Extend Vexer attestation/export stack and Concelier OSV fixes

src/StellaOps.Vexer.Export/ExportEngine.cs

@@ -37,18 +37,24 @@ public sealed class VexExportEngine : IExportEngine
     private readonly IVexExportDataSource _dataSource;
     private readonly IReadOnlyDictionary<VexExportFormat, IVexExporter> _exporters;
     private readonly ILogger<VexExportEngine> _logger;
+    private readonly IVexCacheIndex? _cacheIndex;
+    private readonly IReadOnlyList<IVexArtifactStore> _artifactStores;
 
     public VexExportEngine(
         IVexExportStore exportStore,
         IVexPolicyEvaluator policyEvaluator,
         IVexExportDataSource dataSource,
         IEnumerable<IVexExporter> exporters,
-        ILogger<VexExportEngine> logger)
+        ILogger<VexExportEngine> logger,
+        IVexCacheIndex? cacheIndex = null,
+        IEnumerable<IVexArtifactStore>? artifactStores = null)
     {
         _exportStore = exportStore ?? throw new ArgumentNullException(nameof(exportStore));
         _policyEvaluator = policyEvaluator ?? throw new ArgumentNullException(nameof(policyEvaluator));
         _dataSource = dataSource ?? throw new ArgumentNullException(nameof(dataSource));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+        _cacheIndex = cacheIndex;
+        _artifactStores = artifactStores?.ToArray() ?? Array.Empty<IVexArtifactStore>();
 
         if (exporters is null)
         {
@@ -69,9 +75,25 @@ public sealed class VexExportEngine : IExportEngine
             if (cached is not null)
             {
                 _logger.LogInformation("Reusing cached export for {Signature} ({Format})", signature.Value, context.Format);
-                return cached with { FromCache = true };
+                return new VexExportManifest(
+                    cached.ExportId,
+                    cached.QuerySignature,
+                    cached.Format,
+                    cached.CreatedAt,
+                    cached.Artifact,
+                    cached.ClaimCount,
+                    cached.SourceProviders,
+                    fromCache: true,
+                    cached.ConsensusRevision,
+                    cached.Attestation,
+                    cached.SizeBytes);
             }
         }
+        else if (_cacheIndex is not null)
+        {
+            await _cacheIndex.RemoveAsync(signature, context.Format, cancellationToken).ConfigureAwait(false);
+            _logger.LogInformation("Force refresh requested; invalidated cache entry for {Signature} ({Format})", signature.Value, context.Format);
+        }
 
         var dataset = await _dataSource.FetchAsync(context.Query, cancellationToken).ConfigureAwait(false);
         var exporter = ResolveExporter(context.Format);
@@ -87,6 +109,31 @@ public sealed class VexExportEngine : IExportEngine
         await using var buffer = new MemoryStream();
         var result = await exporter.SerializeAsync(exportRequest, buffer, cancellationToken).ConfigureAwait(false);
 
+        if (_artifactStores.Count > 0)
+        {
+            var writtenBytes = buffer.ToArray();
+            try
+            {
+                var artifact = new VexExportArtifact(
+                    result.Digest,
+                    context.Format,
+                    writtenBytes,
+                    result.Metadata);
+
+                foreach (var store in _artifactStores)
+                {
+                    await store.SaveAsync(artifact, cancellationToken).ConfigureAwait(false);
+                }
+
+                _logger.LogInformation("Stored export artifact {Digest} via {StoreCount} store(s)", result.Digest.ToUri(), _artifactStores.Count);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "Failed to store export artifact {Digest}", result.Digest.ToUri());
+                throw;
+            }
+        }
+
         var exportId = FormattableString.Invariant($"exports/{context.RequestedAt:yyyyMMddTHHmmssfffZ}/{digest.Digest}");
         var manifest = new VexExportManifest(
             exportId,
@@ -123,6 +170,7 @@ public static class VexExportServiceCollectionExtensions
     public static IServiceCollection AddVexExportEngine(this IServiceCollection services)
     {
         services.AddSingleton<IExportEngine, VexExportEngine>();
+        services.AddVexExportCacheServices();
         return services;
     }
 }