fleetforge_trust/

lib.rs

//! Trust metadata primitives shared across the runtime.

use anyhow::{anyhow, Context, Result};
use base64::engine::general_purpose::{STANDARD as BASE64, URL_SAFE_NO_PAD as BASE64_URL_SAFE};
use base64::Engine;
use chrono::{DateTime, Utc};
use ed25519_dalek::{
    Signature as Ed25519Signature, Signer as _, SigningKey as Ed25519SigningKey,
    VerifyingKey as Ed25519VerifyingKey,
};
use fleetforge_common::licensing::{ensure_feature_allowed, LicensedFeature};
use hmac::{Hmac, Mac};
#[cfg(any(
    feature = "kms-cli-aws",
    feature = "kms-cli-gcp",
    feature = "kms-cli-azure"
))]
use once_cell::sync::OnceCell;
use p256::ecdsa::{Signature as P256Signature, VerifyingKey as P256VerifyingKey};
use p384::ecdsa::{Signature as P384Signature, VerifyingKey as P384VerifyingKey};
use p521::ecdsa::{Signature as P521Signature, VerifyingKey as P521VerifyingKey};
use process::{ProcessError, ProcessRunner};
#[cfg(any(feature = "jwk-aws", feature = "jwk-gcp"))]
use rsa::pkcs1::DecodeRsaPublicKey;
use rsa::pkcs1v15;
use rsa::pkcs8::{AssociatedOid, DecodePublicKey};
use rsa::pss;
use rsa::traits::PublicKeyParts;
use rsa::{BigUint, RsaPublicKey};
use serde::{Deserialize, Serialize};
use serde_json::{Map, Value};
use sha2::{Digest, Sha256, Sha384, Sha512};
use signature::{digest::FixedOutputReset, Verifier};
#[cfg(any(
    feature = "kms-cli-aws",
    feature = "kms-cli-gcp",
    feature = "jwk-gcp",
    feature = "jwk-aws"
))]
use spki::{der::Decode, ObjectIdentifier, SubjectPublicKeyInfoOwned};
use std::borrow::Cow;
use std::collections::BTreeMap;
#[cfg(any(feature = "kms-cli-gcp", feature = "kms-cli-aws"))]
use std::io::Write;
use std::sync::Arc;
use std::{env, fs, path::Path};
#[cfg(any(feature = "kms-cli-gcp", feature = "kms-cli-aws"))]
use tempfile::NamedTempFile;
use uuid::Uuid;
use which::which;

mod c2pa;
mod capability;
mod process;
mod scitt;
mod vault;
mod vault_object_store;
mod serde_helpers {
    pub mod base64_bytes {
        use base64::engine::general_purpose::STANDARD as BASE64;
        use base64::Engine;
        use serde::{Deserialize, Deserializer, Serializer};

        pub fn serialize<S>(bytes: &Vec<u8>, serializer: S) -> Result<S::Ok, S::Error>
        where
            S: Serializer,
        {
            serializer.serialize_str(&BASE64.encode(bytes))
        }

        pub fn deserialize<'de, D>(deserializer: D) -> Result<Vec<u8>, D::Error>
        where
            D: Deserializer<'de>,
        {
            let encoded = String::deserialize(deserializer)?;
            BASE64
                .decode(encoded.as_bytes())
                .map_err(serde::de::Error::custom)
        }
    }
}

pub fn normalize_ecdsa_signature(
    signature: &[u8],
    algorithm: &SigningAlgorithm,
) -> Result<Vec<u8>> {
    if !algorithm.is_ecdsa() {
        return Ok(signature.to_vec());
    }
    if signature.first().copied() == Some(0x30) {
        return Ok(signature.to_vec());
    }
    if signature.len() % 2 != 0 {
        return Err(anyhow!(
            "invalid ECDSA signature length {}; expected even number of bytes",
            signature.len()
        ));
    }
    let half = signature.len() / 2;
    raw_ecdsa_to_der(&signature[..half], &signature[half..])
}

fn raw_ecdsa_to_der(r: &[u8], s: &[u8]) -> Result<Vec<u8>> {
    fn encode_integer(bytes: &[u8]) -> Vec<u8> {
        let mut value = bytes
            .iter()
            .skip_while(|b| **b == 0)
            .copied()
            .collect::<Vec<_>>();
        if value.is_empty() {
            value.push(0);
        }
        if value[0] & 0x80 != 0 {
            value.insert(0, 0);
        }
        let mut encoded = vec![0x02, value.len() as u8];
        encoded.extend(value);
        encoded
    }

    let mut r_enc = encode_integer(r);
    let mut s_enc = encode_integer(s);
    let total_len = (r_enc.len() + s_enc.len()) as u8;
    let mut der = vec![0x30, total_len];
    der.append(&mut r_enc);
    der.append(&mut s_enc);
    Ok(der)
}

pub fn digest_for_algorithm(algorithm: &SigningAlgorithm, payload: &[u8]) -> Result<Vec<u8>> {
    let digest = match algorithm.as_str() {
        "ES256" | "PS256" | "RS256" => Sha256::digest(payload).to_vec(),
        "ES384" | "PS384" | "RS384" => Sha384::digest(payload).to_vec(),
        "ES512" | "PS512" | "RS512" => Sha512::digest(payload).to_vec(),
        other => {
            return Err(anyhow!(
                "algorithm '{}' is not supported by digest_for_algorithm",
                other
            ))
        }
    };
    Ok(digest)
}

fn decode_base64_url(value: &str) -> Result<Vec<u8>> {
    BASE64_URL_SAFE
        .decode(value.as_bytes())
        .map_err(|err| anyhow!("failed to decode base64url field: {err}"))
}

fn jwk_str<'a>(jwk: &'a Jwk, field: &str) -> Result<&'a str> {
    jwk.fields
        .get(field)
        .and_then(Value::as_str)
        .ok_or_else(|| anyhow!("JWK missing '{}'", field))
}

fn pad_coordinate(bytes: &[u8], len: usize) -> Result<Vec<u8>> {
    if bytes.len() > len {
        return Err(anyhow!(
            "coordinate length {} exceeds expected {} bytes",
            bytes.len(),
            len
        ));
    }
    if bytes.len() == len {
        return Ok(bytes.to_vec());
    }
    let mut padded = vec![0u8; len];
    padded[len - bytes.len()..].copy_from_slice(bytes);
    Ok(padded)
}

fn uncompressed_point(x: &[u8], y: &[u8]) -> Vec<u8> {
    let mut encoded = Vec::with_capacity(1 + x.len() + y.len());
    encoded.push(0x04);
    encoded.extend_from_slice(x);
    encoded.extend_from_slice(y);
    encoded
}

fn try_verify_with_jwk(
    algorithm: &SigningAlgorithm,
    jwk: &Jwk,
    payload: &[u8],
    signature: &[u8],
) -> Result<Option<bool>> {
    let kty = jwk_str(jwk, "kty")?;
    match kty {
        "OKP" => verify_okp_jwk(algorithm, jwk, payload, signature),
        "EC" => verify_ec_jwk(algorithm, jwk, payload, signature),
        "RSA" => verify_rsa_jwk(algorithm, jwk, payload, signature),
        _ => Ok(None),
    }
}

fn verify_okp_jwk(
    algorithm: &SigningAlgorithm,
    jwk: &Jwk,
    payload: &[u8],
    signature: &[u8],
) -> Result<Option<bool>> {
    if !algorithm.is_edwards() {
        return Ok(None);
    }
    let crv = jwk_str(jwk, "crv")?;
    if crv != "Ed25519" {
        return Err(anyhow!(
            "unsupported OKP curve '{}' for algorithm '{}'",
            crv,
            algorithm.as_str()
        ));
    }
    let x = decode_base64_url(jwk_str(jwk, "x")?)?;
    if x.len() != 32 {
        return Err(anyhow!(
            "Ed25519 public key must be 32 bytes; got {} bytes",
            x.len()
        ));
    }
    if signature.len() != 64 {
        return Ok(Some(false));
    }
    let key_bytes: [u8; 32] = x
        .as_slice()
        .try_into()
        .map_err(|_| anyhow!("invalid Ed25519 public key length"))?;
    let verifying_key = Ed25519VerifyingKey::from_bytes(&key_bytes)
        .map_err(|err| anyhow!("invalid Ed25519 public key: {err}"))?;
    let mut sig_bytes = [0u8; 64];
    sig_bytes.copy_from_slice(signature);
    let sig = Ed25519Signature::from_bytes(&sig_bytes);
    Ok(Some(verifying_key.verify(payload, &sig).is_ok()))
}

fn verify_ec_jwk(
    algorithm: &SigningAlgorithm,
    jwk: &Jwk,
    payload: &[u8],
    signature: &[u8],
) -> Result<Option<bool>> {
    if !algorithm.is_ecdsa() {
        return Ok(None);
    }
    let crv = jwk_str(jwk, "crv")?;
    let x = decode_base64_url(jwk_str(jwk, "x")?)?;
    let y = decode_base64_url(jwk_str(jwk, "y")?)?;
    match (crv, algorithm.as_str()) {
        ("P-256", "ES256") => {
            let x = pad_coordinate(&x, 32)?;
            let y = pad_coordinate(&y, 32)?;
            let encoded = uncompressed_point(&x, &y);
            let verifying_key = P256VerifyingKey::from_sec1_bytes(&encoded)
                .map_err(|err| anyhow!("invalid P-256 public key: {err}"))?;
            let sig = P256Signature::from_der(signature)
                .map_err(|_| anyhow!("invalid P-256 ECDSA signature encoding"))?;
            Ok(Some(verifying_key.verify(payload, &sig).is_ok()))
        }
        ("P-384", "ES384") => {
            let x = pad_coordinate(&x, 48)?;
            let y = pad_coordinate(&y, 48)?;
            let encoded = uncompressed_point(&x, &y);
            let verifying_key = P384VerifyingKey::from_sec1_bytes(&encoded)
                .map_err(|err| anyhow!("invalid P-384 public key: {err}"))?;
            let sig = P384Signature::from_der(signature)
                .map_err(|_| anyhow!("invalid P-384 ECDSA signature encoding"))?;
            Ok(Some(verifying_key.verify(payload, &sig).is_ok()))
        }
        ("P-521", "ES512") => {
            let x = pad_coordinate(&x, 66)?;
            let y = pad_coordinate(&y, 66)?;
            let encoded = uncompressed_point(&x, &y);
            let verifying_key = P521VerifyingKey::from_sec1_bytes(&encoded)
                .map_err(|err| anyhow!("invalid P-521 public key: {err}"))?;
            let sig = P521Signature::from_der(signature)
                .map_err(|_| anyhow!("invalid P-521 ECDSA signature encoding"))?;
            Ok(Some(verifying_key.verify(payload, &sig).is_ok()))
        }
        _ => Err(anyhow!(
            "EC curve '{}' is not compatible with algorithm '{}'",
            crv,
            algorithm.as_str()
        )),
    }
}

fn verify_rsa_jwk(
    algorithm: &SigningAlgorithm,
    jwk: &Jwk,
    payload: &[u8],
    signature: &[u8],
) -> Result<Option<bool>> {
    if !algorithm.is_rsa() {
        return Ok(None);
    }
    let n = decode_base64_url(jwk_str(jwk, "n")?)?;
    let e = decode_base64_url(jwk_str(jwk, "e")?)?;
    let modulus = BigUint::from_bytes_be(&n);
    let exponent = BigUint::from_bytes_be(&e);
    let public_key = RsaPublicKey::new(modulus, exponent).context("invalid RSA key components")?;
    let result = match algorithm.as_str() {
        "RS256" => verify_rsa_pkcs1::<Sha256>(&public_key, payload, signature)?,
        "RS384" => verify_rsa_pkcs1::<Sha384>(&public_key, payload, signature)?,
        "RS512" => verify_rsa_pkcs1::<Sha512>(&public_key, payload, signature)?,
        "PS256" => verify_rsa_pss::<Sha256>(&public_key, payload, signature)?,
        "PS384" => verify_rsa_pss::<Sha384>(&public_key, payload, signature)?,
        "PS512" => verify_rsa_pss::<Sha512>(&public_key, payload, signature)?,
        other => return Err(anyhow!("unsupported RSA algorithm '{}'", other)),
    };
    Ok(Some(result))
}

fn verify_rsa_pkcs1<D>(public_key: &RsaPublicKey, payload: &[u8], signature: &[u8]) -> Result<bool>
where
    D: Digest + Default + Clone + AssociatedOid,
{
    let verifier = pkcs1v15::VerifyingKey::<D>::new(public_key.clone());
    let sig = pkcs1v15::Signature::try_from(signature)
        .map_err(|_| anyhow!("invalid RSA signature length"))?;
    Ok(verifier.verify(payload, &sig).is_ok())
}

fn verify_rsa_pss<D>(public_key: &RsaPublicKey, payload: &[u8], signature: &[u8]) -> Result<bool>
where
    D: Digest + Default + Clone + FixedOutputReset,
{
    let verifier = pss::VerifyingKey::<D>::new(public_key.clone());
    let sig = pss::Signature::try_from(signature)
        .map_err(|_| anyhow!("invalid RSA-PSS signature length"))?;
    Ok(verifier.verify(payload, &sig).is_ok())
}

fn verify_rsa_pkcs1v15_sha256(spki_der: &[u8], payload: &[u8], signature: &[u8]) -> Result<bool> {
    let verifier = pkcs1v15::VerifyingKey::<Sha256>::from_public_key_der(spki_der)
        .context("invalid RSA SPKI")?;
    let sig = pkcs1v15::Signature::try_from(signature)
        .map_err(|_| anyhow!("invalid RSA signature length"))?;
    Ok(verifier.verify(payload, &sig).is_ok())
}

fn build_oct_jwk(key: &[u8]) -> Result<(Jwk, String)> {
    let encoded = BASE64_URL_SAFE.encode(key);
    let mut fields = Map::new();
    fields.insert("kty".into(), Value::String("oct".into()));
    fields.insert("k".into(), Value::String(encoded));
    finalize_jwk(fields)
}

fn build_ed25519_jwk(public_key: &[u8]) -> Result<(Jwk, String)> {
    let encoded = BASE64_URL_SAFE.encode(public_key);
    let mut fields = Map::new();
    fields.insert("kty".into(), Value::String("OKP".into()));
    fields.insert("crv".into(), Value::String("Ed25519".into()));
    fields.insert("x".into(), Value::String(encoded));
    finalize_jwk(fields)
}

fn finalize_jwk(mut fields: Map<String, Value>) -> Result<(Jwk, String)> {
    let jwk = Jwk {
        fields: fields.clone(),
    };
    let kid = jwk_thumbprint(&jwk)?;
    fields.insert("kid".into(), Value::String(kid.clone()));
    Ok((Jwk { fields }, kid))
}

fn jwk_thumbprint(jwk: &Jwk) -> Result<String> {
    let kty = jwk
        .fields
        .get("kty")
        .and_then(Value::as_str)
        .ok_or_else(|| anyhow!("JWK missing 'kty'"))?;
    let canonical = match kty {
        "oct" => {
            let k = jwk
                .fields
                .get("k")
                .and_then(Value::as_str)
                .ok_or_else(|| anyhow!("octet JWK missing 'k'"))?;
            canonical_thumbprint(&[("kty", "oct"), ("k", k)])
        }
        "OKP" => {
            let crv = jwk
                .fields
                .get("crv")
                .and_then(Value::as_str)
                .ok_or_else(|| anyhow!("OKP JWK missing 'crv'"))?;
            let x = jwk
                .fields
                .get("x")
                .and_then(Value::as_str)
                .ok_or_else(|| anyhow!("OKP JWK missing 'x'"))?;
            canonical_thumbprint(&[("crv", crv), ("kty", "OKP"), ("x", x)])
        }
        other => {
            return Err(anyhow!(
                "unsupported JWK kty '{}' for thumbprint computation",
                other
            ))
        }
    }?;
    let digest = Sha256::digest(canonical.as_bytes());
    Ok(BASE64_URL_SAFE.encode(digest))
}

fn canonical_thumbprint(fields: &[(&str, &str)]) -> Result<String> {
    let mut map = BTreeMap::new();
    for (key, value) in fields {
        map.insert(key.to_string(), Value::String(value.to_string()));
    }
    serde_json::to_string(&map).map_err(|err| anyhow!("failed to serialise thumbprint map: {err}"))
}

fn base64_url(bytes: &[u8]) -> String {
    BASE64_URL_SAFE.encode(bytes)
}

fn trim_leading_zeroes(bytes: &[u8]) -> &[u8] {
    let mut idx = 0;
    while idx < bytes.len() && bytes[idx] == 0 {
        idx += 1;
    }
    &bytes[idx..]
}

fn decode_pem(pem: &str) -> Result<Vec<u8>> {
    let body: String = pem
        .lines()
        .filter_map(|line| {
            let trimmed = line.trim();
            if trimmed.starts_with("-----") || trimmed.is_empty() {
                None
            } else {
                Some(trimmed)
            }
        })
        .collect();
    BASE64
        .decode(body.as_bytes())
        .map_err(|err| anyhow!("failed to decode PEM body: {err}"))
}

#[cfg(feature = "jwk-gcp")]
pub fn jwk_from_gcp_public_key(
    pem: &str,
    kid: &str,
    algorithm: &SigningAlgorithm,
    hint: &str,
) -> Result<Jwk> {
    let der = decode_pem(pem)?;
    let spki =
        SubjectPublicKeyInfoOwned::from_der(&der).context("failed to parse GCP public key")?;
    if algorithm.is_edwards() {
        return jwk_from_ed25519_spki(&spki, kid);
    }
    if algorithm.is_ecdsa() {
        let (curve, coord_len) = match algorithm.as_str() {
            "ES256" => ("P-256", 32),
            "ES384" => ("P-384", 48),
            "ES512" => ("P-521", 66),
            other => {
                return Err(anyhow!(
                    "unsupported ECDSA algorithm '{}' for automatic public key parsing; {}",
                    other,
                    hint
                ))
            }
        };
        return jwk_from_ec_spki(&spki, curve, coord_len, kid);
    }
    if algorithm.is_rsa() {
        return jwk_from_rsa_spki(&spki, kid);
    }
    Err(anyhow!(
        "automatic public key parsing is not available for algorithm '{}'; {}",
        algorithm.as_str(),
        hint
    ))
}

#[cfg(any(feature = "jwk-aws", feature = "jwk-gcp"))]
fn jwk_from_ed25519_spki(spki: &SubjectPublicKeyInfoOwned, kid: &str) -> Result<Jwk> {
    let ed_oid = ObjectIdentifier::new("1.3.101.112")
        .map_err(|err| anyhow!("failed to construct Ed25519 OID: {err}"))?;
    if spki.algorithm.oid != ed_oid {
        return Err(anyhow!("public key is not Ed25519"));
    }
    let pk = spki.subject_public_key.raw_bytes();
    if pk.len() != 32 {
        return Err(anyhow!(
            "Ed25519 public key must be 32 bytes; got {}",
            pk.len()
        ));
    }
    let (jwk, _) = build_ed25519_jwk(pk)?;
    Ok(attach_kid(jwk, kid))
}

type HmacSha256 = Hmac<Sha256>;
type HmacSha384 = Hmac<Sha384>;
type HmacSha512 = Hmac<Sha512>;

const TRUST_SIGNING_KEY_ENV: &str = "FLEETFORGE_TRUST_SIGNING_KEY";
const TRUST_SIGNING_KEY_PATH_ENV: &str = "FLEETFORGE_TRUST_SIGNING_KEY_PATH";
const SCITT_SIGNING_KEY_ENV: &str = "FLEETFORGE_SCITT_KEY";
const SCITT_SIGNING_KEY_PATH_ENV: &str = "FLEETFORGE_SCITT_KEY_PATH";
const CAPABILITY_SIGNING_KEY_ENV: &str = "FLEETFORGE_CAPABILITY_KEY";
const CAPABILITY_SIGNING_KEY_PATH_ENV: &str = "FLEETFORGE_CAPABILITY_KEY_PATH";
const C2PA_SIGNING_KEY_ENV: &str = "FLEETFORGE_C2PA_KEY";
const C2PA_SIGNING_KEY_PATH_ENV: &str = "FLEETFORGE_C2PA_KEY_PATH";
const TRUST_SIGNER_BACKEND_ENV: &str = "FLEETFORGE_TRUST_SIGNER_BACKEND";
const TRUST_SIGNER_ALGORITHM_ENV: &str = "FLEETFORGE_TRUST_SIGNER_ALGORITHM";
const TRUST_SIGNER_PUBLIC_KEY_ENV: &str = "FLEETFORGE_TRUST_SIGNER_PUBLIC_KEY";
const TRUST_SIGNER_PUBLIC_KEY_PATH_ENV: &str = "FLEETFORGE_TRUST_SIGNER_PUBLIC_KEY_PATH";
const TRUST_SIGNER_AWS_KEY_ENV: &str = "FLEETFORGE_TRUST_SIGNER_AWS_KEY_ID";
const TRUST_SIGNER_AWS_PROFILE_ENV: &str = "FLEETFORGE_TRUST_SIGNER_AWS_PROFILE";
const TRUST_SIGNER_AWS_REGION_ENV: &str = "FLEETFORGE_TRUST_SIGNER_AWS_REGION";
const TRUST_SIGNER_GCP_KEY_ENV: &str = "FLEETFORGE_TRUST_SIGNER_GCP_KEY_VERSION";
const TRUST_SIGNER_GCP_DIGEST_ENV: &str = "FLEETFORGE_TRUST_SIGNER_GCP_DIGEST";
const TRUST_SIGNER_AZURE_KEY_ENV: &str = "FLEETFORGE_TRUST_SIGNER_AZURE_KEY_ID";
const TRUST_SIGNER_CLI_BIN_ENV: &str = "FLEETFORGE_TRUST_SIGNER_CLI";
const SCITT_SIGNER_BACKEND_ENV: &str = "FLEETFORGE_SCITT_SIGNER_BACKEND";
const SCITT_SIGNER_ALGORITHM_ENV: &str = "FLEETFORGE_SCITT_SIGNER_ALGORITHM";
const SCITT_SIGNER_PUBLIC_KEY_ENV: &str = "FLEETFORGE_SCITT_SIGNER_PUBLIC_KEY";
const SCITT_SIGNER_PUBLIC_KEY_PATH_ENV: &str = "FLEETFORGE_SCITT_SIGNER_PUBLIC_KEY_PATH";
const SCITT_SIGNER_AWS_KEY_ENV: &str = "FLEETFORGE_SCITT_SIGNER_AWS_KEY_ID";
const SCITT_SIGNER_AWS_PROFILE_ENV: &str = "FLEETFORGE_SCITT_SIGNER_AWS_PROFILE";
const SCITT_SIGNER_AWS_REGION_ENV: &str = "FLEETFORGE_SCITT_SIGNER_AWS_REGION";
const SCITT_SIGNER_GCP_KEY_ENV: &str = "FLEETFORGE_SCITT_SIGNER_GCP_KEY_VERSION";
const SCITT_SIGNER_GCP_DIGEST_ENV: &str = "FLEETFORGE_SCITT_SIGNER_GCP_DIGEST";
const SCITT_SIGNER_AZURE_KEY_ENV: &str = "FLEETFORGE_SCITT_SIGNER_AZURE_KEY_ID";
const SCITT_SIGNER_CLI_BIN_ENV: &str = "FLEETFORGE_SCITT_SIGNER_CLI";
const CAPABILITY_SIGNER_BACKEND_ENV: &str = "FLEETFORGE_CAPABILITY_SIGNER_BACKEND";
const CAPABILITY_SIGNER_ALGORITHM_ENV: &str = "FLEETFORGE_CAPABILITY_SIGNER_ALGORITHM";
const CAPABILITY_SIGNER_PUBLIC_KEY_ENV: &str = "FLEETFORGE_CAPABILITY_SIGNER_PUBLIC_KEY";
const CAPABILITY_SIGNER_PUBLIC_KEY_PATH_ENV: &str = "FLEETFORGE_CAPABILITY_SIGNER_PUBLIC_KEY_PATH";
const CAPABILITY_SIGNER_AWS_KEY_ENV: &str = "FLEETFORGE_CAPABILITY_SIGNER_AWS_KEY_ID";
const CAPABILITY_SIGNER_AWS_PROFILE_ENV: &str = "FLEETFORGE_CAPABILITY_SIGNER_AWS_PROFILE";
const CAPABILITY_SIGNER_AWS_REGION_ENV: &str = "FLEETFORGE_CAPABILITY_SIGNER_AWS_REGION";
const CAPABILITY_SIGNER_GCP_KEY_ENV: &str = "FLEETFORGE_CAPABILITY_SIGNER_GCP_KEY_VERSION";
const CAPABILITY_SIGNER_GCP_DIGEST_ENV: &str = "FLEETFORGE_CAPABILITY_SIGNER_GCP_DIGEST";
const CAPABILITY_SIGNER_AZURE_KEY_ENV: &str = "FLEETFORGE_CAPABILITY_SIGNER_AZURE_KEY_ID";
const CAPABILITY_SIGNER_CLI_BIN_ENV: &str = "FLEETFORGE_CAPABILITY_SIGNER_CLI";
const C2PA_SIGNER_BACKEND_ENV: &str = "FLEETFORGE_C2PA_SIGNER_BACKEND";
const C2PA_SIGNER_ALGORITHM_ENV: &str = "FLEETFORGE_C2PA_SIGNER_ALGORITHM";
const C2PA_SIGNER_PUBLIC_KEY_ENV: &str = "FLEETFORGE_C2PA_SIGNER_PUBLIC_KEY";
const C2PA_SIGNER_PUBLIC_KEY_PATH_ENV: &str = "FLEETFORGE_C2PA_SIGNER_PUBLIC_KEY_PATH";
const C2PA_SIGNER_AWS_KEY_ENV: &str = "FLEETFORGE_C2PA_SIGNER_AWS_KEY_ID";
const C2PA_SIGNER_AWS_PROFILE_ENV: &str = "FLEETFORGE_C2PA_SIGNER_AWS_PROFILE";
const C2PA_SIGNER_AWS_REGION_ENV: &str = "FLEETFORGE_C2PA_SIGNER_AWS_REGION";
const C2PA_SIGNER_GCP_KEY_ENV: &str = "FLEETFORGE_C2PA_SIGNER_GCP_KEY_VERSION";
const C2PA_SIGNER_GCP_DIGEST_ENV: &str = "FLEETFORGE_C2PA_SIGNER_GCP_DIGEST";
const C2PA_SIGNER_AZURE_KEY_ENV: &str = "FLEETFORGE_C2PA_SIGNER_AZURE_KEY_ID";
const C2PA_SIGNER_CLI_BIN_ENV: &str = "FLEETFORGE_C2PA_SIGNER_CLI";

struct SignerSlot {
    label: &'static str,
    backend_env: &'static str,
    algorithm_env: &'static str,
    key_env: &'static str,
    key_path_env: &'static str,
    public_key_env: &'static str,
    public_key_path_env: &'static str,
    aws_key_env: &'static str,
    aws_profile_env: &'static str,
    aws_region_env: &'static str,
    gcp_key_env: &'static str,
    gcp_digest_env: &'static str,
    azure_key_env: &'static str,
    cli_bin_env: &'static str,
}

const TRUST_SIGNER_SLOT: SignerSlot = SignerSlot {
    label: "trust",
    backend_env: TRUST_SIGNER_BACKEND_ENV,
    algorithm_env: TRUST_SIGNER_ALGORITHM_ENV,
    key_env: TRUST_SIGNING_KEY_ENV,
    key_path_env: TRUST_SIGNING_KEY_PATH_ENV,
    public_key_env: TRUST_SIGNER_PUBLIC_KEY_ENV,
    public_key_path_env: TRUST_SIGNER_PUBLIC_KEY_PATH_ENV,
    aws_key_env: TRUST_SIGNER_AWS_KEY_ENV,
    aws_profile_env: TRUST_SIGNER_AWS_PROFILE_ENV,
    aws_region_env: TRUST_SIGNER_AWS_REGION_ENV,
    gcp_key_env: TRUST_SIGNER_GCP_KEY_ENV,
    gcp_digest_env: TRUST_SIGNER_GCP_DIGEST_ENV,
    azure_key_env: TRUST_SIGNER_AZURE_KEY_ENV,
    cli_bin_env: TRUST_SIGNER_CLI_BIN_ENV,
};

const SCITT_SIGNER_SLOT: SignerSlot = SignerSlot {
    label: "scitt",
    backend_env: SCITT_SIGNER_BACKEND_ENV,
    algorithm_env: SCITT_SIGNER_ALGORITHM_ENV,
    key_env: SCITT_SIGNING_KEY_ENV,
    key_path_env: SCITT_SIGNING_KEY_PATH_ENV,
    public_key_env: SCITT_SIGNER_PUBLIC_KEY_ENV,
    public_key_path_env: SCITT_SIGNER_PUBLIC_KEY_PATH_ENV,
    aws_key_env: SCITT_SIGNER_AWS_KEY_ENV,
    aws_profile_env: SCITT_SIGNER_AWS_PROFILE_ENV,
    aws_region_env: SCITT_SIGNER_AWS_REGION_ENV,
    gcp_key_env: SCITT_SIGNER_GCP_KEY_ENV,
    gcp_digest_env: SCITT_SIGNER_GCP_DIGEST_ENV,
    azure_key_env: SCITT_SIGNER_AZURE_KEY_ENV,
    cli_bin_env: SCITT_SIGNER_CLI_BIN_ENV,
};

const CAPABILITY_SIGNER_SLOT: SignerSlot = SignerSlot {
    label: "capability",
    backend_env: CAPABILITY_SIGNER_BACKEND_ENV,
    algorithm_env: CAPABILITY_SIGNER_ALGORITHM_ENV,
    key_env: CAPABILITY_SIGNING_KEY_ENV,
    key_path_env: CAPABILITY_SIGNING_KEY_PATH_ENV,
    public_key_env: CAPABILITY_SIGNER_PUBLIC_KEY_ENV,
    public_key_path_env: CAPABILITY_SIGNER_PUBLIC_KEY_PATH_ENV,
    aws_key_env: CAPABILITY_SIGNER_AWS_KEY_ENV,
    aws_profile_env: CAPABILITY_SIGNER_AWS_PROFILE_ENV,
    aws_region_env: CAPABILITY_SIGNER_AWS_REGION_ENV,
    gcp_key_env: CAPABILITY_SIGNER_GCP_KEY_ENV,
    gcp_digest_env: CAPABILITY_SIGNER_GCP_DIGEST_ENV,
    azure_key_env: CAPABILITY_SIGNER_AZURE_KEY_ENV,
    cli_bin_env: CAPABILITY_SIGNER_CLI_BIN_ENV,
};

const C2PA_SIGNER_SLOT: SignerSlot = SignerSlot {
    label: "c2pa",
    backend_env: C2PA_SIGNER_BACKEND_ENV,
    algorithm_env: C2PA_SIGNER_ALGORITHM_ENV,
    key_env: C2PA_SIGNING_KEY_ENV,
    key_path_env: C2PA_SIGNING_KEY_PATH_ENV,
    public_key_env: C2PA_SIGNER_PUBLIC_KEY_ENV,
    public_key_path_env: C2PA_SIGNER_PUBLIC_KEY_PATH_ENV,
    aws_key_env: C2PA_SIGNER_AWS_KEY_ENV,
    aws_profile_env: C2PA_SIGNER_AWS_PROFILE_ENV,
    aws_region_env: C2PA_SIGNER_AWS_REGION_ENV,
    gcp_key_env: C2PA_SIGNER_GCP_KEY_ENV,
    gcp_digest_env: C2PA_SIGNER_GCP_DIGEST_ENV,
    azure_key_env: C2PA_SIGNER_AZURE_KEY_ENV,
    cli_bin_env: C2PA_SIGNER_CLI_BIN_ENV,
};

fn configured_algorithm(slot: &SignerSlot) -> Result<Option<SigningAlgorithm>> {
    match env::var(slot.algorithm_env) {
        Ok(value) => {
            let trimmed = value.trim();
            if trimmed.is_empty() {
                Ok(None)
            } else {
                SigningAlgorithm::parse(trimmed).map(Some)
            }
        }
        Err(_) => Ok(None),
    }
}

fn resolve_signer(slot: &SignerSlot, strict: bool) -> Result<Arc<dyn Signer>> {
    let backend_value = env::var(slot.backend_env).unwrap_or_else(|_| "env-hmac".to_string());
    let backend = backend_value.trim().to_ascii_lowercase();
    match backend.as_str() {
        "" | "env" | "env-hmac" => resolve_hmac_signer(slot, strict),
        "env-ed25519" | "env-edwards" => resolve_ed25519_signer(slot, strict),
        "aws-kms-cli" => {
            ensure_feature_allowed(LicensedFeature::ExternalKms)?;
            #[cfg(feature = "kms-cli-aws")]
            {
                AwsKmsCliSigner::new(slot).map(|signer| Arc::new(signer) as Arc<dyn Signer>)
            }
            #[cfg(not(feature = "kms-cli-aws"))]
            {
                Err(anyhow!(
                    "{} signer backend 'aws-kms-cli' requires enabling the 'kms-cli-aws' feature",
                    slot.label
                ))
            }
        }
        "gcp-kms-cli" => {
            ensure_feature_allowed(LicensedFeature::ExternalKms)?;
            #[cfg(feature = "kms-cli-gcp")]
            {
                GcpKmsCliSigner::new(slot).map(|signer| Arc::new(signer) as Arc<dyn Signer>)
            }
            #[cfg(not(feature = "kms-cli-gcp"))]
            {
                Err(anyhow!(
                    "{} signer backend 'gcp-kms-cli' requires enabling the 'kms-cli-gcp' feature",
                    slot.label
                ))
            }
        }
        "azure-kv-cli" => {
            ensure_feature_allowed(LicensedFeature::ExternalKms)?;
            #[cfg(feature = "kms-cli-azure")]
            {
                AzureKvCliSigner::new(slot).map(|signer| Arc::new(signer) as Arc<dyn Signer>)
            }
            #[cfg(not(feature = "kms-cli-azure"))]
            {
                Err(anyhow!(
                    "{} signer backend 'azure-kv-cli' requires enabling the 'kms-cli-azure' feature",
                    slot.label
                ))
            }
        }
        other => Err(anyhow!(
            "unsupported signer backend '{}' for {} signer",
            other,
            slot.label
        )),
    }
}

fn cli_path_exists(binary: &str) -> bool {
    let path = Path::new(binary);
    if path.is_absolute() || path.components().count() > 1 {
        path.exists()
    } else {
        which(binary).is_ok()
    }
}

const AWS_CLI_GUIDANCE: &str = "Install the AWS CLI (https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html) and run `aws configure` (or export AWS_PROFILE/AWS_REGION) before using this backend.";
const GCP_CLI_GUIDANCE: &str = "Install the Google Cloud CLI (https://cloud.google.com/sdk/docs/install) and run `gcloud auth application-default login` so the signer can call Cloud KMS.";
const AZURE_CLI_GUIDANCE: &str = "Install the Azure CLI (https://learn.microsoft.com/cli/azure/install-azure-cli) and run `az login` (or configure managed identity) before using this backend.";

fn require_cli(binary: &str, context: &str, guidance: &str) -> Result<()> {
    if cli_path_exists(binary) {
        Ok(())
    } else {
        Err(anyhow!(
            "{} requires the '{}' CLI but it was not found. {}",
            context,
            binary,
            guidance
        ))
    }
}

fn map_cli_error(action: &str, binary: &str, guidance: &str, err: ProcessError) -> anyhow::Error {
    match err {
        ProcessError::Spawn { source, .. } => anyhow!(
            "{} failed to start '{}': {}. {}",
            action,
            binary,
            source,
            guidance
        ),
        ProcessError::Timeout {
            timeout,
            stdout,
            stderr,
            ..
        } => anyhow!(
            "{} via '{}' timed out after {:?}. stderr: {} stdout: {}. {}",
            action,
            binary,
            timeout,
            summarize_cli_output(&stderr),
            summarize_cli_output(&stdout),
            guidance
        ),
        ProcessError::NonZeroExit {
            code,
            stdout,
            stderr,
            ..
        } => anyhow!(
            "{} via '{}' exited with status {:?}. stderr: {} stdout: {}. {}",
            action,
            binary,
            code,
            summarize_cli_output(&stderr),
            summarize_cli_output(&stdout),
            guidance
        ),
        ProcessError::Wait { source, .. } => anyhow!(
            "{} via '{}' failed while waiting for completion: {}. {}",
            action,
            binary,
            source,
            guidance
        ),
        ProcessError::Output { source, .. } => anyhow!(
            "{} via '{}' failed to collect CLI output: {}. {}",
            action,
            binary,
            source,
            guidance
        ),
        ProcessError::ReaderPanicked { .. } => anyhow!(
            "{} via '{}' aborted while reading CLI output. {}",
            action,
            binary,
            guidance
        ),
        ProcessError::Json { stdout, source, .. } => anyhow!(
            "{} via '{}' returned invalid JSON: {} (stdout: {}). {}",
            action,
            binary,
            source,
            summarize_cli_output(&stdout),
            guidance
        ),
    }
}

fn summarize_cli_output(output: &str) -> String {
    let trimmed = output.trim();
    if trimmed.is_empty() {
        return "n/a".to_string();
    }
    let max_len = 240;
    if trimmed.len() > max_len {
        format!("{}…", &trimmed[..max_len])
    } else {
        trimmed.to_string()
    }
}

fn resolve_hmac_signer(slot: &SignerSlot, strict: bool) -> Result<Arc<dyn Signer>> {
    let algorithm = configured_algorithm(slot)?;
    if let Some(ref alg) = algorithm {
        if !alg.is_hmac() {
            return Err(anyhow!(
                "{} signer backend 'env-hmac' only supports HS256/HS384/HS512 algorithms",
                slot.label
            ));
        }
    }
    match load_key_material(slot.key_path_env, slot.key_env, slot.label, strict)? {
        Some((key, _)) => Ok(Arc::new(TrustSigner::from_secret_with_algorithm(
            key,
            algorithm.clone(),
        )?)),
        None => {
            if strict {
                Err(anyhow!(
                    "{} signer requires key material (set {} or {})",
                    slot.label,
                    slot.key_env,
                    slot.key_path_env
                ))
            } else {
                Ok(Arc::new(TrustSigner::for_trust_with_algorithm(
                    algorithm.clone(),
                )))
            }
        }
    }
}

fn resolve_ed25519_signer(slot: &SignerSlot, strict: bool) -> Result<Arc<dyn Signer>> {
    if let Some(alg) = configured_algorithm(slot)? {
        if !alg.is_edwards() {
            return Err(anyhow!(
                "{} signer backend 'env-ed25519' only supports EdDSA",
                slot.label
            ));
        }
    }
    match load_key_material(slot.key_path_env, slot.key_env, slot.label, strict)? {
        Some((secret, _)) => {
            let signer = Ed25519Signer::from_bytes(&secret)?;
            Ok(Arc::new(signer))
        }
        None => Err(anyhow!(
            "{} signer requires key material for Ed25519 (set {} or {})",
            slot.label,
            slot.key_env,
            slot.key_path_env
        )),
    }
}

#[cfg(feature = "kms-cli-aws")]
struct AwsKmsCliSigner {
    key_id: String,
    kid: String,
    algorithm: SigningAlgorithm,
    aws_algorithm: &'static str,
    binary: String,
    profile: Option<String>,
    region: Option<String>,
    public_key: Option<Jwk>,
    fetched_public_key: OnceCell<Jwk>,
}

#[cfg(feature = "kms-cli-aws")]
impl AwsKmsCliSigner {
    fn new(slot: &SignerSlot) -> Result<Self> {
        let algorithm =
            configured_algorithm(slot)?.unwrap_or_else(|| SigningAlgorithm::new("PS256"));
        let aws_algorithm = map_aws_algorithm(&algorithm)?;
        let key_id = env::var(slot.aws_key_env).map_err(|_| {
            anyhow!(
                "{} signer backend 'aws-kms-cli' requires {} to be set",
                slot.label,
                slot.aws_key_env
            )
        })?;
        let kid = format!("aws-kms:{}", key_id);
        let binary = env::var(slot.cli_bin_env).unwrap_or_else(|_| "aws".into());
        require_cli(
            &binary,
            &format!("{} signer backend 'aws-kms-cli'", slot.label),
            AWS_CLI_GUIDANCE,
        )?;
        let profile = env::var(slot.aws_profile_env).ok();
        let region = env::var(slot.aws_region_env).ok();
        let public_key = load_jwk_from_env(slot.public_key_env, slot.public_key_path_env)?
            .map(|jwk| attach_kid(jwk, &kid));
        Ok(Self {
            key_id,
            kid,
            algorithm,
            aws_algorithm,
            binary,
            profile,
            region,
            public_key,
            fetched_public_key: OnceCell::new(),
        })
    }

    fn fetch_public_key(&self) -> Result<Jwk> {
        #[derive(Deserialize)]
        struct AwsPublicKeyResponse {
            #[serde(rename = "PublicKey")]
            public_key: String,
            #[serde(rename = "KeySpec")]
            key_spec: String,
        }
        let resp: AwsPublicKeyResponse = ProcessRunner::new(&self.binary)
            .args([
                "kms",
                "get-public-key",
                "--key-id",
                &self.key_id,
                "--output",
                "json",
            ])
            .env_opt("AWS_PROFILE", self.profile.clone())
            .env_opt("AWS_REGION", self.region.clone())
            .run_json()
            .map_err(|err| {
                map_cli_error(
                    "aws kms get-public-key",
                    &self.binary,
                    AWS_CLI_GUIDANCE,
                    err,
                )
            })?;
        let der = BASE64
            .decode(resp.public_key.as_bytes())
            .context("failed to decode AWS public key")?;
        jwk_from_aws_public_key(&der, &resp.key_spec, &self.kid)
    }
}

#[cfg(feature = "kms-cli-aws")]
impl Signer for AwsKmsCliSigner {
    fn algorithm(&self) -> SigningAlgorithm {
        self.algorithm.clone()
    }

    fn key_id(&self) -> &str {
        &self.kid
    }

    fn public_key_jwk(&self) -> Result<Jwk> {
        if let Some(jwk) = &self.public_key {
            return Ok(jwk.clone());
        }
        if let Some(jwk) = self.fetched_public_key.get() {
            return Ok(jwk.clone());
        }
        let jwk = self.fetch_public_key()?;
        let _ = self.fetched_public_key.set(jwk.clone());
        Ok(jwk)
    }

    fn sign(&self, payload: &[u8]) -> Result<SignatureEnvelope> {
        let mut input_file = NamedTempFile::new().context("failed to create temp file")?;
        input_file
            .write_all(payload)
            .context("failed to write payload to temp file")?;
        let message_arg = format!("fileb://{}", input_file.path().display());
        let public_key = Some(self.public_key_jwk()?);
        #[derive(Deserialize)]
        struct AwsSignResponse {
            #[serde(rename = "Signature")]
            signature: String,
            #[serde(rename = "KeyId")]
            key_id: String,
        }
        let resp: AwsSignResponse = ProcessRunner::new(&self.binary)
            .args([
                "kms",
                "sign",
                "--key-id",
                &self.key_id,
                "--message",
                &message_arg,
                "--message-type",
                "RAW",
                "--signing-algorithm",
                self.aws_algorithm,
                "--output",
                "json",
            ])
            .env_opt("AWS_PROFILE", self.profile.clone())
            .env_opt("AWS_REGION", self.region.clone())
            .run_json()
            .map_err(|err| map_cli_error("aws kms sign", &self.binary, AWS_CLI_GUIDANCE, err))?;
        let mut signature = BASE64
            .decode(resp.signature.as_bytes())
            .context("invalid signature output")?;
        signature = normalize_ecdsa_signature(&signature, &self.algorithm)?;
        Ok(SignatureEnvelope {
            algorithm: self.algorithm(),
            signature,
            key_id: format!("aws-kms:{}", resp.key_id),
            public_key,
        })
    }

    fn verify_via_backend(&self, payload: &[u8], signature: &[u8]) -> Result<bool> {
        let mut input_file = NamedTempFile::new().context("failed to create temp file")?;
        input_file
            .write_all(payload)
            .context("failed to write payload to temp file")?;
        let message_arg = format!("fileb://{}", input_file.path().display());
        let signature_b64 = BASE64.encode(signature);
        #[derive(Deserialize)]
        struct AwsVerifyResponse {
            #[serde(rename = "SignatureValid")]
            signature_valid: bool,
        }
        let resp: AwsVerifyResponse = ProcessRunner::new(&self.binary)
            .args([
                "kms",
                "verify",
                "--key-id",
                &self.key_id,
                "--message",
                &message_arg,
                "--message-type",
                "RAW",
                "--signature",
                &signature_b64,
                "--signing-algorithm",
                self.aws_algorithm,
                "--output",
                "json",
            ])
            .env_opt("AWS_PROFILE", self.profile.clone())
            .env_opt("AWS_REGION", self.region.clone())
            .run_json()
            .map_err(|err| map_cli_error("aws kms verify", &self.binary, AWS_CLI_GUIDANCE, err))?;
        Ok(resp.signature_valid)
    }
}

#[cfg(feature = "kms-cli-gcp")]
struct GcpKmsCliSigner {
    key_resource: String,
    kid: String,
    algorithm: SigningAlgorithm,
    digest_algorithm: Option<String>,
    signing_algorithm_flag: Option<String>,
    binary: String,
    public_key: Option<Jwk>,
    public_key_hint: String,
    fetched_public_key: OnceCell<Jwk>,
}

#[cfg(feature = "kms-cli-gcp")]
impl GcpKmsCliSigner {
    fn new(slot: &SignerSlot) -> Result<Self> {
        let algorithm =
            configured_algorithm(slot)?.unwrap_or_else(|| SigningAlgorithm::new("PS256"));
        match algorithm.as_str() {
            "ES256" | "PS256" | "RS256" | "EdDSA" => {}
            other => return Err(anyhow!("unsupported GCP signing algorithm '{}'", other)),
        }
        let (digest_algorithm, signing_algorithm_flag) = if algorithm.is_edwards() {
            (None, Some("ec-sign-ed25519".to_string()))
        } else {
            let mut digest = env::var(slot.gcp_digest_env).unwrap_or_else(|_| "SHA256".into());
            if digest.trim().is_empty() {
                digest = "SHA256".into();
            }
            (Some(digest), None)
        };
        let key_resource = env::var(slot.gcp_key_env).map_err(|_| {
            anyhow!(
                "{} signer backend 'gcp-kms-cli' requires {} to be set",
                slot.label,
                slot.gcp_key_env
            )
        })?;
        let kid = format!("gcp-kms:{}", key_resource);
        let binary = env::var(slot.cli_bin_env).unwrap_or_else(|_| "gcloud".into());
        require_cli(
            &binary,
            &format!("{} signer backend 'gcp-kms-cli'", slot.label),
            GCP_CLI_GUIDANCE,
        )?;
        let public_key = load_jwk_from_env(slot.public_key_env, slot.public_key_path_env)?
            .map(|jwk| attach_kid(jwk, &kid));
        let public_key_hint = format!(
            "set {} or {}",
            slot.public_key_env, slot.public_key_path_env
        );
        Ok(Self {
            key_resource,
            kid,
            algorithm,
            digest_algorithm,
            signing_algorithm_flag,
            binary,
            public_key,
            public_key_hint,
            fetched_public_key: OnceCell::new(),
        })
    }

    fn fetch_public_key(&self) -> Result<Jwk> {
        #[derive(Deserialize)]
        struct GcpPublicKeyResponse {
            pem: String,
        }
        let resp: GcpPublicKeyResponse = ProcessRunner::new(&self.binary)
            .args([
                "kms",
                "keys",
                "versions",
                "get-public-key",
                "--name",
                &self.key_resource,
                "--format",
                "json",
                "--quiet",
            ])
            .run_json()
            .map_err(|err| {
                map_cli_error(
                    "gcloud kms keys versions get-public-key",
                    &self.binary,
                    GCP_CLI_GUIDANCE,
                    err,
                )
            })?;
        jwk_from_gcp_public_key(&resp.pem, &self.kid, &self.algorithm, &self.public_key_hint)
    }
}

#[cfg(feature = "kms-cli-gcp")]
impl Signer for GcpKmsCliSigner {
    fn algorithm(&self) -> SigningAlgorithm {
        self.algorithm.clone()
    }

    fn key_id(&self) -> &str {
        &self.kid
    }

    fn public_key_jwk(&self) -> Result<Jwk> {
        if let Some(jwk) = &self.public_key {
            return Ok(jwk.clone());
        }
        if let Some(jwk) = self.fetched_public_key.get() {
            return Ok(jwk.clone());
        }
        let jwk = self.fetch_public_key()?;
        let _ = self.fetched_public_key.set(jwk.clone());
        Ok(jwk)
    }

    fn sign(&self, payload: &[u8]) -> Result<SignatureEnvelope> {
        let mut input_file = NamedTempFile::new().context("failed to create temp file")?;
        input_file
            .write_all(payload)
            .context("failed to write payload to temp file")?;
        #[derive(Deserialize)]
        struct GcpSignResponse {
            signature: String,
        }
        let mut runner = ProcessRunner::new(&self.binary).args([
            "kms",
            "keys",
            "versions",
            "asymmetric-sign",
            "--name",
            &self.key_resource,
            "--input-file",
            input_file.path().to_str().unwrap(),
            "--format",
            "json",
            "--quiet",
        ]);
        if let Some(sign_alg) = &self.signing_algorithm_flag {
            runner = runner.args(["--signing-algorithm", sign_alg]);
        } else if let Some(digest) = &self.digest_algorithm {
            runner = runner.args(["--digest-algorithm", digest]);
        }
        let public_key = Some(self.public_key_jwk()?);
        let resp: GcpSignResponse = runner.run_json().map_err(|err| {
            map_cli_error(
                "gcloud kms keys versions asymmetric-sign",
                &self.binary,
                GCP_CLI_GUIDANCE,
                err,
            )
        })?;
        let mut signature = BASE64
            .decode(resp.signature.as_bytes())
            .context("invalid gcloud signature output")?;
        signature = normalize_ecdsa_signature(&signature, &self.algorithm)?;
        Ok(SignatureEnvelope {
            algorithm: self.algorithm(),
            signature,
            key_id: self.kid.clone(),
            public_key,
        })
    }

    fn verify_via_backend(&self, payload: &[u8], signature: &[u8]) -> Result<bool> {
        let mut input_file = NamedTempFile::new().context("failed to create temp file")?;
        input_file
            .write_all(payload)
            .context("failed to write payload to temp file")?;
        let mut signature_file = NamedTempFile::new().context("failed to create signature file")?;
        signature_file
            .write_all(&BASE64.encode(signature).into_bytes())
            .context("failed to write signature to temp file")?;
        #[derive(Deserialize)]
        struct GcpVerifyResponse {
            verified: bool,
        }
        let mut runner = ProcessRunner::new(&self.binary).args([
            "kms",
            "keys",
            "versions",
            "asymmetric-verify",
            "--name",
            &self.key_resource,
            "--input-file",
            input_file.path().to_str().unwrap(),
            "--signature-file",
            signature_file.path().to_str().unwrap(),
            "--format",
            "json",
            "--quiet",
        ]);
        if let Some(sign_alg) = &self.signing_algorithm_flag {
            runner = runner.args(["--signing-algorithm", sign_alg]);
        } else if let Some(digest) = &self.digest_algorithm {
            runner = runner.args(["--digest-algorithm", digest]);
        }
        let resp: GcpVerifyResponse = runner.run_json().map_err(|err| {
            map_cli_error(
                "gcloud kms keys versions asymmetric-verify",
                &self.binary,
                GCP_CLI_GUIDANCE,
                err,
            )
        })?;
        Ok(resp.verified)
    }
}

#[cfg(feature = "kms-cli-azure")]
struct AzureKvCliSigner {
    key_id: String,
    kid: String,
    algorithm: SigningAlgorithm,
    azure_algorithm: String,
    binary: String,
    public_key: Option<Jwk>,
    fetched_public_key: OnceCell<Jwk>,
}

#[cfg(feature = "kms-cli-azure")]
impl AzureKvCliSigner {
    fn new(slot: &SignerSlot) -> Result<Self> {
        let algorithm =
            configured_algorithm(slot)?.unwrap_or_else(|| SigningAlgorithm::new("PS256"));
        let azure_algorithm = map_azure_algorithm(&algorithm)?;
        let key_id = env::var(slot.azure_key_env).map_err(|_| {
            anyhow!(
                "{} signer backend 'azure-kv-cli' requires {} to be set",
                slot.label,
                slot.azure_key_env
            )
        })?;
        let kid = format!("azure-kv:{}", key_id);
        let binary = env::var(slot.cli_bin_env).unwrap_or_else(|_| "az".into());
        require_cli(
            &binary,
            &format!("{} signer backend 'azure-kv-cli'", slot.label),
            AZURE_CLI_GUIDANCE,
        )?;
        let public_key = load_jwk_from_env(slot.public_key_env, slot.public_key_path_env)?
            .map(|jwk| attach_kid(jwk, &kid));
        Ok(Self {
            key_id,
            kid,
            algorithm,
            azure_algorithm,
            binary,
            public_key,
            fetched_public_key: OnceCell::new(),
        })
    }

    fn fetch_public_key(&self) -> Result<Jwk> {
        let value: Value = ProcessRunner::new(&self.binary)
            .args([
                "keyvault",
                "key",
                "show",
                "--id",
                &self.key_id,
                "--output",
                "json",
            ])
            .run_json()
            .map_err(|err| {
                map_cli_error(
                    "az keyvault key show",
                    &self.binary,
                    AZURE_CLI_GUIDANCE,
                    err,
                )
            })?;
        let key_value = value
            .get("key")
            .cloned()
            .ok_or_else(|| anyhow!("Azure key show response missing 'key' object"))?;
        let jwk =
            Jwk::from_value(key_value).context("Azure key payload is not a valid JWK shape")?;
        Ok(attach_kid(jwk, &self.kid))
    }
}

#[cfg(feature = "kms-cli-azure")]
impl Signer for AzureKvCliSigner {
    fn algorithm(&self) -> SigningAlgorithm {
        self.algorithm.clone()
    }

    fn key_id(&self) -> &str {
        &self.kid
    }

    fn public_key_jwk(&self) -> Result<Jwk> {
        if let Some(jwk) = &self.public_key {
            return Ok(jwk.clone());
        }
        self.fetched_public_key
            .get_or_try_init(|| self.fetch_public_key())
            .map(|jwk| jwk.clone())
    }

    fn sign(&self, payload: &[u8]) -> Result<SignatureEnvelope> {
        let digest = digest_for_algorithm(&self.algorithm, payload)?;
        let digest_b64 = BASE64.encode(&digest);
        let public_key = Some(self.public_key_jwk()?);
        #[derive(Deserialize)]
        struct AzureSignResponse {
            result: String,
        }
        let resp: AzureSignResponse = ProcessRunner::new(&self.binary)
            .args([
                "keyvault",
                "key",
                "sign",
                "--id",
                &self.key_id,
                "--algorithm",
                &self.azure_algorithm,
                "--digest",
                &digest_b64,
                "--output",
                "json",
            ])
            .run_json()
            .map_err(|err| {
                map_cli_error(
                    "az keyvault key sign",
                    &self.binary,
                    AZURE_CLI_GUIDANCE,
                    err,
                )
            })?;
        let mut signature = BASE64
            .decode(resp.result.as_bytes())
            .context("invalid Azure signature output")?;
        signature = normalize_ecdsa_signature(&signature, &self.algorithm)?;
        Ok(SignatureEnvelope {
            algorithm: self.algorithm(),
            signature,
            key_id: self.kid.clone(),
            public_key,
        })
    }

    fn verify_via_backend(&self, payload: &[u8], signature: &[u8]) -> Result<bool> {
        let digest = digest_for_algorithm(&self.algorithm, payload)?;
        let digest_b64 = BASE64.encode(&digest);
        let signature_b64 = BASE64.encode(signature);
        #[derive(Deserialize)]
        struct AzureVerifyResponse {
            value: bool,
        }
        let resp: AzureVerifyResponse = ProcessRunner::new(&self.binary)
            .args([
                "keyvault",
                "key",
                "verify",
                "--id",
                &self.key_id,
                "--algorithm",
                &self.azure_algorithm,
                "--digest",
                &digest_b64,
                "--value",
                &signature_b64,
                "--output",
                "json",
            ])
            .run_json()
            .map_err(|err| {
                map_cli_error(
                    "az keyvault key verify",
                    &self.binary,
                    AZURE_CLI_GUIDANCE,
                    err,
                )
            })?;
        Ok(resp.value)
    }
}

#[cfg(feature = "kms-cli-aws")]
fn map_aws_algorithm(alg: &SigningAlgorithm) -> Result<&'static str> {
    match alg.as_str() {
        "ES256" => Ok("ECDSA_SHA_256"),
        "ES384" => Ok("ECDSA_SHA_384"),
        "PS256" => Ok("RSASSA_PSS_SHA_256"),
        "PS384" => Ok("RSASSA_PSS_SHA_384"),
        "RS256" => Ok("RSASSA_PKCS1_V1_5_SHA_256"),
        other => Err(anyhow!(
            "unsupported AWS signing algorithm '{}' (supported: ES256, ES384, PS256, PS384, RS256)",
            other
        )),
    }
}

#[cfg(feature = "kms-cli-azure")]
fn map_azure_algorithm(alg: &SigningAlgorithm) -> Result<String> {
    match alg.as_str() {
        "ES256" | "ES384" | "ES512" | "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512" => {
            Ok(alg.as_str().to_string())
        }
        other => Err(anyhow!("unsupported Azure signing algorithm '{}'", other)),
    }
}

#[cfg(feature = "jwk-aws")]
pub fn jwk_from_aws_public_key(der: &[u8], key_spec: &str, kid: &str) -> Result<Jwk> {
    let spki =
        SubjectPublicKeyInfoOwned::from_der(der).context("failed to parse AWS public key SPKI")?;
    match key_spec {
        "ECC_NIST_P256" => jwk_from_ec_spki(&spki, "P-256", 32, kid),
        "ECC_NIST_P384" => jwk_from_ec_spki(&spki, "P-384", 48, kid),
        "ECC_NIST_P521" => jwk_from_ec_spki(&spki, "P-521", 66, kid),
        "RSA_2048" | "RSA_3072" | "RSA_4096" => jwk_from_rsa_spki(&spki, kid),
        other => Err(anyhow!(
            "unsupported AWS KMS KeySpec '{}' for public key export",
            other
        )),
    }
}

#[cfg(any(feature = "jwk-aws", feature = "jwk-gcp"))]
fn jwk_from_ec_spki(
    spki: &SubjectPublicKeyInfoOwned,
    curve: &str,
    coord_len: usize,
    kid: &str,
) -> Result<Jwk> {
    let point = spki.subject_public_key.raw_bytes();
    if point.len() != 1 + (coord_len * 2) || point.first().copied() != Some(0x04) {
        return Err(anyhow!("unsupported EC public key format from AWS KMS"));
    }
    let x = &point[1..1 + coord_len];
    let y = &point[1 + coord_len..];
    let mut fields = Map::new();
    fields.insert("kty".into(), Value::String("EC".into()));
    fields.insert("crv".into(), Value::String(curve.into()));
    fields.insert("x".into(), Value::String(base64_url(x)));
    fields.insert("y".into(), Value::String(base64_url(y)));
    Ok(attach_kid(Jwk { fields }, kid))
}

#[cfg(any(feature = "jwk-aws", feature = "jwk-gcp"))]
fn jwk_from_rsa_spki(spki: &SubjectPublicKeyInfoOwned, kid: &str) -> Result<Jwk> {
    let spk_bytes = spki
        .subject_public_key
        .as_bytes()
        .ok_or_else(|| anyhow!("subjectPublicKey BIT STRING not octet-aligned"))?;
    let rsa = rsa::RsaPublicKey::from_pkcs1_der(spk_bytes)
        .context("failed to parse RSA public key from AWS KMS")?;
    let n_bytes = rsa.n().to_bytes_be();
    let e_bytes = rsa.e().to_bytes_be();
    let n = trim_leading_zeroes(&n_bytes);
    let e = trim_leading_zeroes(&e_bytes);
    let mut fields = Map::new();
    fields.insert("kty".into(), Value::String("RSA".into()));
    fields.insert("n".into(), Value::String(base64_url(n)));
    fields.insert("e".into(), Value::String(base64_url(e)));
    Ok(attach_kid(Jwk { fields }, kid))
}

/// Environment flag that gates Trust Mesh alpha capabilities.
pub const TRUST_MESH_ALPHA_FLAG: &str = "TRUST_MESH_ALPHA";

#[derive(Clone, Debug, PartialEq, Eq)]
pub struct SigningAlgorithm(Cow<'static, str>);

impl SigningAlgorithm {
    pub fn new(value: impl Into<Cow<'static, str>>) -> Self {
        Self(value.into())
    }

    pub fn as_str(&self) -> &str {
        &self.0
    }

    pub fn parse(value: &str) -> Result<Self> {
        let normalized = value.trim().to_ascii_uppercase();
        if normalized.is_empty() {
            return Err(anyhow!("signing algorithm value is empty"));
        }
        Ok(SigningAlgorithm::new(normalized))
    }

    pub fn is_ecdsa(&self) -> bool {
        matches!(self.as_str(), "ES256" | "ES384" | "ES512")
    }

    pub fn is_rsa(&self) -> bool {
        matches!(
            self.as_str(),
            "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512"
        )
    }

    pub fn is_edwards(&self) -> bool {
        self.as_str() == "EDDSA"
    }

    pub fn is_hmac(&self) -> bool {
        matches!(self.as_str(), "HS256" | "HS384" | "HS512")
    }
}

impl Default for SigningAlgorithm {
    fn default() -> Self {
        SigningAlgorithm::new("HS256")
    }
}

impl Serialize for SigningAlgorithm {
    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
    where
        S: serde::Serializer,
    {
        serializer.serialize_str(self.as_str())
    }
}

impl<'de> Deserialize<'de> for SigningAlgorithm {
    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
    where
        D: serde::Deserializer<'de>,
    {
        let value = String::deserialize(deserializer)?;
        SigningAlgorithm::parse(&value)
            .map_err(|err| serde::de::Error::custom(format!("invalid signing algorithm: {err}")))
    }
}

#[derive(Clone, Debug, Serialize, Deserialize)]
pub struct Jwk {
    #[serde(flatten)]
    pub fields: Map<String, Value>,
}

impl Jwk {
    pub fn from_value(value: Value) -> Result<Self> {
        let map = value
            .as_object()
            .cloned()
            .ok_or_else(|| anyhow!("JWK must be a JSON object"))?;
        Ok(Self { fields: map })
    }
}

#[derive(Clone, Debug, Serialize, Deserialize)]
pub struct SignatureEnvelope {
    pub algorithm: SigningAlgorithm,
    #[serde(with = "crate::serde_helpers::base64_bytes")]
    pub signature: Vec<u8>,
    pub key_id: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub public_key: Option<Jwk>,
}

impl SignatureEnvelope {
    pub fn verify_offline(&self, payload: &[u8]) -> Result<Option<bool>> {
        match &self.public_key {
            Some(jwk) => try_verify_with_jwk(&self.algorithm, jwk, payload, &self.signature),
            None => Ok(None),
        }
    }
}

pub fn verify_signature_envelope<F>(
    payload: &[u8],
    envelope: &SignatureEnvelope,
    signer_lookup: F,
) -> Result<bool>
where
    F: Fn(&str) -> Option<Arc<dyn Signer>>,
{
    if let Some(result) = envelope.verify_offline(payload)? {
        return Ok(result);
    }
    if let Some(signer) = signer_lookup(&envelope.key_id) {
        return signer.verify(payload, &envelope.signature);
    }
    Ok(false)
}

pub trait Signer: Send + Sync {
    fn algorithm(&self) -> SigningAlgorithm;
    fn key_id(&self) -> &str;
    fn public_key_jwk(&self) -> Result<Jwk>;
    fn sign(&self, payload: &[u8]) -> Result<SignatureEnvelope>;
    fn verify(&self, payload: &[u8], signature: &[u8]) -> Result<bool> {
        if let Ok(jwk) = self.public_key_jwk() {
            if let Some(result) = try_verify_with_jwk(&self.algorithm(), &jwk, payload, signature)?
            {
                return Ok(result);
            }
        }
        self.verify_via_backend(payload, signature)
    }

    fn verify_via_backend(&self, _payload: &[u8], _signature: &[u8]) -> Result<bool> {
        Ok(false)
    }

    fn sign_json(&self, value: &Value) -> Result<SignatureEnvelope> {
        let canonical = serde_json::to_vec(value)?;
        self.sign(&canonical)
    }
}

#[derive(Clone, Copy)]
enum HmacAlgorithm {
    Sha256,
    Sha384,
    Sha512,
}

impl HmacAlgorithm {
    fn from_option(algorithm: Option<SigningAlgorithm>) -> Result<Self> {
        match algorithm {
            Some(alg) => match alg.as_str() {
                "HS256" => Ok(Self::Sha256),
                "HS384" => Ok(Self::Sha384),
                "HS512" => Ok(Self::Sha512),
                other => Err(anyhow!(
                    "unsupported HMAC signing algorithm '{}'; expected HS256/HS384/HS512",
                    other
                )),
            },
            None => Ok(Self::Sha256),
        }
    }

    fn signing_algorithm(&self) -> SigningAlgorithm {
        match self {
            Self::Sha256 => SigningAlgorithm::new("HS256"),
            Self::Sha384 => SigningAlgorithm::new("HS384"),
            Self::Sha512 => SigningAlgorithm::new("HS512"),
        }
    }

    fn sign(&self, key: &[u8], payload: &[u8]) -> Result<Vec<u8>> {
        match self {
            Self::Sha256 => {
                let mut signer = HmacSha256::new_from_slice(key)
                    .context("HMAC (SHA-256) signing key must be valid length")?;
                signer.update(payload);
                Ok(signer.finalize().into_bytes().to_vec())
            }
            Self::Sha384 => {
                let mut signer = HmacSha384::new_from_slice(key)
                    .context("HMAC (SHA-384) signing key must be valid length")?;
                signer.update(payload);
                Ok(signer.finalize().into_bytes().to_vec())
            }
            Self::Sha512 => {
                let mut signer = HmacSha512::new_from_slice(key)
                    .context("HMAC (SHA-512) signing key must be valid length")?;
                signer.update(payload);
                Ok(signer.finalize().into_bytes().to_vec())
            }
        }
    }
}

#[derive(Clone)]
pub struct TrustSigner {
    key: Vec<u8>,
    kid: String,
    jwk: Jwk,
    hmac_alg: HmacAlgorithm,
}

impl TrustSigner {
    pub fn for_trust() -> Self {
        Self::for_trust_with_algorithm(None)
    }

    pub fn for_trust_with_algorithm(algorithm: Option<SigningAlgorithm>) -> Self {
        let key = match load_key_material(
            TRUST_SIGNING_KEY_PATH_ENV,
            TRUST_SIGNING_KEY_ENV,
            "trust",
            false,
        )
        .expect("failed to load trust signing key material")
        {
            Some((key, _)) => key,
            None => default_hmac_key_material(),
        };
        TrustSigner::from_secret_with_algorithm(key, algorithm)
            .expect("failed to initialize trust signer")
    }

    fn from_secret(key: Vec<u8>) -> Result<Self> {
        Self::from_secret_with_algorithm(key, None)
    }

    fn from_secret_with_algorithm(
        key: Vec<u8>,
        algorithm: Option<SigningAlgorithm>,
    ) -> Result<Self> {
        let hmac_alg = HmacAlgorithm::from_option(algorithm)?;
        let (jwk, kid) = build_oct_jwk(&key)?;
        Ok(Self {
            key,
            kid,
            jwk,
            hmac_alg,
        })
    }

    fn sign_raw(&self, payload: &[u8]) -> Result<Vec<u8>> {
        self.hmac_alg.sign(&self.key, payload)
    }
}

impl Signer for TrustSigner {
    fn algorithm(&self) -> SigningAlgorithm {
        self.hmac_alg.signing_algorithm()
    }

    fn key_id(&self) -> &str {
        &self.kid
    }

    fn public_key_jwk(&self) -> Result<Jwk> {
        Ok(self.jwk.clone())
    }

    fn sign(&self, payload: &[u8]) -> Result<SignatureEnvelope> {
        let signature = self.sign_raw(payload)?;
        Ok(SignatureEnvelope {
            algorithm: self.algorithm(),
            signature,
            key_id: self.kid.clone(),
            public_key: Some(self.jwk.clone()),
        })
    }

    fn verify(&self, payload: &[u8], signature: &[u8]) -> Result<bool> {
        let expected = self.sign_raw(payload)?;
        Ok(expected == signature)
    }
}

fn load_key_material(
    path_env: &str,
    key_env: &str,
    label: &str,
    strict: bool,
) -> Result<Option<(Vec<u8>, String)>> {
    if let Ok(path) = env::var(path_env) {
        match fs::read(&path) {
            Ok(bytes) => {
                let id = Path::new(&path)
                    .file_name()
                    .and_then(|name| name.to_str())
                    .map(|name| format!("file:{name}"))
                    .unwrap_or_else(|| format!("file:{label}-key"));
                return Ok(Some((bytes, id)));
            }
            Err(err) if strict => {
                return Err(anyhow!(
                    "failed to read signing key from '{}': {}",
                    path,
                    err
                ));
            }
            Err(_) => {
                // fall back to alternate sources when not strict
            }
        }
    }

    if let Ok(encoded) = env::var(key_env) {
        let trimmed = encoded.trim();
        if trimmed.is_empty() {
            return Ok(None);
        }
        if let Ok(decoded) = BASE64.decode(trimmed) {
            return Ok(Some((decoded, format!("env:{label}"))));
        }
        return Ok(Some((
            trimmed.as_bytes().to_vec(),
            format!("env:{label}-raw"),
        )));
    }

    if strict {
        Ok(None)
    } else {
        Ok(None)
    }
}

fn default_hmac_key_material() -> Vec<u8> {
    Sha256::digest(b"fleetforge-trust-default-signer").to_vec()
}

fn load_jwk_from_env(json_env: &str, path_env: &str) -> Result<Option<Jwk>> {
    if let Ok(raw) = env::var(json_env) {
        let trimmed = raw.trim();
        if trimmed.is_empty() {
            return Ok(None);
        }
        let value: Value = serde_json::from_str(trimmed)
            .map_err(|err| anyhow!("invalid JWK JSON in {}: {}", json_env, err))?;
        return Ok(Some(Jwk::from_value(value)?));
    }
    if let Ok(path) = env::var(path_env) {
        let contents = fs::read_to_string(&path)
            .with_context(|| format!("failed to read JWK file '{}'", path))?;
        let value: Value = serde_json::from_str(&contents)
            .map_err(|err| anyhow!("invalid JWK JSON in {}: {}", path, err))?;
        return Ok(Some(Jwk::from_value(value)?));
    }
    Ok(None)
}

fn attach_kid(mut jwk: Jwk, kid: &str) -> Jwk {
    jwk.fields
        .insert("kid".to_string(), Value::String(kid.to_string()));
    jwk
}

#[derive(Clone)]
pub struct Ed25519Signer {
    kid: String,
    signing_key: Ed25519SigningKey,
    verifying_key: Ed25519VerifyingKey,
    jwk: Jwk,
}

impl Ed25519Signer {
    pub fn from_bytes(secret: &[u8]) -> Result<Self> {
        let key_bytes: [u8; 32] = match secret.len() {
            32 => {
                let mut array = [0u8; 32];
                array.copy_from_slice(secret);
                array
            }
            64 => {
                let mut array = [0u8; 32];
                array.copy_from_slice(&secret[..32]);
                array
            }
            _ => {
                return Err(anyhow!(
                    "Ed25519 key material must be 32 or 64 bytes; got {}",
                    secret.len()
                ));
            }
        };
        let signing_key = Ed25519SigningKey::from_bytes(&key_bytes);
        let verifying_key = Ed25519VerifyingKey::from(&signing_key);
        let (jwk, kid) = build_ed25519_jwk(&verifying_key.to_bytes())?;
        Ok(Self {
            kid,
            signing_key,
            verifying_key,
            jwk,
        })
    }
}

impl Signer for Ed25519Signer {
    fn algorithm(&self) -> SigningAlgorithm {
        SigningAlgorithm::new("EdDSA")
    }

    fn key_id(&self) -> &str {
        &self.kid
    }

    fn public_key_jwk(&self) -> Result<Jwk> {
        Ok(self.jwk.clone())
    }

    fn sign(&self, payload: &[u8]) -> Result<SignatureEnvelope> {
        let signature: Ed25519Signature = self.signing_key.sign(payload);
        Ok(SignatureEnvelope {
            algorithm: self.algorithm(),
            signature: signature.to_bytes().to_vec(),
            key_id: self.kid.clone(),
            public_key: Some(self.jwk.clone()),
        })
    }

    fn verify(&self, payload: &[u8], signature: &[u8]) -> Result<bool> {
        if signature.len() != 64 {
            return Ok(false);
        }
        let mut sig_bytes = [0u8; 64];
        sig_bytes.copy_from_slice(signature);
        let sig = Ed25519Signature::from_bytes(&sig_bytes);
        Ok(self.verifying_key.verify(payload, &sig).is_ok())
    }
}

/// Returns the default Trust Mesh signer, falling back to an ephemeral key when none is configured.
pub fn trust_signer() -> Arc<dyn Signer> {
    resolve_signer(&TRUST_SIGNER_SLOT, false).unwrap_or_else(|err| {
        eprintln!(
            "warning: falling back to local trust signer because configuration failed: {err}"
        );
        Arc::new(TrustSigner::for_trust())
    })
}

/// Loads the SCITT signer configuration, requiring explicit key material.
pub fn scitt_signer() -> Result<Arc<dyn Signer>> {
    ensure_feature_allowed(LicensedFeature::ScittTransparency)?;
    resolve_signer(&SCITT_SIGNER_SLOT, true)
}

/// Loads the capability signer; falls back to the trust signer when none is configured.
pub fn capability_signer() -> Result<Arc<dyn Signer>> {
    resolve_signer(&CAPABILITY_SIGNER_SLOT, false)
}

/// Loads the C2PA signer; falls back to the trust signer when none is configured.
pub fn c2pa_signer() -> Result<Arc<dyn Signer>> {
    resolve_signer(&C2PA_SIGNER_SLOT, false)
}

/// High-level trust classification.
#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
#[serde(tag = "kind", rename_all = "snake_case")]
pub enum Trust {
    Trusted,
    Untrusted,
    Derived {
        #[serde(flatten)]
        origin: TrustOrigin,
    },
}

impl Trust {
    /// Convenience constructor for derived trust values.
    pub fn derived(origin: TrustOrigin) -> Self {
        Self::Derived { origin }
    }

    /// Returns the underlying origin when present.
    pub fn origin(&self) -> Option<&TrustOrigin> {
        match self {
            Trust::Derived { origin } => Some(origin),
            _ => None,
        }
    }
}

/// Describes how the runtime obtained an untrusted or derived value.
#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
pub struct TrustOrigin {
    pub boundary: TrustBoundary,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub run_id: Option<Uuid>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub step_id: Option<Uuid>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub source: Option<TrustSource>,
}

impl TrustOrigin {
    pub fn new(boundary: TrustBoundary) -> Self {
        Self {
            boundary,
            run_id: None,
            step_id: None,
            source: None,
        }
    }

    pub fn with_run_id(mut self, run_id: Uuid) -> Self {
        self.run_id = Some(run_id);
        self
    }

    pub fn with_step_id(mut self, step_id: Uuid) -> Self {
        self.step_id = Some(step_id);
        self
    }

    pub fn with_source(mut self, source: TrustSource) -> Self {
        self.source = Some(source);
        self
    }
}

/// Boundary within the runtime where trust is assessed.
#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum TrustBoundary {
    IngressPrompt,
    IngressTool,
    IngressMemory,
    IngressDocument,
    Scheduler,
    Executor,
    EgressPrompt,
    EgressTool,
    EgressMemory,
    Artifact,
    Gateway,
    Unknown,
}

/// Source system that produced the value.
#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
#[serde(tag = "type", rename_all = "snake_case")]
pub enum TrustSource {
    UserInput,
    Retrieval {
        #[serde(skip_serializing_if = "Option::is_none")]
        provider: Option<String>,
    },
    ToolOutput {
        #[serde(skip_serializing_if = "Option::is_none")]
        tool: Option<String>,
    },
    Memory {
        namespace: String,
        key: String,
    },
    System,
    Other {
        #[serde(skip_serializing_if = "Option::is_none")]
        detail: Option<String>,
    },
}

/// Strongly-typed wrapper for trusted values.
#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
#[serde(transparent)]
pub struct Trusted<T>(pub T);

impl<T> Trusted<T> {
    pub fn into_inner(self) -> T {
        self.0
    }
}

impl<T> From<T> for Trusted<T> {
    fn from(value: T) -> Self {
        Self(value)
    }
}

/// Strongly-typed wrapper for untrusted values.
#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
#[serde(transparent)]
pub struct Untrusted<T>(pub T);

impl<T> Untrusted<T> {
    pub fn into_inner(self) -> T {
        self.0
    }

    pub fn as_ref(&self) -> &T {
        &self.0
    }

    pub fn map<U, F: FnOnce(T) -> U>(self, f: F) -> Untrusted<U> {
        Untrusted(f(self.0))
    }
}

impl<T> From<T> for Untrusted<T> {
    fn from(value: T) -> Self {
        Self(value)
    }
}

/// Placeholder attestation envelope attached to trust decisions and replay events.
#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
pub struct Attestation {
    pub id: Uuid,
    /// When the attestation was produced.
    pub issued_at: DateTime<Utc>,
    /// Subject the attestation refers to (run, step, artifact, etc.).
    #[serde(skip_serializing_if = "Option::is_none")]
    pub subject: Option<TrustSubject>,
    /// Hash or digest of the artifact governed by this attestation.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub artifact_hash: Option<String>,
    /// Arbitrary claims (policy decisions, budget usage, etc.).
    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
    pub claims: BTreeMap<String, serde_json::Value>,
    /// Optional signature reference (for external verification services).
    #[serde(skip_serializing_if = "Option::is_none")]
    pub signature: Option<String>,
}

impl Attestation {
    pub fn new(id: Uuid, issued_at: DateTime<Utc>) -> Self {
        Self {
            id,
            issued_at,
            subject: None,
            artifact_hash: None,
            claims: BTreeMap::new(),
            signature: None,
        }
    }

    pub fn with_subject(mut self, subject: TrustSubject) -> Self {
        self.subject = Some(subject);
        self
    }

    pub fn with_signature(mut self, signature: impl Into<String>) -> Self {
        self.signature = Some(signature.into());
        self
    }
}

/// Identifies what entity an attestation or trust decision covers.
#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
#[serde(tag = "type", rename_all = "snake_case")]
pub enum TrustSubject {
    Run { run_id: Uuid },
    Step { run_id: Uuid, step_id: Uuid },
    Tool { name: String },
    Artifact { uri: String },
    CapabilityToken { token_id: Uuid },
    Custom { label: String },
}

/// Outcome of evaluating a policy against a subject.
#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
pub struct TrustDecision {
    pub subject: TrustSubject,
    pub policy_id: String,
    pub verdict: TrustVerdict,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub reason: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub attestation_id: Option<Uuid>,
}

impl TrustDecision {
    pub fn new(subject: TrustSubject, policy_id: impl Into<String>, verdict: TrustVerdict) -> Self {
        Self {
            subject,
            policy_id: policy_id.into(),
            verdict,
            reason: None,
            attestation_id: None,
        }
    }

    pub fn with_reason(mut self, reason: impl Into<String>) -> Self {
        self.reason = Some(reason.into());
        self
    }

    pub fn with_attestation(mut self, attestation_id: Uuid) -> Self {
        self.attestation_id = Some(attestation_id);
        self
    }
}

/// Placeholder for future detailed policy verdict information.
#[derive(Clone, Debug, Eq, PartialEq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum TrustVerdict {
    Allow,
    Deny,
    Redact,
}

pub use c2pa::{
    generate_c2pa_manifest, verify_c2pa_manifest, C2paManifestEnvelope, CapabilityEvidence,
    CapabilityEvidenceEntry, IdentityEvidence, ManifestInput, ManifestProfile, PolicyEvidence,
    VerifiedManifest,
};
pub use capability::{
    mint_capability_token, verify_capability_token, CapabilityBudgetLimits, CapabilityClaims,
    CapabilitySchemaRef, CapabilityToken, CapabilityTokenScope, CapabilityTokenSubject,
    CapabilityToolScope,
};
pub use scitt::build_scitt_entry;
pub use vault::{digest_bytes, digest_json, AttestationVault, InMemoryAttestationVault};
pub use vault_object_store::ObjectStoreAttestationVault;

#[cfg(test)]
mod tests {
    use super::*;
    use chrono::Duration;
    use std::env;
    use std::sync::{Mutex, OnceLock};

    fn env_lock() -> &'static Mutex<()> {
        static LOCK: OnceLock<Mutex<()>> = OnceLock::new();
        LOCK.get_or_init(|| Mutex::new(()))
    }

    #[test]
    fn scitt_signer_requires_configuration() {
        let _guard = env_lock().lock().unwrap();
        let original_key = env::var(super::SCITT_SIGNING_KEY_ENV).ok();
        let original_path = env::var(super::SCITT_SIGNING_KEY_PATH_ENV).ok();
        let original_tier = env::var("FLEETFORGE_LICENSE_TIER").ok();
        env::set_var("FLEETFORGE_LICENSE_TIER", "enterprise");
        env::remove_var(super::SCITT_SIGNING_KEY_ENV);
        env::remove_var(super::SCITT_SIGNING_KEY_PATH_ENV);

        let result = scitt_signer();
        assert!(
            result.is_err(),
            "expected scitt_signer to fail without explicit key"
        );

        if let Some(value) = original_key {
            env::set_var(super::SCITT_SIGNING_KEY_ENV, value);
        } else {
            env::remove_var(super::SCITT_SIGNING_KEY_ENV);
        }

        if let Some(value) = original_path {
            env::set_var(super::SCITT_SIGNING_KEY_PATH_ENV, value);
        } else {
            env::remove_var(super::SCITT_SIGNING_KEY_PATH_ENV);
        }
        if let Some(value) = original_tier {
            env::set_var("FLEETFORGE_LICENSE_TIER", value);
        } else {
            env::remove_var("FLEETFORGE_LICENSE_TIER");
        }
    }

    #[test]
    fn capability_token_mints_jws() {
        let _guard = env_lock().lock().unwrap();
        let signer = capability_signer().expect("capability signer should load");
        let subject = CapabilityTokenSubject {
            run_id: Uuid::new_v4(),
            step_id: Some(Uuid::new_v4()),
            attempt: Some(1),
        };
        let scope = CapabilityTokenScope {
            tool: CapabilityToolScope {
                name: "test_tool".into(),
                id: Some("tool-123".into()),
                variant: Some("v1".into()),
            },
            schema: CapabilitySchemaRef {
                hash: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef".into(),
                version: Some("1.0.0".into()),
            },
            data_domains: Some(vec!["default".into()]),
            budget: Some(CapabilityBudgetLimits {
                tokens: Some(100),
                cost_usd: Some(1.5),
                duration_ms: Some(60000),
            }),
        };

        let token = mint_capability_token(
            subject,
            scope,
            Some(vec!["runtime".into()]),
            Duration::minutes(5),
            signer.as_ref(),
        )
        .expect("minting capability token should succeed");

        verify_capability_token(&token).expect("capability token must verify with signer");
        let parts: Vec<&str> = token.jws.split('.').collect();
        assert_eq!(parts.len(), 3, "jws must contain three segments");
        assert_eq!(
            token.key_id,
            signer.key_id(),
            "capability token should expose signer key id"
        );
        assert_ne!(token.claims.token_id, Uuid::nil());
    }
}