//go:build ignore

// gen_age_vectors writes the age vectors of stage 2 of datekeys-dart, every
// file and every result produced by filippo.io/age v1.3.2 and the agewrap
// package of datekeys-go:
//
//   - test/vectors/age.json: age files with X25519 and scrypt recipients,
//     their truncations and manipulations, a corpus of headers against the
//     grammar and the limits of the parser, the stanza rules and identities
//     of agewrap, and the text of Go's error for each;
//   - test/vectors/age_fixtures.json: the PAYLOAD_AGE of every official
//     capsule of testdata/ with its payload_identity, and the
//     INNER_ACCESS_AGE of the time_and_key ones, which OUTER_TIME_AGE seals
//     and this program opens with the release of the fixture.
//
// Large files are not stored: a file of more than one STREAM chunk is its
// header, its nonce and its file key, and the tests encrypt the documented
// plaintext again and check the SHA-256 of the whole file before reading it.
// Headers of megabytes are written as parts to repeat.
//
// It needs the module context of datekeys-go and changes nothing there:
//
//	cd ../datekeys-go && go run ../datekeys-dart/tool/gen_age_vectors.go -out ../datekeys-dart/test/vectors
//
// The fixtures are those of the testdata/ of datekeys-dart (-testdata), the
// copy synced from datekeys-go at the version that this package implements.
//
// age draws its file keys, nonces and ephemeral shares from crypto/rand, so
// each run writes other files; the tests read whatever is committed.
package main

import (
	"bytes"
	"crypto/sha256"
	"encoding/base64"
	"encoding/hex"
	"encoding/json"
	"flag"
	"fmt"
	"io"
	"log"
	"os"
	"path/filepath"
	"runtime"
	"slices"
	"strings"
	"unicode/utf8"

	"filippo.io/age"
	"golang.org/x/crypto/chacha20poly1305"
	"golang.org/x/crypto/curve25519"
	"golang.org/x/crypto/hkdf"
	"golang.org/x/crypto/scrypt"

	"g.activething.com/go/DateKeys/accesskey"
	"g.activething.com/go/DateKeys/agewrap"
	"g.activething.com/go/DateKeys/capsule"
	"g.activething.com/go/DateKeys/profile"
	"g.activething.com/go/DateKeys/provider"
)

type obj = map[string]any

// testdata is the synced copy of datekeys-dart, read only.
var testdata string

func h(b []byte) string { return hex.EncodeToString(b) }

func sum(b []byte) string {
	s := sha256.Sum256(b)
	return h(s[:])
}

func check(err error) {
	if err != nil {
		log.Fatal(err)
	}
}

func mustHex(s string) []byte {
	b, err := hex.DecodeString(s)
	check(err)
	return b
}

var b64 = base64.RawStdEncoding

// pattern is the plaintext of n bytes that the large files encrypt: byte i
// is (31·i + 7) mod 256.
func pattern(n int) []byte {
	b := make([]byte, n)
	for i := range b {
		b[i] = byte(31*i + 7)
	}
	return b
}

// eph is the i-th ephemeral scalar of the crafted stanzas.
func eph(i int) []byte {
	s := sha256.Sum256([]byte{byte(i)})
	return s[:]
}

func encrypt(plain []byte, rs ...age.Recipient) []byte {
	var buf bytes.Buffer
	w, err := age.Encrypt(&buf, rs...)
	check(err)
	_, err = w.Write(plain)
	check(err)
	check(w.Close())
	return buf.Bytes()
}

// fnRecipient wraps the file key with a function: stanzas that age would not
// write, with the file key that the header MAC uses.
type fnRecipient func(fileKey []byte) []*age.Stanza

func (f fnRecipient) Wrap(fileKey []byte) ([]*age.Stanza, error) { return f(fileKey), nil }

// x25519Stanza wraps fileKey to the public key pub with the ephemeral
// scalar eph, as age's X25519Recipient, with the share and body given.
func x25519Stanza(fileKey, pub, eph []byte) *age.Stanza {
	share, err := curve25519.X25519(eph, curve25519.Basepoint)
	check(err)
	secret, err := curve25519.X25519(eph, pub)
	check(err)
	salt := append(slices.Clone(share), pub...)
	key := make([]byte, 32)
	_, err = io.ReadFull(hkdf.New(sha256.New, secret, salt, []byte("age-encryption.org/v1/X25519")), key)
	check(err)
	a, err := chacha20poly1305.New(key)
	check(err)
	return &age.Stanza{Type: "X25519", Args: []string{b64.EncodeToString(share)}, Body: a.Seal(nil, make([]byte, 12), fileKey, nil)}
}

func scryptStanza(fileKey []byte, pass string, salt []byte, logN int, wf string) *age.Stanza {
	k, err := scrypt.Key([]byte(pass), append([]byte("age-encryption.org/v1/scrypt"), salt...), 1<<logN, 8, 1, 32)
	check(err)
	a, err := chacha20poly1305.New(k)
	check(err)
	return &age.Stanza{Type: "scrypt", Args: []string{b64.EncodeToString(salt), wf}, Body: a.Seal(nil, make([]byte, 12), fileKey, nil)}
}

// An identity of a case, as the tests build it again.
type idSpec struct {
	X25519        string `json:"x25519,omitempty"`
	Scrypt        string `json:"scrypt,omitempty"`
	MaxWorkFactor int    `json:"max_work_factor,omitempty"`
}

func (s idSpec) identity() age.Identity {
	if s.X25519 != "" {
		id, err := age.ParseX25519Identity(s.X25519)
		check(err)
		return id
	}
	id, err := age.NewScryptIdentity(s.Scrypt)
	check(err)
	id.SetMaxWorkFactor(s.MaxWorkFactor)
	return id
}

// result decrypts file with ids as capsule.decryptAll does and returns the
// outcome: the SHA-256 of the plaintext, or the text of the error and its
// phase, header for age.Decrypt and payload for the STREAM.
func result(file []byte, ids ...age.Identity) obj {
	r, err := age.Decrypt(bytes.NewReader(file), ids...)
	if err != nil {
		return obj{"error": err.Error(), "phase": "header"}
	}
	plain, err := io.ReadAll(r)
	if err != nil {
		return obj{"error": err.Error(), "phase": "payload"}
	}
	return obj{"plaintext_sha256": sum(plain), "plaintext_length": len(plain)}
}

// A part of a file: text or hex, repeated.
type part struct {
	Text   *string `json:"text,omitempty"`
	Hex    *string `json:"hex,omitempty"`
	Repeat int     `json:"repeat,omitempty"`
}

// txt is a text part, or a hex one when s is not UTF-8, which JSON cannot
// hold.
func txt(s string) part {
	if !utf8.ValidString(s) {
		return hx([]byte(s))
	}
	return part{Text: &s}
}
func hx(b []byte) part         { s := h(b); return part{Hex: &s} }
func rep(s string, n int) part { return part{Text: &s, Repeat: n} }
func build(parts []part) []byte {
	var buf bytes.Buffer
	for _, p := range parts {
		var b []byte
		if p.Text != nil {
			b = []byte(*p.Text)
		} else {
			b = mustHex(*p.Hex)
		}
		n := p.Repeat
		if n == 0 {
			n = 1
		}
		for range n {
			buf.Write(b)
		}
	}
	return buf.Bytes()
}

func stanzasOf(ss []*age.Stanza) []obj {
	var out []obj
	for _, s := range ss {
		args := s.Args
		if args == nil {
			args = []string{}
		}
		out = append(out, obj{"type": s.Type, "args": args, "body_length": len(s.Body), "body_sha256": sum(s.Body)})
	}
	return out
}

// probe gives the stanzas of agewrap.Stanzas: all of them when they are
// few, else their number and the first and the last.
func probe(file []byte) obj {
	ss, err := agewrap.Stanzas(bytes.NewReader(file))
	if err != nil {
		return obj{"error": err.Error()}
	}
	if len(ss) <= 16 {
		return obj{"count": len(ss), "stanzas": stanzasOf(ss)}
	}
	return obj{"count": len(ss), "first": stanzasOf(ss[:1])[0], "last": stanzasOf(ss[len(ss)-1:])[0]}
}

func errText(err error) any {
	if err == nil {
		return nil
	}
	return err.Error()
}

func main() {
	outDir := flag.String("out", "", "directory of the vectors")
	flag.StringVar(&testdata, "testdata", "../datekeys-dart/testdata", "the testdata/ of datekeys-dart, synced from datekeys-go")
	flag.Parse()
	if *outDir == "" {
		log.Fatal("-out is required")
	}
	ageJSON(*outDir)
	fixturesJSON(*outDir)
}

func ageJSON(outDir string) {
	primary, err := age.GenerateX25519Identity()
	check(err)
	other, err := age.GenerateX25519Identity()
	check(err)
	mainID := idSpec{X25519: primary.String()}
	otherID := idSpec{X25519: other.String()}
	const pass = "correct horse battery staple"
	mainRaw, err := agewrap.RawX25519Recipient(primary.Recipient())
	check(err)

	doc := obj{
		"description": "age files written by filippo.io/age v1.3.2 and read by it, with the text of Go's error for each case; see tool/gen_age_vectors.go. A file is hex, or parts (text or hex, repeated) to concatenate. A large file is its header, its nonce and its file key: its plaintext is pattern(length), byte i = (31 i + 7) mod 256, encrypted again by the test, which checks the SHA-256 of the whole file. An identity is {x25519: AGE-SECRET-KEY-1...} or {scrypt: passphrase, max_work_factor}. A result is the SHA-256 and length of the plaintext, or the error of age.Decrypt (phase header) or of reading its plaintext (phase payload).",
		"generator":   "tool/gen_age_vectors.go, " + runtime.Version(),
		"identities":  obj{"main": primary.String(), "main_recipient": primary.Recipient().String(), "main_recipient_raw": h(mainRaw), "other": other.String(), "passphrase": pass},
	}

	// Files.
	files := map[string][]byte{}
	var fileList []obj
	addFile := func(name string, file []byte, plain []byte) {
		files[name] = file
		fileList = append(fileList, obj{"name": name, "hex": h(file), "plaintext": h(plain)})
	}
	for _, n := range []int{0, 1, 100} {
		p := pattern(n)
		addFile(fmt.Sprintf("x25519_%d", n), encrypt(p, primary.Recipient()), p)
	}
	addFile("x25519_two_recipients", encrypt(pattern(50), other.Recipient(), primary.Recipient()), pattern(50))
	for _, logN := range []int{1, 2, 10, 16, 17} {
		r, err := age.NewScryptRecipient(pass)
		check(err)
		r.SetWorkFactor(logN)
		p := pattern(40)
		addFile(fmt.Sprintf("scrypt_%d", logN), encrypt(p, r), p)
	}
	// An scrypt stanza beside an X25519 one, which age.Encrypt never writes.
	addFile("x25519_and_scrypt", encrypt(pattern(10), primary.Recipient(), fnRecipient(func(fk []byte) []*age.Stanza {
		return []*age.Stanza{scryptStanza(fk, pass, pattern(16), 1, "1")}
	})), pattern(10))
	// scrypt stanzas of every form that age refuses, each with a valid MAC.
	scryptForms := []struct {
		name string
		s    func(fk []byte) *age.Stanza
	}{
		{"scrypt_wf_leading_zero", func(fk []byte) *age.Stanza { return scryptStanza(fk, pass, pattern(16), 1, "01") }},
		{"scrypt_wf_zero", func(fk []byte) *age.Stanza { return scryptStanza(fk, pass, pattern(16), 1, "0") }},
		{"scrypt_wf_sign", func(fk []byte) *age.Stanza { return scryptStanza(fk, pass, pattern(16), 1, "+1") }},
		{"scrypt_wf_letters", func(fk []byte) *age.Stanza { return scryptStanza(fk, pass, pattern(16), 1, "1a") }},
		{"scrypt_wf_out_of_range", func(fk []byte) *age.Stanza {
			return scryptStanza(fk, pass, pattern(16), 1, "99999999999999999999")
		}},
		{"scrypt_wf_max_int64", func(fk []byte) *age.Stanza {
			return scryptStanza(fk, pass, pattern(16), 1, "9223372036854775807")
		}},
		{"scrypt_wf_23", func(fk []byte) *age.Stanza { return scryptStanza(fk, pass, pattern(16), 1, "23") }},
		{"scrypt_one_arg", func(fk []byte) *age.Stanza {
			s := scryptStanza(fk, pass, pattern(16), 1, "1")
			s.Args = s.Args[:1]
			return s
		}},
		{"scrypt_salt_15", func(fk []byte) *age.Stanza { return scryptStanza(fk, pass, pattern(15), 1, "1") }},
		{"scrypt_salt_padded", func(fk []byte) *age.Stanza {
			s := scryptStanza(fk, pass, pattern(16), 1, "1")
			s.Args[0] += "=="
			return s
		}},
		{"scrypt_body_31", func(fk []byte) *age.Stanza {
			s := scryptStanza(fk, pass, pattern(16), 1, "1")
			s.Body = s.Body[:31]
			return s
		}},
	}
	for _, f := range scryptForms {
		addFile(f.name, encrypt(pattern(5), fnRecipient(func(fk []byte) []*age.Stanza { return []*age.Stanza{f.s(fk)} })), pattern(5))
	}
	// X25519 stanzas of every form that age refuses, each with a valid MAC.
	// u = 1, a point of low order: X25519 of any scalar and it is zero.
	lowOrder := append([]byte{1}, make([]byte, 31)...)
	if _, err := curve25519.X25519(pattern(32), lowOrder); err == nil {
		log.Fatal("u = 1 is not refused")
	}
	x25519Forms := []struct {
		name string
		s    func(fk []byte) *age.Stanza
	}{
		{"x25519_no_arg", func(fk []byte) *age.Stanza {
			s := x25519Stanza(fk, mainRaw, pattern(32))
			s.Args = nil
			return s
		}},
		{"x25519_two_args", func(fk []byte) *age.Stanza {
			s := x25519Stanza(fk, mainRaw, pattern(32))
			s.Args = append(s.Args, "x")
			return s
		}},
		{"x25519_share_31", func(fk []byte) *age.Stanza {
			s := x25519Stanza(fk, mainRaw, pattern(32))
			s.Args[0] = b64.EncodeToString(pattern(31))
			return s
		}},
		{"x25519_share_bad_base64", func(fk []byte) *age.Stanza {
			s := x25519Stanza(fk, mainRaw, pattern(32))
			s.Args[0] = s.Args[0][:42] + "B"
			return s
		}},
		{"x25519_share_low_order", func(fk []byte) *age.Stanza {
			s := x25519Stanza(fk, mainRaw, pattern(32))
			s.Args[0] = b64.EncodeToString(lowOrder)
			return s
		}},
		{"x25519_body_33", func(fk []byte) *age.Stanza {
			s := x25519Stanza(fk, mainRaw, pattern(32))
			s.Body = append(s.Body, 0)
			return s
		}},
		{"x25519_body_tampered", func(fk []byte) *age.Stanza {
			s := x25519Stanza(fk, mainRaw, pattern(32))
			s.Body[3] ^= 1
			return s
		}},
		{"x25519_custom_valid", func(fk []byte) *age.Stanza { return x25519Stanza(fk, mainRaw, pattern(32)) }},
	}
	for _, f := range x25519Forms {
		addFile(f.name, encrypt(pattern(5), fnRecipient(func(fk []byte) []*age.Stanza { return []*age.Stanza{f.s(fk)} })), pattern(5))
	}
	doc["files"] = fileList

	// Large files: more than one STREAM chunk.
	var large []obj
	largeFiles := map[string][]byte{}
	for _, n := range []int{65535, 65536, 65537, 131072, 140000} {
		file := encrypt(pattern(n), primary.Recipient())
		hdr, err := age.ExtractHeader(bytes.NewReader(file))
		check(err)
		fk, err := age.DecryptHeader(hdr, primary)
		check(err)
		name := fmt.Sprintf("x25519_large_%d", n)
		largeFiles[name] = file
		files[name] = file
		large = append(large, obj{"name": name, "header": h(hdr), "nonce": h(file[len(hdr) : len(hdr)+16]), "file_key": h(fk), "length": n, "file_length": len(file), "file_sha256": sum(file)})
	}
	doc["large"] = large

	// Cases: a file, an edit, identities, and Go's result.
	type edit struct {
		Truncate *int   `json:"truncate,omitempty"`
		Append   string `json:"append,omitempty"`
		At       *int   `json:"at,omitempty"`
		Xor      string `json:"xor,omitempty"`
	}
	apply := func(b []byte, e *edit) []byte {
		b = slices.Clone(b)
		if e == nil {
			return b
		}
		if e.Truncate != nil {
			b = b[:*e.Truncate]
		}
		if e.At != nil {
			x := mustHex(e.Xor)
			for i := range x {
				b[*e.At+i] ^= x[i]
			}
		}
		return append(b, mustHex(e.Append)...)
	}
	intp := func(i int) *int { return &i }
	var caseList []obj
	addCase := func(name, file string, e *edit, ids ...idSpec) {
		b := apply(files[file], e)
		var ages []age.Identity
		for _, s := range ids {
			ages = append(ages, s.identity())
		}
		c := obj{"name": name, "file": file, "identities": ids, "result": result(b, ages...)}
		if ids == nil {
			c["identities"] = []idSpec{}
		}
		if e != nil {
			c["edit"] = e
		}
		caseList = append(caseList, c)
	}
	scryptID := func(p string, max int) idSpec { return idSpec{Scrypt: p, MaxWorkFactor: max} }
	for _, f := range fileList {
		name := f["name"].(string)
		switch {
		case strings.HasPrefix(name, "scrypt_"), name == "x25519_and_scrypt":
			addCase(name+", passphrase, max 16", name, nil, scryptID(pass, 16))
			addCase(name+", passphrase, max 22", name, nil, scryptID(pass, 22))
			addCase(name+", X25519 and passphrase", name, nil, mainID, scryptID(pass, 16))
		default:
			addCase(name+", main identity", name, nil, mainID)
		}
	}
	addCase("x25519_1, other identity", "x25519_1", nil, otherID)
	addCase("x25519_1, other and main", "x25519_1", nil, otherID, mainID)
	addCase("x25519_1, two other identities", "x25519_1", nil, otherID, otherID)
	addCase("x25519_1, passphrase", "x25519_1", nil, scryptID(pass, 16))
	addCase("x25519_1, passphrase then main", "x25519_1", nil, scryptID(pass, 16), mainID)
	addCase("x25519_1, no identity", "x25519_1", nil)
	addCase("x25519_two_recipients, other", "x25519_two_recipients", nil, otherID)
	addCase("scrypt_2, wrong passphrase", "scrypt_2", nil, scryptID("wrong", 16))
	addCase("scrypt_2, wrong passphrase then main", "scrypt_2", nil, scryptID("wrong", 16), mainID)
	addCase("scrypt_17, max 17", "scrypt_17", nil, scryptID(pass, 17))

	// Truncations and manipulations of x25519_100 and of the large files.
	small := files["x25519_100"]
	hdrSmall, err := age.ExtractHeader(bytes.NewReader(small))
	check(err)
	hl := len(hdrSmall)
	for _, n := range []int{0, 10, 21, 22, 23, hl - 2, hl - 1, hl, hl + 1, hl + 15, hl + 16, hl + 17, hl + 31, hl + 32, len(small) - 1} {
		addCase(fmt.Sprintf("x25519_100 truncated to %d", n), "x25519_100", &edit{Truncate: intp(n)}, mainID)
	}
	addCase("x25519_100 and a byte", "x25519_100", &edit{Append: "00"}, mainID)
	for _, at := range []int{0, 5, 21, 25, hl - 10, hl - 2, hl, hl + 15, hl + 16, hl + 50, len(small) - 1} {
		addCase(fmt.Sprintf("x25519_100, byte %d changed", at), "x25519_100", &edit{At: intp(at), Xor: "01"}, mainID)
	}
	for _, name := range []string{"x25519_large_65535", "x25519_large_65536", "x25519_large_65537", "x25519_large_131072", "x25519_large_140000"} {
		f := files[name]
		hdr, err := age.ExtractHeader(bytes.NewReader(f))
		check(err)
		p := len(hdr) + 16
		const enc = 65536 + 16
		cuts := []int{p, p + 1, p + 16, p + enc - 1, p + enc, p + enc + 1, p + enc + 16, p + enc + 17, len(f) - 1, len(f) - 16, len(f) - 17}
		for _, n := range cuts {
			if n < 0 || n > len(f) {
				continue
			}
			addCase(fmt.Sprintf("%s truncated to %d", name, n), name, &edit{Truncate: intp(n)}, mainID)
		}
		addCase(name+" and a byte", name, &edit{Append: "00"}, mainID)
		addCase(name+" and 17 bytes", name, &edit{Append: h(make([]byte, 17))}, mainID)
		for _, at := range []int{p, p + 100, p + enc - 1, p + enc, len(f) - 1} {
			if at < len(f) {
				addCase(fmt.Sprintf("%s, byte %d changed", name, at), name, &edit{At: intp(at), Xor: "80"}, mainID)
			}
		}
		addCase(name+", nonce changed", name, &edit{At: intp(len(hdr)), Xor: "01"}, mainID)
	}
	doc["cases"] = caseList

	// The grammar and the limits of the header. Each file is the header of
	// x25519_1 or a variant of it, with its payload.
	base := files["x25519_1"]
	hdr1, err := age.ExtractHeader(bytes.NewReader(base))
	check(err)
	payload := base[len(hdr1):]
	lines := strings.SplitAfter(string(hdr1), "\n")
	intro, open, body, footer := lines[0], lines[1], lines[2], lines[3]
	mac := strings.TrimSuffix(strings.TrimPrefix(footer, "--- "), "\n")
	tail := []part{txt(footer), hx(payload)}
	withBody := func(o, b string) []part { return append([]part{txt(intro), txt(o), txt(b)}, tail...) }
	var headers []obj
	addHeader := func(name string, parts []part) {
		file := build(parts)
		headers = append(headers, obj{"name": name, "parts": parts, "length": len(file), "sha256": sum(file), "result": result(file, primary), "probe": probe(file)})
	}
	full := strings.Repeat("A", 64) + "\n"
	big := 2 << 20
	addHeader("x25519_1 as written", []part{hx(base)})
	addHeader("empty", nil)
	addHeader("intro without its newline", []part{txt(strings.TrimSuffix(intro, "\n"))})
	addHeader("a short intro", []part{txt("age")})
	addHeader("an identity, no newline", []part{txt(primary.String())})
	addHeader("an identity line", []part{txt(primary.String() + "\n")})
	addHeader("a plugin identity line", []part{txt("AGE-PLUGIN-X-1QQQ\n")})
	addHeader("intro v2", append([]part{txt("age-encryption.org/v2\n"), txt(open), txt(body)}, tail...))
	addHeader("a long first line cut inside a rune", []part{txt("age-encryption.org/v1ñ\n")})
	addHeader("a binary first line", []part{hx([]byte{0xff, 0xfe, 0, 1, '\n'})})
	addHeader("intro only", []part{txt(intro)})
	addHeader("intro and two bytes", []part{txt(intro), txt("--")})
	addHeader("intro and ---", []part{txt(intro), txt("---")})
	addHeader("no stanzas", []part{txt(intro), txt(footer), hx(payload)})
	addHeader("the footer without newline", []part{txt(intro), txt(open), txt(body), txt(strings.TrimSuffix(footer, "\n"))})
	addHeader("the footer without MAC", append([]part{txt(intro), txt(open), txt(body), txt("---\n")}, hx(payload)))
	addHeader("the footer with an empty MAC", append([]part{txt(intro), txt(open), txt(body), txt("--- \n")}, hx(payload)))
	addHeader("the footer with two spaces", append([]part{txt(intro), txt(open), txt(body), txt("---  " + mac + "\n")}, hx(payload)))
	addHeader("the footer with two arguments", append([]part{txt(intro), txt(open), txt(body), txt("--- " + mac + " x\n")}, hx(payload)))
	addHeader("a MAC of 31 bytes", append([]part{txt(intro), txt(open), txt(body), txt("--- " + b64.EncodeToString(pattern(31)) + "\n")}, hx(payload)))
	addHeader("a MAC with padding", append([]part{txt(intro), txt(open), txt(body), txt("--- " + mac + "=\n")}, hx(payload)))
	addHeader("a MAC with a CR", append([]part{txt(intro), txt(open), txt(body), txt("--- " + mac + "\r\n")}, hx(payload)))
	addHeader("a changed MAC", append([]part{txt(intro), txt(open), txt(body), txt("--- " + b64.EncodeToString(pattern(32)) + "\n")}, hx(payload)))
	addHeader("----", append([]part{txt(intro), txt(open), txt(body), txt("---- " + mac + "\n")}, hx(payload)))
	addHeader("opening line ->", withBody("->\n", body))
	addHeader("opening line -> and a space", withBody("-> \n", body))
	addHeader("opening line with two spaces", withBody(strings.Replace(open, " ", "  ", 1), body))
	addHeader("opening line with a trailing space", withBody(strings.TrimSuffix(open, "\n")+" \n", body))
	addHeader("opening line ->X25519", withBody(strings.Replace(open, "-> ", "->", 1), body))
	addHeader("opening line - >", withBody(strings.Replace(open, "->", "- >", 1), body))
	addHeader("opening line with a tab", withBody(strings.Replace(open, " ", "\t", 1), body))
	addHeader("opening line with a CR", withBody(strings.TrimSuffix(open, "\n")+"\r\n", body))
	addHeader("an argument with a byte above 0x7e", withBody("-> X25519 \x80\n", body))
	addHeader("an argument with DEL", withBody("-> X25519 a\x7f\n", body))
	addHeader("a type of non-ASCII letters", withBody("-> tlöck 1\n", body))
	addHeader("129 tokens", withBody("->"+strings.Repeat(" a", 129)+"\n", "\n"))
	addHeader("130 tokens", withBody("->"+strings.Repeat(" a", 130)+"\n", "\n"))
	addHeader("a body line with a CR", withBody(open, strings.TrimSuffix(body, "\n")+"\r\n"))
	addHeader("a body line with padding", withBody(open, strings.TrimSuffix(body, "\n")+"=\n"))
	// The last character of 32 bytes in Base64 carries two zero bits.
	const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
	last := strings.IndexByte(alphabet, body[len(body)-2])
	addHeader("a body line with non-zero trailing bits", withBody(open, body[:len(body)-2]+string(alphabet[last|1])+"\n"))
	addHeader("a body line of 41 bytes", withBody(open, strings.TrimSuffix(body, "\n")[:42]+"\n"))
	addHeader("a body line with a space", withBody(open, " "+body))
	addHeader("a body line of 68 columns", withBody(open, strings.Repeat("A", 68)+"\n"))
	addHeader("a body line of 65 columns", withBody(open, strings.Repeat("A", 65)+"\n"))
	addHeader("a full line, then the footer", withBody(open, full))
	addHeader("a full line, then a stanza", append([]part{txt(intro), txt(open), txt(full), txt(open), txt(body)}, tail...))
	addHeader("a full line and an empty one", withBody(open, full+"\n"))
	addHeader("an empty body", withBody(open, "\n"))
	addHeader("a stanza cut after its opening line", []part{txt(intro), txt(open)})
	addHeader("a stanza cut in its body", []part{txt(intro), txt(open), txt(strings.TrimSuffix(body, "\n"))})
	addHeader("two copies of the stanza", append([]part{txt(intro), txt(open), txt(body), txt(open), txt(body)}, tail...))
	addHeader("1024 stanzas", append([]part{txt(intro), rep(open+body, 1024)}, tail...))
	addHeader("1025 stanzas", append([]part{txt(intro), rep(open+body, 1025)}, tail...))
	addHeader("1023 other stanzas and the stanza", append([]part{txt(intro), rep("-> other\n\n", 1023), txt(open), txt(body)}, tail...))
	// The 2 MiB limit: a first line, a body, the Peek of the footer, the
	// footer line, and a header that ends exactly at the limit.
	addHeader("a first line of 2 MiB and a byte", []part{rep("a", big+1)})
	addHeader("a first line of 2 MiB, no newline", []part{rep("a", big)})
	addHeader("a first line of 2 MiB with its newline", []part{rep("a", big-1), txt("\n")})
	addHeader("a body past 2 MiB", append([]part{txt(intro), txt("-> pad x\n"), rep(full, 33000)}, tail...))
	// intro (22) + "-> pad " (7) + token + "\n" + k full lines + "\n" ends
	// at 31 + t + 65k.
	padStanza := func(end int) []part {
		k := (end - 32) / 65
		t := end - 31 - 65*k
		if t < 1 {
			k--
			t += 65
		}
		return []part{txt(intro), txt("-> pad "), rep("t", t), txt("\n"), rep(full, k), txt("\n")}
	}
	footerLine := "--- " + mac + "\n"
	addHeader("the footer peeked at 2 MiB - 2", append(padStanza(big-2), txt(footerLine), hx(payload)))
	addHeader("the footer peeked at 2 MiB - 3", append(padStanza(big-3), txt(footerLine), hx(payload)))
	addHeader("a header that ends at 2 MiB", append(padStanza(big-len(footerLine)), txt(footerLine), hx(payload)))
	addHeader("a header that ends at 2 MiB + 1", append(padStanza(big-len(footerLine)+1), txt(footerLine), hx(payload)))
	addHeader("a header that ends at 2 MiB, nothing after", append(padStanza(big-len(footerLine)), txt(footerLine)))
	doc["headers"] = headers

	// The stanza rules of agewrap, on stanzas given directly.
	qn := profile.Quicknet()
	st := func(typ string, args ...string) *age.Stanza {
		if args == nil {
			args = []string{}
		}
		return &age.Stanza{Type: typ, Args: args, Body: []byte{}}
	}
	chain := qn.ChainHashHex()
	type rule struct {
		name    string
		stanzas []*age.Stanza
	}
	stanzaJSON := func(ss []*age.Stanza) []obj {
		var out []obj
		for _, s := range ss {
			out = append(out, obj{"type": s.Type, "args": s.Args})
		}
		if out == nil {
			out = []obj{}
		}
		return out
	}
	var timeRules []obj
	for _, r := range []rule{
		{"one tlock stanza", []*age.Stanza{st("tlock", "1000", chain)}},
		{"no stanza", nil},
		{"two stanzas", []*age.Stanza{st("tlock", "1000", chain), st("tlock", "1000", chain)}},
		{"an X25519 stanza", []*age.Stanza{st("X25519", "x")}},
		{"tlock with one argument", []*age.Stanza{st("tlock", "1000")}},
		{"tlock with three arguments", []*age.Stanza{st("tlock", "1000", chain, "x")}},
		{"round 0999", []*age.Stanza{st("tlock", "0999", chain)}},
		{"round 1001", []*age.Stanza{st("tlock", "1001", chain)}},
		{"round with a sign", []*age.Stanza{st("tlock", "+1000", chain)}},
		{"chain hash in uppercase", []*age.Stanza{st("tlock", "1000", strings.ToUpper(chain))}},
		{"another chain hash", []*age.Stanza{st("tlock", "1000", strings.Repeat("ab", 32))}},
		{"type TLOCK", []*age.Stanza{st("TLOCK", "1000", chain)}},
		{"type with a quote", []*age.Stanza{st("t\"x", "1000", chain)}},
	} {
		timeRules = append(timeRules, obj{"name": r.name, "stanzas": stanzaJSON(r.stanzas), "round": 1000, "error": errText(agewrap.CheckTimeStanzas(r.stanzas, qn, 1000))})
	}
	var payloadRules, accessRules []obj
	for _, r := range []rule{
		{"one X25519 stanza", []*age.Stanza{st("X25519", "a")}},
		{"no stanza", nil},
		{"two X25519 stanzas", []*age.Stanza{st("X25519", "a"), st("X25519", "b")}},
		{"a scrypt stanza", []*age.Stanza{st("scrypt", "a", "1")}},
		{"type x25519", []*age.Stanza{st("x25519", "a")}},
	} {
		payloadRules = append(payloadRules, obj{"name": r.name, "stanzas": stanzaJSON(r.stanzas), "error": errText(agewrap.CheckPayloadStanzas(r.stanzas))})
	}
	sixteen := func(mod func([]*age.Stanza) []*age.Stanza) []*age.Stanza {
		var ss []*age.Stanza
		for i := range 16 {
			ss = append(ss, st("X25519", fmt.Sprintf("share%d", i)))
		}
		if mod != nil {
			ss = mod(ss)
		}
		return ss
	}
	for _, slots := range []int{0, 16} {
		for _, r := range []rule{
			{"one X25519 stanza", []*age.Stanza{st("X25519", "a")}},
			{"no stanza", nil},
			{"sixteen X25519 stanzas", sixteen(nil)},
			{"fifteen", sixteen(func(s []*age.Stanza) []*age.Stanza { return s[:15] })},
			{"seventeen", sixteen(func(s []*age.Stanza) []*age.Stanza { return append(s, st("X25519", "x")) })},
			{"stanza 3 of type tlock", sixteen(func(s []*age.Stanza) []*age.Stanza { s[3] = st("tlock", "1", "2"); return s })},
			{"stanza 9 repeats the share of stanza 2", sixteen(func(s []*age.Stanza) []*age.Stanza { s[9] = st("X25519", "share2"); return s })},
			{"stanzas of two arguments with the same first one", sixteen(func(s []*age.Stanza) []*age.Stanza {
				s[1] = st("X25519", "same", "x")
				s[2] = st("X25519", "same", "y")
				return s
			})},
			{"stanzas without arguments", sixteen(func(s []*age.Stanza) []*age.Stanza {
				s[1] = st("X25519")
				s[2] = st("X25519")
				return s
			})},
		} {
			accessRules = append(accessRules, obj{"name": r.name, "slots": slots, "stanzas": stanzaJSON(r.stanzas), "error": errText(agewrap.CheckAccessStanzas(r.stanzas, slots))})
		}
	}
	doc["time_stanzas"] = obj{"profile_id": qn.ID, "chain_hash": chain, "cases": timeRules}
	doc["payload_stanzas"] = payloadRules
	doc["access_stanzas"] = accessRules

	// The identities of agewrap on whole files.
	var wrapCases []obj
	addWrap := func(name string, file []byte, kind string, slots int, raws [][]byte, want error) {
		var id age.Identity
		var err error
		switch kind {
		case "payload":
			id, err = agewrap.NewPayloadIdentity(raws[0])
		case "access":
			var ids []age.Identity
			for _, r := range raws {
				x, e := agewrap.X25519IdentityFromRaw(r)
				check(e)
				ids = append(ids, x)
			}
			id, err = agewrap.NewAccessIdentity(slots, ids...)
		}
		var rawHex []string
		for _, r := range raws {
			rawHex = append(rawHex, h(r))
		}
		if rawHex == nil {
			rawHex = []string{}
		}
		c := obj{"name": name, "kind": kind, "slots": slots, "raw_identities": rawHex, "file": h(file)}
		if err != nil {
			c["result"] = obj{"error": err.Error(), "phase": "identity"}
		} else {
			c["result"] = result(file, id)
		}
		wrapCases = append(wrapCases, c)
	}
	newRaw := func() (*age.X25519Identity, []byte) {
		id, err := age.GenerateX25519Identity()
		check(err)
		raw, err := agewrap.RawX25519Identity(id)
		check(err)
		return id, raw
	}
	pid, praw := newRaw()
	_, wrongRaw := newRaw()
	addWrap("PAYLOAD_AGE for R_PAYLOAD", encrypt(pattern(7), pid.Recipient()), "payload", 0, [][]byte{praw}, nil)
	addWrap("PAYLOAD_AGE for another recipient", encrypt(pattern(7), pid.Recipient()), "payload", 0, [][]byte{wrongRaw}, nil)
	addWrap("PAYLOAD_AGE with two stanzas", encrypt(pattern(7), pid.Recipient(), other.Recipient()), "payload", 0, [][]byte{praw}, nil)
	sr, err := age.NewScryptRecipient(pass)
	check(err)
	sr.SetWorkFactor(1)
	addWrap("PAYLOAD_AGE with a scrypt stanza", encrypt(pattern(7), sr), "payload", 0, [][]byte{praw}, nil)
	ppub, err := agewrap.RawX25519Recipient(pid.Recipient())
	check(err)
	for _, f := range []struct {
		name string
		mod  func(s *age.Stanza)
	}{
		{"a share of low order", func(s *age.Stanza) { s.Args[0] = b64.EncodeToString(lowOrder) }},
		{"a share of 31 bytes", func(s *age.Stanza) { s.Args[0] = b64.EncodeToString(pattern(31)) }},
		{"two arguments", func(s *age.Stanza) { s.Args = append(s.Args, "x") }},
		{"a body of 33 bytes", func(s *age.Stanza) { s.Body = append(s.Body, 1) }},
	} {
		file := encrypt(pattern(7), fnRecipient(func(fk []byte) []*age.Stanza {
			s := x25519Stanza(fk, ppub, pattern(32))
			f.mod(s)
			return []*age.Stanza{s}
		}))
		addWrap("PAYLOAD_AGE with "+f.name, file, "payload", 0, [][]byte{praw}, nil)
	}
	addWrap("a payload identity of 31 bytes", encrypt(pattern(7), pid.Recipient()), "payload", 0, [][]byte{praw[:31]}, nil)

	// INNER_ACCESS_AGE: sixteen slots, three credentials.
	var creds []*age.X25519Identity
	var credRaws [][]byte
	var recips []age.Recipient
	for range 3 {
		id, raw := newRaw()
		creds = append(creds, id)
		credRaws = append(credRaws, raw)
		recips = append(recips, id.Recipient())
	}
	for range 13 {
		d, _ := newRaw()
		recips = append(recips, d.Recipient())
	}
	inner := encrypt(pattern(9), recips...)
	addWrap("sixteen slots, the first credential", inner, "access", 16, [][]byte{credRaws[0]}, nil)
	addWrap("sixteen slots, three credentials", inner, "access", 16, credRaws, nil)
	addWrap("sixteen slots, a stranger and the third", inner, "access", 16, [][]byte{wrongRaw, credRaws[2]}, nil)
	addWrap("sixteen slots, a stranger", inner, "access", 16, [][]byte{wrongRaw}, nil)
	addWrap("sixteen slots read as format 1", inner, "access", 0, [][]byte{credRaws[1]}, nil)
	addWrap("no identity", inner, "access", 16, nil, nil)
	addWrap("fifteen slots", encrypt(pattern(9), recips[:15]...), "access", 16, [][]byte{credRaws[0]}, nil)
	addWrap("one recipient, format 1", encrypt(pattern(9), creds[0].Recipient()), "access", 0, [][]byte{credRaws[0]}, nil)
	dup := append(slices.Clone(recips[:15]), creds[1].Recipient())
	addWrap("a credential in two slots", encrypt(pattern(9), dup...), "access", 16, [][]byte{credRaws[0], credRaws[1]}, nil)
	addWrap("a credential in two slots, read by another", encrypt(pattern(9), dup...), "access", 16, [][]byte{credRaws[0]}, nil)
	repeated := encrypt(pattern(9), fnRecipient(func(fk []byte) []*age.Stanza {
		var ss []*age.Stanza
		for i := range 15 {
			ss = append(ss, x25519Stanza(fk, ppub, eph(i)))
		}
		return append(ss, x25519Stanza(fk, ppub, eph(0)))
	}))
	addWrap("a repeated ephemeral share", repeated, "access", 16, [][]byte{praw}, nil)
	malformed := encrypt(pattern(9), fnRecipient(func(fk []byte) []*age.Stanza {
		var ss []*age.Stanza
		for i := range 16 {
			ss = append(ss, x25519Stanza(fk, ppub, eph(100+i)))
		}
		ss[7].Args[0] = b64.EncodeToString(lowOrder)
		return ss
	}))
	addWrap("a stanza with a share of low order", malformed, "access", 16, [][]byte{wrongRaw}, nil)
	addWrap("INNER_ACCESS_AGE with a scrypt stanza", encrypt(pattern(9), sr), "access", 0, [][]byte{credRaws[0]}, nil)
	doc["agewrap"] = wrapCases

	// age.ParseX25519Identity.
	var parseCases []obj
	addParse := func(s string) {
		id, err := age.ParseX25519Identity(s)
		c := obj{"input": s}
		if err != nil {
			c["error"] = err.Error()
		} else {
			raw, err := agewrap.RawX25519Identity(id)
			check(err)
			c["raw"] = h(raw)
			c["recipient"] = id.Recipient().String()
			c["string"] = id.String()
		}
		parseCases = append(parseCases, c)
	}
	addParse(primary.String())
	addParse(strings.ToLower(primary.String()))
	addParse(primary.Recipient().String())
	addParse(primary.String()[:len(primary.String())-1] + "Q")
	addParse("AGE-SECRET-KEY-1QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQSGNLJW")
	addParse("AGE-SECRET-KEY-")
	addParse("")
	addParse("Age-secret-key-1qqq")
	addParse(strings.Replace(primary.String(), "AGE-SECRET-KEY-1", "AGE-SECRET-KEY-2", 1))
	doc["parse_identity"] = parseCases

	write(filepath.Join(outDir, "age.json"), doc)
}

// fixturesJSON opens, in each official capsule of testdata/, its
// PAYLOAD_AGE with its payload_identity and, under time_and_key, its
// OUTER_TIME_AGE with the release of the fixture, to give the
// INNER_ACCESS_AGE that it seals.
func fixturesJSON(outDir string) {
	matches, err := filepath.Glob(filepath.Join(testdata, "fixtures", "*.dkc"))
	check(err)
	qn := profile.Quicknet()
	var out []obj
	for _, path := range matches {
		name := strings.TrimSuffix(filepath.Base(path), ".dkc")
		dkc, err := os.ReadFile(path)
		check(err)
		var rec struct {
			Format          int
			AccessPolicy    string `json:"access_policy"`
			PayloadIdentity string `json:"payload_identity"`
			ControlCBOR     string `json:"control_cbor"`
			Identities      []string
			AccessKeyFile   string `json:"access_key_file"`
			Release         struct {
				Round     uint64
				Signature string
			}
		}
		raw, err := os.ReadFile(strings.TrimSuffix(path, ".dkc") + ".json")
		check(err)
		check(json.Unmarshal(raw, &rec))
		pre, err := capsule.ParsePrelude(dkc[:capsule.PreludeSize])
		check(err)
		off := int(pre.PayloadOffset())
		payload := dkc[off:]
		pid, err := agewrap.NewPayloadIdentity(mustHex(rec.PayloadIdentity))
		check(err)
		res := result(payload, pid)
		if _, ok := res["error"]; ok {
			log.Fatalf("%s: PAYLOAD_AGE: %v", name, res["error"])
		}
		f := obj{"name": name, "format": rec.Format, "access_policy": rec.AccessPolicy, "payload_offset": off, "payload_length": len(payload), "payload_sha256": sum(payload), "payload_identity": rec.PayloadIdentity, "payload_result": res}
		// A stranger gets the error of spec §30.1.
		wrong := strings.Repeat("0", 63) + "1"
		wid, err := agewrap.NewPayloadIdentity(mustHex(wrong))
		check(err)
		f["payload_wrong_identity"] = obj{"raw": wrong, "result": result(payload, wid)}

		sealedStart := capsule.PreludeSize + int(pre.PublicHeaderLen)
		sealed := dkc[sealedStart:off]
		if rec.AccessPolicy == "time_and_key" {
			tid, err := agewrap.NewTimeIdentity(qn, rec.Release.Round, provider.Release{Round: rec.Release.Round, Signature: mustHex(rec.Release.Signature)})
			check(err)
			r, err := age.Decrypt(bytes.NewReader(sealed), tid)
			check(err)
			innerAge, err := io.ReadAll(r)
			check(err)
			slots := 0
			if rec.Format >= 2 {
				slots = agewrap.AccessSlots
			}
			var ids []obj
			var all []age.Identity
			addID := func(source string, id age.Identity) {
				x := id.(*age.X25519Identity)
				raw, err := agewrap.RawX25519Identity(x)
				check(err)
				aid, err := agewrap.NewAccessIdentity(slots, id)
				check(err)
				ids = append(ids, obj{"source": source, "raw": h(raw), "result": result(innerAge, aid)})
				all = append(all, id)
			}
			if rec.AccessKeyFile != "" {
				kf, err := os.Open(filepath.Join(testdata, "fixtures", rec.AccessKeyFile))
				check(err)
				k, err := accesskey.Decode(kf)
				check(err)
				kf.Close()
				id, err := k.Identity()
				check(err)
				addID(rec.AccessKeyFile, id)
			}
			for i, s := range rec.Identities {
				id, err := age.ParseX25519Identity(s)
				check(err)
				addID(fmt.Sprintf("identities[%d]", i), id)
			}
			aid, err := agewrap.NewAccessIdentity(slots, all...)
			check(err)
			allRes := result(innerAge, aid)
			if allRes["plaintext_sha256"] != sum(mustHex(rec.ControlCBOR)) {
				log.Fatalf("%s: INNER_ACCESS_AGE does not seal control_cbor", name)
			}
			stranger, err := age.GenerateX25519Identity()
			check(err)
			sid, err := agewrap.NewAccessIdentity(slots, stranger)
			check(err)
			f["inner_access_age"] = obj{"hex": h(innerAge), "slots": slots, "identities": ids, "all_identities_result": allRes, "stranger_result": result(innerAge, sid), "control_cbor_sha256": sum(mustHex(rec.ControlCBOR))}
		}
		out = append(out, f)
	}
	if len(out) == 0 {
		log.Fatal("no fixtures: run it from datekeys-go")
	}
	write(filepath.Join(outDir, "age_fixtures.json"), obj{
		"description": "The PAYLOAD_AGE of every official capsule of testdata/fixtures of datekeys-dart, opened by Go with its payload_identity (agewrap.PayloadIdentity) and with a stranger, and the INNER_ACCESS_AGE of the time_and_key ones, which this program took from OUTER_TIME_AGE with the release of the fixture, opened with each credential of the fixture and with a stranger (agewrap.AccessIdentity). Results as in age.json. See tool/gen_age_vectors.go.",
		"generator":   "tool/gen_age_vectors.go, " + runtime.Version(),
		"fixtures":    out,
	})
}

func write(path string, doc obj) {
	var buf bytes.Buffer
	enc := json.NewEncoder(&buf)
	enc.SetEscapeHTML(false)
	enc.SetIndent("", " ")
	check(enc.Encode(doc))
	check(os.WriteFile(path, buf.Bytes(), 0o644))
	fmt.Printf("wrote %s, %d bytes\n", path, buf.Len())
}