DEVELOPER GUIDE

// 1. Check if installed
if (typeof window.krayWallet !== 'undefined') {
    console.log('KRAY Wallet detected!');
}

// 2. Connect
async function connectWallet() {
    const result = await window.krayWallet.requestAccounts();
    if (result.success) {
        console.log('Connected:', result.address);
    }
}

// 3. Get data
const balance = await window.krayWallet.getBalance();
const inscriptions = await window.krayWallet.getInscriptions();
const runes = await window.krayWallet.getRunes();
            

// ─────────────────────────────────────────────────────────────
// STAY CONNECTED ACROSS RELOADS — the standard pattern
// Connect once; the site stays connected through refreshes until
// the user clicks Disconnect. No popup on refresh.
// ─────────────────────────────────────────────────────────────
const CONNECTED_KEY = "myapp:wallet-connected";

// Call ONCE on page load, before deciding to show Connected vs "Connect".
async function restoreWalletSession() {
    if (!window.krayWallet) return null;                        // not installed
    if (localStorage.getItem(CONNECTED_KEY) !== "1") return null; // user isn't opted in
    try {
        // getAccounts() is SILENT — never opens a popup. Returns [] if the
        // user revoked this origin in the extension.
        const [address] = await window.krayWallet.getAccounts();
        if (!address) { localStorage.removeItem(CONNECTED_KEY); return null; } // self-heal
        return address;
    } catch {
        return null;                                            // stay logged out
    }
}

// Call from your "Connect" button (this is the one that may popup).
async function connectWallet() {
    const result = await window.krayWallet.requestAccounts();
    const address = Array.isArray(result) ? result[0] : result.address;
    if (address) localStorage.setItem(CONNECTED_KEY, "1");      // remember the choice
    return address;
}

// Call from your "Disconnect" button → a refresh now stays logged out.
function disconnectWallet() {
    localStorage.removeItem(CONNECTED_KEY);
    // ...also clear your own app/session state (cookies, JWT, UI).
    // The extension keeps the origin approved (expected); the flag above is
    // what gates auto-reconnect, so the wallet stays gone until Connect.
}

// Wire it up on load:
//   const address = await restoreWalletSession();
//   address ? showConnected(address) : showConnectButton();
            

// ─────────────────────────────────────────────────────────────
// FRONTEND — uses only the open, public window.krayWallet API
// ─────────────────────────────────────────────────────────────
const KRAY = "https://kray.space";
const DIVISIBILITY = { KRAY: 0, DOG: 5, RADIOLA: 2, DSC: 0, SATSPACE: 3 };
const toRaw = (human, token) => Math.round(human * 10 ** (DIVISIBILITY[token] ?? 0));

function wallet() {
    if (!window.krayWallet) throw new Error("Install the KRAY Wallet extension.");
    return window.krayWallet;
}

// Current sequential nonce for the account (NOT Date.now()).
async function getNonce(address) {
    const acc = await fetch(`${KRAY}/l2/account/${address}`).then(r => r.json());
    return acc.nonce ?? 0;
}

// 1) CONNECT + PROVE OWNERSHIP (login)
async function connectAndProve() {
    const w = wallet();
    const acc = await w.requestAccounts();
    const address = Array.isArray(acc) ? acc[0] : acc.address;
    const pk = await w.getPublicKey();
    const pubkey = pk.publicKey ?? pk;

    // Your backend issues a one-time nonce so the login can't be replayed.
    const { nonce } = await fetch("/your-backend/auth/challenge").then(r => r.json());
    const message = `myapp:login:${address}:${nonce}`;
    const { signature } = await w.signMessageWithConfirmation(message);

    // Send {address, pubkey, message, signature} to your backend to verify.
    return { address, pubkey, message, signature };
}

// 2) ACCEPT A PAYMENT in any L2 token (e.g. 500 DOG)
async function payWithToken({ buyer, token, amountHuman, yourReceiveAddress }) {
    const w = wallet();
    const amountRaw = toRaw(amountHuman, token);      // RAW units
    const nonce = await getNonce(buyer);
    const pk = await w.getPublicKey();
    const pubkey = pk.publicKey ?? pk;

    // Signed message format the network verifies: from:to:amount:nonce:tx_type:token
    const message = `${buyer}:${yourReceiveAddress}:${amountRaw}:${nonce}:transfer:${token}`;
    const { signature } = await w.signMessageWithConfirmation(message);

    const res = await fetch(`${KRAY}/l2/transaction/send`, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({
            from_account: buyer, to_account: yourReceiveAddress,
            amount: amountRaw, token_symbol: token, tx_type: "transfer",
            nonce, signature, pubkey,
        }),
    });
    const data = await res.json();
    if (!res.ok) throw new Error(data.error || "Payment failed");
    return data.tx_hash;   // hand this to your backend to confirm
}
            

// ─────────────────────────────────────────────────────────────
// BACKEND (Node) — the source of truth. Verify, then grant.
//   npm i @bitcoinerlab/secp256k1 bitcoinjs-lib
// ─────────────────────────────────────────────────────────────
import * as ecc from "@bitcoinerlab/secp256k1";
import * as bitcoin from "bitcoinjs-lib";
import { createHash } from "crypto";
bitcoin.initEccLib(ecc);

// Proves the signer actually owns that taproot address (Schnorr BIP-340 + P2TR).
export function verifyOwnership(message, sigHex, pubkeyHex, address) {
    const pub = Buffer.from(pubkeyHex, "hex");
    const x = pub.length === 33 ? pub.subarray(1, 33) : pub.subarray(0, 32);
    const derived = bitcoin.payments.p2tr({
        internalPubkey: x, network: bitcoin.networks.bitcoin,
    }).address;
    if (derived !== address) return false;              // anti-spoof
    const hash = createHash("sha256").update(message).digest();
    const sig = Buffer.from(sigHex, "hex");
    return sig.length === 64 && ecc.verifySchnorr(hash, x, sig);
}

// Confirms the payment really landed with the right token + RAW amount.
export async function confirmPayment(txHash, to, token, amountRaw) {
    const tx = await fetch(`https://kray.space/l2/transaction/${txHash}`).then(r => r.json());
    return tx?.status === "confirmed" &&
           tx?.to_account === to &&
           (tx?.token_symbol || "KRAY") === token &&
           BigInt(tx?.amount ?? 0) === BigInt(amountRaw);
}

// Grant the plan / NFT / access ONLY when BOTH are true. Never before.
            

// ─────────────────────────────────────────────────────────────
// LIVE NFT LICENSE — backend helpers (open APIs only)
// Reuse verifyOwnership() from the template above for the wallet proof.
// ─────────────────────────────────────────────────────────────
const KRAY = "https://kray.space";

/**
 * Does `address` CURRENTLY hold a live pass?
 * Configure ONE OR MORE of: l2CollectionIds, l2NftIds, l1InscriptionIds.
 */
export async function holdsLivePass(address, gate) {
    const need = Math.max(1, gate.minCount ?? 1);
    const addr = address.toLowerCase();
    let held = 0;

    const wantL2 = (gate.l2CollectionIds?.length || gate.l2NftIds?.length);
    if (wantL2) {
        const res = await fetch(`${KRAY}/api/l2/nfts/${addr}`);
        if (!res.ok) return false;                          // fail closed
        const body = await res.json();
        const list = Array.isArray(body) ? body : (body.nfts ?? []);
        const collections = new Set(gate.l2CollectionIds ?? []);
        const ids = new Set(gate.l2NftIds ?? []);
        for (const n of list) {
            const status = String(n.status ?? "").toUpperCase();
            if (status !== "ACTIVE") continue;              // BRIDGED ≠ license
            const id = String(n.id ?? n.nft_id ?? "");
            const coll = String(n.collection_id ?? n.collectionId ?? "");
            if (collections.has(coll) || ids.has(id)) {
                if (++held >= need) return true;
            }
        }
    }

    for (const inscriptionId of gate.l1InscriptionIds ?? []) {
        // L1 Ordinal owner — use YOUR ord indexer (or Kray node /ord/inscription/:id
        // with your API key). Public sites should not hardcode a private node URL.
        const res = await fetch(`${YOUR_ORD_BASE}/ord/inscription/${inscriptionId}`, {
            headers: YOUR_ORD_HEADERS, // e.g. { "x-api-key": "…" } if required
        });
        if (!res.ok) return false;                          // fail closed
        const { address: owner } = await res.json();
        if (owner && owner.toLowerCase() === addr) {
            if (++held >= need) return true;
        }
    }
    return false;
}

// Example gate configs (pick what fits your product):
//   { l2CollectionIds: ["my_club_pass"], minCount: 1 }
//   { l2NftIds: ["nft_unique_1of1"] }
//   { l1InscriptionIds: ["a1b2…64chars…i0"] }

/**
 * Full gate on a privileged action:
 *   1) verifyOwnership(message, sig, pubkey, address)  ← wallet is real
 *   2) holdsLivePass(address, YOUR_GATE)               ← NFT still there
 * Grant ONLY when both are true. Re-run on every request (live license).
 */
            

// ─────────────────────────────────────────────────────────────
// FRONTEND — prove wallet, then ask YOUR backend (never skip the proof)
// ─────────────────────────────────────────────────────────────
async function unlockWithNftPass() {
    const w = wallet();
    const acc = await w.requestAccounts();
    const address = Array.isArray(acc) ? acc[0] : acc.address;
    const pubkey = (await w.getPublicKey()).publicKey ?? await w.getPublicKey();

    // One-time challenge from YOUR backend (anti-replay) — same as login.
    const { nonce } = await fetch("/your-backend/auth/challenge").then(r => r.json());
    const message = `myapp:nft-pass:${address}:${nonce}`;
    const { signature } = await w.signMessage(message); // login-style, frictionless

    // Backend: verifyOwnership + holdsLivePass → session / cookie / JWT you issue.
    const res = await fetch("/your-backend/nft-pass/unlock", {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ address, pubkey, message, signature, nonce }),
    });
    if (!res.ok) throw new Error("Pass not held or signature invalid");
    return res.json(); // { ok: true, session: "…" }
}