/*
<MODULE_CONTRACT>
<purpose>RFC-0715: Shared types and re-exports for N3 cryptographic verification commands.</purpose>


<non-goals>
  <item>Does not define command handlers — those live in nachweis-*.ts files.</item>
</non-goals>
</MODULE_CONTRACT>
<CHANGE_SUMMARY>
  <item>RFC-0715: initial N3 shared types module.</item>
  <item>RFC-0715 review fix: add shared flagString/flagBool helpers to eliminate duplication across command files.</item>
  <item>RFC-0871: add TimestampAssurance type, extend NachweisTimestampResult and NachweisVerifySignatureResult with assurance metadata.</item>
  <item>RFC-1097: step 6 — compass.migrate codemod run

Mechanical v1 to v2 header migration across the workspace: 942 files rewritten — CHANGE_SUMMARY windows collapsed into history, forbidden v1 blocks stripped, KEY_DECISIONS seeded from @ai-invariant comments (5 files) or TODO placeholders (103 files), blocks reordered to canonical order.</item>
  <item>RFC-1097: sweep — werkstatt-engine clean

Sweep batch 4: 73 Compass headers on headerless engine files (certification, component-runtime, isolation, evolution, testing), real KEY_DECISIONS on 75 files (kernel, cache, dht, swim, gitmesh, runtime), ~80 purpose expansions (CONTRACT-02/PURPOSE-02), non-goals on 13 CONTRACT-03 files, CS-07 history literal fix repo-wide (253 files). Policy: .template.ts/.template.astro excludedPaths. werkstatt-engine now 0 diagnostics.</item>
</CHANGE_SUMMARY>
*/

import type { KernelCommandInput } from "@warpgogol/werkstatt-engine/kernel";

export {
  isNachweisEntitled,
  makeSkipResult,
  resolveNachweisCachePath,
  resolveDefaultLang,
  resolvePbpEntityDir,
} from "./nachweis-io.ts";

export function flagString(input: KernelCommandInput, key: string): string | undefined {
  const v = input.flags[key];
  return typeof v === "string" ? v : undefined;
}

export function flagBool(input: KernelCommandInput, key: string): boolean {
  const v = input.flags[key];
  return v === true || v === "true";
}

export interface NachweisSignResult {
  slug: string;
  systemId: string;
  signatureHex: string;
  publicKeyHex: string;
  bordbuchEventId: string | null;
  idempotent: boolean;
}

export type TimestampAssurance = "rfc3161" | "eidas-qualified";

export interface NachweisTimestampResult {
  slug: string;
  systemId: string;
  timestampTokenBase64: string;
  tsaUrl: string;
  bordbuchEventId: string | null;
  idempotent: boolean;
  timestampAssurance: TimestampAssurance;
  qualificationEvidenceRef?: string;
}

export interface NachweisVerifySignatureResult {
  slug: string;
  systemId: string;
  signatureValid: boolean;
  timestampVerified: boolean;
  timestampAssurance: TimestampAssurance;
  qualificationEvidenceRef?: string;
  publicKeyHex: string | null;
  details: string;
}