// src/lib/crypto.ts
import crypto from "crypto";
import jwt from "jsonwebtoken";
function generateKeyPairES256() {
  const keyId = crypto.randomUUID();
  const { privateKey, publicKey } = crypto.generateKeyPairSync("ec", {
    namedCurve: "P-256",
    // ES256
    publicKeyEncoding: {
      type: "spki",
      format: "der"
    },
    privateKeyEncoding: {
      type: "pkcs8",
      format: "der"
    }
  });
  const privateKeyB64 = privateKey.toString("base64");
  const publicKeyB64 = publicKey.toString("base64");
  const fingerprint = crypto.createHash("sha256").update(publicKey).digest("hex");
  return {
    privateKey: privateKeyB64,
    publicKey: publicKeyB64,
    keyId,
    fingerprint,
    algorithm: "ES256"
  };
}
function generateKeyPairRS256() {
  const keyId = crypto.randomUUID();
  const { privateKey, publicKey } = crypto.generateKeyPairSync("rsa", {
    modulusLength: 2048,
    publicKeyEncoding: {
      type: "spki",
      format: "der"
    },
    privateKeyEncoding: {
      type: "pkcs8",
      format: "der"
    }
  });
  const privateKeyB64 = privateKey.toString("base64");
  const publicKeyB64 = publicKey.toString("base64");
  const fingerprint = crypto.createHash("sha256").update(publicKey).digest("hex");
  return {
    privateKey: privateKeyB64,
    publicKey: publicKeyB64,
    keyId,
    fingerprint,
    algorithm: "RS256"
  };
}
function generateKeyPair(algorithm = "ES256") {
  return algorithm === "ES256" ? generateKeyPairES256() : generateKeyPairRS256();
}
function generateClientToken(payload, privateKeyB64, algorithm, options) {
  try {
    const privateKeyDER = Buffer.from(privateKeyB64, "base64");
    const privateKeyObject = crypto.createPrivateKey({
      key: privateKeyDER,
      format: "der",
      type: "pkcs8"
    });
    const privateKeyPEM = privateKeyObject.export({
      type: "pkcs8",
      format: "pem"
    });
    const signOptions = {
      algorithm,
      issuer: options?.issuer || "spfn-client",
      expiresIn: options?.expiresIn ?? "15m"
      // Default to 15 minutes
    };
    return jwt.sign(payload, privateKeyPEM, signOptions);
  } catch (error) {
    throw new Error(
      `Failed to generate client token: ${error instanceof Error ? error.message : "Unknown error"}`
    );
  }
}
function verifyClientToken(token, publicKeyB64, algorithm) {
  try {
    const publicKeyDER = Buffer.from(publicKeyB64, "base64");
    const publicKeyObject = crypto.createPublicKey({
      key: publicKeyDER,
      format: "der",
      type: "spki"
    });
    return jwt.verify(token, publicKeyObject, {
      algorithms: [algorithm],
      issuer: "spfn-client"
    });
  } catch (error) {
    throw new Error(
      `Failed to verify token: ${error instanceof Error ? error.message : "Unknown error"}`
    );
  }
}
function getKeySize(publicKeyB64) {
  const keyDER = Buffer.from(publicKeyB64, "base64");
  return {
    bytes: keyDER.length,
    base64Length: publicKeyB64.length
  };
}
function shouldRotateKey(createdAt, rotationDays = 90) {
  const now = /* @__PURE__ */ new Date();
  const ageInDays = Math.floor(
    (now.getTime() - createdAt.getTime()) / (1e3 * 60 * 60 * 24)
  );
  const daysRemaining = Math.max(0, rotationDays - ageInDays);
  return {
    shouldRotate: daysRemaining <= 7,
    // Warn 7 days before expiry
    daysRemaining
  };
}
export {
  generateClientToken,
  generateKeyPair,
  generateKeyPairES256,
  generateKeyPairRS256,
  getKeySize,
  shouldRotateKey,
  verifyClientToken
};
//# sourceMappingURL=crypto.js.map