solwatch 0.1.18

//! Audit orchestrator. Runs every check against live chain data, folds the
//! flags into a 0-100 score + verdict, and returns a structured result.

use crate::chain::SolClient;
use crate::checks::{bundles, cluster, deployer, holders, liquidity, mint};
use crate::types::{score_flags, AuditResult, Coverage, Flag, Severity, TokenMeta};
use serde_json::json;

#[derive(Default, Clone, Copy)]
pub struct AuditOptions {
    pub skip_bundles: bool,
    pub skip_copycats: bool,
    /// Deeper cluster pass: more funding hops probed, bigger lookup budget.
    pub deep: bool,
}

pub async fn audit_token(
    client: &SolClient,
    mint_addr: &str,
    opts: AuditOptions,
    now_ms: i64,
    scanned_at: String,
) -> AuditResult {
    let mut warnings = vec![];
    // Every pass that cannot see what it claims to check records the gap here.
    // The verdict cap reads it, so no silent data failure publishes as an
    // all-clear. See types::Coverage for why this replaced the old two-input
    // derivation.
    let mut cov = Coverage::new();

    // Prologue: the four fetches are independent — run them concurrently.
    let (mint_res, meta_res, jup_res, liq) = futures::join!(
        client.mint_info(mint_addr),
        client.metaplex_metadata(mint_addr),
        client.jupiter_token(mint_addr),
        liquidity::analyze(client, mint_addr, now_ms),
    );
    let mint_info = match mint_res {
        Ok(m) => m,
        Err(e) => {
            warnings.push(format!("mint lookup: {e}"));
            None
        }
    };
    let meta = meta_res
        .map_err(|e| warnings.push(format!("metadata: {e}")))
        .ok()
        .flatten();
    let jup = jup_res
        .map_err(|e| warnings.push(format!("jupiter: {e}")))
        .ok()
        .flatten();
    if let Some(e) = &liq.fetch_error {
        warnings.push(format!("liquidity (dexscreener): {e}"));
    }

    let Some(mint_info) = mint_info else {
        // No mint account = not a token (or a dead RPC) — honest UNKNOWN.
        let (score, verdict) = score_flags(&[], false);
        return AuditResult {
            address: mint_addr.to_string(),
            chain: crate::config::CHAIN,
            scanned_at,
            token: TokenMeta::default(),
            score,
            verdict,
            flags: vec![],
            sections: json!({}),
            warnings,
            coverage_gaps: vec!["mint account unresolved — no checks could run".into()],
            rokha_url: crate::config::rokha_link(),
            rokha_app: serde_json::Value::Null,
        };
    };

    let mint_an = mint::analyze(&mint_info, meta.as_ref());
    let supply = mint_info.supply;

    // Holder pass (needs the DexScreener pool list to label LP accounts).
    let jup_top10 = jup.as_ref().and_then(|j| j.audit.top_holders_percentage);
    let (holder_an, holder_warn) =
        holders::analyze(client, mint_addr, supply, &liq.pool_addresses, jup_top10).await;
    if let Some(w) = holder_warn {
        warnings.push(w);
    }

    // Parallel: deployer, bundles, copycats.
    let dev = jup.as_ref().and_then(|j| j.dev.clone());
    let symbol = mint_an
        .symbol
        .clone()
        .or_else(|| jup.as_ref().and_then(|j| j.symbol.clone()));
    // --fast skips the launch-bundle AND cluster passes outright. That is a
    // coverage gap by construction, not a clean result: without it a bundled
    // rug with a clean mint published "LOW RISK 100/100", byte-indistinguishable
    // from a full clean audit. SKILL.md already documented that fast scores
    // aren't comparable; now the code enforces it.
    if opts.skip_bundles {
        cov.degrade("launch-window bundle + wallet-cluster passes skipped (--fast)");
    }
    if opts.skip_copycats {
        cov.degrade("copycat/impersonator scan skipped (--fast)");
    }
    let bundles_fut = async {
        if opts.skip_bundles {
            bundles::BundleAnalysis {
                section: json!({"analyzed": false, "note": "skipped (--fast)"}),
                flags: vec![],
                buyers: vec![],
                launch_slot: None,
                launch_txs: vec![],
                coverage: 0.0,
                dev: dev.clone(),
            }
        } else {
            bundles::analyze(
                client,
                mint_addr,
                supply,
                &holder_an.pool_owners,
                &liq.pool_addresses,
                dev.as_deref(),
            )
            .await
        }
    };
    let copycats_fut = async {
        match (&symbol, opts.skip_copycats) {
            // A failed lookup is NOT "no impersonators found" — the two are
            // indistinguishable downstream, so the error is surfaced rather
            // than swallowed into an empty vec.
            (Some(s), false) => match client.find_copycats(s, mint_addr).await {
                Ok(c) => (c, None),
                Err(e) => (vec![], Some(format!("copycat scan (dexscreener): {e}"))),
            },
            _ => (vec![], None),
        }
    };
    let (bundle_an, (copycats, copycat_err)) = futures::join!(bundles_fut, copycats_fut);
    if let Some(e) = copycat_err {
        warnings.push(e);
        cov.degrade("copycat/impersonator scan failed");
    }
    // Deployer runs after bundles so it can fall back to the fee-payer dev the
    // bundle pass resolved when Jupiter has no indexed creator.
    let (deployer_section, deployer_flags) =
        deployer::analyze(client, jup.as_ref(), bundle_an.dev.as_deref(), &mut cov).await;
    let bundles_section = bundle_an.section.clone();
    let bundles_flags = bundle_an.flags.clone();

    // Wallet-link pass — funding graph + transfers + same-slot + Jito, folded
    // into the shared contract v2. Skipped under --fast.
    let (cluster_section, cluster_flags, cluster_supersedes) = if opts.skip_bundles {
        (
            json!({"schema": 2, "scope": {"wallets_analyzed": 0, "holders_analyzed": 0,
                "snipers_analyzed": 0, "funder_hops": 0, "transfer_probes": 0,
                "transfer_txs_sampled": 0, "coverage": "unavailable",
                "limits": ["the wallet-link pass did not run at all (--fast)"],
                "note": "skipped (--fast)"},
                "findings": [], "effective_concentration": serde_json::Value::Null}),
            vec![],
            false,
        )
    } else {
        let out = cluster::analyze(
            client,
            mint_addr,
            cluster::ClusterInputs {
                holders: &holder_an.ranked,
                buyers: &bundle_an.buyers,
                dev: bundle_an.dev.as_deref(),
                excluded: &holder_an.pool_owners,
                supply,
                launch_slot: bundle_an.launch_slot,
                launch_txs: &bundle_an.launch_txs,
                launch_coverage: bundle_an.coverage,
                holders_live: holder_an.live_list,
            },
            opts.deep,
        )
        .await;
        (out.section, out.flags, out.supersedes_raw_top10)
    };

    // LP-safety posture per venue.
    let mut lp_flags = vec![];
    let launchpad = jup.as_ref().and_then(|j| j.launchpad.clone());
    match liq.top_dex.as_deref() {
        Some("pumpfun") => lp_flags.push(Flag::new(
            "bonding_curve",
            Severity::Info,
            "Still on the bonding curve",
            "Trading happens on pump.fun's bonding curve — there is no LP to pull yet, but the token is extremely early and most never graduate.".into(),
            3,
        )),
        Some("pumpswap") => lp_flags.push(Flag::new(
            "lp_locked",
            Severity::Good,
            "LP locked by protocol (PumpSwap)",
            // Scoped to the PumpSwap pool: a dev can still seed a separate,
            // fully-owned pool elsewhere, so the guarantee must not be stated
            // about the token as a whole.
            "Graduated pump.fun token — the PumpSwap pool's liquidity is protocol-owned and cannot be pulled by the dev. Any OTHER pool this token trades in is not covered by that protection.".into(),
            0,
        )),
        Some(_) if liq.pair_count > 0 => {
            let deep = liq.total_liquidity_usd >= 100_000.0;
            let via = launchpad
                .as_deref()
                .map(|l| format!(" (launched via {l})"))
                .unwrap_or_default();
            lp_flags.push(Flag::new(
                "lp_lock_unverified",
                if deep { Severity::Info } else { Severity::Warning },
                "LP lock unverified",
                format!("Solwatch could not confirm the LP is burned or locked{via} — in principle the dev could pull it. Verify before trusting."),
                if deep { 3 } else { 10 },
            ));
        }
        _ => {}
    }

    // Market-quality reads: Solwatch's own bot-volume heuristics (from data
    // already fetched) + Jupiter's third-party organic score, labeled as such.
    let mut market_flags = vec![];
    // Heuristic 1 — uniform launch-buy sizes: an army of bots buying near-
    // identical amounts is manufactured demand, not a crowd.
    if bundle_an.buyers.len() >= 5 {
        let amounts: Vec<u128> = bundle_an.buyers.iter().map(|b| b.amount).collect();
        let uniform = max_uniform_ratio(&amounts);
        if uniform >= 0.6 {
            market_flags.push(Flag::new(
                "uniform_buys",
                Severity::Warning,
                "Launch buys are suspiciously uniform",
                format!(
                    "{}% of the launch-window buys are near-identical sizes — scripted wallets, not organic buyers.",
                    (uniform * 100.0).round()
                ),
                8,
            ));
        }
    }
    // Heuristic 2 — volume way out of proportion to the holder base.
    if let (Some(vol), Some(holders_n)) = (
        liq.section
            .pointer("/totalVolume24hUsd")
            .and_then(|v| v.as_f64())
            .filter(|v| *v > 0.0),
        jup.as_ref().and_then(|j| j.holder_count),
    ) {
        if holders_n >= 20 && vol / holders_n as f64 > 50_000.0 {
            market_flags.push(Flag::new(
                "wash_volume",
                Severity::Warning,
                "Volume disproportionate to holders",
                format!(
                    "${:.0}k of 24h volume across only {holders_n} holders (~${:.0}k per holder) — heavy wash/bot trading is the usual cause.",
                    vol / 1000.0,
                    vol / holders_n as f64 / 1000.0
                ),
                6,
            ));
        }
    }
    if let Some(j) = &jup {
        match (j.organic_score, j.organic_score_label.as_deref()) {
            (Some(s), Some("low")) if liq.pair_count > 0 => market_flags.push(Flag::new(
                "low_organic",
                Severity::Warning,
                "Volume looks botted (Jupiter score)",
                format!(
                    "Jupiter's third-party organic score is {} / 100 — most of the trading volume doesn't look like real humans.",
                    s.round()
                ),
                8,
            )),
            (Some(s), Some("high")) => market_flags.push(Flag::new(
                "organic_volume",
                Severity::Good,
                "Organic trading activity (Jupiter score)",
                format!("Jupiter's third-party organic score is {} / 100 — real trader activity.", s.round()),
                0,
            )),
            _ => {}
        }
        if j.is_verified == Some(true) {
            market_flags.push(Flag::new(
                "verified",
                Severity::Good,
                "Community-verified token",
                "Listed on Jupiter's verified list.".into(),
                0,
            ));
        }
    }

    // Copycats.
    let mut copycat_flags = vec![];
    if !copycats.is_empty() {
        let ids: Vec<String> = copycats
            .iter()
            .take(3)
            .map(|c| c.base_token.address[..8.min(c.base_token.address.len())].to_string())
            .collect();
        copycat_flags.push(Flag::new(
            "copycats",
            Severity::Info,
            &format!("{} same-symbol token(s) on Solana", copycats.len()),
            format!(
                "Impersonators exist — double-check you hold {mint_addr}. Copycats: {}.",
                ids.join(", ")
            ),
            2,
        ));
    }

    // Assemble. When the entity top-10 read is authoritative (full coverage AND
    // strictly higher than the raw number — gated in cluster.rs), it SUPERSEDES
    // the raw per-wallet top-10 flag so the same supply is not deducted twice.
    // Because both gates must hold, this can only ever replace a flag with a
    // HARSHER one; a partial graph never removes a deduction.
    let mut holder_flags = holder_an.flags;
    if cluster_supersedes {
        holder_flags.retain(|f| f.id != "top10_concentration");
    }
    let mut flags: Vec<Flag> = vec![];
    flags.extend(mint_an.flags);
    flags.extend(holder_flags);
    flags.extend(liq.flags);
    flags.extend(deployer_flags);
    flags.extend(bundles_flags);
    flags.extend(cluster_flags);
    flags.extend(lp_flags);
    flags.extend(market_flags);
    flags.extend(copycat_flags);

    // Coverage honesty: the deterministic mint checks (mint/freeze authority,
    // Token-2022 traps) are always complete, but the CONCENTRATION read is only
    // trustworthy when we could actually read the live holder set and the RPC
    // wasn't throttling. When we're blind there, an affirmative all-clear (LOW
    // RISK) is not earned — cap the ceiling at FAIR and say so loudly, so a
    // bundle-heavy rug with a clean mint audited through RPC limits can't post
    // as "88/100 LOW RISK". (Launch-window-only gaps are handled by the '⚠
    // partial scan' tweet marker + the report notes, not a verdict cap.)
    let rpc_pressure = client.rpc_pressure();
    if !holder_an.live_list {
        cov.degrade("live holder concentration unreadable");
    }
    if let Some(p) = rpc_pressure {
        cov.degrade("RPC throttling reduced scan coverage");
        warnings.push(p);
    }
    // The cluster pass reports its own coverage; a partial funding walk or a
    // truncated probe budget means the clustered concentration read is a floor.
    if cluster_section
        .pointer("/scope/coverage")
        .and_then(|v| v.as_str())
        .is_some_and(|c| c != "full" && c != "unavailable")
    {
        cov.degrade("wallet-cluster analysis was partial");
    }
    let coverage_blind = cov.is_blind();
    if coverage_blind {
        flags.push(Flag::new(
            "insufficient_coverage",
            Severity::Warning,
            "Incomplete scan — treat the score as a ceiling",
            format!(
                "Solwatch could not complete every check this run: {}. The deterministic mint checks (mint & freeze authority, Token-2022 traps) ARE complete and are unaffected — but unknown is not the same as safe, so treat the score as a ceiling rather than an all-clear and re-run for the full picture.",
                cov.summary()
            ),
            0,
        ));
    }

    let (mut score, mut verdict) = score_flags(&flags, true);
    if coverage_blind && score > 79 {
        score = 79;
        verdict = crate::types::verdict_from_score(score);
    }
    flags.sort_by_key(|f| std::cmp::Reverse(f.severity.rank()));

    let top_pair = liq
        .section
        .pointer("/pairs/0")
        .cloned()
        .unwrap_or(json!(null));
    // 24h volume is the TOKEN's, not one pool's — pairs are sorted by
    // liquidity, and on migrated tokens the deepest pool is often not where
    // the trading is (observed live: a Meteora DLMM at $281k liq / $759k vol
    // shown while the pumpswap pool did $5.2M).
    // Read the ALL-pairs total the liquidity pass computes, not a sum over the
    // display-truncated top-8 array.
    let volume_24h_total = liq
        .section
        .pointer("/totalVolume24hUsd")
        .and_then(|v| v.as_f64())
        .filter(|v| *v > 0.0);
    let token_meta = TokenMeta {
        name: mint_an
            .name
            .clone()
            .or_else(|| jup.as_ref().and_then(|j| j.name.clone())),
        symbol,
        decimals: Some(mint_info.decimals),
        total_supply: Some(mint_info.supply_raw.clone()),
        holders_count: jup.as_ref().and_then(|j| j.holder_count),
        market_cap_usd: jup
            .as_ref()
            .and_then(|j| j.mcap)
            .or_else(|| liq.section.pointer("/fdvUsd").and_then(|v| v.as_f64())),
        volume_24h_usd: volume_24h_total
            .or_else(|| top_pair.pointer("/volume/h24").and_then(|v| v.as_f64())),
        price_usd: jup
            .as_ref()
            .and_then(|j| j.usd_price)
            .or_else(|| top_pair.pointer("/priceUsd").and_then(|v| v.as_f64())),
        token_program: Some(mint_info.program.clone()),
        launchpad,
        // When the token started TRADING (oldest pair), not when Jupiter
        // indexed it. Jupiter's `created_at` is an index-row date that reads
        // the same for tokens launched years apart, so it is only a fallback.
        created_at: liq
            .section
            .pointer("/firstPairCreatedAtMs")
            .and_then(|v| v.as_i64())
            .and_then(|ms| {
                time::OffsetDateTime::from_unix_timestamp(ms / 1000)
                    .ok()
                    .and_then(|t| {
                        t.format(&time::format_description::well_known::Rfc3339)
                            .ok()
                    })
            })
            .or_else(|| jup.as_ref().and_then(|j| j.created_at.clone())),
    };

    let copycats_section: Vec<_> = copycats
        .iter()
        .take(5)
        .map(|c| {
            json!({
                "mint": c.base_token.address,
                "liquidityUsd": c.liquidity.as_ref().and_then(|l| l.usd).unwrap_or(0.0),
                "pair": c.pair_address,
            })
        })
        .collect();
    let market_section = jup.as_ref().map(|j| {
        json!({
            "organicScore": j.organic_score,
            "organicScoreLabel": j.organic_score_label,
            "isVerified": j.is_verified,
            "tags": j.tags,
            "icon": j.icon,
        })
    });

    let mut result = AuditResult {
        address: mint_addr.to_string(),
        chain: crate::config::CHAIN,
        scanned_at,
        token: token_meta,
        score,
        verdict,
        flags,
        sections: json!({
            "mint": mint_an.section,
            "holders": holder_an.section,
            "liquidity": liq.section,
            "bundles": bundles_section,
            "cluster": cluster_section,
            "deployer": deployer_section,
            "market": market_section,
            "copycats": copycats_section,
        }),
        warnings,
        coverage_gaps: cov.gaps().to_vec(),
        rokha_url: crate::config::rokha_link(),
        rokha_app: serde_json::Value::Null,
    };
    result.rokha_app = crate::report::render_rokha_app(&result);
    result
}

/// Largest fraction of values clustered within ±1% of a common size (public
/// for the unit tests). 1.0 = every buy is the same size.
pub fn max_uniform_ratio(amounts: &[u128]) -> f64 {
    if amounts.is_empty() {
        return 0.0;
    }
    let mut best = 0usize;
    for &a in amounts {
        if a == 0 {
            continue;
        }
        let lo = a - a / 100;
        let hi = a + a / 100;
        let n = amounts.iter().filter(|&&x| x >= lo && x <= hi).count();
        best = best.max(n);
    }
    best as f64 / amounts.len() as f64
}