import { Buffer } from 'node:buffer';

/**
 * The production signing-key resource is deliberately code-owned.  The empty
 * table records the current activation hold until the platform supplies an
 * official key; there is no environment or runtime override.
 */
export const CODE_OWNED_PLUGIN_SIGNING_KEYS = Object.freeze(
  {} as Readonly<Record<string, string>>,
);

export const PLUGIN_SIGNING_KEY_ACTIVATION_HOLD = true as const;

export interface PluginSigningKeyStore {
  get(keyId: string): Uint8Array | string | null;
}

function decodeKey(value: string): Uint8Array | null {
  const trimmed = value.trim();
  if (trimmed.length === 0) return null;
  if (trimmed.includes('BEGIN PUBLIC KEY')) return Buffer.from(trimmed, 'utf8');
  try {
    const bytes = Buffer.from(trimmed, 'base64');
    return bytes.length > 0 ? bytes : null;
  } catch {
    return null;
  }
}

export function loadCodeOwnedPluginSigningKey(keyId: string): Uint8Array | null {
  if (typeof keyId !== 'string' || keyId.length === 0) return null;
  const encoded = CODE_OWNED_PLUGIN_SIGNING_KEYS[keyId];
  return encoded === undefined ? null : decodeKey(encoded);
}

export function createCodeOwnedPluginTrustStore(): PluginSigningKeyStore {
  return Object.freeze({
    get: loadCodeOwnedPluginSigningKey,
  });
}

export const getCodeOwnedPluginSigningKey = loadCodeOwnedPluginSigningKey;