use std::env;
use std::process::ExitCode;
use std::time::Instant;

use mt_codec::domain;
use mt_crypto::{
    hash, keypair, keypair_from_seed, sha256_raw, sign, verify, Hash32, PublicKey, SecretKey,
    Signature, KEYPAIR_SEED_SIZE, PUBLIC_KEY_SIZE, SECRET_KEY_SIZE, SIGNATURE_SIZE,
};
use mt_examples::{
    hex_full, print_field, print_kv, print_note, print_section, print_subsection, print_warn,
    xxd_dump,
};
use mt_merkle::{empty_internal, internal_hash, leaf_hash, TREE_DEPTH};

// Debug fingerprint через domain-separated hash. Label «fingerprint (debug)»
// явно указывает что это NOT raw SHA-256 — используется mt-fingerprint-debug
// domain для избежания confusion с consensus hashes.
fn fingerprint(bytes: &[u8]) -> String {
    let h: Hash32 = hash(b"mt-fingerprint-debug", &[bytes]);
    let short: Vec<u8> = h[..8].to_vec();
    hex_full(&short)
}

fn debug_hash(bytes: &[u8]) -> String {
    let h: Hash32 = hash(b"mt-fingerprint-debug", &[bytes]);
    hex_full(&h)
}

// Raw SHA-256 без domain separation — для FIPS 180-4 conformance checks
// и для сравнения с standalone `shasum -a 256` output.
fn raw_sha256(bytes: &[u8]) -> String {
    hex_full(&sha256_raw(bytes))
}

// Dump SK только если явно включён через env var M1_DUMP_SK=1.
// По умолчанию — redacted fingerprint only. Prevents accidental leak через
// cargo run --release --example m1_crypto > shared.log.
fn dump_sk_enabled() -> bool {
    std::env::var("M1_DUMP_SK").ok().as_deref() == Some("1")
}

// cmd_keypair_deterministic заменяет старый print_recovery_disclosure (soft note):
// реальный test of deterministic KeyGen — два прогона keypair_from_seed(seed) с
// тем же seed → byte-exact equality, с разным seed → различные. Это actual
// демонстрация recovery flow на уровне primitive (не только note про mnemonic crate).

fn print_pk(pk: &PublicKey) {
    print_subsection("PUBLIC KEY — передаётся в сеть, попадает в AccountTable/NodeTable");
    print_kv("size", format!("{PUBLIC_KEY_SIZE} bytes"));
    print_kv(
        "fingerprint (8B, domain=mt-fingerprint-debug)",
        fingerprint(pk.as_bytes()),
    );
    print_kv(
        "debug_hash (domain=mt-fingerprint-debug)",
        debug_hash(pk.as_bytes()),
    );
    print_kv("sha256_raw (no domain)", raw_sha256(pk.as_bytes()));
    println!("  hex_full:");
    println!("    {}", hex_full(pk.as_bytes()));
    println!("  xxd dump:");
    for line in xxd_dump(pk.as_bytes()).lines() {
        println!("    {line}");
    }
}

fn print_sk(sk: &SecretKey) {
    print_subsection("SECRET KEY — НЕ покидает узел, хранится только локально");
    print_kv("size", format!("{SECRET_KEY_SIZE} bytes"));
    print_kv(
        "fingerprint (8B, domain=mt-fingerprint-debug)",
        fingerprint(sk.as_bytes()),
    );

    if !dump_sk_enabled() {
        print_warn(
            "SK bytes REDACTED — set M1_DUMP_SK=1 to show (dev-only, unsafe для shared output)",
        );
        return;
    }

    print_kv(
        "debug_hash (domain=mt-fingerprint-debug)",
        debug_hash(sk.as_bytes()),
    );
    print_kv("sha256_raw (no domain)", raw_sha256(sk.as_bytes()));
    println!("  hex_full:");
    println!("    {}", hex_full(sk.as_bytes()));
    println!("  xxd dump:");
    for line in xxd_dump(sk.as_bytes()).lines() {
        println!("    {line}");
    }
    print_warn("SK отображён только потому что M1_DUMP_SK=1 установлен");
    print_warn("В production SK никогда не логируется, не сериализуется в открытом виде");
}

fn print_sig(sig: &Signature) {
    print_subsection("SIGNATURE — ML-DSA-65 deterministic");
    print_kv("size", format!("{SIGNATURE_SIZE} bytes"));
    print_kv(
        "fingerprint (8B, domain=mt-fingerprint-debug)",
        fingerprint(sig.as_bytes()),
    );
    print_kv(
        "debug_hash (domain=mt-fingerprint-debug)",
        debug_hash(sig.as_bytes()),
    );
    print_kv("sha256_raw (no domain)", raw_sha256(sig.as_bytes()));
    println!("  hex_full:");
    println!("    {}", hex_full(sig.as_bytes()));
    println!("  xxd dump:");
    for line in xxd_dump(sig.as_bytes()).lines() {
        println!("    {line}");
    }
}

fn cmd_keypair_random(n: usize) -> bool {
    print_section(&format!(
        "KEYPAIR RANDOM — ML-DSA-65 (OS rng entropy) × {n} (sanity check primitive)"
    ));
    print_subsection("Алгоритм");
    print_kv(
        "scheme",
        "ML-DSA-65 (NIST FIPS 204 finalized 2024-08, lattice-based, [I-1] compliant)",
    );
    print_kv(
        "library",
        "OpenSSL 3.5.5 LTS via own thin C FFI wrapper (mt-crypto-native)",
    );
    print_kv(
        "entropy source",
        "time+pid+stack-addr → SHA-256 (test/tool only; production через keypair_from_seed из HKDF)",
    );
    print_kv("pk size", format!("{PUBLIC_KEY_SIZE} bytes"));
    print_kv("sk size", format!("{SECRET_KEY_SIZE} bytes"));
    print_kv("sig size", format!("{SIGNATURE_SIZE} bytes"));

    let mut pks: Vec<PublicKey> = Vec::with_capacity(n);
    let mut sks: Vec<Vec<u8>> = Vec::with_capacity(n);
    let mut all_verify_ok = true;

    for i in 0..n {
        print_section(&format!("KEYPAIR #{} / {}", i + 1, n));
        let t0 = Instant::now();
        let (pk, sk) = keypair();
        let elapsed = t0.elapsed();
        print_kv(
            "generation time",
            format!("{:.2}ms", elapsed.as_secs_f64() * 1000.0),
        );

        print_pk(&pk);
        print_sk(&sk);

        let msg = format!("keypair#{i} self-test");
        let sig = sign(&sk, msg.as_bytes()).expect("sign self-test");
        let ok = verify(&pk, msg.as_bytes(), &sig);
        print_subsection("Self-test sign+verify");
        print_kv("test message", format!("{:?} ({} bytes)", msg, msg.len()));
        print_kv("verify(pk,msg,sig)", format!("{ok}"));
        if !ok {
            all_verify_ok = false;
        }

        pks.push(pk);
        sks.push(sk.as_bytes().to_vec());
    }

    print_section("UNIQUENESS INVARIANT");
    let mut pks_distinct = true;
    let mut sks_distinct = true;
    for i in 0..pks.len() {
        for j in (i + 1)..pks.len() {
            if pks[i].as_bytes() == pks[j].as_bytes() {
                pks_distinct = false;
                print_warn(&format!("pk[{i}] == pk[{j}] !!!"));
            }
            if sks[i] == sks[j] {
                sks_distinct = false;
                print_warn(&format!("sk[{i}] == sk[{j}] !!!"));
            }
        }
    }
    print_kv("all_public_keys_distinct", format!("{pks_distinct}"));
    print_kv("all_secret_keys_distinct", format!("{sks_distinct}"));

    print_section("RECOVERY MECHANISM POINTER");
    print_note("Production identity flow — через m1_mnemonic (deterministic from 24 слов)");
    print_note("Эта команда — RANDOM keypair sanity check ML-DSA-65 primitive (test/dev only)");
    print_note(
        "Для deterministic recovery test: subcommand `keypair` (без --random) либо `m1_mnemonic`",
    );

    let pass = all_verify_ok && pks_distinct && sks_distinct;
    println!(
        "\n[result] KEYPAIR-RANDOM: {}",
        if pass { "PASS" } else { "FAIL" }
    );
    pass
}

fn cmd_keypair_deterministic() -> bool {
    print_section("KEYPAIR DETERMINISTIC — ML-DSA-65.KeyGen(seed) byte-exact recovery test");

    print_subsection("Алгоритм");
    print_kv(
        "scheme",
        "ML-DSA-65 (NIST FIPS 204 finalized 2024-08, FIPS 204 §3.1 ξ ∈ B32)",
    );
    print_kv(
        "seed source",
        "fixed test value [0x42; 32] (production: HKDF-Expand из master_seed)",
    );
    print_kv("pk size", format!("{PUBLIC_KEY_SIZE} bytes"));
    print_kv("sk size", format!("{SECRET_KEY_SIZE} bytes"));

    let seed = [0x42u8; KEYPAIR_SEED_SIZE];
    print_subsection("DERIVATION TRACE — два независимых прогона keypair_from_seed(seed)");
    print_kv("seed hex", hex_full(&seed));

    let (pk_a, sk_a) = keypair_from_seed(&seed).expect("keygen run A");
    let (pk_b, sk_b) = keypair_from_seed(&seed).expect("keygen run B");

    let pk_match = pk_a.as_bytes() == pk_b.as_bytes();
    let sk_match = sk_a.as_bytes() == sk_b.as_bytes();

    print_kv(
        "Run A pk fingerprint (8B)",
        hex_full(&sha256_raw(pk_a.as_bytes())[..8]),
    );
    print_kv(
        "Run B pk fingerprint (8B)",
        hex_full(&sha256_raw(pk_b.as_bytes())[..8]),
    );
    print_kv(
        "Run A sk fingerprint (8B)",
        hex_full(&sha256_raw(sk_a.as_bytes())[..8]),
    );
    print_kv(
        "Run B sk fingerprint (8B)",
        hex_full(&sha256_raw(sk_b.as_bytes())[..8]),
    );

    print_subsection("BYTE-EXACT EQUALITY ASSERTIONS");
    print_kv("pk_a == pk_b", if pk_match { "OK ✓" } else { "FAIL ✗" });
    print_kv("sk_a == sk_b", if sk_match { "OK ✓" } else { "FAIL ✗" });

    print_subsection("DIFFERENT SEED → DIFFERENT KEYPAIR (sanity)");
    let seed2 = [0x43u8; KEYPAIR_SEED_SIZE];
    let (pk_c, _) = keypair_from_seed(&seed2).expect("keygen seed2");
    let pk_differs = pk_a.as_bytes() != pk_c.as_bytes();
    print_kv("seed2 hex", hex_full(&seed2));
    print_kv(
        "pk_a != pk_c (different seed)",
        if pk_differs { "OK ✓" } else { "FAIL ✗" },
    );

    print_subsection("FINGERPRINTS — для cross-impl byte-exact verification");
    print_kv("pk sha256", hex_full(&sha256_raw(pk_a.as_bytes())));
    print_kv("sk sha256", hex_full(&sha256_raw(sk_a.as_bytes())));

    print_section("RECOVERY MECHANISM");
    print_note(
        "Эта команда — actual byte-exact test, не описание. Тот же seed → тот же keypair всегда.",
    );
    print_note(
        "В production seed выводится из 24-слов мнемоники через mt-mnemonic (HKDF-Expand role-keyed).",
    );
    print_note("Полный recovery flow до terminal IDs — m1_mnemonic recovery-fingerprint");

    let pass = pk_match && sk_match && pk_differs;
    println!(
        "\n[result] KEYPAIR-DETERMINISTIC: {}",
        if pass { "PASS" } else { "FAIL" }
    );
    pass
}

fn cmd_sign(msg: &str) -> bool {
    print_section(&format!(
        "SIGN + VERIFY — ML-DSA-65 deterministic signature on message {msg:?}"
    ));

    print_subsection("Message preparation");
    let msg_bytes = msg.as_bytes();
    print_kv("len", format!("{} bytes", msg_bytes.len()));
    print_kv("ascii", msg.to_string());
    print_kv("hex", hex_full(msg_bytes));

    let (pk, sk) = keypair();
    print_pk(&pk);
    print_sk(&sk);

    print_subsection("Sign call trace");
    print_kv(
        "function",
        format!("mt_crypto::sign(sk, msg) → Signature[{SIGNATURE_SIZE}B]"),
    );
    print_kv(
        "internal",
        "OpenSSL EVP_DigestSign + OSSL_SIGNATURE_PARAM_DETERMINISTIC=1 (FIPS 204 Algorithm 2, deterministic variant)",
    );
    let t0 = Instant::now();
    let sig = sign(&sk, msg_bytes).expect("sign happy path");
    let sign_ms = t0.elapsed().as_secs_f64() * 1000.0;
    print_kv("sign latency", format!("{sign_ms:.2}ms"));
    print_sig(&sig);

    print_subsection("Verify call trace (happy path)");
    let t1 = Instant::now();
    let ok = verify(&pk, msg_bytes, &sig);
    let verify_ms = t1.elapsed().as_secs_f64() * 1000.0;
    print_kv("verify latency", format!("{verify_ms:.2}ms"));
    print_kv("result", format!("{ok}"));

    print_section("ADVERSARIAL TESTS");

    print_subsection("1. Mutation at 4 positions must all reject");
    let positions = [0usize, 166, 333, 665];
    let mut mut_all_rejected = true;
    for &pos in &positions {
        let mut bad = *sig.as_bytes();
        bad[pos] ^= 0xFF;
        let bad_sig = Signature::from_array(bad);
        let rejected = !verify(&pk, msg_bytes, &bad_sig);
        print_kv(
            &format!("mutate byte {pos}"),
            format!(
                "sig[{pos}]=0x{:02x} → 0x{:02x}, verify={}",
                sig.as_bytes()[pos],
                bad[pos],
                if rejected {
                    "REJECTED ✓"
                } else {
                    "ACCEPTED ✗"
                }
            ),
        );
        if !rejected {
            mut_all_rejected = false;
        }
    }

    print_subsection("2. Mutated message must be rejected");
    let mut bad_msg = msg_bytes.to_vec();
    if !bad_msg.is_empty() {
        bad_msg[0] ^= 0x01;
    } else {
        bad_msg.push(0x01);
    }
    let msg_rejected = !verify(&pk, &bad_msg, &sig);
    print_kv("orig msg hex", hex_full(msg_bytes));
    print_kv("bad msg  hex", hex_full(&bad_msg));
    print_kv(
        "verify(pk, bad_msg, sig)",
        if msg_rejected {
            "REJECTED ✓"
        } else {
            "ACCEPTED ✗"
        },
    );

    print_subsection("3. Cross-key: verify with wrong pubkey must fail");
    let (other_pk, _) = keypair();
    let cross_rejected = !verify(&other_pk, msg_bytes, &sig);
    print_kv("other_pk fingerprint", fingerprint(other_pk.as_bytes()));
    print_kv(
        "verify(other_pk, msg, sig)",
        if cross_rejected {
            "REJECTED ✓"
        } else {
            "ACCEPTED ✗"
        },
    );

    print_subsection(
        "4. Determinism: same (sk, msg) twice → identical σ (FIPS 204 §3.7, RND = 0x00 × 32)",
    );
    let sig2 = sign(&sk, msg_bytes).expect("sign sample 2");
    let identical = sig.as_bytes() == sig2.as_bytes();
    let sig2_verifies = verify(&pk, msg_bytes, &sig2);
    print_kv("sig1 fingerprint", fingerprint(sig.as_bytes()));
    print_kv("sig2 fingerprint", fingerprint(sig2.as_bytes()));
    print_kv("sig1 == sig2", format!("{identical}"));
    print_kv("verify(pk, msg, sig2)", format!("{sig2_verifies}"));

    let pass =
        ok && mut_all_rejected && msg_rejected && cross_rejected && identical && sig2_verifies;
    println!("\n[result] SIGN: {}", if pass { "PASS" } else { "FAIL" });
    pass
}

fn cmd_hash() -> bool {
    print_section("HASH — SHA-256 (FIPS 180-4) + domain-separated composition");

    print_subsection("1. FIPS 180-4 §B.1 vector: SHA-256(\"abc\")");
    let input = b"abc";
    print_kv("input ascii", "abc");
    print_kv("input hex", hex_full(input));
    print_kv("input len", format!("{} bytes", input.len()));
    let got = sha256_raw(input);
    let expected_hex = "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad";
    print_kv("mt_crypto::sha256_raw(b\"abc\")", hex_full(&got));
    print_kv("FIPS 180-4 expected", expected_hex.to_string());
    let fips_ok = hex_full(&got) == expected_hex;
    print_kv("byte-exact match", format!("{fips_ok}"));
    print_note("NOTE: mt_crypto::hash(domain, parts) использует NUL separator и self-delimiting");
    print_note("formula SHA-256(domain || 0x00 || parts) — не raw SHA-256. Для FIPS compatibility");
    print_note("используется отдельная функция sha256_raw() без domain separation.");

    print_subsection("2. Empty-parts collapse: hash(d,[]) == hash(d,[b\"\"])");
    let a = hash(domain::OP, &[]);
    let b = hash(domain::OP, &[&[] as &[u8]]);
    print_kv("hash(OP, [])", hex_full(&a));
    print_kv("hash(OP, [b\"\"])", hex_full(&b));
    let collapse_ok = a == b;
    print_kv("equal", format!("{collapse_ok}"));

    print_subsection("3. Part concatenation: hash(d,[a,b,c]) == hash(d,[a||b||c])");
    let h_parts = hash(domain::OP, &[b"aa", b"bb", b"cc"]);
    let h_concat = hash(domain::OP, &[b"aabbcc"]);
    print_kv("hash(OP, [aa,bb,cc])", hex_full(&h_parts));
    print_kv("hash(OP, [aabbcc])", hex_full(&h_concat));
    let concat_ok = h_parts == h_concat;
    print_kv("equal", format!("{concat_ok}"));

    print_subsection("4. Domain separation — все R2 class domains c input=x");
    let x: &[u8] = b"x";
    let class_domains: &[(&str, &[u8])] = &[
        ("mt-op", domain::OP),
        ("mt-nodereg", domain::NODEREG),
        ("mt-proposal", domain::PROPOSAL),
        ("mt-bundle", domain::BUNDLE),
        ("mt-vdf-reveal", domain::VDF_REVEAL),
    ];
    let mut outputs: Vec<Hash32> = Vec::new();
    for (name, d) in class_domains {
        let h = hash(d, &[x]);
        print_kv(&format!("{name:<16} input=x"), hex_full(&h));
        outputs.push(h);
    }
    let mut class_distinct = true;
    for i in 0..outputs.len() {
        for j in (i + 1)..outputs.len() {
            if outputs[i] == outputs[j] {
                class_distinct = false;
                print_warn(&format!(
                    "collision: {} == {}",
                    class_domains[i].0, class_domains[j].0
                ));
            }
        }
    }
    print_kv("all_class_domains_distinct", format!("{class_distinct}"));

    print_subsection("5. Domain separator registry — полный список 32 штук");
    let all_domains: &[(&str, &[u8])] = &[
        ("mt-op", domain::OP),
        ("mt-nodereg", domain::NODEREG),
        ("mt-proposal", domain::PROPOSAL),
        ("mt-bundle", domain::BUNDLE),
        ("mt-vdf-reveal", domain::VDF_REVEAL),
        ("mt-account", domain::ACCOUNT),
        ("mt-candidate-vdf-init", domain::CANDIDATE_VDF_INIT),
        ("mt-merkle-leaf", domain::MERKLE_LEAF),
        ("mt-merkle-node", domain::MERKLE_NODE),
        ("mt-state-root", domain::STATE_ROOT),
        ("mt-timechain", domain::TIMECHAIN),
        ("mt-lottery", domain::LOTTERY),
        ("mt-bc-aggregate", domain::BC_AGGREGATE),
        ("mt-bc-aggregate-empty", domain::BC_AGGREGATE_EMPTY),
        ("mt-selection", domain::SELECTION),
        ("mt-nodereg-sort", domain::NODEREG_SORT),
        ("mt-confirmation", domain::CONFIRMATION),
        ("mt-app", domain::APP),
        ("mt-node", domain::NODE),
        ("mt-genesis", domain::GENESIS),
        ("mt-seed", domain::SEED),
        ("mt-account-key", domain::ACCOUNT_KEY),
        ("mt-node-key", domain::NODE_KEY),
        ("mt-content-chunk", domain::CONTENT_CHUNK),
        ("mt-content-manifest", domain::CONTENT_MANIFEST),
        ("mt-profile", domain::PROFILE),
        ("mt-encryption-key", domain::ENCRYPTION_KEY),
        ("mt-app-encryption-key", domain::APP_ENCRYPTION_KEY),
        ("mt-prekeys", domain::PREKEYS),
        ("mt-tunnel-online", domain::TUNNEL_ONLINE),
        ("mt-tunnel-mesh", domain::TUNNEL_MESH),
        ("mt-bootstrap-pow", domain::BOOTSTRAP_POW),
        ("mt-recovery-fingerprint", domain::RECOVERY_FINGERPRINT),
    ];
    print_kv("registry size", format!("{}", all_domains.len()));
    for (name, bytes) in all_domains {
        print_field(
            name,
            &format!("{} bytes, hex={}", bytes.len(), hex_full(bytes)),
        );
    }

    let pass = fips_ok && collapse_ok && concat_ok && class_distinct;
    println!("\n[result] HASH: {}", if pass { "PASS" } else { "FAIL" });
    pass
}

fn cmd_merkle() -> bool {
    print_section("MERKLE — Sparse Merkle Tree depth=256, empty_internal table");

    print_subsection("Определения");
    print_kv("TREE_DEPTH", format!("{TREE_DEPTH}"));
    print_kv("EMPTY_LEAF", hex_full(&empty_internal(0)));
    print_kv(
        "leaf_hash(x)",
        "= SHA-256(\"mt-merkle-leaf\" || x)".to_string(),
    );
    print_kv(
        "internal_hash(l,r)",
        "= SHA-256(\"mt-merkle-node\" || l || r)".to_string(),
    );
    print_kv(
        "empty_internal(k)",
        "= level 0: [0;32]; level k≥1: internal_hash(empty_internal(k-1), empty_internal(k-1))"
            .to_string(),
    );

    print_subsection("Derivation trace — первые 3 уровня");
    let lvl0 = empty_internal(0);
    let lvl1 = empty_internal(1);
    let lvl2 = empty_internal(2);
    println!("  level 0 = EMPTY_LEAF");
    println!("         = {}", hex_full(&lvl0));
    println!();
    println!("  level 1 = internal_hash(level_0, level_0)");
    println!("         = SHA-256(\"mt-merkle-node\" || level_0 || level_0)");
    println!("    input domain (14B): {}", hex_full(domain::MERKLE_NODE));
    println!(
        "    input data   (64B): {}",
        hex_full(&[&lvl0[..], &lvl0[..]].concat())
    );
    println!("    output       (32B): {}", hex_full(&lvl1));
    println!();
    println!("  level 2 = internal_hash(level_1, level_1)");
    println!("    input domain (14B): {}", hex_full(domain::MERKLE_NODE));
    println!(
        "    input data   (64B): {}",
        hex_full(&[&lvl1[..], &lvl1[..]].concat())
    );
    println!("    output       (32B): {}", hex_full(&lvl2));

    print_subsection("Полная таблица empty_internal(0..=256)");
    for k in 0..=TREE_DEPTH {
        let v = empty_internal(k);
        println!("  level {k:>3}: {}", hex_full(&v));
    }

    print_subsection("Invariants");
    let lvl256 = empty_internal(TREE_DEPTH);
    let level0_zero = lvl0 == [0u8; 32];
    let mut monotonic_all_differ = true;
    for k in 0..TREE_DEPTH {
        if empty_internal(k) == empty_internal(k + 1) {
            monotonic_all_differ = false;
            print_warn(&format!("level {k} == level {}", k + 1));
        }
    }
    let determinism = empty_internal(TREE_DEPTH) == lvl256;
    print_kv("level_0_is_all_zero", format!("{level0_zero}"));
    print_kv("all_consecutive_differ", format!("{monotonic_all_differ}"));
    print_kv("determinism (re-query equal)", format!("{determinism}"));

    print_subsection("Sanity: leaf_hash(\"hello\") определён и отличается от EMPTY_LEAF");
    let leaf = leaf_hash(b"hello");
    let internal = internal_hash(&lvl0, &lvl0);
    print_kv("leaf_hash(b\"hello\")", hex_full(&leaf));
    print_kv("internal_hash(zeros,zeros)", hex_full(&internal));
    print_kv(
        "leaf_hash == internal_hash(z,z)",
        format!("{}", leaf == internal),
    );
    print_kv(
        "leaf_hash == empty_internal(1)",
        format!("{}", leaf == lvl1),
    );
    let leaf_vs_empty = leaf != lvl0;
    print_kv("leaf_hash != EMPTY_LEAF", format!("{leaf_vs_empty}"));

    let pass = level0_zero && monotonic_all_differ && determinism && leaf_vs_empty;
    println!("\n[result] MERKLE: {}", if pass { "PASS" } else { "FAIL" });
    pass
}

fn cmd_all() -> bool {
    print_section("M1 CRYPTO — FULL USER JOURNEY");
    print_note(
        "Прогоняется полный путь: deterministic keypair test + 3 random keypairs + sign + hash + merkle",
    );

    let a = cmd_keypair_deterministic();
    let b = cmd_keypair_random(3);
    let c = cmd_sign("Montana M1 crypto shakedown — production journey");
    let d = cmd_hash();
    let e = cmd_merkle();

    print_section("SUMMARY");
    print_kv("keypair-deterministic", if a { "PASS" } else { "FAIL" });
    print_kv("keypair-random", if b { "PASS" } else { "FAIL" });
    print_kv("sign", if c { "PASS" } else { "FAIL" });
    print_kv("hash", if d { "PASS" } else { "FAIL" });
    print_kv("merkle-empty", if e { "PASS" } else { "FAIL" });

    let pass = a && b && c && d && e;
    println!(
        "\n[result] ALL SCENARIOS: {}",
        if pass { "PASS" } else { "FAIL" }
    );
    pass
}

fn bool_to_exit(pass: bool) -> ExitCode {
    if pass {
        ExitCode::SUCCESS
    } else {
        ExitCode::FAILURE
    }
}

fn usage() {
    eprintln!("M1 CRYPTO — ML-DSA-65 + SHA-256 + Sparse Merkle shakedown binary");
    eprintln!();
    eprintln!("usage: m1_crypto <subcommand> [args]");
    eprintln!();
    eprintln!("  keypair                Deterministic keypair test (recovery sanity, default)");
    eprintln!("  keypair-random [N]     RANDOM N keypairs (default 1) + uniqueness check");
    eprintln!("  sign [MSG]             Keypair → sign(MSG) → verify + 4 adversarial теста");
    eprintln!("  hash                   FIPS 180-4 vector + domain separation + registry полный");
    eprintln!("  merkle-empty           Sparse Merkle: все 257 levels + derivation trace");
    eprintln!("  all                    Прогнать все подкоманды подряд (user journey)");
    eprintln!();
    eprintln!("Всё печатает байты в hex + xxd dump. Exit code 0=PASS, 1=FAIL.");
}

fn main() -> ExitCode {
    let args: Vec<String> = env::args().collect();
    let sub = match args.get(1) {
        Some(s) => s.as_str(),
        None => {
            usage();
            return ExitCode::FAILURE;
        },
    };
    let pass = match sub {
        "keypair" => cmd_keypair_deterministic(),
        "keypair-random" => {
            let n: usize = args.get(2).and_then(|s| s.parse().ok()).unwrap_or(1);
            cmd_keypair_random(n)
        },
        "sign" => {
            let default_msg = String::from("Montana M1 crypto shakedown");
            let msg = args.get(2).unwrap_or(&default_msg);
            cmd_sign(msg)
        },
        "hash" => cmd_hash(),
        "merkle-empty" => cmd_merkle(),
        "all" => cmd_all(),
        _ => {
            usage();
            return ExitCode::FAILURE;
        },
    };
    bool_to_exit(pass)
}