Chapter 3: Understanding Pack Algebra & Deterministic Composition

# Step 1: Create auth Pack spec
cat > auth-pack.yaml << 'EOF'
apiVersion: apx.dev/v1
kind: Pack
metadata:
  name: authentication-jwt
  version: 1.0.0
spec:
  transformations:
    files:
      - action: create
        path: middleware/auth.ts
        content_hash: sha256:abc123...
        template: |
          import jwt from 'jsonwebtoken';
          export function authMiddleware(req, res, next) {
            const token = req.headers.authorization?.split(' ')[1];
            if (!token) return res.status(401).json({ error: 'No token' });
            try {
              req.user = jwt.verify(token, process.env.JWT_SECRET);
              next();
            } catch(e) {
              res.status(403).json({ error: 'Invalid token' });
            }
          }
      - action: modify
        path: routes/api.ts
        operation: inject_middleware
        location: { before_all_routes: true }
        content: "import { authMiddleware } from '../middleware/auth';"
  semantics:
    state_machine:
      states: [Unauthenticated, Authenticated]
      transitions:
        - from: Unauthenticated
          to: Authenticated
          event: valid_token_provided
    contracts:
      invariants:
        - name: token_required
          formula: "∀req: protected_route(req) → has_token(req)"
  composition:
    conflicts:
      route_modification:
        policy: merge_sequence
        priority: 100
EOF

# Step 2: Create rate limit Pack spec
cat > ratelimit-pack.yaml << 'EOF'
apiVersion: apx.dev/v1
kind: Pack
metadata:
  name: rate-limiting
  version: 1.0.0
spec:
  transformations:
    files:
      - action: create
        path: middleware/ratelimit.ts
        template: |
          import rateLimit from 'express-rate-limit';
          export const rateLimiter = rateLimit({
            windowMs: 15 * 60 * 1000, // 15 minutes
            max: 100, // limit each user to 100 requests per windowMs
            keyGenerator: (req) => req.user?.id || req.ip
          });
      - action: modify
        path: routes/api.ts
        operation: inject_middleware
        location: { after_middleware: "authMiddleware" }
        content: "import { rateLimiter } from '../middleware/ratelimit';"
  dependencies:
    requires:
      - pack: authentication-jwt
        version: ">=1.0.0"
        reason: "Needs req.user.id for per-user rate limiting"
  semantics:
    contracts:
      preconditions:
        - "req.user must be defined" # Requires auth first!
      invariants:
        - name: rate_limit_enforced
          formula: "∀user: request_count(user, 15min) ≤ 100"
  composition:
    conflicts:
      route_modification:
        policy: merge_sequence
        priority: 90 # Lower than auth, so applies after
EOF

# Step 3: Validate composition
apx compose auth-pack.yaml ratelimit-pack.yaml --dry-run

# Expected output:
# ✓ No conflicts detected
# ✓ Dependency satisfied: rate-limiting requires authentication-jwt@>=1.0.0
# ✓ Semantic ordering: auth (priority 100) → ratelimit (priority 90)
# ✓ Combined invariants verified: token_required ∧ rate_limit_enforced
# 
# Composition plan:
# 1. Apply P_auth transformations
# 2. Apply P_ratelimit transformations  
# 3. Verify final state satisfies both invariants
#
# Semantic hash: sha256:f7e2a4b3c9d8...

# Step 4: Apply the composition
apx apply auth-pack.yaml ratelimit-pack.yaml

# Step 5: Verify it worked
npm test -- --grep "auth and rate limiting"