# gatekeeper-sdk/stanley_shield/security.py
import hmac
import hashlib
import json

def generate_signature(payload: dict, timestamp: str, secret: str) -> str:
    actor_id = payload.get('actor', {}).get('id')
    action = payload.get('action')
    metadata = payload.get('metadata', {})
    
    # Python's separators=(',', ':') is the key to matching Node's default JSON.stringify
    meta_json = json.dumps(metadata, sort_keys=True, separators=(',', ':'))
    
    message = f"{timestamp}|{actor_id}|{action}|{meta_json}"
    
    
    return hmac.new(
        secret.encode('utf-8'),
        message.encode('utf-8'), 
        hashlib.sha256
    ).hexdigest()