// Session-only activity store (PR C2.5). Honest: this is NOT persistent account history —
// it holds events created during the current browser session and is labelled as such in the UI.
// It never stores raw biometrics, full IBANs, capabilities, signatures or secrets.

export type ActivityKind = 'payment' | 'confirmation' | 'biometrics' | 'security-demo'

export interface ActivityEvent {
  id: string
  kind: ActivityKind
  title: string
  status: string
  ts: number
  amount?: string
  reference?: string
  reasonCodes?: string[]
  auditVerified?: boolean
  modelVersion?: string
}

let events: ActivityEvent[] = []
const subs = new Set<() => void>()

function rid(): string {
  return typeof crypto !== 'undefined' && 'randomUUID' in crypto
    ? crypto.randomUUID()
    : `ev-${Date.now()}-${Math.random().toString(16).slice(2)}`
}

export function addActivity(e: Omit<ActivityEvent, 'id' | 'ts'> & { ts?: number }): ActivityEvent {
  const ev: ActivityEvent = { id: rid(), ts: e.ts ?? Date.now(), ...e }
  events = [ev, ...events].slice(0, 100)
  subs.forEach((f) => f())
  return ev
}

export function listActivity(kind?: ActivityKind): ActivityEvent[] {
  const all = [...events].sort((a, b) => b.ts - a.ts)
  return kind ? all.filter((e) => e.kind === kind) : all
}

export function subscribeActivity(fn: () => void): () => void {
  subs.add(fn)
  return () => subs.delete(fn)
}

/** Test helper — reset the session store. */
export function _resetActivity(): void {
  events = []
  subs.forEach((f) => f())
}