const encoder = new TextEncoder();
const RSA_BITS = 4096;
const PRIME_BITS = 2048;
const PUBLIC_EXPONENT = 65537n;

export const DERIVATION_NAME = 'SAWD-v1';
export const MASTER_LABEL = 'SHINE/ARWEAVE/RSA4096/SAWD-v1/MASTER';
export const STREAM_LABEL = 'SHINE/ARWEAVE/RSA4096/SAWD-v1/STREAM';
export const MR_LABEL = 'SHINE/ARWEAVE/RSA4096/SAWD-v1/MILLER-RABIN';
export const MILLER_RABIN_ROUNDS = 42;
export const SMALL_PRIME_LIMIT = 10000;

function getSubtle() {
  const subtle = globalThis.crypto?.subtle;
  if (!subtle) {
    throw new Error('SAWD-v1 требует WebCrypto (crypto.subtle)');
  }
  return subtle;
}

function utf8(text) {
  return encoder.encode(String(text));
}

function concatBytes(...chunks) {
  const total = chunks.reduce((sum, part) => sum + (part?.length || 0), 0);
  const out = new Uint8Array(total);
  let offset = 0;
  for (const part of chunks) {
    if (!part?.length) continue;
    out.set(part, offset);
    offset += part.length;
  }
  return out;
}

function bytesToBase64(bytes) {
  let binary = '';
  const chunkSize = 0x8000;
  for (let i = 0; i < bytes.length; i += chunkSize) {
    const chunk = bytes.subarray(i, i + chunkSize);
    binary += String.fromCharCode(...chunk);
  }
  return btoa(binary);
}

function base64UrlToBytes(value) {
  const normalized = String(value || '').replace(/-/g, '+').replace(/_/g, '/');
  const padLen = (4 - (normalized.length % 4)) % 4;
  const binary = atob(normalized + '='.repeat(padLen));
  const out = new Uint8Array(binary.length);
  for (let i = 0; i < binary.length; i += 1) {
    out[i] = binary.charCodeAt(i);
  }
  return out;
}

export function base64UrlEncode(bytes) {
  return bytesToBase64(bytes).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/g, '');
}

export function unsignedBytesToBigInt(bytes) {
  let value = 0n;
  for (const byte of bytes) {
    value = (value << 8n) | BigInt(byte);
  }
  return value;
}

export function bigIntToUnsignedBytes(value) {
  let v = BigInt(value);
  if (v < 0n) throw new Error('Ожидалось неотрицательное BigInt значение');
  if (v === 0n) return new Uint8Array([0]);

  let hex = v.toString(16);
  if (hex.length % 2 !== 0) hex = `0${hex}`;
  const out = new Uint8Array(hex.length / 2);
  for (let i = 0; i < out.length; i += 1) {
    out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
  }
  return out;
}

function bitLength(v) {
  return BigInt(v).toString(2).length;
}

function uint64be(counter) {
  const out = new Uint8Array(8);
  let v = BigInt(counter);
  for (let i = 7; i >= 0; i -= 1) {
    out[i] = Number(v & 0xffn);
    v >>= 8n;
  }
  return out;
}

function uint32be(counter) {
  const out = new Uint8Array(4);
  let v = BigInt(counter);
  for (let i = 3; i >= 0; i -= 1) {
    out[i] = Number(v & 0xffn);
    v >>= 8n;
  }
  return out;
}

async function importHmacKey(keyBytes) {
  return getSubtle().importKey(
    'raw',
    keyBytes,
    { name: 'HMAC', hash: 'SHA-256' },
    false,
    ['sign'],
  );
}

async function hmacSha256WithImportedKey(importedKey, messageBytes) {
  const signed = await getSubtle().sign('HMAC', importedKey, messageBytes);
  return new Uint8Array(signed);
}

export async function hmacSha256(keyBytes, messageBytes) {
  const imported = await importHmacKey(keyBytes);
  return hmacSha256WithImportedKey(imported, messageBytes);
}

export async function sha256(bytes) {
  const digest = await getSubtle().digest('SHA-256', bytes);
  return new Uint8Array(digest);
}

const STREAM_PREFIX = utf8(`${STREAM_LABEL}/`);
const MR_PREFIX = utf8(`${MR_LABEL}/`);
const SLASH = utf8('/');
const MASTER_LABEL_UTF8 = utf8(MASTER_LABEL);
const TWO = 2n;
const THREE = 3n;
const PRIME_HIGH_BIT_MASK = 1n << 2047n;

function makeSmallPrimes(limit) {
  const sieve = new Uint8Array(limit + 1);
  const primes = [];
  for (let i = 2; i <= limit; i += 1) {
    if (sieve[i]) continue;
    primes.push(i);
    for (let j = i * 2; j <= limit; j += i) {
      sieve[j] = 1;
    }
  }
  return primes;
}

const SMALL_PRIMES = makeSmallPrimes(SMALL_PRIME_LIMIT);

export async function deriveBytes(masterSeed32, label, length) {
  const imported = await importHmacKey(masterSeed32);
  return deriveBytesWithImportedKey(imported, label, length);
}

async function deriveBytesWithImportedKey(masterSeedKey, label, length) {
  const target = Number(length);
  if (!Number.isInteger(target) || target <= 0) {
    throw new Error('deriveBytes: length должен быть положительным целым');
  }
  let counter = 0n;
  const chunks = [];
  let written = 0;
  const labelBytes = utf8(String(label || ''));
  while (written < target) {
    const msg = concatBytes(STREAM_PREFIX, labelBytes, SLASH, uint64be(counter));
    const block = await hmacSha256WithImportedKey(masterSeedKey, msg);
    chunks.push(block);
    written += block.length;
    counter += 1n;
  }
  return concatBytes(...chunks).slice(0, target);
}

export function gcd(a, b) {
  let x = BigInt(a);
  let y = BigInt(b);
  while (y !== 0n) {
    const t = x % y;
    x = y;
    y = t;
  }
  return x < 0n ? -x : x;
}

export function lcm(a, b) {
  const x = BigInt(a);
  const y = BigInt(b);
  return (x / gcd(x, y)) * y;
}

export function modPow(base, exponent, modulus) {
  let b = BigInt(base) % BigInt(modulus);
  let e = BigInt(exponent);
  const m = BigInt(modulus);
  let result = 1n;
  while (e > 0n) {
    if (e & 1n) result = (result * b) % m;
    b = (b * b) % m;
    e >>= 1n;
  }
  return result;
}

export function modInverse(a, modulus) {
  let t = 0n;
  let newT = 1n;
  let r = BigInt(modulus);
  let newR = BigInt(a) % BigInt(modulus);

  while (newR !== 0n) {
    const q = r / newR;
    [t, newT] = [newT, t - q * newT];
    [r, newR] = [newR, r - q * newR];
  }
  if (r !== 1n) throw new Error('Обратный элемент не существует');
  if (t < 0n) t += BigInt(modulus);
  return t;
}

function passesSmallPrimeFilter(candidate) {
  for (const p of SMALL_PRIMES) {
    const pBig = BigInt(p);
    if (candidate === pBig) return true;
    if (candidate % pBig === 0n) return false;
  }
  return true;
}

async function millerRabinWithImportedKey(masterSeedKey, candidate, label, index, rounds = MILLER_RABIN_ROUNDS) {
  const n = BigInt(candidate);
  if (n < 2n) return false;
  if (n === 2n || n === 3n) return true;
  if ((n & 1n) === 0n) return false;

  let d = n - 1n;
  let s = 0;
  while ((d & 1n) === 0n) {
    d >>= 1n;
    s += 1;
  }

  const labelBytes = utf8(String(label || ''));
  const indexBytes = uint64be(index);
  const nMinusThree = n - THREE;
  if (nMinusThree <= 0n) return false;

  for (let round = 0; round < rounds; round += 1) {
    const msg = concatBytes(MR_PREFIX, labelBytes, SLASH, indexBytes, SLASH, uint32be(round));
    const baseBytes = await hmacSha256WithImportedKey(masterSeedKey, msg);
    const a = TWO + (unsignedBytesToBigInt(baseBytes) % nMinusThree);

    let x = modPow(a, d, n);
    if (x === 1n || x === n - 1n) continue;

    let witnessComposite = true;
    for (let i = 1; i < s; i += 1) {
      x = modPow(x, 2n, n);
      if (x === n - 1n) {
        witnessComposite = false;
        break;
      }
    }
    if (witnessComposite) return false;
  }

  return true;
}

export async function millerRabin(masterSeed32, candidate, label, index, rounds = MILLER_RABIN_ROUNDS) {
  const imported = await importHmacKey(masterSeed32);
  return millerRabinWithImportedKey(imported, candidate, label, index, rounds);
}

export async function isProbablePrime(masterSeed32, candidate, label, index) {
  const imported = await importHmacKey(masterSeed32);
  return isProbablePrimeWithImportedKey(imported, candidate, label, index);
}

async function isProbablePrimeWithImportedKey(masterSeedKey, candidate, label, index) {
  const n = BigInt(candidate);
  if ((n & 1n) === 0n) return false;
  if (bitLength(n) !== PRIME_BITS) return false;
  if (!passesSmallPrimeFilter(n)) return false;
  if (gcd(n - 1n, PUBLIC_EXPONENT) !== 1n) return false;
  return millerRabinWithImportedKey(masterSeedKey, n, label, index, MILLER_RABIN_ROUNDS);
}

async function tickEvery(iteration, step = 8n) {
  if (iteration % step === 0n) {
    await Promise.resolve();
  }
}

export async function derivePrime(masterSeed32, label) {
  const imported = await importHmacKey(masterSeed32);
  return derivePrimeWithImportedKey(imported, label);
}

async function derivePrimeWithImportedKey(masterSeedKey, label, startIndex = 0n) {
  let index = BigInt(startIndex);
  while (true) {
    const raw = await deriveBytesWithImportedKey(masterSeedKey, `${label}/${index}`, PRIME_BITS / 8);
    let candidate = unsignedBytesToBigInt(raw);
    candidate |= PRIME_HIGH_BIT_MASK;
    candidate |= 1n;

    if (bitLength(candidate) === PRIME_BITS && await isProbablePrimeWithImportedKey(masterSeedKey, candidate, label, index)) {
      return { prime: candidate, index };
    }

    index += 1n;
    await tickEvery(index);
  }
}

function toJwkB64(value) {
  return base64UrlEncode(bigIntToUnsignedBytes(value));
}

async function deriveArweaveWalletParts(clientKey32) {
  if (!(clientKey32 instanceof Uint8Array)) {
    throw new Error('SAWD-v1: clientKey32 должен быть Uint8Array');
  }
  if (clientKey32.length !== 32) {
    throw new Error('SAWD-v1: clientKey32 должен быть ровно 32 байта');
  }

  const masterSeed32 = await hmacSha256(MASTER_LABEL_UTF8, clientKey32);
  const masterSeedKey = await importHmacKey(masterSeed32);

  const pResult = await derivePrimeWithImportedKey(masterSeedKey, 'p');
  let qResult = await derivePrimeWithImportedKey(masterSeedKey, 'q');
  while (qResult.prime === pResult.prime) {
    qResult = await derivePrimeWithImportedKey(masterSeedKey, 'q', qResult.index + 1n);
  }

  let p = pResult.prime;
  let q = qResult.prime;
  if (p > q) {
    [p, q] = [q, p];
  }

  const n = p * q;
  const lambda = lcm(p - 1n, q - 1n);
  const d = modInverse(PUBLIC_EXPONENT, lambda);
  const dp = d % (p - 1n);
  const dq = d % (q - 1n);
  const qi = modInverse(q, p);

  const jwk = {
    kty: 'RSA',
    e: 'AQAB',
    n: toJwkB64(n),
    d: toJwkB64(d),
    p: toJwkB64(p),
    q: toJwkB64(q),
    dp: toJwkB64(dp),
    dq: toJwkB64(dq),
    qi: toJwkB64(qi),
  };

  const owner = jwk.n;
  const address = base64UrlEncode(await sha256(bigIntToUnsignedBytes(n)));

  return {
    derivation: DERIVATION_NAME,
    jwk,
    owner,
    address,
    _private: {
      p,
      q,
      n,
    },
  };
}

export async function deriveArweaveWalletFromClientKey32(clientKey32) {
  const result = await deriveArweaveWalletParts(clientKey32);
  return {
    derivation: result.derivation,
    jwk: result.jwk,
    owner: result.owner,
    address: result.address,
  };
}

export async function selfTestSawdV1() {
  const invalid = new Uint8Array(31);
  let invalidFailed = false;
  try {
    await deriveArweaveWalletFromClientKey32(invalid);
  } catch {
    invalidFailed = true;
  }
  if (!invalidFailed) {
    throw new Error('SAWD-v1 self-test: длина != 32 должна приводить к ошибке');
  }

  const clientKey = new Uint8Array(32);
  for (let i = 0; i < clientKey.length; i += 1) {
    clientKey[i] = i + 1;
  }

  const first = await deriveArweaveWalletParts(clientKey);
  const second = await deriveArweaveWalletParts(clientKey);

  if (!first.address || !second.address) {
    throw new Error('SAWD-v1 self-test: адрес пустой');
  }
  if (first.address !== second.address) {
    throw new Error('SAWD-v1 self-test: адрес должен быть детерминированным');
  }
  if (first.jwk.n !== second.jwk.n) {
    throw new Error('SAWD-v1 self-test: jwk.n должен быть детерминированным');
  }
  if (first.jwk.e !== 'AQAB') {
    throw new Error('SAWD-v1 self-test: jwk.e должен быть AQAB');
  }
  if (first.owner !== first.jwk.n) {
    throw new Error('SAWD-v1 self-test: owner должен совпадать с jwk.n');
  }
  if (!(first._private.p < first._private.q)) {
    throw new Error('SAWD-v1 self-test: ожидается p < q');
  }
  if (bitLength(first._private.n) !== RSA_BITS) {
    throw new Error('SAWD-v1 self-test: ожидается n с длиной 4096 бит');
  }

  const pFromJwk = unsignedBytesToBigInt(base64UrlToBytes(first.jwk.p));
  const qFromJwk = unsignedBytesToBigInt(base64UrlToBytes(first.jwk.q));
  if (!(pFromJwk < qFromJwk)) {
    throw new Error('SAWD-v1 self-test: p и q в JWK должны удовлетворять p < q');
  }

  return {
    ok: true,
    derivation: DERIVATION_NAME,
    address: first.address,
  };
}