import Foundation

func values(_ input: String) -> [String: String] {
    var result: [String: String] = [:]
    for item in input.split(separator: ";") {
        let pair = item.split(separator: "=", maxSplits: 1).map(String.init)
        if pair.count == 2 { result[pair[0]] = pair[1] }
    }
    return result
}

func evaluate(_ version: String, _ kind: String, _ input: String) -> String {
    let values = values(input)
    switch kind {
    case "version": return ["2", "1", "0"].contains(input) ? "valid" : "invalid:unsupported_version"
    case "page":
        guard let raw = values["limit"], let limit = Int(raw), (1...100).contains(limit) else { return "invalid:invalid_limit" }
        return "valid"
    case "manifest":
        for key in ["provider_url", "vm_address", "password", "private_key"] where values[key] != nil { return "invalid:forbidden_field" }
        return values["version"] == "1" && values["gateway_id"] != nil && values["public_identity"] != nil && (values["grant"]?.utf8.count ?? 0) >= 43 && values["purpose"] == "launch" ? "valid" : "invalid:invalid_manifest"
    case "clipboard": return values["encoding"] == "utf-8" && values["file"] == nil ? "valid" : "invalid:unsupported_clipboard"
    case "session_request":
        guard version == "2" else { return "invalid:unsupported_version" }
        if values["policy_snapshot"] != nil { return "invalid:forbidden_field" }
        guard (try? SessionRequest(
            clientDeviceId: values["client_device_id"] ?? "", deviceKeyId: values["device_key_id"] ?? "",
            poolId: values["pool_id"] ?? "", idempotencyKey: values["idempotency_key"] ?? "",
            requestedDisplayMode: nil
        )) != nil else { return "invalid:required" }
        return "valid"
    case "browser_authenticated_session":
        guard values["client_device_id"] == nil, values["device_key_id"] == nil else { return "invalid:forbidden_field" }
        guard (try? BrowserAuthenticatedSession(
            username: values["username"] ?? "", provider: values["provider"] ?? "",
            roles: [values["roles"] ?? ""], role: values["role"] ?? ""
        )) != nil else { return "invalid:invalid_session" }
        return "valid"
    case "native_authenticated_session":
        guard let identity = try? NativeSessionIdentity(
            clientDeviceId: values["client_device_id"] ?? "", deviceKeyId: values["device_key_id"] ?? ""
        ), values["client_device_id"] != nil, values["device_key_id"] != nil else { return "invalid:required" }
        guard (try? NativeAuthenticatedSession(
            username: values["username"] ?? "", provider: values["provider"] ?? "",
            roles: [values["roles"] ?? ""], role: values["role"] ?? "", nativeIdentity: identity
        )) != nil else { return "invalid:invalid_session" }
        return "valid"
    case "native_tunnel_credential":
        guard (try? NativeTunnelCredential(
            clientDeviceId: values["client_device_id"] ?? "", deviceKeyId: values["device_key_id"] ?? "",
            certificateChainPem: values["certificate_chain_pem"] ?? "", trustBundlePem: values["trust_bundle_pem"] ?? "",
            expiresAt: values["expires_at"] ?? ""
        )) != nil else { return "invalid:invalid_credential" }
        return "valid"
    case "event":
        guard values["version"] == "1" else { return "invalid:unsupported_version" }
        if let after = Int(values["after"] ?? ""), let earliest = Int(values["earliest"] ?? ""), after > 0, earliest > 0, after < earliest - 1 { return "invalid:gap" }
        if (Int(values["payload_bytes"] ?? "") ?? Int.max) > 16384 { return "invalid:payload_limit" }
        guard let sequence = Int(values["sequence"] ?? ""), sequence > 0, values["correlation_id"] != nil else { return "invalid:required" }
        return "valid"
    case "tunnel":
        let registered = ["control.v1", "control.v2", "display.request.v1", "input.absolute.v1", "input.scroll.v1"].contains(values["feature"] ?? "")
        if ["2", "1", "0"].contains(values["offered"] ?? "") && registered { return "valid" }
        return registered ? "invalid:unsupported_version" : "invalid:unsupported_feature"
    case "datagram": return classifyDatagram(values["hex"] ?? "")
    case "gateway_input": return classifyGatewayInput(values["hex"] ?? "")
    case "gateway_feedback": return classifyGatewayFeedback(values["hex"] ?? "")
    case "gateway_clipboard":
        if values["file"] != nil { return "invalid:forbidden" }
        guard let direction = values["direction"], let text = values["text"],
              let encoding = values["encoding"], let token = values["loop_token"],
              (try? GatewayClipboardText(
                  direction: direction, text: text, encoding: encoding, loopToken: token
              )) != nil else { return "invalid:clipboard" }
        return "valid"
    case "gateway_clipboard_audit":
        if values["text"] != nil { return "invalid:forbidden" }
        guard ["client_to_provider", "provider_to_client"].contains(values["direction"] ?? ""), ["forwarded", "suppressed", "rejected"].contains(values["outcome"] ?? ""), ["forwarded", "loop", "policy", "rate", "provider", "malformed"].contains(values["reason"] ?? ""), let textBytes = Int(values["text_bytes"] ?? ""), (0...65536).contains(textBytes) else { return "invalid:clipboard_audit" }
        return "valid"
    default: return "invalid:unknown_kind"
    }
}

func evaluateDeviceProof(_ input: String) -> String {
    let values = values(input)
    let serverID = Data(decodeHex(values["server_id"] ?? "")!)
    let principalID = Data(decodeHex(values["principal_id"] ?? "")!)
    let deviceID = Data(decodeHex(values["device_id"] ?? "")!)
    let challenge = Data(decodeHex(values["challenge"] ?? "")!)
    let expiry = Int64(values["expiry_unix_ms"] ?? "")!
    return try! deviceRegistrationProofTranscript(
        serverID: serverID, principalID: principalID, deviceID: deviceID,
        challenge: challenge, expiryUnixMilliseconds: expiry
    ).map { String(format: "%02x", $0) }.joined()
}

func decodeHex(_ encoded: String) -> [UInt8]? {
    let characters = Array(encoded)
    guard characters.count % 2 == 0 else { return nil }
    var raw: [UInt8] = []
    for index in stride(from: 0, to: characters.count, by: 2) {
        guard let byte = UInt8(String(characters[index...index + 1]), radix: 16) else { return nil }
        raw.append(byte)
    }
    return raw
}

func classifyGatewayInput(_ encoded: String) -> String {
    guard let raw = decodeHex(encoded) else { return "invalid:hex" }
    guard raw.count >= 6 else { return "invalid:truncated" }
    guard Array(raw[0..<4]) == Array("VGI1".utf8) else { return "invalid:magic" }
    let kind = raw[4]
    let body = Array(raw.dropFirst(6))
    guard body.count == Int(raw[5]) else { return "invalid:length" }
    switch kind {
    case 1:
        return body.count == 4 && body[0] <= 1 && (body[2] != 0 || body[3] != 0) ? "valid" : "invalid:field"
    case 2:
        guard body.count == 3 else { return "invalid:length" }
        guard body[0] <= 1 && (1...5).contains(body[1]) else { return "invalid:field" }
        return body[2] == 0 ? "valid" : "invalid:reserved"
    case 3: return body.count == 4 ? "valid" : "invalid:length"
    case 4:
        guard (1...4).contains(body.count), let scalar = String(bytes: body, encoding: .utf8), scalar.unicodeScalars.count == 1 else { return "invalid:utf8" }
        return "valid"
    case 5:
        guard body.count == 17 else { return "invalid:length" }
        guard body[0] <= 15 else { return "invalid:field" }
        guard body[1] != 0 || body[2] != 0 || body.dropFirst(3).allSatisfy({ $0 == 0 }) else { return "invalid:field" }
        return "valid"
    case 6:
        guard body.count == 8 else { return "invalid:length" }
        let x = Int(body[0]) * 256 + Int(body[1])
        let y = Int(body[2]) * 256 + Int(body[3])
        let width = Int(body[4]) * 256 + Int(body[5])
        let height = Int(body[6]) * 256 + Int(body[7])
        return width > 0 && height > 0 && x < width && y < height ? "valid" : "invalid:field"
    case 7: return body.count == 4 ? "valid" : "invalid:length"
    default: return "invalid:kind"
    }
}

func classifyGatewayFeedback(_ encoded: String) -> String {
    guard let raw = decodeHex(encoded) else { return "invalid:hex" }
    guard raw.count >= 8 else { return "invalid:truncated" }
    guard Array(raw[0..<4]) == Array("VGF1".utf8) else { return "invalid:magic" }
    let direction = raw[4]
    let kind = raw[5]
    let body = Array(raw.dropFirst(8))
    guard body.count == Int(raw[6]) * 256 + Int(raw[7]) else { return "invalid:length" }
    guard direction <= 1 else { return "invalid:direction" }
    if direction == 0 {
        if (0x10...0x12).contains(kind) { return "invalid:direction" }
        switch kind {
        case 1: return body.isEmpty ? "valid" : "invalid:length"
        case 2:
            return validFECStatus(body) ? "valid" : "invalid:field"
        case 3: return body.isEmpty ? "valid" : "invalid:length"
        default: return "invalid:type"
        }
    }
    if kind == 1 || kind == 2 || kind == 3 { return "invalid:direction" }
    switch kind {
    case 0x10: return body.count == 4 ? "valid" : "invalid:length"
    case 0x11:
        guard body.count == 5 else { return "invalid:length" }
        return body[0] <= 15 ? "valid" : "invalid:field"
    case 0x12:
        guard body.count == 1 else { return "invalid:length" }
        return body[0] <= 1 ? "valid" : "invalid:field"
    default: return "invalid:type"
    }
}

func validFECStatus(_ body: [UInt8]) -> Bool {
    guard body.count == 21 else { return false }
    let totalData = Int(body[10]) * 256 + Int(body[11])
    let totalParity = Int(body[12]) * 256 + Int(body[13])
    let receivedData = Int(body[14]) * 256 + Int(body[15])
    let receivedParity = Int(body[16]) * 256 + Int(body[17])
    return totalData > 0 && receivedData <= totalData && receivedParity <= totalParity && body[18] <= 100 && body[20] > 0 && body[19] < body[20]
}

func classifyDatagram(_ encoded: String) -> String {
    guard let raw = decodeHex(encoded) else { return "invalid:hex" }
    guard raw.count >= 3 else { return "invalid:truncated" }
    guard raw[0] == 0x56 && raw[1] == 0x44 else { return "invalid:magic" }
    guard raw[2] == 1 || raw[2] == 2 else { return "invalid:unsupported_version" }
    let headerBytes = raw[2] == 1 ? 21 : 23
    guard raw.count >= headerBytes else { return "invalid:truncated" }
    let limit: Int
    switch (raw[2], raw[3]) {
    case (1, 1): limit = 1024
    case (1, 2): limit = 2048
    case (1, 3): limit = 65515
    case (1, 10), (1, 11), (1, 12): limit = 1179
    case (2, 10), (2, 11): limit = 1177
    default: return "invalid:unknown_channel"
    }
    guard raw[4] == 0 else { return "invalid:flags" }
    let fragmentIndex = raw[2] == 1 ? Int(raw[17]) : Int(raw[17]) * 256 + Int(raw[18])
    let fragmentCount = raw[2] == 1 ? Int(raw[18]) : Int(raw[19]) * 256 + Int(raw[20])
    if raw[2] == 2 && fragmentCount > 891 { return "invalid:fragment_limit" }
    guard fragmentCount > 0 && fragmentIndex < fragmentCount else { return "invalid:fragment" }
    let payloadOffset = raw[2] == 1 ? 19 : 21
    let payloadLength = Int(raw[payloadOffset]) * 256 + Int(raw[payloadOffset + 1])
    guard payloadLength <= limit else { return "invalid:payload_limit" }
    guard raw.count == headerBytes + payloadLength else { return "invalid:length_mismatch" }
    guard raw[2] == 1 ? raw.count <= 65536 : raw.count <= 1200 else { return "invalid:frame_limit" }
    return "valid"
}

func normalizedDigest(_ results: [String]) -> String {
    var value: UInt64 = 14695981039346656037
    for result in results {
        for byte in Array("\(result)\n".utf8) {
            value ^= UInt64(byte)
            value = value &* 1099511628211
        }
    }
    return String(format: "%016llx", value)
}

func fixtureHash() -> String {
    let text = try! String(contentsOfFile: "fixtures/manifest.json", encoding: .utf8)
    let marker = "\"corpus_sha256\": \""
    guard let start = text.range(of: marker)?.upperBound else { fatalError("fixture hash") }
    let suffix = text[start...]
    guard let end = suffix.firstIndex(of: "\"") else { fatalError("fixture hash") }
    return String(suffix[..<end])
}

@main
struct ConformanceMain {
    static func main() {
        let names = try! FileManager.default.contentsOfDirectory(atPath: "fixtures/conformance").filter { $0.hasSuffix(".tsv") }.sorted()
        var results: [String] = []
        for name in names {
            let text = try! String(contentsOfFile: "fixtures/conformance/\(name)", encoding: .utf8)
            var lines = text.split(whereSeparator: \.isNewline).map(String.init)
            precondition(lines.removeFirst() == "id\tversion\tkind\tinput\texpected")
            for line in lines {
                let fields = line.split(separator: "\t", omittingEmptySubsequences: false).map(String.init)
                precondition(fields.count == 5)
                let actual = fields[2] == "device_proof_transcript"
                    ? evaluateDeviceProof(fields[3])
                    : evaluate(fields[1], fields[2], fields[3])
                precondition(actual == fields[4], fields[0])
                results.append("\(fields[0])\t\(actual)")
            }
        }
        print("Swift conformance passed normalized=\(normalizedDigest(results)) fixtures=\(fixtureHash())")
    }
}