export const VERSION: "1.0.0";
export const EXECUTION_PERMIT_SPEC:
  "https://mandateshield.com/specifications/execution-permit/v1";
export const EXECUTION_RECEIPT_SPEC:
  "https://mandateshield.com/specifications/execution-receipt/v1";
export const EXECUTION_PERMIT_PROFILE:
  "provider-bound-execution-v1";
export const EXECUTION_RECEIPT_PROFILE:
  "cryptographic-execution-state-v1";
export const EXECUTION_PERMIT_REDEMPTION_URI:
  "https://mandateshield.com/api/v2/execution-permits/redeem";

export type Sha256Digest = `sha256:${string}`;
export type ProviderProfile =
  | "GENERIC_HTTP_V1"
  | "STRIPE_PAYMENT_INTENTS_V1"
  | "X402_V2_EXACT"
  | "MPP_CHARGE_V1";

export type ProviderBinding = {
  profile: ProviderProfile;
  environment: "test" | "live";
  account: string;
  request_id: string;
  request_digest: Sha256Digest;
  idempotency_key: string;
};

export type PayeeBinding = {
  merchant_id: string;
  destination: string;
  destination_digest: Sha256Digest;
};

export type AmountBinding =
  | {
      mode: "ISO_4217";
      minor_units: number;
      currency: string;
    }
  | {
      mode: "ATOMIC_ASSET";
      atomic_units: string;
      asset_decimals: number;
      asset_id: string;
      network: string;
    };

export type ResourceBinding = {
  method: "GET" | "POST" | "PUT" | "PATCH";
  uri: string;
  body_digest: Sha256Digest;
};

export type ExecutionEvidencePublicJwk = {
  kid: string;
  kty: "EC";
  crv: "P-256";
  x: string;
  y: string;
  alg: "ES256";
  use: "sig";
  key_ops?: ["verify"];
  ext?: boolean;
  [member: string]: unknown;
};

export type ExecutionPermitClaims = {
  iss: "https://mandateshield.com";
  aud: string;
  iat: number;
  nbf: number;
  exp: number;
  jti: `msp_${string}`;
  spec: typeof EXECUTION_PERMIT_SPEC;
  permit_profile: typeof EXECUTION_PERMIT_PROFILE;
  scope: "payment:execute:one";
  authorization_ref: string;
  decision_receipt_id: `msr_${string}`;
  decision_receipt_hash: Sha256Digest;
  input_digest: Sha256Digest;
  attempt_digest: Sha256Digest;
  protocol: string;
  provider: ProviderBinding;
  payee: PayeeBinding;
  amount: AmountBinding;
  resource: ResourceBinding;
  settlement_deadline: number;
  max_uses: 1;
  redemption_uri: typeof EXECUTION_PERMIT_REDEMPTION_URI;
  one_use_enforced: false;
};

export type ExecutionEvidenceClass =
  | "CALLER_ASSERTED"
  | "FACILITATOR_SIGNED"
  | "PROVIDER_API_VERIFIED"
  | "CHAIN_FINALIZED"
  | "UNRESOLVED"
  | "LEDGER_DERIVED";

export type ExecutionReceiptClaims = {
  iss: "https://mandateshield.com";
  aud: string;
  iat: number;
  jti: `mse_${string}`;
  spec: typeof EXECUTION_RECEIPT_SPEC;
  receipt_profile: typeof EXECUTION_RECEIPT_PROFILE;
  artifact_purpose: "HISTORICAL_EXECUTION_EVIDENCE";
  execution_authorized: false;
  authorization_ref: string;
  decision_receipt_id: `msr_${string}`;
  decision_receipt_hash: Sha256Digest;
  permit_id: `msp_${string}` | null;
  permit_hash: Sha256Digest | null;
  input_digest: Sha256Digest;
  attempt_digest: Sha256Digest;
  transition_ref: string;
  transition_digest: Sha256Digest;
  protocol: string;
  provider: ProviderBinding | null;
  payee: PayeeBinding;
  amount: AmountBinding;
  resource: ResourceBinding | null;
  payment_reference: string | null;
  action: "COMMIT" | "RELEASE" | "EXPIRE" | "SETTLE_UNKNOWN";
  from_state: string;
  to_state: string;
  outcome:
    | "COMMITTED"
    | "NOT_SUBMITTED"
    | "FAILED"
    | "EXPIRED"
    | "SETTLEMENT_UNKNOWN";
  evidence_class: ExecutionEvidenceClass;
  evidence_digest: Sha256Digest;
  independent_verification: boolean;
  transitioned_at: number;
  outcome_occurred_at: number | null;
  settlement_deadline: number | null;
};

export type ExecutionEvidenceVerificationInput = {
  compact: string;
  jwks: {
    keys: ExecutionEvidencePublicJwk[];
  };
  expectedAudience?: string;
  now?: number;
  clockSkewSeconds?: number;
};

export type VerifiedExecutionPermit = {
  valid: true;
  artifact_type: "EXECUTION_PERMIT";
  protected_header: {
    alg: "ES256";
    kid: string;
    typ: "MSP+JWT";
  };
  claims: ExecutionPermitClaims;
  cryptographically_valid: true;
  context_matched: boolean;
  online_state: "UNKNOWN";
  advisory_only: true;
  one_use_enforced: false;
  provider_submission_permitted: false;
  redemption_uri: typeof EXECUTION_PERMIT_REDEMPTION_URI;
};

export type VerifiedExecutionReceipt = {
  valid: true;
  artifact_type: "EXECUTION_RECEIPT";
  protected_header: {
    alg: "ES256";
    kid: string;
    typ: "MSE+JWT";
  };
  claims: ExecutionReceiptClaims;
  cryptographically_valid: true;
  context_matched: boolean;
  historical_evidence_only: true;
  execution_authorized: false;
  independent_verification: boolean;
  one_use_enforced: false;
  provider_submission_permitted: false;
};

export function canonicalize(value: unknown): string;

export function verifyExecutionPermitOffline(
  input: ExecutionEvidenceVerificationInput,
): Promise<VerifiedExecutionPermit>;

export function verifyExecutionReceiptOffline(
  input: ExecutionEvidenceVerificationInput,
): Promise<VerifiedExecutionReceipt>;

export function verifyExecutionEvidenceOffline(
  input: ExecutionEvidenceVerificationInput,
): Promise<VerifiedExecutionPermit | VerifiedExecutionReceipt>;

export default verifyExecutionEvidenceOffline;