{% extends "base.html" %}
{% block title %}{{ "Edit" if mode == "edit" else "New" }} manifest · ai-protect{% endblock %}
{% block autorefresh %}window.AI_PROTECT_NO_AUTOREFRESH = true;{% endblock %}

{% macro select(name, options, current, allow_blank=False) %}
  <select name="{{ name }}" id="{{ name }}">
    {% if allow_blank %}<option value=""></option>{% endif %}
    {% for opt in options %}
      <option value="{{ opt }}" {% if current == opt %}selected{% endif %}>{{ opt }}</option>
    {% endfor %}
  </select>
{% endmacro %}

{% block content %}
  <a class="back" href="{{ url_for('manifests') }}">← back to manifests</a>
  <h1>
    {% if mode == "edit" %}Edit manifest <span class="mono">{{ original_name }}</span>
    {% else %}New manifest{% endif %}
  </h1>

  {% if errors %}
    <div class="alert alert-error">
      <strong>Validation errors:</strong>
      <ul>
        {% for e in errors %}<li>{{ e }}</li>{% endfor %}
      </ul>
    </div>
  {% endif %}
  {% if warnings %}
    <div class="alert alert-warn">
      <strong>Warnings (saved anyway):</strong>
      <ul>
        {% for w in warnings %}<li>{{ w }}</li>{% endfor %}
      </ul>
    </div>
  {% endif %}

  <form method="POST" class="manifest-form" id="manifest-form"
        action="{{ url_for('manifest_edit', name=original_name) if mode == 'edit' else url_for('manifest_new') }}">

    {# A tiny helper macro keeps the help-bubble pattern uniform across the
       form. Anchors land at /docs#manifest-<key>. #}
    {% macro hb(anchor, tooltip) -%}
      <a href="{{ url_for('docs_page') }}#{{ anchor }}" class="help-bubble"
         title="{{ tooltip }}" target="_blank" rel="noopener">?</a>
    {%- endmacro %}

    <fieldset class="form-fs">
      <legend>Identity</legend>
      <div class="form-grid">
        <label class="form-row">
          <span>Name <span class="req">*</span> {{ hb('manifest-name', 'Lower-case identifier — becomes the YAML filename and the app_name on every finding. Keep stable.') }}</span>
          <input type="text" name="name" required pattern="[A-Za-z][A-Za-z0-9_-]{1,63}"
                 placeholder="e.g. Example-Commercial or example-commercial"
                 value="{{ form.get('name', '') }}">
          <small class="form-help">Letters (mixed case OK), digits, dashes, underscores; starts with a letter. This is the YAML filename and the <code>app_name</code> on every finding — keep it stable. Names that differ only by case are refused on save (collide on case-insensitive filesystems).</small>
        </label>
        <label class="form-row">
          <span>Owner email <span class="req">*</span> {{ hb('manifest-owner', 'Accountable owner. Receives findings notifications.') }}</span>
          <input type="email" name="owner" required
                 placeholder="you@example.com"
                 value="{{ form.get('owner', '') }}">
          <small class="form-help">Accountable owner of the app. Receives findings notifications.</small>
        </label>
        <label class="form-row">
          <span>On-call email {{ hb('manifest-owner', 'Paged when blocking gates trip during a release. Defaults to Owner.') }}</span>
          <input type="email" name="on_call"
                 placeholder="oncall@example.com (defaults to Owner)"
                 value="{{ form.get('on_call', '') }}">
          <small class="form-help">Optional — defaults to the Owner if blank.</small>
        </label>
        <label class="form-row span-2">
          <span>Description {{ hb('manifest-description', 'Free-text. What the app does + security shape. Tokenized by intel_match to find relevant CVE feeds.') }}</span>
          <textarea name="description" rows="3" placeholder="What does this app do, what's the security shape?">{{ form.get('description', '') }}</textarea>
        </label>
      </div>
    </fieldset>

    <fieldset class="form-fs">
      <legend>
        Risk tiering (v2.1 four-dimension scoring)
        {{ hb('manifest-data-sensitivity', 'Each dimension scores 1-4 (riskier higher). Sum + forced rules → Tier 1-4. Use "all" if your app spans every value in a dimension; it resolves to the most-restrictive value.') }}
      </legend>
      <div class="form-grid form-grid-4">
        <label class="form-row">
          <span>Data sensitivity {{ hb('manifest-data-sensitivity', 'Most-sensitive data class the app touches. PHI forces Tier 1.') }}</span>
          {{ select('data_sensitivity', options.data_sensitivity, form.get('data_sensitivity')) }}
          <small class="form-help"><strong>all</strong> = app handles multiple classes (e.g. PHI + PII); resolves to <em>phi</em> for tiering. <strong>phi</strong> forces Tier 1. <strong>pii</strong>/<strong>financial</strong> = 3/4. <strong>confidential</strong> = 2/4. <strong>public</strong> = 1/4.</small>
        </label>
        <label class="form-row">
          <span>Decision impact {{ hb('manifest-decision-impact', 'What the worst possible model output could cause. clinical_influence forces Tier 1.') }}</span>
          {{ select('decision_impact', options.decision_impact, form.get('decision_impact')) }}
          <small class="form-help"><strong>all</strong> → resolves to <em>irreversible</em>. <strong>irreversible</strong> = uncorrectable downstream (4/4). <strong>clinical_influence</strong> forces Tier 1. <strong>automated_action</strong> = downstream effect but recoverable (3/4). <strong>advisory</strong> = a human decides whether to act (1/4).</small>
        </label>
        <label class="form-row">
          <span>Integration footprint {{ hb('manifest-integration-footprint', 'How much the app reaches into other systems.') }}</span>
          {{ select('integration_footprint', options.integration_footprint, form.get('integration_footprint')) }}
          <small class="form-help"><strong>all</strong> → resolves to <em>external_action</em>. <strong>external_action</strong> = third-party API calls (4/4). <strong>agent_tool_use</strong> = model invokes tools/MCPs (3/4). <strong>write_back</strong> = writes to a system of record (3/4). <strong>read_only</strong> = pure inference (1/4).</small>
        </label>
        <label class="form-row">
          <span>User population {{ hb('manifest-user-population', 'Who can talk to the app. external + non-advisory forces Tier 1.') }}</span>
          {{ select('user_population', options.user_population, form.get('user_population')) }}
          <small class="form-help"><strong>all</strong> → resolves to <em>external</em>. <strong>external</strong> = public/customers/partners (4/4). <strong>enterprise</strong>/<strong>team</strong> = internal (2/4). <strong>single_user</strong> = only the owner (1/4). external + non-advisory forces Tier 1.</small>
        </label>
      </div>
      <div class="tier-preview-block">
        Live preview:
        <span id="tier-preview" class="tier-badge tier-3">T?</span>
        <span id="tier-preview-rationale" class="small muted"></span>
        <a href="{{ url_for('docs_page') }}#manifest-fields" target="_blank" rel="noopener"
           class="small" style="margin-left:10px">More on what these mean →</a>
      </div>
    </fieldset>

    <fieldset class="form-fs">
      <legend>Scan scope {{ hb('manifest-source-paths', 'Where SAST/SCA/IaC adapters look on disk. Optional when source_provider=github (the orchestrator sets it after cloning).') }}</legend>
      <label class="form-row">
        <span>Source paths {{ hb('manifest-source-paths', 'One path per line. Every SAST/SCA adapter scans these. Leave blank when using the GitHub source provider — it materializes the repo and sets this automatically.') }}</span>
        {# Pre-fill priority:
             1. source_paths (canonical, plural — what the form writes back)
             2. source_path  (legacy singular — every existing manifest in
                pipeline/manifests uses this form, so we have to surface it
                or editing pre-existing manifests starts with a blank field).
           NOT required: the validator only checks individual entries are
           non-empty; an empty list is accepted (matters for github source
           provider, which materializes paths at scan time). #}
        {% set _existing_paths = form.get('source_paths') or ([form.get('source_path')] if form.get('source_path') else []) %}
        <textarea name="source_paths" id="source_paths" rows="4"
                  placeholder="/home/user/ExampleAdsApp/commercial&#10;/home/user/ExampleAdsApp/ads-studio">{% for p in _existing_paths %}{{ p }}
{% endfor %}</textarea>
        <small class="form-help">
          One path per line. Each is scanned by every SAST/SCA adapter the policy table assigns to this tier × stage; findings from all paths are aggregated.
          Leave blank when using the GitHub source provider.
          <button type="button" class="btn-link" id="browse-btn">⇲ Browse for a path…</button>
        </small>
      </label>
      <label class="form-row">
        <span>Source excludes {{ hb('manifest-source-excludes', 'One pattern per line. Drops findings whose path matches an absolute prefix, a glob (*.pyc), or a substring (__pycache__).') }}</span>
        <textarea name="source_excludes" rows="4"
                  placeholder="__pycache__&#10;node_modules&#10;*.pyc&#10;/opt/secrets/">{% for e in (form.get('source_excludes') or []) %}{{ e }}
{% endfor %}</textarea>
        <small class="form-help">
          One pattern per line. Drops findings post-hoc whose path matches:
          <code>/abs/prefix</code> (absolute prefix), <code>*.pyc</code> (glob), or
          <code>__pycache__</code> (substring of path). Common defaults
          (<code>__pycache__</code>, <code>node_modules</code>, <code>.git</code>, <code>*.pyc</code>)
          are already skipped by most adapters.
        </small>
      </label>
      <label class="form-row">
        <span>App aliases (inherit remediation history) {{ hb('manifest-app-aliases', 'Previous app names this manifest inherits resolution history from. Used when an app was renamed and you want resolved Changes from the old name to apply to this app.') }}</span>
        <textarea name="app_aliases" rows="2"
                  placeholder="ads-automation">{% for a in (form.get('app_aliases') or []) %}{{ a }}
{% endfor %}</textarea>
        <small class="form-help">
          One previous <code>app_name</code> per line. When this manifest
          inherits findings from a renamed predecessor (e.g. <code>opt_ads</code> →
          <code>example_ads_studio</code>), list the old <code>name</code>(s) here so the
          dashboard treats this app's same logical findings (same adapter +
          category + title) as resolved when the predecessor's Change has
          been applied. Re-keys fingerprints into this app's namespace at
          view time — no data is modified on disk.
        </small>
      </label>
    </fieldset>

    <fieldset class="form-fs">
      <legend>Source provider</legend>
      <small class="form-help" style="display:block;margin-bottom:8px">
        Where ai-protect fetches code from before scanning. Leave blank to use the global default set on <a href="{{ url_for('settings_page') }}">Settings → Source providers</a>. Override per-manifest by picking a provider explicitly.
      </small>
      <div class="form-grid">
        <label class="form-row">
          <span>Provider
            <a href="{{ url_for('docs_page') }}#source-default-provider"
               class="help-bubble" title="local = read source_paths from disk. github = clone the repo before each scan." target="_blank" rel="noopener">?</a>
          </span>
          <select name="source_provider" id="source_provider" data-reveal-controller="1">
            <option value="" {% if not form.get('source_provider') %}selected{% endif %}>— use global default —</option>
            <option value="local" {% if form.get('source_provider') == 'local' %}selected{% endif %}>local</option>
            <option value="github" {% if form.get('source_provider') == 'github' %}selected{% endif %}>github</option>
          </select>
          <small class="form-help">
            <strong>local</strong> — scan the paths listed under <em>Scan scope</em> above. No clone.
            <strong>github</strong> — shallow-clone the repo below before each scan, set Scan scope to the materialized path automatically.
          </small>
        </label>
      </div>

      <div class="form-grid" id="github-fields"
           style="{% if form.get('source_provider') != 'github' %}display:none{% endif %}">
        <label class="form-row">
          <span>GitHub repo
            <a href="{{ url_for('docs_page') }}#source-github-base-url"
               class="help-bubble" title="owner/name, full https URL, or git@github.com:owner/name.git" target="_blank" rel="noopener">?</a>
          </span>
          <input type="text" name="github_repo"
                 placeholder="anchore/syft"
                 value="{{ form.get('github_repo') or '' }}">
          <small class="form-help">
            Accepts <code>owner/name</code>, a full HTTPS URL (<code>https://github.com/owner/name</code>), or SSH-style (<code>git@github.com:owner/name.git</code>). For GHES the base URL configured on <a href="{{ url_for('settings_page') }}">/settings</a> is used automatically.
          </small>
        </label>
        <label class="form-row">
          <span>Ref (branch / tag / SHA)
            <a href="{{ url_for('docs_page') }}#source-github-default-ref"
               class="help-bubble" title="Branch / tag / SHA to checkout. Leave blank to use the settings default." target="_blank" rel="noopener">?</a>
          </span>
          <input type="text" name="github_ref"
                 placeholder="main (blank = use settings default)"
                 value="{{ form.get('github_ref') or '' }}">
          <small class="form-help">
            Branch name (<code>main</code>, <code>develop</code>), tag (<code>v1.2.0</code>), or commit SHA (7+ hex chars — provider detects and uses explicit checkout). Empty = settings <em>Default ref</em>.
          </small>
        </label>
        <label class="form-row">
          <span>Clone depth
            <a href="{{ url_for('docs_page') }}#source-github-clone-depth"
               class="help-bubble" title="1 = shallow (recommended). 0 = full history (only needed for adapters that walk git history)." target="_blank" rel="noopener">?</a>
          </span>
          <input type="number" name="github_clone_depth" min="0" step="1"
                 placeholder="1 (blank = use settings default)"
                 value="{{ form.get('github_clone_depth') if form.get('github_clone_depth') not in (none, '') else '' }}">
          <small class="form-help">
            <code>1</code> = shallow clone (fastest, sufficient for SAST). <code>0</code> = full history. Empty = settings default.
          </small>
        </label>
      </div>
      <div style="margin-top:8px; padding:8px 12px; border-left:3px solid #9ec5ea; background:#0c1421; color:#e6edf5; border-radius:4px">
        <small>
          <strong>Tip:</strong> when <em>Provider = github</em>, Scan scope's <em>Source paths</em> field above is overridden at scan time — the orchestrator materializes the repo to a temp dir (or a persistent cache, per Settings → Clone strategy) and points adapters there. You can still leave Source paths blank.
        </small>
      </div>
    </fieldset>

    <fieldset class="form-fs">
      <legend>Model endpoints (optional) {{ hb('manifest-models', 'Every model the app sends prompts to. PHI handling requires via_gateway=true AND baa_covered=true on every model.') }}</legend>
      <small class="form-help" style="display:block;margin-bottom:8px">
        Each model the app sends prompts to. PHI requires <code>via_gateway=true</code> AND <code>baa_covered=true</code> — manifest validation rejects otherwise.
      </small>
      <div id="models-list" data-prefix="model">
        {% for m in (form.get('models') or []) %}
          {% set i = loop.index0 %}
          <div class="repeat-row">
            <label><input type="text" name="model-{{i}}-name" placeholder="name" value="{{ m.name }}"></label>
            <label><input type="text" name="model-{{i}}-provider" placeholder="provider" value="{{ m.provider }}"></label>
            <label><input type="text" name="model-{{i}}-model" placeholder="model id" value="{{ m.model }}"></label>
            <label><input type="text" name="model-{{i}}-auth_env" placeholder="AUTH_ENV" value="{{ m.auth_env or '' }}"></label>
            <label class="cb"><input type="checkbox" name="model-{{i}}-via_gateway" {% if m.via_gateway %}checked{% endif %}> via gateway</label>
            <label class="cb"><input type="checkbox" name="model-{{i}}-baa_covered" {% if m.baa_covered %}checked{% endif %}> BAA covered</label>
            <button type="button" class="btn-link repeat-remove">remove</button>
          </div>
        {% endfor %}
      </div>
      <button type="button" class="btn btn-secondary btn-sm" id="add-model">+ Add model</button>
    </fieldset>

    <fieldset class="form-fs">
      <legend>MCP servers (optional) {{ hb('manifest-mcp-servers', 'MCPs the app calls as tools. The app inherits the most-restrictive tier across its MCPs — a Tier 4 app that calls a Tier 1 MCP is classified Tier 1.') }}</legend>
      <small class="form-help" style="display:block;margin-bottom:8px">
        MCPs the app calls. Tier inheritance: the app's tier is at least as restrictive as the most-restrictive MCP it uses.
      </small>
      <div id="mcps-list" data-prefix="mcp">
        {% for s in (form.get('mcp_servers') or []) %}
          {% set i = loop.index0 %}
          <div class="repeat-row">
            <label><input type="text" name="mcp-{{i}}-name" placeholder="name" value="{{ s.name }}"></label>
            <label><input type="number" name="mcp-{{i}}-tier" min="1" max="4" value="{{ s.tier }}"></label>
            <label><input type="text" name="mcp-{{i}}-data_scope" placeholder="data scope" value="{{ s.data_scope }}"></label>
            <label><input type="text" name="mcp-{{i}}-actions" placeholder="action1, action2" value="{{ (s.actions or [])|join(', ') }}"></label>
            <label>
              <select name="mcp-{{i}}-side_effects">
                {% for opt in options.side_effects %}
                  <option value="{{ opt }}" {% if s.side_effects == opt %}selected{% endif %}>{{ opt }}</option>
                {% endfor %}
              </select>
            </label>
            <label class="cb"><input type="checkbox" name="mcp-{{i}}-third_party" {% if s.third_party %}checked{% endif %}> third-party</label>
            <button type="button" class="btn-link repeat-remove">remove</button>
          </div>
        {% endfor %}
      </div>
      <button type="button" class="btn btn-secondary btn-sm" id="add-mcp">+ Add MCP</button>
    </fieldset>

    <fieldset class="form-fs">
      <legend>Surfaces (attacker-controlled inputs) {{ hb('manifest-surfaces', 'Where untrusted input enters the app. The more surfaces, the larger the prompt-injection attack surface — adapters like garak / pyrit probe these.') }}</legend>
      <div class="form-grid form-grid-3">
        <label class="cb"><input type="checkbox" name="surface_user_chat" {% if form.get('surfaces', {}).get('has_user_chat') %}checked{% endif %}> user chat</label>
        <label class="cb"><input type="checkbox" name="surface_email" {% if form.get('surfaces', {}).get('has_email_intake') %}checked{% endif %}> email intake</label>
        <label class="cb"><input type="checkbox" name="surface_doc" {% if form.get('surfaces', {}).get('has_document_ingest') %}checked{% endif %}> document ingest</label>
        <label class="cb"><input type="checkbox" name="surface_webhook" {% if form.get('surfaces', {}).get('has_webhook') %}checked{% endif %}> webhook</label>
        <label class="cb"><input type="checkbox" name="surface_voice" {% if form.get('surfaces', {}).get('has_voice') %}checked{% endif %}> voice</label>
      </div>
    </fieldset>

    <fieldset class="form-fs">
      <legend>Target environment {{ hb('manifest-target', 'Where DAST scans (ZAP, nuclei, sqlmap, mcp_scope) reach. Also gates state-changing adapters via allow_mutation.') }}</legend>
      <div class="form-grid">
        <label class="form-row">
          <span>Base URL {{ hb('manifest-target', 'Primary HTTP endpoint. DAST scans target this URL.') }}</span>
          <input type="text" name="target_base_url" placeholder="https://example.com" value="{{ form.get('target', {}).get('base_url') or '' }}">
        </label>
        <label class="form-row">
          <span>API URL {{ hb('manifest-target', 'Separate API endpoint if it differs from the base URL.') }}</span>
          <input type="text" name="target_api_url" placeholder="https://example.com/api/" value="{{ form.get('target', {}).get('api_url') or '' }}">
        </label>
        <label class="form-row">
          <span>Test user token env var {{ hb('manifest-target', 'Env-var name holding a low-privilege test credential. When set, mcp_scope performs a live forbidden-action probe; otherwise static checks only.') }}</span>
          <input type="text" name="target_test_user_token_env" placeholder="TEST_TOKEN" value="{{ form.get('target', {}).get('test_user_token_env') or '' }}">
          <small class="form-help">If set, mcp_scope probes a forbidden action live.</small>
        </label>
        <label class="cb">
          <input type="checkbox" name="target_allow_mutation" {% if form.get('target', {}).get('allow_mutation') %}checked{% endif %}>
          Allow mutation {{ hb('manifest-target', 'Required true for any adapter that modifies state: Burp active, ZAP active, sqlmap, atomic, caldera, metasploit, ride. Default off.') }}
          <small class="form-help">Required for active DAST + atomic / caldera / metasploit exploits + ride.</small>
        </label>
        <label class="form-row span-2">
          <span>Network allowed zones {{ hb('manifest-target', 'CIDR list that pre-approves internal-IP DAST scans for THIS app. Lifts the default refusal of RFC1918/loopback/etc. when the resolved IP is in one of these CIDRs.') }}</span>
          <textarea name="target_network_allowed_zones" rows="2" placeholder="one zone per line">{% for z in (form.get('target', {}).get('network_allowed_zones') or []) %}{{ z }}
{% endfor %}</textarea>
        </label>
      </div>
    </fieldset>

    <fieldset class="form-fs">
      <legend>Expected behavior (optional) {{ hb('manifest-expected', 'Ground-truth allow-lists. Anything outside these sets is flagged as a scope violation by mcp_scope.') }}</legend>
      <div class="form-grid">
        <label class="form-row">
          <span>Expected actions {{ hb('manifest-expected', 'Allow-list of action / tool names the app is authorized to invoke.') }}</span>
          <textarea name="expected_actions" rows="3" placeholder="one action per line">{% for a in (form.get('expected_actions') or []) %}{{ a }}
{% endfor %}</textarea>
          <small class="form-help">Ground-truth allow-list. Anything an MCP exposes outside this set is a scope violation.</small>
        </label>
        <label class="form-row">
          <span>Expected data scopes {{ hb('manifest-expected', 'Allow-list of data classifications the app is authorized to access. Outside-scope reads are flagged.') }}</span>
          <textarea name="expected_data_scopes" rows="3" placeholder="one scope per line">{% for s in (form.get('expected_data_scopes') or []) %}{{ s }}
{% endfor %}</textarea>
        </label>
        <label class="form-row span-2">
          <span>Threat model path {{ hb('manifest-threat-model', 'Required for Tier 1/2 at the design stage. See pipeline/fixtures/clinical_assistant_threat_model.yml for the shape.') }}</span>
          <input type="text" name="threat_model_path" placeholder="pipeline/fixtures/your_threat_model.yml" value="{{ form.get('threat_model_path') or '' }}">
          <small class="form-help">Required for Tier 1/2 at design stage.</small>
        </label>
        <label class="form-row span-2">
          <span>Guardrails path {{ hb('manifest-guardrails', 'NeMo Guardrails config. Required for Tier 1/2. See pipeline/fixtures/clinical_assistant_guardrails.yml for the shape.') }}</span>
          <input type="text" name="guardrails_path" placeholder="pipeline/fixtures/your_guardrails.yml" value="{{ form.get('guardrails_path') or '' }}">
          <small class="form-help">Required for Tier 1/2. The <code>guardrails</code> adapter fails the gate if missing.</small>
        </label>
      </div>
    </fieldset>

    <div class="form-actions">
      <button type="submit" class="btn btn-primary">{{ "Save changes" if mode == "edit" else "Create manifest" }}</button>
      <a href="{{ url_for('manifests') }}" class="btn btn-secondary">Cancel</a>
      {% if mode == "edit" %}
        <button type="button" class="btn btn-danger" id="delete-btn"
                data-name="{{ original_name }}"
                style="margin-left:auto">Delete manifest</button>
      {% endif %}
    </div>
  </form>

  <!-- Browse modal -->
  <div id="browse-modal" class="modal" hidden>
    <div class="modal-card">
      <div class="modal-header">
        <h3>Pick a source path</h3>
        <button type="button" class="btn-link" id="browse-close">✕</button>
      </div>
      <div class="modal-body">
        <div id="browse-roots" class="browse-roots"></div>
        <div class="browse-path mono small" id="browse-current">~</div>
        <ul id="browse-list" class="browse-list"></ul>
      </div>
      <div class="modal-footer">
        <button type="button" class="btn btn-primary" id="browse-pick">Use this directory</button>
        <button type="button" class="btn btn-secondary" id="browse-up">↑ Up</button>
        <button type="button" class="btn btn-secondary" id="browse-cancel">Cancel</button>
      </div>
    </div>
  </div>

  <script>
  (function() {
    // ---- Tier preview ----
    const tierFields = ['data_sensitivity', 'decision_impact', 'integration_footprint', 'user_population'];
    const tierEl = document.getElementById('tier-preview');
    const tierRat = document.getElementById('tier-preview-rationale');
    async function refreshTier() {
      const params = new URLSearchParams();
      for (const f of tierFields) {
        const v = document.getElementById(f).value;
        if (v) params.set(f, v);
      }
      try {
        const r = await fetch('/api/tier/preview?' + params.toString());
        const d = await r.json();
        if (d.error) return;
        tierEl.textContent = 'T' + d.tier;
        tierEl.className = 'tier-badge tier-' + d.tier;
        const forced = d.forced_to_tier_1 ? ' (FORCED — ' + d.forced_reason + ')' : '';
        tierRat.textContent = 'score=' + d.score + forced;
      } catch (e) { /* ignore */ }
    }
    for (const f of tierFields) {
      const el = document.getElementById(f);
      if (el) el.addEventListener('change', refreshTier);
    }
    refreshTier();

    // ---- Repeat-row helpers ----
    function reindex(container, prefix) {
      const rows = container.querySelectorAll(':scope > .repeat-row');
      rows.forEach((row, i) => {
        row.querySelectorAll('[name]').forEach(el => {
          el.name = el.name.replace(new RegExp('^' + prefix + '-\\d+-'), prefix + '-' + i + '-');
        });
      });
    }
    function bindRow(row, container, prefix) {
      const btn = row.querySelector('.repeat-remove');
      if (btn) btn.addEventListener('click', () => {
        row.remove();
        reindex(container, prefix);
      });
    }
    document.querySelectorAll('.repeat-row').forEach(r => {
      const container = r.parentElement;
      const prefix = container.dataset.prefix;
      bindRow(r, container, prefix);
    });

    function addModelRow() {
      const container = document.getElementById('models-list');
      const i = container.children.length;
      const div = document.createElement('div');
      div.className = 'repeat-row';
      div.innerHTML = `
        <label><input type="text" name="model-${i}-name" placeholder="name"></label>
        <label><input type="text" name="model-${i}-provider" placeholder="provider"></label>
        <label><input type="text" name="model-${i}-model" placeholder="model id"></label>
        <label><input type="text" name="model-${i}-auth_env" placeholder="AUTH_ENV"></label>
        <label class="cb"><input type="checkbox" name="model-${i}-via_gateway"> via gateway</label>
        <label class="cb"><input type="checkbox" name="model-${i}-baa_covered"> BAA covered</label>
        <button type="button" class="btn-link repeat-remove">remove</button>`;
      container.appendChild(div);
      bindRow(div, container, 'model');
    }
    document.getElementById('add-model').addEventListener('click', addModelRow);

    function addMcpRow() {
      const container = document.getElementById('mcps-list');
      const i = container.children.length;
      const opts = {{ options.side_effects | tojson }};
      const sel = opts.map(o => `<option value="${o}">${o}</option>`).join('');
      const div = document.createElement('div');
      div.className = 'repeat-row';
      div.innerHTML = `
        <label><input type="text" name="mcp-${i}-name" placeholder="name"></label>
        <label><input type="number" name="mcp-${i}-tier" min="1" max="4" value="2"></label>
        <label><input type="text" name="mcp-${i}-data_scope" placeholder="data scope"></label>
        <label><input type="text" name="mcp-${i}-actions" placeholder="action1, action2"></label>
        <label><select name="mcp-${i}-side_effects">${sel}</select></label>
        <label class="cb"><input type="checkbox" name="mcp-${i}-third_party"> third-party</label>
        <button type="button" class="btn-link repeat-remove">remove</button>`;
      container.appendChild(div);
      bindRow(div, container, 'mcp');
    }
    document.getElementById('add-mcp').addEventListener('click', addMcpRow);

    // ---- Browse modal ----
    const modal = document.getElementById('browse-modal');
    const list = document.getElementById('browse-list');
    const roots = document.getElementById('browse-roots');
    const current = document.getElementById('browse-current');
    const sourceTextarea = document.getElementById('source_paths');
    let currentPath = '~';

    async function loadBrowse(path) {
      const r = await fetch('/api/browse?path=' + encodeURIComponent(path));
      const d = await r.json();
      currentPath = d.path || path;
      current.textContent = currentPath;
      list.innerHTML = (d.dirs || []).map(x =>
        `<li><button type="button" class="browse-entry" data-path="${x.path}">📁 ${x.name}</button></li>`
      ).join('') || '<li class="small muted">(no subdirectories)</li>';
      list.querySelectorAll('.browse-entry').forEach(b =>
        b.addEventListener('click', () => loadBrowse(b.dataset.path))
      );
      roots.innerHTML = (d.roots || []).map(r =>
        `<button type="button" class="browse-root" data-path="${r}">${r}</button>`
      ).join('');
      roots.querySelectorAll('.browse-root').forEach(b =>
        b.addEventListener('click', () => loadBrowse(b.dataset.path))
      );
    }

    document.getElementById('browse-btn').addEventListener('click', () => {
      modal.hidden = false;
      loadBrowse('~');
    });
    document.getElementById('browse-close').addEventListener('click', () => modal.hidden = true);
    document.getElementById('browse-cancel').addEventListener('click', () => modal.hidden = true);
    document.getElementById('browse-up').addEventListener('click', () => {
      const parent = currentPath.replace(/\/[^/]+$/, '') || '/';
      loadBrowse(parent);
    });
    document.getElementById('browse-pick').addEventListener('click', () => {
      const t = sourceTextarea.value.trimEnd();
      sourceTextarea.value = t ? (t + '\n' + currentPath) : currentPath;
      modal.hidden = true;
    });

    // ---- Source provider reveal ----
    const providerSel = document.getElementById('source_provider');
    const ghFields = document.getElementById('github-fields');
    if (providerSel && ghFields) {
      const sync = () => { ghFields.style.display = providerSel.value === 'github' ? '' : 'none'; };
      providerSel.addEventListener('change', sync);
      sync();
    }

    // ---- Delete confirm ----
    const delBtn = document.getElementById('delete-btn');
    if (delBtn) {
      delBtn.addEventListener('click', () => {
        const name = delBtn.dataset.name;
        if (!confirm(`Delete manifest "${name}"?\n\nThis removes the YAML file from disk. Existing findings keyed to this app will remain in the store but no future scans will run.`)) return;
        const f = document.createElement('form');
        f.method = 'POST';
        f.action = '/manifests/' + encodeURIComponent(name) + '/delete';
        document.body.appendChild(f);
        f.submit();
      });
    }
  })();
  </script>
{% endblock %}