#!/usr/bin/env bash
set -euo pipefail

# CASAN Plan-16 SEC-10 — mint a signed agent-identity token.
#
# Proves a caller really IS a given agent (instead of just setting CASAN_AGENT).
# The signed assertion is bound to the agent id AND the run id, so a token cannot
# be replayed for a different run:
#     casan-agent|v1|<agent-id>|<run-id>
#
# Usage:  agent-identity-sign.sh <agent-id> <run-id> <private-key> <sig-out>
# The matching PUBLIC key must be registered in agent-identities.registry.

AGENT="${1:-}"; RUN="${2:-}"; PRIV="${3:-}"; SIG_OUT="${4:-}"
if [[ -z "$AGENT" || -z "$RUN" || -z "$PRIV" || -z "$SIG_OUT" ]]; then
  echo "Usage: agent-identity-sign.sh <agent-id> <run-id> <private-key> <sig-out>" >&2
  exit 64
fi
command -v openssl >/dev/null 2>&1 || { echo "openssl_unavailable" >&2; exit 1; }

TMP="$(mktemp)"; trap 'rm -f "$TMP"' EXIT
printf '%s' "casan-agent|v1|$AGENT|$RUN" > "$TMP"
openssl dgst -sha256 -sign "$PRIV" -out "$SIG_OUT" "$TMP"
echo "AGENT_IDENTITY_SIGNED agent=$AGENT run=$RUN sig=$SIG_OUT"