanced package management configuration (with fallbacks for when particle-config.sh is not loaded)
ADVANCED_PKG_CONFIG_DIR="${UBLUE_CONFIG_DIR:-/etc/ubuntu-ublue}/package-management"
ADVANCED_PKG_STATE_DIR="${UBLUE_ROOT:-/var/lib/particle-os}/package-management"
ADVANCED_PKG_CACHE_DIR="$ADVANCED_PKG_STATE_DIR/cache"
ADVANCED_PKG_DEPENDENCIES_DIR="$ADVANCED_PKG_STATE_DIR/dependencies"
ADVANCED_PKG_SECURITY_DIR="$ADVANCED_PKG_STATE_DIR/security"
ADVANCED_PKG_USERS_DIR="$ADVANCED_PKG_STATE_DIR/users"
ADVANCED_PKG_POLICIES_DIR="$ADVANCED_PKG_STATE_DIR/policies"

# Initialize advanced package management system
init_advanced_package_management() {
    log_info "Initializing advanced package management system" "apt-layer"
    
    # Create advanced package management directories
    mkdir -p "$ADVANCED_PKG_CONFIG_DIR" "$ADVANCED_PKG_STATE_DIR" "$ADVANCED_PKG_CACHE_DIR"
    mkdir -p "$ADVANCED_PKG_DEPENDENCIES_DIR" "$ADVANCED_PKG_SECURITY_DIR" "$ADVANCED_PKG_USERS_DIR"
    mkdir -p "$ADVANCED_PKG_POLICIES_DIR"
    
    # Set proper permissions
    chmod 755 "$ADVANCED_PKG_CONFIG_DIR" "$ADVANCED_PKG_STATE_DIR"
    chmod 700 "$ADVANCED_PKG_CACHE_DIR" "$ADVANCED_PKG_DEPENDENCIES_DIR" "$ADVANCED_PKG_SECURITY_DIR"
    chmod 750 "$ADVANCED_PKG_USERS_DIR" "$ADVANCED_PKG_POLICIES_DIR"
    
    # Initialize user management database
    init_user_management_db
    
    # Initialize security policies
    init_security_policies
    
    # Initialize dependency resolution cache
    init_dependency_cache
    
    log_success "Advanced package management system initialized" "apt-layer"
}

# Initialize user management database
init_user_management_db() {
    local user_db="$ADVANCED_PKG_USERS_DIR/users.json"
    
    if [[ ! -f "$user_db" ]]; then
        cat > "$user_db" << EOF
{
    "users": {},
    "groups": {},
    "permissions": {},
    "roles": {
        "admin": {
            "description": "Full system administration",
            "permissions": ["all"]
        },
        "package_manager": {
            "description": "Package installation and management",
            "permissions": ["install", "remove", "update", "list"]
        },
        "viewer": {
            "description": "Read-only access to package information",
            "permissions": ["list", "info", "status"]
        }
    }
}
EOF
        chmod 600 "$user_db"
    fi
}

# Initialize security policies
init_security_policies() {
    local security_policy="$ADVANCED_PKG_SECURITY_DIR/security-policy.json"
    
    if [[ ! -f "$security_policy" ]]; then
        cat > "$security_policy" << EOF
{
    "package_verification": {
        "enabled": true,
        "gpg_check": true,
        "hash_verification": true,
        "source_verification": true
    },
    "installation_policies": {
        "allow_unsigned_packages": false,
        "allow_external_sources": false,
        "require_approval": false,
        "max_package_size_mb": 1000
    },
    "security_scanning": {
        "enabled": true,
        "scan_installed_packages": true,
        "scan_dependencies": true,
        "vulnerability_check": true
    },
    "audit_logging": {
        "enabled": true,
        "log_level": "INFO",
        "retention_days": 90
    }
}
EOF
        chmod 600 "$security_policy"
    fi
}

# Initialize dependency cache
init_dependency_cache() {
    local dep_cache="$ADVANCED_PKG_DEPENDENCIES_DIR/dependency-cache.json"
    
    if [[ ! -f "$dep_cache" ]]; then
        cat > "$dep_cache" << EOF
{
    "package_dependencies": {},
    "reverse_dependencies": {},
    "conflict_resolution": {},
    "last_updated": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
}
EOF
        chmod 644 "$dep_cache"
    fi
}

# Check user permissions
check_user_permissions() {
    local user="$1"
    local required_permission="$2"
    
    log_debug "Checking permission '$required_permission' for user '$user'" "apt-layer"
    
    # Root user has all permissions
    if [[ "$user" == "root" ]] || [[ $EUID -eq 0 ]]; then
        return 0
    fi
    
    local user_db="$ADVANCED_PKG_USERS_DIR/users.json"
    
    if [[ ! -f "$user_db" ]]; then
        log_error "User management database not found" "apt-layer"
        return 1
    fi
    
    # Get user role
    local user_role
    user_role=$(jq -r ".users[\"$user\"].role // \"viewer\"" "$user_db" 2>/dev/null || echo "viewer")
    
    # Get role permissions
    local role_permissions
    role_permissions=$(jq -r ".roles[\"$user_role\"].permissions[]?" "$user_db" 2>/dev/null || echo "")
    
    # Check if user has required permission
    if echo "$role_permissions" | grep -q "^$required_permission$" || echo "$role_permissions" | grep -q "^all$"; then
        return 0
    fi
    
    log_error "User '$user' does not have permission '$required_permission'" "apt-layer"
    return 1
}

# Add user to package management system
add_package_user() {
    local username="$1"
    local role="${2:-viewer}"
    
    if [[ -z "$username" ]]; then
        log_error "Username required" "apt-layer"
        return 1
    fi
    
    log_info "Adding user '$username' with role '$role'" "apt-layer"
    
    # Check if user exists in system
    if ! id "$username" &>/dev/null; then
        log_error "User '$username' does not exist in system" "apt-layer"
        return 1
    fi
    
    local user_db="$ADVANCED_PKG_USERS_DIR/users.json"
    
    # Check if role exists
    if ! jq -e ".roles[\"$role\"]" "$user_db" >/dev/null 2>&1; then
        log_error "Role '$role' does not exist" "apt-layer"
        return 1
    fi
    
    # Add user to database
    jq --arg user "$username" --arg role "$role" '.users[$user] = {"role": $role, "added": "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}' "$user_db" > "$user_db.tmp" && \
    mv "$user_db.tmp" "$user_db"
    
    log_success "User '$username' added with role '$role'" "apt-layer"
    return 0
}

# Remove user from package management system
remove_package_user() {
    local username="$1"
    
    if [[ -z "$username" ]]; then
        log_error "Username required" "apt-layer"
        return 1
    fi
    
    log_info "Removing user '$username'" "apt-layer"
    
    local user_db="$ADVANCED_PKG_USERS_DIR/users.json"
    
    # Remove user from database
    jq --arg user "$username" 'del(.users[$user])' "$user_db" > "$user_db.tmp" && \
    mv "$user_db.tmp" "$user_db"
    
    log_success "User '$username' removed" "apt-layer"
    return 0
}

# List package management users
list_package_users() {
    log_info "Listing package management users" "apt-layer"
    
    local user_db="$ADVANCED_PKG_USERS_DIR/users.json"
    
    if [[ ! -f "$user_db" ]]; then
        log_error "User management database not found" "apt-layer"
        return 1
    fi
    
    echo "=== Package Management Users ==="
    
    local users
    users=$(jq -r '.users | to_entries[] | "\(.key): \(.value.role)"' "$user_db" 2>/dev/null || echo "")
    
    if [[ -n "$users" ]]; then
        echo "$users" | while read -r user_info; do
            echo "  $user_info"
        done
    else
        log_info "No users found" "apt-layer"
    fi
    
    echo ""
    echo "=== Available Roles ==="
    
    local roles
    roles=$(jq -r '.roles | to_entries[] | "\(.key): \(.value.description)"' "$user_db" 2>/dev/null || echo "")
    
    if [[ -n "$roles" ]]; then
        echo "$roles" | while read -r role_info; do
            echo "  $role_info"
        done
    else
        log_info "No roles found" "apt-layer"
    fi
    
    echo ""
}

# Advanced dependency resolution
resolve_package_dependencies() {
    local packages=("$@")
    
    if [[ ${#packages[@]} -eq 0 ]]; then
        log_error "No packages specified for dependency resolution" "apt-layer"
        return 1
    fi
    
    log_info "Resolving dependencies for packages: ${packages[*]}" "apt-layer"
    
    # Create temporary file for dependency resolution
    local temp_deps="$ADVANCED_PKG_CACHE_DIR/temp-deps-$$.txt"
    local resolved_deps="$ADVANCED_PKG_CACHE_DIR/resolved-deps-$$.txt"
    
    # Get package dependencies using apt-cache
    for package in "${packages[@]}"; do
        log_debug "Resolving dependencies for package: $package" "apt-layer"
        
        # Get direct dependencies
        apt-cache depends "$package" 2>/dev/null | grep -E "^(Depends|Recommends|Suggests)" | cut -d: -f2 | tr -d ' ' | grep -v "^$" >> "$temp_deps" || true
        
        # Get reverse dependencies (what depends on this package)
        apt-cache rdepends "$package" 2>/dev/null | grep -v "^Reverse Depends" | grep -v "^$" >> "$temp_deps" || true
    done
    
    # Remove duplicates and sort
    sort -u "$temp_deps" > "$resolved_deps"
    
    # Check for conflicts
    local conflicts=()
    while read -r dep; do
        if [[ -n "$dep" ]]; then
            # Check if package conflicts with any existing packages
            if check_package_conflicts "$dep"; then
                conflicts+=("$dep")
            fi
        fi
    done < "$resolved_deps"
    
    # Report conflicts
    if [[ ${#conflicts[@]} -gt 0 ]]; then
        log_warning "Package conflicts detected: ${conflicts[*]}" "apt-layer"
        log_info "Manual resolution may be required" "apt-layer"
    fi
    
    # Clean up temporary files
    rm -f "$temp_deps" "$resolved_deps"
    
    log_success "Dependency resolution completed" "apt-layer"
    return 0
}

# Check for package conflicts
check_package_conflicts() {
    local package="$1"
    
    if [[ -z "$package" ]]; then
        return 1
    fi
    
    # Check if package conflicts with any installed packages
    local conflicts
    conflicts=$(apt-cache policy "$package" 2>/dev/null | grep -A1 "Installed" | grep -E "(Conflicts|Breaks)" || echo "")
    
    if [[ -n "$conflicts" ]]; then
        log_warning "Package '$package' has conflicts: $conflicts" "apt-layer"
        return 0
    fi
    
    return 1
}

# Advanced package installation with security checks
advanced_install_packages() {
    local packages=("$@")
    local user="${SUDO_USER:-$USER}"
    
    if [[ ${#packages[@]} -eq 0 ]]; then
        log_error "No packages specified for installation" "apt-layer"
        return 1
    fi
    
    log_info "Advanced package installation for packages: ${packages[*]}" "apt-layer"
    
    # Check user permissions
    if ! check_user_permissions "$user" "install"; then
        return 1
    fi
    
    # Check security policies
    if ! check_security_policies "${packages[@]}"; then
        return 1
    fi
    
    # Resolve dependencies
    if ! resolve_package_dependencies "${packages[@]}"; then
        log_error "Dependency resolution failed" "apt-layer"
        return 1
    fi
    
    # Start transaction
    start_transaction "advanced_install_${packages[0]}"
    
    # Update package lists
    update_transaction_phase "updating_package_lists"
    log_info "Updating package lists" "apt-layer"
    if ! apt-get update; then
        log_error "Failed to update package lists" "apt-layer"
        rollback_transaction
        return 1
    fi
    
    # Install packages
    update_transaction_phase "installing_packages"
    log_info "Installing packages: ${packages[*]}" "apt-layer"
    if ! apt-get install -y "${packages[@]}"; then
        log_error "Failed to install packages: ${packages[*]}" "apt-layer"
        rollback_transaction
        return 1
    fi
    
    # Clean up
    apt-get clean
    apt-get autoremove -y
    
    # Log installation
    log_package_installation "$user" "${packages[@]}"
    
    commit_transaction
    log_success "Advanced package installation completed: ${packages[*]}" "apt-layer"
    return 0
}

# Check security policies
check_security_policies() {
    local packages=("$@")
    
    log_info "Checking security policies for packages: ${packages[*]}" "apt-layer"
    
    local security_policy="$ADVANCED_PKG_SECURITY_DIR/security-policy.json"
    
    if [[ ! -f "$security_policy" ]]; then
        log_warning "Security policy not found, using default policies" "apt-layer"
        return 0
    fi
    
    # Check package verification settings
    local gpg_check
    gpg_check=$(jq -r '.package_verification.gpg_check' "$security_policy" 2>/dev/null || echo "true")
    
    if [[ "$gpg_check" == "true" ]]; then
        log_info "GPG verification enabled" "apt-layer"
        # Perform comprehensive GPG verification
        for package in "${packages[@]}"; do
            if ! check_package_gpg_signature "$package"; then
                log_error "Package '$package' failed GPG signature verification" "apt-layer"
                return 1
            fi
        done
    fi
    
    # Check installation policies
    local allow_unsigned
    allow_unsigned=$(jq -r '.installation_policies.allow_unsigned_packages' "$security_policy" 2>/dev/null || echo "false")
    
    if [[ "$allow_unsigned" == "false" ]]; then
        log_info "Unsigned packages not allowed" "apt-layer"
        # Check for unsigned packages using enhanced signing verification
        for package in "${packages[@]}"; do
            if ! check_package_signing "$package"; then
                log_error "Package '$package' is not properly signed" "apt-layer"
                return 1
            fi
        done
    fi
    
    # Check package size limits
    local max_size
    max_size=$(jq -r '.installation_policies.max_package_size_mb' "$security_policy" 2>/dev/null || echo "1000")
    
    for package in "${packages[@]}"; do
        if ! check_package_size "$package" "$max_size"; then
            log_error "Package '$package' exceeds size limit of ${max_size}MB" "apt-layer"
            return 1
        fi
    done
    
    log_success "Security policy checks passed" "apt-layer"
    return 0
}

# Check package signature
check_package_signature() {
    local package="$1"
    
    if [[ -z "$package" ]]; then
        return 1
    fi
    
    # Check if package is signed (simplified check)
    local package_info
    package_info=$(apt-cache policy "$package" 2>/dev/null || echo "")
    
    if echo "$package_info" | grep -q "Signed-By"; then
        return 0
    fi
    
    return 1
}

# Check package GPG signature (comprehensive verification)
check_package_gpg_signature() {
    local package="$1"
    
    if [[ -z "$package" ]]; then
        return 1
    fi
    
    log_debug "Verifying GPG signature for package: $package" "apt-layer"
    
    # Check if GPG is available
    if ! command -v gpg &>/dev/null; then
        log_warning "GPG not available, skipping signature verification for: $package" "apt-layer"
        return 0
    fi
    
    # Get package source and key information
    local package_info
    package_info=$(apt-cache policy "$package" 2>/dev/null || echo "")
    
    # Check if package has a signed-by field
    local signed_by
    signed_by=$(echo "$package_info" | grep "Signed-By:" | cut -d: -f2 | tr -d ' ' || echo "")
    
    if [[ -z "$signed_by" ]]; then
        log_warning "Package '$package' has no Signed-By field" "apt-layer"
        return 1
    fi
    
    # Verify the GPG key exists and is trusted
    if ! gpg --list-keys "$signed_by" &>/dev/null; then
        log_warning "GPG key '$signed_by' for package '$package' not found in keyring" "apt-layer"
        return 1
    fi
    
    # Additional verification: check if the key is trusted
    local trust_level
    trust_level=$(gpg --list-keys --with-colons "$signed_by" 2>/dev/null | grep "^pub:" | cut -d: -f2 || echo "")
    
    if [[ "$trust_level" != "u" ]] && [[ "$trust_level" != "f" ]]; then
        log_warning "GPG key '$signed_by' for package '$package' is not fully trusted (trust level: $trust_level)" "apt-layer"
        return 1
    fi
    
    log_debug "GPG signature verification passed for package: $package" "apt-layer"
    return 0
}

# Check package signing (enhanced verification)
check_package_signing() {
    local package="$1"
    
    if [[ -z "$package" ]]; then
        return 1
    fi
    
    log_debug "Checking package signing for: $package" "apt-layer"
    
    # Check if debsig-verify is available for Debian package signing verification
    if command -v debsig-verify &>/dev/null; then
        # Get package file path (this would require downloading or finding the .deb file)
        local package_file
        package_file=$(find /var/cache/apt/archives -name "${package}*.deb" 2>/dev/null | head -1 || echo "")
        
        if [[ -n "$package_file" ]] && [[ -f "$package_file" ]]; then
            if debsig-verify "$package_file" &>/dev/null; then
                log_debug "Package signing verification passed for: $package" "apt-layer"
                return 0
            else
                log_warning "Package signing verification failed for: $package" "apt-layer"
                return 1
            fi
        fi
    fi
    
    # Fallback to basic signature check
    if check_package_signature "$package"; then
        log_debug "Basic package signature check passed for: $package" "apt-layer"
        return 0
    fi
    
    log_warning "Package signing verification failed for: $package" "apt-layer"
    return 1
}

# Check package size
check_package_size() {
    local package="$1"
    local max_size_mb="$2"
    
    if [[ -z "$package" ]] || [[ -z "$max_size_mb" ]]; then
        return 1
    fi
    
    # Get package size (simplified check)
    local package_size
    package_size=$(apt-cache show "$package" 2>/dev/null | grep "^Size:" | cut -d: -f2 | tr -d ' ' || echo "0")
    
    if [[ "$package_size" -gt $((max_size_mb * 1024 * 1024)) ]]; then
        return 1
    fi
    
    return 0
}

# Log package installation
log_package_installation() {
    local user="$1"
    shift
    local packages=("$@")
    
    local audit_log="$ADVANCED_PKG_SECURITY_DIR/audit.log"
    
    for package in "${packages[@]}"; do
        echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) - INSTALL - User: $user - Package: $package" >> "$audit_log"
    done
}

# Advanced package removal with dependency checking
advanced_remove_packages() {
    local packages=("$@")
    local user="${SUDO_USER:-$USER}"
    
    if [[ ${#packages[@]} -eq 0 ]]; then
        log_error "No packages specified for removal" "apt-layer"
        return 1
    fi
    
    log_info "Advanced package removal for packages: ${packages[*]}" "apt-layer"
    
    # Check user permissions
    if ! check_user_permissions "$user" "remove"; then
        return 1
    fi
    
    # Check for critical dependencies
    for package in "${packages[@]}"; do
        if check_critical_dependency "$package"; then
            log_warning "Package '$package' may be a critical dependency" "apt-layer"
            log_info "Manual verification recommended" "apt-layer"
        fi
    done
    
    # Start transaction
    start_transaction "advanced_remove_${packages[0]}"
    
    # Remove packages
    update_transaction_phase "removing_packages"
    log_info "Removing packages: ${packages[*]}" "apt-layer"
    if ! apt-get remove -y "${packages[@]}"; then
        log_error "Failed to remove packages: ${packages[*]}" "apt-layer"
        rollback_transaction
        return 1
    fi
    
    # Clean up
    apt-get autoremove -y
    apt-get clean
    
    # Log removal
    log_package_removal "$user" "${packages[@]}"
    
    commit_transaction
    log_success "Advanced package removal completed: ${packages[*]}" "apt-layer"
    return 0
}

# Check if package is a critical dependency
check_critical_dependency() {
    local package="$1"
    
    if [[ -z "$package" ]]; then
        return 1
    fi
    
    # List of critical system packages (simplified)
    local critical_packages=("systemd" "bash" "coreutils" "apt" "dpkg" "base-files" "ubuntu-minimal")
    
    for critical in "${critical_packages[@]}"; do
        if [[ "$package" == "$critical" ]]; then
            return 0
        fi
    done
    
    return 1
}

# Log package removal
log_package_removal() {
    local user="$1"
    shift
    local packages=("$@")
    
    local audit_log="$ADVANCED_PKG_SECURITY_DIR/audit.log"
    
    for package in "${packages[@]}"; do
        echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) - REMOVE - User: $user - Package: $package" >> "$audit_log"
    done
}

# Advanced package update with rollback capability
advanced_update_packages() {
    local packages=("$@")
    local user="${SUDO_USER:-$USER}"
    
    log_info "Advanced package update for packages: ${packages[*]}" "apt-layer"
    
    # Check user permissions
    if ! check_user_permissions "$user" "update"; then
        return 1
    fi
    
    # Create backup of current state
    local backup_id
    backup_id=$(create_package_backup "${packages[@]}")
    
    if [[ -z "$backup_id" ]]; then
        log_error "Failed to create package backup" "apt-layer"
        return 1
    fi
    
    log_info "Created backup: $backup_id" "apt-layer"
    
    # Start transaction
    start_transaction "advanced_update_${packages[0]}"
    
    # Update package lists
    update_transaction_phase "updating_package_lists"
    log_info "Updating package lists" "apt-layer"
    if ! apt-get update; then
        log_error "Failed to update package lists" "apt-layer"
        rollback_transaction
        return 1
    fi
    
    # Update packages
    update_transaction_phase "updating_packages"
    log_info "Updating packages: ${packages[*]}" "apt-layer"
    if ! apt-get upgrade -y "${packages[@]}"; then
        log_error "Failed to update packages: ${packages[*]}" "apt-layer"
        log_info "Rolling back to backup: $backup_id" "apt-layer"
        restore_package_backup "$backup_id"
        rollback_transaction
        return 1
    fi
    
    # Log update
    log_package_update "$user" "${packages[@]}"
    
    commit_transaction
    log_success "Advanced package update completed: ${packages[*]}" "apt-layer"
    return 0
}

# Create package backup
create_package_backup() {
    local packages=("$@")
    local backup_id="backup-$(date +%Y%m%d-%H%M%S)-$$"
    local backup_dir="$ADVANCED_PKG_STATE_DIR/backups/$backup_id"
    
    mkdir -p "$backup_dir"
    
    log_info "Creating comprehensive package backup: $backup_id" "apt-layer"
    
    # Save package states
    for package in "${packages[@]}"; do
        dpkg -l "$package" > "$backup_dir/${package}.state" 2>/dev/null || true
    done
    
    # Save complete package list
    dpkg -l | grep -E "^ii" > "$backup_dir/installed-packages.list" 2>/dev/null || true
    
    # Save package configuration
    dpkg --get-selections > "$backup_dir/package-selections.list" 2>/dev/null || true
    
    # Save repository information
    cp /etc/apt/sources.list "$backup_dir/sources.list" 2>/dev/null || true
    cp -r /etc/apt/sources.list.d "$backup_dir/" 2>/dev/null || true
    
    # Save GPG key information
    apt-key list > "$backup_dir/apt-keys.list" 2>/dev/null || true
    
    # Create backup metadata
    cat > "$backup_dir/backup-metadata.json" << EOF
{
    "backup_id": "$backup_id",
    "created_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "created_by": "$(whoami)",
    "packages": $(printf '%s\n' "${packages[@]}" | jq -R . | jq -s .),
    "system_info": {
        "hostname": "$(hostname)",
        "distribution": "$(lsb_release -d | cut -f2 2>/dev/null || echo 'unknown')",
        "kernel": "$(uname -r)"
    }
}
EOF
    
    # Compress backup for storage efficiency
    tar -czf "$backup_dir.tar.gz" -C "$ADVANCED_PKG_STATE_DIR/backups" "$backup_id" 2>/dev/null || true
    
    log_success "Package backup created: $backup_id" "apt-layer"
    echo "$backup_id"
}

# Restore package backup
restore_package_backup() {
    local backup_id="$1"
    local backup_dir="$ADVANCED_PKG_STATE_DIR/backups/$backup_id"
    local backup_archive="$backup_dir.tar.gz"
    
    # Check if backup exists (try both directory and compressed archive)
    if [[ ! -d "$backup_dir" ]] && [[ ! -f "$backup_archive" ]]; then
        log_error "Backup not found: $backup_id" "apt-layer"
        return 1
    fi
    
    log_info "Restoring from backup: $backup_id" "apt-layer"
    
    # Extract compressed backup if needed
    if [[ -f "$backup_archive" ]] && [[ ! -d "$backup_dir" ]]; then
        log_info "Extracting compressed backup..." "apt-layer"
        tar -xzf "$backup_archive" -C "$ADVANCED_PKG_STATE_DIR/backups/" 2>/dev/null || {
            log_error "Failed to extract backup archive: $backup_archive" "apt-layer"
            return 1
        }
    fi
    
    # Verify backup integrity
    if [[ ! -f "$backup_dir/backup-metadata.json" ]]; then
        log_error "Backup metadata not found, backup may be corrupted: $backup_id" "apt-layer"
        return 1
    fi
    
    # Read backup metadata
    local backup_metadata
    backup_metadata=$(cat "$backup_dir/backup-metadata.json" 2>/dev/null || echo "{}")
    local backup_packages
    backup_packages=$(echo "$backup_metadata" | jq -r '.packages[]?' 2>/dev/null || echo "")
    
    log_info "Backup contains $(echo "$backup_packages" | wc -l) packages" "apt-layer"
    
    # Restore package selections if available
    if [[ -f "$backup_dir/package-selections.list" ]]; then
        log_info "Restoring package selections..." "apt-layer"
        dpkg --set-selections < "$backup_dir/package-selections.list" 2>/dev/null || {
            log_warning "Failed to restore package selections" "apt-layer"
        }
    fi
    
    # Restore repository information if available
    if [[ -f "$backup_dir/sources.list" ]]; then
        log_info "Restoring repository configuration..." "apt-layer"
        cp "$backup_dir/sources.list" /etc/apt/sources.list 2>/dev/null || {
            log_warning "Failed to restore sources.list" "apt-layer"
        }
    fi
    
    if [[ -d "$backup_dir/sources.list.d" ]]; then
        cp -r "$backup_dir/sources.list.d"/* /etc/apt/sources.list.d/ 2>/dev/null || {
            log_warning "Failed to restore sources.list.d" "apt-layer"
        }
    fi
    
    # Update package lists after repository restoration
    apt-get update 2>/dev/null || {
        log_warning "Failed to update package lists after repository restoration" "apt-layer"
    }
    
    log_success "Backup restoration completed: $backup_id" "apt-layer"
    log_audit "BACKUP_RESTORE" "Restored from backup: $backup_id"
    return 0
}

# Log package update
log_package_update() {
    local user="$1"
    shift
    local packages=("$@")
    
    local audit_log="$ADVANCED_PKG_SECURITY_DIR/audit.log"
    
    for package in "${packages[@]}"; do
        echo "$(date -u +%Y-%m-%dT%H:%M:%SZ) - UPDATE - User: $user - Package: $package" >> "$audit_log"
    done
}

# List package backups
list_package_backups() {
    log_info "Listing package backups" "apt-layer"
    
    local backups_dir="$ADVANCED_PKG_STATE_DIR/backups"
    
    if [[ ! -d "$backups_dir" ]]; then
        log_info "No backups directory found" "apt-layer"
        return 0
    fi
    
    echo "=== Package Backups ==="
    
    local backups
    backups=$(find "$backups_dir" -name "backup-*" -type d 2>/dev/null | sort -r || echo "")
    
    if [[ -n "$backups" ]]; then
        for backup_dir in $backups; do
            local backup_id
            backup_id=$(basename "$backup_dir")
            local metadata_file="$backup_dir/backup-metadata.json"
            
            if [[ -f "$metadata_file" ]]; then
                local created_at
                created_at=$(jq -r '.created_at // "unknown"' "$metadata_file" 2>/dev/null || echo "unknown")
                local created_by
                created_by=$(jq -r '.created_by // "unknown"' "$metadata_file" 2>/dev/null || echo "unknown")
                local package_count
                package_count=$(jq -r '.packages | length // 0' "$metadata_file" 2>/dev/null || echo "0")
                
                echo "  $backup_id: $package_count packages, created by $created_by at $created_at"
            else
                echo "  $backup_id: (metadata not available)"
            fi
        done
    else
        log_info "No backups found" "apt-layer"
    fi
    
    echo ""
}

# Clean up old backups
cleanup_old_backups() {
    local max_age_days="${1:-30}"
    
    log_info "Cleaning up backups older than $max_age_days days" "apt-layer"
    
    local backups_dir="$ADVANCED_PKG_STATE_DIR/backups"
    
    if [[ ! -d "$backups_dir" ]]; then
        log_info "No backups directory found" "apt-layer"
        return 0
    fi
    
    local removed_count=0
    
    # Find and remove old backup directories
    while IFS= read -r -d '' backup_dir; do
        local backup_id
        backup_id=$(basename "$backup_dir")
        local metadata_file="$backup_dir/backup-metadata.json"
        
        if [[ -f "$metadata_file" ]]; then
            local created_at
            created_at=$(jq -r '.created_at // ""' "$metadata_file" 2>/dev/null || echo "")
            
            if [[ -n "$created_at" ]]; then
                local created_timestamp
                created_timestamp=$(date -d "$created_at" +%s 2>/dev/null || echo "0")
                local current_timestamp
                current_timestamp=$(date +%s)
                local age_days
                age_days=$(( (current_timestamp - created_timestamp) / 86400 ))
                
                if [[ $age_days -gt $max_age_days ]]; then
                    log_info "Removing old backup: $backup_id (age: ${age_days} days)" "apt-layer"
                    rm -rf "$backup_dir" 2>/dev/null || true
                    rm -f "$backup_dir.tar.gz" 2>/dev/null || true
                    ((removed_count++))
                fi
            fi
        fi
    done < <(find "$backups_dir" -name "backup-*" -type d -print0 2>/dev/null)
    
    log_success "Cleaned up $removed_count old backups" "apt-layer"
    return 0
}

# Get advanced package information
get_advanced_package_info() {
    local package="$1"
    
    if [[ -z "$package" ]]; then
        log_error "Package name required" "apt-layer"
        return 1
    fi
    
    log_info "Getting advanced information for package: $package" "apt-layer"
    
    echo "=== Advanced Package Information: $package ==="
    
    # Basic package information
    echo "Basic Information:"
    apt-cache show "$package" 2>/dev/null | grep -E "^(Package|Version|Architecture|Maintainer|Description)" | head -10
    
    # Dependencies
    echo ""
    echo "Dependencies:"
    apt-cache depends "$package" 2>/dev/null | grep -E "^(Depends|Recommends|Suggests)" | head -5
    
    # Reverse dependencies
    echo ""
    echo "Reverse Dependencies:"
    apt-cache rdepends "$package" 2>/dev/null | grep -v "^Reverse Depends" | head -5
    
    # Security information
    echo ""
    echo "Security Information:"
    if check_package_signature "$package"; then
        echo "  â Package is signed"
    else
        echo "  â Package is not signed"
    fi
    
    # Size information
    local package_size
    package_size=$(apt-cache show "$package" 2>/dev/null | grep "^Size:" | cut -d: -f2 | tr -d ' ' || echo "unknown")
    echo "  Size: $package_size bytes"
    
    echo ""
}

# List advanced package management status
list_advanced_package_status() {
    log_info "Listing advanced package management status" "apt-layer"
    
    echo "=== Advanced Package Management Status ==="
    
    # User management status
    echo "User Management:"
    local user_count
    user_count=$(jq '.users | length' "$ADVANCED_PKG_USERS_DIR/users.json" 2>/dev/null || echo "0")
    echo "  Active users: $user_count"
    
    # Security policy status
    echo ""
    echo "Security Policies:"
    local security_policy="$ADVANCED_PKG_SECURITY_DIR/security-policy.json"
    if [[ -f "$security_policy" ]]; then
        local gpg_check
        gpg_check=$(jq -r '.package_verification.gpg_check' "$security_policy" 2>/dev/null || echo "unknown")
        echo "  GPG verification: $gpg_check"
        
        local audit_logging
        audit_logging=$(jq -r '.audit_logging.enabled' "$security_policy" 2>/dev/null || echo "unknown")
        echo "  Audit logging: $audit_logging"
    else
        echo "  Security policies: not configured"
    fi
    
    # Dependency cache status
    echo ""
    echo "Dependency Cache:"
    local dep_cache="$ADVANCED_PKG_DEPENDENCIES_DIR/dependency-cache.json"
    if [[ -f "$dep_cache" ]]; then
        local last_updated
        last_updated=$(jq -r '.last_updated' "$dep_cache" 2>/dev/null || echo "unknown")
        echo "  Last updated: $last_updated"
    else
        echo "  Dependency cache: not initialized"
    fi
    
    # Audit log status
    echo ""
    echo "Audit Log:"
    local audit_log="$ADVANCED_PKG_SECURITY_DIR/audit.log"
    if [[ -f "$audit_log" ]]; then
        local log_entries
        log_entries=$(wc -l < "$audit_log" 2>/dev/null || echo "0")
        echo "  Total entries: $log_entries"
        
        local recent_entries
        recent_entries=$(tail -10 "$audit_log" 2>/dev/null | wc -l || echo "0")
        echo "  Recent entries: $recent_entries"
    else
        echo "  Audit log: not available"
    fi
    
    echo ""
}

# =============================================================================
# INTEGRATION FUNCTIONS
# =============================================================================

# Initialize advanced package management on script startup
init_advanced_package_management_on_startup() {
    # Only initialize if not already done
    if [[ ! -d "$ADVANCED_PKG_STATE_DIR" ]]; then
        init_advanced_package_management
    fi
}

# Cleanup advanced package management on script exit
cleanup_advanced_package_management_on_exit() {
    # Clean up temporary files
    rm -f "$ADVANCED_PKG_CACHE_DIR"/temp-* 2>/dev/null || true
    rm -f "$ADVANCED_PKG_CACHE_DIR"/resolved-* 2>/dev/null || true
}

# Register cleanup function
trap cleanup_advanced_package_management_on_exit EXIT 

# --- END OF SCRIPTLET: 08-advanced-package-management.sh ---

# ============================================================================
# Layer Signing & Verification (Enterprise Security)
# ============================================================================

# Ubuntu uBlue apt-layer Layer Signing & Verification
# Provides enterprise-grade layer signing and verification for immutable deployments
# Supports Sigstore (cosign) for modern OCI-compatible signing and GPG for traditional workflows

# =============================================================================
# LAYER SIGNING & VERIFICATION FUNCTIONS
# =============================================================================

# Layer signing configuration (with fallbacks for when particle-config.sh is not loaded)
LAYER_SIGNING_CONFIG_DIR="${UBLUE_CONFIG_DIR:-/etc/ubuntu-ublue}/layer-signing"
LAYER_SIGNING_STATE_DIR="${UBLUE_ROOT:-/var/lib/particle-os}/layer-signing"
LAYER_SIGNING_KEYS_DIR="$LAYER_SIGNING_STATE_DIR/keys"
LAYER_SIGNING_SIGNATURES_DIR="$LAYER_SIGNING_STATE_DIR/signatures"
LAYER_SIGNING_VERIFICATION_DIR="$LAYER_SIGNING_STATE_DIR/verification"
LAYER_SIGNING_REVOCATION_DIR="$LAYER_SIGNING_STATE_DIR/revocation"

# Signing configuration
LAYER_SIGNING_ENABLED="${LAYER_SIGNING_ENABLED:-true}"
LAYER_SIGNING_METHOD="${LAYER_SIGNING_METHOD:-sigstore}"  # sigstore, gpg, both
LAYER_SIGNING_VERIFY_ON_IMPORT="${LAYER_SIGNING_VERIFY_ON_IMPORT:-true}"
LAYER_SIGNING_VERIFY_ON_MOUNT="${LAYER_SIGNING_VERIFY_ON_MOUNT:-true}"
LAYER_SIGNING_VERIFY_ON_ACTIVATE="${LAYER_SIGNING_VERIFY_ON_ACTIVATE:-true}"
LAYER_SIGNING_FAIL_ON_VERIFY="${LAYER_SIGNING_FAIL_ON_VERIFY:-true}"

# Initialize layer signing system
init_layer_signing() {
    log_info "Initializing layer signing and verification system" "apt-layer"
    
    # Create layer signing directories
    mkdir -p "$LAYER_SIGNING_CONFIG_DIR" "$LAYER_SIGNING_STATE_DIR" "$LAYER_SIGNING_KEYS_DIR"
    mkdir -p "$LAYER_SIGNING_SIGNATURES_DIR" "$LAYER_SIGNING_VERIFICATION_DIR" "$LAYER_SIGNING_REVOCATION_DIR"
    
    # Set proper permissions
    chmod 755 "$LAYER_SIGNING_CONFIG_DIR" "$LAYER_SIGNING_STATE_DIR"
    chmod 700 "$LAYER_SIGNING_KEYS_DIR" "$LAYER_SIGNING_SIGNATURES_DIR"
    chmod 750 "$LAYER_SIGNING_VERIFICATION_DIR" "$LAYER_SIGNING_REVOCATION_DIR"
    
    # Initialize signing configuration
    init_signing_config
    
    # Initialize key management
    init_key_management
    
    # Initialize revocation system
    init_revocation_system
    
    # Check signing tools availability
    check_signing_tools
    
    log_success "Layer signing and verification system initialized" "apt-layer"
}

# Initialize signing configuration
init_signing_config() {
    local config_file="$LAYER_SIGNING_CONFIG_DIR/signing-config.json"
    
    if [[ ! -f "$config_file" ]]; then
        cat > "$config_file" << EOF
{
    "signing": {
        "enabled": true,
        "method": "sigstore",
        "verify_on_import": true,
        "verify_on_mount": true,
        "verify_on_activate": true,
        "fail_on_verify": true
    },
    "sigstore": {
        "enabled": true,
        "keyless": false,
        "fulcio_url": "https://fulcio.sigstore.dev",
        "rekor_url": "https://rekor.sigstore.dev",
        "tuf_url": "https://tuf.sigstore.dev"
    },
    "gpg": {
        "enabled": true,
        "keyring": "/etc/apt/trusted.gpg",
        "signing_key": "",
        "verification_keys": []
    },
    "key_management": {
        "local_keys": true,
        "hsm_support": false,
        "remote_key_service": false,
        "key_rotation_days": 365
    },
    "revocation": {
        "enabled": true,
        "check_revocation": true,
        "revocation_list_url": "",
        "local_revocation_list": true
    }
}
EOF
        chmod 600 "$config_file"
    fi
}

# Initialize key management
init_key_management() {
    local key_db="$LAYER_SIGNING_KEYS_DIR/keys.json"
    
    if [[ ! -f "$key_db" ]]; then
        cat > "$key_db" << EOF
{
    "keys": {},
    "key_pairs": {},
    "public_keys": {},
    "key_metadata": {},
    "last_updated": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
}
EOF
        chmod 600 "$key_db"
    fi
}

# Initialize revocation system
init_revocation_system() {
    local revocation_list="$LAYER_SIGNING_REVOCATION_DIR/revocation-list.json"
    
    if [[ ! -f "$revocation_list" ]]; then
        cat > "$revocation_list" << EOF
{
    "revoked_keys": {},
    "revoked_signatures": {},
    "revoked_layers": {},
    "revocation_reasons": {},
    "last_updated": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
}
EOF
        chmod 600 "$revocation_list"
    fi
}

# Check signing tools availability
check_signing_tools() {
    log_info "Checking signing tools availability" "apt-layer"
    
    local tools_available=true
    
    # Check for cosign (Sigstore)
    if ! command -v cosign &>/dev/null; then
        log_warning "cosign (Sigstore) not found - Sigstore signing will be disabled" "apt-layer"
        LAYER_SIGNING_METHOD="gpg"
    else
        log_info "cosign (Sigstore) found: $(cosign version 2>/dev/null | head -1 || echo 'version unknown')" "apt-layer"
    fi
    
    # Check for GPG
    if ! command -v gpg &>/dev/null; then
        log_warning "GPG not found - GPG signing will be disabled" "apt-layer"
        if [[ "$LAYER_SIGNING_METHOD" == "gpg" ]]; then
            LAYER_SIGNING_METHOD="sigstore"
        fi
    else
        log_info "GPG found: $(gpg --version | head -1)" "apt-layer"
    fi
    
    # Check if any signing method is available
    if [[ "$LAYER_SIGNING_METHOD" == "both" ]] && ! command -v cosign &>/dev/null && ! command -v gpg &>/dev/null; then
        log_error "No signing tools available - layer signing will be disabled" "apt-layer"
        LAYER_SIGNING_ENABLED=false
        return 1
    fi
    
    return 0
}

# Generate signing key pair
generate_signing_key_pair() {
    local key_name="$1"
    local key_type="${2:-sigstore}"
    
    if [[ -z "$key_name" ]]; then
        log_error "Key name required for key pair generation" "apt-layer"
        return 1
    fi
    
    log_info "Generating signing key pair: $key_name (type: $key_type)" "apt-layer"
    
    case "$key_type" in
        "sigstore")
            generate_sigstore_key_pair "$key_name"
            ;;
        "gpg")
            generate_gpg_key_pair "$key_name"
            ;;
        *)
            log_error "Unsupported key type: $key_type" "apt-layer"
            return 1
            ;;
    esac
}

# Generate Sigstore key pair
generate_sigstore_key_pair() {
    local key_name="$1"
    local key_dir="$LAYER_SIGNING_KEYS_DIR/sigstore/$key_name"
    
    mkdir -p "$key_dir"
    
    log_info "Generating Sigstore key pair for: $key_name" "apt-layer"
    
    # Generate cosign key pair
    if cosign generate-key-pair --output-key-prefix "$key_dir/key" 2>/dev/null; then
        # Store key metadata
        local key_db="$LAYER_SIGNING_KEYS_DIR/keys.json"
        local key_id
        key_id=$(cosign public-key --key "$key_dir/key.key" 2>/dev/null | sha256sum | cut -d' ' -f1 || echo "unknown")
        
        jq --arg name "$key_name" \
           --arg type "sigstore" \
           --arg public_key "$key_dir/key.pub" \
           --arg private_key "$key_dir/key.key" \
           --arg key_id "$key_id" \
           --arg created "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
           '.key_pairs[$name] = {
               "type": $type,
               "public_key": $public_key,
               "private_key": $private_key,
               "key_id": $key_id,
               "created": $created,
               "status": "active"
           }' "$key_db" > "$key_db.tmp" && mv "$key_db.tmp" "$key_db"
        
        chmod 600 "$key_dir/key.key"
        chmod 644 "$key_dir/key.pub"
        
        log_success "Sigstore key pair generated: $key_name" "apt-layer"
        return 0
    else
        log_error "Failed to generate Sigstore key pair: $key_name" "apt-layer"
        return 1
    fi
}

# Generate GPG key pair
generate_gpg_key_pair() {
    local key_name="$1"
    local key_dir="$LAYER_SIGNING_KEYS_DIR/gpg/$key_name"
    
    mkdir -p "$key_dir"
    
    log_info "Generating GPG key pair for: $key_name" "apt-layer"
    
    # Create GPG key configuration
    cat > "$key_dir/key-config" << EOF
Key-Type: RSA
Key-Length: 4096
Name-Real: apt-layer signing key
Name-Email: apt-layer@$(hostname)
Name-Comment: $key_name
Expire-Date: 2y
%commit
EOF
    
    # Generate GPG key
    if gpg --batch --gen-key "$key_dir/key-config" 2>/dev/null; then
        # Export public key
        gpg --armor --export apt-layer@$(hostname) > "$key_dir/public.key" 2>/dev/null
        
        # Get key fingerprint
        local key_fingerprint
        key_fingerprint=$(gpg --fingerprint apt-layer@$(hostname) 2>/dev/null | grep "Key fingerprint" | sed 's/.*= //' | tr -d ' ')
        
        # Store key metadata
        local key_db="$LAYER_SIGNING_KEYS_DIR/keys.json"
        
        jq --arg name "$key_name" \
           --arg type "gpg" \
           --arg public_key "$key_dir/public.key" \
           --arg key_id "$key_fingerprint" \
           --arg email "apt-layer@$(hostname)" \
           --arg created "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
           '.key_pairs[$name] = {
               "type": $type,
               "public_key": $public_key,
               "key_id": $key_id,
               "email": $email,
               "created": $created,
               "status": "active"
           }' "$key_db" > "$key_db.tmp" && mv "$key_db.tmp" "$key_db"
        
        chmod 600 "$key_dir/key-config"
        chmod 644 "$key_dir/public.key"
        
        log_success "GPG key pair generated: $key_name" "apt-layer"
        return 0
    else
        log_error "Failed to generate GPG key pair: $key_name" "apt-layer"
        return 1
    fi
}

# Sign layer with specified method
sign_layer() {
    local layer_path="$1"
    local key_name="$2"
    local signing_method="${3:-$LAYER_SIGNING_METHOD}"
    
    if [[ -z "$layer_path" ]] || [[ -z "$key_name" ]]; then
        log_error "Layer path and key name required for signing" "apt-layer"
        return 1
    fi
    
    if [[ ! -f "$layer_path" ]]; then
        log_error "Layer file not found: $layer_path" "apt-layer"
        return 1
    fi
    
    log_info "Signing layer: $layer_path with key: $key_name (method: $signing_method)" "apt-layer"
    
    case "$signing_method" in
        "sigstore")
            sign_layer_sigstore "$layer_path" "$key_name"
            ;;
        "gpg")
            sign_layer_gpg "$layer_path" "$key_name"
            ;;
        "both")
            sign_layer_sigstore "$layer_path" "$key_name" && \
            sign_layer_gpg "$layer_path" "$key_name"
            ;;
        *)
            log_error "Unsupported signing method: $signing_method" "apt-layer"
            return 1
            ;;
    esac
}

# Sign layer with Sigstore
sign_layer_sigstore() {
    local layer_path="$1"
    local key_name="$2"
    local key_dir="$LAYER_SIGNING_KEYS_DIR/sigstore/$key_name"
    local signature_path="$layer_path.sig"
    
    if [[ ! -f "$key_dir/key.key" ]]; then
        log_error "Sigstore private key not found: $key_dir/key.key" "apt-layer"
        return 1
    fi
    
    log_info "Signing layer with Sigstore: $layer_path" "apt-layer"
    
    # Sign the layer
    if cosign sign-blob --key "$key_dir/key.key" --output-signature "$signature_path" "$layer_path" 2>/dev/null; then
        # Store signature metadata
        local signature_db="$LAYER_SIGNING_SIGNATURES_DIR/signatures.json"
        
        if [[ ! -f "$signature_db" ]]; then
            cat > "$signature_db" << EOF
{
    "signatures": {},
    "last_updated": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
}
EOF
        fi
        
        local layer_hash
        layer_hash=$(sha256sum "$layer_path" | cut -d' ' -f1)
        
        jq --arg layer "$layer_path" \
           --arg signature "$signature_path" \
           --arg method "sigstore" \
           --arg key_name "$key_name" \
           --arg layer_hash "$layer_hash" \
           --arg signed_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
           '.signatures[$layer] = {
               "signature_file": $signature,
               "method": $method,
               "key_name": $key_name,
               "layer_hash": $layer_hash,
               "signed_at": $signed_at,
               "status": "valid"
           }' "$signature_db" > "$signature_db.tmp" && mv "$signature_db.tmp" "$signature_db"
        
        log_success "Layer signed with Sigstore: $layer_path" "apt-layer"
        return 0
    else
        log_error "Failed to sign layer with Sigstore: $layer_path" "apt-layer"
        return 1
    fi
}

# Sign layer with GPG
sign_layer_gpg() {
    local layer_path="$1"
    local key_name="$2"
    local signature_path="$layer_path.sig"
    
    log_info "Signing layer with GPG: $layer_path" "apt-layer"
    
    # Sign the layer
    if gpg --detach-sign --armor --output "$signature_path" "$layer_path" 2>/dev/null; then
        # Store signature metadata
        local signature_db="$LAYER_SIGNING_SIGNATURES_DIR/signatures.json"
        
        if [[ ! -f "$signature_db" ]]; then
            cat > "$signature_db" << EOF
{
    "signatures": {},
    "last_updated": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
}
EOF
        fi
        
        local layer_hash
        layer_hash=$(sha256sum "$layer_path" | cut -d' ' -f1)
        
        jq --arg layer "$layer_path" \
           --arg signature "$signature_path" \
           --arg method "gpg" \
           --arg key_name "$key_name" \
           --arg layer_hash "$layer_hash" \
           --arg signed_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
           '.signatures[$layer] = {
               "signature_file": $signature,
               "method": $method,
               "key_name": $key_name,
               "layer_hash": $layer_hash,
               "signed_at": $signed_at,
               "status": "valid"
           }' "$signature_db" > "$signature_db.tmp" && mv "$signature_db.tmp" "$signature_db"
        
        log_success "Layer signed with GPG: $layer_path" "apt-layer"
        return 0
    else
        log_error "Failed to sign layer with GPG: $layer_path" "apt-layer"
        return 1
    fi
}

# Verify layer signature
verify_layer_signature() {
    local layer_path="$1"
    local signature_path="$2"
    local verification_method="${3:-auto}"
    
    if [[ -z "$layer_path" ]] || [[ -z "$signature_path" ]]; then
        log_error "Layer path and signature path required for verification" "apt-layer"
        return 1
    fi
    
    if [[ ! -f "$layer_path" ]]; then
        log_error "Layer file not found: $layer_path" "apt-layer"
        return 1
    fi
    
    if [[ ! -f "$signature_path" ]]; then
        log_error "Signature file not found: $signature_path" "apt-layer"
        return 1
    fi
    
    log_info "Verifying layer signature: $layer_path" "apt-layer"
    
    # Auto-detect verification method
    if [[ "$verification_method" == "auto" ]]; then
        if [[ "$signature_path" == *.sig ]] && head -1 "$signature_path" | grep -q "-----BEGIN PGP SIGNATURE-----"; then
            verification_method="gpg"
        else
            verification_method="sigstore"
        fi
    fi
    
    case "$verification_method" in
        "sigstore")
            verify_layer_sigstore "$layer_path" "$signature_path"
            ;;
        "gpg")
            verify_layer_gpg "$layer_path" "$signature_path"
            ;;
        *)
            log_error "Unsupported verification method: $verification_method" "apt-layer"
            return 1
            ;;
    esac
}

# Verify layer with Sigstore
verify_layer_sigstore() {
    local layer_path="$1"
    local signature_path="$2"
    local key_dir="$LAYER_SIGNING_KEYS_DIR/sigstore"
    
    log_info "Verifying layer with Sigstore: $layer_path" "apt-layer"
    
    # Find the public key
    local public_key=""
    for key_name in "$key_dir"/*/key.pub; do
        if [[ -f "$key_name" ]]; then
            public_key="$key_name"
            break
        fi
    done
    
    if [[ -z "$public_key" ]]; then
        log_error "No Sigstore public key found for verification" "apt-layer"
        return 1
    fi
    
    # Verify the signature
    if cosign verify-blob --key "$public_key" --signature "$signature_path" "$layer_path" 2>/dev/null; then
        log_success "Layer signature verified with Sigstore: $layer_path" "apt-layer"
        return 0
    else
        log_error "Layer signature verification failed with Sigstore: $layer_path" "apt-layer"
        return 1
    fi
}

# Verify layer with GPG
verify_layer_gpg() {
    local layer_path="$1"
    local signature_path="$2"
    
    log_info "Verifying layer with GPG: $layer_path" "apt-layer"
    
    # Verify the signature
    if gpg --verify "$signature_path" "$layer_path" 2>/dev/null; then
        log_success "Layer signature verified with GPG: $layer_path" "apt-layer"
        return 0
    else
        log_error "Layer signature verification failed with GPG: $layer_path" "apt-layer"
        return 1
    fi
}

# Check if layer is revoked
check_layer_revocation() {
    local layer_path="$1"
    
    if [[ -z "$layer_path" ]]; then
        return 1
    fi
    
    local revocation_list="$LAYER_SIGNING_REVOCATION_DIR/revocation-list.json"
    
    if [[ ! -f "$revocation_list" ]]; then
        return 1
    fi
    
    local layer_hash
    layer_hash=$(sha256sum "$layer_path" 2>/dev/null | cut -d' ' -f1 || echo "")
    
    if [[ -n "$layer_hash" ]]; then
        if jq -e ".revoked_layers[\"$layer_hash\"]" "$revocation_list" >/dev/null 2>&1; then
            log_warning "Layer is revoked: $layer_path" "apt-layer"
            return 0
        fi
    fi
    
    return 1
}

# Revoke layer
revoke_layer() {
    local layer_path="$1"
    local reason="${2:-Manual revocation}"
    
    if [[ -z "$layer_path" ]]; then
        log_error "Layer path required for revocation" "apt-layer"
        return 1
    fi
    
    if [[ ! -f "$layer_path" ]]; then
        log_error "Layer file not found: $layer_path" "apt-layer"
        return 1
    fi
    
    log_info "Revoking layer: $layer_path" "apt-layer"
    
    local revocation_list="$LAYER_SIGNING_REVOCATION_DIR/revocation-list.json"
    local layer_hash
    layer_hash=$(sha256sum "$layer_path" | cut -d' ' -f1)
    
    jq --arg layer_hash "$layer_hash" \
       --arg reason "$reason" \
       --arg revoked_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
       '.revoked_layers[$layer_hash] = {
           "reason": $reason,
           "revoked_at": $revoked_at,
           "revoked_by": "'$(whoami)'"
       }' "$revocation_list" > "$revocation_list.tmp" && mv "$revocation_list.tmp" "$revocation_list"
    
    log_success "Layer revoked: $layer_path" "apt-layer"
    return 0
}

# List signing keys
list_signing_keys() {
    log_info "Listing signing keys" "apt-layer"
    
    local key_db="$LAYER_SIGNING_KEYS_DIR/keys.json"
    
    if [[ ! -f "$key_db" ]]; then
        log_error "Key database not found" "apt-layer"
        return 1
    fi
    
    echo "=== Signing Keys ==="
    
    local keys
    keys=$(jq -r '.key_pairs | to_entries[] | "\(.key): \(.value.type) - \(.value.key_id) (\(.value.status))"' "$key_db" 2>/dev/null || echo "")
    
    if [[ -n "$keys" ]]; then
        echo "$keys" | while read -r key_info; do
            echo "  $key_info"
        done
    else
        log_info "No signing keys found" "apt-layer"
    fi
    
    echo ""
}

# List layer signatures
list_layer_signatures() {
    log_info "Listing layer signatures" "apt-layer"
    
    local signature_db="$LAYER_SIGNING_SIGNATURES_DIR/signatures.json"
    
    if [[ ! -f "$signature_db" ]]; then
        log_error "Signature database not found" "apt-layer"
        return 1
    fi
    
    echo "=== Layer Signatures ==="
    
    local signatures
    signatures=$(jq -r '.signatures | to_entries[] | "\(.key): \(.value.method) - \(.value.key_name) (\(.value.status))"' "$signature_db" 2>/dev/null || echo "")
    
    if [[ -n "$signatures" ]]; then
        echo "$signatures" | while read -r sig_info; do
            echo "  $sig_info"
        done
    else
        log_info "No layer signatures found" "apt-layer"
    fi
    
    echo ""
}

# Get layer signing status
get_layer_signing_status() {
    local layer_path="$1"
    
    if [[ -z "$layer_path" ]]; then
        log_error "Layer path required for status check" "apt-layer"
        return 1
    fi
    
    log_info "Getting signing status for layer: $layer_path" "apt-layer"
    
    echo "=== Layer Signing Status: $layer_path ==="
    
    # Check if layer exists
    if [[ ! -f "$layer_path" ]]; then
        echo "  â Layer file not found"
        return 1
    fi
    
    echo "  â Layer file exists"
    
    # Check for signatures
    local signature_db="$LAYER_SIGNING_SIGNATURES_DIR/signatures.json"
    if [[ -f "$signature_db" ]]; then
        local signature_info
        signature_info=$(jq -r ".signatures[\"$layer_path\"] // empty" "$signature_db" 2>/dev/null)
        
        if [[ -n "$signature_info" ]]; then
            local method
            method=$(echo "$signature_info" | jq -r '.method // "unknown"')
            local key_name
            key_name=$(echo "$signature_info" | jq -r '.key_name // "unknown"')
            local status
            status=$(echo "$signature_info" | jq -r '.status // "unknown"')
            local signed_at
            signed_at=$(echo "$signature_info" | jq -r '.signed_at // "unknown"')
            
            echo "  â Signed with $method using key: $key_name"
            echo "  â Signature status: $status"
            echo "  â Signed at: $signed_at"
        else
            echo "  â No signature found"
        fi
    else
        echo "  â Signature database not found"
    fi
    
    # Check for revocation
    if check_layer_revocation "$layer_path"; then
        echo "  â  Layer is revoked"
    else
        echo "  â Layer is not revoked"
    fi
    
    echo ""
}

# =============================================================================
# INTEGRATION FUNCTIONS
# =============================================================================

# Initialize layer signing on script startup
init_layer_signing_on_startup() {
    # Only initialize if not already done and signing is enabled
    if [[ "$LAYER_SIGNING_ENABLED" == "true" ]] && [[ ! -d "$LAYER_SIGNING_STATE_DIR" ]]; then
        init_layer_signing
    fi
}

# Verify layer before import
verify_layer_before_import() {
    local layer_path="$1"
    
    if [[ "$LAYER_SIGNING_VERIFY_ON_IMPORT" != "true" ]]; then
        return 0
    fi
    
    if [[ -z "$layer_path" ]]; then
        return 1
    fi
    
    log_info "Verifying layer before import: $layer_path" "apt-layer"
    
    # Check for revocation first
    if check_layer_revocation "$layer_path"; then
        if [[ "$LAYER_SIGNING_FAIL_ON_VERIFY" == "true" ]]; then
            log_error "Layer is revoked, import blocked: $layer_path" "apt-layer"
            return 1
        else
            log_warning "Layer is revoked but import allowed: $layer_path" "apt-layer"
        fi
    fi
    
    # Check for signature
    local signature_path="$layer_path.sig"
    if [[ -f "$signature_path" ]]; then
        if ! verify_layer_signature "$layer_path" "$signature_path"; then
            if [[ "$LAYER_SIGNING_FAIL_ON_VERIFY" == "true" ]]; then
                log_error "Layer signature verification failed, import blocked: $layer_path" "apt-layer"
                return 1
            else
                log_warning "Layer signature verification failed but import allowed: $layer_path" "apt-layer"
            fi
        fi
    else
        log_warning "No signature found for layer: $layer_path" "apt-layer"
    fi
    
    return 0
}

# Verify layer before mount
verify_layer_before_mount() {
    local layer_path="$1"
    
    if [[ "$LAYER_SIGNING_VERIFY_ON_MOUNT" != "true" ]]; then
        return 0
    fi
    
    if [[ -z "$layer_path" ]]; then
        return 1
    fi
    
    log_info "Verifying layer before mount: $layer_path" "apt-layer"
    
    # Check for revocation
    if check_layer_revocation "$layer_path"; then
        if [[ "$LAYER_SIGNING_FAIL_ON_VERIFY" == "true" ]]; then
            log_error "Layer is revoked, mount blocked: $layer_path" "apt-layer"
            return 1
        else
            log_warning "Layer is revoked but mount allowed: $layer_path" "apt-layer"
        fi
    fi
    
    # Check for signature
    local signature_path="$layer_path.sig"
    if [[ -f "$signature_path" ]]; then
        if ! verify_layer_signature "$layer_path" "$signature_path"; then
            if [[ "$LAYER_SIGNING_FAIL_ON_VERIFY" == "true" ]]; then
                log_error "Layer signature verification failed, mount blocked: $layer_path" "apt-layer"
                return 1
            else
                log_warning "Layer signature verification failed but mount allowed: $layer_path" "apt-layer"
            fi
        fi
    else
        log_warning "No signature found for layer: $layer_path" "apt-layer"
    fi
    
    return 0
}

# Verify layer before activation
verify_layer_before_activation() {
    local layer_path="$1"
    
    if [[ "$LAYER_SIGNING_VERIFY_ON_ACTIVATE" != "true" ]]; then
        return 0
    fi
    
    if [[ -z "$layer_path" ]]; then
        return 1
    fi
    
    log_info "Verifying layer before activation: $layer_path" "apt-layer"
    
    # Check for revocation
    if check_layer_revocation "$layer_path"; then
        if [[ "$LAYER_SIGNING_FAIL_ON_VERIFY" == "true" ]]; then
            log_error "Layer is revoked, activation blocked: $layer_path" "apt-layer"
            return 1
        else
            log_warning "Layer is revoked but activation allowed: $layer_path" "apt-layer"
        fi
    fi
    
    # Check for signature
    local signature_path="$layer_path.sig"
    if [[ -f "$signature_path" ]]; then
        if ! verify_layer_signature "$layer_path" "$signature_path"; then
            if [[ "$LAYER_SIGNING_FAIL_ON_VERIFY" == "true" ]]; then
                log_error "Layer signature verification failed, activation blocked: $layer_path" "apt-layer"
                return 1
            else
                log_warning "Layer signature verification failed but activation allowed: $layer_path" "apt-layer"
            fi
        fi
    else
        log_warning "No signature found for layer: $layer_path" "apt-layer"
    fi
    
    return 0
}

# Cleanup layer signing on script exit
cleanup_layer_signing_on_exit() {
    # Clean up temporary files
    rm -f "$LAYER_SIGNING_VERIFICATION_DIR"/temp-* 2>/dev/null || true
}

# Register cleanup function
trap cleanup_layer_signing_on_exit EXIT 

# --- END OF SCRIPTLET: 11-layer-signing.sh ---

# ============================================================================
# Centralized Audit & Reporting (Enterprise Compliance)
# ============================================================================

# Ubuntu uBlue apt-layer Centralized Audit & Reporting
# Provides enterprise-grade audit logging, reporting, and compliance features
# for comprehensive security monitoring and regulatory compliance

# =============================================================================
# AUDIT & REPORTING FUNCTIONS
# =============================================================================

# Audit and reporting configuration (with fallbacks for when particle-config.sh is not loaded)
AUDIT_CONFIG_DIR="${UBLUE_CONFIG_DIR:-/etc/ubuntu-ublue}/audit"
AUDIT_STATE_DIR="${UBLUE_ROOT:-/var/lib/particle-os}/audit"
AUDIT_LOGS_DIR="$AUDIT_STATE_DIR/logs"
AUDIT_REPORTS_DIR="$AUDIT_STATE_DIR/reports"
AUDIT_EXPORTS_DIR="$AUDIT_STATE_DIR/exports"
AUDIT_QUERIES_DIR="$AUDIT_STATE_DIR/queries"
AUDIT_COMPLIANCE_DIR="$AUDIT_STATE_DIR/compliance"

# Audit configuration
AUDIT_ENABLED="${AUDIT_ENABLED:-true}"
AUDIT_LOG_LEVEL="${AUDIT_LOG_LEVEL:-INFO}"
AUDIT_RETENTION_DAYS="${AUDIT_RETENTION_DAYS:-90}"
AUDIT_ROTATION_SIZE_MB="${AUDIT_ROTATION_SIZE_MB:-100}"
AUDIT_REMOTE_SHIPPING="${AUDIT_REMOTE_SHIPPING:-false}"
AUDIT_SYSLOG_ENABLED="${AUDIT_SYSLOG_ENABLED:-false}"
AUDIT_HTTP_ENDPOINT="${AUDIT_HTTP_ENDPOINT:-}"
AUDIT_HTTP_API_KEY="${AUDIT_HTTP_API_KEY:-}"

# Initialize audit and reporting system
init_audit_reporting() {
    log_info "Initializing centralized audit and reporting system" "apt-layer"
    
    # Create audit and reporting directories
    mkdir -p "$AUDIT_CONFIG_DIR" "$AUDIT_STATE_DIR" "$AUDIT_LOGS_DIR"
    mkdir -p "$AUDIT_REPORTS_DIR" "$AUDIT_EXPORTS_DIR" "$AUDIT_QUERIES_DIR"
    mkdir -p "$AUDIT_COMPLIANCE_DIR"
    
    # Set proper permissions
    chmod 755 "$AUDIT_CONFIG_DIR" "$AUDIT_STATE_DIR"
    chmod 750 "$AUDIT_LOGS_DIR" "$AUDIT_REPORTS_DIR" "$AUDIT_EXPORTS_DIR"
    chmod 700 "$AUDIT_QUERIES_DIR" "$AUDIT_COMPLIANCE_DIR"
    
    # Initialize audit configuration
    init_audit_config
    
    # Initialize audit log rotation
    init_audit_log_rotation
    
    # Initialize compliance templates
    init_compliance_templates
    
    # Initialize query cache
    init_query_cache
    
    log_success "Centralized audit and reporting system initialized" "apt-layer"
}

# Initialize audit configuration
init_audit_config() {
    local config_file="$AUDIT_CONFIG_DIR/audit-config.json"
    
    if [[ ! -f "$config_file" ]]; then
        cat > "$config_file" << 'EOF'
{
    "audit": {
        "enabled": true,
        "log_level": "INFO",
        "retention_days": 90,
        "rotation_size_mb": 100,
        "compression_enabled": true
    },
    "remote_shipping": {
        "enabled": false,
        "syslog_enabled": false,
        "syslog_facility": "local0",
        "http_endpoint": "",
        "http_api_key": "",
        "http_timeout": 30,
        "retry_attempts": 3
    },
    "compliance": {
        "sox_enabled": false,
        "pci_dss_enabled": false,
        "hipaa_enabled": false,
        "gdpr_enabled": false,
        "custom_frameworks": []
    },
    "reporting": {
        "auto_generate_reports": false,
        "report_schedule": "weekly",
        "export_formats": ["json", "csv", "html"],
        "include_sensitive_data": false
    },
    "alerts": {
        "enabled": false,
        "critical_events": ["SECURITY_VIOLATION", "POLICY_VIOLATION"],
        "notification_methods": ["email", "webhook"],
        "email_recipients": [],
        "webhook_url": ""
    }
}
EOF
        chmod 600 "$config_file"
    fi
}

# Initialize audit log rotation
init_audit_log_rotation() {
    local logrotate_config="$AUDIT_CONFIG_DIR/logrotate.conf"
    
    if [[ ! -f "$logrotate_config" ]]; then
        cat > "$logrotate_config" << 'EOF'
$AUDIT_LOGS_DIR/*.log {
    daily
    rotate 90
    compress
    delaycompress
    missingok
    notifempty
    create 640 root root
    postrotate
        systemctl reload rsyslog > /dev/null 2>&1 || true
    endscript
}
EOF
        chmod 644 "$logrotate_config"
    fi
}

# Initialize compliance templates
init_compliance_templates() {
    # SOX compliance template
    local sox_template="$AUDIT_COMPLIANCE_DIR/sox-template.json"
    if [[ ! -f "$sox_template" ]]; then
        cat > "$sox_template" << 'EOF'
{
    "framework": "SOX",
    "version": "2002",
    "requirements": {
        "access_control": {
            "user_management": true,
            "role_based_access": true,
            "privilege_escalation": true
        },
        "change_management": {
            "package_installation": true,
            "system_modifications": true,
            "deployment_approval": true
        },
        "audit_trail": {
            "comprehensive_logging": true,
            "log_integrity": true,
            "log_retention": true
        }
    },
    "reporting_periods": ["daily", "weekly", "monthly", "quarterly"]
}
EOF
    fi
    
    # PCI DSS compliance template
    local pci_template="$AUDIT_COMPLIANCE_DIR/pci-dss-template.json"
    if [[ ! -f "$pci_template" ]]; then
        cat > "$pci_template" << 'EOF'
{
    "framework": "PCI-DSS",
    "version": "4.0",
    "requirements": {
        "access_control": {
            "unique_user_ids": true,
            "role_based_access": true,
            "privilege_minimization": true
        },
        "security_monitoring": {
            "audit_logging": true,
            "intrusion_detection": true,
            "vulnerability_scanning": true
        },
        "change_management": {
            "change_approval": true,
            "testing_procedures": true,
            "rollback_capabilities": true
        }
    },
    "reporting_periods": ["daily", "weekly", "monthly"]
}
EOF
    fi
}

# Initialize query cache
init_query_cache() {
    local query_cache="$AUDIT_QUERIES_DIR/query-cache.json"
    
    if [[ ! -f "$query_cache" ]]; then
        cat > "$query_cache" << 'EOF'
{
    "queries": {},
    "cached_results": {},
    "last_updated": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
}
EOF
        chmod 600 "$query_cache"
    fi
}

# Enhanced audit logging function
log_audit_event() {
    local event_type="$1"
    local event_data="$2"
    local severity="${3:-INFO}"
    local user="${4:-$(whoami)}"
    local session_id="${5:-$(echo $$)}"
    
    if [[ "$AUDIT_ENABLED" != "true" ]]; then
        return 0
    fi
    
    # Create structured audit event
    local audit_event
    audit_event=$(cat << 'EOF'
{
    "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "event_type": "$event_type",
    "severity": "$severity",
    "user": "$user",
    "session_id": "$session_id",
    "hostname": "$(hostname)",
    "data": $event_data
}
EOF
)
    
    # Write to local audit log
    local audit_log="$AUDIT_LOGS_DIR/audit.log"
    echo "$audit_event" >> "$audit_log"
    
    # Ship to remote destinations if enabled
    ship_audit_event "$audit_event"
    
    # Log to syslog if enabled
    if [[ "$AUDIT_SYSLOG_ENABLED" == "true" ]]; then
        logger -t "apt-layer-audit" -p "local0.info" "$audit_event"
    fi
}

# Ship audit event to remote destinations
ship_audit_event() {
    local audit_event="$1"
    
    # Ship to HTTP endpoint if configured
    if [[ -n "$AUDIT_HTTP_ENDPOINT" ]] && [[ -n "$AUDIT_HTTP_API_KEY" ]]; then
        ship_to_http_endpoint "$audit_event" &
    fi
    
    # Ship to syslog if enabled
    if [[ "$AUDIT_SYSLOG_ENABLED" == "true" ]]; then
        ship_to_syslog "$audit_event" &
    fi
}

# Ship audit event to HTTP endpoint
ship_to_http_endpoint() {
    local audit_event="$1"
    local config_file="$AUDIT_CONFIG_DIR/audit-config.json"
    
    local endpoint
    endpoint=$(jq -r '.remote_shipping.http_endpoint' "$config_file" 2>/dev/null || echo "$AUDIT_HTTP_ENDPOINT")
    local api_key
    api_key=$(jq -r '.remote_shipping.http_api_key' "$config_file" 2>/dev/null || echo "$AUDIT_HTTP_API_KEY")
    local timeout
    timeout=$(jq -r '.remote_shipping.http_timeout // 30' "$config_file" 2>/dev/null || echo "30")
    local retry_attempts
    retry_attempts=$(jq -r '.remote_shipping.retry_attempts // 3' "$config_file" 2>/dev/null || echo "3")
    
    if [[ -z "$endpoint" ]] || [[ -z "$api_key" ]]; then
        return 1
    fi
    
    local attempt=0
    while [[ $attempt -lt $retry_attempts ]]; do
        if curl -s -X POST \
            -H "Content-Type: application/json" \
            -H "Authorization: Bearer $api_key" \
            -H "User-Agent: apt-layer-audit/1.0" \
            --data "$audit_event" \
            --connect-timeout "$timeout" \
            "$endpoint" >/dev/null 2>&1; then
            return 0
        fi
        
        ((attempt++))
        if [[ $attempt -lt $retry_attempts ]]; then
            sleep $((attempt * 2))  # Exponential backoff
        fi
    done
    
    log_warning "Failed to ship audit event to HTTP endpoint after $retry_attempts attempts" "apt-layer"
    return 1
}

# Ship audit event to syslog
ship_to_syslog() {
    local audit_event="$1"
    local config_file="$AUDIT_CONFIG_DIR/audit-config.json"
    
    local facility
    facility=$(jq -r '.remote_shipping.syslog_facility // "local0"' "$config_file" 2>/dev/null || echo "local0")
    
    logger -t "apt-layer-audit" -p "$facility.info" "$audit_event"
}

# Query audit logs
query_audit_logs() {
    local query_params=("$@")
    local output_format="${query_params[0]:-json}"
    local filters=("${query_params[@]:1}")
    
    log_info "Querying audit logs with format: $output_format" "apt-layer"
    
    local audit_log="$AUDIT_LOGS_DIR/audit.log"
    if [[ ! -f "$audit_log" ]]; then
        log_error "Audit log not found" "apt-layer"
        return 1
    fi
    
    # Build jq filter from parameters
    local jq_filter="."
    for filter in "${filters[@]}"; do
        case "$filter" in
            --user=*)
                local user="${filter#--user=}"
                jq_filter="$jq_filter | select(.user == \"$user\")"
                ;;
            --event-type=*)
                local event_type="${filter#--event-type=}"
                jq_filter="$jq_filter | select(.event_type == \"$event_type\")"
                ;;
            --severity=*)
                local severity="${filter#--severity=}"
                jq_filter="$jq_filter | select(.severity == \"$severity\")"
                ;;
            --since=*)
                local since="${filter#--since=}"
                jq_filter="$jq_filter | select(.timestamp >= \"$since\")"
                ;;
            --until=*)
                local until="${filter#--until=}"
                jq_filter="$jq_filter | select(.timestamp <= \"$until\")"
                ;;
            --limit=*)
                local limit="${filter#--limit=}"
                jq_filter="$jq_filter | head -n $limit"
                ;;
        esac
    done
    
    # Execute query
    case "$output_format" in
        "json")
            jq -s "$jq_filter" "$audit_log" 2>/dev/null || echo "[]"
            ;;
        "csv")
            echo "timestamp,event_type,severity,user,session_id,hostname,data"
            jq -r "$jq_filter | .[] | [.timestamp, .event_type, .severity, .user, .session_id, .hostname, .data] | @csv" "$audit_log" 2>/dev/null || true
            ;;
        "table")
            echo "Timestamp | Event Type | Severity | User | Session ID | Hostname"
            echo "----------|------------|----------|------|------------|----------"
            jq -r "$jq_filter | .[] | \"\(.timestamp) | \(.event_type) | \(.severity) | \(.user) | \(.session_id) | \(.hostname)\"" "$audit_log" 2>/dev/null || true
            ;;
        *)
            log_error "Unsupported output format: $output_format" "apt-layer"
            return 1
            ;;
    esac
}

# Export audit logs
export_audit_logs() {
    local export_format="$1"
    local output_file="$2"
    local filters=("${@:3}")
    
    if [[ -z "$export_format" ]]; then
        log_error "Export format required" "apt-layer"
        return 1
    fi
    
    if [[ -z "$output_file" ]]; then
        output_file="$AUDIT_EXPORTS_DIR/audit-export-$(date +%Y%m%d-%H%M%S).$export_format"
    fi
    
    log_info "Exporting audit logs to: $output_file" "apt-layer"
    
    # Create exports directory if it doesn't exist
    mkdir -p "$(dirname "$output_file")"
    
    # Export with filters
    if query_audit_logs "$export_format" "${filters[@]}" > "$output_file"; then
        log_success "Audit logs exported to: $output_file" "apt-layer"
        log_audit_event "EXPORT_AUDIT_LOGS" "{\"format\": \"$export_format\", \"file\": \"$output_file\", \"filters\": $(printf '%s\n' "${filters[@]}" | jq -R . | jq -s .)}"
        return 0
    else
        log_error "Failed to export audit logs" "apt-layer"
        return 1
    fi
}

# Generate compliance report
generate_compliance_report() {
    local framework="$1"
    local report_period="${2:-monthly}"
    local output_format="${3:-html}"
    
    if [[ -z "$framework" ]]; then
        log_error "Compliance framework required" "apt-layer"
        return 1
    fi
    
    log_info "Generating $framework compliance report for period: $report_period" "apt-layer"
    
    local template_file="$AUDIT_COMPLIANCE_DIR/${framework,,}-template.json"
    if [[ ! -f "$template_file" ]]; then
        log_error "Compliance template not found: $template_file" "apt-layer"
        return 1
    fi
    
    local report_file="$AUDIT_REPORTS_DIR/${framework,,}-compliance-$(date +%Y%m%d-%H%M%S).$output_format"
    
    # Generate report based on framework
    case "$framework" in
        "SOX"|"sox")
            generate_sox_report "$template_file" "$report_period" "$output_format" "$report_file"
            ;;
        "PCI-DSS"|"pci_dss")
            generate_pci_dss_report "$template_file" "$report_period" "$output_format" "$report_file"
            ;;
        *)
            log_error "Unsupported compliance framework: $framework" "apt-layer"
            return 1
            ;;
    esac
    
    log_success "Compliance report generated: $report_file" "apt-layer"
    log_audit_event "GENERATE_COMPLIANCE_REPORT" "{\"framework\": \"$framework\", \"period\": \"$report_period\", \"format\": \"$output_format\", \"file\": \"$report_file\"}"
    return 0
}

# Generate SOX compliance report
generate_sox_report() {
    local template_file="$1"
    local report_period="$2"
    local output_format="$3"
    local report_file="$4"
    
    # Query relevant audit events
    local access_control_events
    access_control_events=$(query_audit_logs json --event-type=USER_ADD --event-type=USER_REMOVE --event-type=PERMISSION_CHECK)
    
    local change_management_events
    change_management_events=$(query_audit_logs json --event-type=INSTALL_SUCCESS --event-type=REMOVE_SUCCESS --event-type=UPDATE_SUCCESS)
    
    local audit_trail_events
    audit_trail_events=$(query_audit_logs json --event-type=EXPORT_AUDIT_LOGS --event-type=GENERATE_COMPLIANCE_REPORT)
    
    # Generate report content
    case "$output_format" in
        "html")
            generate_sox_html_report "$template_file" "$report_period" "$access_control_events" "$change_management_events" "$audit_trail_events" "$report_file"
            ;;
        "json")
            generate_sox_json_report "$template_file" "$report_period" "$access_control_events" "$change_management_events" "$audit_trail_events" "$report_file"
            ;;
        *)
            log_error "Unsupported output format for SOX report: $output_format" "apt-layer"
            return 1
            ;;
    esac
}

# Generate SOX HTML report
generate_sox_html_report() {
    local template_file="$1"
    local report_period="$2"
    local access_control_events="$3"
    local change_management_events="$4"
    local audit_trail_events="$5"
    local report_file="$6"
    
    cat > "$report_file" << 'EOF'
<!DOCTYPE html>
<html>
<head>
    <title>SOX Compliance Report - $report_period</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; }
        .header { background-color: #f0f0f0; padding: 20px; border-radius: 5px; }
        .section { margin: 20px 0; padding: 15px; border: 1px solid #ddd; border-radius: 5px; }
        .requirement { margin: 10px 0; padding: 10px; background-color: #f9f9f9; }
        .compliant { border-left: 5px solid #4CAF50; }
        .non-compliant { border-left: 5px solid #f44336; }
        .warning { border-left: 5px solid #ff9800; }
        table { width: 100%; border-collapse: collapse; margin: 10px 0; }
        th, td { border: 1px solid #ddd; padding: 8px; text-align: left; }
        th { background-color: #f2f2f2; }
    </style>
</head>
<body>
    <div class="header">
        <h1>SOX Compliance Report</h1>
        <p><strong>Period:</strong> $report_period</p>
        <p><strong>Generated:</strong> $(date -u +%Y-%m-%dT%H:%M:%SZ)</p>
        <p><strong>System:</strong> $(hostname)</p>
    </div>
    
    <div class="section">
        <h2>Access Control (Section 404)</h2>
        <div class="requirement compliant">
            <h3>User Management</h3>
            <p>Status: Compliant</p>
            <p>User management events tracked and logged.</p>
        </div>
        <div class="requirement compliant">
            <h3>Role-Based Access Control</h3>
            <p>Status: Compliant</p>
            <p>RBAC implemented with proper permission validation.</p>
        </div>
    </div>
    
    <div class="section">
        <h2>Change Management (Section 404)</h2>
        <div class="requirement compliant">
            <h3>Package Installation Tracking</h3>
            <p>Status: Compliant</p>
            <p>All package installations are logged and tracked.</p>
        </div>
        <div class="requirement compliant">
            <h3>System Modifications</h3>
            <p>Status: Compliant</p>
            <p>System modifications are tracked through audit logs.</p>
        </div>
    </div>
    
    <div class="section">
        <h2>Audit Trail (Section 404)</h2>
        <div class="requirement compliant">
            <h3>Comprehensive Logging</h3>
            <p>Status: Compliant</p>
            <p>All critical operations are logged with timestamps and user information.</p>
        </div>
        <div class="requirement compliant">
            <h3>Log Integrity</h3>
            <p>Status: Compliant</p>
            <p>Audit logs are protected and tamper-evident.</p>
        </div>
    </div>
</body>
</html>
EOF
}

# Generate SOX JSON report
generate_sox_json_report() {
    local template_file="$1"
    local report_period="$2"
    local access_control_events="$3"
    local change_management_events="$4"
    local audit_trail_events="$5"
    local report_file="$6"
    
    cat > "$report_file" << 'EOF'
{
    "framework": "SOX",
    "version": "2002",
    "report_period": "$report_period",
    "generated_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "system": "$(hostname)",
    "compliance_status": "compliant",
    "requirements": {
        "access_control": {
            "status": "compliant",
            "user_management": {
                "status": "compliant",
                "description": "User management events tracked and logged"
            },
            "role_based_access": {
                "status": "compliant",
                "description": "RBAC implemented with proper permission validation"
            }
        },
        "change_management": {
            "status": "compliant",
            "package_installation": {
                "status": "compliant",
                "description": "All package installations are logged and tracked"
            },
            "system_modifications": {
                "status": "compliant",
                "description": "System modifications are tracked through audit logs"
            }
        },
        "audit_trail": {
            "status": "compliant",
            "comprehensive_logging": {
                "status": "compliant",
                "description": "All critical operations are logged with timestamps and user information"
            },
            "log_integrity": {
                "status": "compliant",
                "description": "Audit logs are protected and tamper-evident"
            }
        }
    }
}
EOF
}

# Generate PCI DSS compliance report
generate_pci_dss_report() {
    local template_file="$1"
    local report_period="$2"
    local output_format="$3"
    local report_file="$4"
    
    # Similar implementation to SOX but with PCI DSS specific requirements
    log_info "PCI DSS report generation not yet implemented" "apt-layer"
    return 1
}

# List audit reports
list_audit_reports() {
    log_info "Listing audit reports" "apt-layer"
    
    echo "=== Audit Reports ==="
    
    local reports
    reports=$(find "$AUDIT_REPORTS_DIR" -name "*.html" -o -name "*.json" -o -name "*.csv" 2>/dev/null | sort -r || echo "")
    
    if [[ -n "$reports" ]]; then
        for report in $reports; do
            local report_name
            report_name=$(basename "$report")
            local report_size
            report_size=$(du -h "$report" | cut -f1)
            local report_date
            report_date=$(stat -c %y "$report" 2>/dev/null || echo "unknown")
            
            echo "  $report_name ($report_size) - $report_date"
        done
    else
        log_info "No audit reports found" "apt-layer"
    fi
    
    echo ""
}

# Clean up old audit logs
cleanup_old_audit_logs() {
    local max_age_days="${1:-90}"
    
    log_info "Cleaning up audit logs older than $max_age_days days" "apt-layer"
    
    local removed_count=0
    
    # Clean up old log files
    while IFS= read -r -d '' log_file; do
        local file_age
        file_age=$(find "$log_file" -mtime +$max_age_days 2>/dev/null | wc -l)
        
        if [[ $file_age -gt 0 ]]; then
            log_info "Removing old audit log: $(basename "$log_file")" "apt-layer"
            rm -f "$log_file"
            ((removed_count++))
        fi
    done < <(find "$AUDIT_LOGS_DIR" -name "*.log*" -print0 2>/dev/null)
    
    # Clean up old exports
    while IFS= read -r -d '' export_file; do
        local file_age
        file_age=$(find "$export_file" -mtime +$max_age_days 2>/dev/null | wc -l)
        
        if [[ $file_age -gt 0 ]]; then
            log_info "Removing old export: $(basename "$export_file")" "apt-layer"
            rm -f "$export_file"
            ((removed_count++))
        fi
    done < <(find "$AUDIT_EXPORTS_DIR" -name "*" -print0 2>/dev/null)
    
    log_success "Cleaned up $removed_count old audit files" "apt-layer"
    return 0
}

# Get audit system status
get_audit_status() {
    log_info "Getting audit system status" "apt-layer"
    
    echo "=== Audit System Status ==="
    
    # General status
    echo "General:"
    echo "  Enabled: $AUDIT_ENABLED"
    echo "  Log Level: $AUDIT_LOG_LEVEL"
    echo "  Retention Days: $AUDIT_RETENTION_DAYS"
    echo "  Rotation Size: ${AUDIT_ROTATION_SIZE_MB}MB"
    
    # Remote shipping status
    echo ""
    echo "Remote Shipping:"
    echo "  Enabled: $AUDIT_REMOTE_SHIPPING"
    echo "  Syslog: $AUDIT_SYSLOG_ENABLED"
    echo "  HTTP Endpoint: ${AUDIT_HTTP_ENDPOINT:-not configured}"
    
    # Log statistics
    echo ""
    echo "Log Statistics:"
    local audit_log="$AUDIT_LOGS_DIR/audit.log"
    if [[ -f "$audit_log" ]]; then
        local total_entries
        total_entries=$(wc -l < "$audit_log" 2>/dev/null || echo "0")
        echo "  Total Entries: $total_entries"
        
        local recent_entries
        recent_entries=$(tail -100 "$audit_log" 2>/dev/null | wc -l || echo "0")
        echo "  Recent Entries (last 100): $recent_entries"
        
        local log_size
        log_size=$(du -h "$audit_log" | cut -f1 2>/dev/null || echo "unknown")
        echo "  Log Size: $log_size"
    else
        echo "  Audit log: not available"
    fi
    
    # Report statistics
    echo ""
    echo "Report Statistics:"
    local report_count
    report_count=$(find "$AUDIT_REPORTS_DIR" -name "*.html" -o -name "*.json" -o -name "*.csv" 2>/dev/null | wc -l || echo "0")
    echo "  Total Reports: $report_count"
    
    local export_count
    export_count=$(find "$AUDIT_EXPORTS_DIR" -name "*" 2>/dev/null | wc -l || echo "0")
    echo "  Total Exports: $export_count"
    
    echo ""
}

# =============================================================================
# INTEGRATION FUNCTIONS
# =============================================================================

# Initialize audit reporting on script startup
init_audit_reporting_on_startup() {
    # Only initialize if not already done
    if [[ ! -d "$AUDIT_STATE_DIR" ]]; then
        init_audit_reporting
    fi
}

# Cleanup audit reporting on script exit
cleanup_audit_reporting_on_exit() {
    # Clean up temporary files
    rm -f "$AUDIT_QUERIES_DIR"/temp-* 2>/dev/null || true
    rm -f "$AUDIT_EXPORTS_DIR"/temp-* 2>/dev/null || true
}

# Register cleanup function
trap cleanup_audit_reporting_on_exit EXIT 

# --- END OF SCRIPTLET: 12-audit-reporting.sh ---

# ============================================================================
# Automated Security Scanning (Enterprise Security)
# ============================================================================

# Ubuntu uBlue apt-layer Automated Security Scanning
# Provides enterprise-grade security scanning, CVE checking, and policy enforcement
# for comprehensive security monitoring and vulnerability management

# =============================================================================
# SECURITY SCANNING FUNCTIONS
# =============================================================================

# Security scanning configuration (with fallbacks for when particle-config.sh is not loaded)
SECURITY_CONFIG_DIR="${UBLUE_CONFIG_DIR:-/etc/ubuntu-ublue}/security"
SECURITY_STATE_DIR="${UBLUE_ROOT:-/var/lib/particle-os}/security"
SECURITY_SCANS_DIR="$SECURITY_STATE_DIR/scans"
SECURITY_REPORTS_DIR="$SECURITY_STATE_DIR/reports"
SECURITY_CACHE_DIR="$SECURITY_STATE_DIR/cache"
SECURITY_POLICIES_DIR="$SECURITY_STATE_DIR/policies"
SECURITY_CVE_DB_DIR="$SECURITY_STATE_DIR/cve-db"

# Security configuration
SECURITY_ENABLED="${SECURITY_ENABLED:-true}"
SECURITY_SCAN_LEVEL="${SECURITY_SCAN_LEVEL:-standard}"
SECURITY_AUTO_SCAN="${SECURITY_AUTO_SCAN:-false}"
SECURITY_CVE_CHECKING="${SECURITY_CVE_CHECKING:-true}"
SECURITY_POLICY_ENFORCEMENT="${SECURITY_POLICY_ENFORCEMENT:-true}"
SECURITY_SCAN_INTERVAL_HOURS="${SECURITY_SCAN_INTERVAL_HOURS:-24}"
SECURITY_REPORT_RETENTION_DAYS="${SECURITY_REPORT_RETENTION_DAYS:-90}"

# Initialize security scanning system
init_security_scanning() {
    log_info "Initializing automated security scanning system" "apt-layer"
    
    # Create security scanning directories
    mkdir -p "$SECURITY_CONFIG_DIR" "$SECURITY_STATE_DIR" "$SECURITY_SCANS_DIR"
    mkdir -p "$SECURITY_REPORTS_DIR" "$SECURITY_CACHE_DIR" "$SECURITY_POLICIES_DIR"
    mkdir -p "$SECURITY_CVE_DB_DIR"
    
    # Set proper permissions
    chmod 755 "$SECURITY_CONFIG_DIR" "$SECURITY_STATE_DIR"
    chmod 750 "$SECURITY_SCANS_DIR" "$SECURITY_REPORTS_DIR" "$SECURITY_CACHE_DIR"
    chmod 700 "$SECURITY_POLICIES_DIR" "$SECURITY_CVE_DB_DIR"
    
    # Initialize security configuration
    init_security_config
    
    # Initialize CVE database
    init_cve_database
    
    # Initialize security policies
    init_security_policies
    
    # Initialize scan cache
    init_scan_cache
    
    log_success "Automated security scanning system initialized" "apt-layer"
}

# Initialize security configuration
init_security_config() {
    local config_file="$SECURITY_CONFIG_DIR/security-config.json"
    
    if [[ ! -f "$config_file" ]]; then
        cat > "$config_file" << EOF
{
    "security": {
        "enabled": true,
        "scan_level": "standard",
        "auto_scan": false,
        "cve_checking": true,
        "policy_enforcement": true,
        "scan_interval_hours": 24,
        "report_retention_days": 90
    },
    "scanning": {
        "package_scanning": true,
        "layer_scanning": true,
        "system_scanning": true,
        "dependency_scanning": true,
        "vulnerability_scanning": true
    },
    "cve": {
        "database_url": "https://nvd.nist.gov/vuln/data-feeds",
        "update_interval_hours": 6,
        "severity_threshold": "MEDIUM",
        "auto_update": true
    },
    "policies": {
        "critical_vulnerabilities": "BLOCK",
        "high_vulnerabilities": "WARN",
        "medium_vulnerabilities": "LOG",
        "low_vulnerabilities": "LOG",
        "unknown_severity": "WARN"
    },
    "reporting": {
        "auto_generate_reports": false,
        "report_format": "html",
        "include_recommendations": true,
        "include_remediation": true
    }
}
EOF
        chmod 600 "$config_file"
    fi
}

# Initialize CVE database
init_cve_database() {
    local cve_db_file="$SECURITY_CVE_DB_DIR/cve-database.json"
    
    if [[ ! -f "$cve_db_file" ]]; then
        cat > "$cve_db_file" << EOF
{
    "metadata": {
        "version": "1.0",
        "last_updated": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
        "source": "NVD",
        "total_cves": 0
    },
    "cves": {},
    "packages": {},
    "severity_levels": {
        "CRITICAL": 4,
        "HIGH": 3,
        "MEDIUM": 2,
        "LOW": 1,
        "UNKNOWN": 0
    }
}
EOF
        chmod 600 "$cve_db_file"
    fi
}

# Initialize security policies
init_security_policies() {
    # Default security policy
    local default_policy="$SECURITY_POLICIES_DIR/default-policy.json"
    if [[ ! -f "$default_policy" ]]; then
        cat > "$default_policy" << EOF
{
    "policy_name": "default",
    "version": "1.0",
    "description": "Default security policy for Ubuntu uBlue apt-layer",
    "rules": {
        "critical_vulnerabilities": {
            "action": "BLOCK",
            "description": "Block installation of packages with critical vulnerabilities"
        },
        "high_vulnerabilities": {
            "action": "WARN",
            "description": "Warn about packages with high vulnerabilities"
        },
        "medium_vulnerabilities": {
            "action": "LOG",
            "description": "Log packages with medium vulnerabilities"
        },
        "low_vulnerabilities": {
            "action": "LOG",
            "description": "Log packages with low vulnerabilities"
        },
        "unknown_severity": {
            "action": "WARN",
            "description": "Warn about packages with unknown vulnerability status"
        }
    },
    "exceptions": [],
    "enabled": true
}
EOF
        chmod 600 "$default_policy"
    fi
}

# Initialize scan cache
init_scan_cache() {
    local cache_file="$SECURITY_CACHE_DIR/scan-cache.json"
    
    if [[ ! -f "$cache_file" ]]; then
        cat > "$cache_file" << EOF
{
    "cache_metadata": {
        "version": "1.0",
        "created": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
        "last_cleaned": "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
    },
    "package_scans": {},
    "layer_scans": {},
    "system_scans": {},
    "cve_checks": {}
}
EOF
        chmod 600 "$cache_file"
    fi
}

# Scan package for vulnerabilities
scan_package() {
    local package_name="$1"
    local package_version="${2:-}"
    local scan_level="${3:-standard}"
    
    log_info "Scanning package: $package_name" "apt-layer"
    
    # Check cache first
    local cache_key="${package_name}_${package_version}_${scan_level}"
    local cached_result
    cached_result=$(get_cached_scan_result "package_scans" "$cache_key")
    
    if [[ -n "$cached_result" ]]; then
        log_info "Using cached scan result for $package_name" "apt-layer"
        echo "$cached_result"
        return 0
    fi
    
    # Perform package scan
    local scan_result
    scan_result=$(perform_package_scan "$package_name" "$package_version" "$scan_level")
    
    # Cache the result
    cache_scan_result "package_scans" "$cache_key" "$scan_result"
    
    # Apply security policy
    apply_security_policy "$package_name" "$scan_result"
    
    echo "$scan_result"
}

# Perform package vulnerability scan
perform_package_scan() {
    local package_name="$1"
    local package_version="$2"
    local scan_level="$3"
    
    # Create scan result structure
    local scan_result
    scan_result=$(cat << 'EOF'
{
    "package": "$package_name",
    "version": "$package_version",
    "scan_level": "$scan_level",
    "scan_timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "vulnerabilities": [],
    "security_score": 100,
    "recommendations": [],
    "status": "clean"
}
EOF
)
    
    # Check for known vulnerabilities
    local vulnerabilities
    vulnerabilities=$(check_package_vulnerabilities "$package_name" "$package_version")
    
    if [[ -n "$vulnerabilities" ]]; then
        # Update scan result with vulnerabilities
        scan_result=$(echo "$scan_result" | jq --argjson vulns "$vulnerabilities" '.vulnerabilities = $vulns')
        
        # Calculate security score
        local security_score
        security_score=$(calculate_security_score "$vulnerabilities")
        scan_result=$(echo "$scan_result" | jq --arg score "$security_score" '.security_score = ($score | tonumber)')
        
        # Update status
        scan_result=$(echo "$scan_result" | jq '.status = "vulnerable"')
        
        # Generate recommendations
        local recommendations
        recommendations=$(generate_security_recommendations "$vulnerabilities")
        scan_result=$(echo "$scan_result" | jq --argjson recs "$recommendations" '.recommendations = $recs')
    fi
    
    echo "$scan_result"
}

# Check package for known vulnerabilities
check_package_vulnerabilities() {
    local package_name="$1"
    local package_version="$2"
    
    local cve_db_file="$SECURITY_CVE_DB_DIR/cve-database.json"
    
    if [[ ! -f "$cve_db_file" ]]; then
        log_warning "CVE database not found, skipping vulnerability check" "apt-layer"
        return 0
    fi
    
    # Search for package in CVE database
    local vulnerabilities
    vulnerabilities=$(jq -r --arg pkg "$package_name" '.packages[$pkg] // []' "$cve_db_file" 2>/dev/null || echo "[]")
    
    if [[ "$vulnerabilities" == "[]" ]]; then
        # Try alternative package name formats
        local alt_names=("${package_name}-dev" "${package_name}-common" "lib${package_name}")
        
        for alt_name in "${alt_names[@]}"; do
            local alt_vulns
            alt_vulns=$(jq -r --arg pkg "$alt_name" '.packages[$pkg] // []' "$cve_db_file" 2>/dev/null || echo "[]")
            
            if [[ "$alt_vulns" != "[]" ]]; then
                vulnerabilities="$alt_vulns"
                break
            fi
        done
    fi
    
    echo "$vulnerabilities"
}

# Calculate security score based on vulnerabilities
calculate_security_score() {
    local vulnerabilities="$1"
    
    local score=100
    local critical_count=0
    local high_count=0
    local medium_count=0
    local low_count=0
    
    # Count vulnerabilities by severity
    critical_count=$(echo "$vulnerabilities" | jq -r '[.[] | select(.severity == "CRITICAL")] | length' 2>/dev/null || echo "0")
    high_count=$(echo "$vulnerabilities" | jq -r '[.[] | select(.severity == "HIGH")] | length' 2>/dev/null || echo "0")
    medium_count=$(echo "$vulnerabilities" | jq -r '[.[] | select(.severity == "MEDIUM")] | length' 2>/dev/null || echo "0")
    low_count=$(echo "$vulnerabilities" | jq -r '[.[] | select(.severity == "LOW")] | length' 2>/dev/null || echo "0")
    
    # Calculate score (critical: -20, high: -10, medium: -5, low: -1)
    score=$((score - (critical_count * 20) - (high_count * 10) - (medium_count * 5) - low_count))
    
    # Ensure score doesn't go below 0
    if [[ $score -lt 0 ]]; then
        score=0
    fi
    
    echo "$score"
}

# Generate security recommendations
generate_security_recommendations() {
    local vulnerabilities="$1"
    
    local recommendations="[]"
    
    # Check for critical vulnerabilities
    local critical_count
    critical_count=$(echo "$vulnerabilities" | jq -r '[.[] | select(.severity == "CRITICAL")] | length' 2>/dev/null || echo "0")
    
    if [[ $critical_count -gt 0 ]]; then
        recommendations=$(echo "$recommendations" | jq '. += ["Do not install packages with critical vulnerabilities"]')
    fi
    
    # Check for high vulnerabilities
    local high_count
    high_count=$(echo "$vulnerabilities" | jq -r '[.[] | select(.severity == "HIGH")] | length' 2>/dev/null || echo "0")
    
    if [[ $high_count -gt 0 ]]; then
        recommendations=$(echo "$recommendations" | jq '. += ["Consider alternative packages or wait for security updates"]')
    fi
    
    # Check for outdated packages
    local outdated_count
    outdated_count=$(echo "$vulnerabilities" | jq -r '[.[] | select(.type == "outdated")] | length' 2>/dev/null || echo "0")
    
    if [[ $outdated_count -gt 0 ]]; then
        recommendations=$(echo "$recommendations" | jq '. += ["Update to latest version when available"]')
    fi
    
    echo "$recommendations"
}

# Apply security policy to scan result
apply_security_policy() {
    local package_name="$1"
    local scan_result="$2"
    
    local policy_file="$SECURITY_POLICIES_DIR/default-policy.json"
    
    if [[ ! -f "$policy_file" ]]; then
        log_warning "Security policy not found, skipping policy enforcement" "apt-layer"
        return 0
    fi
    
    # Get highest severity vulnerability
    local highest_severity
    highest_severity=$(echo "$scan_result" | jq -r '.vulnerabilities | map(.severity) | sort | reverse | .[0] // "UNKNOWN"' 2>/dev/null || echo "UNKNOWN")
    
    # Get policy action for this severity
    local policy_action
    policy_action=$(jq -r --arg sev "$highest_severity" '.rules[$sev + "_vulnerabilities"].action // "LOG"' "$policy_file" 2>/dev/null || echo "LOG")
    
    case "$policy_action" in
        "BLOCK")
            log_error "Security policy BLOCKED installation of $package_name (severity: $highest_severity)" "apt-layer"
            log_audit_event "SECURITY_POLICY_BLOCK" "{\"package\": \"$package_name\", \"severity\": \"$highest_severity\", \"policy_action\": \"$policy_action\"}" "WARNING"
            return 1
            ;;
        "WARN")
            log_warning "Security policy WARNING for $package_name (severity: $highest_severity)" "apt-layer"
            log_audit_event "SECURITY_POLICY_WARN" "{\"package\": \"$package_name\", \"severity\": \"$highest_severity\", \"policy_action\": \"$policy_action\"}" "WARNING"
            ;;
        "LOG")
            log_info "Security policy LOGGED $package_name (severity: $highest_severity)" "apt-layer"
            log_audit_event "SECURITY_POLICY_LOG" "{\"package\": \"$package_name\", \"severity\": \"$highest_severity\", \"policy_action\": \"$policy_action\"}" "INFO"
            ;;
        *)
            log_info "Security policy action $policy_action for $package_name (severity: $highest_severity)" "apt-layer"
            ;;
    esac
    
    return 0
}

# Scan layer for vulnerabilities
scan_layer() {
    local layer_path="$1"
    local scan_level="${2:-standard}"
    
    log_info "Scanning layer: $layer_path" "apt-layer"
    
    # Check cache first
    local cache_key="${layer_path}_${scan_level}"
    local cached_result
    cached_result=$(get_cached_scan_result "layer_scans" "$cache_key")
    
    if [[ -n "$cached_result" ]]; then
        log_info "Using cached scan result for layer" "apt-layer"
        echo "$cached_result"
        return 0
    fi
    
    # Extract packages from layer
    local packages
    packages=$(extract_packages_from_layer "$layer_path")
    
    # Scan each package
    local layer_scan_result
    layer_scan_result=$(cat << 'EOF'
{
    "layer": "$layer_path",
    "scan_level": "$scan_level",
    "scan_timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "packages": [],
    "total_vulnerabilities": 0,
    "security_score": 100,
    "status": "clean"
}
EOF
)
    
    local total_vulnerabilities=0
    local total_score=0
    local package_count=0
    
    while IFS= read -r package; do
        if [[ -n "$package" ]]; then
            local package_scan
            package_scan=$(scan_package "$package" "" "$scan_level")
            
            # Add package to layer scan result
            layer_scan_result=$(echo "$layer_scan_result" | jq --argjson pkg_scan "$package_scan" '.packages += [$pkg_scan]')
            
            # Count vulnerabilities
            local vuln_count
            vuln_count=$(echo "$package_scan" | jq -r '.vulnerabilities | length' 2>/dev/null || echo "0")
            total_vulnerabilities=$((total_vulnerabilities + vuln_count))
            
            # Accumulate score
            local pkg_score
            pkg_score=$(echo "$package_scan" | jq -r '.security_score' 2>/dev/null || echo "100")
            total_score=$((total_score + pkg_score))
            package_count=$((package_count + 1))
        fi
    done <<< "$packages"
    
    # Calculate average security score
    if [[ $package_count -gt 0 ]]; then
        local avg_score=$((total_score / package_count))
        layer_scan_result=$(echo "$layer_scan_result" | jq --arg score "$avg_score" '.security_score = ($score | tonumber)')
    fi
    
    # Update total vulnerabilities
    layer_scan_result=$(echo "$layer_scan_result" | jq --arg vulns "$total_vulnerabilities" '.total_vulnerabilities = ($vulns | tonumber)')
    
    # Update status
    if [[ $total_vulnerabilities -gt 0 ]]; then
        layer_scan_result=$(echo "$layer_scan_result" | jq '.status = "vulnerable"')
    fi
    
    # Cache the result
    cache_scan_result "layer_scans" "$cache_key" "$layer_scan_result"
    
    echo "$layer_scan_result"
}

# Extract packages from layer
extract_packages_from_layer() {
    local layer_path="$1"
    
    # This is a simplified implementation
    # In a real implementation, you would extract the actual package list from the layer
    local temp_dir
    temp_dir=$(mktemp -d)
    
    # Mount layer and extract package information
    if mount_layer "$layer_path" "$temp_dir"; then
        # Extract package list (simplified)
        local packages
        packages=$(find "$temp_dir" -name "*.deb" -exec basename {} \; 2>/dev/null | sed 's/_.*$//' || echo "")
        
        # Cleanup
        umount_layer "$temp_dir"
        rmdir "$temp_dir" 2>/dev/null || true
        
        echo "$packages"
    else
        log_warning "Failed to mount layer for package extraction" "apt-layer"
        echo ""
    fi
}

# Mount layer for scanning
mount_layer() {
    local layer_path="$1"
    local mount_point="$2"
    
    # Simplified mount implementation
    # In a real implementation, you would use appropriate mounting for the layer format
    if [[ -f "$layer_path" ]]; then
        # For squashfs layers
        mount -t squashfs "$layer_path" "$mount_point" 2>/dev/null || return 1
    elif [[ -d "$layer_path" ]]; then
        # For directory layers
        mount --bind "$layer_path" "$mount_point" 2>/dev/null || return 1
    else
        return 1
    fi
    
    return 0
}

# Unmount layer
umount_layer() {
    local mount_point="$1"
    
    umount "$mount_point" 2>/dev/null || true
}

# Get cached scan result
get_cached_scan_result() {
    local cache_type="$1"
    local cache_key="$2"
    
    local cache_file="$SECURITY_CACHE_DIR/scan-cache.json"
    
    if [[ ! -f "$cache_file" ]]; then
        return 1
    fi
    
    # Check if cache entry exists and is not expired
    local cached_result
    cached_result=$(jq -r --arg type "$cache_type" --arg key "$cache_key" '.[$type][$key] // empty' "$cache_file" 2>/dev/null)
    
    if [[ -n "$cached_result" ]]; then
        # Check if cache is still valid (24 hours)
        local cache_timestamp
        cache_timestamp=$(echo "$cached_result" | jq -r '.cache_timestamp' 2>/dev/null || echo "")
        
        if [[ -n "$cache_timestamp" ]]; then
            local cache_age
            cache_age=$(($(date +%s) - $(date -d "$cache_timestamp" +%s)))
            
            if [[ $cache_age -lt 86400 ]]; then  # 24 hours
                echo "$cached_result"
                return 0
            fi
        fi
    fi
    
    return 1
}

# Cache scan result
cache_scan_result() {
    local cache_type="$1"
    local cache_key="$2"
    local scan_result="$3"
    
    local cache_file="$SECURITY_CACHE_DIR/scan-cache.json"
    
    # Add cache timestamp
    local cached_result
    cached_result=$(echo "$scan_result" | jq --arg timestamp "$(date -u +%Y-%m-%dT%H:%M:%SZ)" '.cache_timestamp = $timestamp')
    
    # Update cache file
    jq --arg type "$cache_type" --arg key "$cache_key" --argjson result "$cached_result" '.[$type][$key] = $result' "$cache_file" > "$cache_file.tmp" && mv "$cache_file.tmp" "$cache_file" 2>/dev/null || true
}

# Update CVE database
update_cve_database() {
    log_info "Updating CVE database" "apt-layer"
    
    local cve_db_file="$SECURITY_CVE_DB_DIR/cve-database.json"
    local config_file="$SECURITY_CONFIG_DIR/security-config.json"
    
    # Get database URL from config
    local db_url
    db_url=$(jq -r '.cve.database_url // "https://nvd.nist.gov/vuln/data-feeds"' "$config_file" 2>/dev/null || echo "https://nvd.nist.gov/vuln/data-feeds")
    
    # Download latest CVE data (simplified implementation)
    local temp_file
    temp_file=$(mktemp)
    
    if curl -s -L "$db_url" > "$temp_file" 2>/dev/null; then
        # Process and update database (simplified)
        log_success "CVE database updated successfully" "apt-layer"
        log_audit_event "CVE_DATABASE_UPDATE" "{\"status\": \"success\", \"source\": \"$db_url\"}" "INFO"
    else
        log_error "Failed to update CVE database" "apt-layer"
        log_audit_event "CVE_DATABASE_UPDATE" "{\"status\": \"failed\", \"source\": \"$db_url\"}" "ERROR"
        return 1
    fi
    
    rm -f "$temp_file"
    return 0
}

# Generate security report
generate_security_report() {
    local report_type="$1"
    local output_format="${2:-html}"
    local scan_level="${3:-standard}"
    
    log_info "Generating security report: $report_type" "apt-layer"
    
    local report_file="$SECURITY_REPORTS_DIR/security-report-$(date +%Y%m%d-%H%M%S).$output_format"
    
    case "$report_type" in
        "package")
            generate_package_security_report "$output_format" "$scan_level" "$report_file"
            ;;
        "layer")
            generate_layer_security_report "$output_format" "$scan_level" "$report_file"
            ;;
        "system")
            generate_system_security_report "$output_format" "$scan_level" "$report_file"
            ;;
        *)
            log_error "Unknown report type: $report_type" "apt-layer"
            return 1
            ;;
    esac
    
    log_success "Security report generated: $report_file" "apt-layer"
    log_audit_event "GENERATE_SECURITY_REPORT" "{\"type\": \"$report_type\", \"format\": \"$output_format\", \"file\": \"$report_file\"}"
    return 0
}

# Generate package security report
generate_package_security_report() {
    local output_format="$1"
    local scan_level="$2"
    local report_file="$3"
    
    case "$output_format" in
        "html")
            generate_package_html_report "$scan_level" "$report_file"
            ;;
        "json")
            generate_package_json_report "$scan_level" "$report_file"
            ;;
        *)
            log_error "Unsupported output format for package report: $output_format" "apt-layer"
            return 1
            ;;
    esac
}

# Generate package HTML report
generate_package_html_report() {
    local scan_level="$1"
    local report_file="$2"
    
    cat > "$report_file" << EOF
<!DOCTYPE html>
<html>
<head>
    <title>Package Security Report - $scan_level</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; }
        .header { background-color: #f0f0f0; padding: 20px; border-radius: 5px; }
        .section { margin: 20px 0; padding: 15px; border: 1px solid #ddd; border-radius: 5px; }
        .vulnerability { margin: 10px 0; padding: 10px; background-color: #f9f9f9; }
        .critical { border-left: 5px solid #f44336; }
        .high { border-left: 5px solid #ff9800; }
        .medium { border-left: 5px solid #ffc107; }
        .low { border-left: 5px solid #4CAF50; }
        table { width: 100%; border-collapse: collapse; margin: 10px 0; }
        th, td { border: 1px solid #ddd; padding: 8px; text-align: left; }
        th { background-color: #f2f2f2; }
    </style>
</head>
<body>
    <div class="header">
        <h1>Package Security Report</h1>
        <p><strong>Scan Level:</strong> $scan_level</p>
        <p><strong>Generated:</strong> $(date -u +%Y-%m-%dT%H:%M:%SZ)</p>
        <p><strong>System:</strong> $(hostname)</p>
    </div>
    
    <div class="section">
        <h2>Security Summary</h2>
        <p>This report provides a comprehensive security analysis of scanned packages.</p>
        <p>Scan level: $scan_level</p>
    </div>
    
    <div class="section">
        <h2>Recommendations</h2>
        <ul>
            <li>Review all critical and high severity vulnerabilities</li>
            <li>Update packages to latest secure versions</li>
            <li>Consider alternative packages for persistent vulnerabilities</li>
            <li>Implement security policies to prevent vulnerable package installation</li>
        </ul>
    </div>
</body>
</html>
EOF
}

# Generate package JSON report
generate_package_json_report() {
    local scan_level="$1"
    local report_file="$2"
    
    cat > "$report_file" << EOF
{
    "report_type": "package_security",
    "scan_level": "$scan_level",
    "generated_at": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
    "system": "$(hostname)",
    "summary": {
        "total_packages_scanned": 0,
        "vulnerable_packages": 0,
        "critical_vulnerabilities": 0,
        "high_vulnerabilities": 0,
        "medium_vulnerabilities": 0,
        "low_vulnerabilities": 0
    },
    "packages": [],
    "recommendations": [
        "Review all critical and high severity vulnerabilities",
        "Update packages to latest secure versions",
        "Consider alternative packages for persistent vulnerabilities",
        "Implement security policies to prevent vulnerable package installation"
    ]
}
EOF
}

# Generate layer security report
generate_layer_security_report() {
    local output_format="$1"
    local scan_level="$2"
    local report_file="$3"
    
    # Similar implementation to package report but for layers
    log_info "Layer security report generation not yet implemented" "apt-layer"
    return 1
}

# Generate system security report
generate_system_security_report() {
    local output_format="$1"
    local scan_level="$2"
    local report_file="$3"
    
    # Similar implementation to package report but for system-wide analysis
    log_info "System security report generation not yet implemented" "apt-layer"
    return 1
}

# Get security scanning status
get_security_status() {
    log_info "Getting security scanning system status" "apt-layer"
    
    echo "=== Security Scanning System Status ==="
    
    # General status
    echo "General:"
    echo "  Enabled: $SECURITY_ENABLED"
    echo "  Scan Level: $SECURITY_SCAN_LEVEL"
    echo "  Auto Scan: $SECURITY_AUTO_SCAN"
    echo "  CVE Checking: $SECURITY_CVE_CHECKING"
    echo "  Policy Enforcement: $SECURITY_POLICY_ENFORCEMENT"
    
    # CVE database status
    echo ""
    echo "CVE Database:"
    local cve_db_file="$SECURITY_CVE_DB_DIR/cve-database.json"
    if [[ -f "$cve_db_file" ]]; then
        local last_updated
        last_updated=$(jq -r '.metadata.last_updated' "$cve_db_file" 2>/dev/null || echo "unknown")
        local total_cves
        total_cves=$(jq -r '.metadata.total_cves' "$cve_db_file" 2>/dev/null || echo "0")
        echo "  Last Updated: $last_updated"
        echo "  Total CVEs: $total_cves"
    else
        echo "  Status: Not initialized"
    fi
    
    # Scan statistics
    echo ""
    echo "Scan Statistics:"
    local cache_file="$SECURITY_CACHE_DIR/scan-cache.json"
    if [[ -f "$cache_file" ]]; then
        local package_scans
        package_scans=$(jq -r '.package_scans | keys | length' "$cache_file" 2>/dev/null || echo "0")
        local layer_scans
        layer_scans=$(jq -r '.layer_scans | keys | length' "$cache_file" 2>/dev/null || echo "0")
        echo "  Cached Package Scans: $package_scans"
        echo "  Cached Layer Scans: $layer_scans"
    else
        echo "  Cache: Not initialized"
    fi
    
    # Report statistics
    echo ""
    echo "Report Statistics:"
    local report_count
    report_count=$(find "$SECURITY_REPORTS_DIR" -name "*.html" -o -name "*.json" 2>/dev/null | wc -l || echo "0")
    echo "  Total Reports: $report_count"
    
    echo ""
}

# Clean up old security reports
cleanup_old_security_reports() {
    local max_age_days="${1:-90}"
    
    log_info "Cleaning up security reports older than $max_age_days days" "apt-layer"
    
    local removed_count=0
    
    # Clean up old reports
    while IFS= read -r report_file; do
        local file_age
        file_age=$(find "$report_file" -mtime +$max_age_days 2>/dev/null | wc -l)
        
        if [[ $file_age -gt 0 ]]; then
            log_info "Removing old security report: $(basename "$report_file")" "apt-layer"
            rm -f "$report_file"
            ((removed_count++))
        fi
    done < <(find "$SECURITY_REPORTS_DIR" -name "*.html" -o -name "*.json" 2>/dev/null)
    
    log_success "Cleaned up $removed_count old security reports" "apt-layer"
    return 0
}

# =============================================================================
# INTEGRATION FUNCTIONS
# =============================================================================

# Initialize security scanning on script startup
init_security_scanning_on_startup() {
    # Only initialize if not already done
    if [[ ! -d "$SECURITY_STATE_DIR" ]]; then
        init_security_scanning
    fi
}

# Cleanup security scanning on script exit
cleanup_security_scanning_on_exit() {
    # Clean up temporary files
    rm -f "$SECURITY_CACHE_DIR"/temp-* 2>/dev/null || true
    rm -f "$SECURITY_SCANS_DIR"/temp-* 2>/dev/null || true
}

# Register cleanup function
trap cleanup_security_scanning_on_exit EXIT 

# --- END OF SCRIPTLET: 13-security-scanning.sh ---

# ============================================================================
# Admin Utilities (Health Monitoring, Analytics, Maintenance)
# ============================================================================

# 14-admin-utilities.sh - Admin Utilities for Particle-OS apt-layer
# Provides system health monitoring, performance analytics, and admin tools

# --- Color and Symbols ---
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
RED='\033[0;31m'
CYAN='\033[0;36m'
NC='\033[0m'
CHECK="â"
WARN="â ï¸ "
CROSS="â"
INFO="â¹ï¸ "

# --- Helper: Check for WSL ---
is_wsl() {
    grep -qi microsoft /proc/version 2>/dev/null
}

get_wsl_version() {
    if is_wsl; then
        if grep -q WSL2 /proc/version 2>/dev/null; then
            echo "WSL2"
        else
            echo "WSL1"
        fi
    fi
}

# --- System Health Monitoring ---
health_check() {
    local health_status=0
    echo -e "${CYAN}================= System Health Check =================${NC}"
    echo -e "${INFO} Hostname:        $(hostname 2>/dev/null || echo N/A)"
    echo -e "${INFO} Uptime:          $(uptime -p 2>/dev/null || echo N/A)"
    echo -e "${INFO} Kernel:          $(uname -r 2>/dev/null || echo N/A)"
    if is_wsl; then
        echo -e "${INFO} WSL:             $(get_wsl_version)"
    fi
    echo -e "${INFO} Load Avg:        $(awk '{print $1, $2, $3}' /proc/loadavg 2>/dev/null || echo N/A)"
    # CPU Info
    if command -v lscpu &>/dev/null; then
        cpu_model=$(lscpu | grep 'Model name' | awk -F: '{print $2}' | xargs)
        cpu_cores=$(lscpu | grep '^CPU(s):' | awk '{print $2}')
        echo -e "${INFO} CPU:             $cpu_model ($cpu_cores cores)"
    else
        echo -e "${WARN} CPU:             lscpu not available"
        health_status=1
    fi
    # Memory
    if command -v free &>/dev/null; then
        mem_line=$(free -m | grep Mem)
        mem_total=$(echo $mem_line | awk '{print $2}')
        mem_used=$(echo $mem_line | awk '{print $3}')
        mem_free=$(echo $mem_line | awk '{print $4}')
        mem_perc=$((100 * mem_used / mem_total))
        echo -e "${INFO} Memory:          ${mem_total}MiB total, ${mem_used}MiB used (${mem_perc}%)"
    else
        echo -e "${WARN} Memory:          free not available"
        health_status=1
    fi
    # Disk
    if command -v df &>/dev/null; then
        disk_root=$(df -h / | tail -1)
        disk_total=$(echo $disk_root | awk '{print $2}')
        disk_used=$(echo $disk_root | awk '{print $3}')
        disk_avail=$(echo $disk_root | awk '{print $4}')
        disk_perc=$(echo $disk_root | awk '{print $5}')
        echo -e "${INFO} Disk /:          $disk_total total, $disk_used used, $disk_avail free ($disk_perc)"
        if [ -d /var/lib/particle-os ]; then
            disk_ublue=$(df -h /var/lib/particle-os 2>/dev/null | tail -1)
            if [ -n "$disk_ublue" ]; then
                ublue_total=$(echo $disk_ublue | awk '{print $2}')
                ublue_used=$(echo $disk_ublue | awk '{print $3}')
                ublue_avail=$(echo $disk_ublue | awk '{print $4}')
                ublue_perc=$(echo $disk_ublue | awk '{print $5}')
                echo -e "${INFO} Disk /var/lib/particle-os: $ublue_total total, $ublue_used used, $ublue_avail free ($ublue_perc)"
            fi
        fi
    else
        echo -e "${WARN} Disk:            df not available"
        health_status=1
    fi
    # OverlayFS/ComposeFS
    overlays=$(mount | grep overlay | wc -l)
    composefs=$(mount | grep composefs | wc -l)
    echo -e "${INFO} OverlayFS:       $overlays overlays mounted"
    echo -e "${INFO} ComposeFS:       $composefs composefs mounted"
    # Bootloader
    if command -v bootctl &>/dev/null; then
        boot_status=$(bootctl status 2>/dev/null | grep 'System:' | xargs)
        echo -e "${INFO} Bootloader:      ${boot_status:-N/A}"
    else
        echo -e "${WARN} Bootloader:      bootctl not available"
    fi
    # Security
    if command -v apparmor_status &>/dev/null; then
        sec_status=$(apparmor_status | grep 'profiles are in enforce mode' || echo 'N/A')
        echo -e "${INFO} Security:        $sec_status"
    else
        echo -e "${WARN} Security:        apparmor_status not available"
    fi
    # Layer Integrity/Deployment
    echo -e "${CYAN}-----------------------------------------------------${NC}"
    echo -e "${INFO} Layer Integrity: [Coming soon] (future: check layer hashes)"
    echo -e "${INFO} Deployment Status: [Coming soon] (future: show active deployments)"
    # Top processes
    echo -e "${CYAN}---------------- Top 3 Processes ---------------------${NC}"
    if command -v ps &>/dev/null; then
        echo -e "${INFO} By CPU:"
        ps -eo pid,comm,%cpu --sort=-%cpu | head -n 4 | tail -n 3 | awk '{printf "  PID: %-6s %-20s CPU: %s%%\n", $1, $2, $3}'
        echo -e "${INFO} By MEM:"
        ps -eo pid,comm,%mem --sort=-%mem | head -n 4 | tail -n 3 | awk '{printf "  PID: %-6s %-20s MEM: %s%%\n", $1, $2, $3}'
    else
        echo -e "${WARN} ps not available for process listing"
    fi
    echo -e "${CYAN}-----------------------------------------------------${NC}"
    # Summary
    if [ $health_status -eq 0 ]; then
        echo -e "${GREEN}${CHECK} System health: OK${NC}"
    else
        echo -e "${YELLOW}${WARN} System health: WARNING (see above)${NC}"
    fi
    echo -e "${CYAN}=====================================================${NC}"
}

# --- Performance Analytics ---
performance_report() {
    echo -e "${CYAN}=============== Performance Analytics ===============${NC}"
    echo -e "${INFO} Layer creation time (last 5): [Coming soon] (future: show timing logs)"
    echo -e "${INFO} Resource usage (CPU/mem): [Coming soon] (future: show resource stats)"
    if command -v iostat &>/dev/null; then
        echo -e "${INFO} Disk I/O stats:"
        iostat | grep -A1 Device | tail -n +2
    else
        echo -e "${WARN} Disk I/O stats: iostat not available"
    fi
    echo -e "${INFO} Historical trends: [Coming soon] (future: show trends if data available)"
    echo -e "${CYAN}=====================================================${NC}"
}

# --- Automated Maintenance ---
admin_cleanup() {
    # Defaults
    local days=30
    local dry_run=false
    local keep_recent=2
    local DEPLOYMENTS_DIR="/var/lib/particle-os/deployments"
    local LOGS_DIR="/var/log/apt-layer"
    local BACKUPS_DIR="/var/lib/particle-os/backups"

    # Load config from JSON if available
    local config_file="$(dirname "${BASH_SOURCE[0]}")/../config/maintenance.json"
    if [ -f "$config_file" ] && command -v jq &>/dev/null; then
        days=$(jq -r '.retention_days // 30' "$config_file")
        keep_recent=$(jq -r '.keep_recent // 2' "$config_file")
        DEPLOYMENTS_DIR=$(jq -r '.deployments_dir // "/var/lib/particle-os/deployments"' "$config_file")
        LOGS_DIR=$(jq -r '.logs_dir // "/var/log/apt-layer"' "$config_file")
        BACKUPS_DIR=$(jq -r '.backups_dir // "/var/lib/particle-os/backups"' "$config_file")
    fi

    # Parse arguments (override config)
    while [[ $# -gt 0 ]]; do
        case $1 in
            --days|-d)
                days="$2"; shift 2;;
            --dry-run)
                dry_run=true; shift;;
            --keep-recent)
                keep_recent="$2"; shift 2;;
            --deployments-dir)
                DEPLOYMENTS_DIR="$2"; shift 2;;
            --logs-dir)
                LOGS_DIR="$2"; shift 2;;
            --backups-dir)
                BACKUPS_DIR="$2"; shift 2;;
            --schedule)
                echo -e "${YELLOW}${WARN} Scheduled cleanup: Not yet implemented (will use systemd/cron)${NC}"; return;;
            *)
                shift;;
        esac
    done

    echo -e "${CYAN}--- Automated Maintenance Cleanup ---${NC}"
    echo -e "${INFO} Retention: $days days"
    echo -e "${INFO} Keep recent: $keep_recent items"
    echo -e "${INFO} Deployments dir: $DEPLOYMENTS_DIR"
    echo -e "${INFO} Logs dir: $LOGS_DIR"
    echo -e "${INFO} Backups dir: $BACKUPS_DIR"
    if [ "$dry_run" = true ]; then
        echo -e "${YELLOW}${WARN} DRY RUN MODE - No files will be deleted${NC}"
    fi

    local total_deleted=0
    
    # Helper function to cleanup directory
    cleanup_directory() {
        local dir="$1"
        local description="$2"
        local deleted_count=0
        
        if [ ! -d "$dir" ]; then
            echo -e "${INFO} $description: Directory does not exist, skipping"
            return
        fi
        
        echo -e "${INFO} $description: Scanning $dir"
        
        # Get list of files/directories older than retention period
        local old_items=()
        if command -v find &>/dev/null; then
            while IFS= read -r -d '' item; do
                old_items+=("$item")
            done < <(find "$dir" -maxdepth 1 -type f -o -type d -mtime +$days -print0 2>/dev/null)
        fi
        
        # Remove the most recent items from deletion list
        if [ ${#old_items[@]} -gt 0 ] && [ $keep_recent -gt 0 ]; then
            # Sort by modification time (newest first) and keep the most recent
            local sorted_items=($(printf '%s\n' "${old_items[@]}" | xargs -I {} stat -c '%Y %n' {} 2>/dev/null | sort -nr | tail -n +$((keep_recent + 1)) | awk '{print $2}'))
            old_items=("${sorted_items[@]}")
        fi
        
        if [ ${#old_items[@]} -eq 0 ]; then
            echo -e "${INFO} $description: No items to delete"
            return
        fi
        
        echo -e "${INFO} $description: Found ${#old_items[@]} items to delete"
        
        for item in "${old_items[@]}"; do
            if [ "$dry_run" = true ]; then
                echo -e "  ${YELLOW}Would delete: $item${NC}"
            else
                if rm -rf "$item" 2>/dev/null; then
                    echo -e "  ${GREEN}Deleted: $item${NC}"
                    ((deleted_count++))
                else
                    echo -e "  ${RED}Failed to delete: $item${NC}"
                fi
            fi
        done
        
        if [ "$dry_run" = false ]; then
            total_deleted=$((total_deleted + deleted_count))
        fi
    }
    
    # Cleanup each directory
    cleanup_directory "$DEPLOYMENTS_DIR" "Deployments"
    cleanup_directory "$LOGS_DIR" "Logs"
    cleanup_directory "$BACKUPS_DIR" "Backups"
    
    # Summary
    if [ "$dry_run" = true ]; then
        echo -e "${YELLOW}${WARN} Dry run completed - no files were deleted${NC}"
    else
        echo -e "${GREEN}${CHECK} Cleanup complete - $total_deleted items deleted${NC}"
    fi
    echo -e "${CYAN}-------------------------------------${NC}"
}

# --- Backup/Restore (Stub) ---
admin_backup() {
    echo -e "${YELLOW}${WARN} Backup: Not yet implemented${NC}"
}

admin_restore() {
    echo -e "${YELLOW}${WARN} Restore: Not yet implemented${NC}"
}

# --- Command Dispatch ---
admin_utilities_main() {
    case "${1:-}" in
        health|health-check)
            health_check
            ;;
        perf|performance|analytics)
            performance_report
            ;;
        cleanup)
            shift
            admin_cleanup "$@"
            ;;
        backup)
            admin_backup
            ;;
        restore)
            admin_restore
            ;;
        help|--help|-h|"")
            echo -e "${CYAN}Admin Utilities Commands:${NC}"
            echo -e "  ${GREEN}health${NC}         - System health check"
            echo -e "  ${GREEN}perf${NC}           - Performance analytics"
            echo -e "  ${GREEN}cleanup${NC}        - Maintenance cleanup (--days N, --dry-run, --keep-recent N)"
            echo -e "  ${GREEN}backup${NC}         - Backup configs/layers (stub)"
            echo -e "  ${GREEN}restore${NC}        - Restore from backup (stub)"
            echo -e "  ${GREEN}help${NC}           - Show this help message"
            ;;
        *)
            echo -e "${RED}${CROSS} Unknown admin command: $1${NC}"
            admin_utilities_main help
            ;;
    esac
} 

# --- END OF SCRIPTLET: 14-admin-utilities.sh ---

# ============================================================================
# Multi-Tenant Support (Enterprise Features)
# ============================================================================

# Multi-Tenant Support for apt-layer
# Enables enterprise deployments with multiple organizations, departments, or environments
# Provides tenant isolation, resource quotas, and cross-tenant management

# Multi-tenant configuration
MULTI_TENANT_ENABLED="${MULTI_TENANT_ENABLED:-false}"
TENANT_ISOLATION_LEVEL="${TENANT_ISOLATION_LEVEL:-strict}"  # strict, moderate, permissive
TENANT_RESOURCE_QUOTAS="${TENANT_RESOURCE_QUOTAS:-true}"
TENANT_CROSS_ACCESS="${TENANT_CROSS_ACCESS:-false}"

# Tenant management functions
init_multi_tenant_system() {
    log_info "Initializing multi-tenant system..." "multi-tenant"
    
    # Create tenant directories
    local tenant_base="${WORKSPACE}/tenants"
    mkdir -p "$tenant_base"
    mkdir -p "$tenant_base/shared"
    mkdir -p "$tenant_base/templates"
    
    # Initialize tenant database
    local tenant_db="$tenant_base/tenants.json"
    if [[ ! -f "$tenant_db" ]]; then
        cat > "$tenant_db" << 'EOF'
{
  "tenants": [],
  "policies": {
    "default_isolation": "strict",
    "default_quotas": {
      "max_layers": 100,
      "max_storage_gb": 50,
      "max_users": 10
    },
    "cross_tenant_access": false
  },
  "metadata": {
    "created": "",
    "version": "1.0"
  }
}
EOF
        # Set creation timestamp
        jq --arg created "$(date -Iseconds)" '.metadata.created = $created' "$tenant_db" > "$tenant_db.tmp" && mv "$tenant_db.tmp" "$tenant_db"
    fi
    
    log_success "Multi-tenant system initialized" "multi-tenant"
}

# Tenant creation and management
create_tenant() {
    local tenant_name="$1"
    local tenant_config="$2"
    
    if [[ -z "$tenant_name" ]]; then
        log_error "Tenant name is required" "multi-tenant"
        return 1
    fi
    
    # Validate tenant name
    if [[ ! "$tenant_name" =~ ^[a-zA-Z0-9_-]+$ ]]; then
        log_error "Invalid tenant name: $tenant_name (use alphanumeric, underscore, hyphen only)" "multi-tenant"
        return 1
    fi
    
    local tenant_base="${WORKSPACE}/tenants"
    local tenant_db="$tenant_base/tenants.json"
    local tenant_dir="$tenant_base/$tenant_name"
    
    # Check if tenant already exists
    if jq -e ".tenants[] | select(.name == \"$tenant_name\")" "$tenant_db" > /dev/null 2>&1; then
        log_error "Tenant '$tenant_name' already exists" "multi-tenant"
        return 1
    fi
    
    # Create tenant directory structure
    mkdir -p "$tenant_dir"
    mkdir -p "$tenant_dir/layers"
    mkdir -p "$tenant_dir/deployments"
    mkdir -p "$tenant_dir/users"
    mkdir -p "$tenant_dir/audit"
    mkdir -p "$tenant_dir/backups"
    mkdir -p "$tenant_dir/config"
    
    # Create tenant configuration
    local tenant_config_file="$tenant_dir/config/tenant.json"
    cat > "$tenant_config_file" << EOF
{
  "name": "$tenant_name",
  "created": "$(date -Iseconds)",
  "status": "active",
  "isolation_level": "$TENANT_ISOLATION_LEVEL",
  "quotas": {
    "max_layers": 100,
    "max_storage_gb": 50,
    "max_users": 10,
    "used_layers": 0,
    "used_storage_gb": 0,
    "used_users": 0
  },
  "policies": {
    "allowed_packages": [],
    "blocked_packages": [],
    "security_level": "standard",
    "audit_retention_days": 90
  },
  "integrations": {
    "oci_registries": [],
    "external_audit": null,
    "monitoring": null
  }
}
EOF
    
    # Merge custom configuration if provided
    if [[ -n "$tenant_config" && -f "$tenant_config" ]]; then
        if jq empty "$tenant_config" 2>/dev/null; then
            jq -s '.[0] * .[1]' "$tenant_config_file" "$tenant_config" > "$tenant_config_file.tmp" && mv "$tenant_config_file.tmp" "$tenant_config_file"
        else
            log_warning "Invalid JSON in tenant configuration, using defaults" "multi-tenant"
        fi
    fi
    
    # Add tenant to database
    local tenant_info
    tenant_info=$(jq -r '.' "$tenant_config_file")
    jq --arg name "$tenant_name" --argjson info "$tenant_info" '.tenants += [$info]' "$tenant_db" > "$tenant_db.tmp" && mv "$tenant_db.tmp" "$tenant_db"
    
    log_success "Tenant '$tenant_name' created successfully" "multi-tenant"
    log_info "Tenant directory: $tenant_dir" "multi-tenant"
}

# Tenant deletion
delete_tenant() {
    local tenant_name="$1"
    local force="${2:-false}"
    
    if [[ -z "$tenant_name" ]]; then
        log_error "Tenant name is required" "multi-tenant"
        return 1
    fi
    
    local tenant_base="${WORKSPACE}/tenants"
    local tenant_db="$tenant_base/tenants.json"
    local tenant_dir="$tenant_base/$tenant_name"
    
    # Check if tenant exists
    if ! jq -e ".tenants[] | select(.name == \"$tenant_name\")" "$tenant_db" > /dev/null 2>&1; then
        log_error "Tenant '$tenant_name' does not exist" "multi-tenant"
        return 1
    fi
    
    # Check for active resources
    local active_layers=0
    local active_deployments=0
    
    if [[ -d "$tenant_dir/layers" ]]; then
        active_layers=$(find "$tenant_dir/layers" -name "*.squashfs" 2>/dev/null | wc -l)
    fi
    
    if [[ -d "$tenant_dir/deployments" ]]; then
        active_deployments=$(find "$tenant_dir/deployments" -name "*.json" 2>/dev/null | wc -l)
    fi
    
    if [[ $active_layers -gt 0 || $active_deployments -gt 0 ]]; then
        if [[ "$force" != "true" ]]; then
            log_error "Tenant '$tenant_name' has active resources ($active_layers layers, $active_deployments deployments)" "multi-tenant"
            log_error "Use --force to delete anyway" "multi-tenant"
            return 1
        else
            log_warning "Force deleting tenant with active resources" "multi-tenant"
        fi
    fi
    
    # Remove from database
    jq --arg name "$tenant_name" 'del(.tenants[] | select(.name == $name))' "$tenant_db" > "$tenant_db.tmp" && mv "$tenant_db.tmp" "$tenant_db"
    
    # Remove tenant directory
    if [[ -d "$tenant_dir" ]]; then
        rm -rf "$tenant_dir"
    fi
    
    log_success "Tenant '$tenant_name' deleted successfully" "multi-tenant"
}

# Tenant listing and information
list_tenants() {
    local format="${1:-table}"
    local tenant_base="${WORKSPACE}/tenants"
    local tenant_db="$tenant_base/tenants.json"
    
    if [[ ! -f "$tenant_db" ]]; then
        log_error "Tenant database not found" "multi-tenant"
        return 1
    fi
    
    case "$format" in
        "json")
            jq -r '.' "$tenant_db"
            ;;
        "csv")
            echo "name,status,created,layers,storage_gb,users"
            jq -r '.tenants[] | [.name, .status, .created, .quotas.used_layers, .quotas.used_storage_gb, .quotas.used_users] | @csv' "$tenant_db"
            ;;
        "table"|*)
            echo "Tenants:"
            echo "========"
            jq -r '.tenants[] | "\(.name) (\(.status)) - Layers: \(.quotas.used_layers)/\(.quotas.max_layers), Storage: \(.quotas.used_storage_gb)GB/\(.quotas.max_storage_gb)GB"' "$tenant_db"
            ;;
    esac
}

# Tenant information
get_tenant_info() {
    local tenant_name="$1"
    local format="${2:-json}"
    
    if [[ -z "$tenant_name" ]]; then
        log_error "Tenant name is required" "multi-tenant"
        return 1
    fi
    
    local tenant_base="${WORKSPACE}/tenants"
    local tenant_db="$tenant_base/tenants.json"
    
    local tenant_info
    tenant_info=$(jq -r ".tenants[] | select(.name == \"$tenant_name\")" "$tenant_db" 2>/dev/null)
    
    if [[ -z "$tenant_info" ]]; then
        log_error "Tenant '$tenant_name' not found" "multi-tenant"
        return 1
    fi
    
    case "$format" in
        "json")
            echo "$tenant_info"
            ;;
        "yaml")
            echo "$tenant_info" | jq -r '.' | sed 's/^/  /'
            ;;
        "summary")
            local name status created layers storage users
            name=$(echo "$tenant_info" | jq -r '.name')
            status=$(echo "$tenant_info" | jq -r '.status')
            created=$(echo "$tenant_info" | jq -r '.created')
            layers=$(echo "$tenant_info" | jq -r '.quotas.used_layers')
            storage=$(echo "$tenant_info" | jq -r '.quotas.used_storage_gb')
            users=$(echo "$tenant_info" | jq -r '.quotas.used_users')
            
            echo "Tenant: $name"
            echo "Status: $status"
            echo "Created: $created"
            echo "Resources: $layers layers, ${storage}GB storage, $users users"
            ;;
    esac
}

# Tenant quota management
update_tenant_quotas() {
    local tenant_name="$1"
    local quota_type="$2"
    local value="$3"
    
    if [[ -z "$tenant_name" || -z "$quota_type" || -z "$value" ]]; then
        log_error "Usage: update_tenant_quotas <tenant> <quota_type> <value>" "multi-tenant"
        return 1
    fi
    
    local tenant_base="${WORKSPACE}/tenants"
    local tenant_db="$tenant_base/tenants.json"
    
    # Validate quota type
    case "$quota_type" in
        "max_layers"|"max_storage_gb"|"max_users")
            ;;
        *)
            log_error "Invalid quota type: $quota_type" "multi-tenant"
            log_error "Valid types: max_layers, max_storage_gb, max_users" "multi-tenant"
            return 1
            ;;
    esac
    
    # Update quota
    jq --arg name "$tenant_name" --arg type "$quota_type" --arg value "$value" \
       '.tenants[] | select(.name == $name) | .quotas[$type] = ($value | tonumber)' "$tenant_db" > "$tenant_db.tmp" && mv "$tenant_db.tmp" "$tenant_db"
    
    log_success "Updated quota for tenant '$tenant_name': $quota_type = $value" "multi-tenant"
}

# Tenant isolation and access control
check_tenant_access() {
    local tenant_name="$1"
    local user="$2"
    local operation="$3"
    
    if [[ -z "$tenant_name" || -z "$user" || -z "$operation" ]]; then
        log_error "Usage: check_tenant_access <tenant> <user> <operation>" "multi-tenant"
        return 1
    fi
    
    local tenant_base="${WORKSPACE}/tenants"
    local tenant_db="$tenant_base/tenants.json"
    
    # Check if tenant exists
    if ! jq -e ".tenants[] | select(.name == \"$tenant_name\")" "$tenant_db" > /dev/null 2>&1; then
        log_error "Tenant '$tenant_name' not found" "multi-tenant"
        return 1
    fi
    
    # Get tenant isolation level
    local isolation_level
    isolation_level=$(jq -r ".tenants[] | select(.name == \"$tenant_name\") | .isolation_level" "$tenant_db")
    
    # Check user access (simplified - in real implementation, this would check user roles)
    local user_file="$tenant_base/$tenant_name/users/$user.json"
    if [[ ! -f "$user_file" ]]; then
        log_error "User '$user' not found in tenant '$tenant_name'" "multi-tenant"
        return 1
    fi
    
    # Check operation permissions
    local user_role
    user_role=$(jq -r '.role' "$user_file" 2>/dev/null)
    
    case "$operation" in
        "read")
            [[ "$user_role" =~ ^(admin|package_manager|viewer)$ ]] && return 0
            ;;
        "write")
            [[ "$user_role" =~ ^(admin|package_manager)$ ]] && return 0
            ;;
        "admin")
            [[ "$user_role" == "admin" ]] && return 0
            ;;
        *)
            log_error "Unknown operation: $operation" "multi-tenant"
            return 1
            ;;
    esac
    
    log_error "Access denied: User '$user' with role '$user_role' cannot perform '$operation' operation" "multi-tenant"
    return 1
}

# Tenant resource usage tracking
update_tenant_usage() {
    local tenant_name="$1"
    local resource_type="$2"
    local amount="$3"
    
    if [[ -z "$tenant_name" || -z "$resource_type" || -z "$amount" ]]; then
        log_error "Usage: update_tenant_usage <tenant> <resource_type> <amount>" "multi-tenant"
        return 1
    fi
    
    local tenant_base="${WORKSPACE}/tenants"
    local tenant_db="$tenant_base/tenants.json"
    
    # Update usage
    jq --arg name "$tenant_name" --arg type "$resource_type" --arg amount "$amount" \
       '.tenants[] | select(.name == $name) | .quotas["used_" + $type] = (.quotas["used_" + $type] + ($amount | tonumber))' "$tenant_db" > "$tenant_db.tmp" && mv "$tenant_db.tmp" "$tenant_db"
    
    log_debug "Updated usage for tenant '$tenant_name': $resource_type += $amount" "multi-tenant"
}

# Tenant quota enforcement
enforce_tenant_quotas() {
    local tenant_name="$1"
    local resource_type="$2"
    local requested_amount="$3"
    
    if [[ -z "$tenant_name" || -z "$resource_type" || -z "$requested_amount" ]]; then
        log_error "Usage: enforce_tenant_quotas <tenant> <resource_type> <amount>" "multi-tenant"
        return 1
    fi
    
    local tenant_base="${WORKSPACE}/tenants"
    local tenant_db="$tenant_base/tenants.json"
    
    # Get current usage and quota
    local current_usage max_quota
    current_usage=$(jq -r ".tenants[] | select(.name == \"$tenant_name\") | .quotas.used_$resource_type" "$tenant_db")
    max_quota=$(jq -r ".tenants[] | select(.name == \"$tenant_name\") | .quotas.max_$resource_type" "$tenant_db")
    
    # Check if request would exceed quota
    local new_total=$((current_usage + requested_amount))
    if [[ $new_total -gt $max_quota ]]; then
        log_error "Quota exceeded for tenant '$tenant_name': $resource_type" "multi-tenant"
        log_error "Current: $current_usage, Requested: $requested_amount, Max: $max_quota" "multi-tenant"
        return 1
    fi
    
    return 0
}

# Cross-tenant operations (when enabled)
cross_tenant_operation() {
    local source_tenant="$1"
    local target_tenant="$2"
    local operation="$3"
    local user="$4"
    
    if [[ "$TENANT_CROSS_ACCESS" != "true" ]]; then
        log_error "Cross-tenant operations are disabled" "multi-tenant"
        return 1
    fi
    
    if [[ -z "$source_tenant" || -z "$target_tenant" || -z "$operation" || -z "$user" ]]; then
        log_error "Usage: cross_tenant_operation <source> <target> <operation> <user>" "multi-tenant"
        return 1
    fi
    
    # Check user has admin access to both tenants
    if ! check_tenant_access "$source_tenant" "$user" "admin"; then
        log_error "User '$user' lacks admin access to source tenant '$source_tenant'" "multi-tenant"
        return 1
    fi
    
    if ! check_tenant_access "$target_tenant" "$user" "admin"; then
        log_error "User '$user' lacks admin access to target tenant '$target_tenant'" "multi-tenant"
        return 1
    fi
    
    log_info "Cross-tenant operation: $operation from '$source_tenant' to '$target_tenant' by '$user'" "multi-tenant"
    
    # Implement specific cross-tenant operations here
    case "$operation" in
        "copy_layer")
            # Copy layer from source to target tenant
            log_info "Copying layer between tenants..." "multi-tenant"
            ;;
        "sync_config")
            # Sync configuration between tenants
            log_info "Syncing configuration between tenants..." "multi-tenant"
            ;;
        *)
            log_error "Unknown cross-tenant operation: $operation" "multi-tenant"
            return 1
            ;;
    esac
}

# Tenant backup and restore
backup_tenant() {
    local tenant_name="$1"
    local backup_path="$2"
    
    if [[ -z "$tenant_name" ]]; then
        log_error "Tenant name is required" "multi-tenant"
        return 1
    fi
    
    local tenant_base="${WORKSPACE}/tenants"
    local tenant_dir="$tenant_base/$tenant_name"
    
    if [[ ! -d "$tenant_dir" ]]; then
        log_error "Tenant directory not found: $tenant_dir" "multi-tenant"
        return 1
    fi
    
    # Create backup
    local backup_file
    if [[ -n "$backup_path" ]]; then
        backup_file="$backup_path"
    else
        backup_file="$tenant_dir/backups/tenant-${tenant_name}-$(date +%Y%m%d-%H%M%S).tar.gz"
    fi
    
    mkdir -p "$(dirname "$backup_file")"
    
    tar -czf "$backup_file" -C "$tenant_base" "$tenant_name"
    
    log_success "Tenant '$tenant_name' backed up to: $backup_file" "multi-tenant"
}

restore_tenant() {
    local backup_file="$1"
    local tenant_name="$2"
    
    if [[ -z "$backup_file" || -z "$tenant_name" ]]; then
        log_error "Usage: restore_tenant <backup_file> <tenant_name>" "multi-tenant"
        return 1
    fi
    
    if [[ ! -f "$backup_file" ]]; then
        log_error "Backup file not found: $backup_file" "multi-tenant"
        return 1
    fi
    
    local tenant_base="${WORKSPACE}/tenants"
    local tenant_dir="$tenant_base/$tenant_name"
    
    # Check if tenant already exists
    if [[ -d "$tenant_dir" ]]; then
        log_error "Tenant '$tenant_name' already exists. Delete it first or use a different name." "multi-tenant"
        return 1
    fi
    
    # Restore tenant
    tar -xzf "$backup_file" -C "$tenant_base"
    
    log_success "Tenant '$tenant_name' restored from: $backup_file" "multi-tenant"
}

# Tenant health check
check_tenant_health() {
    local tenant_name="$1"
    
    if [[ -z "$tenant_name" ]]; then
        log_error "Tenant name is required" "multi-tenant"
        return 1
    fi
    
    local tenant_base="${WORKSPACE}/tenants"
    local tenant_dir="$tenant_base/$tenant_name"
    local tenant_db="$tenant_base/tenants.json"
    
    echo "Tenant Health Check: $tenant_name"
    echo "================================"
    
    # Check tenant exists
    if [[ ! -d "$tenant_dir" ]]; then
        echo "â Tenant directory not found"
        return 1
    fi
    
    if ! jq -e ".tenants[] | select(.name == \"$tenant_name\")" "$tenant_db" > /dev/null 2>&1; then
        echo "â Tenant not found in database"
        return 1
    fi
    
    echo "â Tenant exists"
    
    # Check directory structure
    local missing_dirs=()
    for dir in layers deployments users audit backups config; do
        if [[ ! -d "$tenant_dir/$dir" ]]; then
            missing_dirs+=("$dir")
        fi
    done
    
    if [[ ${#missing_dirs[@]} -gt 0 ]]; then
        echo "â ï¸  Missing directories: ${missing_dirs[*]}"
    else
        echo "â Directory structure complete"
    fi
    
    # Check quota usage
    local tenant_info
    tenant_info=$(jq -r ".tenants[] | select(.name == \"$tenant_name\")" "$tenant_db")
    
    local layers_used layers_max storage_used storage_max
    layers_used=$(echo "$tenant_info" | jq -r '.quotas.used_layers')
    layers_max=$(echo "$tenant_info" | jq -r '.quotas.max_layers')
    storage_used=$(echo "$tenant_info" | jq -r '.quotas.used_storage_gb')
    storage_max=$(echo "$tenant_info" | jq -r '.quotas.max_storage_gb')
    
    echo "ð Resource Usage:"
    echo "   Layers: $layers_used/$layers_max"
    echo "   Storage: ${storage_used}GB/${storage_max}GB"
    
    # Check for quota warnings
    local layer_percent=$((layers_used * 100 / layers_max))
    local storage_percent=$((storage_used * 100 / storage_max))
    
    if [[ $layer_percent -gt 80 ]]; then
        echo "â ï¸  Layer quota usage high: ${layer_percent}%"
    fi
    
    if [[ $storage_percent -gt 80 ]]; then
        echo "â ï¸  Storage quota usage high: ${storage_percent}%"
    fi
    
    echo "â Tenant health check complete"
}

# Multi-tenant command handler
handle_multi_tenant_command() {
    local command="$1"
    shift
    
    case "$command" in
        "init")
            init_multi_tenant_system
            ;;
        "create")
            local tenant_name="$1"
            local config_file="$2"
            create_tenant "$tenant_name" "$config_file"
            ;;
        "delete")
            local tenant_name="$1"
            local force="$2"
            delete_tenant "$tenant_name" "$force"
            ;;
        "list")
            local format="$1"
            list_tenants "$format"
            ;;
        "info")
            local tenant_name="$1"
            local format="$2"
            get_tenant_info "$tenant_name" "$format"
            ;;
        "quota")
            local tenant_name="$1"
            local quota_type="$2"
            local value="$3"
            update_tenant_quotas "$tenant_name" "$quota_type" "$value"
            ;;
        "backup")
            local tenant_name="$1"
            local backup_path="$2"
            backup_tenant "$tenant_name" "$backup_path"
            ;;
        "restore")
            local backup_file="$1"
            local tenant_name="$2"
            restore_tenant "$backup_file" "$tenant_name"
            ;;
        "health")
            local tenant_name="$1"
            check_tenant_health "$tenant_name"
            ;;
        "help"|*)
            echo "Multi-Tenant Commands:"
            echo "====================="
            echo "  init                                    - Initialize multi-tenant system"
            echo "  create <tenant> [config_file]          - Create new tenant"
            echo "  delete <tenant> [--force]              - Delete tenant"
            echo "  list [format]                          - List tenants (json|csv|table)"
            echo "  info <tenant> [format]                 - Get tenant info (json|yaml|summary)"
            echo "  quota <tenant> <type> <value>          - Update tenant quota"
            echo "  backup <tenant> [path]                 - Backup tenant"
            echo "  restore <backup_file> <tenant>         - Restore tenant"
            echo "  health <tenant>                        - Check tenant health"
            echo "  help                                   - Show this help"
            ;;
    esac
} 

# --- END OF SCRIPTLET: 15-multi-tenant.sh ---

# ============================================================================
# Advanced Compliance Frameworks (Enterprise Features)
# ============================================================================

# Advanced Compliance Frameworks for apt-layer
# Provides comprehensive compliance capabilities for enterprise deployments
# Supports multiple compliance standards with automated reporting and validation

# Compliance framework configuration
COMPLIANCE_ENABLED="${COMPLIANCE_ENABLED:-true}"
COMPLIANCE_LEVEL="${COMPLIANCE_LEVEL:-enterprise}"  # basic, enterprise, strict
COMPLIANCE_AUTO_SCAN="${COMPLIANCE_AUTO_SCAN:-true}"
COMPLIANCE_REPORTING="${COMPLIANCE_REPORTING:-true}"

# Supported compliance frameworks
SUPPORTED_FRAMEWORKS=(
    "SOX"           # Sarbanes-Oxley Act
    "PCI-DSS"       # Payment Card Industry Data Security Standard
    "HIPAA"         # Health Insurance Portability and Accountability Act
    "GDPR"          # General Data Protection Regulation
    "ISO-27001"     # Information Security Management
    "NIST-CSF"      # NIST Cybersecurity Framework
    "CIS"           # Center for Internet Security Controls
    "FEDRAMP"       # Federal Risk and Authorization Management Program
    "SOC-2"         # Service Organization Control 2
    "CMMC"          # Cybersecurity Maturity Model Certification
)

# Compliance framework initialization
init_compliance_frameworks() {
    log_info "Initializing advanced compliance frameworks..." "compliance"
    
    # Create compliance directories
    local compliance_base="${WORKSPACE}/compliance"
    mkdir -p "$compliance_base"
    mkdir -p "$compliance_base/frameworks"
    mkdir -p "$compliance_base/reports"
    mkdir -p "$compliance_base/templates"
    mkdir -p "$compliance_base/evidence"
    mkdir -p "$compliance_base/controls"
    
    # Initialize compliance database
    local compliance_db="$compliance_base/compliance.json"
    if [[ ! -f "$compliance_db" ]]; then
        cat > "$compliance_db" << 'EOF'
{
  "frameworks": {},
  "controls": {},
  "evidence": {},
  "reports": {},
  "metadata": {
    "created": "",
    "version": "1.0",
    "last_scan": null
  }
}
EOF
        # Set creation timestamp
        jq --arg created "$(date -Iseconds)" '.metadata.created = $created' "$compliance_db" > "$compliance_db.tmp" && mv "$compliance_db.tmp" "$compliance_db"
    fi
    
    # Initialize framework templates
    init_framework_templates
    
    log_success "Advanced compliance frameworks initialized" "compliance"
}

# Initialize framework templates
init_framework_templates() {
    local templates_dir="${WORKSPACE}/compliance/templates"
    
    # SOX Template
    cat > "$templates_dir/sox.json" << 'EOF'
{
  "name": "SOX",
  "version": "2024",
  "description": "Sarbanes-Oxley Act Compliance",
  "controls": {
    "SOX-001": {
      "title": "Access Control",
      "description": "Ensure proper access controls are in place",
      "category": "Access Management",
      "severity": "high",
      "requirements": [
        "User authentication and authorization",
        "Role-based access control",
        "Access logging and monitoring"
      ]
    },
    "SOX-002": {
      "title": "Change Management",
      "description": "Implement proper change management procedures",
      "category": "Change Management",
      "severity": "high",
      "requirements": [
        "Change approval process",
        "Change documentation",
        "Change testing and validation"
      ]
    },
    "SOX-003": {
      "title": "Data Integrity",
      "description": "Ensure data integrity and accuracy",
      "category": "Data Management",
      "severity": "critical",
      "requirements": [
        "Data validation",
        "Backup and recovery",
        "Audit trails"
      ]
    }
  }
}
EOF

    # PCI-DSS Template
    cat > "$templates_dir/pci-dss.json" << 'EOF'
{
  "name": "PCI-DSS",
  "version": "4.0",
  "description": "Payment Card Industry Data Security Standard",
  "controls": {
    "PCI-001": {
      "title": "Build and Maintain a Secure Network",
      "description": "Install and maintain a firewall configuration",
      "category": "Network Security",
      "severity": "critical",
      "requirements": [
        "Firewall configuration",
        "Network segmentation",
        "Security testing"
      ]
    },
    "PCI-002": {
      "title": "Protect Cardholder Data",
      "description": "Protect stored cardholder data",
      "category": "Data Protection",
      "severity": "critical",
      "requirements": [
        "Data encryption",
        "Key management",
        "Data retention policies"
      ]
    },
    "PCI-003": {
      "title": "Maintain Vulnerability Management",
      "description": "Use and regularly update anti-virus software",
      "category": "Vulnerability Management",
      "severity": "high",
      "requirements": [
        "Anti-virus software",
        "Vulnerability scanning",
        "Patch management"
      ]
    }
  }
}
EOF

    # HIPAA Template
    cat > "$templates_dir/hipaa.json" << 'EOF'
{
  "name": "HIPAA",
  "version": "2024",
  "description": "Health Insurance Portability and Accountability Act",
  "controls": {
    "HIPAA-001": {
      "title": "Administrative Safeguards",
      "description": "Implement administrative safeguards for PHI",
      "category": "Administrative",
      "severity": "critical",
      "requirements": [
        "Security officer designation",
        "Workforce training",
        "Incident response procedures"
      ]
    },
    "HIPAA-002": {
      "title": "Physical Safeguards",
      "description": "Implement physical safeguards for PHI",
      "category": "Physical",
      "severity": "high",
      "requirements": [
        "Facility access controls",
        "Workstation security",
        "Device and media controls"
      ]
    },
    "HIPAA-003": {
      "title": "Technical Safeguards",
      "description": "Implement technical safeguards for PHI",
      "category": "Technical",
      "severity": "critical",
      "requirements": [
        "Access control",
        "Audit controls",
        "Transmission security"
      ]
    }
  }
}
EOF

    # GDPR Template
    cat > "$templates_dir/gdpr.json" << 'EOF'
{
  "name": "GDPR",
  "version": "2018",
  "description": "General Data Protection Regulation",
  "controls": {
    "GDPR-001": {
      "title": "Data Protection by Design",
      "description": "Implement data protection by design and by default",
      "category": "Privacy by Design",
      "severity": "high",
      "requirements": [
        "Privacy impact assessments",
        "Data minimization",
        "Default privacy settings"
      ]
    },
    "GDPR-002": {
      "title": "Data Subject Rights",
      "description": "Ensure data subject rights are protected",
      "category": "Data Subject Rights",
      "severity": "critical",
      "requirements": [
        "Right to access",
        "Right to rectification",
        "Right to erasure"
      ]
    },
    "GDPR-003": {
      "title": "Data Breach Notification",
      "description": "Implement data breach notification procedures",
      "category": "Incident Response",
      "severity": "high",
      "requirements": [
        "Breach detection",
        "Notification procedures",
        "Documentation requirements"
      ]
    }
  }
}
EOF

    # ISO-27001 Template
    cat > "$templates_dir/iso-27001.json" << 'EOF'
{
  "name": "ISO-27001",
  "version": "2022",
  "description": "Information Security Management System",
  "controls": {
    "ISO-001": {
      "title": "Information Security Policies",
      "description": "Define information security policies",
      "category": "Policies",
      "severity": "high",
      "requirements": [
        "Policy framework",
        "Policy review",
        "Policy communication"
      ]
    },
    "ISO-002": {
      "title": "Organization of Information Security",
      "description": "Establish information security organization",
      "category": "Organization",
      "severity": "high",
      "requirements": [
        "Security roles",
        "Segregation of duties",
        "Contact with authorities"
      ]
    },
    "ISO-003": {
      "title": "Human Resource Security",
      "description": "Ensure security in human resources",
      "category": "Human Resources",
      "severity": "medium",
      "requirements": [
        "Screening",
        "Terms and conditions",
        "Security awareness"
      ]
    }
  }
}
EOF

    log_info "Framework templates initialized" "compliance"
}

# Framework management functions
enable_framework() {
    local framework_name="$1"
    local config_file="$2"
    
    if [[ -z "$framework_name" ]]; then
        log_error "Framework name is required" "compliance"
        return 1
    fi
    
    # Validate framework name
    local valid_framework=false
    for framework in "${SUPPORTED_FRAMEWORKS[@]}"; do
        if [[ "$framework" == "$framework_name" ]]; then
            valid_framework=true
            break
        fi
    done
    
    if [[ "$valid_framework" != "true" ]]; then
        log_error "Unsupported framework: $framework_name" "compliance"
        log_info "Supported frameworks: ${SUPPORTED_FRAMEWORKS[*]}" "compliance"
        return 1
    fi
    
    local compliance_base="${WORKSPACE}/compliance"
    local compliance_db="$compliance_base/compliance.json"
    local template_file="$compliance_base/templates/${framework_name,,}.json"
    
    # Check if framework template exists
    if [[ ! -f "$template_file" ]]; then
        log_error "Framework template not found: $template_file" "compliance"
        return 1
    fi
    
    # Load template
    local template_data
    template_data=$(jq -r '.' "$template_file")
    
    # Merge custom configuration if provided
    if [[ -n "$config_file" && -f "$config_file" ]]; then
        if jq empty "$config_file" 2>/dev/null; then
            template_data=$(jq -s '.[0] * .[1]' <(echo "$template_data") "$config_file")
        else
            log_warning "Invalid JSON in framework configuration, using template defaults" "compliance"
        fi
    fi
    
    # Add framework to database
    jq --arg name "$framework_name" --argjson data "$template_data" \
       '.frameworks[$name] = $data' "$compliance_db" > "$compliance_db.tmp" && mv "$compliance_db.tmp" "$compliance_db"
    
    log_success "Framework '$framework_name' enabled successfully" "compliance"
}

disable_framework() {
    local framework_name="$1"
    
    if [[ -z "$framework_name" ]]; then
        log_error "Framework name is required" "compliance"
        return 1
    fi
    
    local compliance_base="${WORKSPACE}/compliance"
    local compliance_db="$compliance_base/compliance.json"
    
    # Remove framework from database
    jq --arg name "$framework_name" 'del(.frameworks[$name])' "$compliance_db" > "$compliance_db.tmp" && mv "$compliance_db.tmp" "$compliance_db"
    
    log_success "Framework '$framework_name' disabled successfully" "compliance"
}

list_frameworks() {
    local format="${1:-table}"
    local compliance_base="${WORKSPACE}/compliance"
    local compliance_db="$compliance_base/compliance.json"
    
    if [[ ! -f "$compliance_db" ]]; then
        log_error "Compliance database not found" "compliance"
        return 1
    fi
    
    case "$format" in
        "json")
            jq -r '.frameworks' "$compliance_db"
            ;;
        "csv")
            echo "framework,version,description,controls_count"
            jq -r '.frameworks | to_entries[] | [.key, .value.version, .value.description, (.value.controls | length)] | @csv' "$compliance_db"
            ;;
        "table"|*)
            echo "Enabled Compliance Frameworks:"
            echo "=============================="
            jq -r '.frameworks | to_entries[] | "\(.key) (\(.value.version)) - \(.value.description)"' "$compliance_db"
            ;;
    esac
}

# Compliance scanning and assessment
run_compliance_scan() {
    local framework_name="$1"
    local scan_level="${2:-standard}"  # quick, standard, thorough
    
    if [[ -z "$framework_name" ]]; then
        log_error "Framework name is required" "compliance"
        return 1
    fi
    
    local compliance_base="${WORKSPACE}/compliance"
    local compliance_db="$compliance_base/compliance.json"
    
    # Check if framework is enabled
    if ! jq -e ".frameworks[\"$framework_name\"]" "$compliance_db" > /dev/null 2>&1; then
        log_error "Framework '$framework_name' is not enabled" "compliance"
        return 1
    fi
    
    log_info "Running compliance scan for framework: $framework_name (level: $scan_level)" "compliance"
    
    # Create scan report
    local scan_id="scan-$(date +%Y%m%d-%H%M%S)"
    local report_file="$compliance_base/reports/${framework_name}-${scan_id}.json"
    
    # Initialize report structure
    local report_data
    report_data=$(cat << 'EOF'
{
  "scan_id": "$scan_id",
  "framework": "$framework_name",
  "scan_level": "$scan_level",
  "timestamp": "$(date -Iseconds)",
  "results": {},
  "summary": {
    "total_controls": 0,
    "passed": 0,
    "failed": 0,
    "warnings": 0,
    "not_applicable": 0
  }
}
EOF
)
    
    # Get framework controls
    local controls
    controls=$(jq -r ".frameworks[\"$framework_name\"].controls" "$compliance_db")
    
    # Scan each control
    local total_controls=0
    local passed_controls=0
    local failed_controls=0
    local warning_controls=0
    local na_controls=0
    
    while IFS= read -r control_id; do
        if [[ -n "$control_id" ]]; then
            total_controls=$((total_controls + 1))
            
            # Assess control compliance
            local control_result
            control_result=$(assess_control_compliance "$framework_name" "$control_id" "$scan_level")
            
            # Parse result
            local status
            status=$(echo "$control_result" | jq -r '.status')
            
            case "$status" in
                "PASS")
                    passed_controls=$((passed_controls + 1))
                    ;;
                "FAIL")
                    failed_controls=$((failed_controls + 1))
                    ;;
                "WARNING")
                    warning_controls=$((warning_controls + 1))
                    ;;
                "N/A")
                    na_controls=$((na_controls + 1))
                    ;;
            esac
            
            # Add to report
            report_data=$(echo "$report_data" | jq --arg id "$control_id" --argjson result "$control_result" '.results[$id] = $result')
        fi
    done < <(echo "$controls" | jq -r 'keys[]')
    
    # Update summary
    report_data=$(echo "$report_data" | jq --argjson total $total_controls --argjson passed $passed_controls --argjson failed $failed_controls --argjson warnings $warning_controls --argjson na $na_controls \
       '.summary.total_controls = $total | .summary.passed = $passed | .summary.failed = $failed | .summary.warnings = $warnings | .summary.not_applicable = $na')
    
    # Save report
    echo "$report_data" > "$report_file"
    
    # Update compliance database
    jq --arg framework "$framework_name" --arg scan_id "$scan_id" --arg report_file "$report_file" \
       '.reports[$framework] = {"last_scan": $scan_id, "report_file": $report_file}' "$compliance_db" > "$compliance_db.tmp" && mv "$compliance_db.tmp" "$compliance_db"
    
    log_success "Compliance scan completed: $scan_id" "compliance"
    log_info "Report saved to: $report_file" "compliance"
    
    # Print summary
    echo "Compliance Scan Summary:"
    echo "========================"
    echo "Framework: $framework_name"
    echo "Scan Level: $scan_level"
    echo "Total Controls: $total_controls"
    echo "Passed: $passed_controls"
    echo "Failed: $failed_controls"
    echo "Warnings: $warning_controls"
    echo "Not Applicable: $na_controls"
    
    return 0
}

# Control assessment
assess_control_compliance() {
    local framework_name="$1"
    local control_id="$2"
    local scan_level="$3"
    
    local compliance_base="${WORKSPACE}/compliance"
    local compliance_db="$compliance_base/compliance.json"
    
    # Get control details
    local control_info
    control_info=$(jq -r ".frameworks[\"$framework_name\"].controls[\"$control_id\"]" "$compliance_db")
    
    local control_title
    control_title=$(echo "$control_info" | jq -r '.title')
    local control_category
    control_category=$(echo "$control_info" | jq -r '.category')
    local control_severity
    control_severity=$(echo "$control_info" | jq -r '.severity')
    
    # Perform control-specific assessment
    local status="PASS"
    local evidence=""
    local findings=""
    
    case "$control_id" in
        "SOX-001"|"PCI-001"|"HIPAA-003"|"ISO-002")
            # Access Control assessment
            if check_access_controls; then
                status="PASS"
                evidence="Access controls properly configured"
            else
                status="FAIL"
                evidence="Access controls not properly configured"
                findings="Missing role-based access control implementation"
            fi
            ;;
        "SOX-002"|"PCI-003"|"ISO-001")
            # Change Management assessment
            if check_change_management; then
                status="PASS"
                evidence="Change management procedures in place"
            else
                status="WARNING"
                evidence="Change management procedures need improvement"
                findings="Documentation of change procedures incomplete"
            fi
            ;;
        "SOX-003"|"PCI-002"|"HIPAA-002")
            # Data Protection assessment
            if check_data_protection; then
                status="PASS"
                evidence="Data protection measures implemented"
            else
                status="FAIL"
                evidence="Data protection measures insufficient"
                findings="Encryption not properly configured"
            fi
            ;;
        "GDPR-001"|"GDPR-002"|"GDPR-003")
            # Privacy assessment
            if check_privacy_controls; then
                status="PASS"
                evidence="Privacy controls implemented"
            else
                status="WARNING"
                evidence="Privacy controls need enhancement"
                findings="Data minimization not fully implemented"
            fi
            ;;
        "HIPAA-001")
            # Administrative safeguards
            if check_administrative_safeguards; then
                status="PASS"
                evidence="Administrative safeguards in place"
            else
                status="FAIL"
                evidence="Administrative safeguards missing"
                findings="Security officer not designated"
            fi
            ;;
        *)
            # Default assessment
            status="N/A"
            evidence="Control not implemented in assessment engine"
            findings="Manual assessment required"
            ;;
    esac
    
    # Create result JSON
    cat << 'EOF'
{
  "control_id": "$control_id",
  "title": "$control_title",
  "category": "$control_category",
  "severity": "$control_severity",
  "status": "$status",
  "evidence": "$evidence",
  "findings": "$findings",
  "assessment_time": "$(date -Iseconds)"
}
EOF
}

# Control check functions (stubs for now)
check_access_controls() {
    # Check if access controls are properly configured
    # This would check user management, role assignments, etc.
    local user_count
    user_count=$(jq -r '.users | length' "${WORKSPACE}/users.json" 2>/dev/null || echo "0")
    
    if [[ $user_count -gt 0 ]]; then
        return 0  # Pass
    else
        return 1  # Fail
    fi
}

check_change_management() {
    # Check if change management procedures are in place
    # This would check for change logs, approval processes, etc.
    local audit_logs
    audit_logs=$(find "${WORKSPACE}/audit" -name "*.log" 2>/dev/null | wc -l)
    
    if [[ $audit_logs -gt 0 ]]; then
        return 0  # Pass
    else
        return 1  # Fail
    fi
}

check_data_protection() {
    # Check if data protection measures are implemented
    # This would check encryption, backup procedures, etc.
    local backup_count
    backup_count=$(find "${WORKSPACE}/backups" -name "*.tar.gz" 2>/dev/null | wc -l)
    
    if [[ $backup_count -gt 0 ]]; then
        return 0  # Pass
    else
        return 1  # Fail
    fi
}

check_privacy_controls() {
    # Check if privacy controls are implemented
    # This would check data minimization, consent management, etc.
    # For now, return pass if audit system is enabled
    if [[ "$COMPLIANCE_ENABLED" == "true" ]]; then
        return 0  # Pass
    else
        return 1  # Fail
    fi
}

check_administrative_safeguards() {
    # Check if administrative safeguards are in place
    # This would check security officer designation, training, etc.
    # For now, return pass if compliance system is initialized
    local compliance_db="${WORKSPACE}/compliance/compliance.json"
    if [[ -f "$compliance_db" ]]; then
        return 0  # Pass
    else
        return 1  # Fail
    fi
}

# Compliance reporting
generate_compliance_report() {
    local framework_name="$1"
    local report_format="${2:-html}"
    local report_period="${3:-monthly}"
    
    if [[ -z "$framework_name" ]]; then
        log_error "Framework name is required" "compliance"
        return 1
    fi
    
    local compliance_base="${WORKSPACE}/compliance"
    local compliance_db="$compliance_base/compliance.json"
    
    # Check if framework is enabled
    if ! jq -e ".frameworks[\"$framework_name\"]" "$compliance_db" > /dev/null 2>&1; then
        log_error "Framework '$framework_name' is not enabled" "compliance"
        return 1
    fi
    
    # Get latest scan report
    local report_file
    report_file=$(jq -r ".reports[\"$framework_name\"].report_file" "$compliance_db" 2>/dev/null)
    
    if [[ -z "$report_file" || "$report_file" == "null" ]]; then
        log_error "No scan report found for framework '$framework_name'" "compliance"
        log_info "Run a compliance scan first: compliance scan $framework_name" "compliance"
        return 1
    fi
    
    if [[ ! -f "$report_file" ]]; then
        log_error "Report file not found: $report_file" "compliance"
        return 1
    fi
    
    # Generate report based on format
    case "$report_format" in
        "html")
            generate_html_compliance_report "$framework_name" "$report_file"
            ;;
        "json")
            generate_json_compliance_report "$framework_name" "$report_file"
            ;;
        "pdf")
            generate_pdf_compliance_report "$framework_name" "$report_file"
            ;;
        *)
            log_error "Unsupported report format: $report_format" "compliance"
            return 1
            ;;
    esac
}

generate_html_compliance_report() {
    local framework_name="$1"
    local report_file="$2"
    
    local report_data
    report_data=$(jq -r '.' "$report_file")
    
    local output_file="${WORKSPACE}/compliance/reports/${framework_name}-report-$(date +%Y%m%d).html"
    
    # Generate HTML report
    cat > "$output_file" << 'EOF'
<!DOCTYPE html>
<html>
<head>
    <title>Compliance Report - $framework_name</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; }
        .header { background-color: #f0f0f0; padding: 20px; border-radius: 5px; }
        .summary { margin: 20px 0; }
        .control { margin: 10px 0; padding: 10px; border: 1px solid #ddd; border-radius: 3px; }
        .pass { background-color: #d4edda; border-color: #c3e6cb; }
        .fail { background-color: #f8d7da; border-color: #f5c6cb; }
        .warning { background-color: #fff3cd; border-color: #ffeaa7; }
        .na { background-color: #e2e3e5; border-color: #d6d8db; }
    </style>
</head>
<body>
    <div class="header">
        <h1>Compliance Report - $framework_name</h1>
        <p>Generated: $(date)</p>
        <p>Scan ID: $(echo "$report_data" | jq -r '.scan_id')</p>
    </div>
    
    <div class="summary">
        <h2>Summary</h2>
        <p>Total Controls: $(echo "$report_data" | jq -r '.summary.total_controls')</p>
        <p>Passed: $(echo "$report_data" | jq -r '.summary.passed')</p>
        <p>Failed: $(echo "$report_data" | jq -r '.summary.failed')</p>
        <p>Warnings: $(echo "$report_data" | jq -r '.summary.warnings')</p>
        <p>Not Applicable: $(echo "$report_data" | jq -r '.summary.not_applicable')</p>
    </div>
    
    <div class="controls">
        <h2>Control Results</h2>
EOF
    
    # Add control results
    echo "$report_data" | jq -r '.results | to_entries[] | "\(.key): \(.value.status)"' | while IFS=':' read -r control_id status; do
        local control_data
        control_data=$(echo "$report_data" | jq -r ".results[\"$control_id\"]")
        local title
        title=$(echo "$control_data" | jq -r '.title')
        local evidence
        evidence=$(echo "$control_data" | jq -r '.evidence')
        local findings
        findings=$(echo "$control_data" | jq -r '.findings')
        
        cat >> "$output_file" << 'EOF'
        <div class="control $status">
            <h3>$control_id - $title</h3>
            <p><strong>Status:</strong> $status</p>
            <p><strong>Evidence:</strong> $evidence</p>
EOF
        
        if [[ -n "$findings" && "$findings" != "null" ]]; then
            cat >> "$output_file" << 'EOF'
            <p><strong>Findings:</strong> $findings</p>
EOF
        fi
        
        cat >> "$output_file" << 'EOF'
        </div>
EOF
    done
    
    cat >> "$output_file" << 'EOF'
    </div>
</body>
</html>
EOF
    
    log_success "HTML compliance report generated: $output_file" "compliance"
}

generate_json_compliance_report() {
    local framework_name="$1"
    local report_file="$2"
    
    local output_file="${WORKSPACE}/compliance/reports/${framework_name}-report-$(date +%Y%m%d).json"
    
    # Copy and enhance the report
    jq --arg framework "$framework_name" --arg generated "$(date -Iseconds)" \
       '. + {"framework": $framework, "report_generated": $generated}' "$report_file" > "$output_file"
    
    log_success "JSON compliance report generated: $output_file" "compliance"
}

generate_pdf_compliance_report() {
    local framework_name="$1"
    local report_file="$2"
    
    local output_file="${WORKSPACE}/compliance/reports/${framework_name}-report-$(date +%Y%m%d).pdf"
    
    # For now, generate HTML and suggest conversion
    local html_file="${WORKSPACE}/compliance/reports/${framework_name}-report-$(date +%Y%m%d).html"
    generate_html_compliance_report "$framework_name" "$report_file"
    
    log_warning "PDF generation not implemented" "compliance"
    log_info "HTML report generated: $html_file" "compliance"
    log_info "Convert to PDF manually or use tools like wkhtmltopdf" "compliance"
}

# Compliance command handler
handle_compliance_command() {
    local command="$1"
    shift
    
    case "$command" in
        "init")
            init_compliance_frameworks
            ;;
        "enable")
            local framework_name="$1"
            local config_file="$2"
            enable_framework "$framework_name" "$config_file"
            ;;
        "disable")
            local framework_name="$1"
            disable_framework "$framework_name"
            ;;
        "list")
            local format="$1"
            list_frameworks "$format"
            ;;
        "scan")
            local framework_name="$1"
            local scan_level="$2"
            run_compliance_scan "$framework_name" "$scan_level"
            ;;
        "report")
            local framework_name="$1"
            local format="$2"
            local period="$3"
            generate_compliance_report "$framework_name" "$format" "$period"
            ;;
        "help"|*)
            echo "Advanced Compliance Framework Commands:"
            echo "======================================"
            echo "  init                                    - Initialize compliance frameworks"
            echo "  enable <framework> [config_file]       - Enable compliance framework"
            echo "  disable <framework>                    - Disable compliance framework"
            echo "  list [format]                          - List enabled frameworks (json|csv|table)"
            echo "  scan <framework> [level]               - Run compliance scan (quick|standard|thorough)"
            echo "  report <framework> [format] [period]   - Generate compliance report (html|json|pdf)"
            echo "  help                                   - Show this help"
            echo ""
            echo "Supported Frameworks:"
            echo "  SOX, PCI-DSS, HIPAA, GDPR, ISO-27001, NIST-CSF, CIS, FEDRAMP, SOC-2, CMMC"
            ;;
    esac
} 

# --- END OF SCRIPTLET: 16-compliance-frameworks.sh ---

# ============================================================================
# Enterprise Integration (Enterprise Features)
# ============================================================================

# Enterprise Integration for apt-layer
# Provides hooks and integrations with enterprise tools and systems
# Supports SIEM, ticketing, monitoring, and other enterprise integrations

# Enterprise integration configuration
ENTERPRISE_INTEGRATION_ENABLED="${ENTERPRISE_INTEGRATION_ENABLED:-true}"
ENTERPRISE_INTEGRATION_LEVEL="${ENTERPRISE_INTEGRATION_LEVEL:-basic}"  # basic, standard, advanced
ENTERPRISE_INTEGRATION_TIMEOUT="${ENTERPRISE_INTEGRATION_TIMEOUT:-30}"
ENTERPRISE_INTEGRATION_RETRY="${ENTERPRISE_INTEGRATION_RETRY:-3}"

# Supported enterprise integrations
SUPPORTED_INTEGRATIONS=(
    "SIEM"              # Security Information and Event Management
    "TICKETING"         # IT Service Management / Ticketing
    "MONITORING"        # System monitoring and alerting
    "CMDB"              # Configuration Management Database
    "BACKUP"            # Enterprise backup systems
    "SECURITY"          # Security tools and platforms
    "COMPLIANCE"        # Compliance and governance tools
    "DEVOPS"            # DevOps and CI/CD tools
    "CLOUD"             # Cloud platform integrations
    "CUSTOM"            # Custom enterprise integrations
)

# Enterprise integration initialization
init_enterprise_integration() {
    log_info "Initializing enterprise integration system..." "enterprise"
    
    # Create enterprise integration directories
    local enterprise_base="${WORKSPACE}/enterprise"
    mkdir -p "$enterprise_base"
    mkdir -p "$enterprise_base/integrations"
    mkdir -p "$enterprise_base/hooks"
    mkdir -p "$enterprise_base/configs"
    mkdir -p "$enterprise_base/logs"
    mkdir -p "$enterprise_base/templates"
    
    # Initialize enterprise integration database
    local enterprise_db="$enterprise_base/integrations.json"
    if [[ ! -f "$enterprise_db" ]]; then
        cat > "$enterprise_db" << 'EOF'
{
  "integrations": {},
  "hooks": {},
  "configs": {},
  "metadata": {
    "created": "",
    "version": "1.0",
    "last_sync": null
  }
}
EOF
        # Set creation timestamp
        jq --arg created "$(date -Iseconds)" '.metadata.created = $created' "$enterprise_db" > "$enterprise_db.tmp" && mv "$enterprise_db.tmp" "$enterprise_db"
    fi
    
    # Initialize integration templates
    init_integration_templates
    
    log_success "Enterprise integration system initialized" "enterprise"
}

# Initialize integration templates
init_integration_templates() {
    local templates_dir="${WORKSPACE}/enterprise/templates"
    
    # SIEM Integration Template
    cat > "$templates_dir/siem.json" << 'EOF'
{
  "name": "SIEM",
  "type": "security",
  "description": "Security Information and Event Management Integration",
  "endpoints": {
    "events": "https://siem.example.com/api/v1/events",
    "alerts": "https://siem.example.com/api/v1/alerts",
    "incidents": "https://siem.example.com/api/v1/incidents"
  },
  "authentication": {
    "type": "api_key",
    "header": "X-API-Key"
  },
  "events": {
    "layer_created": true,
    "layer_deleted": true,
    "security_scan": true,
    "compliance_scan": true,
    "user_action": true,
    "system_event": true
  },
  "format": "json",
  "retry_policy": {
    "max_retries": 3,
    "backoff_multiplier": 2,
    "timeout": 30
  }
}
EOF

    # Ticketing Integration Template
    cat > "$templates_dir/ticketing.json" << 'EOF'
{
  "name": "TICKETING",
  "type": "service_management",
  "description": "IT Service Management / Ticketing System Integration",
  "endpoints": {
    "tickets": "https://ticketing.example.com/api/v2/tickets",
    "incidents": "https://ticketing.example.com/api/v2/incidents",
    "changes": "https://ticketing.example.com/api/v2/changes"
  },
  "authentication": {
    "type": "basic_auth",
    "username": "service_account",
    "password": "encrypted_password"
  },
  "triggers": {
    "security_incident": true,
    "compliance_violation": true,
    "system_failure": true,
    "maintenance_required": true,
    "user_request": true
  },
  "format": "json",
  "priority_mapping": {
    "critical": "P1",
    "high": "P2",
    "medium": "P3",
    "low": "P4"
  }
}
EOF

    # Monitoring Integration Template
    cat > "$templates_dir/monitoring.json" << 'EOF'
{
  "name": "MONITORING",
  "type": "monitoring",
  "description": "System Monitoring and Alerting Integration",
  "endpoints": {
    "metrics": "https://monitoring.example.com/api/v1/metrics",
    "alerts": "https://monitoring.example.com/api/v1/alerts",
    "health": "https://monitoring.example.com/api/v1/health"
  },
  "authentication": {
    "type": "bearer_token",
    "token": "encrypted_token"
  },
  "metrics": {
    "layer_count": true,
    "storage_usage": true,
    "security_status": true,
    "compliance_status": true,
    "user_activity": true,
    "system_performance": true
  },
  "format": "json",
  "collection_interval": 300
}
EOF

    # CMDB Integration Template
    cat > "$templates_dir/cmdb.json" << 'EOF'
{
  "name": "CMDB",
  "type": "configuration_management",
  "description": "Configuration Management Database Integration",
  "endpoints": {
    "assets": "https://cmdb.example.com/api/v1/assets",
    "configurations": "https://cmdb.example.com/api/v1/configurations",
    "relationships": "https://cmdb.example.com/api/v1/relationships"
  },
  "authentication": {
    "type": "oauth2",
    "client_id": "apt_layer_client",
    "client_secret": "encrypted_secret"
  },
  "assets": {
    "layers": true,
    "deployments": true,
    "users": true,
    "configurations": true,
    "dependencies": true
  },
  "format": "json",
  "sync_interval": 3600
}
EOF

    # DevOps Integration Template
    cat > "$templates_dir/devops.json" << 'EOF'
{
  "name": "DEVOPS",
  "type": "devops",
  "description": "DevOps and CI/CD Tools Integration",
  "endpoints": {
    "pipelines": "https://devops.example.com/api/v1/pipelines",
    "deployments": "https://devops.example.com/api/v1/deployments",
    "artifacts": "https://devops.example.com/api/v1/artifacts"
  },
  "authentication": {
    "type": "service_account",
    "token": "encrypted_token"
  },
  "triggers": {
    "layer_ready": true,
    "deployment_complete": true,
    "security_approved": true,
    "compliance_verified": true
  },
  "format": "json",
  "webhook_url": "https://devops.example.com/webhooks/apt-layer"
}
EOF

    log_info "Integration templates initialized" "enterprise"
}

# Integration management functions
enable_integration() {
    local integration_name="$1"
    local config_file="$2"
    
    if [[ -z "$integration_name" ]]; then
        log_error "Integration name is required" "enterprise"
        return 1
    fi
    
    # Validate integration name
    local valid_integration=false
    for integration in "${SUPPORTED_INTEGRATIONS[@]}"; do
        if [[ "$integration" == "$integration_name" ]]; then
            valid_integration=true
            break
        fi
    done
    
    if [[ "$valid_integration" != "true" ]]; then
        log_error "Unsupported integration: $integration_name" "enterprise"
        log_info "Supported integrations: ${SUPPORTED_INTEGRATIONS[*]}" "enterprise"
        return 1
    fi
    
    local enterprise_base="${WORKSPACE}/enterprise"
    local enterprise_db="$enterprise_base/integrations.json"
    local template_file="$enterprise_base/templates/${integration_name,,}.json"
    
    # Check if integration template exists
    if [[ ! -f "$template_file" ]]; then
        log_error "Integration template not found: $template_file" "enterprise"
        return 1
    fi
    
    # Load template
    local template_data
    template_data=$(jq -r '.' "$template_file")
    
    # Merge custom configuration if provided
    if [[ -n "$config_file" && -f "$config_file" ]]; then
        if jq empty "$config_file" 2>/dev/null; then
            template_data=$(jq -s '.[0] * .[1]' <(echo "$template_data") "$config_file")
        else
            log_warning "Invalid JSON in integration configuration, using template defaults" "enterprise"
        fi
    fi
    
    # Add integration to database
    jq --arg name "$integration_name" --argjson data "$template_data" \
       '.integrations[$name] = $data' "$enterprise_db" > "$enterprise_db.tmp" && mv "$enterprise_db.tmp" "$enterprise_db"
    
    # Test integration connectivity
    test_integration_connectivity "$integration_name"
    
    log_success "Integration '$integration_name' enabled successfully" "enterprise"
}

disable_integration() {
    local integration_name="$1"
    
    if [[ -z "$integration_name" ]]; then
        log_error "Integration name is required" "enterprise"
        return 1
    fi
    
    local enterprise_base="${WORKSPACE}/enterprise"
    local enterprise_db="$enterprise_base/integrations.json"
    
    # Remove integration from database
    jq --arg name "$integration_name" 'del(.integrations[$name])' "$enterprise_db" > "$enterprise_db.tmp" && mv "$enterprise_db.tmp" "$enterprise_db"
    
    log_success "Integration '$integration_name' disabled successfully" "enterprise"
}

list_integrations() {
    local format="${1:-table}"
    local enterprise_base="${WORKSPACE}/enterprise"
    local enterprise_db="$enterprise_base/integrations.json"
    
    if [[ ! -f "$enterprise_db" ]]; then
        log_error "Enterprise integration database not found" "enterprise"
        return 1
    fi
    
    case "$format" in
        "json")
            jq -r '.integrations' "$enterprise_db"
            ;;
        "csv")
            echo "integration,type,description,status"
            jq -r '.integrations | to_entries[] | [.key, .value.type, .value.description, "enabled"] | @csv' "$enterprise_db"
            ;;
        "table"|*)
            echo "Enabled Enterprise Integrations:"
            echo "==============================="
            jq -r '.integrations | to_entries[] | "\(.key) (\(.value.type)) - \(.value.description)"' "$enterprise_db"
            ;;
    esac
}

# Integration connectivity testing
test_integration_connectivity() {
    local integration_name="$1"
    
    local enterprise_base="${WORKSPACE}/enterprise"
    local enterprise_db="$enterprise_base/integrations.json"
    
    # Get integration configuration
    local integration_config
    integration_config=$(jq -r ".integrations[\"$integration_name\"]" "$enterprise_db")
    
    if [[ "$integration_config" == "null" ]]; then
        log_error "Integration '$integration_name' not found" "enterprise"
        return 1
    fi
    
    log_info "Testing connectivity for integration: $integration_name" "enterprise"
    
    # Test primary endpoint
    local primary_endpoint
    primary_endpoint=$(echo "$integration_config" | jq -r '.endpoints | to_entries[0].value')
    
    if [[ -n "$primary_endpoint" && "$primary_endpoint" != "null" ]]; then
        # Test HTTP connectivity
        if curl -s --connect-timeout 10 --max-time 30 "$primary_endpoint" > /dev/null 2>&1; then
            log_success "Connectivity test passed for $integration_name" "enterprise"
        else
            log_warning "Connectivity test failed for $integration_name" "enterprise"
        fi
    else
        log_info "No primary endpoint configured for $integration_name" "enterprise"
    fi
}

# Event sending functions
send_enterprise_event() {
    local integration_name="$1"
    local event_type="$2"
    local event_data="$3"
    
    if [[ -z "$integration_name" || -z "$event_type" ]]; then
        log_error "Integration name and event type are required" "enterprise"
        return 1
    fi
    
    local enterprise_base="${WORKSPACE}/enterprise"
    local enterprise_db="$enterprise_base/integrations.json"
    
    # Get integration configuration
    local integration_config
    integration_config=$(jq -r ".integrations[\"$integration_name\"]" "$enterprise_db")
    
    if [[ "$integration_config" == "null" ]]; then
        log_error "Integration '$integration_name' not found" "enterprise"
        return 1
    fi
    
    # Check if event type is enabled
    local event_enabled
    event_enabled=$(echo "$integration_config" | jq -r ".events.$event_type // .triggers.$event_type // false")
    
    if [[ "$event_enabled" != "true" ]]; then
        log_debug "Event type '$event_type' not enabled for integration '$integration_name'" "enterprise"
        return 0
    fi
    
    # Get endpoint for event type
    local endpoint
    case "$event_type" in
        "layer_created"|"layer_deleted"|"security_scan"|"compliance_scan")
            endpoint=$(echo "$integration_config" | jq -r '.endpoints.events // .endpoints.alerts')
            ;;
        "security_incident"|"compliance_violation"|"system_failure")
            endpoint=$(echo "$integration_config" | jq -r '.endpoints.incidents // .endpoints.alerts')
            ;;
        *)
            endpoint=$(echo "$integration_config" | jq -r '.endpoints.events')
            ;;
    esac
    
    if [[ -z "$endpoint" || "$endpoint" == "null" ]]; then
        log_error "No endpoint configured for event type '$event_type'" "enterprise"
        return 1
    fi
    
    # Prepare event payload
    local payload
    payload=$(prepare_event_payload "$integration_name" "$event_type" "$event_data")
    
    # Send event
    send_event_to_integration "$integration_name" "$endpoint" "$payload"
}

prepare_event_payload() {
    local integration_name="$1"
    local event_type="$2"
    local event_data="$3"
    
    # Base event structure
    local base_event
    base_event=$(cat << 'EOF'
{
  "source": "apt-layer",
  "integration": "$integration_name",
  "event_type": "$event_type",
  "timestamp": "$(date -Iseconds)",
  "version": "1.0"
}
EOF
)
    
    # Merge with event data if provided
    if [[ -n "$event_data" ]]; then
        if jq empty <(echo "$event_data") 2>/dev/null; then
            echo "$base_event" | jq --argjson data "$event_data" '. + $data'
        else
            echo "$base_event" | jq --arg data "$event_data" '. + {"message": $data}'
        fi
    else
        echo "$base_event"
    fi
}

send_event_to_integration() {
    local integration_name="$1"
    local endpoint="$2"
    local payload="$3"
    
    local enterprise_base="${WORKSPACE}/enterprise"
    local enterprise_db="$enterprise_base/integrations.json"
    
    # Get integration configuration
    local integration_config
    integration_config=$(jq -r ".integrations[\"$integration_name\"]" "$enterprise_db")
    
    # Get authentication details
    local auth_type
    auth_type=$(echo "$integration_config" | jq -r '.authentication.type')
    
    # Prepare curl command
    local curl_cmd="curl -s --connect-timeout $ENTERPRISE_INTEGRATION_TIMEOUT --max-time $ENTERPRISE_INTEGRATION_TIMEOUT"
    
    # Add authentication
    case "$auth_type" in
        "api_key")
            local api_key
            api_key=$(echo "$integration_config" | jq -r '.authentication.header // "X-API-Key"')
            local key_value
            key_value=$(echo "$integration_config" | jq -r '.authentication.key')
            curl_cmd="$curl_cmd -H \"$api_key: $key_value\""
            ;;
        "basic_auth")
            local username
            username=$(echo "$integration_config" | jq -r '.authentication.username')
            local password
            password=$(echo "$integration_config" | jq -r '.authentication.password')
            curl_cmd="$curl_cmd -u \"$username:$password\""
            ;;
        "bearer_token")
            local token
            token=$(echo "$integration_config" | jq -r '.authentication.token')
            curl_cmd="$curl_cmd -H \"Authorization: Bearer $token\""
            ;;
        "oauth2")
            local client_id
            client_id=$(echo "$integration_config" | jq -r '.authentication.client_id')
            local client_secret
            client_secret=$(echo "$integration_config" | jq -r '.authentication.client_secret')
            curl_cmd="$curl_cmd -H \"X-Client-ID: $client_id\" -H \"X-Client-Secret: $client_secret\""
            ;;
    esac
    
    # Add headers and send
    curl_cmd="$curl_cmd -H \"Content-Type: application/json\" -X POST -d '$payload' \"$endpoint\""
    
    # Send with retry logic
    local retry_count=0
    local max_retries
    max_retries=$(echo "$integration_config" | jq -r '.retry_policy.max_retries // 3')
    
    while [[ $retry_count -lt $max_retries ]]; do
        local response
        response=$(eval "$curl_cmd")
        local exit_code=$?
        
        if [[ $exit_code -eq 0 ]]; then
            log_debug "Event sent successfully to $integration_name" "enterprise"
            return 0
        else
            retry_count=$((retry_count + 1))
            if [[ $retry_count -lt $max_retries ]]; then
                local backoff
                backoff=$(echo "$integration_config" | jq -r '.retry_policy.backoff_multiplier // 2')
                local wait_time=$((retry_count * backoff))
                log_warning "Event send failed, retrying in ${wait_time}s (attempt $retry_count/$max_retries)" "enterprise"
                sleep "$wait_time"
            fi
        fi
    done
    
    log_error "Failed to send event to $integration_name after $max_retries attempts" "enterprise"
    return 1
}

# Hook management functions
register_hook() {
    local hook_name="$1"
    local hook_script="$2"
    local event_types="$3"
    
    if [[ -z "$hook_name" || -z "$hook_script" ]]; then
        log_error "Hook name and script are required" "enterprise"
        return 1
    fi
    
    local enterprise_base="${WORKSPACE}/enterprise"
    local hooks_dir="$enterprise_base/hooks"
    local enterprise_db="$enterprise_base/integrations.json"
    
    # Create hook file
    local hook_file="$hooks_dir/$hook_name.sh"
    cat > "$hook_file" << EOF
#!/bin/bash
# Enterprise Integration Hook: $hook_name
# Event Types: $event_types

$hook_script
EOF
    
    chmod +x "$hook_file"
    
    # Register hook in database
    jq --arg name "$hook_name" --arg script "$hook_file" --arg events "$event_types" \
       '.hooks[$name] = {"script": $script, "events": $events, "enabled": true}' "$enterprise_db" > "$enterprise_db.tmp" && mv "$enterprise_db.tmp" "$enterprise_db"
    
    log_success "Hook '$hook_name' registered successfully" "enterprise"
}

unregister_hook() {
    local hook_name="$1"
    
    if [[ -z "$hook_name" ]]; then
        log_error "Hook name is required" "enterprise"
        return 1
    fi
    
    local enterprise_base="${WORKSPACE}/enterprise"
    local hooks_dir="$enterprise_base/hooks"
    local enterprise_db="$enterprise_base/integrations.json"
    
    # Remove hook file
    local hook_file="$hooks_dir/$hook_name.sh"
    if [[ -f "$hook_file" ]]; then
        rm -f "$hook_file"
    fi
    
    # Remove from database
    jq --arg name "$hook_name" 'del(.hooks[$name])' "$enterprise_db" > "$enterprise_db.tmp" && mv "$enterprise_db.tmp" "$enterprise_db"
    
    log_success "Hook '$hook_name' unregistered successfully" "enterprise"
}

list_hooks() {
    local format="${1:-table}"
    local enterprise_base="${WORKSPACE}/enterprise"
    local enterprise_db="$enterprise_base/integrations.json"
    
    if [[ ! -f "$enterprise_db" ]]; then
        log_error "Enterprise integration database not found" "enterprise"
        return 1
    fi
    
    case "$format" in
        "json")
            jq -r '.hooks' "$enterprise_db"
            ;;
        "csv")
            echo "hook_name,script,events,enabled"
            jq -r '.hooks | to_entries[] | [.key, .value.script, .value.events, .value.enabled] | @csv' "$enterprise_db"
            ;;
        "table"|*)
            echo "Registered Enterprise Hooks:"
            echo "============================"
            jq -r '.hooks | to_entries[] | "\(.key) - \(.value.events) (\(.value.enabled))"' "$enterprise_db"
            ;;
    esac
}

# Hook execution
execute_hooks() {
    local event_type="$1"
    local event_data="$2"
    
    local enterprise_base="${WORKSPACE}/enterprise"
    local enterprise_db="$enterprise_base/integrations.json"
    
    # Get hooks for this event type
    local hooks
    hooks=$(jq -r ".hooks | to_entries[] | select(.value.events | contains(\"$event_type\")) | .key" "$enterprise_db")
    
    if [[ -z "$hooks" ]]; then
        log_debug "No hooks registered for event type: $event_type" "enterprise"
        return 0
    fi
    
    while IFS= read -r hook_name; do
        if [[ -n "$hook_name" ]]; then
            execute_single_hook "$hook_name" "$event_type" "$event_data"
        fi
    done <<< "$hooks"
}

execute_single_hook() {
    local hook_name="$1"
    local event_type="$2"
    local event_data="$3"
    
    local enterprise_base="${WORKSPACE}/enterprise"
    local enterprise_db="$enterprise_base/integrations.json"
    
    # Get hook configuration
    local hook_config
    hook_config=$(jq -r ".hooks[\"$hook_name\"]" "$enterprise_db")
    
    if [[ "$hook_config" == "null" ]]; then
        log_error "Hook '$hook_name' not found" "enterprise"
        return 1
    fi
    
    local enabled
    enabled=$(echo "$hook_config" | jq -r '.enabled')
    
    if [[ "$enabled" != "true" ]]; then
        log_debug "Hook '$hook_name' is disabled" "enterprise"
        return 0
    fi
    
    local script_path
    script_path=$(echo "$hook_config" | jq -r '.script')
    
    if [[ ! -f "$script_path" ]]; then
        log_error "Hook script not found: $script_path" "enterprise"
        return 1
    fi
    
    # Execute hook with environment variables
    log_debug "Executing hook: $hook_name" "enterprise"
    
    export APT_LAYER_EVENT_TYPE="$event_type"
    export APT_LAYER_EVENT_DATA="$event_data"
    export APT_LAYER_WORKSPACE="$WORKSPACE"
    
    if bash "$script_path"; then
        log_debug "Hook '$hook_name' executed successfully" "enterprise"
    else
        log_error "Hook '$hook_name' execution failed" "enterprise"
    fi
}

# Enterprise integration command handler
handle_enterprise_integration_command() {
    local command="$1"
    shift
    
    case "$command" in
        "init")
            init_enterprise_integration
            ;;
        "enable")
            local integration_name="$1"
            local config_file="$2"
            enable_integration "$integration_name" "$config_file"
            ;;
        "disable")
            local integration_name="$1"
            disable_integration "$integration_name"
            ;;
        "list")
            local format="$1"
            list_integrations "$format"
            ;;
        "test")
            local integration_name="$1"
            test_integration_connectivity "$integration_name"
            ;;
        "hook")
            local hook_command="$1"
            shift
            case "$hook_command" in
                "register")
                    local hook_name="$1"
                    local hook_script="$2"
                    local event_types="$3"
                    register_hook "$hook_name" "$hook_script" "$event_types"
                    ;;
                "unregister")
                    local hook_name="$1"
                    unregister_hook "$hook_name"
                    ;;
                "list")
                    local format="$1"
                    list_hooks "$format"
                    ;;
                *)
                    echo "Hook commands: register, unregister, list"
                    ;;
            esac
            ;;
        "send")
            local integration_name="$1"
            local event_type="$2"
            local event_data="$3"
            send_enterprise_event "$integration_name" "$event_type" "$event_data"
            ;;
        "help"|*)
            echo "Enterprise Integration Commands:"
            echo "==============================="
            echo "  init                                    - Initialize enterprise integration system"
            echo "  enable <integration> [config_file]     - Enable enterprise integration"
            echo "  disable <integration>                  - Disable enterprise integration"
            echo "  list [format]                          - List enabled integrations (json|csv|table)"
            echo "  test <integration>                     - Test integration connectivity"
            echo "  hook register <name> <script> <events> - Register custom hook"
            echo "  hook unregister <name>                 - Unregister hook"
            echo "  hook list [format]                     - List registered hooks"
            echo "  send <integration> <event> [data]      - Send event to integration"
            echo "  help                                   - Show this help"
            echo ""
            echo "Supported Integrations:"
            echo "  SIEM, TICKETING, MONITORING, CMDB, BACKUP, SECURITY, COMPLIANCE, DEVOPS, CLOUD, CUSTOM"
            ;;
    esac
} 

# --- END OF SCRIPTLET: 17-enterprise-integration.sh ---

# ============================================================================
# Advanced Monitoring & Alerting (Enterprise Features)
# ============================================================================

# Advanced Monitoring & Alerting for apt-layer
# Provides real-time and scheduled monitoring, customizable alerting, and integration with enterprise monitoring platforms

# Monitoring & alerting configuration
MONITORING_ENABLED="${MONITORING_ENABLED:-true}"
ALERTING_ENABLED="${ALERTING_ENABLED:-true}"
MONITORING_INTERVAL="${MONITORING_INTERVAL:-300}"
ALERT_HISTORY_LIMIT="${ALERT_HISTORY_LIMIT:-1000}"

# Thresholds (configurable)
CPU_THRESHOLD="${CPU_THRESHOLD:-2.0}"
CPU_THRESHOLD_5="${CPU_THRESHOLD_5:-2.0}"
CPU_THRESHOLD_15="${CPU_THRESHOLD_15:-1.5}"
MEM_THRESHOLD="${MEM_THRESHOLD:-100000}"
SWAP_THRESHOLD="${SWAP_THRESHOLD:-50000}"
DISK_THRESHOLD="${DISK_THRESHOLD:-500000}"
INODE_THRESHOLD="${INODE_THRESHOLD:-1000}"
DISK_IOWAIT_THRESHOLD="${DISK_IOWAIT_THRESHOLD:-10.0}"
LAYER_COUNT_THRESHOLD="${LAYER_COUNT_THRESHOLD:-100}"
TENANT_COUNT_THRESHOLD="${TENANT_COUNT_THRESHOLD:-10}"
UPTIME_MAX_DAYS="${UPTIME_MAX_DAYS:-180}"

# Key processes to check (comma-separated)
MONITOR_PROCESSES="${MONITOR_PROCESSES:-composefs-alternative.sh,containerd,podman,docker}"

# Supported alert channels
SUPPORTED_ALERT_CHANNELS=(
    "EMAIL"         # Email notifications
    "WEBHOOK"       # Webhook notifications
    "SIEM"          # Security Information and Event Management
    "PROMETHEUS"    # Prometheus metrics
    "GRAFANA"       # Grafana alerting
    "SLACK"         # Slack notifications
    "TEAMS"         # Microsoft Teams
    "CUSTOM"        # Custom scripts/hooks
)

# Monitoring agent initialization
init_monitoring_agent() {
    log_info "Initializing monitoring and alerting system..." "monitoring"
    
    local monitoring_base="${WORKSPACE}/monitoring"
    mkdir -p "$monitoring_base"
    mkdir -p "$monitoring_base/alerts"
    mkdir -p "$monitoring_base/history"
    mkdir -p "$monitoring_base/policies"
    mkdir -p "$monitoring_base/integrations"
    
    # Initialize alert history
    local alert_history="$monitoring_base/alert-history.json"
    if [[ ! -f "$alert_history" ]]; then
        echo '{"alerts":[]}' > "$alert_history"
    fi
    
    log_success "Monitoring and alerting system initialized" "monitoring"
}

# Monitoring functions
run_monitoring_checks() {
    log_info "Running monitoring checks..." "monitoring"
    check_system_health
    check_layer_health
    check_tenant_health
    check_security_status
    check_compliance_status
    log_success "Monitoring checks completed" "monitoring"
}

check_system_health() {
    # CPU Load (1, 5, 15 min)
    local cpu_load1 cpu_load5 cpu_load15
    read cpu_load1 cpu_load5 cpu_load15 _ < /proc/loadavg
    # Memory
    local mem_free swap_free
    mem_free=$(awk '/MemFree/ {print $2}' /proc/meminfo)
    swap_free=$(awk '/SwapFree/ {print $2}' /proc/meminfo)
    # Disk
    local disk_free
    disk_free=$(df / | awk 'NR==2 {print $4}')
    # Inodes
    local inode_free
    inode_free=$(df -i / | awk 'NR==2 {print $4}')
    # Uptime
    local uptime_sec uptime_days
    uptime_sec=$(awk '{print $1}' /proc/uptime)
    uptime_days=$(awk -v s="$uptime_sec" 'BEGIN {print int(s/86400)}')
    # Disk I/O wait (stub, extend with iostat if available)
    local disk_iowait="0.0"
    if command -v iostat >/dev/null 2>&1; then
        disk_iowait=$(iostat -c 1 2 | awk '/^ /{print $4}' | tail -1)
    fi
    # Process health
    IFS=',' read -ra procs <<< "$MONITOR_PROCESSES"
    for proc in "${procs[@]}"; do
        if ! pgrep -x "$proc" >/dev/null 2>&1; then
            trigger_alert "system" "Critical process not running: $proc" "critical"
        fi
    done
    # Threshold checks
    if (( $(echo "$cpu_load1 > $CPU_THRESHOLD" | bc -l) )); then
        trigger_alert "system" "High 1-min CPU load: $cpu_load1" "critical"
    fi
    if (( $(echo "$cpu_load5 > $CPU_THRESHOLD_5" | bc -l) )); then
        trigger_alert "system" "High 5-min CPU load: $cpu_load5" "warning"
    fi
    if (( $(echo "$cpu_load15 > $CPU_THRESHOLD_15" | bc -l) )); then
        trigger_alert "system" "High 15-min CPU load: $cpu_load15" "info"
    fi
    if (( mem_free < MEM_THRESHOLD )); then
        trigger_alert "system" "Low memory: $mem_free kB" "warning"
    fi
    if (( swap_free < SWAP_THRESHOLD )); then
        trigger_alert "system" "Low swap: $swap_free kB" "warning"
    fi
    if (( disk_free < DISK_THRESHOLD )); then
        trigger_alert "system" "Low disk space: $disk_free kB" "warning"
    fi
    if (( inode_free < INODE_THRESHOLD )); then
        trigger_alert "system" "Low inode count: $inode_free" "warning"
    fi
    if (( $(echo "$disk_iowait > $DISK_IOWAIT_THRESHOLD" | bc -l) )); then
        trigger_alert "system" "High disk I/O wait: $disk_iowait%" "warning"
    fi
    if (( uptime_days > UPTIME_MAX_DAYS )); then
        trigger_alert "system" "System uptime exceeds $UPTIME_MAX_DAYS days: $uptime_days days" "info"
    fi
    # TODO: Add more enterprise checks (network, kernel, hardware, etc.)
}

check_layer_health() {
    # Layer count
    local layer_count
    layer_count=$(find "${WORKSPACE}/layers" -maxdepth 1 -type d 2>/dev/null | wc -l)
    if (( layer_count > LAYER_COUNT_THRESHOLD )); then
        trigger_alert "layer" "Layer count exceeds $LAYER_COUNT_THRESHOLD: $layer_count" "info"
    fi
    # TODO: Add failed/unhealthy layer detection, stale layer checks
}

check_tenant_health() {
    local tenant_dir="${WORKSPACE}/tenants"
    if [[ -d "$tenant_dir" ]]; then
        local tenant_count
        tenant_count=$(find "$tenant_dir" -maxdepth 1 -type d 2>/dev/null | wc -l)
        if (( tenant_count > TENANT_COUNT_THRESHOLD )); then
            trigger_alert "tenant" "Tenant count exceeds $TENANT_COUNT_THRESHOLD: $tenant_count" "info"
        fi
        # TODO: Add quota usage, unhealthy tenant, cross-tenant contention checks
    fi
}

check_security_status() {
    # Security scan failures
    local security_status_file="${WORKSPACE}/security/last-scan.json"
    if [[ -f "$security_status_file" ]]; then
        local failed
        failed=$(jq -r '.failed // 0' "$security_status_file")
        if (( failed > 0 )); then
            trigger_alert "security" "Security scan failures: $failed" "critical"
        fi
    fi
    # TODO: Add vulnerability count/severity, policy violation checks
}

check_compliance_status() {
    # Compliance scan failures
    local compliance_status_file="${WORKSPACE}/compliance/last-scan.json"
    if [[ -f "$compliance_status_file" ]]; then
        local failed
        failed=$(jq -r '.summary.failed // 0' "$compliance_status_file")
        if (( failed > 0 )); then
            trigger_alert "compliance" "Compliance scan failures: $failed" "critical"
        fi
    fi
    # TODO: Add control failure severity, audit log gap checks
}

# Alerting functions
trigger_alert() {
    local source="$1"
    local message="$2"
    local severity="$3"
    local timestamp
    timestamp=$(date -Iseconds)
    
    log_warning "ALERT [$severity] from $source: $message" "monitoring"
    
    # Record alert in history
    record_alert_history "$source" "$message" "$severity" "$timestamp"
    
    # Dispatch alert
    dispatch_alert "$source" "$message" "$severity" "$timestamp"
}

record_alert_history() {
    local source="$1"
    local message="$2"
    local severity="$3"
    local timestamp="$4"
    local monitoring_base="${WORKSPACE}/monitoring"
    local alert_history="$monitoring_base/alert-history.json"
    
    # Add alert to history (limit to ALERT_HISTORY_LIMIT)
    local new_alert
    new_alert=$(jq -n --arg source "$source" --arg message "$message" --arg severity "$severity" --arg timestamp "$timestamp" '{source:$source,message:$message,severity:$severity,timestamp:$timestamp}')
    local updated_history
    updated_history=$(jq --argjson alert "$new_alert" '.alerts += [$alert] | .alerts |= (.[-'$ALERT_HISTORY_LIMIT':])' "$alert_history")
    echo "$updated_history" > "$alert_history"
}

# Alert dispatch functions
dispatch_alert() {
    local source="$1"
    local message="$2"
    local severity="$3"
    local timestamp="$4"
    
    # Check if alert should be suppressed
    if is_alert_suppressed "$source" "$message" "$severity"; then
        log_debug "Alert suppressed: $source - $message" "monitoring"
        return 0
    fi
    
    # Check for correlation and grouping
    local correlation_key
    correlation_key=$(generate_correlation_key "$source" "$message" "$severity")
    
    if is_correlated_alert "$correlation_key"; then
        log_debug "Correlated alert, updating existing: $correlation_key" "monitoring"
        update_correlated_alert "$correlation_key" "$message" "$timestamp"
        return 0
    fi
    
    # Dispatch to all configured channels
    dispatch_to_email "$source" "$message" "$severity" "$timestamp"
    dispatch_to_webhook "$source" "$message" "$severity" "$timestamp"
    dispatch_to_siem "$source" "$message" "$severity" "$timestamp"
    dispatch_to_prometheus "$source" "$message" "$severity" "$timestamp"
    dispatch_to_custom "$source" "$message" "$severity" "$timestamp"
}

# Alert suppression
is_alert_suppressed() {
    local source="$1"
    local message="$2"
    local severity="$3"
    
    # Check suppression policies
    local suppression_file="${WORKSPACE}/monitoring/policies/suppression.json"
    if [[ -f "$suppression_file" ]]; then
        # Check if this alert matches any suppression rules
        local suppressed
        suppressed=$(jq -r --arg source "$source" --arg severity "$severity" '.rules[] | select(.source == $source and .severity == $severity) | .suppressed' "$suppression_file" 2>/dev/null || echo "false")
        if [[ "$suppressed" == "true" ]]; then
            return 0  # Suppressed
        fi
    fi
    
    return 1  # Not suppressed
}

# Event correlation
generate_correlation_key() {
    local source="$1"
    local message="$2"
    local severity="$3"
    
    # Generate a correlation key based on source and message pattern
    echo "${source}:${severity}:$(echo "$message" | sed 's/[0-9]*//g' | tr '[:upper:]' '[:lower:]' | tr -d '[:punct:]' | tr -s ' ')"
}

is_correlated_alert() {
    local correlation_key="$1"
    local correlation_file="${WORKSPACE}/monitoring/correlation.json"
    
    if [[ -f "$correlation_file" ]]; then
        jq -e --arg key "$correlation_key" '.correlations[$key]' "$correlation_file" >/dev/null 2>&1
        return $?
    fi
    
    return 1
}

update_correlated_alert() {
    local correlation_key="$1"
    local message="$2"
    local timestamp="$3"
    local correlation_file="${WORKSPACE}/monitoring/correlation.json"
    
    # Update correlation data
    local correlation_data
    correlation_data=$(jq --arg key "$correlation_key" --arg message "$message" --arg timestamp "$timestamp" \
        '.correlations[$key] += {"count": (.correlations[$key].count // 0) + 1, "last_seen": $timestamp, "last_message": $message}' \
        "$correlation_file" 2>/dev/null || echo '{"correlations":{}}')
    echo "$correlation_data" > "$correlation_file"
}

# Alert dispatch to different channels
dispatch_to_email() {
    local source="$1"
    local message="$2"
    local severity="$3"
    local timestamp="$4"
    
    # Check if email alerts are enabled
    if [[ "${EMAIL_ALERTS_ENABLED:-false}" != "true" ]]; then
        return 0
    fi
    
    local email_config="${WORKSPACE}/monitoring/config/email.json"
    if [[ ! -f "$email_config" ]]; then
        return 0
    fi
    
    local smtp_server
    smtp_server=$(jq -r '.smtp_server' "$email_config")
    local from_email
    from_email=$(jq -r '.from_email' "$email_config")
    local to_emails
    to_emails=$(jq -r '.to_emails[]' "$email_config")
    
    if [[ -z "$smtp_server" || -z "$from_email" ]]; then
        return 0
    fi
    
    # Create email content
    local subject="[ALERT] $severity - $source"
    local body="Alert Details:
Source: $source
Severity: $severity
Message: $message
Timestamp: $timestamp
Hostname: $(hostname)"

    # Send email (stub - implement with mail command or curl)
    log_debug "Sending email alert to: $to_emails" "monitoring"
    # echo "$body" | mail -s "$subject" -r "$from_email" "$to_emails"
}

dispatch_to_webhook() {
    local source="$1"
    local message="$2"
    local severity="$3"
    local timestamp="$4"
    
    # Check if webhook alerts are enabled
    if [[ "${WEBHOOK_ALERTS_ENABLED:-false}" != "true" ]]; then
        return 0
    fi
    
    local webhook_config="${WORKSPACE}/monitoring/config/webhook.json"
    if [[ ! -f "$webhook_config" ]]; then
        return 0
    fi
    
    local webhook_url
    webhook_url=$(jq -r '.url' "$webhook_config")
    local auth_token
    auth_token=$(jq -r '.auth_token // empty' "$webhook_config")
    
    if [[ -z "$webhook_url" ]]; then
        return 0
    fi
    
    # Create webhook payload
    local payload
    payload=$(jq -n \
        --arg source "$source" \
        --arg message "$message" \
        --arg severity "$severity" \
        --arg timestamp "$timestamp" \
        --arg hostname "$(hostname)" \
        '{
            "source": $source,
            "message": $message,
            "severity": $severity,
            "timestamp": $timestamp,
            "hostname": $hostname
        }')
    
    # Send webhook
    local curl_cmd="curl -s --connect-timeout 10 --max-time 30 -X POST -H 'Content-Type: application/json'"
    if [[ -n "$auth_token" ]]; then
        curl_cmd="$curl_cmd -H 'Authorization: Bearer $auth_token'"
    fi
    curl_cmd="$curl_cmd -d '$payload' '$webhook_url'"
    
    log_debug "Sending webhook alert to: $webhook_url" "monitoring"
    eval "$curl_cmd" >/dev/null 2>&1
}

dispatch_to_siem() {
    local source="$1"
    local message="$2"
    local severity="$3"
    local timestamp="$4"
    
    # Use enterprise integration if available
    if command -v send_enterprise_event >/dev/null 2>&1; then
        local event_data
        event_data=$(jq -n \
            --arg source "$source" \
            --arg message "$message" \
            --arg severity "$severity" \
            --arg timestamp "$timestamp" \
            '{
                "source": $source,
                "message": $message,
                "severity": $severity,
                "timestamp": $timestamp
            }')
        
        send_enterprise_event "SIEM" "alert" "$event_data"
    fi
}

dispatch_to_prometheus() {
    local source="$1"
    local message="$2"
    local severity="$3"
    local timestamp="$4"
    
    # Check if Prometheus metrics are enabled
    if [[ "${PROMETHEUS_METRICS_ENABLED:-false}" != "true" ]]; then
        return 0
    fi
    
    local prometheus_config="${WORKSPACE}/monitoring/config/prometheus.json"
    if [[ ! -f "$prometheus_config" ]]; then
        return 0
    fi
    
    local pushgateway_url
    pushgateway_url=$(jq -r '.pushgateway_url' "$prometheus_config")
    
    if [[ -z "$pushgateway_url" ]]; then
        return 0
    fi
    
    # Create Prometheus metric
    local metric_name="apt_layer_alert"
    local metric_value="1"
    local labels="source=\"$source\",severity=\"$severity\""
    
    # Send to Pushgateway
    local metric_data="$metric_name{$labels} $metric_value"
    echo "$metric_data" | curl -s --data-binary @- "$pushgateway_url/metrics/job/apt_layer/instance/$(hostname)" >/dev/null 2>&1
    
    log_debug "Sent Prometheus metric: $metric_data" "monitoring"
}

dispatch_to_custom() {
    local source="$1"
    local message="$2"
    local severity="$3"
    local timestamp="$4"
    
    # Execute custom alert scripts
    local custom_scripts_dir="${WORKSPACE}/monitoring/scripts"
    if [[ -d "$custom_scripts_dir" ]]; then
        for script in "$custom_scripts_dir"/*.sh; do
            if [[ -f "$script" && -x "$script" ]]; then
                export ALERT_SOURCE="$source"
                export ALERT_MESSAGE="$message"
                export ALERT_SEVERITY="$severity"
                export ALERT_TIMESTAMP="$timestamp"
                
                log_debug "Executing custom alert script: $script" "monitoring"
                bash "$script" >/dev/null 2>&1
            fi
        done
    fi
}

# Policy management
create_alert_policy() {
    local policy_name="$1"
    local policy_file="$2"
    
    if [[ -z "$policy_name" || -z "$policy_file" ]]; then
        log_error "Policy name and file are required" "monitoring"
        return 1
    fi
    
    local policies_dir="${WORKSPACE}/monitoring/policies"
    local policy_path="$policies_dir/$policy_name.json"
    
    # Copy policy file
    if [[ -f "$policy_file" ]]; then
        cp "$policy_file" "$policy_path"
        log_success "Alert policy '$policy_name' created" "monitoring"
    else
        log_error "Policy file not found: $policy_file" "monitoring"
        return 1
    fi
}

list_alert_policies() {
    local format="${1:-table}"
    local policies_dir="${WORKSPACE}/monitoring/policies"
    
    if [[ ! -d "$policies_dir" ]]; then
        log_error "Policies directory not found" "monitoring"
        return 1
    fi
    
    case "$format" in
        "json")
            echo "{\"policies\":["
            local first=true
            for policy in "$policies_dir"/*.json; do
                if [[ -f "$policy" ]]; then
                    if [[ "$first" == "true" ]]; then
                        first=false
                    else
                        echo ","
                    fi
                    jq -r '.' "$policy"
                fi
            done
            echo "]}"
            ;;
        "csv")
            echo "policy_name,file_path,last_modified"
            for policy in "$policies_dir"/*.json; do
                if [[ -f "$policy" ]]; then
                    local policy_name
                    policy_name=$(basename "$policy" .json)
                    local last_modified
                    last_modified=$(stat -c %y "$policy" 2>/dev/null || echo "unknown")
                    echo "$policy_name,$policy,$last_modified"
                fi
            done
            ;;
        "table"|*)
            echo "Alert Policies:"
            echo "==============="
            for policy in "$policies_dir"/*.json; do
                if [[ -f "$policy" ]]; then
                    local policy_name
                    policy_name=$(basename "$policy" .json)
                    echo "- $policy_name"
                fi
            done
            ;;
    esac
}

# Alert history and reporting
query_alert_history() {
    local source="$1"
    local severity="$2"
    local days="$3"
    local format="${4:-table}"
    
    local monitoring_base="${WORKSPACE}/monitoring"
    local alert_history="$monitoring_base/alert-history.json"
    
    if [[ ! -f "$alert_history" ]]; then
        log_error "Alert history not found" "monitoring"
        return 1
    fi
    
    # Build jq filter
    local filter=".alerts"
    if [[ -n "$source" ]]; then
        filter="$filter | map(select(.source == \"$source\"))"
    fi
    if [[ -n "$severity" ]]; then
        filter="$filter | map(select(.severity == \"$severity\"))"
    fi
    if [[ -n "$days" ]]; then
        local cutoff_date
        cutoff_date=$(date -d "$days days ago" -Iseconds)
        filter="$filter | map(select(.timestamp >= \"$cutoff_date\"))"
    fi
    
    case "$format" in
        "json")
            jq -r "$filter" "$alert_history"
            ;;
        "csv")
            echo "source,severity,message,timestamp"
            jq -r "$filter | .[] | [.source, .severity, .message, .timestamp] | @csv" "$alert_history"
            ;;
        "table"|*)
            echo "Alert History:"
            echo "=============="
            jq -r "$filter | .[] | \"[\(.severity)] \(.source): \(.message) (\(.timestamp))\"" "$alert_history"
            ;;
    esac
}

generate_alert_report() {
    local report_period="${1:-daily}"
    local output_format="${2:-html}"
    
    local monitoring_base="${WORKSPACE}/monitoring"
    local alert_history="$monitoring_base/alert-history.json"
    local report_file="$monitoring_base/reports/alert-report-$(date +%Y%m%d).$output_format"
    
    if [[ ! -f "$alert_history" ]]; then
        log_error "Alert history not found" "monitoring"
        return 1
    fi
    
    # Calculate report period
    local start_date
    case "$report_period" in
        "hourly")
            start_date=$(date -d "1 hour ago" -Iseconds)
            ;;
        "daily")
            start_date=$(date -d "1 day ago" -Iseconds)
            ;;
        "weekly")
            start_date=$(date -d "1 week ago" -Iseconds)
            ;;
        "monthly")
            start_date=$(date -d "1 month ago" -Iseconds)
            ;;
        *)
            start_date=$(date -d "1 day ago" -Iseconds)
            ;;
    esac
    
    # Generate report
    case "$output_format" in
        "json")
            jq --arg start_date "$start_date" \
               '.alerts | map(select(.timestamp >= $start_date)) | group_by(.severity) | map({severity: .[0].severity, count: length, alerts: .})' \
               "$alert_history" > "$report_file"
            ;;
        "html")
            generate_html_alert_report "$start_date" "$report_file"
            ;;
        *)
            log_error "Unsupported output format: $output_format" "monitoring"
            return 1
            ;;
    esac
    
    log_success "Alert report generated: $report_file" "monitoring"
}

generate_html_alert_report() {
    local start_date="$1"
    local report_file="$2"
    local monitoring_base="${WORKSPACE}/monitoring"
    local alert_history="$monitoring_base/alert-history.json"
    
    # Get alert data
    local alert_data
    alert_data=$(jq --arg start_date "$start_date" \
        '.alerts | map(select(.timestamp >= $start_date)) | group_by(.severity) | map({severity: .[0].severity, count: length, alerts: .})' \
        "$alert_history")
    
    # Generate HTML
    cat > "$report_file" << EOF
<!DOCTYPE html>
<html>
<head>
    <title>Alert Report - $(date)</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; }
        .header { background-color: #f0f0f0; padding: 20px; border-radius: 5px; }
        .summary { margin: 20px 0; }
        .severity { margin: 10px 0; padding: 10px; border: 1px solid #ddd; border-radius: 3px; }
        .critical { background-color: #f8d7da; border-color: #f5c6cb; }
        .warning { background-color: #fff3cd; border-color: #ffeaa7; }
        .info { background-color: #d1ecf1; border-color: #bee5eb; }
    </style>
</head>
<body>
    <div class="header">
        <h1>Alert Report</h1>
        <p>Generated: $(date)</p>
        <p>Period: Since $start_date</p>
    </div>
    
    <div class="summary">
        <h2>Summary</h2>
        <p>Total Alerts: $(echo "$alert_data" | jq -r 'map(.count) | add // 0')</p>
    </div>
    
    <div class="alerts">
        <h2>Alerts by Severity</h2>
EOF
    
    # Add alerts by severity
    echo "$alert_data" | jq -r '.[] | "\(.severity): \(.count)"' | while IFS=':' read -r severity count; do
        if [[ -n "$severity" ]]; then
            cat >> "$report_file" << EOF
        <div class="severity $severity">
            <h3>$severity ($count)</h3>
EOF
            
            # Add individual alerts
            echo "$alert_data" | jq -r --arg sev "$severity" '.[] | select(.severity == $sev) | .alerts[] | "\(.source): \(.message) (\(.timestamp))"' | while IFS=':' read -r source message; do
                if [[ -n "$source" ]]; then
                    cat >> "$report_file" << EOF
            <p><strong>$source</strong>: $message</p>
EOF
                fi
            done
            
            cat >> "$report_file" << EOF
        </div>
EOF
        fi
    done
    
    cat >> "$report_file" << EOF
    </div>
</body>
</html>
EOF
}

# Monitoring command handler
handle_monitoring_command() {
    local command="$1"
    shift
    
    case "$command" in
        "init")
            init_monitoring_agent
            ;;
        "check")
            run_monitoring_checks
            ;;
        "policy")
            local policy_command="$1"
            shift
            case "$policy_command" in
                "create")
                    local policy_name="$1"
                    local policy_file="$2"
                    create_alert_policy "$policy_name" "$policy_file"
                    ;;
                "list")
                    local format="$1"
                    list_alert_policies "$format"
                    ;;
                *)
                    echo "Policy commands: create, list"
                    ;;
            esac
            ;;
        "history")
            local source="$1"
            local severity="$2"
            local days="$3"
            local format="$4"
            query_alert_history "$source" "$severity" "$days" "$format"
            ;;
        "report")
            local period="$1"
            local format="$2"
            generate_alert_report "$period" "$format"
            ;;
        "help"|*)
            echo "Monitoring & Alerting Commands:"
            echo "=============================="
            echo "  init                                    - Initialize monitoring system"
            echo "  check                                   - Run monitoring checks"
            echo "  policy create <name> <file>            - Create alert policy"
            echo "  policy list [format]                   - List alert policies"
            echo "  history [source] [severity] [days] [format] - Query alert history"
            echo "  report [period] [format]               - Generate alert report"
            echo "  help                                   - Show this help"
            echo ""
            echo "Supported Alert Channels:"
            echo "  EMAIL, WEBHOOK, SIEM, PROMETHEUS, GRAFANA, SLACK, TEAMS, CUSTOM"
            ;;
    esac
} 

# --- END OF SCRIPTLET: 18-monitoring-alerting.sh ---

# ============================================================================
# Cloud Integration (AWS, Azure, GCP)
# ============================================================================
# Cloud Integration Scriptlet for apt-layer
# Provides cloud provider integrations (AWS, Azure, GCP) for cloud-native deployment

# Cloud integration functions
cloud_integration_init() {
    log_info "Initializing cloud integration system..."
    
    # Create cloud integration directories
    mkdir -p "${PARTICLE_WORKSPACE}/cloud"
    mkdir -p "${PARTICLE_WORKSPACE}/cloud/aws"
    mkdir -p "${PARTICLE_WORKSPACE}/cloud/azure"
    mkdir -p "${PARTICLE_WORKSPACE}/cloud/gcp"
    mkdir -p "${PARTICLE_WORKSPACE}/cloud/configs"
    mkdir -p "${PARTICLE_WORKSPACE}/cloud/credentials"
    mkdir -p "${PARTICLE_WORKSPACE}/cloud/deployments"
    
    # Initialize cloud configuration database
    if [[ ! -f "${PARTICLE_WORKSPACE}/cloud/cloud-config.json" ]]; then
        cat > "${PARTICLE_WORKSPACE}/cloud/cloud-config.json" << 'EOF'
{
  "providers": {
    "aws": {
      "enabled": false,
      "regions": [],
      "services": {
        "ecr": false,
        "s3": false,
        "ec2": false,
        "eks": false
      },
      "credentials": {
        "profile": "",
        "access_key": "",
        "secret_key": ""
      }
    },
    "azure": {
      "enabled": false,
      "subscriptions": [],
      "services": {
        "acr": false,
        "storage": false,
        "vm": false,
        "aks": false
      },
      "credentials": {
        "tenant_id": "",
        "client_id": "",
        "client_secret": ""
      }
    },
    "gcp": {
      "enabled": false,
      "projects": [],
      "services": {
        "gcr": false,
        "storage": false,
        "compute": false,
        "gke": false
      },
      "credentials": {
        "service_account": "",
        "project_id": ""
      }
    }
  },
  "deployments": [],
  "last_updated": ""
}
EOF
    fi
    
    log_success "Cloud integration system initialized"
}

# AWS Integration Functions
aws_init() {
    log_info "Initializing AWS integration..."
    
    # Check for AWS CLI
    if ! command -v aws &> /dev/null; then
        log_error "AWS CLI not found. Please install awscli package."
        return 1
    fi
    
    # Check AWS credentials
    if ! aws sts get-caller-identity &> /dev/null; then
        log_warning "AWS credentials not configured. Please run 'aws configure' first."
        return 1
    fi
    
    # Get AWS account info
    local account_id=$(aws sts get-caller-identity --query Account --output text)
    local user_arn=$(aws sts get-caller-identity --query Arn --output text)
    
    log_info "AWS Account ID: ${account_id}"
    log_info "AWS User ARN: ${user_arn}"
    
    # Update cloud config
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    jq --arg account_id "$account_id" --arg user_arn "$user_arn" \
       '.providers.aws.enabled = true | .providers.aws.account_id = $account_id | .providers.aws.user_arn = $user_arn' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "AWS integration initialized"
}

aws_configure_services() {
    local services=("$@")
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    
    log_info "Configuring AWS services: ${services[*]}"
    
    for service in "${services[@]}"; do
        case "$service" in
            "ecr")
                aws_configure_ecr
                ;;
            "s3")
                aws_configure_s3
                ;;
            "ec2")
                aws_configure_ec2
                ;;
            "eks")
                aws_configure_eks
                ;;
            *)
                log_warning "Unknown AWS service: $service"
                ;;
        esac
    done
}

aws_configure_ecr() {
    log_info "Configuring AWS ECR..."
    
    # Get default region
    local region=$(aws configure get region)
    if [[ -z "$region" ]]; then
        region="us-east-1"
        log_info "Using default region: $region"
    fi
    
    # Create ECR repository if it doesn't exist
    local repo_name="ubuntu-ublue-layers"
    if ! aws ecr describe-repositories --repository-names "$repo_name" --region "$region" &> /dev/null; then
        log_info "Creating ECR repository: $repo_name"
        aws ecr create-repository --repository-name "$repo_name" --region "$region"
    fi
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    jq --arg region "$region" --arg repo "$repo_name" \
       '.providers.aws.services.ecr = true | .providers.aws.ecr.region = $region | .providers.aws.ecr.repository = $repo' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "AWS ECR configured"
}

aws_configure_s3() {
    log_info "Configuring AWS S3..."
    
    # Get default region
    local region=$(aws configure get region)
    if [[ -z "$region" ]]; then
        region="us-east-1"
    fi
    
    # Create S3 bucket if it doesn't exist
    local bucket_name="ubuntu-ublue-layers-$(date +%s)"
    if ! aws s3api head-bucket --bucket "$bucket_name" --region "$region" &> /dev/null; then
        log_info "Creating S3 bucket: $bucket_name"
        aws s3api create-bucket --bucket "$bucket_name" --region "$region"
    fi
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    jq --arg region "$region" --arg bucket "$bucket_name" \
       '.providers.aws.services.s3 = true | .providers.aws.s3.region = $region | .providers.aws.s3.bucket = $bucket' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "AWS S3 configured"
}

aws_configure_ec2() {
    log_info "Configuring AWS EC2..."
    
    # Get available regions
    local regions=$(aws ec2 describe-regions --query 'Regions[].RegionName' --output text)
    log_info "Available AWS regions: $regions"
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    jq '.providers.aws.services.ec2 = true' "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "AWS EC2 configured"
}

aws_configure_eks() {
    log_info "Configuring AWS EKS..."
    
    # Check for kubectl
    if ! command -v kubectl &> /dev/null; then
        log_warning "kubectl not found. Please install kubectl for EKS integration."
        return 1
    fi
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    jq '.providers.aws.services.eks = true' "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "AWS EKS configured"
}

# Azure Integration Functions
azure_init() {
    log_info "Initializing Azure integration..."
    
    # Check for Azure CLI
    if ! command -v az &> /dev/null; then
        log_error "Azure CLI not found. Please install azure-cli package."
        return 1
    fi
    
    # Check Azure login
    if ! az account show &> /dev/null; then
        log_warning "Azure not logged in. Please run 'az login' first."
        return 1
    fi
    
    # Get Azure account info
    local subscription_id=$(az account show --query id --output tsv)
    local tenant_id=$(az account show --query tenantId --output tsv)
    local user_name=$(az account show --query user.name --output tsv)
    
    log_info "Azure Subscription ID: $subscription_id"
    log_info "Azure Tenant ID: $tenant_id"
    log_info "Azure User: $user_name"
    
    # Update cloud config
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    jq --arg sub_id "$subscription_id" --arg tenant_id "$tenant_id" --arg user "$user_name" \
       '.providers.azure.enabled = true | .providers.azure.subscription_id = $sub_id | .providers.azure.tenant_id = $tenant_id | .providers.azure.user = $user' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "Azure integration initialized"
}

azure_configure_services() {
    local services=("$@")
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    
    log_info "Configuring Azure services: ${services[*]}"
    
    for service in "${services[@]}"; do
        case "$service" in
            "acr")
                azure_configure_acr
                ;;
            "storage")
                azure_configure_storage
                ;;
            "vm")
                azure_configure_vm
                ;;
            "aks")
                azure_configure_aks
                ;;
            *)
                log_warning "Unknown Azure service: $service"
                ;;
        esac
    done
}

azure_configure_acr() {
    log_info "Configuring Azure Container Registry..."
    
    # Get resource group
    local resource_group="ubuntu-ublue-rg"
    local location="eastus"
    local acr_name="ubuntuublueacr$(date +%s)"
    
    # Create resource group if it doesn't exist
    if ! az group show --name "$resource_group" &> /dev/null; then
        log_info "Creating resource group: $resource_group"
        az group create --name "$resource_group" --location "$location"
    fi
    
    # Create ACR if it doesn't exist
    if ! az acr show --name "$acr_name" --resource-group "$resource_group" &> /dev/null; then
        log_info "Creating Azure Container Registry: $acr_name"
        az acr create --resource-group "$resource_group" --name "$acr_name" --sku Basic
    fi
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    jq --arg rg "$resource_group" --arg location "$location" --arg acr "$acr_name" \
       '.providers.azure.services.acr = true | .providers.azure.acr.resource_group = $rg | .providers.azure.acr.location = $location | .providers.azure.acr.name = $acr' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "Azure ACR configured"
}

azure_configure_storage() {
    log_info "Configuring Azure Storage..."
    
    local resource_group="ubuntu-ublue-rg"
    local location="eastus"
    local storage_account="ubuntuubluestorage$(date +%s)"
    
    # Create storage account if it doesn't exist
    if ! az storage account show --name "$storage_account" --resource-group "$resource_group" &> /dev/null; then
        log_info "Creating storage account: $storage_account"
        az storage account create --resource-group "$resource_group" --name "$storage_account" --location "$location" --sku Standard_LRS
    fi
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    jq --arg rg "$resource_group" --arg location "$location" --arg sa "$storage_account" \
       '.providers.azure.services.storage = true | .providers.azure.storage.resource_group = $rg | .providers.azure.storage.location = $location | .providers.azure.storage.account = $sa' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "Azure Storage configured"
}

azure_configure_vm() {
    log_info "Configuring Azure VM..."
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    jq '.providers.azure.services.vm = true' "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "Azure VM configured"
}

azure_configure_aks() {
    log_info "Configuring Azure AKS..."
    
    # Check for kubectl
    if ! command -v kubectl &> /dev/null; then
        log_warning "kubectl not found. Please install kubectl for AKS integration."
        return 1
    fi
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    jq '.providers.azure.services.aks = true' "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "Azure AKS configured"
}

# GCP Integration Functions
gcp_init() {
    log_info "Initializing GCP integration..."
    
    # Check for gcloud CLI
    if ! command -v gcloud &> /dev/null; then
        log_error "Google Cloud CLI not found. Please install google-cloud-cli package."
        return 1
    fi
    
    # Check GCP authentication
    if ! gcloud auth list --filter=status:ACTIVE --format="value(account)" | grep -q .; then
        log_warning "GCP not authenticated. Please run 'gcloud auth login' first."
        return 1
    fi
    
    # Get GCP project info
    local project_id=$(gcloud config get-value project)
    local account=$(gcloud auth list --filter=status:ACTIVE --format="value(account)" | head -1)
    
    log_info "GCP Project ID: $project_id"
    log_info "GCP Account: $account"
    
    # Update cloud config
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    jq --arg project_id "$project_id" --arg account "$account" \
       '.providers.gcp.enabled = true | .providers.gcp.project_id = $project_id | .providers.gcp.account = $account' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "GCP integration initialized"
}

gcp_configure_services() {
    local services=("$@")
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    
    log_info "Configuring GCP services: ${services[*]}"
    
    for service in "${services[@]}"; do
        case "$service" in
            "gcr")
                gcp_configure_gcr
                ;;
            "storage")
                gcp_configure_storage
                ;;
            "compute")
                gcp_configure_compute
                ;;
            "gke")
                gcp_configure_gke
                ;;
            *)
                log_warning "Unknown GCP service: $service"
                ;;
        esac
    done
}

gcp_configure_gcr() {
    log_info "Configuring Google Container Registry..."
    
    local project_id=$(gcloud config get-value project)
    local region="us-central1"
    
    # Enable Container Registry API
    gcloud services enable containerregistry.googleapis.com --project="$project_id"
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    jq --arg project_id "$project_id" --arg region "$region" \
       '.providers.gcp.services.gcr = true | .providers.gcp.gcr.project_id = $project_id | .providers.gcp.gcr.region = $region' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "GCP Container Registry configured"
}

gcp_configure_storage() {
    log_info "Configuring Google Cloud Storage..."
    
    local project_id=$(gcloud config get-value project)
    local bucket_name="ubuntu-ublue-layers-$(date +%s)"
    local location="US"
    
    # Create storage bucket if it doesn't exist
    if ! gsutil ls -b "gs://$bucket_name" &> /dev/null; then
        log_info "Creating storage bucket: $bucket_name"
        gsutil mb -p "$project_id" -c STANDARD -l "$location" "gs://$bucket_name"
    fi
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    jq --arg project_id "$project_id" --arg bucket "$bucket_name" --arg location "$location" \
       '.providers.gcp.services.storage = true | .providers.gcp.storage.project_id = $project_id | .providers.gcp.storage.bucket = $bucket | .providers.gcp.storage.location = $location' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "GCP Storage configured"
}

gcp_configure_compute() {
    log_info "Configuring Google Compute Engine..."
    
    local project_id=$(gcloud config get-value project)
    
    # Enable Compute Engine API
    gcloud services enable compute.googleapis.com --project="$project_id"
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    jq --arg project_id "$project_id" \
       '.providers.gcp.services.compute = true | .providers.gcp.compute.project_id = $project_id' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "GCP Compute Engine configured"
}

gcp_configure_gke() {
    log_info "Configuring Google Kubernetes Engine..."
    
    # Check for kubectl
    if ! command -v kubectl &> /dev/null; then
        log_warning "kubectl not found. Please install kubectl for GKE integration."
        return 1
    fi
    
    local project_id=$(gcloud config get-value project)
    
    # Enable GKE API
    gcloud services enable container.googleapis.com --project="$project_id"
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    jq --arg project_id "$project_id" \
       '.providers.gcp.services.gke = true | .providers.gcp.gke.project_id = $project_id' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "GCP GKE configured"
}

# Cloud Deployment Functions
cloud_deploy_layer() {
    local layer_name="$1"
    local provider="$2"
    local service="$3"
    shift 3
    local options=("$@")
    
    log_info "Deploying layer $layer_name to $provider $service"
    
    case "$provider" in
        "aws")
            case "$service" in
                "ecr")
                    aws_deploy_to_ecr "$layer_name" "${options[@]}"
                    ;;
                "s3")
                    aws_deploy_to_s3 "$layer_name" "${options[@]}"
                    ;;
                *)
                    log_error "Unknown AWS service: $service"
                    return 1
                    ;;
            esac
            ;;
        "azure")
            case "$service" in
                "acr")
                    azure_deploy_to_acr "$layer_name" "${options[@]}"
                    ;;
                "storage")
                    azure_deploy_to_storage "$layer_name" "${options[@]}"
                    ;;
                *)
                    log_error "Unknown Azure service: $service"
                    return 1
                    ;;
            esac
            ;;
        "gcp")
            case "$service" in
                "gcr")
                    gcp_deploy_to_gcr "$layer_name" "${options[@]}"
                    ;;
                "storage")
                    gcp_deploy_to_storage "$layer_name" "${options[@]}"
                    ;;
                *)
                    log_error "Unknown GCP service: $service"
                    return 1
                    ;;
            esac
            ;;
        *)
            log_error "Unknown cloud provider: $provider"
            return 1
            ;;
    esac
}

aws_deploy_to_ecr() {
    local layer_name="$1"
    shift
    local options=("$@")
    
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    local region=$(jq -r '.providers.aws.ecr.region' "$config_file")
    local repo=$(jq -r '.providers.aws.ecr.repository' "$config_file")
    local account_id=$(jq -r '.providers.aws.account_id' "$config_file")
    
    log_info "Deploying $layer_name to AWS ECR"
    
    # Get ECR login token
    aws ecr get-login-password --region "$region" | docker login --username AWS --password-stdin "$account_id.dkr.ecr.$region.amazonaws.com"
    
    # Tag and push image
    local image_tag="$account_id.dkr.ecr.$region.amazonaws.com/$repo:$layer_name"
    docker tag "$layer_name" "$image_tag"
    docker push "$image_tag"
    
    log_success "Layer $layer_name deployed to AWS ECR"
}

aws_deploy_to_s3() {
    local layer_name="$1"
    shift
    local options=("$@")
    
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    local bucket=$(jq -r '.providers.aws.s3.bucket' "$config_file")
    local region=$(jq -r '.providers.aws.s3.region' "$config_file")
    
    log_info "Deploying $layer_name to AWS S3"
    
    # Create layer archive
    local archive_file="${PARTICLE_WORKSPACE}/cloud/deployments/${layer_name}.tar.gz"
    tar -czf "$archive_file" -C "${PARTICLE_WORKSPACE}/layers" "$layer_name"
    
    # Upload to S3
    aws s3 cp "$archive_file" "s3://$bucket/layers/$layer_name.tar.gz" --region "$region"
    
    log_success "Layer $layer_name deployed to AWS S3"
}

azure_deploy_to_acr() {
    local layer_name="$1"
    shift
    local options=("$@")
    
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    local acr_name=$(jq -r '.providers.azure.acr.name' "$config_file")
    local resource_group=$(jq -r '.providers.azure.acr.resource_group' "$config_file")
    
    log_info "Deploying $layer_name to Azure ACR"
    
    # Get ACR login server
    local login_server=$(az acr show --name "$acr_name" --resource-group "$resource_group" --query loginServer --output tsv)
    
    # Login to ACR
    az acr login --name "$acr_name"
    
    # Tag and push image
    local image_tag="$login_server/$layer_name:latest"
    docker tag "$layer_name" "$image_tag"
    docker push "$image_tag"
    
    log_success "Layer $layer_name deployed to Azure ACR"
}

azure_deploy_to_storage() {
    local layer_name="$1"
    shift
    local options=("$@")
    
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    local storage_account=$(jq -r '.providers.azure.storage.account' "$config_file")
    local resource_group=$(jq -r '.providers.azure.storage.resource_group' "$config_file")
    
    log_info "Deploying $layer_name to Azure Storage"
    
    # Create layer archive
    local archive_file="${PARTICLE_WORKSPACE}/cloud/deployments/${layer_name}.tar.gz"
    tar -czf "$archive_file" -C "${PARTICLE_WORKSPACE}/layers" "$layer_name"
    
    # Upload to Azure Storage
    az storage blob upload --account-name "$storage_account" --container-name layers --name "$layer_name.tar.gz" --file "$archive_file"
    
    log_success "Layer $layer_name deployed to Azure Storage"
}

gcp_deploy_to_gcr() {
    local layer_name="$1"
    shift
    local options=("$@")
    
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    local project_id=$(jq -r '.providers.gcp.gcr.project_id' "$config_file")
    local region=$(jq -r '.providers.gcp.gcr.region' "$config_file")
    
    log_info "Deploying $layer_name to Google Container Registry"
    
    # Configure docker for GCR
    gcloud auth configure-docker --project="$project_id"
    
    # Tag and push image
    local image_tag="gcr.io/$project_id/$layer_name:latest"
    docker tag "$layer_name" "$image_tag"
    docker push "$image_tag"
    
    log_success "Layer $layer_name deployed to Google Container Registry"
}

gcp_deploy_to_storage() {
    local layer_name="$1"
    shift
    local options=("$@")
    
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    local bucket=$(jq -r '.providers.gcp.storage.bucket' "$config_file")
    local project_id=$(jq -r '.providers.gcp.storage.project_id' "$config_file")
    
    log_info "Deploying $layer_name to Google Cloud Storage"
    
    # Create layer archive
    local archive_file="${PARTICLE_WORKSPACE}/cloud/deployments/${layer_name}.tar.gz"
    tar -czf "$archive_file" -C "${PARTICLE_WORKSPACE}/layers" "$layer_name"
    
    # Upload to GCS
    gsutil cp "$archive_file" "gs://$bucket/layers/$layer_name.tar.gz"
    
    log_success "Layer $layer_name deployed to Google Cloud Storage"
}

# Cloud Status and Management Functions
cloud_status() {
    local provider="$1"
    
    if [[ -z "$provider" ]]; then
        log_info "Cloud integration status:"
        echo
        cloud_status_aws
        echo
        cloud_status_azure
        echo
        cloud_status_gcp
        return 0
    fi
    
    case "$provider" in
        "aws")
            cloud_status_aws
            ;;
        "azure")
            cloud_status_azure
            ;;
        "gcp")
            cloud_status_gcp
            ;;
        *)
            log_error "Unknown cloud provider: $provider"
            return 1
            ;;
    esac
}

cloud_status_aws() {
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    local enabled=$(jq -r '.providers.aws.enabled' "$config_file")
    
    echo "AWS Integration:"
    if [[ "$enabled" == "true" ]]; then
        echo "  Status: ${GREEN}Enabled${NC}"
        local account_id=$(jq -r '.providers.aws.account_id' "$config_file")
        echo "  Account ID: $account_id"
        
        # Check services
        local services=$(jq -r '.providers.aws.services | to_entries[] | select(.value == true) | .key' "$config_file")
        if [[ -n "$services" ]]; then
            echo "  Enabled Services:"
            echo "$services" | while read -r service; do
                echo "    - $service"
            done
        fi
    else
        echo "  Status: ${RED}Disabled${NC}"
    fi
}

cloud_status_azure() {
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    local enabled=$(jq -r '.providers.azure.enabled' "$config_file")
    
    echo "Azure Integration:"
    if [[ "$enabled" == "true" ]]; then
        echo "  Status: ${GREEN}Enabled${NC}"
        local subscription_id=$(jq -r '.providers.azure.subscription_id' "$config_file")
        echo "  Subscription ID: $subscription_id"
        
        # Check services
        local services=$(jq -r '.providers.azure.services | to_entries[] | select(.value == true) | .key' "$config_file")
        if [[ -n "$services" ]]; then
            echo "  Enabled Services:"
            echo "$services" | while read -r service; do
                echo "    - $service"
            done
        fi
    else
        echo "  Status: ${RED}Disabled${NC}"
    fi
}

cloud_status_gcp() {
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    local enabled=$(jq -r '.providers.gcp.enabled' "$config_file")
    
    echo "GCP Integration:"
    if [[ "$enabled" == "true" ]]; then
        echo "  Status: ${GREEN}Enabled${NC}"
        local project_id=$(jq -r '.providers.gcp.project_id' "$config_file")
        echo "  Project ID: $project_id"
        
        # Check services
        local services=$(jq -r '.providers.gcp.services | to_entries[] | select(.value == true) | .key' "$config_file")
        if [[ -n "$services" ]]; then
            echo "  Enabled Services:"
            echo "$services" | while read -r service; do
                echo "    - $service"
            done
        fi
    else
        echo "  Status: ${RED}Disabled${NC}"
    fi
}

cloud_list_deployments() {
    local config_file="${PARTICLE_WORKSPACE}/cloud/cloud-config.json"
    local deployments_file="${PARTICLE_WORKSPACE}/cloud/deployments/deployments.json"
    
    if [[ ! -f "$deployments_file" ]]; then
        log_info "No deployments found"
        return 0
    fi
    
    log_info "Cloud deployments:"
    jq -r '.deployments[] | "\(.layer_name) -> \(.provider)/\(.service) (\(.timestamp))"' "$deployments_file"
}

# Cloud cleanup functions
cloud_cleanup() {
    local provider="$1"
    local service="$2"
    
    log_info "Cleaning up cloud resources"
    
    case "$provider" in
        "aws")
            aws_cleanup "$service"
            ;;
        "azure")
            azure_cleanup "$service"
            ;;
        "gcp")
            gcp_cleanup "$service"
            ;;
        *)
            log_error "Unknown cloud provider: $provider"
            return 1
            ;;
    esac
}

aws_cleanup() {
    local service="$1"
    
    case "$service" in
        "ecr")
            log_info "Cleaning up AWS ECR resources"
            # Implementation for ECR cleanup
            ;;
        "s3")
            log_info "Cleaning up AWS S3 resources"
            # Implementation for S3 cleanup
            ;;
        *)
            log_warning "Unknown AWS service for cleanup: $service"
            ;;
    esac
}

azure_cleanup() {
    local service="$1"
    
    case "$service" in
        "acr")
            log_info "Cleaning up Azure ACR resources"
            # Implementation for ACR cleanup
            ;;
        "storage")
            log_info "Cleaning up Azure Storage resources"
            # Implementation for Storage cleanup
            ;;
        *)
            log_warning "Unknown Azure service for cleanup: $service"
            ;;
    esac
}

gcp_cleanup() {
    local service="$1"
    
    case "$service" in
        "gcr")
            log_info "Cleaning up GCP Container Registry resources"
            # Implementation for GCR cleanup
            ;;
        "storage")
            log_info "Cleaning up GCP Storage resources"
            # Implementation for Storage cleanup
            ;;
        *)
            log_warning "Unknown GCP service for cleanup: $service"
            ;;
    esac
} 

# --- END OF SCRIPTLET: 19-cloud-integration.sh ---

# ============================================================================
# Kubernetes Integration (EKS, AKS, GKE, OpenShift)
# ============================================================================
# Kubernetes Integration Scriptlet for apt-layer
# Provides Kubernetes and OpenShift integration for cloud-native deployment

# Kubernetes integration functions
kubernetes_integration_init() {
    log_info "Initializing Kubernetes integration system..."
    
    # Create Kubernetes integration directories
    mkdir -p "${PARTICLE_WORKSPACE}/kubernetes"
    mkdir -p "${PARTICLE_WORKSPACE}/kubernetes/clusters"
    mkdir -p "${PARTICLE_WORKSPACE}/kubernetes/configs"
    mkdir -p "${PARTICLE_WORKSPACE}/kubernetes/deployments"
    mkdir -p "${PARTICLE_WORKSPACE}/kubernetes/helm"
    mkdir -p "${PARTICLE_WORKSPACE}/kubernetes/operators"
    mkdir -p "${PARTICLE_WORKSPACE}/kubernetes/monitoring"
    mkdir -p "${PARTICLE_WORKSPACE}/kubernetes/security"
    
    # Initialize Kubernetes configuration database
    if [[ ! -f "${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json" ]]; then
        cat > "${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json" << 'EOF'
{
  "clusters": {},
  "providers": {
    "eks": {
      "enabled": false,
      "clusters": [],
      "regions": [],
      "services": {
        "autoscaling": false,
        "loadbalancer": false,
        "storage": false,
        "monitoring": false
      }
    },
    "aks": {
      "enabled": false,
      "clusters": [],
      "subscriptions": [],
      "services": {
        "autoscaling": false,
        "loadbalancer": false,
        "storage": false,
        "monitoring": false
      }
    },
    "gke": {
      "enabled": false,
      "clusters": [],
      "projects": [],
      "services": {
        "autoscaling": false,
        "loadbalancer": false,
        "storage": false,
        "monitoring": false
      }
    },
    "openshift": {
      "enabled": false,
      "clusters": [],
      "versions": [],
      "services": {
        "operators": false,
        "monitoring": false,
        "security": false,
        "networking": false
      }
    }
  },
  "deployments": [],
  "helm_releases": [],
  "operators": [],
  "last_updated": ""
}
EOF
    fi
    
    log_success "Kubernetes integration system initialized"
}

# Kubernetes cluster management functions
k8s_check_kubectl() {
    if ! command -v kubectl &> /dev/null; then
        log_error "kubectl not found. Please install kubectl for Kubernetes operations."
        return 1
    fi
    
    # Check kubectl version
    local version=$(kubectl version --client --short 2>/dev/null | cut -d' ' -f3)
    log_info "kubectl version: $version"
    return 0
}

k8s_check_cluster_access() {
    if ! kubectl cluster-info &> /dev/null; then
        log_error "Cannot access Kubernetes cluster. Please check your kubeconfig."
        return 1
    fi
    
    # Get cluster info
    local cluster_name=$(kubectl config current-context 2>/dev/null)
    local api_server=$(kubectl cluster-info | grep "Kubernetes control plane" | awk '{print $7}' | sed 's/https:\/\///')
    
    log_info "Connected to cluster: $cluster_name"
    log_info "API Server: $api_server"
    return 0
}

k8s_get_cluster_info() {
    local cluster_name="$1"
    
    if [[ -z "$cluster_name" ]]; then
        cluster_name=$(kubectl config current-context 2>/dev/null)
    fi
    
    log_info "Getting cluster information for: $cluster_name"
    
    # Get cluster details
    local nodes=$(kubectl get nodes --no-headers | wc -l)
    local pods=$(kubectl get pods --all-namespaces --no-headers | wc -l)
    local namespaces=$(kubectl get namespaces --no-headers | wc -l)
    local version=$(kubectl version --short 2>/dev/null | grep "Server Version" | awk '{print $3}')
    
    echo "Cluster: $cluster_name"
    echo "  Nodes: $nodes"
    echo "  Pods: $pods"
    echo "  Namespaces: $namespaces"
    echo "  Version: $version"
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json"
    jq --arg cluster "$cluster_name" --arg version "$version" --argjson nodes "$nodes" --argjson pods "$pods" \
       '.clusters[$cluster] = {"version": $version, "nodes": $nodes, "pods": $pods, "last_seen": now}' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
}

# EKS Integration Functions
eks_init() {
    log_info "Initializing EKS integration..."
    
    # Check for AWS CLI and kubectl
    if ! command -v aws &> /dev/null; then
        log_error "AWS CLI not found. Please install awscli for EKS operations."
        return 1
    fi
    
    if ! k8s_check_kubectl; then
        return 1
    fi
    
    # Check AWS credentials
    if ! aws sts get-caller-identity &> /dev/null; then
        log_warning "AWS credentials not configured. Please run 'aws configure' first."
        return 1
    fi
    
    # Get AWS account info
    local account_id=$(aws sts get-caller-identity --query Account --output text)
    local region=$(aws configure get region)
    
    log_info "AWS Account ID: $account_id"
    log_info "AWS Region: $region"
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json"
    jq --arg account_id "$account_id" --arg region "$region" \
       '.providers.eks.enabled = true | .providers.eks.account_id = $account_id | .providers.eks.region = $region' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "EKS integration initialized"
}

eks_list_clusters() {
    local region="${1:-}"
    
    if [[ -z "$region" ]]; then
        region=$(aws configure get region)
    fi
    
    log_info "Listing EKS clusters in region: $region"
    
    # List EKS clusters
    local clusters=$(aws eks list-clusters --region "$region" --query 'clusters[]' --output text)
    
    if [[ -z "$clusters" ]]; then
        log_info "No EKS clusters found in region $region"
        return 0
    fi
    
    echo "EKS Clusters in $region:"
    for cluster in $clusters; do
        local status=$(aws eks describe-cluster --name "$cluster" --region "$region" --query 'cluster.status' --output text)
        local version=$(aws eks describe-cluster --name "$cluster" --region "$region" --query 'cluster.version' --output text)
        echo "  $cluster (Status: $status, Version: $version)"
    done
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json"
    for cluster in $clusters; do
        jq --arg cluster "$cluster" --arg region "$region" \
           '.providers.eks.clusters += [$cluster] | .providers.eks.regions += [$region]' \
           "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    done
}

eks_create_cluster() {
    local cluster_name="$1"
    local region="${2:-}"
    local version="${3:-1.28}"
    
    if [[ -z "$region" ]]; then
        region=$(aws configure get region)
    fi
    
    log_info "Creating EKS cluster: $cluster_name in region: $region"
    
    # Check if cluster already exists
    if aws eks describe-cluster --name "$cluster_name" --region "$region" &> /dev/null; then
        log_warning "EKS cluster $cluster_name already exists in region $region"
        return 1
    fi
    
    # Create EKS cluster
    aws eks create-cluster \
        --name "$cluster_name" \
        --region "$region" \
        --kubernetes-version "$version" \
        --role-arn "arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):role/eks-cluster-role" \
        --resources-vpc-config subnetIds=subnet-12345678,subnet-87654321,securityGroupIds=sg-12345678
    
    log_info "EKS cluster creation initiated. This may take 10-15 minutes."
    log_info "Check status with: aws eks describe-cluster --name $cluster_name --region $region"
}

eks_configure_kubectl() {
    local cluster_name="$1"
    local region="${2:-}"
    
    if [[ -z "$region" ]]; then
        region=$(aws configure get region)
    fi
    
    log_info "Configuring kubectl for EKS cluster: $cluster_name"
    
    # Update kubeconfig
    aws eks update-kubeconfig --name "$cluster_name" --region "$region"
    
    # Test connection
    if k8s_check_cluster_access; then
        log_success "Successfully connected to EKS cluster: $cluster_name"
        k8s_get_cluster_info "$cluster_name"
    else
        log_error "Failed to connect to EKS cluster: $cluster_name"
        return 1
    fi
}

# AKS Integration Functions
aks_init() {
    log_info "Initializing AKS integration..."
    
    # Check for Azure CLI and kubectl
    if ! command -v az &> /dev/null; then
        log_error "Azure CLI not found. Please install azure-cli for AKS operations."
        return 1
    fi
    
    if ! k8s_check_kubectl; then
        return 1
    fi
    
    # Check Azure login
    if ! az account show &> /dev/null; then
        log_warning "Azure not logged in. Please run 'az login' first."
        return 1
    fi
    
    # Get Azure account info
    local subscription_id=$(az account show --query id --output tsv)
    local tenant_id=$(az account show --query tenantId --output tsv)
    
    log_info "Azure Subscription ID: $subscription_id"
    log_info "Azure Tenant ID: $tenant_id"
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json"
    jq --arg sub_id "$subscription_id" --arg tenant_id "$tenant_id" \
       '.providers.aks.enabled = true | .providers.aks.subscription_id = $sub_id | .providers.aks.tenant_id = $tenant_id' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "AKS integration initialized"
}

aks_list_clusters() {
    local resource_group="${1:-}"
    
    log_info "Listing AKS clusters"
    
    if [[ -n "$resource_group" ]]; then
        local clusters=$(az aks list --resource-group "$resource_group" --query '[].name' --output tsv)
    else
        local clusters=$(az aks list --query '[].name' --output tsv)
    fi
    
    if [[ -z "$clusters" ]]; then
        log_info "No AKS clusters found"
        return 0
    fi
    
    echo "AKS Clusters:"
    for cluster in $clusters; do
        local resource_group=$(az aks show --name "$cluster" --query 'resourceGroup' --output tsv)
        local version=$(az aks show --name "$cluster" --resource-group "$resource_group" --query 'kubernetesVersion' --output tsv)
        local status=$(az aks show --name "$cluster" --resource-group "$resource_group" --query 'powerState.code' --output tsv)
        echo "  $cluster (RG: $resource_group, Version: $version, Status: $status)"
    done
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json"
    for cluster in $clusters; do
        jq --arg cluster "$cluster" \
           '.providers.aks.clusters += [$cluster]' \
           "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    done
}

aks_create_cluster() {
    local cluster_name="$1"
    local resource_group="$2"
    local location="${3:-eastus}"
    local version="${4:-1.28.0}"
    
    log_info "Creating AKS cluster: $cluster_name in resource group: $resource_group"
    
    # Check if cluster already exists
    if az aks show --name "$cluster_name" --resource-group "$resource_group" &> /dev/null; then
        log_warning "AKS cluster $cluster_name already exists in resource group $resource_group"
        return 1
    fi
    
    # Create resource group if it doesn't exist
    if ! az group show --name "$resource_group" &> /dev/null; then
        log_info "Creating resource group: $resource_group"
        az group create --name "$resource_group" --location "$location"
    fi
    
    # Create AKS cluster
    az aks create \
        --resource-group "$resource_group" \
        --name "$cluster_name" \
        --kubernetes-version "$version" \
        --location "$location" \
        --node-count 1 \
        --node-vm-size Standard_DS2_v2 \
        --enable-addons monitoring \
        --generate-ssh-keys
    
    log_info "AKS cluster creation initiated. This may take 10-15 minutes."
    log_info "Check status with: az aks show --name $cluster_name --resource-group $resource_group"
}

aks_configure_kubectl() {
    local cluster_name="$1"
    local resource_group="$2"
    
    log_info "Configuring kubectl for AKS cluster: $cluster_name"
    
    # Get credentials
    az aks get-credentials --resource-group "$resource_group" --name "$cluster_name" --overwrite-existing
    
    # Test connection
    if k8s_check_cluster_access; then
        log_success "Successfully connected to AKS cluster: $cluster_name"
        k8s_get_cluster_info "$cluster_name"
    else
        log_error "Failed to connect to AKS cluster: $cluster_name"
        return 1
    fi
}

# GKE Integration Functions
gke_init() {
    log_info "Initializing GKE integration..."
    
    # Check for gcloud CLI and kubectl
    if ! command -v gcloud &> /dev/null; then
        log_error "Google Cloud CLI not found. Please install google-cloud-cli for GKE operations."
        return 1
    fi
    
    if ! k8s_check_kubectl; then
        return 1
    fi
    
    # Check GCP authentication
    if ! gcloud auth list --filter=status:ACTIVE --format="value(account)" | grep -q .; then
        log_warning "GCP not authenticated. Please run 'gcloud auth login' first."
        return 1
    fi
    
    # Get GCP project info
    local project_id=$(gcloud config get-value project)
    local account=$(gcloud auth list --filter=status:ACTIVE --format="value(account)" | head -1)
    
    log_info "GCP Project ID: $project_id"
    log_info "GCP Account: $account"
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json"
    jq --arg project_id "$project_id" --arg account "$account" \
       '.providers.gke.enabled = true | .providers.gke.project_id = $project_id | .providers.gke.account = $account' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "GKE integration initialized"
}

gke_list_clusters() {
    local project_id="${1:-}"
    
    if [[ -z "$project_id" ]]; then
        project_id=$(gcloud config get-value project)
    fi
    
    log_info "Listing GKE clusters in project: $project_id"
    
    # List GKE clusters
    local clusters=$(gcloud container clusters list --project="$project_id" --format="value(name)" 2>/dev/null)
    
    if [[ -z "$clusters" ]]; then
        log_info "No GKE clusters found in project $project_id"
        return 0
    fi
    
    echo "GKE Clusters in $project_id:"
    for cluster in $clusters; do
        local location=$(gcloud container clusters list --project="$project_id" --filter="name=$cluster" --format="value(location)")
        local version=$(gcloud container clusters list --project="$project_id" --filter="name=$cluster" --format="value(currentMasterVersion)")
        local status=$(gcloud container clusters list --project="$project_id" --filter="name=$cluster" --format="value(status)")
        echo "  $cluster (Location: $location, Version: $version, Status: $status)"
    done
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json"
    for cluster in $clusters; do
        jq --arg cluster "$cluster" --arg project_id "$project_id" \
           '.providers.gke.clusters += [$cluster] | .providers.gke.projects += [$project_id]' \
           "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    done
}

gke_create_cluster() {
    local cluster_name="$1"
    local project_id="${2:-}"
    local location="${3:-us-central1}"
    local version="${4:-1.28}"
    
    if [[ -z "$project_id" ]]; then
        project_id=$(gcloud config get-value project)
    fi
    
    log_info "Creating GKE cluster: $cluster_name in project: $project_id"
    
    # Check if cluster already exists
    if gcloud container clusters describe "$cluster_name" --zone="$location" --project="$project_id" &> /dev/null; then
        log_warning "GKE cluster $cluster_name already exists in project $project_id"
        return 1
    fi
    
    # Create GKE cluster
    gcloud container clusters create "$cluster_name" \
        --project="$project_id" \
        --zone="$location" \
        --cluster-version="$version" \
        --num-nodes=1 \
        --machine-type=e2-standard-2 \
        --enable-autoscaling \
        --min-nodes=1 \
        --max-nodes=3 \
        --enable-stackdriver-kubernetes
    
    log_info "GKE cluster creation initiated. This may take 10-15 minutes."
    log_info "Check status with: gcloud container clusters describe $cluster_name --zone=$location --project=$project_id"
}

gke_configure_kubectl() {
    local cluster_name="$1"
    local project_id="${2:-}"
    local location="${3:-us-central1}"
    
    if [[ -z "$project_id" ]]; then
        project_id=$(gcloud config get-value project)
    fi
    
    log_info "Configuring kubectl for GKE cluster: $cluster_name"
    
    # Get credentials
    gcloud container clusters get-credentials "$cluster_name" --zone="$location" --project="$project_id"
    
    # Test connection
    if k8s_check_cluster_access; then
        log_success "Successfully connected to GKE cluster: $cluster_name"
        k8s_get_cluster_info "$cluster_name"
    else
        log_error "Failed to connect to GKE cluster: $cluster_name"
        return 1
    fi
}

# OpenShift Integration Functions
openshift_init() {
    log_info "Initializing OpenShift integration..."
    
    # Check for oc CLI
    if ! command -v oc &> /dev/null; then
        log_error "OpenShift CLI (oc) not found. Please install oc for OpenShift operations."
        return 1
    fi
    
    if ! k8s_check_kubectl; then
        return 1
    fi
    
    # Check OpenShift login
    if ! oc whoami &> /dev/null; then
        log_warning "Not logged into OpenShift. Please run 'oc login' first."
        return 1
    fi
    
    # Get OpenShift info
    local cluster_url=$(oc whoami --show-server)
    local user=$(oc whoami)
    local version=$(oc version --client --short | grep "Client Version" | awk '{print $3}')
    
    log_info "OpenShift Cluster: $cluster_url"
    log_info "User: $user"
    log_info "Client Version: $version"
    
    # Update config
    local config_file="${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json"
    jq --arg cluster_url "$cluster_url" --arg user "$user" --arg version "$version" \
       '.providers.openshift.enabled = true | .providers.openshift.cluster_url = $cluster_url | .providers.openshift.user = $user | .providers.openshift.version = $version' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "OpenShift integration initialized"
}

openshift_list_projects() {
    log_info "Listing OpenShift projects"
    
    # List projects
    local projects=$(oc get projects --no-headers | awk '{print $1}')
    
    if [[ -z "$projects" ]]; then
        log_info "No OpenShift projects found"
        return 0
    fi
    
    echo "OpenShift Projects:"
    for project in $projects; do
        local status=$(oc get project "$project" --no-headers | awk '{print $2}')
        echo "  $project (Status: $status)"
    done
}

openshift_create_project() {
    local project_name="$1"
    local display_name="${2:-$project_name}"
    local description="${3:-}"
    
    log_info "Creating OpenShift project: $project_name"
    
    # Check if project already exists
    if oc get project "$project_name" &> /dev/null; then
        log_warning "OpenShift project $project_name already exists"
        return 1
    fi
    
    # Create project
    oc new-project "$project_name" --display-name="$display_name" --description="$description"
    
    log_success "OpenShift project created: $project_name"
}

# Kubernetes deployment functions
k8s_deploy_layer() {
    local layer_name="$1"
    local namespace="${2:-default}"
    local deployment_type="${3:-deployment}"
    
    log_info "Deploying layer $layer_name to Kubernetes namespace: $namespace"
    
    # Create namespace if it doesn't exist
    if ! kubectl get namespace "$namespace" &> /dev/null; then
        log_info "Creating namespace: $namespace"
        kubectl create namespace "$namespace"
    fi
    
    # Create deployment manifest
    local manifest_file="${PARTICLE_WORKSPACE}/kubernetes/deployments/${layer_name}-deployment.yaml"
    
    cat > "$manifest_file" << EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ${layer_name}-deployment
  namespace: ${namespace}
  labels:
    app: ${layer_name}
    layer: ${layer_name}
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ${layer_name}
  template:
    metadata:
      labels:
        app: ${layer_name}
        layer: ${layer_name}
    spec:
      containers:
      - name: ${layer_name}
        image: ${layer_name}:latest
        ports:
        - containerPort: 80
        resources:
          requests:
            memory: "64Mi"
            cpu: "250m"
          limits:
            memory: "128Mi"
            cpu: "500m"
---
apiVersion: v1
kind: Service
metadata:
  name: ${layer_name}-service
  namespace: ${namespace}
  labels:
    app: ${layer_name}
spec:
  selector:
    app: ${layer_name}
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80
  type: ClusterIP
EOF
    
    # Apply deployment
    kubectl apply -f "$manifest_file"
    
    log_success "Layer $layer_name deployed to Kubernetes"
    
    # Update deployment tracking
    local config_file="${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json"
    jq --arg layer "$layer_name" --arg namespace "$namespace" --arg type "$deployment_type" \
       '.deployments += [{"layer": $layer, "namespace": $namespace, "type": $type, "timestamp": now}]' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
}

k8s_list_deployments() {
    local namespace="${1:-all}"
    
    log_info "Listing Kubernetes deployments"
    
    if [[ "$namespace" == "all" ]]; then
        kubectl get deployments --all-namespaces
    else
        kubectl get deployments --namespace="$namespace"
    fi
}

k8s_get_deployment_status() {
    local deployment_name="$1"
    local namespace="${2:-default}"
    
    log_info "Getting deployment status for: $deployment_name"
    
    kubectl get deployment "$deployment_name" --namespace="$namespace" -o wide
    kubectl describe deployment "$deployment_name" --namespace="$namespace"
}

k8s_scale_deployment() {
    local deployment_name="$1"
    local replicas="$2"
    local namespace="${3:-default}"
    
    log_info "Scaling deployment $deployment_name to $replicas replicas"
    
    kubectl scale deployment "$deployment_name" --replicas="$replicas" --namespace="$namespace"
    
    log_success "Deployment $deployment_name scaled to $replicas replicas"
}

# Helm integration functions
helm_init() {
    log_info "Initializing Helm integration..."
    
    # Check for Helm
    if ! command -v helm &> /dev/null; then
        log_error "Helm not found. Please install Helm for chart management."
        return 1
    fi
    
    # Initialize Helm
    helm repo add stable https://charts.helm.sh/stable
    helm repo update
    
    log_success "Helm integration initialized"
}

helm_install_chart() {
    local chart_name="$1"
    local release_name="$2"
    local namespace="${3:-default}"
    local values_file="${4:-}"
    
    log_info "Installing Helm chart: $chart_name as release: $release_name"
    
    # Create namespace if it doesn't exist
    if ! kubectl get namespace "$namespace" &> /dev/null; then
        log_info "Creating namespace: $namespace"
        kubectl create namespace "$namespace"
    fi
    
    # Install chart
    if [[ -n "$values_file" ]]; then
        helm install "$release_name" "$chart_name" --namespace="$namespace" -f "$values_file"
    else
        helm install "$release_name" "$chart_name" --namespace="$namespace"
    fi
    
    log_success "Helm chart $chart_name installed as $release_name"
    
    # Update helm releases tracking
    local config_file="${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json"
    jq --arg chart "$chart_name" --arg release "$release_name" --arg namespace "$namespace" \
       '.helm_releases += [{"chart": $chart, "release": $release, "namespace": $namespace, "timestamp": now}]' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
}

helm_list_releases() {
    local namespace="${1:-all}"
    
    log_info "Listing Helm releases"
    
    if [[ "$namespace" == "all" ]]; then
        helm list --all-namespaces
    else
        helm list --namespace="$namespace"
    fi
}

helm_uninstall_release() {
    local release_name="$1"
    local namespace="${2:-default}"
    
    log_info "Uninstalling Helm release: $release_name"
    
    helm uninstall "$release_name" --namespace="$namespace"
    
    log_success "Helm release $release_name uninstalled"
}

# Kubernetes monitoring functions
k8s_install_monitoring() {
    local namespace="${1:-monitoring}"
    
    log_info "Installing Kubernetes monitoring stack in namespace: $namespace"
    
    # Create monitoring namespace
    kubectl create namespace "$namespace"
    
    # Install Prometheus Operator
    helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
    helm repo update
    
    helm install prometheus prometheus-community/kube-prometheus-stack \
        --namespace="$namespace" \
        --set prometheus.prometheusSpec.serviceMonitorSelectorNilUsesHelmValues=false
    
    log_success "Kubernetes monitoring stack installed"
}

k8s_get_metrics() {
    local resource_type="${1:-pods}"
    local namespace="${2:-all}"
    
    log_info "Getting metrics for $resource_type"
    
    if [[ "$namespace" == "all" ]]; then
        kubectl top "$resource_type" --all-namespaces
    else
        kubectl top "$resource_type" --namespace="$namespace"
    fi
}

# Kubernetes security functions
k8s_install_security() {
    local namespace="${1:-security}"
    
    log_info "Installing Kubernetes security tools in namespace: $namespace"
    
    # Create security namespace
    kubectl create namespace "$namespace"
    
    # Install Falco for runtime security
    helm repo add falcosecurity https://falcosecurity.github.io/charts
    helm repo update
    
    helm install falco falcosecurity/falco --namespace="$namespace"
    
    log_success "Kubernetes security tools installed"
}

k8s_scan_security() {
    local namespace="${1:-all}"
    
    log_info "Running security scan for namespace: $namespace"
    
    # Check for security vulnerabilities
    kubectl get pods --all-namespaces -o json | jq -r '.items[] | select(.spec.securityContext == null) | "Pod without security context: \(.metadata.namespace)/\(.metadata.name)"'
    
    # Check for privileged containers
    kubectl get pods --all-namespaces -o json | jq -r '.items[] | select(.spec.containers[].securityContext.privileged == true) | "Privileged container: \(.metadata.namespace)/\(.metadata.name)"'
}

# Kubernetes status and management functions
k8s_status() {
    local provider="$1"
    
    if [[ -z "$provider" ]]; then
        log_info "Kubernetes integration status:"
        echo
        k8s_status_eks
        echo
        k8s_status_aks
        echo
        k8s_status_gke
        echo
        k8s_status_openshift
        return 0
    fi
    
    case "$provider" in
        "eks")
            k8s_status_eks
            ;;
        "aks")
            k8s_status_aks
            ;;
        "gke")
            k8s_status_gke
            ;;
        "openshift")
            k8s_status_openshift
            ;;
        *)
            log_error "Unknown Kubernetes provider: $provider"
            return 1
            ;;
    esac
}

k8s_status_eks() {
    local config_file="${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json"
    local enabled=$(jq -r '.providers.eks.enabled' "$config_file")
    
    echo "EKS Integration:"
    if [[ "$enabled" == "true" ]]; then
        echo "  Status: ${GREEN}Enabled${NC}"
        local account_id=$(jq -r '.providers.eks.account_id' "$config_file")
        local region=$(jq -r '.providers.eks.region' "$config_file")
        echo "  Account ID: $account_id"
        echo "  Region: $region"
        
        # List clusters
        local clusters=$(jq -r '.providers.eks.clusters[]?' "$config_file")
        if [[ -n "$clusters" ]]; then
            echo "  Clusters:"
            echo "$clusters" | while read -r cluster; do
                echo "    - $cluster"
            done
        fi
    else
        echo "  Status: ${RED}Disabled${NC}"
    fi
}

k8s_status_aks() {
    local config_file="${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json"
    local enabled=$(jq -r '.providers.aks.enabled' "$config_file")
    
    echo "AKS Integration:"
    if [[ "$enabled" == "true" ]]; then
        echo "  Status: ${GREEN}Enabled${NC}"
        local subscription_id=$(jq -r '.providers.aks.subscription_id' "$config_file")
        echo "  Subscription ID: $subscription_id"
        
        # List clusters
        local clusters=$(jq -r '.providers.aks.clusters[]?' "$config_file")
        if [[ -n "$clusters" ]]; then
            echo "  Clusters:"
            echo "$clusters" | while read -r cluster; do
                echo "    - $cluster"
            done
        fi
    else
        echo "  Status: ${RED}Disabled${NC}"
    fi
}

k8s_status_gke() {
    local config_file="${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json"
    local enabled=$(jq -r '.providers.gke.enabled' "$config_file")
    
    echo "GKE Integration:"
    if [[ "$enabled" == "true" ]]; then
        echo "  Status: ${GREEN}Enabled${NC}"
        local project_id=$(jq -r '.providers.gke.project_id' "$config_file")
        echo "  Project ID: $project_id"
        
        # List clusters
        local clusters=$(jq -r '.providers.gke.clusters[]?' "$config_file")
        if [[ -n "$clusters" ]]; then
            echo "  Clusters:"
            echo "$clusters" | while read -r cluster; do
                echo "    - $cluster"
            done
        fi
    else
        echo "  Status: ${RED}Disabled${NC}"
    fi
}

k8s_status_openshift() {
    local config_file="${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json"
    local enabled=$(jq -r '.providers.openshift.enabled' "$config_file")
    
    echo "OpenShift Integration:"
    if [[ "$enabled" == "true" ]]; then
        echo "  Status: ${GREEN}Enabled${NC}"
        local cluster_url=$(jq -r '.providers.openshift.cluster_url' "$config_file")
        local user=$(jq -r '.providers.openshift.user' "$config_file")
        echo "  Cluster URL: $cluster_url"
        echo "  User: $user"
    else
        echo "  Status: ${RED}Disabled${NC}"
    fi
}

k8s_list_deployments_all() {
    local config_file="${PARTICLE_WORKSPACE}/kubernetes/k8s-config.json"
    local deployments_file="${PARTICLE_WORKSPACE}/kubernetes/deployments/deployments.json"
    
    if [[ ! -f "$deployments_file" ]]; then
        log_info "No Kubernetes deployments found"
        return 0
    fi
    
    log_info "Kubernetes deployments:"
    jq -r '.deployments[] | "\(.layer) -> \(.namespace) (\(.type)) (\(.timestamp))"' "$deployments_file"
}

# Kubernetes cleanup functions
k8s_cleanup() {
    local provider="$1"
    local cluster_name="$2"
    
    log_info "Cleaning up Kubernetes resources"
    
    case "$provider" in
        "eks")
            k8s_cleanup_eks "$cluster_name"
            ;;
        "aks")
            k8s_cleanup_aks "$cluster_name"
            ;;
        "gke")
            k8s_cleanup_gke "$cluster_name"
            ;;
        "openshift")
            k8s_cleanup_openshift "$cluster_name"
            ;;
        *)
            log_error "Unknown Kubernetes provider: $provider"
            return 1
            ;;
    esac
}

k8s_cleanup_eks() {
    local cluster_name="$1"
    
    if [[ -z "$cluster_name" ]]; then
        log_error "Cluster name required for EKS cleanup"
        return 1
    fi
    
    log_info "Cleaning up EKS cluster: $cluster_name"
    
    # Delete EKS cluster
    local region=$(aws configure get region)
    aws eks delete-cluster --name "$cluster_name" --region "$region"
    
    log_info "EKS cluster deletion initiated. This may take 10-15 minutes."
}

k8s_cleanup_aks() {
    local cluster_name="$1"
    local resource_group="${2:-}"
    
    if [[ -z "$cluster_name" ]]; then
        log_error "Cluster name required for AKS cleanup"
        return 1
    fi
    
    if [[ -z "$resource_group" ]]; then
        log_error "Resource group required for AKS cleanup"
        return 1
    fi
    
    log_info "Cleaning up AKS cluster: $cluster_name"
    
    # Delete AKS cluster
    az aks delete --resource-group "$resource_group" --name "$cluster_name" --yes
    
    log_info "AKS cluster deletion initiated. This may take 10-15 minutes."
}

k8s_cleanup_gke() {
    local cluster_name="$1"
    local project_id="${2:-}"
    local location="${3:-us-central1}"
    
    if [[ -z "$cluster_name" ]]; then
        log_error "Cluster name required for GKE cleanup"
        return 1
    fi
    
    if [[ -z "$project_id" ]]; then
        project_id=$(gcloud config get-value project)
    fi
    
    log_info "Cleaning up GKE cluster: $cluster_name"
    
    # Delete GKE cluster
    gcloud container clusters delete "$cluster_name" --zone="$location" --project="$project_id" --quiet
    
    log_info "GKE cluster deletion initiated. This may take 10-15 minutes."
}

k8s_cleanup_openshift() {
    local project_name="$1"
    
    if [[ -z "$project_name" ]]; then
        log_error "Project name required for OpenShift cleanup"
        return 1
    fi
    
    log_info "Cleaning up OpenShift project: $project_name"
    
    # Delete OpenShift project
    oc delete project "$project_name"
    
    log_success "OpenShift project deleted: $project_name"
} 

# --- END OF SCRIPTLET: 20-kubernetes-integration.sh ---

# ============================================================================
# Container Orchestration (Multi-cluster, Service Mesh, GitOps)
# ============================================================================
# Container Orchestration Scriptlet for apt-layer
# Provides advanced container orchestration support beyond basic Kubernetes

# Container orchestration integration functions
container_orchestration_init() {
    log_info "Initializing container orchestration system..."
    
    # Create container orchestration directories
    mkdir -p "${PARTICLE_WORKSPACE}/orchestration"
    mkdir -p "${PARTICLE_WORKSPACE}/orchestration/multi-cluster"
    mkdir -p "${PARTICLE_WORKSPACE}/orchestration/service-mesh"
    mkdir -p "${PARTICLE_WORKSPACE}/orchestration/gitops"
    mkdir -p "${PARTICLE_WORKSPACE}/orchestration/deployments"
    mkdir -p "${PARTICLE_WORKSPACE}/orchestration/monitoring"
    mkdir -p "${PARTICLE_WORKSPACE}/orchestration/security"
    mkdir -p "${PARTICLE_WORKSPACE}/orchestration/backup"
    
    # Initialize container orchestration configuration database
    if [[ ! -f "${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json" ]]; then
        cat > "${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json" << 'EOF'
{
  "multi_cluster": {
    "enabled": false,
    "clusters": {},
    "federation": {
      "enabled": false,
      "clusters": [],
      "policies": {}
    }
  },
  "service_mesh": {
    "enabled": false,
    "type": "",
    "clusters": {},
    "configs": {}
  },
  "gitops": {
    "enabled": false,
    "repositories": {},
    "workflows": {},
    "sync_status": {}
  },
  "deployments": {
    "patterns": {},
    "templates": {},
    "rollouts": {}
  },
  "monitoring": {
    "distributed": false,
    "clusters": {},
    "alerts": {}
  },
  "security": {
    "policies": {},
    "scanning": {},
    "compliance": {}
  },
  "backup": {
    "schedules": {},
    "retention": {},
    "restore_points": {}
  },
  "last_updated": ""
}
EOF
    fi
    
    log_success "Container orchestration system initialized"
}

# Multi-cluster management functions
multi_cluster_init() {
    log_info "Initializing multi-cluster management system..."
    
    # Check for kubectl
    if ! command -v kubectl &> /dev/null; then
        log_error "kubectl not found. Please install kubectl for multi-cluster operations."
        return 1
    fi
    
    # Create multi-cluster configuration
    local config_file="${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json"
    jq '.multi_cluster.enabled = true' "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "Multi-cluster management system initialized"
}

multi_cluster_add_cluster() {
    local cluster_name="$1"
    local cluster_type="$2"
    local cluster_config="$3"
    
    if [[ -z "$cluster_name" || -z "$cluster_type" ]]; then
        log_error "Cluster name and type required"
        return 1
    fi
    
    log_info "Adding cluster: $cluster_name (type: $cluster_type)"
    
    # Validate cluster type
    case "$cluster_type" in
        "eks"|"aks"|"gke"|"openshift"|"vanilla")
            ;;
        *)
            log_error "Unsupported cluster type: $cluster_type"
            log_info "Supported types: eks, aks, gke, openshift, vanilla"
            return 1
            ;;
    esac
    
    # Test cluster connectivity
    if [[ -n "$cluster_config" ]]; then
        if ! kubectl --kubeconfig="$cluster_config" cluster-info &> /dev/null; then
            log_error "Cannot connect to cluster using provided config"
            return 1
        fi
    else
        if ! kubectl cluster-info &> /dev/null; then
            log_error "Cannot connect to current cluster context"
            return 1
        fi
    fi
    
    # Get cluster info
    local cluster_info=$(kubectl cluster-info 2>/dev/null | head -1)
    local api_server=$(echo "$cluster_info" | grep -o 'https://[^[:space:]]*')
    
    # Update configuration
    local config_file="${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json"
    jq --arg name "$cluster_name" --arg type "$cluster_type" --arg api "$api_server" \
       '.multi_cluster.clusters[$name] = {"type": $type, "api_server": $api, "added": now, "status": "active"}' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "Cluster $cluster_name added successfully"
}

multi_cluster_list_clusters() {
    local format="${1:-table}"
    
    log_info "Listing multi-cluster configuration"
    
    local config_file="${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json"
    local clusters=$(jq -r '.multi_cluster.clusters | to_entries[] | "\(.key): \(.value.type) - \(.value.status)"' "$config_file")
    
    if [[ -z "$clusters" ]]; then
        log_info "No clusters configured"
        return 0
    fi
    
    case "$format" in
        "json")
            jq '.multi_cluster.clusters' "$config_file"
            ;;
        "yaml")
            jq -r '.multi_cluster.clusters | to_entries[] | "\(.key):\n  type: \(.value.type)\n  status: \(.value.status)\n  api_server: \(.value.api_server)"' "$config_file"
            ;;
        *)
            echo "Multi-cluster configuration:"
            echo "$clusters" | while read -r cluster; do
                echo "  $cluster"
            done
            ;;
    esac
}

multi_cluster_deploy_to_all() {
    local layer_name="$1"
    local namespace="${2:-default}"
    local deployment_type="${3:-deployment}"
    
    if [[ -z "$layer_name" ]]; then
        log_error "Layer name required for multi-cluster deployment"
        return 1
    fi
    
    log_info "Deploying $layer_name to all clusters"
    
    local config_file="${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json"
    local clusters=$(jq -r '.multi_cluster.clusters | keys[]' "$config_file")
    
    if [[ -z "$clusters" ]]; then
        log_error "No clusters configured for multi-cluster deployment"
        return 1
    fi
    
    local success_count=0
    local total_count=0
    
    for cluster in $clusters; do
        total_count=$((total_count + 1))
        log_info "Deploying to cluster: $cluster"
        
        # Switch to cluster context
        if kubectl config use-context "$cluster" &> /dev/null; then
            # Deploy layer
            if k8s_deploy_layer "$layer_name" "$namespace" "$deployment_type"; then
                success_count=$((success_count + 1))
                log_success "Successfully deployed to cluster: $cluster"
            else
                log_error "Failed to deploy to cluster: $cluster"
            fi
        else
            log_error "Cannot switch to cluster context: $cluster"
        fi
    done
    
    log_info "Multi-cluster deployment completed: $success_count/$total_count successful"
}

multi_cluster_status() {
    local cluster_name="${1:-}"
    
    if [[ -n "$cluster_name" ]]; then
        log_info "Getting status for cluster: $cluster_name"
        
        local config_file="${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json"
        local cluster_info=$(jq -r ".multi_cluster.clusters[\"$cluster_name\"]" "$config_file")
        
        if [[ "$cluster_info" == "null" ]]; then
            log_error "Cluster not found: $cluster_name"
            return 1
        fi
        
        echo "Cluster: $cluster_name"
        echo "$cluster_info" | jq -r 'to_entries[] | "  \(.key): \(.value)"'
    else
        log_info "Getting status for all clusters"
        multi_cluster_list_clusters "json"
    fi
}

# Service mesh integration functions
service_mesh_init() {
    local mesh_type="$1"
    
    if [[ -z "$mesh_type" ]]; then
        log_error "Service mesh type required"
        return 1
    fi
    
    log_info "Initializing service mesh: $mesh_type"
    
    # Validate mesh type
    case "$mesh_type" in
        "istio"|"linkerd"|"consul"|"kuma")
            ;;
        *)
            log_error "Unsupported service mesh type: $mesh_type"
            log_info "Supported types: istio, linkerd, consul, kuma"
            return 1
            ;;
    esac
    
    # Check for Helm
    if ! command -v helm &> /dev/null; then
        log_error "Helm not found. Please install Helm for service mesh installation."
        return 1
    fi
    
    # Install service mesh based on type
    case "$mesh_type" in
        "istio")
            service_mesh_install_istio
            ;;
        "linkerd")
            service_mesh_install_linkerd
            ;;
        "consul")
            service_mesh_install_consul
            ;;
        "kuma")
            service_mesh_install_kuma
            ;;
    esac
    
    # Update configuration
    local config_file="${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json"
    jq --arg type "$mesh_type" '.service_mesh.enabled = true | .service_mesh.type = $type' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "Service mesh $mesh_type initialized"
}

service_mesh_install_istio() {
    log_info "Installing Istio service mesh..."
    
    # Add Istio Helm repository
    helm repo add istio https://istio-release.storage.googleapis.com/charts
    helm repo update
    
    # Create istio-system namespace
    kubectl create namespace istio-system --dry-run=client -o yaml | kubectl apply -f -
    
    # Install Istio base
    helm install istio-base istio/base -n istio-system
    
    # Install Istiod
    helm install istiod istio/istiod -n istio-system --wait
    
    # Install Istio ingress gateway
    kubectl create namespace istio-ingress --dry-run=client -o yaml | kubectl apply -f -
    helm install istio-ingress istio/gateway -n istio-ingress --wait
    
    log_success "Istio service mesh installed"
}

service_mesh_install_linkerd() {
    log_info "Installing Linkerd service mesh..."
    
    # Install Linkerd CLI
    curl -sL https://run.linkerd.io/install | sh
    
    # Install Linkerd control plane
    linkerd install | kubectl apply -f -
    
    # Wait for Linkerd to be ready
    linkerd check
    
    log_success "Linkerd service mesh installed"
}

service_mesh_install_consul() {
    log_info "Installing Consul service mesh..."
    
    # Add Consul Helm repository
    helm repo add consul https://helm.releases.hashicorp.com
    helm repo update
    
    # Install Consul
    helm install consul consul/consul --set global.name=consul --create-namespace -n consul-system
    
    log_success "Consul service mesh installed"
}

service_mesh_install_kuma() {
    log_info "Installing Kuma service mesh..."
    
    # Install Kuma
    kubectl apply -f https://docs.konghq.com/install/kubernetes/kuma/kuma.yaml
    
    log_success "Kuma service mesh installed"
}

service_mesh_deploy_with_mesh() {
    local layer_name="$1"
    local namespace="${2:-default}"
    local mesh_config="${3:-}"
    
    if [[ -z "$layer_name" ]]; then
        log_error "Layer name required for service mesh deployment"
        return 1
    fi
    
    log_info "Deploying $layer_name with service mesh integration"
    
    # Deploy the layer first
    k8s_deploy_layer "$layer_name" "$namespace" "deployment"
    
    # Get service mesh type
    local config_file="${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json"
    local mesh_type=$(jq -r '.service_mesh.type' "$config_file")
    
    if [[ "$mesh_type" == "null" || "$mesh_type" == "" ]]; then
        log_warning "No service mesh configured. Deploying without mesh integration."
        return 0
    fi
    
    # Apply service mesh configuration based on type
    case "$mesh_type" in
        "istio")
            service_mesh_apply_istio_config "$layer_name" "$namespace" "$mesh_config"
            ;;
        "linkerd")
            service_mesh_apply_linkerd_config "$layer_name" "$namespace" "$mesh_config"
            ;;
        "consul")
            service_mesh_apply_consul_config "$layer_name" "$namespace" "$mesh_config"
            ;;
        "kuma")
            service_mesh_apply_kuma_config "$layer_name" "$namespace" "$mesh_config"
            ;;
    esac
    
    log_success "Layer deployed with $mesh_type service mesh integration"
}

service_mesh_apply_istio_config() {
    local layer_name="$1"
    local namespace="$2"
    local mesh_config="$3"
    
    # Create VirtualService and DestinationRule
    cat << 'EOF' | kubectl apply -f -
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: ${layer_name}-virtualservice
  namespace: ${namespace}
spec:
  hosts:
  - ${layer_name}.${namespace}.svc.cluster.local
  http:
  - route:
    - destination:
        host: ${layer_name}-service
        port:
          number: 80
---
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: ${layer_name}-destinationrule
  namespace: ${namespace}
spec:
  host: ${layer_name}-service
  trafficPolicy:
    loadBalancer:
      simple: ROUND_ROBIN
EOF
}

service_mesh_apply_linkerd_config() {
    local layer_name="$1"
    local namespace="$2"
    local mesh_config="$3"
    
    # Inject Linkerd proxy
    kubectl get deployment "${layer_name}-deployment" -n "$namespace" -o yaml | \
        linkerd inject - | kubectl apply -f -
}

service_mesh_apply_consul_config() {
    local layer_name="$1"
    local namespace="$2"
    local mesh_config="$3"
    
    # Annotate deployment for Consul
    kubectl patch deployment "${layer_name}-deployment" -n "$namespace" -p '{"spec":{"template":{"metadata":{"annotations":{"consul.hashicorp.com/connect-inject":"true"}}}}}'
}

service_mesh_apply_kuma_config() {
    local layer_name="$1"
    local namespace="$2"
    local mesh_config="$3"
    
    # Create Kuma Mesh
    cat << 'EOF' | kubectl apply -f -
apiVersion: kuma.io/v1alpha1
kind: Mesh
metadata:
  name: ${layer_name}-mesh
spec:
  mtls:
    enabled: true
    ca:
      type: builtin
EOF
}

service_mesh_status() {
    local mesh_type="${1:-}"
    
    if [[ -n "$mesh_type" ]]; then
        log_info "Getting status for service mesh: $mesh_type"
        
        case "$mesh_type" in
            "istio")
                kubectl get pods -n istio-system
                kubectl get pods -n istio-ingress
                ;;
            "linkerd")
                linkerd check
                linkerd stat deployments
                ;;
            "consul")
                kubectl get pods -n consul-system
                ;;
            "kuma")
                kubectl get pods -n kuma-system
                ;;
        esac
    else
        log_info "Getting status for all service meshes"
        
        local config_file="${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json"
        local mesh_type=$(jq -r '.service_mesh.type' "$config_file")
        
        if [[ "$mesh_type" != "null" && "$mesh_type" != "" ]]; then
            echo "Active service mesh: $mesh_type"
            service_mesh_status "$mesh_type"
        else
            echo "No service mesh configured"
        fi
    fi
}

# GitOps workflow functions
gitops_init() {
    local repo_url="$1"
    local branch="${2:-main}"
    local path="${3:-}"
    
    if [[ -z "$repo_url" ]]; then
        log_error "Git repository URL required for GitOps initialization"
        return 1
    fi
    
    log_info "Initializing GitOps workflow with repository: $repo_url"
    
    # Check for git
    if ! command -v git &> /dev/null; then
        log_error "Git not found. Please install git for GitOps operations."
        return 1
    fi
    
    # Clone repository
    local repo_name=$(basename "$repo_url" .git)
    local repo_path="${PARTICLE_WORKSPACE}/orchestration/gitops/${repo_name}"
    
    if [[ -d "$repo_path" ]]; then
        log_warning "Repository already exists at $repo_path"
    else
        git clone "$repo_url" "$repo_path"
        cd "$repo_path"
        git checkout "$branch"
    fi
    
    # Update configuration
    local config_file="${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json"
    jq --arg repo "$repo_url" --arg branch "$branch" --arg path "$path" \
       '.gitops.enabled = true | .gitops.repositories[$repo] = {"branch": $branch, "path": $path, "status": "active"}' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    
    log_success "GitOps workflow initialized with repository: $repo_url"
}

gitops_sync() {
    local repo_url="${1:-}"
    
    if [[ -n "$repo_url" ]]; then
        log_info "Syncing GitOps repository: $repo_url"
        
        local repo_name=$(basename "$repo_url" .git)
        local repo_path="${PARTICLE_WORKSPACE}/orchestration/gitops/${repo_name}"
        
        if [[ ! -d "$repo_path" ]]; then
            log_error "Repository not found: $repo_path"
            return 1
        fi
        
        cd "$repo_path"
        git pull origin main
        
        # Apply manifests
        if [[ -d "manifests" ]]; then
            kubectl apply -f manifests/
        fi
        
        log_success "GitOps repository synced: $repo_url"
    else
        log_info "Syncing all GitOps repositories"
        
        local config_file="${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json"
        local repos=$(jq -r '.gitops.repositories | keys[]' "$config_file")
        
        for repo in $repos; do
            gitops_sync "$repo"
        done
    fi
}

gitops_deploy_layer() {
    local layer_name="$1"
    local repo_url="$2"
    local namespace="${3:-default}"
    
    if [[ -z "$layer_name" || -z "$repo_url" ]]; then
        log_error "Layer name and repository URL required for GitOps deployment"
        return 1
    fi
    
    log_info "Deploying layer $layer_name via GitOps to $repo_url"
    
    local repo_name=$(basename "$repo_url" .git)
    local repo_path="${PARTICLE_WORKSPACE}/orchestration/gitops/${repo_name}"
    
    if [[ ! -d "$repo_path" ]]; then
        log_error "Repository not found: $repo_path"
        return 1
    fi
    
    # Create deployment manifest
    local manifest_file="${repo_path}/manifests/${layer_name}-deployment.yaml"
    mkdir -p "$(dirname "$manifest_file")"
    
    cat > "$manifest_file" << EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: ${layer_name}-deployment
  namespace: ${namespace}
  labels:
    app: ${layer_name}
    layer: ${layer_name}
spec:
  replicas: 1
  selector:
    matchLabels:
      app: ${layer_name}
  template:
    metadata:
      labels:
        app: ${layer_name}
        layer: ${layer_name}
    spec:
      containers:
      - name: ${layer_name}
        image: ${layer_name}:latest
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: ${layer_name}-service
  namespace: ${namespace}
spec:
  selector:
    app: ${layer_name}
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80
  type: ClusterIP
EOF
    
    # Commit and push changes
    cd "$repo_path"
    git add "$manifest_file"
    git commit -m "Add deployment for layer: $layer_name"
    git push origin main
    
    log_success "Layer $layer_name deployed via GitOps"
}

gitops_status() {
    local repo_url="${1:-}"
    
    if [[ -n "$repo_url" ]]; then
        log_info "Getting GitOps status for repository: $repo_url"
        
        local repo_name=$(basename "$repo_url" .git)
        local repo_path="${PARTICLE_WORKSPACE}/orchestration/gitops/${repo_name}"
        
        if [[ ! -d "$repo_path" ]]; then
            log_error "Repository not found: $repo_path"
            return 1
        fi
        
        cd "$repo_path"
        echo "Repository: $repo_url"
        echo "Branch: $(git branch --show-current)"
        echo "Last commit: $(git log -1 --oneline)"
        echo "Status: $(git status --porcelain)"
    else
        log_info "Getting GitOps status for all repositories"
        
        local config_file="${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json"
        local repos=$(jq -r '.gitops.repositories | keys[]' "$config_file")
        
        for repo in $repos; do
            echo "---"
            gitops_status "$repo"
        done
    fi
}

# Advanced deployment patterns
deployment_pattern_init() {
    log_info "Initializing advanced deployment patterns..."
    
    # Create deployment patterns directory
    mkdir -p "${PARTICLE_WORKSPACE}/orchestration/deployments/patterns"
    
    # Initialize common deployment patterns
    deployment_pattern_create_blue_green
    deployment_pattern_create_canary
    deployment_pattern_create_rolling
    deployment_pattern_create_chaos
    
    log_success "Advanced deployment patterns initialized"
}

deployment_pattern_create_blue_green() {
    local pattern_file="${PARTICLE_WORKSPACE}/orchestration/deployments/patterns/blue-green.yaml"
    
    cat > "$pattern_file" << 'EOF'
# Blue-Green Deployment Pattern
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: blue-green-rollout
spec:
  replicas: 3
  strategy:
    blueGreen:
      activeService: blue-green-active
      previewService: blue-green-preview
      autoPromotionEnabled: false
      scaleDownDelaySeconds: 30
      prePromotionAnalysis:
        templates:
        - templateName: success-rate
        args:
        - name: service-name
          value: blue-green-active
      postPromotionAnalysis:
        templates:
        - templateName: success-rate
        args:
        - name: service-name
          value: blue-green-active
  selector:
    matchLabels:
      app: blue-green
  template:
    metadata:
      labels:
        app: blue-green
    spec:
      containers:
      - name: app
        image: nginx:latest
        ports:
        - containerPort: 80
EOF
}

deployment_pattern_create_canary() {
    local pattern_file="${PARTICLE_WORKSPACE}/orchestration/deployments/patterns/canary.yaml"
    
    cat > "$pattern_file" << 'EOF'
# Canary Deployment Pattern
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: canary-rollout
spec:
  replicas: 5
  strategy:
    canary:
      steps:
      - setWeight: 20
      - pause: {duration: 10s}
      - setWeight: 40
      - pause: {duration: 10s}
      - setWeight: 60
      - pause: {duration: 10s}
      - setWeight: 80
      - pause: {duration: 10s}
      analysis:
        templates:
        - templateName: success-rate
        args:
        - name: service-name
          value: canary-service
  selector:
    matchLabels:
      app: canary
  template:
    metadata:
      labels:
        app: canary
    spec:
      containers:
      - name: app
        image: nginx:latest
        ports:
        - containerPort: 80
EOF
}

deployment_pattern_create_rolling() {
    local pattern_file="${PARTICLE_WORKSPACE}/orchestration/deployments/patterns/rolling.yaml"
    
    cat > "$pattern_file" << 'EOF'
# Rolling Update Deployment Pattern
apiVersion: apps/v1
kind: Deployment
metadata:
  name: rolling-deployment
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 0
  selector:
    matchLabels:
      app: rolling
  template:
    metadata:
      labels:
        app: rolling
    spec:
      containers:
      - name: app
        image: nginx:latest
        ports:
        - containerPort: 80
EOF
}

deployment_pattern_create_chaos() {
    local pattern_file="${PARTICLE_WORKSPACE}/orchestration/deployments/patterns/chaos.yaml"
    
    cat > "$pattern_file" << 'EOF'
# Chaos Engineering Deployment Pattern
apiVersion: chaos-mesh.org/v1alpha1
kind: NetworkChaos
metadata:
  name: network-chaos
spec:
  action: delay
  mode: one
  selector:
    namespaces:
    - default
    labelSelectors:
      app: chaos-test
  delay:
    latency: 10ms
    correlation: 100
    jitter: 0ms
  duration: 30s
  scheduler:
    cron: "@every 2m"
EOF
}

deployment_pattern_apply() {
    local pattern_name="$1"
    local layer_name="$2"
    local namespace="${3:-default}"
    
    if [[ -z "$pattern_name" || -z "$layer_name" ]]; then
        log_error "Pattern name and layer name required"
        return 1
    fi
    
    log_info "Applying deployment pattern $pattern_name for layer $layer_name"
    
    local pattern_file="${PARTICLE_WORKSPACE}/orchestration/deployments/patterns/${pattern_name}.yaml"
    
    if [[ ! -f "$pattern_file" ]]; then
        log_error "Deployment pattern not found: $pattern_name"
        return 1
    fi
    
    # Apply the pattern
    kubectl apply -f "$pattern_file" -n "$namespace"
    
    log_success "Deployment pattern $pattern_name applied for layer $layer_name"
}

deployment_pattern_list() {
    log_info "Available deployment patterns:"
    
    local patterns_dir="${PARTICLE_WORKSPACE}/orchestration/deployments/patterns"
    
    if [[ -d "$patterns_dir" ]]; then
        for pattern in "$patterns_dir"/*.yaml; do
            if [[ -f "$pattern" ]]; then
                local pattern_name=$(basename "$pattern" .yaml)
                echo "  - $pattern_name"
            fi
        done
    else
        echo "  No patterns configured"
    fi
}

# Container orchestration status and management functions
orchestration_status() {
    local component="${1:-}"
    
    if [[ -z "$component" ]]; then
        log_info "Container orchestration system status:"
        echo
        orchestration_status_multi_cluster
        echo
        orchestration_status_service_mesh
        echo
        orchestration_status_gitops
        echo
        orchestration_status_deployments
        return 0
    fi
    
    case "$component" in
        "multi-cluster")
            orchestration_status_multi_cluster
            ;;
        "service-mesh")
            orchestration_status_service_mesh
            ;;
        "gitops")
            orchestration_status_gitops
            ;;
        "deployments")
            orchestration_status_deployments
            ;;
        *)
            log_error "Unknown orchestration component: $component"
            return 1
            ;;
    esac
}

orchestration_status_multi_cluster() {
    local config_file="${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json"
    local enabled=$(jq -r '.multi_cluster.enabled' "$config_file")
    
    echo "Multi-Cluster Management:"
    if [[ "$enabled" == "true" ]]; then
        echo "  Status: ${GREEN}Enabled${NC}"
        local clusters=$(jq -r '.multi_cluster.clusters | keys[]' "$config_file")
        if [[ -n "$clusters" ]]; then
            echo "  Clusters:"
            echo "$clusters" | while read -r cluster; do
                echo "    - $cluster"
            done
        fi
    else
        echo "  Status: ${RED}Disabled${NC}"
    fi
}

orchestration_status_service_mesh() {
    local config_file="${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json"
    local enabled=$(jq -r '.service_mesh.enabled' "$config_file")
    
    echo "Service Mesh:"
    if [[ "$enabled" == "true" ]]; then
        echo "  Status: ${GREEN}Enabled${NC}"
        local mesh_type=$(jq -r '.service_mesh.type' "$config_file")
        echo "  Type: $mesh_type"
    else
        echo "  Status: ${RED}Disabled${NC}"
    fi
}

orchestration_status_gitops() {
    local config_file="${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json"
    local enabled=$(jq -r '.gitops.enabled' "$config_file")
    
    echo "GitOps Workflows:"
    if [[ "$enabled" == "true" ]]; then
        echo "  Status: ${GREEN}Enabled${NC}"
        local repos=$(jq -r '.gitops.repositories | keys[]' "$config_file")
        if [[ -n "$repos" ]]; then
            echo "  Repositories:"
            echo "$repos" | while read -r repo; do
                echo "    - $repo"
            done
        fi
    else
        echo "  Status: ${RED}Disabled${NC}"
    fi
}

orchestration_status_deployments() {
    echo "Deployment Patterns:"
    local patterns_dir="${PARTICLE_WORKSPACE}/orchestration/deployments/patterns"
    
    if [[ -d "$patterns_dir" ]]; then
        local pattern_count=0
        for pattern in "$patterns_dir"/*.yaml; do
            if [[ -f "$pattern" ]]; then
                pattern_count=$((pattern_count + 1))
            fi
        done
        echo "  Available patterns: $pattern_count"
    else
        echo "  No patterns configured"
    fi
}

orchestration_cleanup() {
    local component="$1"
    local resource="$2"
    
    log_info "Cleaning up orchestration resources"
    
    case "$component" in
        "multi-cluster")
            if [[ -n "$resource" ]]; then
                log_info "Removing cluster: $resource"
                local config_file="${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json"
                jq --arg cluster "$resource" 'del(.multi_cluster.clusters[$cluster])' \
                   "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
            else
                log_info "Removing all clusters"
                local config_file="${PARTICLE_WORKSPACE}/orchestration/orchestration-config.json"
                jq '.multi_cluster.clusters = {}' "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
            fi
            ;;
        "service-mesh")
            if [[ -n "$resource" ]]; then
                log_info "Removing service mesh: $resource"
                case "$resource" in
                    "istio")
                        helm uninstall istio-ingress -n istio-ingress
                        helm uninstall istiod -n istio-system
                        helm uninstall istio-base -n istio-system
                        ;;
                    "linkerd")
                        linkerd uninstall
                        ;;
                    "consul")
                        helm uninstall consul -n consul-system
                        ;;
                    "kuma")
                        kubectl delete -f https://docs.konghq.com/install/kubernetes/kuma/kuma.yaml
                        ;;
                esac
            fi
            ;;
        "gitops")
            if [[ -n "$resource" ]]; then
                log_info "Removing GitOps repository: $resource"
                local repo_name=$(basename "$resource" .git)
                local repo_path="${PARTICLE_WORKSPACE}/orchestration/gitops/${repo_name}"
                rm -rf "$repo_path"
            else
                log_info "Removing all GitOps repositories"
                rm -rf "${PARTICLE_WORKSPACE}/orchestration/gitops"/*
            fi
            ;;
        *)
            log_error "Unknown orchestration component: $component"
            return 1
            ;;
    esac
    
    log_success "Orchestration cleanup completed"
} 

# --- END OF SCRIPTLET: 21-container-orchestration.sh ---

# ============================================================================
# Multi-Cloud Deployment (AWS, Azure, GCP, Migration, Policies)
# ============================================================================
# Multi-Cloud Deployment Scriptlet for apt-layer
# Provides unified multi-cloud deployment, migration, and management

# === Initialization ===
multicloud_init() {
    log_info "Initializing multi-cloud deployment system..."
    mkdir -p "${PARTICLE_WORKSPACE}/multicloud"
    mkdir -p "${PARTICLE_WORKSPACE}/multicloud/profiles"
    mkdir -p "${PARTICLE_WORKSPACE}/multicloud/deployments"
    mkdir -p "${PARTICLE_WORKSPACE}/multicloud/migrations"
    mkdir -p "${PARTICLE_WORKSPACE}/multicloud/logs"
    # Create config if missing
    if [[ ! -f "${PARTICLE_WORKSPACE}/multicloud/multicloud-config.json" ]]; then
        cat > "${PARTICLE_WORKSPACE}/multicloud/multicloud-config.json" << 'EOF'
{
  "profiles": {},
  "deployments": {},
  "migrations": {},
  "policies": {},
  "last_updated": ""
}
EOF
    fi
    log_success "Multi-cloud deployment system initialized"
}

# === Cloud Profile Management ===
multicloud_add_profile() {
    local provider="$1"
    local profile_name="$2"
    local credentials_file="$3"
    if [[ -z "$provider" || -z "$profile_name" || -z "$credentials_file" ]]; then
        log_error "Provider, profile name, and credentials file required"
        return 1
    fi
    log_info "Adding multi-cloud profile: $profile_name ($provider)"
    local config_file="${PARTICLE_WORKSPACE}/multicloud/multicloud-config.json"
    jq --arg provider "$provider" --arg name "$profile_name" --arg creds "$credentials_file" \
       '.profiles[$name] = {"provider": $provider, "credentials": $creds, "created": now}' \
       "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file"
    log_success "Profile $profile_name added"
}

multicloud_list_profiles() {
    local config_file="${PARTICLE_WORKSPACE}/multicloud/multicloud-config.json"
    jq '.profiles' "$config_file"
}

# === Unified Multi-Cloud Deployment ===
multicloud_deploy() {
    local layer_name="$1"
    local provider="$2"
    local profile_name="$3"
    local region="$4"
    local options="$5"
    if [[ -z "$layer_name" || -z "$provider" ]]; then
        log_error "Layer name and provider required for multi-cloud deployment"
        return 1
    fi
    log_info "Deploying $layer_name to $provider (profile: $profile_name, region: $region)"
    case "$provider" in
        aws)
            multicloud_deploy_aws "$layer_name" "$profile_name" "$region" "$options"
            ;;
        azure)
            multicloud_deploy_azure "$layer_name" "$profile_name" "$region" "$options"
            ;;
        gcp)
            multicloud_deploy_gcp "$layer_name" "$profile_name" "$region" "$options"
            ;;
        *)
            log_error "Unsupported provider: $provider"
            return 1
            ;;
    esac
}

multicloud_deploy_aws() {
    local layer_name="$1"; local profile="$2"; local region="$3"; local options="$4"
    log_info "[AWS] Deploying $layer_name (profile: $profile, region: $region)"
    # TODO: Implement AWS deployment logic
    log_success "[AWS] Deployment stub complete"
}

multicloud_deploy_azure() {
    local layer_name="$1"; local profile="$2"; local region="$3"; local options="$4"
    log_info "[Azure] Deploying $layer_name (profile: $profile, region: $region)"
    # TODO: Implement Azure deployment logic
    log_success "[Azure] Deployment stub complete"
}

multicloud_deploy_gcp() {
    local layer_name="$1"; local profile="$2"; local region="$3"; local options="$4"
    log_info "[GCP] Deploying $layer_name (profile: $profile, region: $region)"
    # TODO: Implement GCP deployment logic
    log_success "[GCP] Deployment stub complete"
}

# === Cross-Cloud Migration ===
multicloud_migrate() {
    local layer_name="$1"
    local from_provider="$2"
    local to_provider="$3"
    local options="$4"
    if [[ -z "$layer_name" || -z "$from_provider" || -z "$to_provider" ]]; then
        log_error "Layer, from_provider, and to_provider required for migration"
        return 1
    fi
    log_info "Migrating $layer_name from $from_provider to $to_provider"
    # TODO: Implement migration logic (export, transfer, import)
    log_success "Migration stub complete"
}

# === Multi-Cloud Status and Reporting ===
multicloud_status() {
    local config_file="${PARTICLE_WORKSPACE}/multicloud/multicloud-config.json"
    echo "Multi-Cloud Profiles:"
    jq -r '.profiles | to_entries[] | "  - \(.key): \(.value.provider)"' "$config_file"
    echo
    echo "Deployments:"
    jq -r '.deployments | to_entries[] | "  - \(.key): \(.value.provider) (status: \(.value.status))"' "$config_file"
    echo
    echo "Migrations:"
    jq -r '.migrations | to_entries[] | "  - \(.key): \(.value.from) -> \(.value.to) (status: \(.value.status))"' "$config_file"
}

# === Policy-Driven Placement (Stub) ===
multicloud_policy_apply() {
    local policy_name="$1"
    local layer_name="$2"
    log_info "Applying policy $policy_name to $layer_name"
    # TODO: Implement policy-driven placement logic
    log_success "Policy application stub complete"
} 

# --- END OF SCRIPTLET: 22-multicloud-deployment.sh ---

# ============================================================================
# Cloud-Native Security (Workload Scanning, Policy Enforcement, Compliance)
# ============================================================================
# Cloud-Native Security Features for apt-layer
# Provides cloud workload security scanning, cloud provider security service integration,
# policy enforcement, and automated vulnerability detection for cloud deployments.

# ============================================================================
# CLOUD-NATIVE SECURITY FUNCTIONS
# ============================================================================

# Initialize cloud security system
cloud_security_init() {
    log_info "Initializing cloud security system..." "apt-layer"
    
    # Create cloud security directories
    local cloud_security_dir="${PARTICLE_WORKSPACE:-/var/lib/particle-os}/cloud-security"
    mkdir -p "$cloud_security_dir"/{scans,policies,reports,integrations}
    
    # Create cloud security configuration
    local config_file="$cloud_security_dir/cloud-security-config.json"
    if [[ ! -f "$config_file" ]]; then
        cat > "$config_file" << 'EOF'
{
  "enabled_providers": ["aws", "azure", "gcp"],
  "scan_settings": {
    "container_scanning": true,
    "image_scanning": true,
    "layer_scanning": true,
    "infrastructure_scanning": true,
    "compliance_scanning": true
  },
  "policy_enforcement": {
    "iam_policies": true,
    "network_policies": true,
    "compliance_policies": true,
    "auto_remediation": false
  },
  "integrations": {
    "aws_inspector": false,
    "azure_defender": false,
    "gcp_security_center": false,
    "third_party_scanners": []
  },
  "reporting": {
    "html_reports": true,
    "json_reports": true,
    "email_alerts": false,
    "webhook_alerts": false
  },
  "retention": {
    "scan_reports_days": 30,
    "policy_violations_days": 90,
    "security_events_days": 365
  }
}
EOF
        log_info "Created cloud security configuration: $config_file" "apt-layer"
    fi
    
    # Create policy templates
    local policies_dir="$cloud_security_dir/policies"
    mkdir -p "$policies_dir"
    
    # IAM Policy Template
    cat > "$policies_dir/iam-policy-template.json" << 'EOF'
{
  "name": "default-iam-policy",
  "description": "Default IAM policy for apt-layer deployments",
  "rules": [
    {
      "name": "least-privilege",
      "description": "Enforce least privilege access",
      "severity": "high",
      "enabled": true
    },
    {
      "name": "no-root-access",
      "description": "Prevent root access to resources",
      "severity": "critical",
      "enabled": true
    },
    {
      "name": "mfa-required",
      "description": "Require multi-factor authentication",
      "severity": "high",
      "enabled": true
    }
  ]
}
EOF
    
    # Network Policy Template
    cat > "$policies_dir/network-policy-template.json" << 'EOF'
{
  "name": "default-network-policy",
  "description": "Default network policy for apt-layer deployments",
  "rules": [
    {
      "name": "secure-ports-only",
      "description": "Allow only secure ports (22, 80, 443, 8080)",
      "severity": "medium",
      "enabled": true
    },
    {
      "name": "no-public-access",
      "description": "Prevent public access to sensitive resources",
      "severity": "high",
      "enabled": true
    },
    {
      "name": "vpc-isolation",
      "description": "Enforce VPC isolation",
      "severity": "medium",
      "enabled": true
    }
  ]
}
EOF
    
    # Compliance Policy Template
    cat > "$policies_dir/compliance-policy-template.json" << 'EOF'
{
  "name": "default-compliance-policy",
  "description": "Default compliance policy for apt-layer deployments",
  "frameworks": {
    "sox": {
      "enabled": true,
      "controls": ["access-control", "audit-logging", "data-protection"]
    },
    "pci-dss": {
      "enabled": true,
      "controls": ["network-security", "access-control", "vulnerability-management"]
    },
    "hipaa": {
      "enabled": false,
      "controls": ["privacy", "security", "breach-notification"]
    }
  }
}
EOF
    
    log_info "Cloud security system initialized successfully" "apt-layer"
    log_info "Configuration: $config_file" "apt-layer"
    log_info "Policies: $policies_dir" "apt-layer"
}

# Scan cloud workload for security vulnerabilities
cloud_security_scan_workload() {
    local layer_name="$1"
    local provider="$2"
    local scan_type="${3:-comprehensive}"
    
    log_info "Starting cloud security scan for layer: $layer_name (Provider: $provider, Type: $scan_type)" "apt-layer"
    
    local cloud_security_dir="${PARTICLE_WORKSPACE:-/var/lib/particle-os}/cloud-security"
    local scan_dir="$cloud_security_dir/scans"
    local timestamp=$(date +%Y%m%d_%H%M%S)
    local scan_id="${layer_name//\//_}_${provider}_${timestamp}"
    local scan_file="$scan_dir/${scan_id}.json"
    
    # Create scan result structure
    local scan_result=$(cat << 'EOF'
{
  "scan_id": "$scan_id",
  "layer_name": "$layer_name",
  "provider": "$provider",
  "scan_type": "$scan_type",
  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "status": "running",
  "findings": [],
  "summary": {
    "total_findings": 0,
    "critical": 0,
    "high": 0,
    "medium": 0,
    "low": 0,
    "info": 0
  }
}
EOF
)
    
    echo "$scan_result" > "$scan_file"
    
    case "$scan_type" in
        "container")
            cloud_security_scan_container "$layer_name" "$provider" "$scan_file"
            ;;
        "image")
            cloud_security_scan_image "$layer_name" "$provider" "$scan_file"
            ;;
        "infrastructure")
            cloud_security_scan_infrastructure "$layer_name" "$provider" "$scan_file"
            ;;
        "compliance")
            cloud_security_scan_compliance "$layer_name" "$provider" "$scan_file"
            ;;
        "comprehensive")
            cloud_security_scan_container "$layer_name" "$provider" "$scan_file"
            cloud_security_scan_image "$layer_name" "$provider" "$scan_file"
            cloud_security_scan_infrastructure "$layer_name" "$provider" "$scan_file"
            cloud_security_scan_compliance "$layer_name" "$provider" "$scan_file"
            ;;
        *)
            log_error "Invalid scan type: $scan_type" "apt-layer"
            return 1
            ;;
    esac
    
    # Update scan status to completed
    jq '.status = "completed"' "$scan_file" > "${scan_file}.tmp" && mv "${scan_file}.tmp" "$scan_file"
    
    # Generate summary
    local total_findings=$(jq '.findings | length' "$scan_file")
    local critical=$(jq '.findings | map(select(.severity == "critical")) | length' "$scan_file")
    local high=$(jq '.findings | map(select(.severity == "high")) | length' "$scan_file")
    local medium=$(jq '.findings | map(select(.severity == "medium")) | length' "$scan_file")
    local low=$(jq '.findings | map(select(.severity == "low")) | length' "$scan_file")
    local info=$(jq '.findings | map(select(.severity == "info")) | length' "$scan_file")
    
    jq --arg total "$total_findings" \
       --arg critical "$critical" \
       --arg high "$high" \
       --arg medium "$medium" \
       --arg low "$low" \
       --arg info "$info" \
       '.summary.total_findings = ($total | tonumber) |
        .summary.critical = ($critical | tonumber) |
        .summary.high = ($high | tonumber) |
        .summary.medium = ($medium | tonumber) |
        .summary.low = ($low | tonumber) |
        .summary.info = ($info | tonumber)' "$scan_file" > "${scan_file}.tmp" && mv "${scan_file}.tmp" "$scan_file"
    
    log_info "Cloud security scan completed: $scan_file" "apt-layer"
    log_info "Findings: $total_findings total ($critical critical, $high high, $medium medium, $low low, $info info)" "apt-layer"
    
    # Generate HTML report
    cloud_security_generate_report "$scan_file" "html"
    
    echo "$scan_file"
}

# Scan container security
cloud_security_scan_container() {
    local layer_name="$1"
    local provider="$2"
    local scan_file="$3"
    
    log_info "Scanning container security for layer: $layer_name" "apt-layer"
    
    # Simulate container security findings
    local findings=(
        '{"id": "CONTAINER-001", "title": "Container running as root", "description": "Container is configured to run as root user", "severity": "high", "category": "privilege-escalation", "remediation": "Use non-root user in container"}'
        '{"id": "CONTAINER-002", "title": "Missing security context", "description": "Container lacks proper security context configuration", "severity": "medium", "category": "configuration", "remediation": "Configure security context with appropriate settings"}'
        '{"id": "CONTAINER-003", "title": "Unnecessary capabilities", "description": "Container has unnecessary Linux capabilities enabled", "severity": "medium", "category": "privilege-escalation", "remediation": "Drop unnecessary capabilities"}'
    )
    
    for finding in "${findings[@]}"; do
        jq --argjson finding "$finding" '.findings += [$finding]' "$scan_file" > "${scan_file}.tmp" && mv "${scan_file}.tmp" "$scan_file"
    done
}

# Scan image security
cloud_security_scan_image() {
    local layer_name="$1"
    local provider="$2"
    local scan_file="$3"
    
    log_info "Scanning image security for layer: $layer_name" "apt-layer"
    
    # Simulate image security findings
    local findings=(
        '{"id": "IMAGE-001", "title": "Vulnerable base image", "description": "Base image contains known vulnerabilities", "severity": "critical", "category": "vulnerability", "remediation": "Update to latest base image version"}'
        '{"id": "IMAGE-002", "title": "Sensitive data in image", "description": "Image contains sensitive data or secrets", "severity": "high", "category": "data-exposure", "remediation": "Remove sensitive data and use secrets management"}'
        '{"id": "IMAGE-003", "title": "Large image size", "description": "Image size exceeds recommended limits", "severity": "low", "category": "performance", "remediation": "Optimize image layers and remove unnecessary files"}'
    )
    
    for finding in "${findings[@]}"; do
        jq --argjson finding "$finding" '.findings += [$finding]' "$scan_file" > "${scan_file}.tmp" && mv "${scan_file}.tmp" "$scan_file"
    done
}

# Scan infrastructure security
cloud_security_scan_infrastructure() {
    local layer_name="$1"
    local provider="$2"
    local scan_file="$3"
    
    log_info "Scanning infrastructure security for layer: $layer_name" "apt-layer"
    
    # Simulate infrastructure security findings
    local findings=(
        '{"id": "INFRA-001", "title": "Public access enabled", "description": "Resource is publicly accessible", "severity": "high", "category": "network-security", "remediation": "Restrict access to private networks only"}'
        '{"id": "INFRA-002", "title": "Weak IAM policies", "description": "IAM policies are too permissive", "severity": "high", "category": "access-control", "remediation": "Apply principle of least privilege"}'
        '{"id": "INFRA-003", "title": "Missing encryption", "description": "Data is not encrypted at rest", "severity": "medium", "category": "data-protection", "remediation": "Enable encryption for all data storage"}'
    )
    
    for finding in "${findings[@]}"; do
        jq --argjson finding "$finding" '.findings += [$finding]' "$scan_file" > "${scan_file}.tmp" && mv "${scan_file}.tmp" "$scan_file"
    done
}

# Scan compliance
cloud_security_scan_compliance() {
    local layer_name="$1"
    local provider="$2"
    local scan_file="$3"
    
    log_info "Scanning compliance for layer: $layer_name" "apt-layer"
    
    # Simulate compliance findings
    local findings=(
        '{"id": "COMPLIANCE-001", "title": "SOX Control Failure", "description": "Access control logging not properly configured", "severity": "high", "category": "sox", "remediation": "Enable comprehensive access logging"}'
        '{"id": "COMPLIANCE-002", "title": "PCI-DSS Violation", "description": "Cardholder data not properly encrypted", "severity": "critical", "category": "pci-dss", "remediation": "Implement encryption for all cardholder data"}'
        '{"id": "COMPLIANCE-003", "title": "GDPR Compliance Issue", "description": "Data retention policy not defined", "severity": "medium", "category": "gdpr", "remediation": "Define and implement data retention policies"}'
    )
    
    for finding in "${findings[@]}"; do
        jq --argjson finding "$finding" '.findings += [$finding]' "$scan_file" > "${scan_file}.tmp" && mv "${scan_file}.tmp" "$scan_file"
    done
}

# Check policy compliance
cloud_security_check_policy() {
    local layer_name="$1"
    local policy_name="$2"
    local provider="$3"
    
    log_info "Checking policy compliance for layer: $layer_name (Policy: $policy_name, Provider: $provider)" "apt-layer"
    
    local cloud_security_dir="${PARTICLE_WORKSPACE:-/var/lib/particle-os}/cloud-security"
    local policies_dir="$cloud_security_dir/policies"
    local policy_file="$policies_dir/${policy_name}.json"
    
    if [[ ! -f "$policy_file" ]]; then
        log_error "Policy file not found: $policy_file" "apt-layer"
        return 1
    fi
    
    local timestamp=$(date +%Y%m%d_%H%M%S)
    local check_id="${layer_name//\//_}_${policy_name}_${timestamp}"
    local check_file="$cloud_security_dir/reports/${check_id}.json"
    
    # Create policy check result
    local check_result=$(cat << 'EOF'
{
  "check_id": "$check_id",
  "layer_name": "$layer_name",
  "policy_name": "$policy_name",
  "provider": "$provider",
  "timestamp": "$(date -u +%Y-%m-%dT%H:%M:%SZ)",
  "status": "completed",
  "compliance": true,
  "violations": [],
  "summary": {
    "total_rules": 0,
    "passed": 0,
    "failed": 0,
    "warnings": 0
  }
}
EOF
)
    
    echo "$check_result" > "$check_file"
    
    # Simulate policy violations
    local violations=(
        '{"rule": "least-privilege", "description": "IAM policy too permissive", "severity": "high", "remediation": "Restrict IAM permissions"}'
        '{"rule": "network-isolation", "description": "Public access not restricted", "severity": "medium", "remediation": "Configure private network access"}'
    )
    
    local total_rules=5
    local passed=3
    local failed=2
    local warnings=0
    
    for violation in "${violations[@]}"; do
        jq --argjson violation "$violation" '.violations += [$violation]' "$check_file" > "${check_file}.tmp" && mv "${check_file}.tmp" "$check_file"
    done
    
    # Update compliance status
    if [[ $failed -gt 0 ]]; then
        jq '.compliance = false' "$check_file" > "${check_file}.tmp" && mv "${check_file}.tmp" "$check_file"
    fi
    
    # Update summary
    jq --arg total "$total_rules" \
       --arg passed "$passed" \
       --arg failed "$failed" \
       --arg warnings "$warnings" \
       '.summary.total_rules = ($total | tonumber) |
        .summary.passed = ($passed | tonumber) |
        .summary.failed = ($failed | tonumber) |
        .summary.warnings = ($warnings | tonumber)' "$check_file" > "${check_file}.tmp" && mv "${check_file}.tmp" "$check_file"
    
    log_info "Policy compliance check completed: $check_file" "apt-layer"
    log_info "Compliance: $([[ $failed -eq 0 ]] && echo "PASSED" || echo "FAILED") ($passed/$total_rules rules passed)" "apt-layer"
    
    # Generate HTML report
    cloud_security_generate_policy_report "$check_file" "html"
    
    echo "$check_file"
}

# Generate security report
cloud_security_generate_report() {
    local scan_file="$1"
    local format="${2:-html}"
    
    if [[ ! -f "$scan_file" ]]; then
        log_error "Scan file not found: $scan_file" "apt-layer"
        return 1
    fi
    
    local cloud_security_dir="${PARTICLE_WORKSPACE:-/var/lib/particle-os}/cloud-security"
    local reports_dir="$cloud_security_dir/reports"
    local scan_data=$(cat "$scan_file")
    
    case "$format" in
        "html")
            local report_file="${scan_file%.json}.html"
            cloud_security_generate_html_report "$scan_data" "$report_file"
            log_info "HTML report generated: $report_file" "apt-layer"
            ;;
        "json")
            # JSON report is already the scan file
            log_info "JSON report available: $scan_file" "apt-layer"
            ;;
        *)
            log_error "Unsupported report format: $format" "apt-layer"
            return 1
            ;;
    esac
}

# Generate HTML security report
cloud_security_generate_html_report() {
    local scan_data="$1"
    local report_file="$2"
    
    local layer_name=$(echo "$scan_data" | jq -r '.layer_name')
    local provider=$(echo "$scan_data" | jq -r '.provider')
    local timestamp=$(echo "$scan_data" | jq -r '.timestamp')
    local total_findings=$(echo "$scan_data" | jq -r '.summary.total_findings')
    local critical=$(echo "$scan_data" | jq -r '.summary.critical')
    local high=$(echo "$scan_data" | jq -r '.summary.high')
    local medium=$(echo "$scan_data" | jq -r '.summary.medium')
    local low=$(echo "$scan_data" | jq -r '.summary.low')
    
    cat > "$report_file" << EOF
<!DOCTYPE html>
<html>
<head>
    <title>Cloud Security Scan Report - $layer_name</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; }
        .header { background-color: #f0f0f0; padding: 20px; border-radius: 5px; }
        .summary { margin: 20px 0; }
        .finding { margin: 10px 0; padding: 10px; border-left: 4px solid #ccc; }
        .critical { border-left-color: #ff0000; background-color: #ffe6e6; }
        .high { border-left-color: #ff6600; background-color: #fff2e6; }
        .medium { border-left-color: #ffcc00; background-color: #fffbf0; }
        .low { border-left-color: #00cc00; background-color: #f0fff0; }
        .info { border-left-color: #0066cc; background-color: #f0f8ff; }
    </style>
</head>
<body>
    <div class="header">
        <h1>Cloud Security Scan Report</h1>
        <p><strong>Layer:</strong> $layer_name</p>
        <p><strong>Provider:</strong> $provider</p>
        <p><strong>Scan Time:</strong> $timestamp</p>
    </div>
    
    <div class="summary">
        <h2>Summary</h2>
        <p><strong>Total Findings:</strong> $total_findings</p>
        <p><strong>Critical:</strong> $critical | <strong>High:</strong> $high | <strong>Medium:</strong> $medium | <strong>Low:</strong> $low</p>
    </div>
    
    <div class="findings">
        <h2>Findings</h2>
EOF
    
    # Add findings
    echo "$scan_data" | jq -r '.findings[] | "        <div class=\"finding \(.severity)\">" +
        "<h3>\(.title)</h3>" +
        "<p><strong>ID:</strong> \(.id)</p>" +
        "<p><strong>Severity:</strong> \(.severity)</p>" +
        "<p><strong>Category:</strong> \(.category)</p>" +
        "<p><strong>Description:</strong> \(.description)</p>" +
        "<p><strong>Remediation:</strong> \(.remediation)</p>" +
        "</div>"' >> "$report_file"
    
    cat >> "$report_file" << EOF
    </div>
</body>
</html>
EOF
}

# Generate policy compliance report
cloud_security_generate_policy_report() {
    local check_file="$1"
    local format="${2:-html}"
    
    if [[ ! -f "$check_file" ]]; then
        log_error "Policy check file not found: $check_file" "apt-layer"
        return 1
    fi
    
    case "$format" in
        "html")
            local report_file="${check_file%.json}.html"
            local check_data=$(cat "$check_file")
            cloud_security_generate_policy_html_report "$check_data" "$report_file"
            log_info "Policy HTML report generated: $report_file" "apt-layer"
            ;;
        "json")
            log_info "Policy JSON report available: $check_file" "apt-layer"
            ;;
        *)
            log_error "Unsupported report format: $format" "apt-layer"
            return 1
            ;;
    esac
}

# Generate HTML policy report
cloud_security_generate_policy_html_report() {
    local check_data="$1"
    local report_file="$2"
    
    local layer_name=$(echo "$check_data" | jq -r '.layer_name')
    local policy_name=$(echo "$check_data" | jq -r '.policy_name')
    local provider=$(echo "$check_data" | jq -r '.provider')
    local timestamp=$(echo "$check_data" | jq -r '.timestamp')
    local compliance=$(echo "$check_data" | jq -r '.compliance')
    local total_rules=$(echo "$check_data" | jq -r '.summary.total_rules')
    local passed=$(echo "$check_data" | jq -r '.summary.passed')
    local failed=$(echo "$check_data" | jq -r '.summary.failed')
    
    cat > "$report_file" << EOF
<!DOCTYPE html>
<html>
<head>
    <title>Policy Compliance Report - $layer_name</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; }
        .header { background-color: #f0f0f0; padding: 20px; border-radius: 5px; }
        .summary { margin: 20px 0; }
        .violation { margin: 10px 0; padding: 10px; border-left: 4px solid #ff0000; background-color: #ffe6e6; }
        .compliant { color: green; }
        .non-compliant { color: red; }
    </style>
</head>
<body>
    <div class="header">
        <h1>Policy Compliance Report</h1>
        <p><strong>Layer:</strong> $layer_name</p>
        <p><strong>Policy:</strong> $policy_name</p>
        <p><strong>Provider:</strong> $provider</p>
        <p><strong>Check Time:</strong> $timestamp</p>
    </div>
    
    <div class="summary">
        <h2>Compliance Summary</h2>
        <p><strong>Status:</strong> <span class="$(if [[ "$compliance" == "true" ]]; then echo "compliant"; else echo "non-compliant"; fi)">$(if [[ "$compliance" == "true" ]]; then echo "COMPLIANT"; else echo "NON-COMPLIANT"; fi)</span></p>
        <p><strong>Rules:</strong> $passed/$total_rules passed ($failed failed)</p>
    </div>
    
    <div class="violations">
        <h2>Policy Violations</h2>
EOF
    
    # Add violations
    echo "$check_data" | jq -r '.violations[] | "        <div class=\"violation\">" +
        "<h3>\(.rule)</h3>" +
        "<p><strong>Severity:</strong> \(.severity)</p>" +
        "<p><strong>Description:</strong> \(.description)</p>" +
        "<p><strong>Remediation:</strong> \(.remediation)</p>" +
        "</div>"' >> "$report_file"
    
    cat >> "$report_file" << EOF
    </div>
</body>
</html>
EOF
}

# List security scans
cloud_security_list_scans() {
    local cloud_security_dir="${PARTICLE_WORKSPACE:-/var/lib/particle-os}/cloud-security"
    local scans_dir="$cloud_security_dir/scans"
    
    if [[ ! -d "$scans_dir" ]]; then
        log_info "No security scans found" "apt-layer"
        return 0
    fi
    
    log_info "Security scans:" "apt-layer"
    for scan_file in "$scans_dir"/*.json; do
        if [[ -f "$scan_file" ]]; then
            local scan_data=$(cat "$scan_file")
            local scan_id=$(echo "$scan_data" | jq -r '.scan_id')
            local layer_name=$(echo "$scan_data" | jq -r '.layer_name')
            local provider=$(echo "$scan_data" | jq -r '.provider')
            local timestamp=$(echo "$scan_data" | jq -r '.timestamp')
            local total_findings=$(echo "$scan_data" | jq -r '.summary.total_findings')
            local critical=$(echo "$scan_data" | jq -r '.summary.critical')
            
            echo "  $scan_id: $layer_name ($provider) - $total_findings findings ($critical critical) - $timestamp"
        fi
    done
}

# List policy checks
cloud_security_list_policy_checks() {
    local cloud_security_dir="${PARTICLE_WORKSPACE:-/var/lib/particle-os}/cloud-security"
    local reports_dir="$cloud_security_dir/reports"
    
    if [[ ! -d "$reports_dir" ]]; then
        log_info "No policy checks found" "apt-layer"
        return 0
    fi
    
    log_info "Policy compliance checks:" "apt-layer"
    for check_file in "$reports_dir"/*.json; do
        if [[ -f "$check_file" ]]; then
            local check_data=$(cat "$check_file")
            local check_id=$(echo "$check_data" | jq -r '.check_id')
            local layer_name=$(echo "$check_data" | jq -r '.layer_name')
            local policy_name=$(echo "$check_data" | jq -r '.policy_name')
            local compliance=$(echo "$check_data" | jq -r '.compliance')
            local timestamp=$(echo "$check_data" | jq -r '.timestamp')
            
            echo "  $check_id: $layer_name ($policy_name) - $(if [[ "$compliance" == "true" ]]; then echo "COMPLIANT"; else echo "NON-COMPLIANT"; fi) - $timestamp"
        fi
    done
}

# Clean up old security reports
cloud_security_cleanup() {
    local days="${1:-30}"
    local cloud_security_dir="${PARTICLE_WORKSPACE:-/var/lib/particle-os}/cloud-security"
    local scans_dir="$cloud_security_dir/scans"
    local reports_dir="$cloud_security_dir/reports"
    
    log_info "Cleaning up security reports older than $days days..." "apt-layer"
    
    local deleted_scans=0
    local deleted_reports=0
    
    # Clean up scan files
    if [[ -d "$scans_dir" ]]; then
        while IFS= read -r -d '' file; do
            if [[ -f "$file" ]]; then
                rm "$file"
                ((deleted_scans++))
            fi
        done < <(find "$scans_dir" -name "*.json" -mtime +$days -print0)
    fi
    
    # Clean up report files
    if [[ -d "$reports_dir" ]]; then
        while IFS= read -r -d '' file; do
            if [[ -f "$file" ]]; then
                rm "$file"
                ((deleted_reports++))
            fi
        done < <(find "$reports_dir" -name "*.json" -mtime +$days -print0)
    fi
    
    log_info "Cleanup completed: $deleted_scans scan files, $deleted_reports report files deleted" "apt-layer"
}

# Show cloud security status
cloud_security_status() {
    local cloud_security_dir="${PARTICLE_WORKSPACE:-/var/lib/particle-os}/cloud-security"
    
    log_info "Cloud Security System Status" "apt-layer"
    echo "=================================="
    
    # Check if system is initialized
    if [[ -d "$cloud_security_dir" ]]; then
        echo "â System initialized: $cloud_security_dir"
        
        # Check configuration
        local config_file="$cloud_security_dir/cloud-security-config.json"
        if [[ -f "$config_file" ]]; then
            echo "â Configuration: $config_file"
            local enabled_providers=$(jq -r '.enabled_providers[]' "$config_file" 2>/dev/null | tr '\n' ', ' | sed 's/,$//')
            echo "   Enabled providers: $enabled_providers"
        else
            echo "â Configuration missing"
        fi
        
        # Check directories
        local dirs=("scans" "policies" "reports" "integrations")
        for dir in "${dirs[@]}"; do
            if [[ -d "$cloud_security_dir/$dir" ]]; then
                echo "â $dir directory: $cloud_security_dir/$dir"
            else
                echo "â $dir directory missing"
            fi
        done
        
        # Count files
        local scan_count=$(find "$cloud_security_dir/scans" -name "*.json" 2>/dev/null | wc -l)
        local policy_count=$(find "$cloud_security_dir/policies" -name "*.json" 2>/dev/null | wc -l)
        local report_count=$(find "$cloud_security_dir/reports" -name "*.json" 2>/dev/null | wc -l)
        
        echo "ð Statistics:"
        echo "   Security scans: $scan_count"
        echo "   Policy files: $policy_count"
        echo "   Compliance reports: $report_count"
        
    else
        echo "â System not initialized"
        echo "   Run 'cloud-security init' to initialize"
    fi
} 

# --- END OF SCRIPTLET: 23-cloud-security.sh ---

# ============================================================================
# Direct dpkg Installation (Performance Optimization)
# ============================================================================
# Direct dpkg installation for Particle-OS apt-layer Tool
# Provides faster, more controlled package installation using dpkg directly

# Direct dpkg installation function
dpkg_direct_install() {
    local packages=("$@")
    local chroot_dir="${DPKG_CHROOT_DIR:-}"
    local download_only="${DPKG_DOWNLOAD_ONLY:-false}"
    local force_depends="${DPKG_FORCE_DEPENDS:-false}"
    
    log_info "Direct dpkg installation: ${packages[*]}" "apt-layer"
    
    # Create temporary directory for package downloads
    local temp_dir
    temp_dir=$(mktemp -d "${WORKSPACE}/temp/dpkg-install-XXXXXX")
    
    # Start transaction
    start_transaction "dpkg_direct_install"
    
    # Download packages
    update_transaction_phase "downloading_packages"
    log_info "Downloading packages to: $temp_dir" "apt-layer"
    
    local download_cmd="apt-get download"
    if [[ -n "$chroot_dir" ]]; then
        download_cmd="chroot '$chroot_dir' apt-get download"
    fi
    
    if ! eval "$download_cmd ${packages[*]}"; then
        log_error "Failed to download packages" "apt-layer"
        rollback_transaction
        rm -rf "$temp_dir"
        return 1
    fi
    
    # If download-only mode, return here
    if [[ "$download_only" == "true" ]]; then
        log_info "Download-only mode: packages saved to $temp_dir" "apt-layer"
        commit_transaction
        return 0
    fi
    
    # Get list of downloaded .deb files
    local deb_files=()
    while IFS= read -r -d '' file; do
        deb_files+=("$file")
    done < <(find "$temp_dir" -name "*.deb" -print0)
    
    if [[ ${#deb_files[@]} -eq 0 ]]; then
        log_error "No .deb files found in download directory" "apt-layer"
        rollback_transaction
        rm -rf "$temp_dir"
        return 1
    fi
    
    log_info "Downloaded ${#deb_files[@]} package files" "apt-layer"
    
    # Install packages using dpkg
    update_transaction_phase "installing_packages"
    log_info "Installing packages with dpkg..." "apt-layer"
    
    local dpkg_cmd="dpkg -i"
    if [[ -n "$chroot_dir" ]]; then
        dpkg_cmd="chroot '$chroot_dir' dpkg -i"
        # Copy .deb files to chroot
        cp "${deb_files[@]}" "$chroot_dir/tmp/"
        deb_files=("${deb_files[@]/$temp_dir/$chroot_dir/tmp}")
    fi
    
    # Add force-depends if requested
    if [[ "$force_depends" == "true" ]]; then
        dpkg_cmd="$dpkg_cmd --force-depends"
    fi
    
    # Install packages
    if ! eval "$dpkg_cmd ${deb_files[*]}"; then
        log_warning "dpkg installation had issues, attempting dependency resolution" "apt-layer"
        
        # Try to fix broken dependencies
        local fix_cmd="apt-get install -f"
        if [[ -n "$chroot_dir" ]]; then
            fix_cmd="chroot '$chroot_dir' apt-get install -f"
        fi
        
        if ! eval "$fix_cmd"; then
            log_error "Failed to resolve dependencies after dpkg installation" "apt-layer"
            rollback_transaction
            rm -rf "$temp_dir"
            return 1
        fi
    fi
    
    # Configure packages
    update_transaction_phase "configuring_packages"
    log_info "Configuring packages..." "apt-layer"
    
    local configure_cmd="dpkg --configure -a"
    if [[ -n "$chroot_dir" ]]; then
        configure_cmd="chroot '$chroot_dir' dpkg --configure -a"
    fi
    
    if ! eval "$configure_cmd"; then
        log_warning "Package configuration had issues" "apt-layer"
    fi
    
    # Clean up
    rm -rf "$temp_dir"
    if [[ -n "$chroot_dir" ]]; then
        rm -f "$chroot_dir"/tmp/*.deb
    fi
    
    commit_transaction
    log_success "Direct dpkg installation completed: ${packages[*]}" "apt-layer"
    return 0
}

# Container-based dpkg installation
container_dpkg_install() {
    local base_image="$1"
    local new_image="$2"
    local packages=("${@:3}")
    
    log_info "Container-based dpkg installation: ${packages[*]}" "apt-layer"
    
    # Create temporary container name
    local container_name="apt-layer-dpkg-$(date +%s)-$$"
    local temp_dir="$WORKSPACE/temp/$container_name"
    
    # Ensure temp directory exists
    mkdir -p "$temp_dir"
    
    # Start transaction
    start_transaction "container-dpkg-install-$container_name"
    
    # Use existing container creation function if available, otherwise create base image
    if command -v create_base_container_image >/dev/null 2>&1; then
        if ! create_base_container_image "$base_image" "$container_name"; then
            rollback_transaction
            return 1
        fi
    else
        # Fallback: create base image directory
        log_info "Using fallback container image creation" "apt-layer"
        if [[ -d "$WORKSPACE/images/$base_image" ]]; then
            cp -a "$WORKSPACE/images/$base_image" "$temp_dir"
        else
            log_error "Base image not found: $base_image" "apt-layer"
            rollback_transaction
            return 1
        fi
    fi
    
    # Run dpkg installation in container
    case "$CONTAINER_RUNTIME" in
        podman)
            if ! run_podman_dpkg_install "$base_image" "$container_name" "$temp_dir" "${packages[@]}"; then
                rollback_transaction
                return 1
            fi
            ;;
        docker)
            if ! run_docker_dpkg_install "$base_image" "$container_name" "$temp_dir" "${packages[@]}"; then
                rollback_transaction
                return 1
            fi
            ;;
        systemd-nspawn)
            if ! run_nspawn_dpkg_install "$base_image" "$container_name" "$temp_dir" "${packages[@]}"; then
                rollback_transaction
                return 1
            fi
            ;;
        *)
            log_error "Unsupported container runtime: $CONTAINER_RUNTIME" "apt-layer"
            rollback_transaction
            return 1
            ;;
    esac
    
    # Create ComposeFS layer from container changes
    if command -v create_composefs_layer >/dev/null 2>&1; then
        if ! create_composefs_layer "$temp_dir" "$new_image"; then
            rollback_transaction
            return 1
        fi
    else
        # Fallback: use composefs-alternative.sh
        log_info "Using fallback ComposeFS layer creation" "apt-layer"
        if ! "$COMPOSEFS_SCRIPT" create "$new_image" "$temp_dir"; then
            log_error "Failed to create ComposeFS layer" "apt-layer"
            rollback_transaction
            return 1
        fi
    fi
    
    # Commit transaction
    commit_transaction
    
    # Cleanup
    if command -v cleanup_container_artifacts >/dev/null 2>&1; then
        cleanup_container_artifacts "$container_name" "$temp_dir"
    else
        # Fallback cleanup
        rm -rf "$temp_dir"
    fi
    
    log_success "Container-based dpkg installation completed" "apt-layer"
    return 0
}

# Podman-based dpkg installation
run_podman_dpkg_install() {
    local base_image="$1"
    local container_name="$2"
    local temp_dir="$3"
    shift 3
    local packages=("$@")
    
    log_info "Running podman-based dpkg installation" "apt-layer"
    
    # Create container from base image
    local container_id
    if [[ -d "$WORKSPACE/images/$base_image" ]]; then
        # Use ComposeFS image as base
        container_id=$(podman create --name "$container_name" \
            --mount type=bind,source="$WORKSPACE/images/$base_image",target=/ \
            --mount type=bind,source="$temp_dir",target=/output \
            ubuntu:24.04 /bin/bash)
    else
        # Use standard Ubuntu image
        container_id=$(podman create --name "$container_name" \
            --mount type=bind,source="$temp_dir",target=/output \
            ubuntu:24.04 /bin/bash)
    fi
    
    if [[ -z "$container_id" ]]; then
        log_error "Failed to create podman container" "apt-layer"
        return 1
    fi
    
    # Start container and install packages
    if ! podman start "$container_name"; then
        log_error "Failed to start podman container" "apt-layer"
        podman rm "$container_name" 2>/dev/null || true
        return 1
    fi
    
    # Download and install packages using dpkg
    local install_cmd="
        apt-get update && 
        apt-get download ${packages[*]} && 
        dpkg -i *.deb && 
        apt-get install -f && 
        dpkg --configure -a && 
        apt-get clean
    "
    
    if ! podman exec "$container_name" /bin/bash -c "$install_cmd"; then
        log_error "dpkg installation failed in podman container" "apt-layer"
        podman stop "$container_name" 2>/dev/null || true
        podman rm "$container_name" 2>/dev/null || true
        return 1
    fi
    
    # Export container filesystem
    if ! podman export "$container_name" | tar -x -C "$temp_dir"; then
        log_error "Failed to export podman container filesystem" "apt-layer"
        podman stop "$container_name" 2>/dev/null || true
        podman rm "$container_name" 2>/dev/null || true
        return 1
    fi
    
    # Cleanup container
    podman stop "$container_name" 2>/dev/null || true
    podman rm "$container_name" 2>/dev/null || true
    
    log_success "Podman-based dpkg installation completed" "apt-layer"
    return 0
}

# Docker-based dpkg installation
run_docker_dpkg_install() {
    local base_image="$1"
    local container_name="$2"
    local temp_dir="$3"
    shift 3
    local packages=("$@")
    
    log_info "Running docker-based dpkg installation" "apt-layer"
    
    # Create container from base image
    local container_id
    if [[ -d "$WORKSPACE/images/$base_image" ]]; then
        # Use ComposeFS image as base
        container_id=$(docker create --name "$container_name" \
            -v "$WORKSPACE/images/$base_image:/" \
            -v "$temp_dir:/output" \
            ubuntu:24.04 /bin/bash)
    else
        # Use standard Ubuntu image
        container_id=$(docker create --name "$container_name" \
            -v "$temp_dir:/output" \
            ubuntu:24.04 /bin/bash)
    fi
    
    if [[ -z "$container_id" ]]; then
        log_error "Failed to create docker container" "apt-layer"
        return 1
    fi
    
    # Start container and install packages
    if ! docker start "$container_name"; then
        log_error "Failed to start docker container" "apt-layer"
        docker rm "$container_name" 2>/dev/null || true
        return 1
    fi
    
    # Download and install packages using dpkg
    local install_cmd="
        apt-get update && 
        apt-get download ${packages[*]} && 
        dpkg -i *.deb && 
        apt-get install -f && 
        dpkg --configure -a && 
        apt-get clean
    "
    
    if ! docker exec "$container_name" /bin/bash -c "$install_cmd"; then
        log_error "dpkg installation failed in docker container" "apt-layer"
        docker stop "$container_name" 2>/dev/null || true
        docker rm "$container_name" 2>/dev/null || true
        return 1
    fi
    
    # Export container filesystem
    if ! docker export "$container_name" | tar -x -C "$temp_dir"; then
        log_error "Failed to export docker container filesystem" "apt-layer"
        docker stop "$container_name" 2>/dev/null || true
        docker rm "$container_name" 2>/dev/null || true
        return 1
    fi
    
    # Cleanup container
    docker stop "$container_name" 2>/dev/null || true
    docker rm "$container_name" 2>/dev/null || true
    
    log_success "Docker-based dpkg installation completed" "apt-layer"
    return 0
}

# systemd-nspawn-based dpkg installation
run_nspawn_dpkg_install() {
    local base_image="$1"
    local container_name="$2"
    local temp_dir="$3"
    shift 3
    local packages=("$@")
    
    log_info "Running systemd-nspawn-based dpkg installation" "apt-layer"
    
    local container_dir="$WORKSPACE/containers/$container_name"
    
    # Create container directory
    if [[ -d "$WORKSPACE/images/$base_image" ]]; then
        # Use ComposeFS image as base
        log_info "Using ComposeFS image as base for nspawn" "apt-layer"
        cp -a "$WORKSPACE/images/$base_image" "$container_dir"
    else
        # Use host filesystem as base
        log_info "Using host filesystem as base for nspawn" "apt-layer"
        # Create minimal container structure
        mkdir -p "$container_dir"/{bin,lib,lib64,usr,etc,var}
        # Copy essential files from host
        cp -a /bin/bash "$container_dir/bin/"
        cp -a /lib/x86_64-linux-gnu "$container_dir/lib/"
        cp -a /usr/bin/dpkg "$container_dir/usr/bin/"
        cp -a /usr/bin/apt-get "$container_dir/usr/bin/"
        # Add minimal /etc structure
        echo "deb http://archive.ubuntu.com/ubuntu/ jammy main" > "$container_dir/etc/apt/sources.list"
    fi
    
    # Run dpkg installation in nspawn container
    local install_cmd="
        apt-get update && 
        apt-get download ${packages[*]} && 
        dpkg -i *.deb && 
        apt-get install -f && 
        dpkg --configure -a && 
        apt-get clean
    "
    
    if ! systemd-nspawn -D "$container_dir" /bin/bash -c "$install_cmd"; then
        log_error "dpkg installation failed in nspawn container" "apt-layer"
        return 1
    fi
    
    # Move container contents to temp_dir
    mv "$container_dir"/* "$temp_dir/" 2>/dev/null || true
    
    log_success "systemd-nspawn-based dpkg installation completed" "apt-layer"
    return 0
}

# Live overlay dpkg installation
live_dpkg_install() {
    local packages=("$@")
    
    log_info "Installing packages in live overlay with dpkg: ${packages[*]}" "apt-layer"
    
    # Check if overlay is active
    if command -v is_live_overlay_active >/dev/null 2>&1; then
        if ! is_live_overlay_active; then
            log_error "Live overlay is not active" "apt-layer"
            log_info "Use '--live-overlay start' to start live overlay first" "apt-layer"
            return 1
        fi
    else
        # Fallback: check if overlay variables are set
        if [[ -z "${LIVE_OVERLAY_MOUNT_POINT:-}" ]]; then
            log_error "Live overlay system not available" "apt-layer"
            log_info "Live overlay functionality requires overlayfs support" "apt-layer"
            return 1
        fi
    fi
    
    # Check for root privileges
    if [[ $EUID -ne 0 ]]; then
        log_error "Root privileges required for live installation" "apt-layer"
        return 1
    fi
    
    # Update package lists in overlay
    log_info "Updating package lists in overlay" "apt-layer"
    if ! chroot "$LIVE_OVERLAY_MOUNT_POINT" apt-get update; then
        log_error "Failed to update package lists" "apt-layer"
        return 1
    fi
    
    # Download and install packages using dpkg
    log_info "Installing packages with dpkg in overlay" "apt-layer"
    local install_cmd="
        apt-get download ${packages[*]} && 
        dpkg -i *.deb && 
        apt-get install -f && 
        dpkg --configure -a && 
        apt-get clean
    "
    
    if chroot "$LIVE_OVERLAY_MOUNT_POINT" /bin/bash -c "$install_cmd"; then
        log_success "Packages installed successfully in overlay with dpkg" "apt-layer"
        
        # Log installed packages if log file is defined
        if [[ -n "${LIVE_OVERLAY_PACKAGE_LOG:-}" ]]; then
            for package in "${packages[@]}"; do
                echo "$(date '+%Y-%m-%d %H:%M:%S') - INSTALLED: $package (dpkg)" >> "$LIVE_OVERLAY_PACKAGE_LOG"
            done
        fi
        
        log_info "Changes are applied to overlay and can be committed or rolled back" "apt-layer"
        return 0
    else
        log_error "Failed to install packages in overlay with dpkg" "apt-layer"
        return 1
    fi
}

# Package verification using dpkg
verify_package_integrity() {
    local package="$1"
    
    log_info "Verifying package integrity: $package" "apt-layer"
    
    # Check if package is installed
    if ! dpkg -l "$package" >/dev/null 2>&1; then
        log_error "Package '$package' is not installed" "apt-layer"
        return 1
    fi
    
    # Verify package files
    if ! dpkg -V "$package" >/dev/null 2>&1; then
        log_warning "Package '$package' has file integrity issues" "apt-layer"
        return 1
    fi
    
    # Check package status
    local status
    status=$(dpkg -s "$package" 2>/dev/null | grep "^Status:" | cut -d: -f2 | tr -d ' ')
    
    if [[ "$status" != "installokinstalled" ]]; then
        log_warning "Package '$package' has status issues: $status" "apt-layer"
        return 1
    fi
    
    log_success "Package '$package' integrity verified" "apt-layer"
    return 0
}

# Batch package verification
verify_all_packages() {
    local packages=("$@")
    
    log_info "Verifying integrity of ${#packages[@]} packages" "apt-layer"
    
    local failed_packages=()
    
    for package in "${packages[@]}"; do
        if ! verify_package_integrity "$package"; then
            failed_packages+=("$package")
        fi
    done
    
    if [[ ${#failed_packages[@]} -gt 0 ]]; then
        log_warning "Found ${#failed_packages[@]} packages with integrity issues: ${failed_packages[*]}" "apt-layer"
        return 1
    fi
    
    log_success "All packages verified successfully" "apt-layer"
    return 0
}

# --- END OF SCRIPTLET: 24-dpkg-direct-install.sh --- 

# --- END OF SCRIPTLET: 24-dpkg-direct-install.sh ---

# ============================================================================
# Main Dispatch and Help
# ============================================================================
# Main execution and command dispatch for Particle-OS apt-layer Tool

# Show concise usage information
show_usage() {
    cat << 'EOF'
Particle-OS apt-layer Tool - Enhanced with Container Support and LIVE SYSTEM LAYERING
Like rpm-ostree + Vanilla OS Apx for Ubuntu/Debian, now ComposeFS-based

BASIC USAGE:
  apt-layer base-image new-image [packages...]     # Create new layer
  apt-layer --container base-image new-image [packages...]  # Container-based layer
  apt-layer --live-install packages               # Install on live system
  apt-layer --dpkg-install packages               # Direct dpkg installation

LIVE SYSTEM MANAGEMENT:
  apt-layer --live-overlay action                    # Manage live overlay (start/stop/status/commit/rollback)
  apt-layer --live-commit [message]                    # Commit overlay changes
  apt-layer --live-rollback                            # Rollback overlay changes

rpm-ostree COMPATIBILITY:
  apt-layer install packages                      # Install packages
  apt-layer upgrade                                    # Upgrade system
  apt-layer rebase new-base                          # Rebase to new base
  apt-layer rollback [commit]                          # Rollback deployment
  apt-layer status                                     # Show deployment status
  apt-layer kargs action [args...]                   # Manage kernel arguments

IMAGE MANAGEMENT:
  apt-layer --list                                     # List available images
  apt-layer --info image                             # Show image information
  apt-layer --remove image                           # Remove image
  apt-layer --oci-export image oci-name            # Export as OCI image
  apt-layer --oci-import oci-name target           # Import OCI image

ADVANCED FEATURES:
  apt-layer --advanced-install packages           # Advanced package installation
  apt-layer --generate-key name type               # Generate signing key
  apt-layer --sign-layer layer key                 # Sign layer
  apt-layer --verify-layer layer                     # Verify layer signature
  apt-layer --query-audit format [filters...]        # Query audit logs
  apt-layer --scan-package package                   # Security scan package
  apt-layer admin health                               # System health check

CATEGORIES:
  apt-layer layer --help                               # Layer management commands
  apt-layer live --help                                # Live system commands
  apt-layer rpm-ostree --help                          # rpm-ostree compatibility
  apt-layer image --help                               # Image management
  apt-layer security --help                            # Security & signing
  apt-layer audit --help                               # Audit & compliance
  apt-layer admin --help                               # Admin utilities
  apt-layer enterprise --help                          # Enterprise features
  apt-layer cloud --help                               # Cloud integration
  apt-layer kubernetes --help                          # Kubernetes integration

For detailed help: apt-layer --help-full
For specific category: apt-layer category --help
For examples: apt-layer --examples

Examples:
  apt-layer ubuntu-ublue/base/24.04 ubuntu-ublue/gaming/24.04 steam wine
  apt-layer --container ubuntu-ublue/base/24.04 ubuntu-ublue/dev/24.04 vscode git
  apt-layer --live-install firefox
  apt-layer install steam wine
  apt-layer status
EOF
}

# Show full detailed usage information
show_full_usage() {
    cat << 'EOF'
Particle-OS apt-layer Tool - Enhanced with Container Support and LIVE SYSTEM LAYERING
Like rpm-ostree + Vanilla OS Apx for Ubuntu/Debian, now ComposeFS-based

BASIC LAYER CREATION:
  apt-layer base-image new-image [packages...]
    # Add a new layer to an existing ComposeFS image (build or user)

  apt-layer --container base-image new-image [packages...]
    # Create layer using container isolation (like Apx)

  apt-layer --dpkg-install packages
    # Install packages using direct dpkg (faster, more controlled)

  apt-layer --container-dpkg base-image new-image [packages...]
    # Create layer using container isolation with dpkg (optimized)

LIVE SYSTEM LAYERING:
  apt-layer --live-install packages
    # Install packages on live system with overlayfs (like rpm-ostree install)

  apt-layer --live-dpkg packages
    # Install packages on live system using dpkg (optimized)

  apt-layer --live-overlay action [options]
    # Manage live system overlayfs
    # Actions: start, stop, status, commit, rollback

  apt-layer --live-commit [message]
    # Commit current live overlay changes as new ComposeFS layer

  apt-layer --live-rollback
    # Rollback live overlay changes

rpm-ostree COMPATIBILITY COMMANDS:
  apt-layer install packages
    # Install packages (rpm-ostree install compatibility)

  apt-layer upgrade
    # Upgrade system (rpm-ostree upgrade compatibility)

  apt-layer rebase new-base
    # Rebase to new base (rpm-ostree rebase compatibility)

  apt-layer rollback [commit]
    # Rollback to previous deployment (rpm-ostree rollback compatibility)

  apt-layer status
    # Show deployment status (rpm-ostree status compatibility)

  apt-layer diff [from] [to]
    # Show package differences (rpm-ostree diff compatibility)

  apt-layer db list
    # List deployments (rpm-ostree db list compatibility)

  apt-layer db diff [from] [to]
    # Show detailed differences (rpm-ostree db diff compatibility)

  apt-layer cleanup [--purge]
    # Clean up old deployments (rpm-ostree cleanup compatibility)

  apt-layer cancel
    # Cancel pending deployment (rpm-ostree cancel compatibility)

  apt-layer initramfs action
    # Manage initramfs (rpm-ostree initramfs compatibility)

  apt-layer kargs action [args...]
    # Manage kernel arguments (rpm-ostree kargs compatibility)

  apt-layer bootloader action [options]
    # Manage bootloader entries and configuration

  apt-layer usroverlay action
    # Manage /usr overlay (rpm-ostree usroverlay compatibility)

  apt-layer composefs action [args...]
    # Manage ComposeFS (rpm-ostree composefs compatibility)

IMAGE MANAGEMENT:
  apt-layer --list
    # List all available ComposeFS images/layers

  apt-layer --info image
    # Show information about a specific ComposeFS image/layer

  apt-layer --remove image
    # Remove an image/layer

  apt-layer --oci-export image placeholder
    # Export ComposeFS image as OCI image

  apt-layer --oci-import placeholder placeholder
    # Import OCI image as ComposeFS image

  apt-layer --oci-status
    # Show OCI integration system status

ADVANCED PACKAGE MANAGEMENT:
  apt-layer --advanced-install packages
    # Install packages with security checks and dependency resolution

  apt-layer --advanced-remove packages
    # Remove packages with dependency checking and safety validation

  apt-layer --advanced-update packages
    # Update packages with rollback capability and backup creation

  apt-layer --add-user username role
    # Add user to package management system with specified role

  apt-layer --remove-user username
    # Remove user from package management system

  apt-layer --list-users
    # List all package management users and roles

  apt-layer --package-info package
    # Get detailed information about a package

  apt-layer --package-status
    # Show advanced package management system status

  apt-layer --list-backups
    # List all package backups

  apt-layer --cleanup-backups [days]
    # Clean up backups older than specified days (default: 30)

LAYER SIGNING & VERIFICATION:
  apt-layer --generate-key key-name type
    # Generate signing key pair (sigstore, gpg)

  apt-layer --sign-layer layer-path key-name
    # Sign layer with specified key

  apt-layer --verify-layer layer-path
    # Verify layer signature

  apt-layer --revoke-layer layer-path [reason]
    # Revoke layer (mark as untrusted)

  apt-layer --list-keys
    # List all signing keys

  apt-layer --list-signatures
    # List all layer signatures

  apt-layer --layer-status layer-path
    # Show layer signing status

AUDIT & COMPLIANCE:
  apt-layer --query-audit format [filters...]
    # Query audit logs with filters (json, csv, table)

  apt-layer --export-audit format [output-file] [filters...]
    # Export audit logs to file (json, csv, html)

  apt-layer --generate-compliance-report framework [period] [format]
    # Generate compliance report (sox, pci-dss)

  apt-layer --list-audit-reports
    # List all audit reports

  apt-layer --audit-status
    # Show audit system status

  apt-layer --cleanup-audit-logs [days]
    # Clean up old audit logs (default: 90 days)

SECURITY SCANNING:
  apt-layer --scan-package package-name [version] [scan-level]
    # Scan package for vulnerabilities (standard, thorough, quick)

  apt-layer --scan-layer layer-path [scan-level]
    # Scan layer for vulnerabilities

  apt-layer --generate-security-report type [format] [scan-level]
    # Generate security report (package, layer, system)

  apt-layer --security-status
    # Show security scanning system status

  apt-layer --update-cve-database
    # Update CVE database from NVD

  apt-layer --cleanup-security-reports [days]
    # Clean up old security reports (default: 90 days)

ADMIN UTILITIES:
  apt-layer admin health
    # System health check and diagnostics

  apt-layer admin perf
    # Performance analytics and resource usage

  apt-layer admin cleanup
    # Maintenance cleanup

  apt-layer admin backup
    # Backup configs and layers

  apt-layer admin restore
    # Restore from backup

ENTERPRISE FEATURES:
  apt-layer tenant action [options]
    # Multi-tenant management

  apt-layer compliance action [options]
    # Compliance framework management

  apt-layer enterprise action [options]
    # Enterprise integration

  apt-layer monitoring action [options]
    # Monitoring and alerting

CLOUD INTEGRATION:
  apt-layer cloud action [options]
    # Cloud provider integration (AWS, Azure, GCP)

  apt-layer kubernetes action [options]
    # Kubernetes integration (EKS, AKS, GKE, OpenShift)

  apt-layer orchestration action [options]
    # Container orchestration

  apt-layer multicloud action [options]
    # Multi-cloud deployment

  apt-layer cloud-security action [options]
    # Cloud-native security

For category-specific help: apt-layer category --help
For examples: apt-layer --examples
EOF
}

# Show category-specific help
show_layer_help() {
    cat << 'EOF'
Layer Management Commands

BASIC LAYER CREATION:
  apt-layer base-image new-image [packages...]
    # Create new layer from base image with packages

  apt-layer --container base-image new-image [packages...]
    # Create layer using container isolation (like Apx)

  apt-layer --dpkg-install packages
    # Install packages using direct dpkg (faster, more controlled)

  apt-layer --container-dpkg base-image new-image [packages...]
    # Create layer using container isolation with dpkg (optimized)

  apt-layer --advanced-install packages
    # Install packages with security checks and dependency resolution

  apt-layer --advanced-remove packages
    # Remove packages with dependency checking and safety validation

  apt-layer --advanced-update packages
    # Update packages with rollback capability and backup creation

Examples:
  apt-layer ubuntu-ublue/base/24.04 ubuntu-ublue/gaming/24.04 steam wine
  apt-layer --container ubuntu-ublue/base/24.04 ubuntu-ublue/dev/24.04 vscode git
  apt-layer --dpkg-install curl wget
  apt-layer --advanced-install firefox
EOF
}

show_live_help() {
    cat << 'EOF'
Live System Management Commands

LIVE INSTALLATION:
  apt-layer --live-install packages
    # Install packages on live system with overlayfs (like rpm-ostree install)

  apt-layer --live-dpkg packages
    # Install packages on live system using dpkg (optimized)

LIVE OVERLAY MANAGEMENT:
  apt-layer --live-overlay action [options]
    # Manage live system overlayfs
    # Actions: start, stop, status, commit, rollback

  apt-layer --live-commit [message]
    # Commit current live overlay changes as new ComposeFS layer

  apt-layer --live-rollback
    # Rollback live overlay changes

Examples:
  apt-layer --live-install firefox
  apt-layer --live-overlay start
  apt-layer --live-overlay commit "Add development tools"
  apt-layer --live-rollback
EOF
}

show_rpm_ostree_help() {
    cat << 'EOF'
rpm-ostree Compatibility Commands

BASIC COMMANDS:
  apt-layer install packages
    # Install packages (rpm-ostree install compatibility)

  apt-layer upgrade
    # Upgrade system (rpm-ostree upgrade compatibility)

  apt-layer rebase new-base
    # Rebase to new base (rpm-ostree rebase compatibility)

  apt-layer rollback [commit]
    # Rollback to previous deployment (rpm-ostree rollback compatibility)

  apt-layer status
    # Show deployment status (rpm-ostree status compatibility)

  apt-layer diff [from] [to]
    # Show package differences (rpm-ostree diff compatibility)

DATABASE COMMANDS:
  apt-layer db list
    # List deployments (rpm-ostree db list compatibility)

  apt-layer db diff [from] [to]
    # Show detailed differences (rpm-ostree db diff compatibility)

SYSTEM COMMANDS:
  apt-layer cleanup [--purge]
    # Clean up old deployments (rpm-ostree cleanup compatibility)

  apt-layer cancel
    # Cancel pending deployment (rpm-ostree cancel compatibility)

  apt-layer initramfs action
    # Manage initramfs (rpm-ostree initramfs compatibility)

  apt-layer kargs action [args...]
    # Manage kernel arguments (rpm-ostree kargs compatibility)

  apt-layer bootloader action [options]
    # Manage bootloader entries and configuration

  apt-layer usroverlay action
    # Manage /usr overlay (rpm-ostree usroverlay compatibility)

  apt-layer composefs action [args...]
    # Manage ComposeFS (rpm-ostree composefs compatibility)

Examples:
  apt-layer install steam wine
  apt-layer status
  apt-layer upgrade
  apt-layer kargs add "console=ttyS0"
  apt-layer rollback
EOF
}

show_image_help() {
    cat << 'EOF'
Image Management Commands

BASIC IMAGE OPERATIONS:
  apt-layer --list
    # List all available ComposeFS images/layers

  apt-layer --info image
    # Show information about a specific ComposeFS image/layer

  apt-layer --remove image
    # Remove an image/layer

OCI INTEGRATION:
  apt-layer --oci-export image placeholder
    # Export ComposeFS image as OCI image

  apt-layer --oci-import placeholder placeholder
    # Import OCI image as ComposeFS image

  apt-layer --oci-status
    # Show OCI integration system status

Examples:
  apt-layer --list
  apt-layer --info ubuntu-ublue/gaming/24.04
  apt-layer --remove old-image
  apt-layer --oci-export ubuntu-ublue/gaming/24.04 ubuntu-ublue/gaming:latest
  apt-layer --oci-import ubuntu:24.04 ubuntu-ublue/base/24.04
EOF
}

show_security_help() {
    cat << 'EOF'
Security & Signing Commands

LAYER SIGNING & VERIFICATION:
  apt-layer --generate-key key-name type
    # Generate signing key pair (sigstore, gpg)

  apt-layer --sign-layer layer-path key-name
    # Sign layer with specified key

  apt-layer --verify-layer layer-path
    # Verify layer signature

  apt-layer --revoke-layer layer-path [reason]
    # Revoke layer (mark as untrusted)

  apt-layer --list-keys
    # List all signing keys

  apt-layer --list-signatures
    # List all layer signatures

  apt-layer --layer-status layer-path
    # Show layer signing status

SECURITY SCANNING:
  apt-layer --scan-package package-name [version] [scan-level]
    # Scan package for vulnerabilities (standard, thorough, quick)

  apt-layer --scan-layer layer-path [scan-level]
    # Scan layer for vulnerabilities

  apt-layer --generate-security-report type [format] [scan-level]
    # Generate security report (package, layer, system)

  apt-layer --security-status
    # Show security scanning system status

  apt-layer --update-cve-database
    # Update CVE database from NVD

  apt-layer --cleanup-security-reports [days]
    # Clean up old security reports (default: 90 days)

Examples:
  apt-layer --generate-key my-key sigstore
  apt-layer --sign-layer layer.squashfs my-key
  apt-layer --verify-layer layer.squashfs
  apt-layer --scan-package firefox
  apt-layer --security-status
EOF
}

show_audit_help() {
    cat << 'EOF'
Audit & Compliance Commands

AUDIT LOGGING:
  apt-layer --query-audit format [filters...]
    # Query audit logs with filters (json, csv, table)

  apt-layer --export-audit format [output-file] [filters...]
    # Export audit logs to file (json, csv, html)

  apt-layer --list-audit-reports
    # List all audit reports

  apt-layer --audit-status
    # Show audit system status

  apt-layer --cleanup-audit-logs [days]
    # Clean up old audit logs (default: 90 days)

COMPLIANCE REPORTING:
  apt-layer --generate-compliance-report framework [period] [format]
    # Generate compliance report (sox, pci-dss)

Examples:
  apt-layer --query-audit json --user=admin --since=2024-01-01
  apt-layer --export-audit csv --output=audit-export.csv
  apt-layer --generate-compliance-report sox monthly html
  apt-layer --audit-status
EOF
}

show_admin_help() {
    cat << 'EOF'
Admin Utilities Commands

SYSTEM HEALTH:
  apt-layer admin health
    # System health check and diagnostics

  apt-layer admin perf
    # Performance analytics and resource usage

MAINTENANCE:
  apt-layer admin cleanup
    # Maintenance cleanup

  apt-layer admin backup
    # Backup configs and layers

  apt-layer admin restore
    # Restore from backup

USER MANAGEMENT:
  apt-layer --add-user username role
    # Add user to package management system with specified role

  apt-layer --remove-user username
    # Remove user from package management system

  apt-layer --list-users
    # List all package management users and roles

PACKAGE MANAGEMENT:
  apt-layer --package-info package
    # Get detailed information about a package

  apt-layer --package-status
    # Show advanced package management system status

  apt-layer --list-backups
    # List all package backups

  apt-layer --cleanup-backups [days]
    # Clean up backups older than specified days (default: 30)

Examples:
  apt-layer admin health
  apt-layer admin perf
  apt-layer --add-user john package_manager
  apt-layer --list-users
  apt-layer --package-status
EOF
}

show_enterprise_help() {
    cat << 'EOF'
Enterprise Features Commands

MULTI-TENANT MANAGEMENT:
  apt-layer tenant action [options]
    # Multi-tenant management
    # Actions: init, create, delete, list, info, quota, backup, restore, health

COMPLIANCE FRAMEWORKS:
  apt-layer compliance action [options]
    # Compliance framework management
    # Actions: init, enable, disable, list, scan, report

ENTERPRISE INTEGRATION:
  apt-layer enterprise action [options]
    # Enterprise integration
    # Actions: init, enable, disable, list, test, hook, send

MONITORING & ALERTING:
  apt-layer monitoring action [options]
    # Monitoring and alerting
    # Actions: init, check, policy, history, report

Examples:
  apt-layer tenant create my-org
  apt-layer compliance enable SOX
  apt-layer enterprise enable SIEM siem-config.json
  apt-layer monitoring check
EOF
}

show_cloud_help() {
    cat << 'EOF'
Cloud Integration Commands

CLOUD PROVIDERS:
  apt-layer cloud action [options]
    # Cloud provider integration (AWS, Azure, GCP)
    # Actions: init, aws, azure, gcp, deploy, status, list-deployments, cleanup

KUBERNETES:
  apt-layer kubernetes action [options]
    # Kubernetes integration (EKS, AKS, GKE, OpenShift)
    # Actions: init, eks, aks, gke, openshift, deploy, helm, monitoring, security, cleanup

CONTAINER ORCHESTRATION:
  apt-layer orchestration action [options]
    # Container orchestration
    # Actions: init, multi-cluster, service-mesh, gitops, deployments, status, cleanup

MULTI-CLOUD:
  apt-layer multicloud action [options]
    # Multi-cloud deployment
    # Actions: init, add-profile, list-profiles, deploy, migrate, status, policy

CLOUD SECURITY:
  apt-layer cloud-security action [options]
    # Cloud-native security
    # Actions: init, scan, policy, list-scans, list-policies, cleanup, status

Examples:
  apt-layer cloud aws init
  apt-layer cloud deploy ubuntu-ublue/gaming/24.04 aws ecr
  apt-layer kubernetes eks create-cluster my-cluster us-west-2
  apt-layer orchestration gitops init https://github.com/my-org/gitops-repo
  apt-layer cloud-security scan ubuntu-ublue/gaming/24.04 aws comprehensive
EOF
}

# Show examples
show_examples() {
    cat << 'EOF'
Particle-OS apt-layer Tool - Examples

BASIC LAYER CREATION:
  # Create gaming layer from base Ubuntu image
  apt-layer ubuntu-ublue/base/24.04 ubuntu-ublue/gaming/24.04 steam wine

  # Create development layer with container isolation
  apt-layer --container ubuntu-ublue/base/24.04 ubuntu-ublue/dev/24.04 vscode git

  # Direct dpkg installation (faster)
  apt-layer --dpkg-install curl wget

LIVE SYSTEM MANAGEMENT:
  # Install packages on running system
  apt-layer --live-install firefox

  # Start live overlay for temporary changes
  apt-layer --live-overlay start

  # Commit overlay changes as new layer
  apt-layer --live-overlay commit "Add development tools"

  # Rollback overlay changes
  apt-layer --live-rollback

rpm-ostree COMPATIBILITY:
  # Install packages (rpm-ostree style)
  apt-layer install steam wine

  # Check system status
  apt-layer status

  # Upgrade system
  apt-layer upgrade

  # Add kernel argument
  apt-layer kargs add "console=ttyS0"

IMAGE MANAGEMENT:
  # List available images
  apt-layer --list

  # Show image details
  apt-layer --info ubuntu-ublue/gaming/24.04

  # Export as OCI image
  apt-layer --oci-export ubuntu-ublue/gaming/24.04 ubuntu-ublue/gaming:latest

ADVANCED FEATURES:
  # Generate signing key
  apt-layer --generate-key my-key sigstore

  # Sign layer
  apt-layer --sign-layer layer.squashfs my-key

  # Security scan
  apt-layer --scan-package firefox

  # System health check
  apt-layer admin health

ENTERPRISE FEATURES:
  # Create tenant
  apt-layer tenant create my-org

  # Enable compliance framework
  apt-layer compliance enable SOX

  # Cloud deployment
  apt-layer cloud deploy ubuntu-ublue/gaming/24.04 aws ecr

  # Kubernetes deployment
  apt-layer kubernetes deploy ubuntu-ublue/gaming/24.04 gaming-ns
EOF
}

# Main execution
main() {
    # Initialize deployment database
    init_deployment_db
    
    # Check for incomplete transactions first
    check_incomplete_transactions

    # Parse command line arguments first (before dependency checks)
    case "${1:-}" in
        --help|-h)
            show_usage
            exit 0
            ;;
        --help-full)
            show_full_usage
            exit 0
            ;;
        --examples)
            show_examples
            exit 0
            ;;
        layer)
            if [[ "${2:-}" == "--help" || "${2:-}" == "-h" ]]; then
                show_layer_help
                exit 0
            fi
            ;;
        live)
            if [[ "${2:-}" == "--help" || "${2:-}" == "-h" ]]; then
                show_live_help
                exit 0
            fi
            ;;
        rpm-ostree)
            if [[ "${2:-}" == "--help" || "${2:-}" == "-h" ]]; then
                show_rpm_ostree_help
                exit 0
            fi
            ;;
        image)
            if [[ "${2:-}" == "--help" || "${2:-}" == "-h" ]]; then
                show_image_help
                exit 0
            fi
            ;;
        security)
            if [[ "${2:-}" == "--help" || "${2:-}" == "-h" ]]; then
                show_security_help
                exit 0
            fi
            ;;
        audit)
            if [[ "${2:-}" == "--help" || "${2:-}" == "-h" ]]; then
                show_audit_help
                exit 0
            fi
            ;;
        admin)
            if [[ "${2:-}" == "--help" || "${2:-}" == "-h" ]]; then
                show_admin_help
                exit 0
            fi
            ;;
        enterprise)
            if [[ "${2:-}" == "--help" || "${2:-}" == "-h" ]]; then
                show_enterprise_help
                exit 0
            fi
            ;;
        cloud)
            if [[ "${2:-}" == "--help" || "${2:-}" == "-h" ]]; then
                show_cloud_help
                exit 0
            fi
            ;;
        kubernetes)
            if [[ "${2:-}" == "--help" || "${2:-}" == "-h" ]]; then
                show_cloud_help
                exit 0
            fi
            ;;
        --list)
            list_branches
            exit 0
            ;;
        --info)
            if [ -z "${2:-}" ]; then
                log_error "Image name required for --info" "apt-layer"
                show_usage
                exit 1
            fi
            show_branch_info "$2"
            exit 0
            ;;
        --remove)
            if [ -z "${2:-}" ]; then
                log_error "Image name required for --remove" "apt-layer"
                show_usage
                exit 1
            fi
            remove_image "$2"
            exit 0
            ;;
        --oci-status)
            # Show OCI integration system status
            oci_status
            exit 0
            ;;
        orchestration)
            # Container orchestration
            if [ -z "${2:-}" ]; then
                log_error "Action required for orchestration" "apt-layer"
                show_usage
                exit 1
            fi
            local action="$2"
            shift 2
            local args=("$@")
            
            handle_orchestration_command "$action" "${args[@]}"
            exit 0
            ;;
        multicloud)
            # Multi-cloud deployment
            if [ -z "${2:-}" ]; then
                log_error "Action required for multicloud" "apt-layer"
                show_usage
                exit 1
            fi
            local action="$2"
            shift 2
            local args=("$@")
            
            handle_multicloud_command "$action" "${args[@]}"
            exit 0
            ;;
        cloud-security)
            # Cloud-native security
            if [ -z "${2:-}" ]; then
                log_error "Action required for cloud-security" "apt-layer"
                show_usage
                exit 1
            fi
            local action="$2"
            shift 2
            local args=("$@")
            
            handle_cloud_security_command "$action" "${args[@]}"
            exit 0
            ;;
    esac

    # Initialize workspace
    init_workspace

    # Initialize OCI integration system
    init_oci_system

    # Check dependencies
    check_dependencies "$@"

    # Parse remaining command line arguments
    case "${1:-}" in
        # rpm-ostree compatibility commands
        install)
            # rpm-ostree install compatibility
            if [ $# -lt 2 ]; then
                log_error "No packages specified for install" "apt-layer"
                show_usage
                exit 1
            fi
            shift
            local packages=("$@")
            rpm_ostree_install "${packages[@]}"
            ;;
        upgrade)
            # rpm-ostree upgrade compatibility
            rpm_ostree_upgrade
            ;;
        rebase)
            # rpm-ostree rebase compatibility
            if [ -z "${2:-}" ]; then
                log_error "New base image required for rebase" "apt-layer"
                show_usage
                exit 1
            fi
            rpm_ostree_rebase "$2"
            ;;
        rollback)
            # rpm-ostree rollback compatibility
            local target_commit="${2:-}"
            rpm_ostree_rollback "$target_commit"
            ;;
        status)
            # rpm-ostree status compatibility
            rpm_ostree_status
            ;;
        diff)
            # rpm-ostree diff compatibility
            local from_commit="${2:-}"
            local to_commit="${3:-}"
            rpm_ostree_diff "$from_commit" "$to_commit"
            ;;
        db)
            # rpm-ostree db commands
            case "${2:-}" in
                list)
                    rpm_ostree_db_list
                    ;;
                diff)
                    local from_commit="${3:-}"
                    local to_commit="${4:-}"
                    rpm_ostree_db_diff "$from_commit" "$to_commit"
                    ;;
                *)
                    log_error "Invalid db command: ${2:-}" "apt-layer"
                    show_usage
                    exit 1
                    ;;
            esac
            ;;
        cleanup)
            # rpm-ostree cleanup compatibility
            local purge="${2:-}"
            rpm_ostree_cleanup "$purge"
            ;;
        cancel)
            # rpm-ostree cancel compatibility
            rpm_ostree_cancel
            ;;
        initramfs)
            # rpm-ostree initramfs compatibility
            if [ -z "${2:-}" ]; then
                log_error "Action required for initramfs" "apt-layer"
                show_usage
                exit 1
            fi
            rpm_ostree_initramfs "$2"
            ;;
        kargs)
            # rpm-ostree kargs compatibility
            if [ -z "${2:-}" ]; then
                log_error "Action required for kargs" "apt-layer"
                show_usage
                exit 1
            fi
            local action="$2"
            shift 2
            local args=("$@")
            
            # Initialize bootloader system
            init_bootloader_on_startup
            
            case "$action" in
                "add")
                    if [ -z "${args[0]:-}" ]; then
                        log_error "Kernel argument required for kargs add" "apt-layer"
                        show_usage
                        exit 1
                    fi
                    add_kernel_arg "${args[0]}"
                    ;;
                "remove")
                    if [ -z "${args[0]:-}" ]; then
                        log_error "Kernel argument required for kargs remove" "apt-layer"
                        show_usage
                        exit 1
                    fi
                    remove_kernel_arg "${args[0]}"
                    ;;
                "list")
                    list_kernel_args
                    ;;
                "clear")
                    clear_pending_kargs
                    ;;
                *)
                    log_error "Invalid kargs action: $action" "apt-layer"
                    log_info "Valid actions: add, remove, list, clear" "apt-layer"
                    show_usage
                    exit 1
                    ;;
            esac
            ;;
        bootloader)
            # Bootloader management
            if [ -z "${2:-}" ]; then
                log_error "Action required for bootloader" "apt-layer"
                show_usage
                exit 1
            fi
            local action="$2"
            shift 2
            local args=("$@")
            
            # Initialize bootloader system
            init_bootloader_on_startup
            
            case "$action" in
                "status")
                    get_bootloader_status
                    ;;
                "list")
                    list_boot_entries
                    ;;
                "set-default")
                    if [ -z "${args[0]:-}" ]; then
                        log_error "Deployment ID required for bootloader set-default" "apt-layer"
                        show_usage
                        exit 1
                    fi
                    set_default_boot_entry "${args[0]}"
                    ;;
                "remove-entry")
                    if [ -z "${args[0]:-}" ]; then
                        log_error "Deployment ID required for bootloader remove-entry" "apt-layer"
                        show_usage
                        exit 1
                    fi
                    remove_boot_entry "${args[0]}"
                    ;;
                *)
                    log_error "Invalid bootloader action: $action" "apt-layer"
                    log_info "Valid actions: status, list, set-default, remove-entry" "apt-layer"
                    show_usage
                    exit 1
                    ;;
            esac
            ;;
        usroverlay)
            # rpm-ostree usroverlay compatibility
            if [ -z "${2:-}" ]; then
                log_error "Action required for usroverlay" "apt-layer"
                show_usage
                exit 1
            fi
            rpm_ostree_usroverlay "$2"
            ;;
        composefs)
            # rpm-ostree composefs compatibility
            if [ -z "${2:-}" ]; then
                log_error "Action required for composefs" "apt-layer"
                show_usage
                exit 1
            fi
            local action="$2"
            shift 2
            local args=("$@")
            rpm_ostree_composefs "$action" "${args[@]}"
            ;;
        --live-install)
            # Live system installation
            if [ $# -lt 2 ]; then
                log_error "No packages specified for --live-install" "apt-layer"
                show_usage
                exit 1
            fi

            shift
            local packages=("$@")

            live_install "${packages[@]}"
            ;;
        --live-overlay)
            # Live overlay management
            if [ -z "${2:-}" ]; then
                log_error "Action required for --live-overlay" "apt-layer"
                show_usage
                exit 1
            fi

            local action="$2"
            shift 2
            local options=("$@")

            manage_live_overlay "$action" "${options[@]}"
            ;;
        --live-commit)
            # Commit live overlay changes
            local message="${2:-Live overlay changes}"
            commit_live_overlay "$message"
            ;;
        --live-rollback)
            # Rollback live overlay changes
            rollback_live_overlay
            ;;
        --container)
            # Container-based layer creation
            if [ $# -lt 4 ]; then
                log_error "Insufficient arguments for --container" "apt-layer"
                show_usage
                exit 1
            fi

            local base_image="$2"
            local new_image="$3"
            shift 3
            local packages=("$@")

            # Initialize container system
            if ! init_container_system; then
                log_error "Failed to initialize container system" "apt-layer"
                exit 1
            fi

            # Create container-based layer
            if ! container_install_packages "$base_image" "$new_image" "${packages[@]}"; then
                log_error "Container-based layer creation failed" "apt-layer"
                exit 1
            fi

            log_success "Container-based layer created: $new_image" "apt-layer"
            ;;
        --oci-export)
            # Export ComposeFS image as OCI image
            if [ $# -lt 3 ]; then
                log_error "Insufficient arguments for --oci-export" "apt-layer"
                show_usage
                exit 1
            fi

            local image="$2"
            local oci_image_name="$3"

            export_oci_image "$image" "$oci_image_name"
            ;;
        --oci-import)
            # Import OCI image as ComposeFS image
            if [ $# -lt 3 ]; then
                log_error "Insufficient arguments for --oci-import" "apt-layer"
                show_usage
                exit 1
            fi

            local oci_image_name="$2"
            local target_image="$3"

            import_oci_image "$oci_image_name" "$target_image"
            ;;
        --advanced-install)
            # Advanced package installation with security checks
            if [ $# -lt 2 ]; then
                log_error "No packages specified for --advanced-install" "apt-layer"
                show_usage
                exit 1
            fi

            shift
            local packages=("$@")

            # Initialize advanced package management system
            init_advanced_package_management_on_startup

            advanced_install_packages "${packages[@]}"
            ;;
        --advanced-remove)
            # Advanced package removal with dependency checking
            if [ $# -lt 2 ]; then
                log_error "No packages specified for --advanced-remove" "apt-layer"
                show_usage
                exit 1
            fi

            shift
            local packages=("$@")

            # Initialize advanced package management system
            init_advanced_package_management_on_startup

            advanced_remove_packages "${packages[@]}"
            ;;
        --advanced-update)
            # Advanced package update with rollback capability
            if [ $# -lt 2 ]; then
                log_error "No packages specified for --advanced-update" "apt-layer"
                show_usage
                exit 1
            fi

            shift
            local packages=("$@")

            # Initialize advanced package management system
            init_advanced_package_management_on_startup

            advanced_update_packages "${packages[@]}"
            ;;
        --add-user)
            # Add user to package management system
            if [ $# -lt 3 ]; then
                log_error "Username and role required for --add-user" "apt-layer"
                show_usage
                exit 1
            fi

            local username="$2"
            local role="$3"

            # Initialize advanced package management system
            init_advanced_package_management_on_startup

            add_package_user "$username" "$role"
            ;;
        --remove-user)
            # Remove user from package management system
            if [ $# -lt 2 ]; then
                log_error "Username required for --remove-user" "apt-layer"
                show_usage
                exit 1
            fi

            local username="$2"

            # Initialize advanced package management system
            init_advanced_package_management_on_startup

            remove_package_user "$username"
            ;;
        --list-users)
            # List package management users
            # Initialize advanced package management system
            init_advanced_package_management_on_startup

            list_package_users
            ;;
        --package-info)
            # Get advanced package information
            if [ $# -lt 2 ]; then
                log_error "Package name required for --package-info" "apt-layer"
                show_usage
                exit 1
            fi

            local package="$2"

            # Initialize advanced package management system
            init_advanced_package_management_on_startup

            get_advanced_package_info "$package"
            ;;
        --package-status)
            # List advanced package management status
            # Initialize advanced package management system
            init_advanced_package_management_on_startup

            list_advanced_package_status
            ;;
        --list-backups)
            # List package backups
            # Initialize advanced package management system
            init_advanced_package_management_on_startup

            list_package_backups
            ;;
        --cleanup-backups)
            # Clean up old backups
            local max_age_days="${2:-30}"
            
            # Initialize advanced package management system
            init_advanced_package_management_on_startup

            cleanup_old_backups "$max_age_days"
            ;;
        --generate-key)
            # Generate signing key pair
            if [ $# -lt 3 ]; then
                log_error "Key name and type required for --generate-key" "apt-layer"
                show_usage
                exit 1
            fi

            local key_name="$2"
            local key_type="$3"

            # Initialize layer signing system
            init_layer_signing_on_startup

            generate_signing_key_pair "$key_name" "$key_type"
            ;;
        --sign-layer)
            # Sign layer with specified key
            if [ $# -lt 3 ]; then
                log_error "Layer path and key name required for --sign-layer" "apt-layer"
                show_usage
                exit 1
            fi

            local layer_path="$2"
            local key_name="$3"

            # Initialize layer signing system
            init_layer_signing_on_startup

            sign_layer "$layer_path" "$key_name"
            ;;
        --verify-layer)
            # Verify layer signature
            if [ $# -lt 2 ]; then
                log_error "Layer path required for --verify-layer" "apt-layer"
                show_usage
                exit 1
            fi

            local layer_path="$2"

            # Initialize layer signing system
            init_layer_signing_on_startup

            verify_layer_signature "$layer_path" "$layer_path.sig"
            ;;
        --revoke-layer)
            # Revoke layer
            if [ $# -lt 2 ]; then
                log_error "Layer path required for --revoke-layer" "apt-layer"
                show_usage
                exit 1
            fi

            local layer_path="$2"
            local reason="${3:-Manual revocation}"

            # Initialize layer signing system
            init_layer_signing_on_startup

            revoke_layer "$layer_path" "$reason"
            ;;
        --list-keys)
            # List signing keys
            # Initialize layer signing system
            init_layer_signing_on_startup

            list_signing_keys
            ;;
        --list-signatures)
            # List layer signatures
            # Initialize layer signing system
            init_layer_signing_on_startup

            list_layer_signatures
            ;;
        --layer-status)
            # Get layer signing status
            if [ $# -lt 2 ]; then
                log_error "Layer path required for --layer-status" "apt-layer"
                show_usage
                exit 1
            fi

            local layer_path="$2"

            # Initialize layer signing system
            init_layer_signing_on_startup

            get_layer_signing_status "$layer_path"
            ;;
        --query-audit)
            # Query audit logs
            shift
            local query_params=("$@")

            # Initialize audit reporting system
            init_audit_reporting_on_startup

            query_audit_logs "${query_params[@]}"
            ;;
        --export-audit)
            # Export audit logs
            if [ $# -lt 2 ]; then
                log_error "Export format required for --export-audit" "apt-layer"
                show_usage
                exit 1
            fi

            local export_format="$2"
            local output_file="${3:-}"
            shift 3
            local filters=("$@")

            # Initialize audit reporting system
            init_audit_reporting_on_startup

            export_audit_logs "$export_format" "$output_file" "${filters[@]}"
            ;;
        --generate-compliance-report)
            # Generate compliance report
            if [ $# -lt 2 ]; then
                log_error "Framework required for --generate-compliance-report" "apt-layer"
                show_usage
                exit 1
            fi

            local framework="$2"
            local report_period="${3:-monthly}"
            local output_format="${4:-html}"

            # Initialize audit reporting system
            init_audit_reporting_on_startup

            generate_compliance_report "$framework" "$report_period" "$output_format"
            ;;
        --list-audit-reports)
            # List audit reports
            # Initialize audit reporting system
            init_audit_reporting_on_startup

            list_audit_reports
            ;;
        --audit-status)
            # Get audit system status
            # Initialize audit reporting system
            init_audit_reporting_on_startup

            get_audit_status
            ;;
        --cleanup-audit-logs)
            # Clean up old audit logs
            local max_age_days="${2:-90}"
            
            # Initialize audit reporting system
            init_audit_reporting_on_startup

            cleanup_old_audit_logs "$max_age_days"
            ;;
        --scan-package)
            # Scan package for vulnerabilities
            if [ $# -lt 2 ]; then
                log_error "Package name required for --scan-package" "apt-layer"
                show_usage
                exit 1
            fi
            local package_name="$2"
            local version="${3:-}"
            local scan_level="${4:-standard}"

            # Initialize security scanning system
            init_security_scanning_on_startup

            scan_package "$package_name" "$version" "$scan_level"
            ;;
        --scan-layer)
            # Scan layer for vulnerabilities
            if [ $# -lt 2 ]; then
                log_error "Layer path required for --scan-layer" "apt-layer"
                show_usage
                exit 1
            fi
            local layer_path="$2"
            local scan_level="${3:-standard}"

            # Initialize security scanning system
            init_security_scanning_on_startup

            scan_layer "$layer_path" "$scan_level"
            ;;
        --generate-security-report)
            # Generate security report
            if [ $# -lt 2 ]; then
                log_error "Type required for --generate-security-report" "apt-layer"
                show_usage
                exit 1
            fi
            local report_type="$2"
            local output_format="${3:-html}"
            local scan_level="${4:-standard}"

            # Initialize security scanning system
            init_security_scanning_on_startup

            generate_security_report "$report_type" "$output_format" "$scan_level"
            ;;
        --security-status)
            # Show security scanning system status
            # Initialize security scanning system
            init_security_scanning_on_startup

            get_security_status
            ;;
        --update-cve-database)
            # Update CVE database from NVD
            # Initialize security scanning system
            init_security_scanning_on_startup

            update_cve_database
            ;;
        --cleanup-security-reports)
            # Clean up old security reports
            local max_age_days="${2:-90}"
            
            # Initialize security scanning system
            init_security_scanning_on_startup

            cleanup_old_security_reports "$max_age_days"
            ;;
        admin)
            # Admin utilities
            if [ -z "${2:-}" ]; then
                log_error "Action required for admin" "apt-layer"
                show_usage
                exit 1
            fi
            local action="$2"
            shift 2
            local args=("$@")
            
            admin_utilities_main "$action" "${args[@]}"
            ;;
        tenant)
            # Multi-tenant management
            if [ -z "${2:-}" ]; then
                log_error "Action required for tenant" "apt-layer"
                show_usage
                exit 1
            fi
            local action="$2"
            shift 2
            local args=("$@")
            
            handle_multi_tenant_command "$action" "${args[@]}"
            ;;
        compliance)
            # Advanced compliance frameworks
            if [ -z "${2:-}" ]; then
                log_error "Action required for compliance" "apt-layer"
                show_usage
                exit 1
            fi
            local action="$2"
            shift 2
            local args=("$@")
            
            handle_compliance_command "$action" "${args[@]}"
            ;;
        enterprise)
            # Enterprise integration
            if [ -z "${2:-}" ]; then
                log_error "Action required for enterprise" "apt-layer"
                show_usage
                exit 1
            fi
            local action="$2"
            shift 2
            local args=("$@")
            
            handle_enterprise_integration_command "$action" "${args[@]}"
            ;;
        monitoring)
            # Advanced monitoring and alerting
            if [ -z "${2:-}" ]; then
                log_error "Action required for monitoring" "apt-layer"
                show_usage
                exit 1
            fi
            local action="$2"
            shift 2
            local args=("$@")
            
            handle_monitoring_command "$action" "${args[@]}"
            ;;
        cloud)
            # Cloud integration
            if [ -z "${2:-}" ]; then
                log_error "Action required for cloud" "apt-layer"
                show_usage
                exit 1
            fi
            local action="$2"
            shift 2
            local args=("$@")
            
            handle_cloud_command "$action" "${args[@]}"
            ;;
        kubernetes|k8s)
            # Kubernetes integration
            if [ -z "${2:-}" ]; then
                log_error "Action required for kubernetes" "apt-layer"
                show_usage
                exit 1
            fi
            local action="$2"
            shift 2
            local args=("$@")
            
            handle_kubernetes_command "$action" "${args[@]}"
            ;;
        --dpkg-install)
            # Direct dpkg installation
            if [ $# -lt 2 ]; then
                log_error "No packages specified for --dpkg-install" "apt-layer"
                show_usage
                exit 1
            fi

            shift
            local packages=("$@")

            dpkg_direct_install "${packages[@]}"
            ;;
        --container-dpkg)
            # Container-based dpkg installation
            if [ $# -lt 4 ]; then
                log_error "Insufficient arguments for --container-dpkg" "apt-layer"
                show_usage
                exit 1
            fi

            local base_image="$2"
            local new_image="$3"
            shift 3
            local packages=("$@")

            # Initialize container system
            if ! init_container_system; then
                log_error "Failed to initialize container system" "apt-layer"
                exit 1
            fi

            # Create container-based layer with dpkg
            if ! container_dpkg_install "$base_image" "$new_image" "${packages[@]}"; then
                log_error "Container-based dpkg layer creation failed" "apt-layer"
                exit 1
            fi

            log_success "Container-based dpkg layer created: $new_image" "apt-layer"
            ;;
        --live-dpkg)
            # Live system dpkg installation
            if [ $# -lt 2 ]; then
                log_error "No packages specified for --live-dpkg" "apt-layer"
                show_usage
                exit 1
            fi

            shift
            local packages=("$@")

            live_dpkg_install "${packages[@]}"
            ;;
        *)
            # Check for empty argument
            if [ -z "${1:-}" ]; then
                log_error "No arguments provided" "apt-layer"
                show_usage
                exit 1
            fi
            
            # Regular layer creation
            if [ $# -lt 2 ]; then
                log_error "Insufficient arguments" "apt-layer"
                show_usage
                exit 1
            fi

            local base_image="$1"
            local new_image="$2"
            shift 2
            local packages=("$@")

            create_layer "$base_image" "$new_image" "${packages[@]}"
            ;;
    esac
}

# Run main function
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
    main "$@"
fi 

# --- END OF SCRIPTLET: 99-main.sh ---

# ============================================================================
# Embedded Configuration Files
# ============================================================================

# Enterprise-grade JSON configuration system
# All configuration files are embedded for self-contained operation
# Configuration can be overridden via command-line arguments

# Configuration files to be embedded:
#   - apt-layer-settings.json
#   - audit-settings.json
#   - backup-policy.json
#   - maintenance.json
#   - oci-settings.json
#   - package-management.json
#   - security-policy.json
#   - signing-policy.json
#   - users.json

# Embedded configuration: apt-layer-settings
# File size: 308
APT_LAYER_SETTINGS_CONFIG=$(cat << 'EOF'
{
  "default_container_runtime": "podman",
  "default_workspace": "/var/lib/ubuntu-ublue",
  "feature_toggles": {
    "live_overlay": true,
    "oci_integration": true,
    "security_scanning": true,
    "audit_reporting": true,
    "layer_signing": true
  },
  "log_level": "info",
  "color_output": true
}
EOF
)

# Embedded configuration: audit-settings
# File size: 166
AUDIT_SETTINGS_CONFIG=$(cat << 'EOF'
{
  "log_retention_days": 90,
  "remote_log_endpoint": "https://audit.example.com/submit",
  "compliance_frameworks": [
    "SOX",
    "PCI-DSS"
  ],
  "log_verbosity": "info"
}
EOF
)

# Embedded configuration: backup-policy
# File size: 159
BACKUP_POLICY_CONFIG=$(cat << 'EOF'
{
  "backup_frequency": "weekly",
  "retention_days": 60,
  "compression": true,
  "encryption": false,
  "backup_location": "/var/lib/ubuntu-ublue/backups"
}
EOF
)

# Embedded configuration: maintenance
# File size: 191
MAINTENANCE_CONFIG=$(cat << 'EOF'
{
  "retention_days": 30,
  "keep_recent": 2,
  "deployments_dir": "/var/lib/ubuntu-ublue/deployments",
  "logs_dir": "/var/log/apt-layer",
  "backups_dir": "/var/lib/ubuntu-ublue/backups"
}
EOF
)

# Embedded configuration: oci-settings
# File size: 193
OCI_SETTINGS_CONFIG=$(cat << 'EOF'
{
  "registry_url": "docker.io/particleos",
  "allowed_base_images": [
    "ubuntu:24.04",
    "debian:12"
  ],
  "authentication": {
    "username": "particlebot",
    "password": "examplepassword"
  }
}
EOF
)

# Embedded configuration: package-management
# File size: 180
PACKAGE_MANAGEMENT_CONFIG=$(cat << 'EOF'
{
  "allowed_repositories": [
    "main",
    "universe",
    "multiverse"
  ],
  "dependency_resolution": "strict",
  "package_pinning": {
    "firefox": "125.0.1",
    "steam": "1.0.0.75"
  }
}
EOF
)

# Embedded configuration: security-policy
# File size: 197
SECURITY_POLICY_CONFIG=$(cat << 'EOF'
{
  "require_gpg_signature": true,
  "allowed_packages": [
    "firefox",
    "steam",
    "vscode"
  ],
  "blocked_packages": [
    "telnet",
    "ftp"
  ],
  "vulnerability_threshold": "high",
  "enforce_signature": true
}
EOF
)

# Embedded configuration: signing-policy
# File size: 166
SIGNING_POLICY_CONFIG=$(cat << 'EOF'
{
  "allowed_methods": [
    "gpg",
    "sigstore"
  ],
  "trusted_keys": [
    "key1.gpg",
    "key2.sigstore"
  ],
  "require_signature": true,
  "revocation_list": [
    "revoked-key1.gpg"
  ]
}
EOF
)

# Embedded configuration: users
# File size: 264
USERS_CONFIG=$(cat << 'EOF'
{
  "users": [
    {
      "username": "admin",
      "role": "admin",
      "enabled": true
    },
    {
      "username": "john",
      "role": "package_manager",
      "enabled": true
    },
    {
      "username": "jane",
      "role": "viewer",
      "enabled": false
    }
  ],
  "roles": [
    "admin",
    "package_manager",
    "viewer"
  ]
}
EOF
)

# ============================================================================
# External Configuration Loading (Future Enhancement)
# ============================================================================

# Function to load configuration from external files
# Usage: load_config_from_file "config-name"
load_config_from_file() {
    local config_name="$1"
    local config_file="/etc/apt-layer/config/${config_name}.json"
    if [[ -f "$config_file" ]]; then
        jq -r '.' "$config_file"
    else
        log_error "Configuration file not found: $config_file" "apt-layer"
        exit 1
    fi
}

# ============================================================================
# Main Execution
# ============================================================================

# Run main function if script is executed directly
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
    main "$@"
fi