from __future__ import annotations

import json
from hashlib import sha256
from typing import Any


def build_macos_signed_metadata(payload: dict[str, Any]) -> dict[str, Any]:
    metadata = dict(payload)
    metadata.setdefault("platform", "macos")
    metadata.setdefault("signing_algorithm", "ed25519")
    metadata.setdefault("passive_only", True)
    canonical = json.dumps(metadata, sort_keys=True, separators=(",", ":"))
    metadata["metadata_digest"] = sha256(canonical.encode("utf-8")).hexdigest()
    return metadata
