import crypto from "node:crypto";
const SAFETY_IDENTIFIER_SECRET_LABEL = "open-mercato:ai-safety-identifier:v1";
const derivedSecretCache = /* @__PURE__ */ new Map();
function readBaseSecret(explicit) {
  const secret = explicit ?? process.env.JWT_SECRET;
  if (!secret) {
    throw new Error("[internal] JWT_SECRET is not set; cannot derive AI safety-identifier secret");
  }
  return secret;
}
function deriveAiSafetyIdentifierSecret(baseSecret) {
  const base = readBaseSecret(baseSecret);
  const cached = derivedSecretCache.get(base);
  if (cached !== void 0) return cached;
  const derived = crypto.createHmac("sha256", base).update(SAFETY_IDENTIFIER_SECRET_LABEL).digest("hex");
  derivedSecretCache.set(base, derived);
  return derived;
}
function computeEndUserIdentifier(tenantId, userId, options) {
  const normalizedUser = (userId ?? "").trim();
  if (!normalizedUser) {
    throw new Error("[internal] computeEndUserIdentifier requires a non-empty userId");
  }
  const key = deriveAiSafetyIdentifierSecret(options?.baseSecret);
  const salt = (tenantId ?? "").trim();
  return crypto.createHmac("sha256", key).update(`${salt}:${normalizedUser}`).digest("hex");
}
export {
  computeEndUserIdentifier,
  deriveAiSafetyIdentifierSecret
};
//# sourceMappingURL=safety-identifier.js.map
