// KYA step 1: Bind agent to cryptographic identity
const agent = await kakunin.agents.create({
  name: 'trading_bot_eu_v2',
  model_hash: await Kakunin.computeModelHash('trading-bot:v2.1.0'),
  model: 'trading-bot',
  version: '2.1.0',
  financial_scope: {
    max_single_trade_usd: 50000,
    permitted_instruments: ['EUR_USD', 'GBP_EUR'],
  },
  metadata: { deployment: 'kubernetes' },
});

// Issue the certificate — 365-day validity, scope baked in, KMS-backed
const cert = await kakunin.agents.certify(agent.id);

// KYA step 2: The baseline is derived automatically from the events you stream.
// Run a warm-up period ingesting representative events; Kakunin builds the
// rolling 30-day baseline itself — there is nothing to record by hand.
await kakunin.events.ingest({
  agentId: agent.id,
  actionType: 'transaction_initiated',
  details: { amount: 25000, market: 'EUR_USD' },
});

// KYA step 4: Verify at action time
async function verifyAction(action) {
  // 1. Certificate status + scope in one keyless call
  const agent = await kakunin.verify.cert(action.serial);
  if (agent.status !== 'active') return { allowed: false, reason: 'cert_invalid' };

  // 2. Verify the signature against the agent's public certificate (server-side)
  const check = await fetch('https://api.kakunin.ai/v1/verify/message', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      payload: action.payload,
      signature: action.signature,
      certificate_serial: action.serial,
    }),
  }).then((r) => r.json());
  if (!check.valid) return { allowed: false, reason: 'sig_invalid' };

  // 3. Check scope
  if (action.size > agent.financial_scope.max_single_trade_usd) {
    return { allowed: false, reason: 'exceeds_cert_scope' };
  }

  // 4. Check the behavioral risk band (Kakunin maintains the baseline)
  const risk = await kakunin.agents.getRisk(agent.agent_id);
  if (risk.dominant_band === 'high') {
    return { allowed: false, reason: 'anomaly_threshold', band: risk.dominant_band };
  }

  return { allowed: true };
}

apiVersion: v1
kind: Pod
metadata:
  name: trading-bot-pod
spec:
  containers:
  # Main agent container
  - name: agent
    image: myrepo/trading-bot:v2.1.0
    env:
    - name: AGENT_ID
      value: trading_bot_eu_v2
    - name: KAKUNIN_API_KEY
      valueFrom:
        secretKeyRef:
          name: kakunin-secrets
          key: api-key
    volumeMounts:
    - name: cert-volume
      mountPath: /var/certs
      readOnly: true

  # KYA enforcement sidecar
  - name: kya-enforcer
    image: kakunin/kya-enforcer:latest
    env:
    - name: AGENT_ID
      value: trading_bot_eu_v2
    - name: BASELINE_REFRESH_INTERVAL
      value: "3600"  # 1 hour
    - name: ANOMALY_CHECK_INTERVAL
      value: "60"    # 60 seconds
    volumeMounts:
    - name: cert-volume
      mountPath: /var/certs
      readOnly: true
    ports:
    - containerPort: 8443
      name: kya-api

  volumes:
  - name: cert-volume
    projected:
      sources:
      - secret:
          name: agent-certificate
          items:
          - key: cert.pem
            path: cert.pem
          - key: key-arn.txt
            path: kms-key-arn.txt

// In agent code
async function executeTrade(tradeRequest) {
  // Call KYA sidecar to verify + sign
  const verified = await fetch('http://localhost:8443/verify-and-sign', {
    method: 'POST',
    body: JSON.stringify(tradeRequest),
  });

  if (!verified.ok) {
    console.error('KYA rejection:', await verified.text());
    return; // Trade blocked
  }

  const { signature, riskScore } = await verified.json();

  // Submit to exchange with proof
  const response = await fetch('https://api.exchange.com/v1/trades', {
    method: 'POST',
    headers: {
      'X-Agent-Certificate': fs.readFileSync('/var/certs/cert.pem'),
      'X-Agent-Signature': signature,
      'X-Risk-Score': riskScore.toString(),
    },
    body: JSON.stringify(tradeRequest),
  });

  return response.json();
}

// Kakunin computes the behavioral profile (percentiles, drift, bands) itself
// from the events you ingest, over a rolling 30-day window. You don't collect
// samples or set a baseline — you read the derived profile:
const risk = await kakunin.agents.getRisk(agent.id);

console.log(risk.dominant_band);          // rolling 'low' | 'medium' | 'high'
console.log(risk.drift.drift_score);  // null until the 30-day baseline forms
console.log(risk.drift.drift_trend);  // 'increasing' | 'decreasing' | 'stable'
console.log(risk.recent_high_risk_events);

function computeAnomalyScore(action, baseline) {
  let score = 0;

  // Size anomaly (weight: 0.35)
  const sizePercentile = percentileRank(action.size, baseline.transaction_size);
  if (sizePercentile > 0.98) {
    score += 0.35 * Math.min(1.0, (sizePercentile - 0.98) * 50);
  }

  // Frequency anomaly (weight: 0.25)
  const hourlyFreq = getHourlyTransactionCount(action.agentId);
  if (hourlyFreq > baseline.transactions_per_hour.p99) {
    score += 0.25 * Math.min(1.0, (hourlyFreq / baseline.transactions_per_hour.p99) - 1);
  }

  // Market anomaly (weight: 0.20)
  if (!baseline.preferred_markets.includes(action.market)) {
    score += 0.20;  // 20% boost for trading outside normal markets
  }

  // Time-of-day anomaly (weight: 0.15)
  const currentTime = getCurrentTime();
  if (!isWithinTradingHours(currentTime, baseline)) {
    score += 0.15;  // Trading outside business hours
  }

  // Geographic anomaly (weight: 0.05)
  if (action.region !== baseline.allowedRegions[0]) {
    score += 0.05;
  }

  return Math.min(1.0, score);
}

// For pre-production, use a sandbox key (kak_test_) — test certs are real X.509
// but carry no regulatory validity. The behavioral baseline forms automatically
// as events accrue; there is no separate "bootstrap mode".
const sandbox = new Kakunin({ apiKey: process.env.KAKUNIN_TEST_KEY! });
const agent = await sandbox.agents.create({
  name: 'trading_bot_v2',
  model_hash: 'sha256:...',
  model: 'trading-bot',
  version: '2.0.0',
});
const cert = await sandbox.agents.certify(agent.id);

// Review the derived profile as it matures — no manual analysis or lock-in.
const risk = await kakunin.agents.getRisk(agent.id);
console.log('Risk band:', risk.dominant_band);
console.log('Drift score:', risk.drift.drift_score);  // number once baseline is ready

// Move to production by issuing a live cert (with a kak_live_ key). The 30-day
// baseline carries over from the ingested history; there is no baseline to lock.
const prodCert = await kakunin.agents.certify(agent.id);

// These are platform behaviors — you don't schedule them. When an ingested event
// lands in the high band, Kakunin queues a revocation check and fires a
// risk.alert webhook automatically. React to the band, or revoke manually:
const result = await kakunin.events.ingest({ agentId: agent.id, actionType, details });

if (result.risk_band === 'high') {
  // Optional: revoke immediately instead of waiting for the automatic check
  await kakunin.certificates.revoke(certId, { reason: 'anomaly_threshold_exceeded' });
}

// Post-revocation: Launch replacement
const replacementAgent = await kakunin.agents.create({
  name: 'trading_bot_v2_replacement',
  replaces: originalAgent.id,
  inheritBaseline: true,  // Reuse normal behavior profile
});