import { readFileSync } from "node:fs";
const pfx = new Uint8Array(readFileSync("./mali-muhur.pfx"));
const signer = { pfx, password: process.env.PFX_PASS! };

import { sign } from "tr-esign/sign";
import { verify } from "tr-esign/verify";
import { upgrade } from "tr-esign/upgrade";

const signed = await sign({
  input: { xml: readFileSync("./invoice.xml", "utf8"), placement: "ubl-extension" },
  signer,
  policy: "P3",                         // TR profili → EPES
  productionPlace: { city: "İstanbul", country: "TR" },
  commitmentType: "proof-of-origin",
});
const r = await verify(signed);         // { valid, level, signer, … }
const t = await upgrade({ xml: signed, to: "T", tsa: { url: "http://tzd.kamusm.gov.tr" } });

import { cadesSign } from "tr-esign/cades-sign";
import { cadesVerify } from "tr-esign/cades-verify";

const data = readFileSync("./recete.bin");
const cms = await cadesSign({ data, signer, policy: "P3", contentIncluded: false });
const r = await cadesVerify(cms, { detachedContent: data });

import { padesSign } from "tr-esign/pades-sign";
import { padesVerify } from "tr-esign/pades-verify";
import { padesUpgrade } from "tr-esign/pades-upgrade";

const pdf = new Uint8Array(readFileSync("./fatura.pdf"));
const signed = await padesSign({ pdf, signer, reason: "Onay", policy: "P3" });
const lta = await padesUpgrade({ pdf: signed, to: "LTA", tsa: { url: "http://tzd.kamusm.gov.tr" } });
const r = await padesVerify(lta);

import { createAsic, readAsic } from "tr-esign/asic";

const data = readFileSync("./fatura.xml");
const sig  = await sign({ input: { xml: data.toString("utf8"), placement: "ubl-extension" }, signer });
const asic = createAsic({
  type: "asic-s",
  data: { name: "fatura.xml", bytes: new Uint8Array(data) },
  signature: { bytes: new TextEncoder().encode(sig), format: "xades" },
});
const { type, dataFiles, signatures } = readAsic(asic);

type VerifyResult =
  | { valid: true; level: "XMLDSig"|"BES"|"EPES"|"T"|"LT"|"LTA";
      signer: { subject, issuer, serialHex, notBefore, notAfter };
      signedAt?: Date;
      counterSignatures?: SignerInfo[];    // XAdES CounterSignature varsa
      allSignatures?: PerSignatureResult[]; // 2+ top-level (paralel) imza varsa
    }
  | { valid: false; reason: string; detail?: unknown };

type VerifyOptions = {
  // Detached imza veya external URI referanslar için.
  resolver?: (uri: string) => Uint8Array | Node | null | Promise<...>;
};

{ xml, to: "T",   tsa?: { url?, policyOid? } }
{ xml, to: "LT",  chain: Uint8Array[], crls?: Uint8Array[], ocsps?: Uint8Array[] }
{ xml, to: "LTA", tsa?: { url?, policyOid? } }

await counterSign({
  xml: signedXml,
  signer: { pfx, password },
  parentSignatureId: "Signature-Id-...",  // opsiyonel; yoksa ilk ds:Signature
  // aynı sign() opsiyonları: signingTime, productionPlace, commitmentType, ...
});

import { cadesSign } from "tr-esign/cades-sign";
import { cadesVerify } from "tr-esign/cades-verify";
import { cadesUpgrade } from "tr-esign/cades-upgrade";

const pfx = new Uint8Array(readFileSync("./mali-muhur.pfx"));
const data = readFileSync("./recete.bin");

// Attached (içerik imza içinde)
const bes = await cadesSign({
  data,
  signer: { pfx, password: process.env.PFX_PASS! },
  policy: "P3",                           // TR profili → EPES
  commitmentType: "proof-of-origin",
});

// Detached (içerik dışta; verify sırasında detachedContent verilir)
const detached = await cadesSign({
  data, signer: { pfx, password },
  contentIncluded: false,
});

// Doğrulama — attached kendi kendine; detached için harici veri verilir
const r = await cadesVerify(bes);
const rDet = await cadesVerify(detached, { detachedContent: data });

// Seviye yükseltme — T, LT, LTA zincirlenebilir.
const t   = await cadesUpgrade({ bytes: bes, to: "T", tsa: { url: "http://tzd.kamusm.gov.tr" } });
const lt  = await cadesUpgrade({ bytes: t,   to: "LT", chain: [leafDer, intDer, rootDer], ocsps, crls });
const lta = await cadesUpgrade({ bytes: lt,  to: "LTA", tsa: { url: "http://tzd.kamusm.gov.tr" } });

import { createAsic, readAsic } from "tr-esign/asic";
import { cadesSign } from "tr-esign/cades-sign";

const data = readFileSync("./recete.bin");
const sig = await cadesSign({ data, signer, contentIncluded: false });

// ASiC-S — tek veri + tek imza
const asicS = createAsic({
  type: "asic-s",
  data: { name: "recete.bin", bytes: data },
  signature: { bytes: sig, format: "cades" },
});
writeFileSync("./recete.asice", asicS);

// ASiC-E — çok dosya + (ops.) manifest
const asicE = createAsic({
  type: "asic-e",
  dataFiles: [
    { name: "fatura.xml", bytes: faturaXml },
    { name: "ek.pdf", bytes: ekPdf },
  ],
  signatures: [
    { bytes: xadesSig, format: "xades" },
  ],
});

// Okuma
const { type, dataFiles, signatures, manifests } = readAsic(asicS);

import { padesSign } from "tr-esign/pades-sign";
import { padesVerify } from "tr-esign/pades-verify";
import { padesUpgrade } from "tr-esign/pades-upgrade";

const pdf = readFileSync("./fatura.pdf");
const pfx = readFileSync("./mali-muhur.pfx");

// B-B / EPES (policy verildiğinde EPES)
const signed = await padesSign({
  pdf: new Uint8Array(pdf),
  signer: { pfx: new Uint8Array(pfx), password: process.env.PFX_PASS! },
  reason: "E-Fatura onayı",
  signerName: "Barış Y.",
  location: "Ankara",
  policy: "P3",                         // TR profili → EPES
  commitmentType: "proof-of-origin",
  signatureSize: 16384,                 // /Contents placeholder (default 16KB)
});

// Seviye yükseltme — B-T / B-LT / B-LTA zincirlenebilir
const bt  = await padesUpgrade({ pdf: signed, to: "T", tsa: { url: "http://tzd.kamusm.gov.tr" } });
const blt = await padesUpgrade({ pdf: bt,     to: "LT", chain: [leafDer, intDer, rootDer], ocsps, crls });
const lta = await padesUpgrade({ pdf: blt,    to: "LTA", tsa: { url: "http://tzd.kamusm.gov.tr" } });

// Doğrulama
const r = await padesVerify(lta);
// r.valid → boolean, r.level → 'BES'|'EPES'|'T'|'LT'|'LTA', r.signer.subject, ...

import { openPkcs11 } from "tr-esign/pkcs11";
import { sign } from "tr-esign/sign";

const handle = openPkcs11({
  modulePath: "/Library/OpenSC/lib/opensc-pkcs11.so", // AKIS / Kamu SM sürücüsü
  pin: process.env.CARD_PIN!,
});
try {
  const signed = await sign({
    input: { xml, placement: "ubl-extension" },
    signer: { pkcs11: handle, label: "Mali Mühür" },
    policy: "P3",
  });
} finally {
  handle.close();
}

import { mssSign, mssPoll } from "tr-esign/mss";

const r = await mssSign({
  serviceUrl: "https://mssp.turkcell.com.tr/MSS_Signature",
  apId: process.env.MSS_AP_ID!,
  apPwd: process.env.MSS_AP_PWD!,
  msisdn: "905551234567",
  dataToBeSigned: new TextEncoder().encode("Fatura onayı mesajı"),
  dataToBeDisplayed: "Faturanızı onaylıyor musunuz?",
  messagingMode: "asynchClientServer",
});
// Async mod: poll
const final = await mssPoll({ ...r, intervalMs: 3000, timeoutMs: 120_000 });
// final.signature → CMS/PKCS#7 DER (cadesVerify ile doğrulanabilir)

import { padesSign } from "tr-esign/pades-sign";

const signed = await padesSign({
  pdf, signer,
  signerName: "Barış Y.",
  visibleSignature: {
    page: 1,
    rect: [50, 50, 250, 110],        // [x1,y1,x2,y2] sayfa koordinatları
    text: "Barış Y.\n21 Nisan 2026\nOnaylandı",
    fontSize: 10,
  },
});

import { cadesSign } from "tr-esign/cades-sign";
import { cadesCounterSign } from "tr-esign/cades-counter-sign";
import { cadesVerify } from "tr-esign/cades-verify";

const bes = await cadesSign({ data, signer: signerA });
const cs = await cadesCounterSign({ cms: bes, signer: signerB });
const r = await cadesVerify(cs);
// r.counterSignatures[0].subject → ikinci imzacının sertifikası

import { createAsicAsync } from "tr-esign/asic";

const asic = await createAsicAsync({
  type: "asic-e",
  dataFiles: [
    { name: "fatura.xml", bytes },
    { name: "ek.pdf", bytes: pdfBytes },
  ],
  signatures: [{ bytes: xadesSig, format: "xades", manifest: "auto" }],
});