// Copyright 2024-2026 Tymofii Pidlisnyi. Apache-2.0 license. See LICENSE.
// Attribution Consent — construct + sign (citer-side)
import { createHash } from 'node:crypto';
import { sign } from '../../crypto/keys.js';
import { canonicalize } from '../../core/canonical.js';
/** The canonical unsigned core of a receipt. Both citer and cited principal
 *  sign exactly this payload, and the receipt id is sha256(core). */
export function receiptCore(receipt) {
    return canonicalize({
        version: receipt.version,
        citer: receipt.citer,
        citer_public_key: receipt.citer_public_key,
        cited_principal: receipt.cited_principal,
        cited_principal_public_key: receipt.cited_principal_public_key,
        citation_content: receipt.citation_content,
        binding_context: receipt.binding_context,
        created_at: receipt.created_at,
        expires_at: receipt.expires_at,
    });
}
/** Build an AttributionReceipt signed by the citer. The cited principal's
 *  consent signature is still absent — verifyAttributionConsent() will
 *  reject this receipt until signAttributionConsent() runs. */
export function createAttributionReceipt(params) {
    if (!params.citation_content || typeof params.citation_content !== 'string') {
        throw new Error('createAttributionReceipt: citation_content must be a non-empty string');
    }
    if (!params.binding_context) {
        throw new Error('createAttributionReceipt: binding_context is required');
    }
    const unsigned = {
        version: '1.0',
        citer: params.citer,
        citer_public_key: params.citer_public_key,
        cited_principal: params.cited_principal,
        cited_principal_public_key: params.cited_principal_public_key,
        citation_content: params.citation_content,
        binding_context: params.binding_context,
        created_at: params.created_at,
        expires_at: params.expires_at,
    };
    const core = receiptCore(unsigned);
    const id = createHash('sha256').update(core).digest('hex');
    const citer_signature = sign(core, params.citer_private_key);
    return {
        id,
        ...unsigned,
        citer_signature,
    };
}
//# sourceMappingURL=create.js.map