{"kty":"OKP","crv":"Ed25519","x":"HzO8jiKnwNPaQZDnTzQN5_GrHwdFb8IqT-Z-HTxus44"}

const crypto = require('crypto');
const fs = require('fs');
// reading the public key in JWK format we created in the previoius step
const jwk = JSON.parse(fs.readFileSync('public-key.jwk'));

// taking only the required attributes in sorted order (canonicalization)
const required = Object.fromEntries(
  ['crv', 'kty', 'x'].map(k => [k, jwk[k]])
);

// calculating the thumbprint
const kid = crypto
  .createHash('sha256')
  .update(JSON.stringify(required))
  .digest('base64url');

// adding the thumbprint hash as a new `kid` attribute (key ID)
fs.writeFileSync('public-key.jwk', JSON.stringify({ ...jwk, kid }));

{"kty":"OKP","crv":"Ed25519","x":"HzO8jiKnwNPaQZDnTzQN5_GrHwdFb8IqT-Z-HTxus44",
"kid":"KYG4GtgVVPWw3r1AXgM6fYFw5kAvRZiJVxZY1Rsgc3Q"}

/**
* Build and sign the HTTP message signature for a given URL.
* Signed components: @authority, signature-agent
* @param {string} url - The full URL of the request being signed
* @returns {{ 'signature-agent': string, 'signature-input': string, 'signature': string }}
*/
async function getSignatureHeaders(url) {
  const signatureAgentUri = 'https://ai-agent.fyi';
  const { hostname } = new URL(url);
  
  const created = Math.floor(Date.now() / 1000);
  // expires = now + 1 hour
  const expires = created + 60*60;
  
  // Component values
  const authorityValue = hostname;
  
  const nonce = crypto.randomBytes(16).toString('base64');
  
  // Signature Input string (what gets signed)
  // Format per RFC 9421 Section 2.1:
  //   "<component-name>": <value>\n  (one per component)
  //   "@signature-params": <sig-params>
  const signatureParams =
  `("@authority" "signature-agent")` +
  `;created=${created}` +
  `;expires=${expires}` +
  `;keyid="${KID}"` + // KID is the JWK thumbprint from the public key
  `;alg="ed25519"` +
  `;nonce="${nonce}"` +
  `;tag="web-bot-auth"`;
  
  // Signature base string per RFC 9421 Section 2.5
  // Each component line: "<name>": <value>
  // Header values are quoted strings; @authority is a plain token (hostname)
  const signingInput = [
  `"@authority": ${authorityValue}`,
  `"signature-agent": "${signatureAgentUri}"`,
  `"@signature-params": ${signatureParams}`,
  ].join('\n');
  
  // Sign with Ed25519 private key
  const signature = crypto.sign(null, Buffer.from(signingInput), PRIVATE_KEY_PEM);
  
  return {
  'signature-agent': `"${signatureAgentUri}"`,
  'signature-input': `sig1=${sigParams}`,
  'signature': `sig1=:${signature.toString('base64')}:`,
  };
}