#!/usr/bin/env python3
"""Create a production-key-signed, machine-bound 30-day offline trial."""
import argparse, base64, copy, datetime as dt, json, subprocess, tempfile, uuid
from pathlib import Path

def canonical(value):
    clean = copy.deepcopy(value)
    clean.pop("signature", None)
    clean.pop("signature_status", None)
    return json.dumps(clean, sort_keys=True, separators=(",", ":"), ensure_ascii=True).encode()

def main():
    p = argparse.ArgumentParser()
    p.add_argument("--private-key", required=True)
    p.add_argument("--machine-id", required=True)
    p.add_argument("--customer", required=True)
    p.add_argument("--output", required=True)
    a = p.parse_args()
    now = dt.datetime.now(dt.timezone.utc).replace(microsecond=0)
    payload = {
      "schema": "cezen.license.v2", "license_id": str(uuid.uuid4()),
      "install_type": "offline-trial", "customer_name": a.customer,
      "allowed_tier": "starter", "feature_profile": "trial",
      "feature_overrides": {"agent_runtime": False, "model_weights": False},
      "limits": {"trial_days": 30, "registered_edge_devices": 0, "active_edge_agents": 0},
      "machine_binding": {"machine_id": a.machine_id},
      "issued_at": now.isoformat().replace("+00:00", "Z"),
      "expires_at": (now + dt.timedelta(days=30)).isoformat().replace("+00:00", "Z"),
      "signature_alg": "rsa-sha256"
    }
    with tempfile.TemporaryDirectory() as d:
        body, sig = Path(d)/"body", Path(d)/"sig"
        body.write_bytes(canonical(payload))
        subprocess.run(["openssl", "dgst", "-sha256", "-sign", a.private_key, "-out", sig, body], check=True)
        payload["signature"] = base64.b64encode(sig.read_bytes()).decode()
    payload["signature_status"] = "signed"
    Path(a.output).write_text(json.dumps(payload, indent=2) + "\n")

if __name__ == "__main__": main()