"""
DPoP proof JWT creation for agent-side authentication.
"""

from __future__ import annotations

import time
import uuid

import jwt as pyjwt


def create_dpop_proof(private_key, kid, method, url, nonce=None):
    """
    Create a DPoP proof JWT (ES256).

    Args:
        private_key: EC private key for signing
        kid: Key identifier from registration
        method: HTTP method (GET, POST, etc.)
        url: Request URL
        nonce: Optional server-issued nonce

    Returns:
        Signed DPoP proof JWT string
    """
    headers = {
        "typ": "dpop+jwt",
        "alg": "ES256",
        "jwk": {"kid": kid},
    }
    payload = {
        "htm": method,
        "htu": url,
        "iat": int(time.time()),
        "jti": str(uuid.uuid4()),
    }
    if nonce:
        payload["nonce"] = nonce

    return pyjwt.encode(payload, private_key, algorithm="ES256", headers=headers)
