Stealth addresses

/**
 * Extract view tag: first byte of the shared secret.
 */
export function extractViewTag(sharedSecret: Uint8Array): number {
  return sharedSecret[0];
}

/**
 * Full stealth address derivation from sender side.
 * Sender knows: K_spend (Ed25519), K_view (X25519)
 * Sender generates ephemeral X25519 keypair.
 */
export function deriveStealthAddress(
  spendPubkey: Uint8Array,
  viewPubkey: Uint8Array,
  ephemeralPrivateKey?: Uint8Array,
): StealthOutput {
  // Generate or use provided ephemeral X25519 keypair
  const ephPriv = ephemeralPrivateKey ?? x25519.utils.randomPrivateKey();
  const ephPub = x25519.getPublicKey(ephPriv);

  // ECDH shared secret
  const shared = ecdhSharedSecret(ephPriv, viewPubkey);

  // View tag
  const viewTag = extractViewTag(shared);

  // Stealth scalar
  const scalar = deriveStealthScalar(shared);

  // Stealth pubkey = K_spend + s*G
  const stealthPubkey = computeStealthPubkey(spendPubkey, scalar);

  // Sui address
  const stealthAddress = pubkeyToSuiAddress(stealthPubkey);

  return {
    ephemeralPubkey: ephPub,
    stealthAddress,
    viewTag,
    stealthPubkey,
  };
}

/**
 * Compute ECDH shared secret between an X25519 private key and public key.
 */
export function ecdhSharedSecret(
  privateKey: Uint8Array,
  publicKey: Uint8Array,
): Uint8Array {
  return x25519.getSharedSecret(privateKey, publicKey);
}

/**
 * Derive the stealth scalar from a shared secret.
 * s = SHA-256(shared || "identipay-stealth-v1")
 */
export function deriveStealthScalar(sharedSecret: Uint8Array): Uint8Array {
  return sha256(concatBytes(sharedSecret, DOMAIN_SEPARATOR));
}

/**
 * Compute stealth public key: K_stealth = K_spend + s*G
 * Uses Ed25519 point arithmetic.
 */
export function computeStealthPubkey(
  spendPubkey: Uint8Array,
  scalar: Uint8Array,
): Uint8Array {
  const sG = ed25519.ExtendedPoint.BASE.multiply(
    bytesToBigInt(scalar),
  );
  const kSpend = ed25519.ExtendedPoint.fromHex(spendPubkey);
  const kStealth = kSpend.add(sG);
  return kStealth.toRawBytes();
}

/// Emitted when a payment is sent to a stealth address.
/// Recipients scan these events to detect incoming payments.
public struct StealthAnnouncement has copy, drop {
    /// Ephemeral public key R = r*G (32 bytes).
    /// The recipient uses this with their viewing private key to derive
    /// the shared secret and detect if this payment is for them.
    ephemeral_pubkey: vector<u8>,
    /// First byte of the ECDH shared secret (fast 1-byte filter).
    /// Reduces full ECDH computations by ~256x during scanning.
    view_tag: u8,
    /// The derived one-time stealth address where the payment was sent.
    stealth_address: address,
    /// Optional encrypted memo (e.g., payment reason).
    metadata: vector<u8>,
}

/// Emit a stealth payment announcement. Called by anyone sending to
/// a stealth address (P2P payments, commerce settlements).
entry fun announce(
    ephemeral_pubkey: vector<u8>,
    view_tag: u8,
    stealth_address: address,
    metadata: vector<u8>,
    _ctx: &mut TxContext,
) {
    assert!(ephemeral_pubkey.length() == PUBKEY_LENGTH, EInvalidEphemeralPubkey);

    event::emit(StealthAnnouncement {
        ephemeral_pubkey,
        view_tag,
        stealth_address,
        metadata,
    });
}

/**
 * Receiver-side: check if an announcement is addressed to us.
 * Receiver knows: k_view (X25519 private), K_spend (Ed25519 public)
 */
export function scanAnnouncement(
  viewPrivateKey: Uint8Array,
  spendPubkey: Uint8Array,
  ephemeralPubkey: Uint8Array,
  announcedViewTag: number,
  announcedStealthAddress: string,
): boolean {
  const shared = ecdhSharedSecret(viewPrivateKey, ephemeralPubkey);
  const viewTag = extractViewTag(shared);

  // Fast filter: check view tag first (256x speedup)
  if (viewTag !== announcedViewTag) return false;

  // Full derivation to confirm
  const scalar = deriveStealthScalar(shared);
  const stealthPubkey = computeStealthPubkey(spendPubkey, scalar);
  const stealthAddress = pubkeyToSuiAddress(stealthPubkey);

  return stealthAddress === announcedStealthAddress;
}