#!/usr/bin/env node
// agent-ancora.mjs: LANTUL ca martor al registrului unui agent (punctul 22, pista B, 2026-09-30).
//
// Ce ramasese deschis dupa B-17 (spus in README): momentul unei intrari e declaratia celui care tine cheia agentului; verificatorul il
// margineste de SUS cu ceasul lui, dar de JOS numai daca primeste ancore de la un martor (`anchors` in verifyLedger), iar fara martor
// cine tine cheia poate antedata intrari. Aici martorul e AereNotary: capul registrului (seq, hash) devine un plic AIP-23
// (`aere-agent-ledger-head`), se noteaza pe lant, iar momentul `firstSeen` pe care il tine contractul, citit prin verificatorul AIP-23 de
// referinta sub un certificat post-cuantic de ancora (dovada Merkle in starea certificata), devine ancora {seq, hash, at}. De aici:
//   - o intrare de DUPA cap nu poate declara un moment sub firstSeen - toleranta (antedatarea e prinsa);
//   - o intrare de PANA LA cap nu poate declara un moment peste firstSeen + toleranta;
//   - un registru care nu contine capul notarizat (alta ramura a aceluiasi agent) nu verifica cu aceasta ancora.
// Momentul nu il alege nici agentul, nici cine noteaza: il scrie lantul. Cine noteaza poate numai sa INTARZIE notarizarea (atunci
// marginea e mai slaba), nu sa o mute inainte. Nimic din registru (actiuni, sume) nu ajunge pe lant: numai hash-ul declaratiei capului.
//
// Fisierul de ancore il produce VERIFICATORUL, cu RPC-ul si verificatorul AIP-23 alese de el; o lista de ancore primita de la cel
// verificat nu dovedeste nimic (ar fi declaratia lui).
//
//   node agent-ancora.mjs head --ledger l.json [--seq N] [--out head.json]            the head as an AIP-23 envelope (no network)
//   node agent-ancora.mjs notarize --head head.json --rpc URL --key-file f [--notary 0x..] [--out notarized.json]
//        refuses chain 2800 (mainnet: a real transaction paid by the key's account) unless AERE_CONFIRM_MAINNET=yes
//   node agent-ancora.mjs anchors --ledger l.json --head n1.json [--head n2.json ...] --rpc URL [--verify-proof verify-proof.mjs]
//        [--chain 28001] [--out anchors.json]      anchors for `agent-cli.mjs verify --anchors`, each read through the AIP-23 verifier
// Iesiri: 0 da; 1 nu (un cap nu e al registrului, notarizarea sau finalitatea pica); 2 folosire gresita sau NEMASURAT (finalitate
// in asteptare, verificator lipsa).
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import crypto from 'node:crypto';
import { spawn } from 'node:child_process';
import { fileURLToPath, pathToFileURL } from 'node:url';

export const HEAD_KIND = 'aere-agent-ledger-head';
export const NOTARI = { 2800: '0x4aB392c4Aca7D9D4C16c0b60a9514c5025bd58c7', 28001: '0x70099E62735500AA2F85B60C518551a57B202d54' };
const AICI = path.dirname(fileURLToPath(import.meta.url));
const sha = (s) => '0x' + crypto.createHash('sha256').update(Buffer.from(s, 'utf8')).digest('hex');
const H32 = /^0x[0-9a-f]{64}$/;
const HASH_INTRARE = /^[0-9a-f]{64}$/;   // hash-ul unei intrari de registru: 64 hex, fara 0x (agent-ledger.mjs)

/** Capul registrului la `seq` (implicit ultima intrare), ca plic AIP-23. Declaratia numeste agentul, sesiunea, politica, seq si hash-ul. */
export function ledgerHeadEnvelope(ledger, { seq = null, createdAt = new Date().toISOString() } = {}) {
  if (!ledger || !Array.isArray(ledger.entries) || !ledger.entries.length) throw new Error('agent-ancora: a ledger with at least one entry is required');
  const s = seq == null ? ledger.entries.length - 1 : Number(seq);
  const e = ledger.entries[s];
  if (!Number.isInteger(s) || !e || e.seq !== s || !HASH_INTRARE.test(String(e.hash))) throw new Error(`agent-ancora: the ledger has no entry ${seq}`);
  const statement = { v: 1, kind: HEAD_KIND, agentId: ledger.agentId, session: ledger.session, policyHash: String(ledger.policyHash).toLowerCase(), seq: s, hash: e.hash, createdAt };
  return { v: 1, kind: HEAD_KIND + '-attestation', statement, statementHash: sha(JSON.stringify(statement)) };
}

/** Plicul e un cap de registru intreg (statementHash se reface) si numeste o intrare a ACESTUI registru? */
export function headMatchesLedger(env, ledger) {
  const st = env && env.statement;
  if (!st || env.kind !== HEAD_KIND + '-attestation' || st.kind !== HEAD_KIND) return { ok: false, motiv: `not an ${HEAD_KIND} attestation` };
  if (!H32.test(String(env.statementHash)) || sha(JSON.stringify(st)) !== env.statementHash) return { ok: false, motiv: 'the statementHash does not match the statement (modified envelope)' };
  if (st.agentId !== ledger.agentId || st.session !== ledger.session || String(st.policyHash).toLowerCase() !== String(ledger.policyHash).toLowerCase()) return { ok: false, motiv: 'the head names another agent, session or policy' };
  const e = Number.isInteger(st.seq) ? ledger.entries[st.seq] : null;
  if (!e || e.hash !== st.hash) return { ok: false, motiv: `the head names seq ${st.seq} with a hash this ledger does not have there (another branch or another ledger)` };
  return { ok: true, seq: st.seq, hash: st.hash };
}

/** Cheia secp256k1 dintr-un fisier: hex singur (cu sau fara 0x) sau un rand `d=` / `PRIVATE_KEY=`; nu se tipareste niciodata. */
export function cheiaDinFisier(f) {
  const randuri = fs.readFileSync(f, 'utf8').split(/\r?\n/).map((l) => l.trim()).filter(Boolean);
  const r = randuri.find((l) => /^(d|PRIVATE_KEY)=/.test(l)) || (randuri.length === 1 ? randuri[0] : '');
  const hex = r.replace(/^(d|PRIVATE_KEY)=/, '').replace(/^0x/, '').trim();
  if (!/^[0-9a-fA-F]{1,64}$/.test(hex)) throw new Error('the key file holds no secp256k1 key (a hex key, or a d= / PRIVATE_KEY= line)');
  return '0x' + hex.padStart(64, '0');
}

/** Pune statementHash-ul capului pe AereNotary. Lantul se citeste de pe RPC, nu se crede din argument; cheia din fisier, netiparita. */
export async function notarizeHead({ envelope, rpc, keyFile, ethers, notary = null, confirmMainnet = process.env.AERE_CONFIRM_MAINNET === 'yes' }) {
  const taie = (s) => String(s ?? '').replace(/(0x)?[0-9a-fA-F]{40,}/g, '<hex>').slice(0, 300);
  const st = envelope && envelope.statement;
  if (!st || envelope.kind !== HEAD_KIND + '-attestation' || st.kind !== HEAD_KIND || !H32.test(String(envelope.statementHash))) return { ok: false, cod: 2, motiv: `REFUSED: not an ${HEAD_KIND} attestation with a 32-byte statementHash` };
  if (sha(JSON.stringify(st)) !== envelope.statementHash) return { ok: false, cod: 1, motiv: 'REFUSED: statementHash does not match the statement (modified envelope)' };
  try {
    const provider = new ethers.JsonRpcProvider(rpc);
    const chainId = Number((await provider.getNetwork()).chainId);
    if (chainId === 2800 && !confirmMainnet) return { ok: false, cod: 3, motiv: 'REFUSED: this RPC serves chain 2800 (Aere Network mainnet); a notarization there is a real transaction paid by the key\'s account. Set AERE_CONFIRM_MAINNET=yes to send it.' };
    const adr = notary || NOTARI[chainId];
    if (!adr || !/^0x[0-9a-fA-F]{40}$/.test(adr)) return { ok: false, cod: 2, motiv: `REFUSED: no known notary on chain ${chainId}; pass --notary` };
    const cod = await provider.getCode(adr);
    if (!cod || cod === '0x') return { ok: false, cod: 1, motiv: `REFUSED: there is no contract at ${adr} on chain ${chainId}` };
    const wallet = new ethers.Wallet(cheiaDinFisier(keyFile), provider);
    const c = new ethers.Contract(adr, ['function notarize(bytes32 h) external', 'function firstSeen(bytes32) view returns (uint64)'], wallet);
    let txHash = null, block = null;
    if (!(Number(await c.firstSeen(envelope.statementHash)) > 0)) {
      const tx = await c.notarize(envelope.statementHash); const rc = await tx.wait(1, 180000);
      if (!rc || rc.status !== 1) return { ok: false, cod: 1, motiv: 'the notarization transaction failed' };
      txHash = rc.hash; block = rc.blockNumber;
    }
    const firstSeen = Number(await c.firstSeen(envelope.statementHash));
    if (!(firstSeen > 0)) return { ok: false, cod: 1, motiv: 'firstSeen is still 0 after the notarization' };
    return { ok: true, envelope: { ...envelope, notarization: { chainId, notary: adr, firstSeen, ...(txHash ? { txHash, block } : { already: true }) } } };
  } catch (e) { return { ok: false, cod: 1, motiv: 'the notarization failed: ' + taie(e.shortMessage || e.message) }; }
}

// verificatorul AIP-23 intoarce momentul in detaliul nivelului de finalitate, "as first seen at <ISO> (<unix>)"; il citim de acolo si
// cerem ca cele doua forme sa fie acelasi moment. Daca forma detaliului se schimba, raspunsul e NEMASURAT, nu o ancora ghicita.
const PRIMA_VEDERE = /as first seen at (\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z) \((\d+)\)/;
export function firstSeenFromVerdict(v) {
  const f = v && Array.isArray(v.levels) ? v.levels.find((x) => x.level === 'finality') : null;
  if (!f) return { stare: 'NEMASURAT', motiv: 'the verifier gave no finality level' };
  if (f.state !== 'PASSED') return { stare: f.state === 'FAILED' ? 'FAILED' : 'NEMASURAT', motiv: `finality ${f.state}: ${String(f.detail).slice(0, 200)}` };
  const m = PRIMA_VEDERE.exec(String(f.detail));
  if (!m || Math.floor(Date.parse(m[1]) / 1000) !== Number(m[2])) return { stare: 'NEMASURAT', motiv: 'finality PASSED, but its detail does not state the first-seen time in the form this tool reads' };
  return { stare: 'PASSED', at: Number(m[2]) };
}

/** Ruleaza verificatorul AIP-23 pe un plic si intoarce JSON-ul lui (sau null). */
export function ruleazaVerificatorul(verifyProof, envFile, { rpc, chain }) {
  return new Promise((ok) => {
    const args = [verifyProof, envFile, '--json', ...(rpc ? ['--rpc', rpc] : []), ...(chain ? ['--chain', String(chain)] : [])];
    const c = spawn(process.execPath, args); let out = '';
    c.stdout.on('data', (d) => { out += d; }); c.stderr.on('data', () => {});
    const ceas = setTimeout(() => c.kill(), 300000);
    c.on('error', () => { clearTimeout(ceas); ok(null); });
    c.on('close', () => { clearTimeout(ceas); try { ok(JSON.parse(out)); } catch { ok(null); } });
  });
}

/**
 * Ancorele registrului din capete notarizate: fiecare cap trebuie sa fie al registrului si sa aiba finalitate post-cuantica PASSED
 * la verificatorul AIP-23 (rulat de `ruleaza`, implicit verify-proof.mjs). Intoarce {stare: 'OK'|'FAILED'|'NEMASURAT', anchors, randuri}.
 */
export async function anchorsFromNotarizedHeads(ledger, envelopes, { verifyProof, rpc, chain = null, ruleaza = ruleazaVerificatorul, tmpDir = null } = {}) {
  const anchors = [], randuri = []; let stare = 'OK';
  const dir = fs.mkdtempSync(path.join(tmpDir || os.tmpdir(), 'aere-agent-ancora-'));
  try {
    for (const env of envelopes) {
      const m = headMatchesLedger(env, ledger);
      if (!m.ok) { randuri.push({ head: env && env.statementHash, pass: false, detail: m.motiv }); stare = 'FAILED'; continue; }
      const f = path.join(dir, `${m.seq}.json`); fs.writeFileSync(f, JSON.stringify(env));
      // lantul: cel cerut de verificator; altfel cel declarat de plic (spus in ancora, ca un timp de testnet sa nu treaca drept unul de 2800)
      const lant = chain || (env.notarization && Number(env.notarization.chainId)) || null;
      const v = await ruleaza(verifyProof, f, { rpc, chain: lant });
      if (!v) { randuri.push({ head: env.statementHash, seq: m.seq, pass: null, detail: 'the AIP-23 verifier did not answer' }); if (stare === 'OK') stare = 'NEMASURAT'; continue; }
      if (v.statementHash && String(v.statementHash).toLowerCase() !== env.statementHash) { randuri.push({ head: env.statementHash, seq: m.seq, pass: false, detail: 'the verifier judged another statementHash' }); stare = 'FAILED'; continue; }
      const fs2 = firstSeenFromVerdict(v);
      if (fs2.stare === 'FAILED') { randuri.push({ head: env.statementHash, seq: m.seq, pass: false, detail: fs2.motiv }); stare = 'FAILED'; continue; }
      if (fs2.stare !== 'PASSED') { randuri.push({ head: env.statementHash, seq: m.seq, pass: null, detail: fs2.motiv }); if (stare === 'OK') stare = 'NEMASURAT'; continue; }
      anchors.push({ seq: m.seq, hash: m.hash, at: fs2.at, statementHash: env.statementHash, chainId: lant, chainAsked: !!chain, witness: 'AereNotary first-seen under a post-quantum certified anchor' });
      randuri.push({ head: env.statementHash, seq: m.seq, pass: true, detail: `seq ${m.seq} first seen on chain ${lant}${chain ? '' : ' (the chain the envelope declares; pass --chain to require one)'} at ${new Date(fs2.at * 1000).toISOString()}` });
    }
  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
  return { stare, anchors: anchors.sort((a, b) => a.seq - b.seq), randuri };
}

// ---------------------------------------------------------------- linia de comanda
class Folosire extends Error {}
async function main(argv) {
  const [cmd, ...rest] = argv;
  const get = (f) => { const i = rest.indexOf(f); return i >= 0 ? rest[i + 1] : undefined; };
  const toate = (f) => rest.flatMap((a, i) => (a === f && rest[i + 1] != null ? [rest[i + 1]] : []));
  const citeste = (f, ce) => { if (!f) throw new Folosire(`--${ce} is required`); try { return JSON.parse(fs.readFileSync(f, 'utf8')); } catch (e) { throw new Folosire(`cannot read ${ce} file ${f}: ${e.message}`); } };
  const scrie = (o, f) => { const s = JSON.stringify(o, null, 1) + '\n'; if (f) fs.writeFileSync(f, s); else process.stdout.write(s); };
  if (cmd === 'head') {
    const env = ledgerHeadEnvelope(citeste(get('--ledger'), 'ledger'), { seq: get('--seq') != null ? Number(get('--seq')) : null });
    scrie(env, get('--out')); if (get('--out')) console.log(`head seq ${env.statement.seq}: ${env.statementHash}`); return 0;
  }
  if (cmd === 'notarize') {
    if (!get('--rpc') || !get('--key-file')) throw new Folosire('notarize --head head.json --rpc URL --key-file f [--notary 0x..] [--out f]');
    const { incarcaEthers } = await import(pathToFileURL(path.join(AICI, 'x402', 'wallet.mjs')).href);
    let ethers; try { ethers = incarcaEthers(); } catch (e) { console.error(e.message); return 2; }
    const r = await notarizeHead({ envelope: citeste(get('--head'), 'head'), rpc: get('--rpc'), keyFile: get('--key-file'), ethers, notary: get('--notary') || null });
    if (!r.ok) { console.error(r.motiv); return r.cod; }
    scrie(r.envelope, get('--out'));
    const n = r.envelope.notarization; console.log(`notarized on chain ${n.chainId} at ${n.notary}: firstSeen ${n.firstSeen}${n.txHash ? `, block ${n.block}` : ' (already notarized)'}`);
    return 0;
  }
  if (cmd === 'anchors') {
    const verifyProof = get('--verify-proof') || process.env.AERE_VERIFY_PROOF;
    if (!verifyProof || !fs.existsSync(verifyProof)) { console.error('NEMASURAT: the AIP-23 reference verifier is needed (--verify-proof <verify-proof.mjs> or AERE_VERIFY_PROOF)'); return 2; }
    if (!get('--rpc')) throw new Folosire('anchors needs --rpc <url>: the chain is read, not trusted from the envelope');
    const heads = toate('--head'); if (!heads.length) throw new Folosire('anchors needs at least one --head notarized.json');
    const r = await anchorsFromNotarizedHeads(citeste(get('--ledger'), 'ledger'), heads.map((f) => citeste(f, 'head')), { verifyProof, rpc: get('--rpc'), chain: get('--chain') ? Number(get('--chain')) : null });
    for (const x of r.randuri) console.error(`${x.pass === true ? 'ok' : x.pass === false ? 'FAIL' : '--'}  ${x.detail}`);
    if (r.stare === 'OK') scrie(r.anchors, get('--out'));
    console.error(r.stare === 'OK' ? `${r.anchors.length} anchor(s): pass them to agent-cli.mjs verify --anchors` : r.stare === 'FAILED' ? 'FAILED: no anchors written' : 'NOT MEASURED: no anchors written (finality pending or the verifier did not answer)');
    return r.stare === 'OK' ? 0 : r.stare === 'FAILED' ? 1 : 2;
  }
  throw new Folosire('usage: agent-ancora.mjs head|notarize|anchors ... (see README.md)');
}
if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
  main(process.argv.slice(2)).then((c) => { process.exitCode = c; }, (e) => { console.error(`agent-ancora: ${e.message}`); process.exitCode = e instanceof Folosire ? 2 : 1; });
}