/**
 * JWS-like HMAC attestation for MCP server certifications.
 * Uses GUARDIAN_CERT_SIGNING_KEY (falls back to dev key when unset).
 */
import { createHmac, timingSafeEqual } from 'crypto';
function b64url(input) {
    return Buffer.from(input).toString('base64url');
}
function fromB64url(input) {
    return Buffer.from(input, 'base64url').toString('utf-8');
}
export function getCertSigningKey() {
    return process.env['GUARDIAN_CERT_SIGNING_KEY'] || 'guardian-dev-cert-key';
}
export function signCertAttestation(payload) {
    const header = b64url(JSON.stringify({ alg: 'HS256', typ: 'GUARDIAN-CERT+JWS' }));
    const body = b64url(JSON.stringify(payload));
    const signingInput = `${header}.${body}`;
    const signature = createHmac('sha256', getCertSigningKey()).update(signingInput).digest('base64url');
    return `${signingInput}.${signature}`;
}
export function verifyCertAttestation(jws) {
    const parts = jws.split('.');
    if (parts.length !== 3)
        return { valid: false, reason: 'invalid_jws_format' };
    const [header, body, signature] = parts;
    const signingInput = `${header}.${body}`;
    const expected = createHmac('sha256', getCertSigningKey()).update(signingInput).digest('base64url');
    try {
        const sigBuf = Buffer.from(signature, 'base64url');
        const expBuf = Buffer.from(expected, 'base64url');
        if (sigBuf.length !== expBuf.length || !timingSafeEqual(sigBuf, expBuf)) {
            return { valid: false, reason: 'bad_signature' };
        }
    }
    catch {
        return { valid: false, reason: 'bad_signature' };
    }
    try {
        const payload = JSON.parse(fromB64url(body));
        if (!payload.serverName || !payload.issuedAt || !payload.expiresAt) {
            return { valid: false, reason: 'invalid_payload' };
        }
        if (new Date(payload.expiresAt).getTime() < Date.now()) {
            return { valid: false, reason: 'expired', payload };
        }
        return { valid: true, payload };
    }
    catch {
        return { valid: false, reason: 'invalid_payload' };
    }
}
//# sourceMappingURL=cert-signing.js.map