import { Arbiter } from '../src/core/Arbiter.js';

function parseArgs(argv) {
  const args = new Map();
  for (let i = 2; i < argv.length; i++) {
    const value = argv[i];
    if (!value.startsWith('--')) continue;
    const [key, inline] = value.slice(2).split('=');
    if (inline !== undefined) {
      args.set(key, inline);
      continue;
    }
    const next = argv[i + 1];
    if (next && !next.startsWith('--')) {
      args.set(key, next);
      i++;
    } else {
      args.set(key, true);
    }
  }
  return args;
}

function createRng(seed) {
  if (seed === null || seed === undefined) {
    return Math.random;
  }
  let state = seed >>> 0;
  return () => {
    state = (1664525 * state + 1013904223) >>> 0;
    return state / 0x100000000;
  };
}

function buildZipfSampler(size, skew, rng) {
  const cumulative = new Array(size);
  let sum = 0;
  for (let i = 1; i <= size; i++) {
    sum += 1 / Math.pow(i, skew);
    cumulative[i - 1] = sum;
  }
  return () => {
    const target = rng() * sum;
    let low = 0;
    let high = cumulative.length - 1;
    while (low < high) {
      const mid = Math.floor((low + high) / 2);
      if (target <= cumulative[mid]) {
        high = mid;
      } else {
        low = mid + 1;
      }
    }
    return low;
  };
}

function pickRandom(items, rng) {
  const index = Math.floor(rng() * items.length);
  return items[index];
}

function addToMapSet(map, key, value) {
  if (!map.has(key)) {
    map.set(key, new Set());
  }
  map.get(key).add(value);
}

function basicSimilarity(key1, key2) {
  if (key1 === key2) return 1.0;
  const type1 = key1.split(':')[0];
  const type2 = key2.split(':')[0];
  if (type1 === type2) {
    const id1 = key1.split(':')[1] || '';
    const id2 = key2.split(':')[1] || '';
    const num1 = parseInt(id1, 10);
    const num2 = parseInt(id2, 10);
    if (!isNaN(num1) && !isNaN(num2)) {
      const diff = Math.abs(num1 - num2);
      if (diff === 0) return 1.0;
      if (diff <= 5) return 0.8;
      if (diff <= 20) return 0.6;
      if (diff <= 100) return 0.4;
      return 0.2;
    }
    const maxLen = Math.max(id1.length, id2.length);
    const minLen = Math.min(id1.length, id2.length);
    let matches = 0;
    for (let i = 0; i < minLen; i++) {
      if (id1[i] === id2[i]) matches++;
    }
    return 0.5 + (maxLen > 0 ? (matches / maxLen) * 0.3 : 0);
  }
  return 0.1;
}

function convertToQualitative(value, scale) {
  let closestValue = scale[0];
  let minDistance = Math.abs(value - scale[0]);
  for (const scaleValue of scale) {
    const distance = Math.abs(value - scaleValue);
    if (distance < minDistance) {
      minDistance = distance;
      closestValue = scaleValue;
    }
  }
  return closestValue;
}

function estimateHitRate(frequencies, cacheSize) {
  if (!frequencies.size || cacheSize <= 0) return 0;
  const counts = Array.from(frequencies.values()).sort((a, b) => b - a);
  let total = 0;
  for (const count of counts) total += count;
  let top = 0;
  for (let i = 0; i < Math.min(cacheSize, counts.length); i++) {
    top += counts[i];
  }
  return top / total;
}

function percentile(sortedValues, percentileValue) {
  if (sortedValues.length === 0) return 0;
  const idx = Math.min(
    sortedValues.length - 1,
    Math.max(0, Math.ceil((percentileValue / 100) * sortedValues.length) - 1)
  );
  return sortedValues[idx];
}

function buildGraph({
  users,
  groups,
  resources,
  memberPerUser,
  accessPerGroup,
  viewerPerUser,
  ownerPerUser,
  blockedPerUser,
  riskPerUser,
  linkPerUser,
  linkPerResource,
  linkReversePerResource,
  riskLimitBase,
  riskLimitVariance,
  trustPerUser,
  trustRequirementBase,
  trustRequirementVariance,
  rng
}) {
  const arbiter = new Arbiter();
  const userIds = [];
  const groupIds = [];
  const resourceIds = [];

  for (let i = 0; i < users; i++) {
    userIds.push(arbiter.addNode(`user:${i}`, 'user'));
  }
  for (let i = 0; i < groups; i++) {
    groupIds.push(arbiter.addNode(`group:${i}`, 'group'));
  }
  for (let i = 0; i < resources; i++) {
    resourceIds.push(arbiter.addNode(`resource:${i}`, 'resource'));
  }

  const viewerSet = new Set();
  const ownerSet = new Set();
  const blockedSet = new Set();
  const memberKeySet = new Set();
  const groupAccessKeySet = new Set();
  const riskScoreMap = new Map();
  const linkKeySet = new Set();
  const resourceAccessKeySet = new Set();

  const memberMap = new Map();
  const groupAccessMap = new Map();
  const viewerByResource = new Map();
  const viewerByUser = new Map();
  const linkAdjacency = new Map();
  const linkReverseAdjacency = new Map();
  const resourceAccessMap = new Map();

  const getKey = (nodeId) => arbiter.keyByNodeId.get(nodeId);
  const addDirectEdge = (relation, srcId, dstId, keySet, value) => {
    const key = arbiter.keyManager.createCompositeKey(srcId, relation, dstId);
    if (keySet.has(key)) return false;
    keySet.add(key);
    const srcKey = getKey(srcId);
    const dstKey = getKey(dstId);
    if (value !== undefined) {
      arbiter.addRelation(srcKey, relation, dstKey, 1.0, { value });
      riskScoreMap.set(key, value);
    } else if (relation === 'member') {
      arbiter.addRelation(srcKey, relation, dstKey, 1.0);
    } else if (relation === 'group_access') {
      arbiter.addRelation(srcKey, relation, dstKey, 1.0);
      arbiter.addRelation(dstKey, 'resource_access', srcKey, 1.0);
      addToMapSet(resourceAccessMap, dstId, srcId);
      resourceAccessKeySet.add(
        arbiter.keyManager.createCompositeKey(dstId, 'resource_access', srcId)
      );
    } else {
      arbiter.addRelation(srcKey, relation, dstKey, 1.0);
    }
    return true;
  };

  const addLinkEdge = (srcId, dstId) => {
    const srcKey = getKey(srcId);
    const dstKey = getKey(dstId);
    const key = arbiter.keyManager.createCompositeKey(srcId, 'link', dstId);
    arbiter.addRelation(srcKey, 'link', dstKey, 1.0);
    linkKeySet.add(key);
    addToMapSet(linkAdjacency, srcId, dstId);
    addToMapSet(linkReverseAdjacency, dstId, srcId);
    return key;
  };

  for (const userId of userIds) {
    const membershipCount = Math.max(1, Math.round(memberPerUser));
    for (let i = 0; i < membershipCount; i++) {
      const groupId = pickRandom(groupIds, rng);
      const key = arbiter.keyManager.createCompositeKey(userId, 'member', groupId);
      if (memberKeySet.has(key)) continue;
      memberKeySet.add(key);
      arbiter.addRelation(getKey(userId), 'member', getKey(groupId), 1.0);
      addToMapSet(memberMap, userId, groupId);
    }
  }

  for (const groupId of groupIds) {
    const accessCount = Math.max(1, Math.round(accessPerGroup));
    for (let i = 0; i < accessCount; i++) {
      const resourceId = pickRandom(resourceIds, rng);
      const key = arbiter.keyManager.createCompositeKey(groupId, 'group_access', resourceId);
      if (groupAccessKeySet.has(key)) continue;
      groupAccessKeySet.add(key);
      arbiter.addRelation(getKey(groupId), 'group_access', getKey(resourceId), 1.0);
      arbiter.addRelation(getKey(resourceId), 'resource_access', getKey(groupId), 1.0);
      resourceAccessKeySet.add(
        arbiter.keyManager.createCompositeKey(resourceId, 'resource_access', groupId)
      );
      addToMapSet(resourceAccessMap, resourceId, groupId);
      addToMapSet(groupAccessMap, groupId, resourceId);
    }
  }

  const addRandomUserResourceEdges = (relation, count, keySet) => {
    let added = 0;
    const maxAttempts = count * 3;
    for (let attempt = 0; attempt < maxAttempts && added < count; attempt++) {
      const userId = pickRandom(userIds, rng);
      const resourceId = pickRandom(resourceIds, rng);
      if (addDirectEdge(relation, userId, resourceId, keySet)) {
        added++;
      }
    }
  };

  addRandomUserResourceEdges('viewer', Math.round(users * viewerPerUser), viewerSet);
  addRandomUserResourceEdges('owner', Math.round(users * ownerPerUser), ownerSet);
  addRandomUserResourceEdges('blocked', Math.round(users * blockedPerUser), blockedSet);

  for (const key of viewerSet) {
    const [userId, , resourceId] = JSON.parse(key);
    addToMapSet(viewerByResource, resourceId, userId);
    addToMapSet(viewerByUser, userId, resourceId);
  }

  const riskCount = Math.round(users * riskPerUser);
  let riskAdded = 0;
  const riskAttempts = riskCount * 3;
  for (let attempt = 0; attempt < riskAttempts && riskAdded < riskCount; attempt++) {
    const userId = pickRandom(userIds, rng);
    const resourceId = pickRandom(resourceIds, rng);
    const key = arbiter.keyManager.createCompositeKey(userId, 'risk_score', resourceId);
    if (riskScoreMap.has(key)) continue;
    const value = rng() * 100;
    arbiter.addRelation(getKey(userId), 'risk_score', getKey(resourceId), 1.0, { value });
    riskScoreMap.set(key, value);
    riskAdded++;
  }

  const riskLimitMap = new Map();
  for (const resourceId of resourceIds) {
    const limit = riskLimitBase + rng() * riskLimitVariance;
    const resourceKey = getKey(resourceId);
    const key = arbiter.keyManager.createCompositeKey(resourceId, 'risk_limit', resourceId);
    arbiter.addRelation(resourceKey, 'risk_limit', resourceKey, 1.0, { value: limit });
    riskLimitMap.set(key, limit);
  }

  const trustLevelMap = new Map();
  const trustRequirementMap = new Map();
  const trustCount = Math.max(1, Math.round(users * trustPerUser));
  let trustAdded = 0;
  const trustAttempts = trustCount * 3;
  for (let attempt = 0; attempt < trustAttempts && trustAdded < trustCount; attempt++) {
    const userId = pickRandom(userIds, rng);
    const resourceId = pickRandom(resourceIds, rng);
    const value = rng();
    const key = arbiter.keyManager.createCompositeKey(userId, 'trust_level', resourceId);
    if (trustLevelMap.has(key)) continue;
    arbiter.addRelation(getKey(userId), 'trust_level', getKey(resourceId), 1.0, { value });
    trustLevelMap.set(key, value);
    trustAdded++;
  }
  for (const resourceId of resourceIds) {
    const value = trustRequirementBase + rng() * trustRequirementVariance;
    const resourceKey = getKey(resourceId);
    const key = arbiter.keyManager.createCompositeKey(resourceId, 'trust_requirement', resourceId);
    arbiter.addRelation(resourceKey, 'trust_requirement', resourceKey, 1.0, { value });
    trustRequirementMap.set(key, value);
  }

  const linkEdgesCount = Math.max(1, Math.round(users * linkPerUser));
  for (let i = 0; i < linkEdgesCount; i++) {
    const userId = pickRandom(userIds, rng);
    const resourceId = pickRandom(resourceIds, rng);
    addLinkEdge(userId, resourceId);
  }
  const resourceLinksCount = Math.max(1, Math.round(resources * linkPerResource));
  for (let i = 0; i < resourceLinksCount; i++) {
    const srcResource = pickRandom(resourceIds, rng);
    const dstResource = pickRandom(resourceIds, rng);
    if (srcResource !== dstResource) {
      addLinkEdge(srcResource, dstResource);
    }
  }
  const reverseLinksCount = Math.max(1, Math.round(resources * linkReversePerResource));
  for (let i = 0; i < reverseLinksCount; i++) {
    const srcResource = pickRandom(resourceIds, rng);
    const dstUser = pickRandom(userIds, rng);
    addLinkEdge(srcResource, dstUser);
  }

  for (const userId of userIds) {
    const node = arbiter.nodes.get(userId);
    if (node) {
      node.embedding = arbiter.jsonhash.generateSketch({ type: 'user', id: userId });
      node.stale = false;
    }
  }
  for (const resourceId of resourceIds) {
    const node = arbiter.nodes.get(resourceId);
    if (node) {
      node.embedding = arbiter.jsonhash.generateSketch({ type: 'resource', id: resourceId });
      node.stale = false;
    }
  }
  if (arbiter.embeddingManager) {
    arbiter.embeddingManager.clearPendingStaleNodes();
  }
  arbiter.embeddingManager = null;

  const relationPools = {
    direct: [
      { name: 'viewer', srcType: 'user', dstType: 'resource', srcPool: userIds, dstPool: resourceIds, keySet: viewerSet },
      { name: 'owner', srcType: 'user', dstType: 'resource', srcPool: userIds, dstPool: resourceIds, keySet: ownerSet },
      { name: 'blocked', srcType: 'user', dstType: 'resource', srcPool: userIds, dstPool: resourceIds, keySet: blockedSet },
      { name: 'member', srcType: 'user', dstType: 'group', srcPool: userIds, dstPool: groupIds, keySet: memberKeySet },
      { name: 'group_access', srcType: 'group', dstType: 'resource', srcPool: groupIds, dstPool: resourceIds, keySet: groupAccessKeySet },
      { name: 'link', srcType: 'user', dstType: 'resource', srcPool: userIds, dstPool: resourceIds, keySet: linkKeySet },
      { name: 'link', srcType: 'resource', dstType: 'resource', srcPool: resourceIds, dstPool: resourceIds, keySet: linkKeySet },
      { name: 'link', srcType: 'resource', dstType: 'user', srcPool: resourceIds, dstPool: userIds, keySet: linkKeySet },
      { name: 'resource_access', srcType: 'resource', dstType: 'group', srcPool: resourceIds, dstPool: groupIds, keySet: resourceAccessKeySet }
    ],
    value: [
      { name: 'risk_score', srcType: 'user', dstType: 'resource', srcPool: userIds, dstPool: resourceIds, keyMap: riskScoreMap },
      { name: 'risk_limit', srcType: 'resource', dstType: 'resource', srcPool: resourceIds, dstPool: resourceIds, keyMap: riskLimitMap },
      { name: 'trust_level', srcType: 'user', dstType: 'resource', srcPool: userIds, dstPool: resourceIds, keyMap: trustLevelMap },
      { name: 'trust_requirement', srcType: 'resource', dstType: 'resource', srcPool: resourceIds, dstPool: resourceIds, keyMap: trustRequirementMap }
    ]
  };

  return {
    arbiter,
    userIds,
    groupIds,
    resourceIds,
    relationPools,
    groundTruth: {
      viewerSet,
      ownerSet,
      blockedSet,
      memberMap,
      groupAccessMap,
      viewerByResource,
      viewerByUser,
      riskScoreMap,
      riskLimitMap,
      trustLevelMap,
      trustRequirementMap,
      linkAdjacency,
      linkReverseAdjacency,
      resourceAccessMap
    }
  };
}

function runQueries({
  arbiter,
  total,
  valueRatio,
  samplers,
  rng,
  recordFrequency,
  frequencies,
  relationPools,
  validation
}) {
  const relationManager = arbiter.relationManager;
  const latencies = [];
  let mismatches = 0;
  let falsePositives = 0;
  let falseNegatives = 0;
  for (let i = 0; i < total; i++) {
    const start = process.hrtime.bigint();
    const useValue = relationPools.value.length > 0 && rng() < valueRatio;
    const relationDef = useValue ? pickRandom(relationPools.value, rng) : pickRandom(relationPools.direct, rng);
    const srcSampler = samplers[relationDef.srcType];
    const dstSampler = samplers[relationDef.dstType];
    const srcId = relationDef.srcPool[srcSampler()];
    const dstId = relationDef.dstPool[dstSampler()];
    const relation = relationDef.name;
    const cacheKey = useValue
      ? relationManager._makeValueCacheKey(srcId, relation, dstId)
      : relationManager._makeDirectCacheKey(srcId, relation, dstId);

    if (recordFrequency) {
      const current = frequencies.get(cacheKey) || 0;
      frequencies.set(cacheKey, current + 1);
    }

    if (useValue) {
      const result = relationManager.getValueRelation(srcId, relation, dstId);
      if (validation) {
        const expected = relationDef.keyMap.has(cacheKey);
        if (expected && !result) {
          mismatches++;
          falseNegatives++;
        } else if (!expected && result) {
          mismatches++;
          falsePositives++;
        }
      }
    } else {
      const result = relationManager.getDirectRelation(srcId, relation, dstId);
      if (validation) {
        const expected = relationDef.keySet.has(cacheKey);
        if (expected && !result) {
          mismatches++;
          falseNegatives++;
        } else if (!expected && result) {
          mismatches++;
          falsePositives++;
        }
      }
    }
    const durationMs = Number(process.hrtime.bigint() - start) / 1e6;
    latencies.push(durationMs);
  }
  return { mismatches, falsePositives, falseNegatives, latencies };
}

function runAuthEval({
  arbiter,
  total,
  samplers,
  rng,
  groundTruth,
  userIds,
  resourceIds,
  debugLimit
}) {
  let tp = 0;
  let tn = 0;
  let fp = 0;
  let fn = 0;
  let predictedTrue = 0;
  let predictedFalse = 0;
  const latencies = [];
  const debugFailures = [];
  const debugFalsePositives = [];
  const perRuleStats = new Map();
  const authRelations = [
    { name: 'can_view', weight: 0.12 },
    { name: 'can_edit', weight: 0.06 },
    { name: 'can_view_ttu', weight: 0.1 },
    { name: 'can_view_ttu_reverse', weight: 0.08 },
    { name: 'can_reach', weight: 0.08 },
    { name: 'can_reach_reverse', weight: 0.08 },
    { name: 'similar_view', weight: 0.08 },
    { name: 'similar_view_reverse', weight: 0.08 },
    { name: 'risk_ok', weight: 0.06 },
    { name: 'trust_ok_qual', weight: 0.06 },
    { name: 'can_view_defeasible', weight: 0.08 },
    { name: 'can_view_mixed', weight: 0.06 },
    { name: 'viewer', weight: 0.03 },
    { name: 'owner', weight: 0.03 }
  ];
  const weightSum = authRelations.reduce((sum, item) => sum + item.weight, 0);
  const pickAuthRelation = () => {
    let roll = rng() * weightSum;
    for (const relation of authRelations) {
      if (roll <= relation.weight) return relation.name;
      roll -= relation.weight;
    }
    return authRelations[authRelations.length - 1].name;
  };
  const isBlocked = (userId, resourceId) =>
    groundTruth.blockedSet.has(arbiter.keyManager.createCompositeKey(userId, 'blocked', resourceId));
  const hasDirect = (relation, userId, resourceId) =>
    groundTruth[`${relation}Set`].has(arbiter.keyManager.createCompositeKey(userId, relation, resourceId));
  const ttuExpected = (userId, resourceId) => {
    const groups = groundTruth.memberMap.get(userId);
    if (!groups) return false;
    for (const groupId of groups) {
      const resources = groundTruth.groupAccessMap.get(groupId);
      if (resources && resources.has(resourceId)) {
        return true;
      }
    }
    return false;
  };
  const canViewExpected = (userId, resourceId) => {
    if (isBlocked(userId, resourceId)) return false;
    if (hasDirect('viewer', userId, resourceId) || hasDirect('owner', userId, resourceId)) {
      return true;
    }
    return ttuExpected(userId, resourceId);
  };
  const canReachCache = new Map();
  const canReachReverseCache = new Map();
  const canReachExpected = (userId, resourceId) => {
    if (!groundTruth.linkAdjacency) return false;
    if (!canReachCache.has(userId)) {
      const reachable = new Set();
      const queue = [{ id: userId, depth: 0 }];
      const visited = new Set([userId]);
      while (queue.length > 0) {
        const { id, depth } = queue.shift();
        if (depth >= 3) continue;
        const next = groundTruth.linkAdjacency.get(id);
        if (!next) continue;
        for (const neighbor of next) {
          if (!visited.has(neighbor)) {
            visited.add(neighbor);
            reachable.add(neighbor);
            queue.push({ id: neighbor, depth: depth + 1 });
          }
        }
      }
      canReachCache.set(userId, reachable);
    }
    return canReachCache.get(userId).has(resourceId);
  };
  const canReachReverseExpected = (userId, resourceId) => {
    if (!groundTruth.linkReverseAdjacency) return false;
    if (!canReachReverseCache.has(userId)) {
      const reachable = new Set();
      const queue = [{ id: userId, depth: 0 }];
      const visited = new Set([userId]);
      while (queue.length > 0) {
        const { id, depth } = queue.shift();
        if (depth >= 3) continue;
        const next = groundTruth.linkReverseAdjacency.get(id);
        if (!next) continue;
        for (const neighbor of next) {
          if (!visited.has(neighbor)) {
            visited.add(neighbor);
            reachable.add(neighbor);
            queue.push({ id: neighbor, depth: depth + 1 });
          }
        }
      }
      canReachReverseCache.set(userId, reachable);
    }
    return canReachReverseCache.get(userId).has(resourceId);
  };
  const similarityThreshold = 0.6;
  const similarViewExpected = (userId, resourceId) => {
    const viewers = groundTruth.viewerByResource.get(resourceId);
    if (!viewers) return false;
    const userKey = arbiter.keyByNodeId.get(userId);
    const userNode = arbiter.nodes.get(userId);
    for (const viewerId of viewers) {
      const viewerKey = arbiter.keyByNodeId.get(viewerId);
      const viewerNode = arbiter.nodes.get(viewerId);
      if (userNode?.embedding && viewerNode?.embedding) {
        if (arbiter.jsonhash.compareSketches(userNode.embedding, viewerNode.embedding) >= similarityThreshold) {
          return true;
        }
      } else if (basicSimilarity(userKey, viewerKey) >= similarityThreshold) {
        return true;
      }
    }
    return false;
  };
  const similarViewReverseExpected = (userId, resourceId) => {
    const resources = groundTruth.viewerByUser.get(userId);
    if (!resources) return false;
    const resourceKey = arbiter.keyByNodeId.get(resourceId);
    const resourceNode = arbiter.nodes.get(resourceId);
    for (const viewedResourceId of resources) {
      const viewedKey = arbiter.keyByNodeId.get(viewedResourceId);
      const viewedNode = arbiter.nodes.get(viewedResourceId);
      if (resourceNode?.embedding && viewedNode?.embedding) {
        if (arbiter.jsonhash.compareSketches(resourceNode.embedding, viewedNode.embedding) >= similarityThreshold) {
          return true;
        }
      } else if (basicSimilarity(resourceKey, viewedKey) >= similarityThreshold) {
        return true;
      }
    }
    return false;
  };
  const riskOkExpected = (userId, resourceId) => {
    const riskRel = arbiter.relationManager.getDirectRelation(userId, 'risk_score', resourceId);
    const limitRel = arbiter.relationManager.getDirectRelation(resourceId, 'risk_limit', resourceId);
    if (!riskRel || !limitRel) {
      return false;
    }
    const riskValue = arbiter.valueManager.getBlurredValue(riskRel);
    const limitValue = arbiter.valueManager.getBlurredValue(limitRel);
    if (!riskValue || !limitValue || !riskValue.interval || !limitValue.interval) {
      return false;
    }
    const possibility = arbiter.valueManager.compareIntervals(
      riskValue.interval,
      limitValue.interval,
      '<='
    );
    return possibility > 0;
  };
  const trustScale = [0, 0.25, 0.5, 0.75, 1];
  const trustOkQualExpected = (userId, resourceId) => {
    const trustLevel = groundTruth.trustLevelMap.get(
      arbiter.keyManager.createCompositeKey(userId, 'trust_level', resourceId)
    );
    const trustRequirement = groundTruth.trustRequirementMap.get(
      arbiter.keyManager.createCompositeKey(resourceId, 'trust_requirement', resourceId)
    );
    if (trustLevel === undefined || trustRequirement === undefined) return false;
    const left = convertToQualitative(trustLevel, trustScale);
    const right = convertToQualitative(trustRequirement, trustScale);
    return left >= right;
  };
  const canViewDefeasibleExpected = (userId, resourceId) => {
    if (!riskOkExpected(userId, resourceId)) return false;
    if (isBlocked(userId, resourceId)) return false;
    return hasDirect('viewer', userId, resourceId) ||
      hasDirect('owner', userId, resourceId) ||
      ttuExpected(userId, resourceId);
  };
  const ttuReverseExpected = (userId, resourceId) => {
    const groups = groundTruth.memberMap.get(userId);
    if (!groups) return false;
    const resourceGroups = groundTruth.resourceAccessMap.get(resourceId);
    if (!resourceGroups) return false;
    for (const groupId of groups) {
      if (resourceGroups.has(groupId)) {
        return true;
      }
    }
    return false;
  };
  const canViewMixedExpected = (userId, resourceId) =>
    canViewExpected(userId, resourceId) ||
    canReachReverseExpected(userId, resourceId) ||
    similarViewReverseExpected(userId, resourceId) ||
    trustOkQualExpected(userId, resourceId);
  const pickFromArray = (arr) => arr[Math.floor(rng() * arr.length)];
  const viewerPairs = Array.from(groundTruth.viewerSet, key => {
    const [userId, , resourceId] = JSON.parse(key);
    return { userId, resourceId };
  });
  const ownerPairs = Array.from(groundTruth.ownerSet, key => {
    const [userId, , resourceId] = JSON.parse(key);
    return { userId, resourceId };
  });
  const ttuPairs = [];
  const groupMembers = new Map();
  for (const [userId, groups] of groundTruth.memberMap.entries()) {
    for (const groupId of groups) {
      addToMapSet(groupMembers, groupId, userId);
      const resources = groundTruth.groupAccessMap.get(groupId);
      if (!resources) continue;
      for (const resourceId of resources) {
        ttuPairs.push({ userId, resourceId });
      }
    }
  }
  const ttuReversePairs = [];
  for (const [resourceId, groups] of groundTruth.resourceAccessMap.entries()) {
    for (const groupId of groups) {
      const members = groupMembers.get(groupId);
      if (!members) continue;
      for (const userId of members) {
        ttuReversePairs.push({ userId, resourceId });
      }
    }
  }
  const buildReachPairs = (adjacency, sourceIds) => {
    const pairs = [];
    for (const sourceId of sourceIds) {
      const reachable = new Set();
      const queue = [{ id: sourceId, depth: 0 }];
      const visited = new Set([sourceId]);
      while (queue.length > 0) {
        const { id, depth } = queue.shift();
        if (depth >= 3) continue;
        const next = adjacency.get(id);
        if (!next) continue;
        for (const neighbor of next) {
          if (!visited.has(neighbor)) {
            visited.add(neighbor);
            reachable.add(neighbor);
            queue.push({ id: neighbor, depth: depth + 1 });
          }
        }
      }
      let added = 0;
      for (const targetId of reachable) {
        pairs.push({ userId: sourceId, resourceId: targetId });
        added++;
        if (added >= 50) break;
      }
    }
    return pairs;
  };
  const canReachPairs = buildReachPairs(groundTruth.linkAdjacency, userIds);
  const userIdSet = new Set(userIds);
  const resourceIdSet = new Set(resourceIds);
  const canReachReversePairs = buildReachPairs(groundTruth.linkReverseAdjacency, userIds)
    .filter(pair => resourceIdSet.has(pair.resourceId));
  const similarViewReversePairs = [];
  for (const [userId, resources] of groundTruth.viewerByUser.entries()) {
    for (const resourceId of resources) {
      similarViewReversePairs.push({ userId, resourceId });
    }
  }
  const riskOkPairs = [];
  for (const key of groundTruth.riskScoreMap.keys()) {
    const [userId, , resourceId] = JSON.parse(key);
    if (riskOkExpected(userId, resourceId)) {
      riskOkPairs.push({ userId, resourceId });
    }
  }
  const trustOkPairs = [];
  for (const key of groundTruth.trustLevelMap.keys()) {
    const [userId, , resourceId] = JSON.parse(key);
    if (trustOkQualExpected(userId, resourceId)) {
      trustOkPairs.push({ userId, resourceId });
    }
  }
  const canViewDefeasiblePairs = ttuPairs.filter(pair => canViewDefeasibleExpected(pair.userId, pair.resourceId));
  const canViewPairs = [...viewerPairs, ...ownerPairs, ...ttuPairs];
  const canViewMixedPairs = [
    ...canViewPairs,
    ...canReachReversePairs,
    ...similarViewReversePairs,
    ...trustOkPairs
  ].filter(pair => canViewMixedExpected(pair.userId, pair.resourceId));
  const expectedForRelation = (relation, userId, resourceId) => {
    if (relation === 'viewer' || relation === 'owner') {
      return hasDirect(relation, userId, resourceId);
    }
    if (relation === 'can_view') {
      return canViewExpected(userId, resourceId);
    }
    if (relation === 'can_edit') {
      return hasDirect('owner', userId, resourceId) && canViewExpected(userId, resourceId);
    }
    if (relation === 'can_view_ttu') {
      return ttuExpected(userId, resourceId);
    }
    if (relation === 'can_view_ttu_reverse') {
      return ttuReverseExpected(userId, resourceId);
    }
    if (relation === 'can_reach') {
      return canReachExpected(userId, resourceId);
    }
    if (relation === 'can_reach_reverse') {
      return canReachReverseExpected(userId, resourceId);
    }
    if (relation === 'similar_view') {
      return similarViewExpected(userId, resourceId);
    }
    if (relation === 'similar_view_reverse') {
      return similarViewReverseExpected(userId, resourceId);
    }
    if (relation === 'risk_ok') {
      return riskOkExpected(userId, resourceId);
    }
    if (relation === 'trust_ok_qual') {
      return trustOkQualExpected(userId, resourceId);
    }
    if (relation === 'can_view_defeasible') {
      return canViewDefeasibleExpected(userId, resourceId);
    }
    if (relation === 'can_view_mixed') {
      return canViewMixedExpected(userId, resourceId);
    }
    return false;
  };
  const positiveSampleRate = 0.45;
  const maxSampleAttempts = 40;
  const pickPairForRelation = (relation) => {
    const positivePools = {
      viewer: viewerPairs,
      owner: ownerPairs,
      can_view: canViewPairs,
      can_edit: canViewPairs,
      can_view_ttu: ttuPairs,
      can_view_ttu_reverse: ttuReversePairs,
      can_reach: canReachPairs,
      can_reach_reverse: canReachReversePairs,
      similar_view: viewerPairs,
      similar_view_reverse: similarViewReversePairs,
      risk_ok: riskOkPairs,
      trust_ok_qual: trustOkPairs,
      can_view_defeasible: canViewDefeasiblePairs,
      can_view_mixed: canViewMixedPairs
    };
    const pool = positivePools[relation] || [];
    const forcePositive = new Set([
      'can_view_ttu_reverse',
      'can_reach_reverse',
      'similar_view_reverse',
      'trust_ok_qual'
    ]);
    if (pool.length > 0 && (forcePositive.has(relation) || rng() < positiveSampleRate)) {
      return pickFromArray(pool);
    }
    if (rng() < positiveSampleRate) {
      const attempts = relation.endsWith('_reverse') ? maxSampleAttempts * 2 : maxSampleAttempts;
      for (let attempt = 0; attempt < attempts; attempt++) {
        const candidateUser = userIds[samplers.user()];
        const candidateResource = resourceIds[samplers.resource()];
        if (expectedForRelation(relation, candidateUser, candidateResource)) {
          return { userId: candidateUser, resourceId: candidateResource };
        }
      }
    }
    return {
      userId: userIds[samplers.user()],
      resourceId: resourceIds[samplers.resource()]
    };
  };
  for (let i = 0; i < total; i++) {
    const relation = pickAuthRelation();
    const sampled = pickPairForRelation(relation);
    const userId = sampled.userId;
    const resourceId = sampled.resourceId;
    const expected = expectedForRelation(relation, userId, resourceId);
    const start = process.hrtime.bigint();
    const result = arbiter.check(
      arbiter.keyByNodeId.get(userId),
      relation,
      arbiter.keyByNodeId.get(resourceId)
    );
    const durationMs = Number(process.hrtime.bigint() - start) / 1e6;
    latencies.push(durationMs);
    const predicted = result && result.possibility > 0;
    if (predicted) {
      predictedTrue++;
    } else {
      predictedFalse++;
    }
    if (expected && predicted) {
      tp++;
    } else if (!expected && !predicted) {
      tn++;
    } else if (!expected && predicted) {
      fp++;
      if (debugFalsePositives.length < debugLimit) {
        let riskDetails = null;
        if (relation === 'risk_ok') {
          const riskRel = arbiter.relationManager.getDirectRelation(userId, 'risk_score', resourceId);
          const limitRel = arbiter.relationManager.getDirectRelation(resourceId, 'risk_limit', resourceId);
          const riskValue = riskRel ? arbiter.valueManager.getBlurredValue(riskRel) : null;
          const limitValue = limitRel ? arbiter.valueManager.getBlurredValue(limitRel) : null;
          const comparison = riskValue && limitValue && riskValue.interval && limitValue.interval
            ? arbiter.valueManager.compareIntervals(riskValue.interval, limitValue.interval, '<=')
            : null;
          riskDetails = {
            riskRelationExists: !!riskRel,
            riskValue: riskRel ? riskRel.value : null,
            riskInterval: riskValue ? riskValue.interval : null,
            limitRelationExists: !!limitRel,
            limitValue: limitRel ? limitRel.value : null,
            limitInterval: limitValue ? limitValue.interval : null,
            comparison
          };
        }
        debugFalsePositives.push({
          relation,
          userId,
          resourceId,
          predictedPossibility: result ? result.possibility : 0,
          predictedReason: result ? result.reason : null,
          predictedMeta: result ? result.meta : null,
          riskDetails
        });
      }
    } else if (expected && !predicted) {
      fn++;
      if (debugFailures.length < debugLimit) {
        const viewerKey = arbiter.keyManager.createCompositeKey(userId, 'viewer', resourceId);
        const ownerKey = arbiter.keyManager.createCompositeKey(userId, 'owner', resourceId);
        const blockedKey = arbiter.keyManager.createCompositeKey(userId, 'blocked', resourceId);
        const viewerDirect = groundTruth.viewerSet.has(viewerKey);
        const ownerDirect = groundTruth.ownerSet.has(ownerKey);
        const blocked = groundTruth.blockedSet.has(blockedKey);
        const memberGroups = groundTruth.memberMap.get(userId) || new Set();
        const accessGroups = [];
        for (const groupId of memberGroups) {
          const resources = groundTruth.groupAccessMap.get(groupId);
          if (resources && resources.has(resourceId)) {
            accessGroups.push(groupId);
          }
        }
        const userKey = arbiter.keyByNodeId.get(userId);
        const resourceKey = arbiter.keyByNodeId.get(resourceId);
        const bypassResult = arbiter.authChecker.check(userKey, relation, resourceKey, { bypassPLTC: true });
        const memberRelations = arbiter.relationManager.getRelationsFromSrc(userId, 'member');
        const groupAccessHasResource = accessGroups.length > 0
          ? arbiter.relationManager.getRelationsFromSrc(accessGroups[0], 'group_access').some(rel => rel.dst === resourceId)
          : false;
        const chainRule = {
          type: 'chain',
          steps: [
            { relation: 'member', direction: 'out' },
            { relation: 'group_access', direction: 'out' }
          ]
        };
        const chainResult = arbiter.authChecker.ruleEvaluator.evaluateRule(
          userId,
          userKey,
          resourceId,
          resourceKey,
          chainRule,
          new Set(),
          relation,
          { bypassPLTC: true }
        );
        debugFailures.push({
          relation,
          userId,
          resourceId,
          viewerDirect,
          ownerDirect,
          blocked,
          memberGroups: Array.from(memberGroups),
          accessGroups,
          memberRelationsCount: memberRelations.length,
          groupAccessHasResource,
          chainPossibility: chainResult ? chainResult.possibility : 0,
          predictedPossibility: result ? result.possibility : 0,
          bypassPossibility: bypassResult ? bypassResult.possibility : 0,
          bypassReason: bypassResult ? bypassResult.reason : null,
          bypassMeta: bypassResult ? bypassResult.meta : null
        });
      }
    }
    if (!perRuleStats.has(relation)) {
      perRuleStats.set(relation, {
        tp: 0,
        tn: 0,
        fp: 0,
        fn: 0,
        predictedTrue: 0,
        predictedFalse: 0,
        latencies: []
      });
    }
    const ruleStats = perRuleStats.get(relation);
    ruleStats.latencies.push(durationMs);
    if (predicted) {
      ruleStats.predictedTrue++;
    } else {
      ruleStats.predictedFalse++;
    }
    if (expected && predicted) {
      ruleStats.tp++;
    } else if (!expected && !predicted) {
      ruleStats.tn++;
    } else if (!expected && predicted) {
      ruleStats.fp++;
    } else if (expected && !predicted) {
      ruleStats.fn++;
    }
  }
  const precision = tp + fp > 0 ? tp / (tp + fp) : 0;
  const recall = tp + fn > 0 ? tp / (tp + fn) : 0;
  const f1 = precision + recall > 0 ? (2 * precision * recall) / (precision + recall) : 0;
  return {
    tp,
    tn,
    fp,
    fn,
    predictedTrue,
    predictedFalse,
    precision,
    recall,
    f1,
    debugFailures,
    debugFalsePositives,
    latencies,
    perRuleStats
  };
}

const args = parseArgs(process.argv);
const config = {
  users: Number(args.get('users') || 200),
  groups: Number(args.get('groups') || 100),
  resources: Number(args.get('resources') || 300),
  memberPerUser: Number(args.get('member-per-user') || 3),
  accessPerGroup: Number(args.get('access-per-group') || 6),
  viewerPerUser: Number(args.get('viewer-per-user') || 2),
  ownerPerUser: Number(args.get('owner-per-user') || 1),
  blockedPerUser: Number(args.get('blocked-per-user') || 0.2),
  riskPerUser: Number(args.get('risk-per-user') || 1.5),
  linkPerUser: Number(args.get('link-per-user') || 2),
  linkPerResource: Number(args.get('link-per-resource') || 2),
  linkReversePerResource: Number(args.get('link-reverse-per-resource') || 1),
  riskLimitBase: Number(args.get('risk-limit-base') || 50),
  riskLimitVariance: Number(args.get('risk-limit-variance') || 30),
  trustPerUser: Number(args.get('trust-per-user') || 2),
  trustRequirementBase: Number(args.get('trust-requirement-base') || 0.3),
  trustRequirementVariance: Number(args.get('trust-requirement-variance') || 0.5),
  queries: Number(args.get('queries') || 20000),
  warmup: Number(args.get('warmup') || 2000),
  zipf: Number(args.get('zipf') || 1.1),
  valueRatio: Number(args.get('value-ratio') || 0.2),
  seed: args.has('seed') ? Number(args.get('seed')) : null,
  debugFailures: Number(args.get('debug-failures') || 5)
};

const rng = createRng(config.seed);
const samplers = {
  user: buildZipfSampler(config.users, config.zipf, rng),
  group: buildZipfSampler(config.groups, config.zipf, rng),
  resource: buildZipfSampler(config.resources, config.zipf, rng)
};
const { arbiter, relationPools, groundTruth, userIds, resourceIds } = buildGraph({
  users: config.users,
  groups: config.groups,
  resources: config.resources,
  memberPerUser: config.memberPerUser,
  accessPerGroup: config.accessPerGroup,
  viewerPerUser: config.viewerPerUser,
  ownerPerUser: config.ownerPerUser,
  blockedPerUser: config.blockedPerUser,
  riskPerUser: config.riskPerUser,
  linkPerUser: config.linkPerUser,
  linkPerResource: config.linkPerResource,
  linkReversePerResource: config.linkReversePerResource,
  riskLimitBase: config.riskLimitBase,
  riskLimitVariance: config.riskLimitVariance,
  trustPerUser: config.trustPerUser,
  trustRequirementBase: config.trustRequirementBase,
  trustRequirementVariance: config.trustRequirementVariance,
  rng
});

arbiter.setRelationConfig('viewer', { type: 'direct' });
arbiter.setRelationConfig('owner', { type: 'direct' });
arbiter.setRelationConfig('member', { type: 'direct' });
arbiter.setRelationConfig('group_access', { type: 'direct' });
arbiter.setRelationConfig('blocked', { type: 'direct' });
arbiter.setRelationConfig('risk_score', { type: 'direct' });
arbiter.setRelationConfig('risk_limit', { type: 'direct' });
arbiter.setRelationConfig('link', { type: 'direct' });
arbiter.setRelationConfig('resource_access', { type: 'direct' });
arbiter.setRelationConfig('trust_level', { type: 'direct' });
arbiter.setRelationConfig('trust_requirement', { type: 'direct' });
arbiter.setRelationConfig('can_view', {
  union: [
    { type: 'direct', relation: 'viewer' },
    { type: 'direct', relation: 'owner' },
    {
      type: 'chain',
      steps: [
        { relation: 'member', direction: 'out' },
        { relation: 'group_access', direction: 'out' }
      ]
    }
  ],
  unless: {
    union: [
      { type: 'direct', relation: 'blocked' }
    ]
  }
});
arbiter.setRelationConfig('can_edit', {
  intersection: [
    { type: 'direct', relation: 'owner' },
    { type: 'computed', relation: 'can_view' }
  ]
});
arbiter.setRelationConfig('can_view_ttu', {
  type: 'tuple_to_userset',
  tuplesetRelation: 'group_access',
  tuplesetDirection: 'in',
  computedRelation: 'member'
});
arbiter.setRelationConfig('can_view_ttu_reverse', {
  type: 'tuple_to_userset',
  tuplesetRelation: 'member',
  reverse: true,
  computedRelation: 'resource_access'
});
arbiter.setRelationConfig('can_reach', {
  type: 'multi_hop',
  relation: 'link',
  maxDepth: 4
});
arbiter.setRelationConfig('can_reach_reverse', {
  type: 'multi_hop',
  relation: 'link',
  maxDepth: 4,
  reverse: true
});
arbiter.setRelationConfig('similar_view', {
  type: 'similar_to',
  relation: 'viewer',
  k: 5,
  similarityThreshold: 0.6,
  fallbackToBasicSimilarity: true
});
arbiter.setRelationConfig('similar_view_reverse', {
  type: 'similar_to',
  relation: 'viewer',
  reverse: true,
  k: 5,
  similarityThreshold: 0.6,
  fallbackToBasicSimilarity: true
});
arbiter.setRelationConfig('risk_ok', {
  type: 'relational_comparator',
  comparator: '<=',
  fallbackBehavior: 'deny',
  left: {
    rule: { type: 'direct', relation: 'risk_score' },
    extractValue: true,
    valueRelation: 'risk_score'
  },
  right: {
    rule: { type: 'direct', relation: 'risk_limit' },
    extractValue: true,
    valueRelation: 'risk_limit',
    evaluateFrom: 'object'
  }
});
arbiter.setRelationConfig('trust_ok_qual', {
  type: 'relational_comparator',
  qualitative: true,
  scaleName: 'five-point',
  comparator: '>=',
  fallbackBehavior: 'deny',
  left: {
    rule: { type: 'direct', relation: 'trust_level' },
    extractValue: true,
    valueRelation: 'trust_level'
  },
  right: {
    rule: { type: 'direct', relation: 'trust_requirement' },
    extractValue: true,
    valueRelation: 'trust_requirement',
    evaluateFrom: 'object'
  }
});
arbiter.setRelationConfig('can_view_defeasible', {
  union: [
    { type: 'direct', relation: 'viewer' },
    { type: 'direct', relation: 'owner' },
    { type: 'computed', relation: 'can_view_ttu' }
  ],
  unless: {
    union: [
      { type: 'direct', relation: 'blocked' }
    ]
  },
  requires: {
    union: [
      { type: 'computed', relation: 'risk_ok' }
    ]
  }
});
arbiter.setRelationConfig('can_view_mixed', {
  union: [
    { type: 'computed', relation: 'can_view' },
    { type: 'computed', relation: 'can_reach_reverse' },
    { type: 'computed', relation: 'similar_view_reverse' },
    { type: 'computed', relation: 'trust_ok_qual' }
  ]
});

arbiter.graphManager.initializeReachabilityChecker({ enableBackwardIndex: true });


if (config.warmup > 0) {
  runQueries({
    arbiter,
    total: config.warmup,
    valueRatio: config.valueRatio,
    samplers,
    rng,
    recordFrequency: false,
    frequencies: new Map(),
    relationPools,
    validation: false
  });
}

arbiter.relationManager.resetCacheStats();
const frequencies = new Map();
const startTime = Date.now();
const validation = runQueries({
  arbiter,
  total: config.queries,
  valueRatio: config.valueRatio,
  samplers,
  rng,
  recordFrequency: true,
  frequencies,
  relationPools,
  validation: true
});
const elapsedMs = Date.now() - startTime;
const qps = elapsedMs > 0 ? Math.round((config.queries / elapsedMs) * 1000) : 0;
const lookupLatencies = [...validation.latencies].sort((a, b) => a - b);
const lookupP95 = percentile(lookupLatencies, 95).toFixed(3);
const lookupP99 = percentile(lookupLatencies, 99).toFixed(3);

const stats = arbiter.relationManager.getCacheStats();
const estimatedHitRate = estimateHitRate(frequencies, arbiter.relationManager._maxCacheSize);

const authStart = Date.now();
const authEval = runAuthEval({
  arbiter,
  total: config.queries,
  samplers,
  rng,
  groundTruth,
  userIds,
  resourceIds,
  debugLimit: config.debugFailures
});
const authElapsed = Date.now() - authStart;
const authQps = authElapsed > 0 ? Math.round((config.queries / authElapsed) * 1000) : 0;
const authLatencies = [...authEval.latencies].sort((a, b) => a - b);
const authP95 = percentile(authLatencies, 95).toFixed(3);
const authP99 = percentile(authLatencies, 99).toFixed(3);
const perRuleOutput = [];
for (const [relation, stats] of authEval.perRuleStats.entries()) {
  const ruleLatencies = [...stats.latencies].sort((a, b) => a - b);
  const ruleP95 = percentile(ruleLatencies, 95);
  const ruleP99 = percentile(ruleLatencies, 99);
  const precision = stats.tp + stats.fp > 0 ? stats.tp / (stats.tp + stats.fp) : 0;
  const recall = stats.tp + stats.fn > 0 ? stats.tp / (stats.tp + stats.fn) : 0;
  const f1 = precision + recall > 0 ? (2 * precision * recall) / (precision + recall) : 0;
  perRuleOutput.push({
    relation,
    tp: stats.tp,
    tn: stats.tn,
    fp: stats.fp,
    fn: stats.fn,
    predictedTrue: stats.predictedTrue,
    predictedFalse: stats.predictedFalse,
    precision: Number(precision.toFixed(3)),
    recall: Number(recall.toFixed(3)),
    f1: Number(f1.toFixed(3)),
    p95: Number(ruleP95.toFixed(3)),
    p99: Number(ruleP99.toFixed(3))
  });
}
perRuleOutput.sort((a, b) => a.relation.localeCompare(b.relation));

console.log('Zipfian cache evaluation');
console.log(`users=${config.users} groups=${config.groups} resources=${config.resources} queries=${config.queries}`);
console.log(`zipf=${config.zipf} value_ratio=${config.valueRatio} warmup=${config.warmup}`);
console.log(`cache_hits=${stats.cacheHits} cache_misses=${stats.cacheMisses} hit_rate=${stats.hitRate}`);
console.log(`relation_cache_size=${stats.relationCacheSize} value_cache_size=${stats.valueCacheSize}`);
console.log(`estimated_topk_hit_rate=${estimatedHitRate.toFixed(3)}`);
console.log(`elapsed_ms=${elapsedMs} qps=${qps}`);
console.log(`lookup_p95_ms=${lookupP95} lookup_p99_ms=${lookupP99}`);
console.log(`validation_mismatches=${validation.mismatches} false_pos=${validation.falsePositives} false_neg=${validation.falseNegatives}`);
console.log(`auth_elapsed_ms=${authElapsed} auth_qps=${authQps}`);
console.log(`auth_p95_ms=${authP95} auth_p99_ms=${authP99}`);
console.log('auth_per_rule');
for (const entry of perRuleOutput) {
  console.log(JSON.stringify(entry));
}
console.log(`auth_predicted_true=${authEval.predictedTrue} auth_predicted_false=${authEval.predictedFalse}`);
console.log(`auth_tp=${authEval.tp} auth_tn=${authEval.tn} auth_fp=${authEval.fp} auth_fn=${authEval.fn}`);
console.log(`auth_precision=${authEval.precision.toFixed(3)} auth_recall=${authEval.recall.toFixed(3)} auth_f1=${authEval.f1.toFixed(3)}`);
if (authEval.debugFailures.length) {
  console.log('auth_failure_samples');
  for (const sample of authEval.debugFailures) {
    console.log(JSON.stringify(sample));
  }
}
if (authEval.debugFalsePositives.length) {
  console.log('auth_false_positive_samples');
  for (const sample of authEval.debugFalsePositives) {
    console.log(JSON.stringify(sample));
  }
}