"use strict";
/**
 * License Key Generation Utility
 *
 * Generates RSA-2048 key pairs for JWT license signing.
 * Run: npx tsx src/license/keygen.ts [output-dir]
 *
 * Output:
 *   - private-key.pem  (keep secret, used by license server)
 *   - public-key.pem   (embed in npm package for offline validation)
 *   - key-info.json    (kid, fingerprint, creation timestamp)
 *
 * @connexum/ai-governance
 */
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    var desc = Object.getOwnPropertyDescriptor(m, k);
    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
      desc = { enumerable: true, get: function() { return m[k]; } };
    }
    Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
    if (k2 === undefined) k2 = k;
    o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
    Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
    o["default"] = v;
});
var __importStar = (this && this.__importStar) || (function () {
    var ownKeys = function(o) {
        ownKeys = Object.getOwnPropertyNames || function (o) {
            var ar = [];
            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
            return ar;
        };
        return ownKeys(o);
    };
    return function (mod) {
        if (mod && mod.__esModule) return mod;
        var result = {};
        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
        __setModuleDefault(result, mod);
        return result;
    };
})();
Object.defineProperty(exports, "__esModule", { value: true });
exports.generateLicenseKeys = generateLicenseKeys;
const crypto = __importStar(require("crypto"));
const fs = __importStar(require("fs"));
const path = __importStar(require("path"));
function generateLicenseKeys(outputDir) {
    if (!fs.existsSync(outputDir)) {
        fs.mkdirSync(outputDir, { recursive: true });
    }
    const kid = `cxgov-key-${Date.now()}`;
    const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
        modulusLength: 2048,
        publicKeyEncoding: { type: 'spki', format: 'pem' },
        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
    });
    // Write keys
    fs.writeFileSync(path.join(outputDir, 'private-key.pem'), privateKey);
    fs.writeFileSync(path.join(outputDir, 'public-key.pem'), publicKey);
    // Compute fingerprint (SHA-256 of DER-encoded public key)
    const fingerprint = crypto.createHash('sha256')
        .update(publicKey)
        .digest('hex');
    // Write metadata
    const keyInfo = {
        kid,
        algorithm: 'RS256',
        keySize: 2048,
        fingerprint,
        createdAt: new Date().toISOString(),
        publicKeyFile: 'public-key.pem',
        privateKeyFile: 'private-key.pem',
        usage: {
            privateKey: 'License server signing (KEEP SECRET)',
            publicKey: 'Embed in jwt-validator.ts EMBEDDED_PUBLIC_KEYS for offline validation',
        },
    };
    fs.writeFileSync(path.join(outputDir, 'key-info.json'), JSON.stringify(keyInfo, null, 2));
    process.stdout.write(`License signing keys generated:\n`);
    process.stdout.write(`  Directory:   ${outputDir}\n`);
    process.stdout.write(`  Key ID:      ${kid}\n`);
    process.stdout.write(`  Fingerprint: ${fingerprint.substring(0, 16)}...\n`);
    process.stdout.write(`  Algorithm:   RS256 (RSA-2048 + SHA-256)\n\n`);
    process.stdout.write(`Next steps:\n`);
    process.stdout.write(`  1. Copy public-key.pem content into src/license/jwt-validator.ts EMBEDDED_PUBLIC_KEYS\n`);
    process.stdout.write(`  2. Set private-key.pem as LICENSE_PRIVATE_KEY env var on license server\n`);
    process.stdout.write(`  3. NEVER commit private-key.pem to version control\n`);
}
// CLI entry point
if (require.main === module) {
    const outputDir = process.argv[2] || path.join(process.cwd(), '.license-keys');
    generateLicenseKeys(outputDir);
}
//# sourceMappingURL=keygen.js.map