Makefile

# TMI Refactored Makefile - Atomic Components with Configuration-Driven Composition
# This Makefile uses YAML configuration files and atomic components for maximum reusability.

.PHONY: help list-targets

# Set default target to help (must be before any includes that define targets)
.DEFAULT_GOAL := help

# Include integration test framework targets
-include test-framework.mk

# Use zsh as the shell with proper PATH
SHELL := /bin/zsh
.SHELLFLAGS := -c

# Export PATH to all submakes and shell recipes
export PATH := /usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/opt/homebrew/bin:$(PATH)

# Default build target
VERSION := 0.9.0
COMMIT := $(shell git rev-parse --short HEAD 2>/dev/null || echo "development")
BUILD_DATE := $(shell date -u +"%Y-%m-%dT%H:%M:%SZ")

# Colors for output
BLUE := \033[0;34m
GREEN := \033[0;32m
YELLOW := \033[1;33m
RED := \033[0;31m
NC := \033[0m

# Logging functions
define log_info
	@echo -e "$(BLUE)[INFO]$(NC) $(1)"
endef

define log_success
	@echo -e "$(GREEN)[SUCCESS]$(NC) $(1)"
endef

define log_warning
	@echo -e "$(YELLOW)[WARNING]$(NC) $(1)"
endef

define log_error
	@echo -e "$(RED)[ERROR]$(NC) $(1)"
endef

# Configuration loading function
define load-config
	$(eval CONFIG_FILE := config/$(1).yml)
	$(eval include scripts/load-config.mk)
endef

# Helper target to load configuration file
.PHONY: load-config-file
load-config-file:
	@if [ -n "$(CONFIG_FILE)" ]; then \
		echo "Loading configuration from $(CONFIG_FILE)"; \
		include scripts/load-config.mk; \
	fi

# Load configuration if CONFIG_FILE is set
ifdef CONFIG_FILE
ifneq ($(wildcard $(CONFIG_FILE)),)
$(info Loading configuration from $(CONFIG_FILE))
include scripts/load-config.mk
endif
endif

# ============================================================================
# ATOMIC COMPONENTS - Infrastructure Management
# ============================================================================

.PHONY: start-database stop-database clean-database start-redis stop-redis clean-redis

start-database:
	$(call log_info,Starting PostgreSQL container...)
	@CONTAINER="$(INFRASTRUCTURE_POSTGRES_CONTAINER)"; \
	if [ -z "$$CONTAINER" ]; then CONTAINER="tmi-postgresql"; fi; \
	PORT="$(INFRASTRUCTURE_POSTGRES_PORT)"; \
	if [ -z "$$PORT" ]; then PORT="5432"; fi; \
	USER="$(INFRASTRUCTURE_POSTGRES_USER)"; \
	if [ -z "$$USER" ]; then USER="tmi_dev"; fi; \
	PASSWORD="$(INFRASTRUCTURE_POSTGRES_PASSWORD)"; \
	if [ -z "$$PASSWORD" ]; then PASSWORD="dev123"; fi; \
	DATABASE="$(INFRASTRUCTURE_POSTGRES_DATABASE)"; \
	if [ -z "$$DATABASE" ]; then DATABASE="tmi_dev"; fi; \
	IMAGE="$(INFRASTRUCTURE_POSTGRES_IMAGE)"; \
	if [ -z "$$IMAGE" ]; then IMAGE="tmi/tmi-postgresql:latest"; fi; \
	DATA_DIR="$$HOME/Projects/tmi-postgres-data"; \
	mkdir -p "$$DATA_DIR"; \
	if ! docker ps -a --format "{{.Names}}" | grep -q "^$$CONTAINER$$"; then \
		echo -e "$(BLUE)[INFO]$(NC) Creating new PostgreSQL container..."; \
		echo -e "$(BLUE)[INFO]$(NC) Mounting data directory: $$DATA_DIR"; \
		docker run -d \
			--name $$CONTAINER \
			-p 127.0.0.1:$$PORT:5432 \
			-e POSTGRES_USER=$$USER \
			-e POSTGRES_PASSWORD=$$PASSWORD \
			-e POSTGRES_DB=$$DATABASE \
			-v "$$DATA_DIR:/var/lib/postgresql/data" \
			$$IMAGE; \
	elif ! docker ps --format "{{.Names}}" | grep -q "^$$CONTAINER$$"; then \
		echo -e "$(BLUE)[INFO]$(NC) Starting existing PostgreSQL container..."; \
		docker start $$CONTAINER; \
	fi; \
	echo "✅ PostgreSQL container is running on port $$PORT"

stop-database:
	$(call log_info,Stopping PostgreSQL container...)
	@CONTAINER="$(INFRASTRUCTURE_POSTGRES_CONTAINER)"; \
	if [ -z "$$CONTAINER" ]; then CONTAINER="tmi-postgresql"; fi; \
	docker stop $$CONTAINER 2>/dev/null || true
	$(call log_success,"PostgreSQL container stopped")

clean-database:
	$(call log_warning,"Removing PostgreSQL container and data...")
	@CONTAINER="$(INFRASTRUCTURE_POSTGRES_CONTAINER)"; \
	if [ -z "$$CONTAINER" ]; then CONTAINER="tmi-postgresql"; fi; \
	docker rm -f $$CONTAINER 2>/dev/null || true
	$(call log_success,"PostgreSQL container and data removed")

start-redis:
	$(call log_info,Starting Redis container...)
	@CONTAINER="$(INFRASTRUCTURE_REDIS_CONTAINER)"; \
	if [ -z "$$CONTAINER" ]; then CONTAINER="tmi-redis"; fi; \
	PORT="$(INFRASTRUCTURE_REDIS_PORT)"; \
	if [ -z "$$PORT" ]; then PORT="6379"; fi; \
	IMAGE="$(INFRASTRUCTURE_REDIS_IMAGE)"; \
	if [ -z "$$IMAGE" ]; then IMAGE="tmi/tmi-redis:latest"; fi; \
	if ! docker ps -a --format "{{.Names}}" | grep -q "^$$CONTAINER$$"; then \
		echo -e "$(BLUE)[INFO]$(NC) Creating new Redis container..."; \
		docker run -d \
			--name $$CONTAINER \
			-p 127.0.0.1:$$PORT:6379 \
			$$IMAGE; \
	elif ! docker ps --format "{{.Names}}" | grep -q "^$$CONTAINER$$"; then \
		echo -e "$(BLUE)[INFO]$(NC) Starting existing Redis container..."; \
		docker start $$CONTAINER; \
	fi; \
	echo "✅ Redis container is running on port $$PORT"

stop-redis:
	$(call log_info,Stopping Redis container...)
	@CONTAINER="$(INFRASTRUCTURE_REDIS_CONTAINER)"; \
	if [ -z "$$CONTAINER" ]; then CONTAINER="tmi-redis"; fi; \
	docker stop $$CONTAINER 2>/dev/null || true
	$(call log_success,"Redis container stopped")

clean-redis:
	$(call log_warning,"Removing Redis container and data...")
	@CONTAINER="$(INFRASTRUCTURE_REDIS_CONTAINER)"; \
	if [ -z "$$CONTAINER" ]; then CONTAINER="tmi-redis"; fi; \
	docker rm -f $$CONTAINER 2>/dev/null || true
	$(call log_success,"Redis container and data removed")


# ============================================================================
# ATOMIC COMPONENTS - Build Management
# ============================================================================

.PHONY: build-server build-migrate build-cats-seed build-cats-seed-oci clean-build generate-api

build-server:
	$(call log_info,Building server binary...)
	@# Read version components
	@MAJOR=$$(jq -r '.major' .version); \
	MINOR=$$(jq -r '.minor' .version); \
	PATCH=$$(jq -r '.patch' .version); \
	go build -tags="dev" \
		-ldflags "-X github.com/ericfitz/tmi/api.VersionMajor=$$MAJOR \
		          -X github.com/ericfitz/tmi/api.VersionMinor=$$MINOR \
		          -X github.com/ericfitz/tmi/api.VersionPatch=$$PATCH \
		          -X github.com/ericfitz/tmi/api.GitCommit=$(COMMIT) \
		          -X github.com/ericfitz/tmi/api.BuildDate=$(BUILD_DATE)" \
		-o bin/tmiserver github.com/ericfitz/tmi/cmd/server
	$(call log_success,"Server binary built: bin/tmiserver")

build-migrate:
	$(call log_info,Building migration tool...)
	@go build -o bin/migrate github.com/ericfitz/tmi/cmd/migrate
	$(call log_success,"Migration tool built: bin/migrate")

build-cats-seed:  ## Build CATS database seeding tool (database-agnostic)
	$(call log_info,Building CATS seeding tool...)
	@go build -o bin/cats-seed github.com/ericfitz/tmi/cmd/cats-seed
	$(call log_success,"CATS seeding tool built: bin/cats-seed")

build-cats-seed-oci:  ## Build CATS database seeding tool with Oracle support (requires oci-env.sh)
	$(call log_info,Building CATS seeding tool with Oracle support...)
	@if [ ! -f "scripts/oci-env.sh" ]; then \
		$(call log_error,"scripts/oci-env.sh not found. Copy from scripts/oci-env.sh.example and configure."); \
		exit 1; \
	fi
	@/bin/bash -c '. scripts/oci-env.sh && go build -tags oracle -o bin/cats-seed github.com/ericfitz/tmi/cmd/cats-seed'
	$(call log_success,"CATS seeding tool built with Oracle support: bin/cats-seed")

build-diagnose-oracle:  ## Build Oracle diagnostic tool
	$(call log_info,Building Oracle diagnostic tool...)
	@go build -o bin/diagnose-oracle github.com/ericfitz/tmi/cmd/diagnose-oracle
	$(call log_success,"Oracle diagnostic tool built: bin/diagnose-oracle")

clean-build:
	$(call log_info,"Cleaning build artifacts...")
	@rm -rf ./bin/*
	@rm -f check-db migrate
	$(call log_success,"Build artifacts cleaned")

generate-api:
	$(call log_info,"Generating API code from OpenAPI specification...")
	@oapi-codegen -config oapi-codegen-config.yml api-schema/tmi-openapi.json
	$(call log_success,"API code generated: api/api.go")


# ============================================================================
# ATOMIC COMPONENTS - Database Operations
# ============================================================================

.PHONY: migrate-database check-database wait-database reset-database

migrate-database:
	$(call log_info,"Running database migrations...")
	@cd cmd/migrate && go run main.go --config ../../config-development.yml
	$(call log_success,"Database migrations completed")

check-database:
	$(call log_info,"Checking database migration status...")
	@if [ -f "./bin/check-db" ]; then \
		./bin/check-db; \
	elif [ -f "./check-db" ]; then \
		./check-db; \
	else \
		cd cmd/check-db && go run main.go; \
	fi

wait-database:
	$(call log_info,"Waiting for database to be ready...")
	@timeout=$${TIMEOUTS_DB_READY:-300}; \
	CONTAINER="$(INFRASTRUCTURE_POSTGRES_CONTAINER)"; \
	if [ -z "$$CONTAINER" ]; then CONTAINER="tmi-postgresql"; fi; \
	USER="$(INFRASTRUCTURE_POSTGRES_USER)"; \
	if [ -z "$$USER" ]; then USER="tmi_dev"; fi; \
	while [ $$timeout -gt 0 ]; do \
		if docker exec $$CONTAINER pg_isready -U $$USER >/dev/null 2>&1; then \
			echo -e "$(GREEN)[SUCCESS]$(NC) Database is ready!"; \
			break; \
		fi; \
		echo "⏳ Waiting for database... ($$timeout seconds remaining)"; \
		sleep 2; \
		timeout=$$((timeout - 2)); \
	done; \
	if [ $$timeout -le 0 ]; then \
		echo -e "$(RED)[ERROR]$(NC) Database failed to start within 300 seconds"; \
		exit 1; \
	fi

reset-database:
	@echo -e "$(YELLOW)[WARNING]$(NC) Dropping and recreating database (DESTRUCTIVE)..."
	@CONTAINER="$(INFRASTRUCTURE_POSTGRES_CONTAINER)"; \
	if [ -z "$$CONTAINER" ]; then CONTAINER="tmi-postgresql"; fi; \
	USER="$(INFRASTRUCTURE_POSTGRES_USER)"; \
	if [ -z "$$USER" ]; then USER="tmi_dev"; fi; \
	DATABASE="$(INFRASTRUCTURE_POSTGRES_DATABASE)"; \
	if [ -z "$$DATABASE" ]; then DATABASE="tmi_dev"; fi; \
	echo -e "$(YELLOW)[WARNING]$(NC) This will drop all data in database: $$DATABASE"; \
	docker exec $$CONTAINER psql -U $$USER -d postgres -c "DROP DATABASE IF EXISTS $$DATABASE;" && \
	docker exec $$CONTAINER psql -U $$USER -d postgres -c "CREATE DATABASE $$DATABASE;" && \
	echo -e "$(GREEN)[SUCCESS]$(NC) Database dropped and recreated" && \
	$(MAKE) migrate-database

# ============================================================================
# ATOMIC COMPONENTS - Process Management
# ============================================================================

.PHONY: stop-process wait-process start-server stop-server

stop-process:
	$(call log_info,"Killing processes on port $(SERVER_PORT)")
	@PORT="$(SERVER_PORT)"; \
	if [ -z "$$PORT" ]; then PORT="8080"; fi; \
	PIDS=$$(lsof -ti :$$PORT 2>/dev/null || true); \
	if [ -n "$$PIDS" ]; then \
		echo "Found processes on port $$PORT: $$PIDS"; \
		for PID in $$PIDS; do \
			echo "Stopping process $$PID listening on port $$PORT..."; \
			kill $$PID 2>/dev/null || true; \
			sleep 1; \
			if ps -p $$PID > /dev/null 2>&1; then \
				echo "Force killing process $$PID..."; \
				kill -9 $$PID 2>/dev/null || true; \
			fi; \
		done; \
		echo "All processes on port $$PORT have been killed"; \
	else \
		echo "No processes found listening on port $$PORT"; \
	fi

start-server: clean-logs
	$(call log_info,"Starting server on port $(SERVER_PORT)")
	@LOG_FILE="$(SERVER_LOG_FILE)"; \
	if [ -z "$$LOG_FILE" ]; then LOG_FILE="logs/server.log"; fi; \
	mkdir -p "$$(dirname "$$LOG_FILE")"; \
	CONFIG_FILE="$(SERVER_CONFIG_FILE)"; \
	if [ -z "$$CONFIG_FILE" ]; then CONFIG_FILE="config-development.yml"; fi; \
	BINARY="$(SERVER_BINARY)"; \
	if [ -z "$$BINARY" ]; then BINARY="bin/tmiserver"; fi; \
	if [ -n "$(SERVER_TAGS)" ]; then \
		echo "Starting server with build tags: $(SERVER_TAGS)"; \
		echo "Building server with tags: $(SERVER_TAGS)"; \
		go build -tags $(SERVER_TAGS) -o $$BINARY ./cmd/server/; \
	fi; \
	echo "Starting server binary: $$BINARY"; \
	$$BINARY --config=$$CONFIG_FILE > $$LOG_FILE 2>&1 & \
	echo $$! > .server.pid
	$(call log_success,"Server started with PID: $$(cat .server.pid)")

stop-server:
	$(call log_info,"Stopping server...")
	@if [ -f .server.pid ]; then \
		PID=$$(cat .server.pid); \
		if ps -p $$PID > /dev/null 2>&1; then \
			echo "Stopping server (PID: $$PID)..."; \
			kill $$PID 2>/dev/null || true; \
			sleep 2; \
			if ps -p $$PID > /dev/null 2>&1; then \
				echo "Force killing server (PID: $$PID)..."; \
				kill -9 $$PID 2>/dev/null || true; \
			fi; \
		fi; \
		rm -f .server.pid; \
	fi
	@$(MAKE) stop-process
	$(call log_success,"Server stopped")

wait-process:
	$(call log_info,"Waiting for server to be ready on port $(SERVER_PORT)")
	@timeout=$${TIMEOUTS_SERVER_READY:-300}; \
	PORT="$(SERVER_PORT)"; \
	if [ -z "$$PORT" ]; then PORT="8080"; fi; \
	while [ $$timeout -gt 0 ]; do \
		if curl -s http://localhost:$$PORT/ >/dev/null 2>&1; then \
			$(call log_success,"Server is ready!"); \
			break; \
		fi; \
		echo "⏳ Waiting for server... ($$timeout seconds remaining)"; \
		sleep 2; \
		timeout=$$((timeout - 2)); \
	done; \
	if [ $$timeout -le 0 ]; then \
		$(call log_error,"Server failed to start within 300 seconds"); \
		exit 1; \
	fi


# ============================================================================
# ATOMIC COMPONENTS - Test Execution
# ============================================================================

.PHONY: execute-tests-unit

execute-tests-unit:
	$(call log_info,"Executing unit tests...")
	@if [ -n "$(TEST_PATTERN)" ] && [ "$(TEST_PATTERN)" != "" ]; then \
		echo "Running specific unit test: $(TEST_PATTERN)"; \
		TEST_CMD="$(ENVIRONMENT_LOGGING_IS_TEST)=true go test -short ./api/... ./auth/... ./cmd/... ./internal/... -run $(TEST_PATTERN) -v"; \
	else \
		echo "Running all unit tests..."; \
		TEST_CMD="$(ENVIRONMENT_LOGGING_IS_TEST)=true go test -short ./api/... ./auth/... ./cmd/... ./internal/..."; \
	fi; \
	if [ "$(TEST_COUNT1)" = "true" ]; then \
		TEST_CMD="$$TEST_CMD --count=1"; \
	fi; \
	if [ "$(TEST_TAGS)" != "" ]; then \
		TEST_CMD="$$TEST_CMD -tags='$(TEST_TAGS)'"; \
	fi; \
	if [ "$(TEST_TIMEOUT)" != "" ]; then \
		TEST_CMD="$$TEST_CMD -timeout=$(TEST_TIMEOUT)"; \
	fi; \
	eval $$TEST_CMD
	$(call log_success,"Unit tests completed")

# ============================================================================
# ATOMIC COMPONENTS - Cleanup Operations
# ============================================================================

.PHONY: clean-files clean-logs clean-containers clean-process clean-everything

clean-logs:
	$(call log_info,"Cleaning up log files...")
	@rm -f integration-test.log server.log .server.pid
	@if [ -d logs ] && [ -n "$$(ls -A logs 2>/dev/null)" ]; then \
		echo -e "$(BLUE)[INFO]$(NC) Removing logs/* files"; \
		find logs -mindepth 1 -delete; \
	fi
	$(call log_success,"Log files cleaned")

clean-files:
	$(call log_info,"Cleaning up files...")
	@if [ -n "$(CLEANUP_FILES)" ] && [ "$(CLEANUP_FILES)" != "" ]; then \
		for file in $(CLEANUP_FILES); do \
			if [ -f "$$file" ]; then \
				echo -e "$(BLUE)[INFO]$(NC) Removing file: $$file"; \
				rm -f "$$file"; \
			fi; \
		done; \
	fi
	@if [ -n "$(ARTIFACTS_PID_FILES)" ] && [ "$(ARTIFACTS_PID_FILES)" != "" ]; then \
		for file in $(ARTIFACTS_PID_FILES); do \
			if [ -f "$$file" ]; then \
				echo -e "$(BLUE)[INFO]$(NC) Removing PID file: $$file"; \
				rm -f "$$file"; \
			fi; \
		done; \
	fi
	@$(MAKE) -f $(MAKEFILE_LIST) clean-logs
	$(call log_info,"Cleaning CATS artifacts...")
	@pkill -f "cats" 2>/dev/null || true
	@sleep 1
	@rm -rf test/outputs/cats
	@rm -rf cats-report
	$(call log_success,"File cleanup completed")

clean-containers:
	$(call log_info,"Cleaning up containers...")
	@if [ -n "$(CLEANUP_CONTAINERS)" ] && [ "$(CLEANUP_CONTAINERS)" != "" ]; then \
		for container in $(CLEANUP_CONTAINERS); do \
			echo -e "$(BLUE)[INFO]$(NC) Stopping and removing container: $$container"; \
			docker stop $$container 2>/dev/null || true; \
			docker rm $$container 2>/dev/null || true; \
		done; \
	fi
	$(call log_success,"Container cleanup completed")

clean-process:
	$(call log_info,"Cleaning up processes...")
	@# Kill server using PID file first (if available)
	@if [ -f .server.pid ]; then \
		PID=$$(cat .server.pid 2>/dev/null || true); \
		if [ -n "$$PID" ] && ps -p $$PID > /dev/null 2>&1; then \
			echo -e "$(BLUE)[INFO]$(NC) Killing server process from PID file: $$PID"; \
			kill $$PID 2>/dev/null || true; \
			sleep 2; \
			if ps -p $$PID > /dev/null 2>&1; then \
				kill -9 $$PID 2>/dev/null || true; \
			fi; \
		fi; \
		rm -f .server.pid; \
	fi
	@# Kill any remaining server processes (bin/tmiserver)
	@SERVER_PIDS=$$(ps aux | grep '[b]in/tmiserver' | awk '{print $$2}' || true); \
	if [ -n "$$SERVER_PIDS" ]; then \
		for PID in $$SERVER_PIDS; do \
			echo -e "$(BLUE)[INFO]$(NC) Killing server process: $$PID"; \
			kill $$PID 2>/dev/null || true; \
			sleep 1; \
			if ps -p $$PID > /dev/null 2>&1; then \
				kill -9 $$PID 2>/dev/null || true; \
			fi; \
		done; \
	fi
	@# Kill OAuth stub processes
	@OAUTH_PIDS=$$(ps aux | grep '[o]auth.*stub' | awk '{print $$2}' || true); \
	if [ -n "$$OAUTH_PIDS" ]; then \
		for PID in $$OAUTH_PIDS; do \
			echo -e "$(BLUE)[INFO]$(NC) Killing OAuth stub process: $$PID"; \
			kill $$PID 2>/dev/null || true; \
			sleep 1; \
			if ps -p $$PID > /dev/null 2>&1; then \
				kill -9 $$PID 2>/dev/null || true; \
			fi; \
		done; \
	fi
	@# Kill processes on specified ports (final cleanup)
	@if [ -n "$(CLEANUP_PROCESSES)" ] && [ "$(CLEANUP_PROCESSES)" != "" ]; then \
		for port in $(CLEANUP_PROCESSES); do \
			echo -e "$(BLUE)[INFO]$(NC) Killing any remaining processes on port: $$port"; \
			PIDS=$$(lsof -ti :$$port 2>/dev/null || true); \
			if [ -n "$$PIDS" ]; then \
				for PID in $$PIDS; do \
					kill $$PID 2>/dev/null || true; \
					sleep 1; \
					if ps -p $$PID > /dev/null 2>&1; then \
						kill -9 $$PID 2>/dev/null || true; \
					fi; \
				done; \
			fi; \
		done; \
	fi
	$(call log_success,"Process cleanup completed")

clean-everything: clean-process clean-containers clean-redis clean-logs clean-files

# ============================================================================
# COMPOSITE TARGETS - Main User-Facing Commands
# ============================================================================

.PHONY: test-unit test-integration test-integration-pg test-integration-oci test-api test-api-collection test-api-list start-dev start-dev-0 start-dev-oci restart-dev clean-dev test-coverage

# Unit Testing - Fast tests with no external dependencies
test-unit:
	$(call log_info,"Running unit tests")
	@LOGGING_IS_TEST=true go test -short ./api/... ./auth/... ./cmd/... ./internal/... -v
	@$(MAKE) -f $(MAKEFILE_LIST) clean-logs

# Integration Testing - Default to PostgreSQL backend
# Also available: test-integration-oci for Oracle ADB
test-integration: test-integration-pg

# Integration Testing - PostgreSQL backend (Docker container)
# Starts PostgreSQL, Redis, runs migrations, and executes integration tests
# Configuration: config-test-integration-pg.yml
# Usage: make test-integration-pg                    - Leave server running (default)
#        make test-integration-pg CLEANUP=true       - Stop server and clean containers
test-integration-pg:
	@if [ "$(CLEANUP)" = "true" ]; then \
		./scripts/run-integration-tests-pg.sh --cleanup; \
	else \
		./scripts/run-integration-tests-pg.sh; \
	fi

# Integration Testing - Oracle ADB backend (OCI Autonomous Database)
# Requires Oracle Instant Client and wallet configuration
# Configuration: config-test-integration-oci.yml
# Usage: make test-integration-oci                   - Leave server running (default)
#        make test-integration-oci CLEANUP=true      - Stop server and clean Redis
test-integration-oci:
	@if [ "$(CLEANUP)" = "true" ]; then \
		./scripts/run-integration-tests-oci.sh --cleanup; \
	else \
		./scripts/run-integration-tests-oci.sh; \
	fi

# API Testing - Comprehensive Postman/Newman test suite
# Usage: make test-api                          - Expect server running (default)
#        make test-api START_SERVER=true        - Auto-start server if needed
#        make test-api-collection COLLECTION=name - Run specific collection
test-api:
	$(call log_info,"Running comprehensive API test suite...")
	@if [ ! -f test/postman/run-tests.sh ]; then \
		echo -e "$(RED)[ERROR]$(NC) API test script not found at test/postman/run-tests.sh"; \
		exit 1; \
	fi
	@if ! command -v newman >/dev/null 2>&1; then \
		echo -e "$(RED)[ERROR]$(NC) Newman is not installed. Install with: pnpm install -g newman newman-reporter-htmlextra"; \
		exit 1; \
	fi
	@if [ "$(START_SERVER)" = "true" ]; then \
		bash test/postman/run-tests.sh --start-server; \
	else \
		bash test/postman/run-tests.sh; \
	fi

# Run a specific Postman collection
# Usage: make test-api-collection COLLECTION=comprehensive-test-collection
#        make test-api-collection COLLECTION=unauthorized-tests-collection
test-api-collection:
	$(call log_info,"Running Postman collection: $(COLLECTION)...")
	@if [ -z "$(COLLECTION)" ]; then \
		echo -e "$(RED)[ERROR]$(NC) COLLECTION parameter required"; \
		echo -e "$(BLUE)[INFO]$(NC) Usage: make test-api-collection COLLECTION=<collection-name>"; \
		echo -e "$(BLUE)[INFO]$(NC) Available collections:"; \
		ls -1 test/postman/*.json 2>/dev/null | xargs -I {} basename {} .json | sed 's/^/  /'; \
		exit 1; \
	fi
	@if [ ! -f "test/postman/$(COLLECTION).json" ]; then \
		echo -e "$(RED)[ERROR]$(NC) Collection not found: test/postman/$(COLLECTION).json"; \
		echo -e "$(BLUE)[INFO]$(NC) Available collections:"; \
		ls -1 test/postman/*.json 2>/dev/null | xargs -I {} basename {} .json | sed 's/^/  /'; \
		exit 1; \
	fi
	@if ! command -v newman >/dev/null 2>&1; then \
		echo -e "$(RED)[ERROR]$(NC) Newman is not installed. Install with: pnpm install -g newman newman-reporter-htmlextra"; \
		exit 1; \
	fi
	@# Use script that handles PKCE OAuth authentication properly
	@bash test/postman/run-postman-collection.sh "$(COLLECTION)"

# List available Postman collections
test-api-list:
	$(call log_info,"Available Postman collections:")
	@ls -1 test/postman/*.json 2>/dev/null | xargs -I {} basename {} .json | sed 's/^/  /'

# Development Environment - Start local dev environment
start-dev:
	$(call log_info,"Starting development environment")
	@$(MAKE) -f $(MAKEFILE_LIST) start-database && \
	$(MAKE) -f $(MAKEFILE_LIST) start-redis && \
	$(MAKE) -f $(MAKEFILE_LIST) wait-database && \
	go build -o bin/check-db cmd/check-db/main.go && \
	$(MAKE) -f $(MAKEFILE_LIST) migrate-database && \
	SERVER_CONFIG_FILE=config-development.yml $(MAKE) -f $(MAKEFILE_LIST) start-server
	$(call log_success,"Development environment started on port 8080")

# Development Environment - Start on all interfaces (0.0.0.0)
start-dev-0:
	$(call log_info,"Starting development environment on 0.0.0.0")
	@$(MAKE) -f $(MAKEFILE_LIST) start-database && \
	$(MAKE) -f $(MAKEFILE_LIST) start-redis && \
	$(MAKE) -f $(MAKEFILE_LIST) wait-database && \
	go build -o bin/check-db cmd/check-db/main.go && \
	$(MAKE) -f $(MAKEFILE_LIST) migrate-database && \
	SERVER_INTERFACE=0.0.0.0 SERVER_CONFIG_FILE=config-development.yml $(MAKE) -f $(MAKEFILE_LIST) start-server
	$(call log_success,"Development environment started on 0.0.0.0:8080")

# Development Environment - Oracle Cloud Infrastructure (OCI) Autonomous Database
# Prerequisites:
#   1. Oracle Instant Client installed
#   2. Wallet extracted to ./wallet directory
#   3. Database user created in OCI ADB
#   4. scripts/start-dev-oci.sh configured with your credentials (gitignored)
start-dev-oci:
	@./scripts/start-dev-oci.sh

# OCI ADB Utility - Drop all tables in OCI Autonomous Database
# Prerequisites: Same as start-dev-oci (Oracle Instant Client, wallet, credentials)
# WARNING: This is destructive and will delete all data in the OCI database
reset-db-oci:
	@./scripts/drop-oracle-tables.sh

# Development Environment - Restart (stop server, clean logs, start dev)
restart-dev:
	$(call log_info,"Restarting development environment")
	@$(MAKE) -f $(MAKEFILE_LIST) stop-server && \
	$(MAKE) -f $(MAKEFILE_LIST) clean-logs && \
	$(MAKE) -f $(MAKEFILE_LIST) start-dev

# Development Environment Cleanup
clean-dev:
	$(call log_info,"Cleaning development environment")
	@$(MAKE) -f $(MAKEFILE_LIST) clean-everything

# Coverage Report Generation - Comprehensive testing with coverage
test-coverage:
	$(call log_info,"Generating coverage reports")
	@trap '$(MAKE) -f $(MAKEFILE_LIST) clean-everything' EXIT; \
	$(MAKE) -f $(MAKEFILE_LIST) clean-everything && \
	mkdir -p coverage && \
	$(MAKE) -f $(MAKEFILE_LIST) test-coverage-unit && \
	$(MAKE) -f $(MAKEFILE_LIST) start-database && \
	$(MAKE) -f $(MAKEFILE_LIST) start-redis && \
	$(MAKE) -f $(MAKEFILE_LIST) wait-database && \
	$(MAKE) -f $(MAKEFILE_LIST) migrate-database && \
	$(MAKE) -f $(MAKEFILE_LIST) test-coverage-integration && \
	$(MAKE) -f $(MAKEFILE_LIST) merge-coverage && \
	$(MAKE) -f $(MAKEFILE_LIST) generate-coverage


# ============================================================================
# SPECIALIZED ATOMIC COMPONENTS - Coverage
# ============================================================================

.PHONY: test-coverage-unit test-coverage-integration merge-coverage generate-coverage

test-coverage-unit:
	$(call log_info,"Running unit tests with coverage...")
	@$(ENVIRONMENT_LOGGING_IS_TEST)=true go test \
		-coverprofile="$(COVERAGE_DIRECTORY)/$(COVERAGE_UNIT_PROFILE)" \
		-covermode=$(COVERAGE_MODE) \
		-coverpkg=./... \
		$(TEST_UNIT_PACKAGES) \
		-tags="$(TEST_UNIT_TAGS)" \
		-timeout=$(TEST_UNIT_TIMEOUT) \
		-v
	$(call log_success,"Unit test coverage completed")

test-coverage-integration:
	$(call log_info,"Running integration tests with coverage...")
	@$(ENVIRONMENT_LOGGING_IS_TEST)=true \
	POSTGRES_HOST=localhost \
	POSTGRES_PORT=$(INFRASTRUCTURE_POSTGRES_PORT) \
	POSTGRES_USER=$(INFRASTRUCTURE_POSTGRES_USER) \
	POSTGRES_PASSWORD=$(INFRASTRUCTURE_POSTGRES_PASSWORD) \
	POSTGRES_DATABASE=$(INFRASTRUCTURE_POSTGRES_DATABASE) \
	REDIS_HOST=localhost \
	REDIS_PORT=$(INFRASTRUCTURE_REDIS_PORT) \
	go test \
		-coverprofile="$(COVERAGE_DIRECTORY)/$(COVERAGE_INTEGRATION_PROFILE)" \
		-covermode=$(COVERAGE_MODE) \
		-coverpkg=./... \
		-tags=$(TEST_INTEGRATION_TAGS) \
		$(TEST_INTEGRATION_PACKAGES) \
		-timeout=$(TEST_INTEGRATION_TIMEOUT) \
		-v
	$(call log_success,"Integration test coverage completed")

merge-coverage:
	$(call log_info,"Merging coverage profiles...")
	@if ! command -v gocovmerge >/dev/null 2>&1; then \
		$(call log_info,"Installing gocovmerge..."); \
		go install $(TOOLS_GOCOVMERGE); \
	fi
	@gocovmerge \
		"$(COVERAGE_DIRECTORY)/$(COVERAGE_UNIT_PROFILE)" \
		"$(COVERAGE_DIRECTORY)/$(COVERAGE_INTEGRATION_PROFILE)" \
		> "$(COVERAGE_DIRECTORY)/$(COVERAGE_COMBINED_PROFILE)"
	$(call log_success,"Coverage profiles merged")

generate-coverage:
	$(call log_info,"Generating coverage reports...")
	@mkdir -p coverage_html
	@if [ "$(OUTPUT_HTML_ENABLED)" = "true" ]; then \
		go tool cover -html="$(COVERAGE_DIRECTORY)/$(COVERAGE_UNIT_PROFILE)" -o "coverage_html/$(COVERAGE_UNIT_HTML_REPORT)"; \
		go tool cover -html="$(COVERAGE_DIRECTORY)/$(COVERAGE_INTEGRATION_PROFILE)" -o "coverage_html/$(COVERAGE_INTEGRATION_HTML_REPORT)"; \
		go tool cover -html="$(COVERAGE_DIRECTORY)/$(COVERAGE_COMBINED_PROFILE)" -o "coverage_html/$(COVERAGE_COMBINED_HTML_REPORT)"; \
	fi
	@if [ "$(OUTPUT_TEXT_ENABLED)" = "true" ]; then \
		go tool cover -func="$(COVERAGE_DIRECTORY)/$(COVERAGE_UNIT_PROFILE)" > "$(COVERAGE_DIRECTORY)/$(COVERAGE_UNIT_DETAILED_REPORT)"; \
		go tool cover -func="$(COVERAGE_DIRECTORY)/$(COVERAGE_INTEGRATION_PROFILE)" > "$(COVERAGE_DIRECTORY)/$(COVERAGE_INTEGRATION_DETAILED_REPORT)"; \
		go tool cover -func="$(COVERAGE_DIRECTORY)/$(COVERAGE_COMBINED_PROFILE)" > "$(COVERAGE_DIRECTORY)/$(COVERAGE_COMBINED_DETAILED_REPORT)"; \
	fi
	@if [ "$(OUTPUT_SUMMARY_ENABLED)" = "true" ]; then \
		$(call log_info,"Generating coverage summary..."); \
		echo "TMI Test Coverage Summary" > "$(COVERAGE_DIRECTORY)/$(COVERAGE_SUMMARY)"; \
		echo "Generated: $$(date)" >> "$(COVERAGE_DIRECTORY)/$(COVERAGE_SUMMARY)"; \
		echo "======================================" >> "$(COVERAGE_DIRECTORY)/$(COVERAGE_SUMMARY)"; \
		echo "" >> "$(COVERAGE_DIRECTORY)/$(COVERAGE_SUMMARY)"; \
		go tool cover -func="$(COVERAGE_DIRECTORY)/$(COVERAGE_COMBINED_PROFILE)" | tail -1 >> "$(COVERAGE_DIRECTORY)/$(COVERAGE_SUMMARY)"; \
		cat "$(COVERAGE_DIRECTORY)/$(COVERAGE_SUMMARY)"; \
	fi
	$(call log_success,"Coverage reports generated in $(COVERAGE_DIRECTORY)/ and coverage_html/")


# OAuth Stub - Development tool for OAuth callback testing
.PHONY: start-oauth-stub stop-oauth-stub kill-oauth-stub check-oauth-stub
start-oauth-stub:
	$(call log_info,"Starting OAuth callback stub on port 8079...")
	@$(MAKE) -f $(MAKEFILE_LIST) kill-oauth-stub >/dev/null 2>&1 || true
	@uv run scripts/oauth-client-callback-stub.py --port 8079 --daemon --pid-file .oauth-stub.pid
	@for i in 1 2 3 4 5 6 7 8 9 10; do \
		if curl -s http://127.0.0.1:8079/latest >/dev/null 2>&1; then \
			echo -e "$(GREEN)[SUCCESS]$(NC) OAuth stub started on http://localhost:8079/"; \
			echo -e "$(BLUE)[INFO]$(NC) Log file: /tmp/oauth-stub.log"; \
			echo -e "$(BLUE)[INFO]$(NC) PID: $$(cat .oauth-stub.pid 2>/dev/null)"; \
			exit 0; \
		fi; \
		sleep 0.5; \
	done; \
	echo -e "$(RED)[ERROR]$(NC) Failed to start OAuth stub (timeout after 5s)"; \
	rm -f .oauth-stub.pid; \
	exit 1

stop-oauth-stub:
	$(call log_info,"Stopping OAuth callback stub...")
	@# Step 1: Send magic exit URL
	@echo -e "$(BLUE)[INFO]$(NC) Sending graceful shutdown request..."
	@curl -s "http://localhost:8079/?code=exit" >/dev/null 2>&1 || true
	@sleep 1
	@# Step 2: Check if anything is still listening on 8079, kill with SIGTERM
	@PIDS=$$(lsof -ti :8079 2>/dev/null || true); \
	if [ -n "$$PIDS" ]; then \
		echo -e "$(BLUE)[INFO]$(NC) Found processes still listening on port 8079: $$PIDS"; \
		for PID in $$PIDS; do \
			echo -e "$(BLUE)[INFO]$(NC) Sending SIGTERM to process $$PID..."; \
			kill $$PID 2>/dev/null || true; \
		done; \
		sleep 2; \
	fi
	@# Step 3: Check again and force kill with SIGKILL if still running
	@PIDS=$$(lsof -ti :8079 2>/dev/null || true); \
	if [ -n "$$PIDS" ]; then \
		echo -e "$(YELLOW)[WARNING]$(NC) Processes still running on port 8079: $$PIDS"; \
		for PID in $$PIDS; do \
			echo -e "$(BLUE)[INFO]$(NC) Force killing process $$PID with SIGKILL..."; \
			kill -9 $$PID 2>/dev/null || true; \
		done; \
		sleep 1; \
	fi
	@# Clean up PID file
	@rm -f .oauth-stub.pid
	@# Final verification
	@PIDS=$$(lsof -ti :8079 2>/dev/null || true); \
	if [ -z "$$PIDS" ]; then \
		echo -e "$(GREEN)[SUCCESS]$(NC) OAuth stub stopped successfully"; \
	else \
		echo -e "$(RED)[ERROR]$(NC) Failed to stop all processes on port 8079: $$PIDS"; \
	fi

kill-oauth-stub:
	$(call log_info,"Force killing anything on port 8079...")
	@PIDS=$$(lsof -ti :8079 2>/dev/null || true); \
	if [ -n "$$PIDS" ]; then \
		echo -e "$(YELLOW)[WARNING]$(NC) Found processes on port 8079: $$PIDS"; \
		for PID in $$PIDS; do \
			echo -e "$(BLUE)[INFO]$(NC) Force killing process $$PID with SIGKILL..."; \
			kill -9 $$PID 2>/dev/null || true; \
		done; \
		sleep 1; \
		echo -e "$(GREEN)[SUCCESS]$(NC) All processes on port 8079 killed"; \
	else \
		echo -e "$(GREEN)[SUCCESS]$(NC) No processes found on port 8079"; \
	fi
	@rm -f .oauth-stub.pid

check-oauth-stub:
	@if [ -f .oauth-stub.pid ]; then \
		PID=$$(cat .oauth-stub.pid); \
		if kill -0 $$PID 2>/dev/null; then \
			echo -e "$(GREEN)[SUCCESS]$(NC) OAuth stub is running (PID: $$PID)"; \
			echo -e "$(BLUE)[INFO]$(NC) URL: http://localhost:8079/"; \
			echo -e "$(BLUE)[INFO]$(NC) Latest endpoint: http://localhost:8079/latest"; \
		else \
			echo -e "$(YELLOW)[WARNING]$(NC) PID file exists but process $$PID is not running"; \
			rm -f .oauth-stub.pid; \
		fi; \
	else \
		PIDS=$$(pgrep -f "oauth-client-callback-stub.py" || true); \
		if [ -n "$$PIDS" ]; then \
			echo -e "$(YELLOW)[WARNING]$(NC) OAuth stub is running but no PID file found"; \
			echo -e "$(BLUE)[INFO]$(NC) PIDs: $$PIDS"; \
		else \
			echo -e "$(BLUE)[INFO]$(NC) OAuth stub is not running"; \
		fi; \
	fi

# ============================================================================
# CATS FUZZING - API Security Testing
# ============================================================================

.PHONY: cats-seed cats-seed-oci cats-fuzz-prep cats-set-max-quotas cats-create-test-data cats-fuzz cats-fuzz-oci cats-fuzz-user cats-fuzz-server cats-fuzz-custom cats-fuzz-path cats-fuzz-full parse-cats-results query-cats-results analyze-cats-results

# Default config file for CATS seeding (can be overridden)
CATS_CONFIG ?= config-development.yml
CATS_USER ?= charlie
CATS_PROVIDER ?= tmi

cats-seed: build-cats-seed  ## Seed database for CATS fuzzing (database-agnostic, works with all supported DBs)
	$(call log_info,"Seeding CATS test data - database-agnostic...")
	@./bin/cats-seed --config=$(CATS_CONFIG) --user=$(CATS_USER) --provider=$(CATS_PROVIDER)
	$(call log_success,"CATS database seeding completed")

cats-seed-oci: build-cats-seed-oci  ## Seed database for CATS fuzzing (Oracle ADB - requires oci-env.sh)
	$(call log_info,"Seeding CATS test data for Oracle ADB...")
	@CATS_USER_ARG="$(CATS_USER)" CATS_PROVIDER_ARG="$(CATS_PROVIDER)" /bin/bash -c '. scripts/oci-env.sh && ./bin/cats-seed --config=config-development-oci.yml --user="$$CATS_USER_ARG" --provider="$$CATS_PROVIDER_ARG"'
	$(call log_success,CATS database seeding completed - Oracle ADB)

diagnose-oracle: build-diagnose-oracle  ## Run Oracle diagnostic tool (requires oci-env.sh)
	$(call log_info,"Running Oracle diagnostic tool...")
	@if [ ! -f "scripts/oci-env.sh" ]; then \
		$(call log_error,"scripts/oci-env.sh not found. Copy from scripts/oci-env.sh.example and configure."); \
		exit 1; \
	fi
	@/bin/bash -c '. scripts/oci-env.sh && ./bin/diagnose-oracle --config=config-development-oci.yml --verbose'
	$(call log_success,Oracle diagnostic completed)

cats-fuzz-prep:  ## Prepare database for CATS fuzzing (DEPRECATED: use cats-seed instead)
	$(call log_warning,"cats-fuzz-prep is deprecated. Use 'make cats-seed' for database-agnostic seeding.")
	$(call log_info,"Preparing database for CATS fuzzing...")
	@./scripts/cats-prepare-database.sh

cats-set-max-quotas:  ## Set maximum quotas for CATS test user (DEPRECATED: use cats-seed instead)
	$(call log_warning,"cats-set-max-quotas is deprecated. Use 'make cats-seed' which includes quota setup.")
	$(call log_info,"Setting maximum quotas for CATS test user...")
	@./scripts/cats-set-max-quotas.sh

cats-create-test-data:  ## Create test data for CATS fuzzing (standalone, requires running server)
	$(call log_info,"Creating test data for CATS fuzzing...")
	@if [ ! -f "./scripts/cats-create-test-data.sh" ]; then \
		$(call log_error,"Test data script not found: ./scripts/cats-create-test-data.sh"); \
		exit 1; \
	fi
	@chmod +x ./scripts/cats-create-test-data.sh
	@if [ -n "$(TOKEN)" ] && [ -n "$(SERVER)" ]; then \
		./scripts/cats-create-test-data.sh --token="$(TOKEN)" --server="$(SERVER)" --user="$(USER)"; \
	else \
		$(call log_error,"Please specify TOKEN and SERVER variables:"); \
		$(call log_info,"  make cats-create-test-data TOKEN=eyJhbGc... SERVER=http://localhost:8080 USER=alice"); \
		exit 1; \
	fi
	$(call log_success,"Test data created: test/outputs/cats/cats-test-data.json")

cats-fuzz: cats-seed  ## Run CATS API fuzzing with database-agnostic seeding
	$(call log_info,"Running CATS API fuzzing with OAuth authentication...")
	@if ! command -v cats >/dev/null 2>&1; then \
		$(call log_error,"CATS tool not found. Please install it first."); \
		$(call log_info,"See: https://github.com/Endava/cats"); \
		$(call log_info,"On MacOS with Homebrew: brew install cats"); \
		exit 1; \
	fi
	@./scripts/run-cats-fuzz.sh

cats-fuzz-oci: cats-seed-oci  ## Run CATS API fuzzing with OCI Autonomous Database
	$(call log_info,"Running CATS API fuzzing with OCI ADB...")
	@if ! command -v cats >/dev/null 2>&1; then \
		$(call log_error,"CATS tool not found. Please install it first."); \
		$(call log_info,"See: https://github.com/Endava/cats"); \
		$(call log_info,"On MacOS with Homebrew: brew install cats"); \
		exit 1; \
	fi
	@./scripts/run-cats-fuzz.sh

cats-fuzz-user:
	$(call log_info,"Running CATS API fuzzing with custom user...")
	@if [ -z "$(USER)" ]; then \
		$(call log_error,"Please specify USER variable: make cats-fuzz-user USER=alice"); \
		exit 1; \
	fi
	@./scripts/run-cats-fuzz.sh -u "$(USER)"

cats-fuzz-server:
	$(call log_info,"Running CATS API fuzzing against custom server...")
	@if [ -z "$(SERVER)" ]; then \
		$(call log_error,"Please specify SERVER variable: make cats-fuzz-server SERVER=http://localhost:8080"); \
		exit 1; \
	fi
	@./scripts/run-cats-fuzz.sh -s "$(SERVER)"

cats-fuzz-custom:
	$(call log_info,"Running CATS API fuzzing with custom user and server...")
	@if [ -z "$(USER)" ] || [ -z "$(SERVER)" ]; then \
		$(call log_error,"Please specify USER and SERVER variables: make cats-fuzz-custom USER=alice SERVER=http://localhost:8080"); \
		exit 1; \
	fi
	@./scripts/run-cats-fuzz.sh -u "$(USER)" -s "$(SERVER)"

cats-fuzz-path:
	$(call log_info,"Running CATS API fuzzing for specific endpoint path...")
	@if [ -z "$(ENDPOINT)" ]; then \
		echo -e "\033[0;31m[ERROR]\033[0m Please specify ENDPOINT variable: make cats-fuzz-path ENDPOINT=/addons"; \
		exit 1; \
	fi
	@set -e; \
	ARGS="-p $(ENDPOINT)"; \
	if [ "$(BLACKBOX)" = "true" ] || [ "$(BLACKBOX)" = "1" ]; then ARGS="$$ARGS -b"; fi; \
	eval "./scripts/run-cats-fuzz.sh $$ARGS"

cats-fuzz-full:
	$(call log_info,"Running CATS API fuzzing with all custom options...")
	@set -e; \
	ARGS=""; \
	if [ -n "$(USER)" ]; then ARGS="$$ARGS -u $(USER)"; fi; \
	if [ -n "$(SERVER)" ]; then ARGS="$$ARGS -s $(SERVER)"; fi; \
	if [ -n "$(ENDPOINT)" ]; then ARGS="$$ARGS -p $(ENDPOINT)"; fi; \
	if [ "$(BLACKBOX)" = "true" ] || [ "$(BLACKBOX)" = "1" ]; then ARGS="$$ARGS -b"; fi; \
	eval "./scripts/run-cats-fuzz.sh $$ARGS"

.PHONY: parse-cats-results
parse-cats-results:  ## Parse CATS test results into SQLite database
	$(call log_info,"Parsing CATS test results into SQLite database...")
	@if [ ! -d "test/outputs/cats/report" ]; then \
		$(call log_error,"test/outputs/cats/report/ directory not found. Run 'make cats-fuzz' first."); \
		exit 1; \
	fi
	$(call log_info,"Cleaning old SQLite database...")
	@rm -f test/outputs/cats/cats-results.db test/outputs/cats/cats-results.db-shm test/outputs/cats/cats-results.db-wal
	@uv run scripts/parse-cats-results.py \
		--input test/outputs/cats/report/ \
		--output test/outputs/cats/cats-results.db \
		--create-schema \
		--batch-size 100
	$(call log_success,"CATS results parsed to test/outputs/cats/cats-results.db")

.PHONY: query-cats-results
query-cats-results:  ## Query parsed CATS results (excludes OAuth false positives)
	$(call log_info,"Querying CATS test results...")
	@if [ ! -f "test/outputs/cats/cats-results.db" ]; then \
		$(call log_error,"test/outputs/cats/cats-results.db not found. Run 'make parse-cats-results' first."); \
		exit 1; \
	fi
	@./scripts/query-cats-results.sh test/outputs/cats/cats-results.db

.PHONY: analyze-cats-results
analyze-cats-results: parse-cats-results query-cats-results  ## Parse and query CATS results
	$(call log_success,"CATS analysis complete")


# ============================================================================
# CONTAINER SECURITY AND BUILD MANAGEMENT
# ============================================================================

.PHONY: build-containers build-container-db build-container-redis build-container-tmi scan-containers scan-trivy report-containers update-docker-scout

# Update Docker Scout CLI
update-docker-scout:
	$(call log_info,Updating Docker Scout CLI...)
	@curl -fsSL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh -o install-scout.sh
	@sh install-scout.sh
	@rm -f install-scout.sh
	$(call log_success,Docker Scout CLI updated successfully)

# Build PostgreSQL container only
build-container-db:
	$(call log_info,Building PostgreSQL container...)
	@$(MAKE) -f $(MAKEFILE_LIST) update-docker-scout
	@./scripts/build-containers.sh postgresql
	$(call log_success,PostgreSQL container built successfully)

# Build Redis container only
build-container-redis:
	$(call log_info,Building Redis container...)
	@$(MAKE) -f $(MAKEFILE_LIST) update-docker-scout
	@./scripts/build-containers.sh redis
	$(call log_success,Redis container built successfully)

# Build TMI server container only
build-container-tmi:
	$(call log_info,Building TMI server container...)
	@$(MAKE) -f $(MAKEFILE_LIST) update-docker-scout
	@./scripts/build-containers.sh application
	$(call log_success,TMI server container built successfully)

# Build all containers with vulnerability patching (runs individual builds serially)
build-containers: build-container-db build-container-redis build-container-tmi
	$(call log_success,All containers built successfully)

# Run security scan on existing containers
scan-containers:
	$(call log_info,Running security scans on container images...)
	@$(MAKE) -f $(MAKEFILE_LIST) update-docker-scout
	@if ! command -v docker scout >/dev/null 2>&1; then \
		$(call log_error,Docker Scout not available after update. Installation may have failed); \
		exit 1; \
	fi
	@mkdir -p security-reports
	@echo "Scanning cgr.dev/chainguard/postgres:latest..."
	@docker scout cves cgr.dev/chainguard/postgres:latest --only-severity critical,high > security-reports/postgresql-scan.txt 2>&1 || true
	@echo "Scanning tmi/tmi-redis:latest..."
	@docker scout cves tmi/tmi-redis:latest --only-severity critical,high > security-reports/redis-scan.txt 2>&1 || true
	@if [ -f "Dockerfile.dev" ]; then \
		echo "Building and scanning application image..."; \
		docker build -f Dockerfile.dev -t tmi-temp-scan:latest . >/dev/null 2>&1 || true; \
		docker scout cves tmi-temp-scan:latest --only-severity critical,high > security-reports/application-scan.txt 2>&1 || true; \
		docker rmi tmi-temp-scan:latest >/dev/null 2>&1 || true; \
	fi
	$(call log_success,Security scans completed. Reports in security-reports/)

# Run Trivy filesystem security scan
scan-trivy:
	$(call log_info,Running Trivy filesystem security scan...)
	@if ! command -v trivy >/dev/null 2>&1; then \
		$(call log_error,Trivy not found. Please install it first.); \
		$(call log_info,See: https://aquasecurity.github.io/trivy/); \
		$(call log_info,On MacOS with Homebrew: brew install trivy); \
		exit 1; \
	fi
	@trivy fs --ignorefile ./.trivyignore.yaml .
	$(call log_success,Trivy filesystem scan completed)

# Generate comprehensive security report
report-containers: scan-containers
	$(call log_info,Generating container security report...)
	@mkdir -p security-reports
	@echo "# TMI Container Security Report" > security-reports/security-summary.md
	@echo "" >> security-reports/security-summary.md
	@echo "**Generated:** $$(date)" >> security-reports/security-summary.md
	@echo "**Scanner:** Docker Scout" >> security-reports/security-summary.md
	@echo "" >> security-reports/security-summary.md
	@echo "## Vulnerability Summary" >> security-reports/security-summary.md
	@echo "" >> security-reports/security-summary.md
	@echo "| Image | Critical | High | Status |" >> security-reports/security-summary.md
	@echo "|-------|----------|------|--------|" >> security-reports/security-summary.md
	@for scan in postgresql redis application; do \
		if [ -f "security-reports/$$scan-scan.txt" ]; then \
			critical=$$( (grep -c "CRITICAL" "security-reports/$$scan-scan.txt" 2>/dev/null || echo "0") | tail -1 | tr -d '\n\r ' ); \
			high=$$( (grep -c "HIGH" "security-reports/$$scan-scan.txt" 2>/dev/null || echo "0") | tail -1 | tr -d '\n\r ' ); \
			status="✅ Good"; \
			if [ "$$critical" -gt "0" ] 2>/dev/null; then status="❌ Critical Issues"; \
			elif [ "$$high" -gt "3" ] 2>/dev/null; then status="⚠️ High Issues"; fi; \
			echo "| $$scan | $$critical | $$high | $$status |" >> security-reports/security-summary.md; \
		fi; \
	done
	@echo "" >> security-reports/security-summary.md
	@echo "## Recommendations" >> security-reports/security-summary.md
	@echo "" >> security-reports/security-summary.md
	@echo "1. Use \`make containers-build\` to build patched containers" >> security-reports/security-summary.md
	@echo "2. Regularly update base images" >> security-reports/security-summary.md
	@echo "3. Implement runtime security monitoring" >> security-reports/security-summary.md
	@echo "4. Review detailed scan results in security-reports/" >> security-reports/security-summary.md
	$(call log_success,Security report generated: security-reports/security-summary.md)

# Start development environment with containers (builds containers first)
start-containers-environment:
	$(call log_info,Starting development environment with containers...)
	@./scripts/make-containers-dev-local.sh
	$(call log_success,Development environment started)

# Shorthand for all container operations
build-containers-all: build-containers report-containers

# ============================================================================
# PROMTAIL CONTAINER MANAGEMENT
# ============================================================================

.PHONY: build-promtail start-promtail stop-promtail clean-promtail

build-promtail:
	$(call log_info,Building Promtail container...)
	@./scripts/build-promtail-container.sh

start-promtail:
	$(call log_info,Starting Promtail container...)
	@CONTAINER="promtail"; \
	LOG_DIR=$$(pwd)/logs; \
	if [ -z "$$LOKI_URL" ]; then \
		if [ -f promtail/config.yaml ]; then \
			LOKI_URL=$$(grep -A1 'clients:' promtail/config.yaml | grep 'url:' | sed 's/.*url: *//'); \
			echo -e "$(BLUE)[INFO]$(NC) Using Loki URL from promtail/config.yaml"; \
		else \
			echo -e "$(RED)[ERROR]$(NC) LOKI_URL environment variable not set and promtail/config.yaml not found"; \
			echo -e "$(BLUE)[INFO]$(NC) Set LOKI_URL (required), and optionally LOKI_USERNAME and LOKI_PASSWORD"; \
			exit 1; \
		fi; \
	fi; \
	if ! docker ps -a --format "{{.Names}}" | grep -q "^$$CONTAINER$$"; then \
		echo -e "$(BLUE)[INFO]$(NC) Creating new Promtail container..."; \
		echo -e "$(BLUE)[INFO]$(NC) Mounting log directory: $$LOG_DIR"; \
		docker run -d \
			--name $$CONTAINER \
			-e LOKI_URL="$$LOKI_URL" \
			-e LOKI_USERNAME="$$LOKI_USERNAME" \
			-e LOKI_PASSWORD="$$LOKI_PASSWORD" \
			-v $$LOG_DIR:/logs:ro \
			-v /var/log/tmi:/var/log/tmi:ro \
			tmi/promtail:latest; \
	elif ! docker ps --format "{{.Names}}" | grep -q "^$$CONTAINER$$"; then \
		echo -e "$(BLUE)[INFO]$(NC) Starting existing Promtail container..."; \
		docker start $$CONTAINER; \
	fi; \
	echo "✅ Promtail container is running"

stop-promtail:
	$(call log_info,Stopping Promtail container...)
	@docker stop promtail 2>/dev/null || true
	$(call log_success,"Promtail container stopped")

clean-promtail:
	$(call log_warning,"Removing Promtail container...")
	@docker rm -f promtail 2>/dev/null || true
	$(call log_success,"Promtail container removed")

# ============================================================================
# DISTROLESS CONTAINER MANAGEMENT
# ============================================================================


# ============================================================================
# BACKWARD COMPATIBILITY ALIASES
# ============================================================================

.PHONY: build build-everything test lint clean dev

# Keep backward compatibility with existing commands
build: build-server
build-everything: build-server
test: test-unit
lint:
	@$(HOME)/go/bin/golangci-lint run ./api/... ./auth/... ./cmd/... ./internal/...
clean: clean-everything
dev: start-dev

# ============================================================================
# Heroku Configuration
# ============================================================================

.PHONY: setup-heroku setup-heroku-dry-run

setup-heroku: ## Configure Heroku environment variables interactively
	$(call log_info,"Starting Heroku environment configuration...")
	@uv run scripts/setup-heroku-env.py

setup-heroku-dry-run: ## Preview Heroku configuration without applying
	$(call log_info,"Previewing Heroku configuration (dry-run mode)...")
	@uv run scripts/setup-heroku-env.py --dry-run

.PHONY: reset-db-heroku drop-db-heroku
reset-db-heroku: ## Drop and recreate Heroku database schema (DESTRUCTIVE - deletes all data). Use ARGS="--yes" to skip confirmation
	$(call log_warning,"This will DELETE ALL DATA in the Heroku database!")
	@./scripts/heroku-reset-database.sh $(ARGS) tmi-server

drop-db-heroku: ## Drop Heroku database schema leaving it empty (DESTRUCTIVE - deletes all data, no migrations). Use ARGS="--yes" to skip confirmation
	$(call log_warning,"This will DELETE ALL DATA in the Heroku database and leave it EMPTY!")
	@./scripts/heroku-drop-database.sh $(ARGS) tmi-server

# ============================================================================
# Heroku Deployment
# ============================================================================

# Deploy to Heroku production
# This target builds the server, commits changes, and deploys to Heroku
deploy-heroku:
	@echo "$(COLOR_BLUE)[INFO]$(COLOR_RESET) Starting Heroku deployment..."
	@echo "$(COLOR_BLUE)[INFO]$(COLOR_RESET) Building server binary..."
	@$(MAKE) build-server
	@echo "$(COLOR_BLUE)[INFO]$(COLOR_RESET) Checking git status..."
	@if [ -n "$$(git status --porcelain)" ]; then \
		echo "$(COLOR_BLUE)[INFO]$(COLOR_RESET) Committing changes..."; \
		git add -A; \
		git commit -m "chore: Build and deploy to Heroku [skip ci]" || true; \
	else \
		echo "$(COLOR_BLUE)[INFO]$(COLOR_RESET) No changes to commit"; \
	fi
	@echo "$(COLOR_BLUE)[INFO]$(COLOR_RESET) Pushing to GitHub main branch..."
	@git push origin main
	@echo "$(COLOR_BLUE)[INFO]$(COLOR_RESET) Pushing to Heroku..."
	@git push heroku main
	@echo "$(COLOR_GREEN)[SUCCESS]$(COLOR_RESET) Deployment complete!"
	@echo "$(COLOR_BLUE)[INFO]$(COLOR_RESET) Checking deployment status..."
	@heroku releases --app tmi-server | head -3


# ============================================================================
# WEBSOCKET TEST HARNESS
# ============================================================================

.PHONY: build-wstest wstest monitor-wstest clean-wstest

build-wstest:
	$(call log_info,Building WebSocket test harness...)
	@cd wstest && go mod tidy && go build -o wstest
	$(call log_success,WebSocket test harness built successfully)

wstest: build-wstest
	$(call log_info,Starting WebSocket test with 3 terminals...)
	@# Check if server is running
	@if ! curl -s http://localhost:8080 > /dev/null 2>&1; then \
		echo -e "$(RED)[ERROR]$(NC) Server not running. Please run 'make start-dev' first"; \
		exit 1; \
	fi
	@# Terminal 1: Host (alice)
	@if [ "$$TERM_PROGRAM" = "Apple_Terminal" ] || [ "$$TERM_PROGRAM" = "iTerm.app" ]; then \
		osascript -e 'tell app "Terminal" to do script "cd $(PWD)/wstest && timeout 30 ./wstest --user alice --host --participants \"bob,charlie,hobobarbarian@gmail.com\""' > /dev/null; \
	elif command -v gnome-terminal > /dev/null 2>&1; then \
		gnome-terminal -- bash -c "cd $(PWD)/wstest && timeout 30 ./wstest --user alice --host --participants 'bob,charlie,hobobarbarian@gmail.com'; exec bash" & \
	elif command -v xterm > /dev/null 2>&1; then \
		xterm -e "cd $(PWD)/wstest && timeout 30 ./wstest --user alice --host --participants 'bob,charlie,hobobarbarian@gmail.com'" & \
	else \
		echo -e "$(YELLOW)[WARNING]$(NC) Could not detect terminal emulator. Running in background..."; \
		cd wstest && timeout 30 ./wstest --user alice --host --participants "bob,charlie,hobobarbarian@gmail.com" > alice.log 2>&1 & \
		echo "Host (alice) running in background, see wstest/alice.log"; \
	fi
	@# Wait for host to start
	@sleep 3
	@# Terminal 2: Participant (bob)
	@if [ "$$TERM_PROGRAM" = "Apple_Terminal" ] || [ "$$TERM_PROGRAM" = "iTerm.app" ]; then \
		osascript -e 'tell app "Terminal" to do script "cd $(PWD)/wstest && timeout 30 ./wstest --user bob"' > /dev/null; \
	elif command -v gnome-terminal > /dev/null 2>&1; then \
		gnome-terminal -- bash -c "cd $(PWD)/wstest && timeout 30 ./wstest --user bob; exec bash" & \
	elif command -v xterm > /dev/null 2>&1; then \
		xterm -e "cd $(PWD)/wstest && timeout 30 ./wstest --user bob" & \
	else \
		cd wstest && timeout 30 ./wstest --user bob > bob.log 2>&1 & \
		echo "Participant (bob) running in background, see wstest/bob.log"; \
	fi
	@# Terminal 3: Participant (charlie)
	@if [ "$$TERM_PROGRAM" = "Apple_Terminal" ] || [ "$$TERM_PROGRAM" = "iTerm.app" ]; then \
		osascript -e 'tell app "Terminal" to do script "cd $(PWD)/wstest && timeout 30 ./wstest --user charlie"' > /dev/null; \
	elif command -v gnome-terminal > /dev/null 2>&1; then \
		gnome-terminal -- bash -c "cd $(PWD)/wstest && timeout 30 ./wstest --user charlie; exec bash" & \
	elif command -v xterm > /dev/null 2>&1; then \
		xterm -e "cd $(PWD)/wstest && timeout 30 ./wstest --user charlie" & \
	else \
		cd wstest && timeout 30 ./wstest --user charlie > charlie.log 2>&1 & \
		echo "Participant (charlie) running in background, see wstest/charlie.log"; \
	fi
	$(call log_success,WebSocket test started with 3 terminals)
	@echo "Watch the terminals for WebSocket activity. Use 'make clean-wstest' to stop all instances."

monitor-wstest: build-wstest
	$(call log_info,Starting WebSocket monitor...)
	@# Check if server is running
	@if ! curl -s http://localhost:8080 > /dev/null 2>&1; then \
		echo -e "$(RED)[ERROR]$(NC) Server not running. Please run 'make start-dev' first"; \
		exit 1; \
	fi
	@# Run monitor in foreground
	@cd wstest && ./wstest --user monitor

clean-wstest:
	$(call log_info,Stopping all WebSocket test harness instances...)
	@# Kill all wstest processes
	@if pgrep -f "wstest" > /dev/null 2>&1; then \
		pkill -f "wstest" && \
		echo -e "$(GREEN)[SUCCESS]$(NC) All WebSocket test harness instances stopped"; \
	else \
		echo -e "$(YELLOW)[WARNING]$(NC) No WebSocket test harness instances found"; \
	fi
	@# Clean up any log files
	@rm -f wstest/*.log 2>/dev/null || true

# ============================================================================
# SBOM GENERATION - Software Bill of Materials
# ============================================================================

.PHONY: check-cyclonedx check-syft generate-sbom generate-sbom-all build-with-sbom build-server-sbom

# Check for cyclonedx-gomod (Go components)
check-cyclonedx:
	@if ! command -v cyclonedx-gomod >/dev/null 2>&1; then \
		$(call log_error,cyclonedx-gomod not found); \
		echo ""; \
		$(call log_info,Install using:); \
		echo "  Homebrew: brew install cyclonedx/cyclonedx/cyclonedx-gomod"; \
		echo "  Go:       go install github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest"; \
		exit 1; \
	fi
	@$(call log_success,cyclonedx-gomod is available)

# Check for Syft (container images)
check-syft:
	@if ! command -v syft >/dev/null 2>&1; then \
		$(call log_error,Syft not found); \
		echo ""; \
		$(call log_info,Install using:); \
		echo "  Homebrew: brew install syft"; \
		echo "  Script:   curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin"; \
		exit 1; \
	fi
	@$(call log_success,Syft is available)

# Generate SBOM for Go application only
generate-sbom: check-cyclonedx
	$(call log_info,Generating SBOM for Go application...)
	@mkdir -p security-reports/sbom
	@cyclonedx-gomod app -json -output security-reports/sbom/tmi-server-$(VERSION)-sbom.json -main cmd/server
	@cyclonedx-gomod app -output security-reports/sbom/tmi-server-$(VERSION)-sbom.xml -main cmd/server
	$(call log_success,SBOM generated: security-reports/sbom/tmi-server-$(VERSION)-sbom.json)
	$(call log_success,SBOM generated: security-reports/sbom/tmi-server-$(VERSION)-sbom.xml)

# Generate all SBOMs (Go app + modules)
generate-sbom-all: check-cyclonedx
	$(call log_info,Generating all Go SBOMs...)
	@mkdir -p security-reports/sbom
	@cyclonedx-gomod app -json -output security-reports/sbom/tmi-server-$(VERSION)-sbom.json -main cmd/server
	@cyclonedx-gomod app -output security-reports/sbom/tmi-server-$(VERSION)-sbom.xml -main cmd/server
	@cyclonedx-gomod mod -json -output security-reports/sbom/tmi-module-$(VERSION)-sbom.json
	@cyclonedx-gomod mod -output security-reports/sbom/tmi-module-$(VERSION)-sbom.xml
	$(call log_success,All Go SBOMs generated in security-reports/sbom/)

# Build server with SBOM
build-with-sbom: build-server generate-sbom

# Alias for build-with-sbom
build-server-sbom: build-with-sbom

# ============================================================================
# VALIDATION TARGETS
# ============================================================================

.PHONY: validate-openapi parse-openapi-validation validate-asyncapi scan-openapi-security arazzo-install arazzo-scaffold arazzo-enhance generate-arazzo validate-arazzo arazzo-all

# ============================================================================
# ARAZZO WORKFLOW GENERATION
# ============================================================================

arazzo-install:
	$(call log_info,Installing Arazzo tooling...)
	@pnpm install
	$(call log_success,Arazzo tools installed)

arazzo-scaffold: arazzo-install
	$(call log_info,Generating base scaffold with Redocly CLI...)
	@bash scripts/generate-arazzo-scaffold.sh
	$(call log_success,Base scaffold generated)

arazzo-enhance:
	$(call log_info,Enhancing with TMI workflow data...)
	@uv run scripts/enhance-arazzo-with-workflows.py
	$(call log_success,Enhanced Arazzo created at api-schema/tmi.arazzo.{yaml,json})

validate-arazzo:
	$(call log_info,Validating Arazzo specifications...)
	@uv run scripts/validate-arazzo.py \
		api-schema/tmi.arazzo.yaml \
		api-schema/tmi.arazzo.json
	$(call log_success,Arazzo specifications are valid)

generate-arazzo: arazzo-scaffold arazzo-enhance validate-arazzo
	$(call log_success,Arazzo specification generation complete)

arazzo-all: arazzo-install generate-arazzo
	$(call log_success,Complete Arazzo workflow finished)

# ============================================================================
# OPENAPI/ASYNCAPI VALIDATION
# ============================================================================

OPENAPI_SPEC := api-schema/tmi-openapi.json
OPENAPI_VALIDATION_REPORT := test/outputs/api-validation/openapi-validation-report.json
OPENAPI_VALIDATION_DB := test/outputs/api-validation/openapi-validation.db
ASYNCAPI_SPEC := api-schema/tmi-asyncapi.yml
ASYNCAPI_VALIDATION_REPORT := test/outputs/api-validation/asyncapi-validation-report.json

validate-openapi:
	$(call log_info,Validating OpenAPI specification...)
	@# Step 1: JSON syntax validation with jq
	@if ! jq empty $(OPENAPI_SPEC) 2>/dev/null; then \
		echo -e "$(RED)[ERROR]$(NC) Invalid JSON syntax in $(OPENAPI_SPEC)"; \
		jq empty $(OPENAPI_SPEC); \
		exit 1; \
	fi
	$(call log_success,JSON syntax is valid)
	@# Step 2: OpenAPI linting with Vacuum (includes OWASP rules) - JSON output only
	@if command -v vacuum >/dev/null 2>&1; then \
		echo -e "$(BLUE)[INFO]$(NC) Running Vacuum OpenAPI analysis (with OWASP rules)..."; \
		vacuum report $(OPENAPI_SPEC) -r vacuum-ruleset.yaml --no-style -o > $(OPENAPI_VALIDATION_REPORT) 2>/dev/null; \
		ERRORS=$$(jq '.resultSet.errorCount // 0' $(OPENAPI_VALIDATION_REPORT)); \
		WARNINGS=$$(jq '.resultSet.warningCount // 0' $(OPENAPI_VALIDATION_REPORT)); \
		INFOS=$$(jq '.resultSet.infoCount // 0' $(OPENAPI_VALIDATION_REPORT)); \
		echo -e "$(BLUE)[INFO]$(NC) Results: $$ERRORS errors, $$WARNINGS warnings, $$INFOS info"; \
		if [ "$$ERRORS" -gt 0 ]; then \
			echo -e "$(RED)[ERROR]$(NC) Validation failed with $$ERRORS errors"; \
			echo -e "$(BLUE)[INFO]$(NC) Loading results into SQLite database for analysis..."; \
			uv run scripts/parse-openapi-validation.py --report $(OPENAPI_VALIDATION_REPORT) --db $(OPENAPI_VALIDATION_DB) --summary; \
			echo -e "$(BLUE)[INFO]$(NC) Query database: sqlite3 $(OPENAPI_VALIDATION_DB) 'SELECT * FROM error_summary'"; \
			exit 1; \
		fi; \
	else \
		echo -e "$(RED)[ERROR]$(NC) Vacuum not found - required for OpenAPI validation"; \
		echo -e "$(BLUE)[INFO]$(NC) Install with: brew install vacuum"; \
		exit 1; \
	fi
	$(call log_success,OpenAPI validation complete. Report: $(OPENAPI_VALIDATION_REPORT))

parse-openapi-validation:
	$(call log_info,Parsing OpenAPI validation report into SQLite database...)
	@uv run scripts/parse-openapi-validation.py --report $(OPENAPI_VALIDATION_REPORT) --db $(OPENAPI_VALIDATION_DB) --summary
	$(call log_success,Validation results loaded into: $(OPENAPI_VALIDATION_DB))

validate-asyncapi:
	$(call log_info,Validating AsyncAPI specification with Spectral...)
	@uv run scripts/validate-asyncapi.py $(ASYNCAPI_SPEC) --format json --output $(ASYNCAPI_VALIDATION_REPORT)
	@uv run scripts/validate-asyncapi.py $(ASYNCAPI_SPEC)
	$(call log_success,AsyncAPI validation complete. Report: $(ASYNCAPI_VALIDATION_REPORT))

# ============================================================================
# STATUS CHECKING
# ============================================================================

.PHONY: status

status:
	@echo "TMI Service Status Check"
	@echo "========================"
	@echo ""
	@printf "%-1s %-23s %-6s %-13s %-35s %s\n" "S" "SERVICE" "PORT" "STATUS" "PROCESS" "CHANGE STATE"
	@printf "%-1s %-23s %-6s %-13s %-35s %s\n" "-" "-----------------------" "------" "-------------" "-----------------------------------" "--------------------"
	@# Check Service (port 8080) - look for actual server process
	@# First check by port, then fall back to PID file for starting servers
	@SERVICE_PID=""; \
	for pid in $$(lsof -ti :8080 2>/dev/null || true); do \
		PROC_CMD=$$(ps -p $$pid -o args= 2>/dev/null | head -1 || true); \
		if echo "$$PROC_CMD" | grep -q "bin/tmiserver\|tmiserver.*--config"; then \
			SERVICE_PID=$$pid; \
			break; \
		fi; \
	done; \
	if [ -z "$$SERVICE_PID" ] && [ -f .server.pid ]; then \
		PID_FROM_FILE=$$(cat .server.pid 2>/dev/null || true); \
		if [ -n "$$PID_FROM_FILE" ] && ps -p $$PID_FROM_FILE > /dev/null 2>&1; then \
			PROC_CMD=$$(ps -p $$PID_FROM_FILE -o args= 2>/dev/null | head -1 || true); \
			if echo "$$PROC_CMD" | grep -q "bin/tmiserver\|tmiserver.*--config"; then \
				SERVICE_PID=$$PID_FROM_FILE; \
			fi; \
		fi; \
	fi; \
	if [ -n "$$SERVICE_PID" ]; then \
		SERVICE_NAME=$$(ps -p $$SERVICE_PID -o args= 2>/dev/null | head -1 | awk '{print $$1}' | xargs basename 2>/dev/null || echo "unknown"); \
		HEALTH_RESPONSE=$$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 2 --max-time 5 http://localhost:8080 2>/dev/null || echo "000"); \
		if [ "$$HEALTH_RESPONSE" = "200" ]; then \
			printf "\033[0;32m✓\033[0m %-23s %-6s %-13s %-35s %s\n" "Service" "8080" "Running" "$$SERVICE_PID ($$SERVICE_NAME)" "make stop-server"; \
			API_VERSION=$$(curl -s http://localhost:8080 2>/dev/null | jq -r '.api.version // "unknown"' 2>/dev/null || echo "unknown"); \
			SERVICE_BUILD=$$(curl -s http://localhost:8080 2>/dev/null | jq -r '.service.build // "unknown"' 2>/dev/null || echo "unknown"); \
			if [ "$$API_VERSION" != "unknown" ] || [ "$$SERVICE_BUILD" != "unknown" ]; then \
				printf "  %-44s API Version: $$API_VERSION, Build: $$SERVICE_BUILD\n" ""; \
			fi; \
		else \
			printf "\033[1;33m⏳\033[0m %-23s %-6s %-13s %-35s %s\n" "Service" "8080" "Starting" "$$SERVICE_PID ($$SERVICE_NAME)" "make stop-server"; \
			printf "  %-44s Process running but not responding (migrations/init)\n" ""; \
		fi; \
	else \
		printf "\033[0;31m✗\033[0m %-23s %-6s %-13s %-35s %s\n" "Service" "8080" "Stopped" "-" "make start-server"; \
	fi
	@# Check Database (port 5432) - check for Docker container
	@DB_CONTAINER=$$(docker ps --filter "publish=5432" --filter "status=running" --format "{{.Names}}" 2>/dev/null | head -1 || true); \
	if [ -n "$$DB_CONTAINER" ]; then \
		DB_IMAGE=$$(docker ps --filter "name=$$DB_CONTAINER" --format "{{.Image}}" 2>/dev/null | head -1 || echo "unknown"); \
		printf "\033[0;32m✓\033[0m %-23s %-6s %-13s %-35s %s\n" "Database" "5432" "Running" "container: $$DB_CONTAINER" "make stop-database"; \
	else \
		printf "\033[0;31m✗\033[0m %-23s %-6s %-13s %-35s %s\n" "Database" "5432" "Stopped" "-" "make start-database"; \
	fi
	@# Check Redis (port 6379) - check for Docker container
	@REDIS_CONTAINER=$$(docker ps --filter "publish=6379" --filter "status=running" --format "{{.Names}}" 2>/dev/null | head -1 || true); \
	if [ -n "$$REDIS_CONTAINER" ]; then \
		REDIS_IMAGE=$$(docker ps --filter "name=$$REDIS_CONTAINER" --format "{{.Image}}" 2>/dev/null | head -1 || echo "unknown"); \
		printf "\033[0;32m✓\033[0m %-23s %-6s %-13s %-35s %s\n" "Redis" "6379" "Running" "container: $$REDIS_CONTAINER" "make stop-redis"; \
	else \
		printf "\033[0;31m✗\033[0m %-23s %-6s %-13s %-35s %s\n" "Redis" "6379" "Stopped" "-" "make start-redis"; \
	fi
	@# Check Application (port 4200) - look for listening process (LISTEN state)
	@APP_PID=$$(lsof -sTCP:LISTEN -ti :4200 2>/dev/null | head -1 || true); \
	if [ -n "$$APP_PID" ]; then \
		APP_NAME=$$(ps -p $$APP_PID -o args= 2>/dev/null | head -1 | awk '{print $$1}' | xargs basename 2>/dev/null || echo "unknown"); \
		printf "\033[0;32m✓\033[0m %-23s %-6s %-13s %-35s %s\n" "Application" "4200" "Running" "$$APP_PID ($$APP_NAME)" "-"; \
	else \
		printf "\033[0;31m✗\033[0m %-23s %-6s %-13s %-35s %s\n" "Application" "4200" "Stopped" "-" "-"; \
	fi
	@# Check OAuth Stub (port 8079) - optional
	@OAUTH_PID=$$(lsof -ti :8079 2>/dev/null | head -1 || true); \
	if [ -n "$$OAUTH_PID" ]; then \
		OAUTH_NAME=$$(ps -p $$OAUTH_PID -o args= 2>/dev/null | head -1 | awk '{print $$1}' | xargs basename 2>/dev/null || echo "unknown"); \
		printf "\033[0;32m✓\033[0m %-23s %-6s %-13s %-35s %s\n" "OAuth Stub" "8079" "Running" "$$OAUTH_PID ($$OAUTH_NAME)" "make stop-oauth-stub"; \
	else \
		printf "\033[1;33m⚬\033[0m %-23s %-6s %-13s %-35s %s\n" "OAuth Stub (Optional)" "8079" "Not running" "-" "make start-oauth-stub"; \
	fi
	@echo ""

# ============================================================================
# HELP AND UTILITIES
# ============================================================================

help:
	@echo "TMI Refactored Makefile - Configuration-Driven Atomic Components"
	@echo ""
	@echo "Usage: make <target> [CONFIG=<config-name>]"
	@echo ""
	@echo "Core Composite Targets (use these):"
	@echo "  status                 - Check status of all services"
	@echo "  test-unit              - Run unit tests"
	@echo "  test-integration       - Run integration tests with PostgreSQL (default)"
	@echo "  test-integration-pg    - Run integration tests with PostgreSQL (Docker)"
	@echo "  test-integration-oci   - Run integration tests with Oracle ADB"
	@echo "  start-dev              - Start development environment"
	@echo "  start-dev-oci          - Start dev environment with OCI Autonomous Database"
	@echo "  reset-db-oci           - Drop all tables in OCI ADB (destructive)"
	@echo "  clean-dev              - Clean development environment"
	@echo ""
	@echo "Container Management (Docker Scout Integration):"
	@echo "  update-docker-scout          - Update Docker Scout CLI to latest version"
	@echo "  build-container-db           - Build PostgreSQL container only"
	@echo "  build-container-redis        - Build Redis container only"
	@echo "  build-container-tmi          - Build TMI server container only"
	@echo "  build-containers             - Build all containers (db, redis, tmi serially)"
	@echo "  scan-containers              - Scan existing containers for vulnerabilities"
	@echo "  scan-trivy                   - Run Trivy filesystem security scan"
	@echo "  report-containers            - Generate comprehensive security report"
	@echo "  start-containers-environment - Start development with containers"
	@echo "  build-containers-all         - Run full container build and report"
	@echo ""
	@echo "SBOM Generation (Software Bill of Materials):"
	@echo "  generate-sbom                - Generate SBOM for Go application (cyclonedx-gomod)"
	@echo "  generate-sbom-all            - Generate all Go SBOMs (app + modules)"
	@echo "  build-with-sbom              - Build server and generate SBOM"
	@echo "  build-server-sbom            - Alias for build-with-sbom"
	@echo "  check-cyclonedx              - Verify cyclonedx-gomod is installed"
	@echo "  check-syft                   - Verify Syft is installed"
	@echo ""
	@echo "Atomic Components (building blocks):"
	@echo "  start-database         - Start PostgreSQL container"
	@echo "  start-redis            - Start Redis container"
	@echo "  build-server           - Build server binary"
	@echo "  migrate-database       - Run database migrations"
	@echo "  reset-database         - Drop database and run migrations (DESTRUCTIVE)"
	@echo "  start-server           - Start server"
	@echo "  clean-everything       - Clean up everything"
	@echo ""
	@echo "WebSocket Testing:"
	@echo "  build-wstest           - Build WebSocket test harness"
	@echo "  wstest                 - Run WebSocket test with 3 terminals (alice, bob, charlie)"
	@echo "  monitor-wstest         - Run WebSocket test harness with user 'monitor'"
	@echo "  clean-wstest           - Stop all running WebSocket test instances"
	@echo ""
	@echo "Arazzo Workflow Generation:"
	@echo "  generate-arazzo        - Generate Arazzo workflow specifications (YAML + JSON)"
	@echo "  validate-arazzo        - Validate generated Arazzo specifications"
	@echo "  arazzo-scaffold        - Generate base scaffold from OpenAPI (Redocly)"
	@echo "  arazzo-enhance         - Enhance scaffold with TMI workflow data"
	@echo "  arazzo-install         - Install Arazzo tooling (Redocly, Spectral)"
	@echo "  arazzo-all             - Full Arazzo generation pipeline"
	@echo ""
	@echo "Validation Targets:"
	@echo "  validate-openapi       - Validate OpenAPI specification"
	@echo "  validate-asyncapi      - Validate AsyncAPI specification"
	@echo ""
	@echo "Configuration Files:"
	@echo "  config/test-unit.yml           - Unit testing configuration"
	@echo "  config/test-integration.yml    - Integration testing configuration"
	@echo "  config/dev-environment.yml     - Development environment configuration"
	@echo "  config/coverage-report.yml     - Coverage reporting configuration"
	@echo ""

list-targets:
	@make -qp | awk -F':' '/^[a-zA-Z0-9][^$$#\/\t=]*:([^=]|$$)/ {print $$1}' | grep -v '^Makefile$$' | sort