<?php
declare(strict_types=1);
// PHP 8.1+. Transport-free paired scaffold. No provider API or SDK is presumed.
// Ports implement verification, current authority, atomicity and trust per README.
enum Op: string { case REGISTER='REGISTER'; case USE='USE'; case REVOKE='REVOKE'; case RETRACT='RETRACT'; }
final class Envelope { public function __construct(public readonly array $fields, public readonly string $signature) {} }
final class Outcome { public function __construct(public readonly Envelope $receipt, public readonly bool $fresh) {} }
interface Transaction {
  public function operation(): Op;
  public function cached(): ?Envelope;
  public function registerNewKey(): void;
  public function requireCurrentEntitlement(): void;
  public function revokeTarget(): void;
  public function retractRelationship(): void;
  public function signResult(): Envelope;
  public function commitOnce(Envelope $result): void;
  public function close(): void; // Roll back unless committed.
}
interface Ports {
  public function challenge(Op $op,string $rid,string $target,string $context): Envelope;
  public function verifyProviderAndApprove(Envelope $challenge): void;
  public function signProof(Envelope $challenge): Envelope;
  public function verifyResultAndApply(Envelope $result): void;
  public function beginVerified(Envelope $proof,string $trustedContext): Transaction;
  public function recoverRevoke(string $rid,string $target,string $trustedContext): Envelope;
}
final class TokenSide {
  public function __construct(private Ports $ports) {}
  public function respond(Envelope $q): Envelope {
    $this->ports->verifyProviderAndApprove($q); return $this->ports->signProof($q);
  }
  public function accept(Envelope $result): void { $this->ports->verifyResultAndApply($result); }
}
final class ProviderSide {
  public function __construct(private Ports $ports) {}
  public function start(Op $op,string $rid,string $target,string $context): Envelope {
    return $this->ports->challenge($op,$rid,$target,$context);
  }
  public function finish(Envelope $proof,string $trustedContext): Outcome {
    $tx=$this->ports->beginVerified($proof,$trustedContext);
    try {
      $old=$tx->cached(); if ($old !== null) return new Outcome($old,false);
      switch($tx->operation()) {
        case Op::REGISTER: $tx->registerNewKey(); break;
        case Op::USE: $tx->requireCurrentEntitlement(); break;
        case Op::REVOKE: $tx->revokeTarget(); break;
        case Op::RETRACT: $tx->retractRelationship(); break;
      }
      $result=$tx->signResult(); $tx->commitOnce($result); return new Outcome($result,true);
    } finally { $tx->close(); }
  }
  public function lost(string $rid,string $target,string $context): Envelope {
    return $this->ports->recoverRevoke($rid,$target,$context);
  }
}
function legacyValue(string $value,bool $approved,bool $selected): string {
  if (!$approved || !$selected || $value==='') throw new RuntimeException('Local approval/selection required');
  return $value; // No BringPass command sent to the reader.
}