# Deterministic per-image identity derived from a seed string, so the NixOS
# module and the CLI know the NIC MAC at evaluation time (OpenCore's ROM must
# match the MAC of en0 for Apple ID / iMessage).
{ lib, ... }:
rec {
  hash = seed: builtins.hashString "sha256" seed;

  # locally administered QEMU-style MAC
  macFromSeed = seed:
    let h = hash "${seed}-mac"; s = i: builtins.substring i 2 h;
    in "52:54:00:${s 0}:${s 2}:${s 4}";

  # RFC 4122 v4 layout
  uuidFromSeed = seed:
    let h = hash "${seed}-uuid"; s = a: b: builtins.substring a b h;
    in lib.toUpper "${s 0 8}-${s 8 4}-4${s 13 3}-8${s 17 3}-${s 20 12}";
}