/**
 * The independent derivation path for banca's golden vectors.
 *
 * NOTHING HERE IMPORTS test-dist/. A vector generated from the implementation
 * it pins proves that the implementation agrees with itself, which is not a
 * property anyone wanted. So every byte a vector asserts is produced here:
 *
 *   · canonical JSON, re-implemented from its spec sentence ("sorted keys, no
 *     whitespace, JSON-safe values only");
 *   · the two signature preimages banca touches, written out as LITERAL
 *     TEMPLATES a reader can hold beside an artifact and check character by
 *     character;
 *   · Ed25519 via @noble/curves and SHA-256 via node:crypto — never id-kit,
 *     never social-kit, never the kit the app links against.
 *
 * The FOLD's expectations are not derived here at all: they are hand-computed
 * and written as literals in build-vectors.mjs, beside an `input_desc` sentence
 * a reader can check without running anything. Arithmetic a machine did is not
 * evidence about the machine that did it.
 *
 * Pure module: importing it computes nothing and writes nothing.
 */

import { createHash } from "node:crypto";
import { ed25519 } from "@noble/curves/ed25519";

// ---- fixed test material ----------------------------------------------------
//
// The seeds are wallet-kit's own fixture seeds, deliberately: the actor public
// keys below are literally the ones in wallet-kit/test/vectors/artifacts.json,
// so a reader can lay the two fixtures side by side, and banca's transcription
// of the wpo preimage is checked against a string wallet-kit published rather
// than against anything banca computed. Nothing here is a real identity.

export const seedBytes = (fill) => {
  const b = new Uint8Array(32);
  if (typeof fill === "number") b.fill(fill);
  else for (let i = 0; i < 32; i++) b[i] = fill(i);
  return b;
};

export const SEED_PAYER = seedBytes((i) => i); //        bytes 00..1f
export const SEED_PAYEE = seedBytes((i) => 32 + i); //   bytes 20..3f
export const SEED_BANK = seedBytes(0x11);
export const SEED_BANK2 = seedBytes(0x33);
export const SEED_THIRD = seedBytes(0x55); //            a relaying member
export const SEED_OUTSIDER = seedBytes(0x77); //         never a member

/** 2025-01-01T00:00:00Z. Fixed and in the past, so no verdict moves with a clock. */
export const TS_FIXED = 1735689600000;

export const b64url = (bytes) => Buffer.from(bytes).toString("base64url");
export const utf8 = (s) => new Uint8Array(Buffer.from(s, "utf8"));
export const sha256b64url = (s) => createHash("sha256").update(Buffer.from(s, "utf8")).digest("base64url");

/** The seed IS the raw Ed25519 private key — id-kit and @noble/curves agree. */
export const pubOf = (seed) => b64url(ed25519.getPublicKey(seed));
export const signOver = (seed, preimage) => b64url(ed25519.sign(utf8(preimage), seed));
export const verifyOver = (pub, sigB64url, preimage) =>
  ed25519.verify(Buffer.from(sigB64url, "base64url"), utf8(preimage), Buffer.from(pub, "base64url"));

export const ACTORS = {
  bankPub: pubOf(SEED_BANK),
  bank2Pub: pubOf(SEED_BANK2),
  payerPub: pubOf(SEED_PAYER),
  payeePub: pubOf(SEED_PAYEE),
  thirdPub: pubOf(SEED_THIRD),
  outsiderPub: pubOf(SEED_OUTSIDER),
};

export const CUR = `${ACTORS.bankPub}.LEI`;
export const CUR2 = `${ACTORS.bank2Pub}.LEI`;

/** 16 deterministic bytes -> a canonical 22-char base64url order id. */
export const orderIdBytes = (n) => new Uint8Array(16).map((_, i) => (n + i) & 0xff);

// ---- canonical JSON, re-implemented from the spec ---------------------------
//
// Enough of the dispatch for these artifacts (objects, strings, integers,
// booleans, null) and no more — its job is to DISAGREE with a wrong
// implementation, not to be one.

export function canonIndependent(v) {
  if (v === null) return "null";
  const t = typeof v;
  if (t === "number" || t === "boolean" || t === "string") return JSON.stringify(v);
  if (Array.isArray(v)) return "[" + v.map(canonIndependent).join(",") + "]";
  if (t === "object") {
    const keys = Object.keys(v)
      .filter((k) => v[k] !== undefined)
      .sort();
    return "{" + keys.map((k) => JSON.stringify(k) + ":" + canonIndependent(v[k])).join(",") + "}";
  }
  throw new Error("canonIndependent: unsupported " + t);
}

/**
 * The two preimages banca touches, written out by hand rather than assembled.
 *
 * These templates are the point of this file. A reader can check, character by
 * character, that the keys are in ASCII order, that there is no whitespace, and
 * that the domain prefix is the right one. `canonIndependent` then has to agree
 * with the template, and banca's `lib/wallet.cljs` has to agree with both.
 */
export function orderPreimageByHand(a) {
  const s = JSON.stringify;
  return (
    `wpay-ord|v1|{"amt":${a.amt},"ctx":${s(a.ctx)},"cur":${s(a.cur)},"exp":${a.exp},` +
    `"from":${s(a.from)},"id":${s(a.id)},"memo":${s(a.memo)},"seq":${a.seq},` +
    `"t":"wpo","to":${s(a.to)},"ts":${a.ts},"v":1}`
  );
}

export function receiptPreimageByHand(r) {
  const s = JSON.stringify;
  // `po` is the WHOLE SIGNED ORDER, `sig` included, canonicalised as a nested
  // object — sorted keys all the way down.
  //
  // This line was wrong in the first draft (it used the UNSIGNED order) and the
  // fixture caught it within a minute: banca's transcription disagreed with the
  // template, and wallet-kit's own published wrc preimage settled which was
  // right. Worth leaving the scar visible — a receipt whose preimage omitted
  // `po.sig` would let a bank re-issue the same settlement over a re-signed
  // order, which is the whole reason the signed order is inside it.
  const po = canonIndependent(r.po);
  return `wpay-rcp|v1|{"bank":${s(r.bank)},"po":${po},"seq":${s(r.seq)},"t":"wrc","ts":${r.ts},"v":1}`;
}

/**
 * The issuance receipt's preimage: domain "wpay-iss", nine keys in ASCII order
 * (amt, bank, cur, h, seq, t, to, ts, v — note "t" < "to" < "ts"). `bsig` is
 * appended on the wire and never part of what it signs. `wri.seq` is the
 * BANK's own issuance slot NUMBER — a third meaning of the word beside
 * `wpo.seq` (the payer's number) and `wrc.seq` (the bank's log-ref STRING).
 */
export function issuancePreimageByHand(i) {
  const s = JSON.stringify;
  return (
    `wpay-iss|v1|{"amt":${i.amt},"bank":${s(i.bank)},"cur":${s(i.cur)},"h":${s(i.h)},` +
    `"seq":${i.seq},"t":"wri","to":${s(i.to)},"ts":${i.ts},"v":1}`
  );
}

/** wri minus `bsig`, in the nine-key wire order (v,t,cur,seq,to,amt,h,ts,bank). */
export function unsignedIssuanceByHand(i) {
  return { v: 1, t: "wri", cur: i.cur, seq: i.seq, to: i.to, amt: i.amt, h: i.h, ts: i.ts, bank: i.bank };
}

/** The banker's `bsig` for one pinned mint: Ed25519 over the wri preimage. */
export function signIssuance({ bankSeed, cur, seq, to, amt, h, ts }) {
  const unsigned = { cur, seq, to, amt, h, ts, bank: pubOf(bankSeed) };
  const preimage = issuancePreimageByHand(unsigned);
  if (preimage !== `wpay-iss|v1|${canonIndependent(unsignedIssuanceByHand(unsigned))}`) {
    throw new Error("independent.mjs: the by-hand wri template and canonIndependent disagree");
  }
  return signOver(bankSeed, preimage);
}

/** wpo minus `sig`, in the twelve-key wire order. */
export function unsignedOrderByHand(o) {
  return {
    v: 1,
    t: "wpo",
    id: o.id,
    cur: o.cur,
    amt: o.amt,
    seq: o.seq,
    from: o.from,
    to: o.to,
    ctx: o.ctx,
    memo: o.memo,
    ts: o.ts,
    exp: o.exp,
  };
}

// ---- artifact builders ------------------------------------------------------

/**
 * A signed payment order. THIRTEEN keys in wpo's fixed order — `sig` appended,
 * never part of what it signs.
 *
 * `idN` seeds the 16 random bytes so two orders that differ only in id are
 * still distinguishable; every other field is explicit, because a fixture whose
 * inputs are defaulted is a fixture nobody can check.
 */
export function makeOrder({ seed, idN, cur, amt, seq, to, ctx = "", memo = "", ts = TS_FIXED, ttl = 600000 }) {
  const unsigned = {
    v: 1,
    t: "wpo",
    id: b64url(orderIdBytes(idN)),
    cur,
    amt,
    seq,
    from: pubOf(seed),
    to,
    ctx,
    memo,
    ts,
    exp: ts + ttl,
  };
  const preimage = orderPreimageByHand(unsigned);
  if (preimage !== `wpay-ord|v1|${canonIndependent(unsigned)}`) {
    throw new Error("independent.mjs: the by-hand template and canonIndependent disagree");
  }
  return { ...unsigned, sig: signOver(seed, preimage) };
}

/** The banker's `bsig` for one settled payment: Ed25519 over the wrc preimage. */
export function signReceipt({ bankSeed, po, logRef, ts }) {
  return signOver(bankSeed, receiptPreimageByHand({ po, seq: logRef, ts, bank: pubOf(bankSeed) }));
}

// ---- BANK/2 escrow, independently derived -----------------------------------
//
// The same discipline as the payment artifacts: preimages written out as
// literal templates so a reader can check the ASCII key order and the domain
// prefix character by character, and signatures from @noble/curves.

/** The fixture hashlock preimage: 32 bytes, 0xc0..0xdf. Fixed, never random. */
export const HASHLOCK_PRE = b64url(new Uint8Array(32).map((_, i) => 0xc0 + i));
/** sha256 of that TEXT — not of the bytes. See wallet-kit consts, HASHLOCK. */
export const HASHLOCK_HASH = sha256b64url(HASHLOCK_PRE);

export function lockPreimageByHand(a) {
  const s = JSON.stringify;
  // Note where ASCII sorting puts `hash`: after `from`, before `id` — nowhere
  // near where it sits on the wire (between `to` and `ctx`).
  return (
    `wpay-lock|v1|{"amt":${a.amt},"ctx":${s(a.ctx)},"cur":${s(a.cur)},"exp":${a.exp},` +
    `"from":${s(a.from)},"hash":${s(a.hash)},"id":${s(a.id)},"memo":${s(a.memo)},` +
    `"seq":${a.seq},"t":"wlk","to":${s(a.to)},"ts":${a.ts},"v":1}`
  );
}

export function releasePreimageByHand(r) {
  const s = JSON.stringify;
  return `wpay-rel|v1|{"cur":${s(r.cur)},"lh":${s(r.lh)},"t":"wrl","to":${s(r.to)},"ts":${r.ts},"v":1}`;
}

/** A signed escrow lock order. FOURTEEN keys — wpo's thirteen plus `hash`. */
export function makeLock({ seed, idN, cur, amt, seq, to, hash = HASHLOCK_HASH, ctx = "", memo = "", ts = TS_FIXED, ttl = 600000 }) {
  const unsigned = {
    v: 1,
    t: "wlk",
    id: b64url(orderIdBytes(idN)),
    cur,
    amt,
    seq,
    from: pubOf(seed),
    to,
    hash,
    ctx,
    memo,
    ts,
    exp: ts + ttl,
  };
  const preimage = lockPreimageByHand(unsigned);
  if (preimage !== `wpay-lock|v1|${canonIndependent(unsigned)}`) {
    throw new Error("independent.mjs: the by-hand lock template and canonIndependent disagree");
  }
  return { ...unsigned, sig: signOver(seed, preimage) };
}

/** A signed beneficiary release. SEVEN keys. The signer IS the beneficiary. */
export function makeRelease({ seed, cur, lh, ts = TS_FIXED }) {
  const unsigned = { v: 1, t: "wrl", cur, lh, to: pubOf(seed), ts };
  const preimage = releasePreimageByHand(unsigned);
  if (preimage !== `wpay-rel|v1|${canonIndependent(unsigned)}`) {
    throw new Error("independent.mjs: the by-hand release template and canonIndependent disagree");
  }
  return { ...unsigned, sig: signOver(seed, preimage) };
}

export function lockReceiptPreimageByHand(r) {
  const s = JSON.stringify;
  // wlr SHARES wrc's domain: same act, same signer, instruction embedded, and
  // `t` inside canon() is what keeps the two preimages apart.
  return (
    `wpay-rcp|v1|{"bank":${s(r.bank)},"lk":${canonIndependent(r.lk)},"seq":${s(r.seq)},` +
    `"t":"wlr","ts":${r.ts},"v":1}`
  );
}

/** The banker's `bsig` for one claimed lock: Ed25519 over the wlr preimage. */
export function signLockReceipt({ bankSeed, lk, logRef, ts }) {
  return signOver(bankSeed, lockReceiptPreimageByHand({ lk, seq: logRef, ts, bank: pubOf(bankSeed) }));
}

export const opLock = (ts, lk) => ({ t: "lock", ts, lk });
export const opClaim = (ts, h, pre) => ({ t: "claim", ts, h, pre });
export const opUnlock = (ts, h, rel) =>
  rel === undefined ? { t: "unlock", ts, h } : { t: "unlock", ts, h, rel };

// ---- synthetic log entries --------------------------------------------------
//
// A rooms-kit LogEntryMeta is {hash, from, clock, op}. Real hashes are base58btc
// CIDs ~49 characters long; the fold treats a hash as an OPAQUE COMPARABLE
// STRING and never parses one, so these fixtures use short sortable names
// ("h01", "h02", …). That exercises exactly the same comparison path and lets a
// reader work out the (clock, hash) order by eye — which is the whole point of a
// fixture about tie-breaks.

export const entry = (hash, clock, from, op) => ({ hash, from, clock, op });

// ---- BANK/1 op builders (independent of lib/protocol.cljs) ------------------
//
// Written out in the key order docs/PROTOCOL.md specifies. If banca's builders
// ever emit a different order, the key-order vector goes red — which is the only
// reason to have a second set.

export const opCharter = (ts, name, code, sym, dec, join) => ({ t: "charter", ts, name, code, sym, dec, join });
export const opOpen = (ts, name) => ({ t: "open", ts, name });
export const opAcct = (ts, to, op) => ({ t: "acct", ts, to, op });
export const opMint = (ts, seq, to, amt, memo) =>
  memo === undefined ? { t: "mint", ts, seq, to, amt } : { t: "mint", ts, seq, to, amt, memo };
export const opBurn = (ts, seq, amt) => ({ t: "burn", ts, seq, amt });
export const opPay = (ts, po) => ({ t: "pay", ts, po });
export const opAck = (ts, h, bsig) => ({ t: "ack", ts, h, bsig });
export const opRate = (ts, num, den) => ({ t: "rate", ts, num, den });
export const opReq = (ts, to, amt, memo) =>
  memo === undefined ? { t: "req", ts, to, amt } : { t: "req", ts, to, amt, memo };

// ---- permutations -----------------------------------------------------------

/**
 * Deterministic insertion orders for the order-independence family: the entries
 * as given, reversed, and a fixed stride-3 rotation. Three orders rather than
 * two, because "as given" and "reversed" alone would not catch a fold that
 * happened to be symmetric.
 */
export function permutations(xs) {
  const rev = [...xs].reverse();
  const stride = [];
  for (let off = 0; off < 3; off++) for (let i = off; i < xs.length; i += 3) stride.push(xs[i]);
  return [[...xs], rev, stride];
}