#!/usr/bin/env node
import { createPrivateKey } from 'node:crypto';
import { readFile, writeFile } from 'node:fs/promises';
import { signReferenceCandidate } from './lib/reference-evidence.mjs';

const args = process.argv.slice(2);
if (args.length !== 6 || args[0] !== '--key-id' || args[2] !== '--private-key') {
  throw new Error('Usage: sign-drive-trace --key-id ID --private-key PRIVATE_PEM INPUT_JSON OUTPUT_JSON');
}
const [, keyId, , privateKeyPath, inputPath, outputPath] = args;
const [candidate, privateKeyPem] = await Promise.all([
  readFile(inputPath, 'utf8').then(JSON.parse),
  readFile(privateKeyPath, 'utf8'),
]);
const privateKey = createPrivateKey(privateKeyPem);
if (privateKey.asymmetricKeyType !== 'ed25519') throw new Error('Reference results require an external Ed25519 private key.');
const signed = signReferenceCandidate(candidate, { keyId, privateKey });
await writeFile(outputPath, `${JSON.stringify(signed, null, 2)}\n`, { encoding: 'utf8', flag: 'wx', mode: 0o600 });