feature: Created create_signature function in atproto-attestation

crates/atproto-attestation/src/attestation.rs

···
     Ok(Value::Object(record_obj))
 }
 
+/// Creates a cryptographic signature for a record with attestation metadata.
+///
+/// This is a low-level function that generates just the signature bytes without
+/// embedding them in a record structure. It's useful when you need to create
+/// signatures independently or for custom attestation workflows.
+///
+/// The signature is created over a content CID that binds together:
+/// - The record content
+/// - The attestation metadata
+/// - The repository DID (to prevent replay attacks)
+///
+/// # Arguments
+///
+/// * `record_input` - The record to sign (as AnyInput: String, Json, or TypedLexicon)
+/// * `attestation_input` - The attestation metadata (as AnyInput)
+/// * `repository` - The repository DID where this record will be stored
+/// * `private_key_data` - The private key to use for signing
+///
+/// # Returns
+///
+/// A byte vector containing the normalized ECDSA signature that can be verified
+/// against the same content CID.
+///
+/// # Errors
+///
+/// Returns an error if:
+/// - CID generation fails
+/// - Signature creation fails
+/// - Signature normalization fails
+///
+/// # Example
+///
+/// ```rust
+/// use atproto_attestation::{create_signature, input::AnyInput};
+/// use atproto_identity::key::{KeyType, generate_key};
+/// use serde_json::json;
+///
+/// # fn example() -> Result<(), Box<dyn std::error::Error>> {
+/// let private_key = generate_key(KeyType::K256Private)?;
+///
+/// let record = json!({"$type": "app.bsky.feed.post", "text": "Hello!"});
+/// let metadata = json!({"$type": "com.example.signature"});
+///
+/// let signature_bytes = create_signature(
+///     AnyInput::Serialize(record),
+///     AnyInput::Serialize(metadata),
+///     "did:plc:repo123",
+///     &private_key
+/// )?;
+///
+/// // signature_bytes can now be base64-encoded or used as needed
+/// # Ok(())
+/// # }
+/// ```
+pub fn create_signature<R, M>(
+    record_input: AnyInput<R>,
+    attestation_input: AnyInput<M>,
+    repository: &str,
+    private_key_data: &KeyData,
+) -> Result<Vec<u8>, AttestationError>
+where
+    R: Serialize + Clone,
+    M: Serialize + Clone,
+{
+    // Step 1: Create a content CID from record + attestation + repository
+    let content_cid = create_attestation_cid(record_input, attestation_input, repository)?;
+
+    // Step 2: Sign the CID bytes
+    let raw_signature = sign(private_key_data, &content_cid.to_bytes())
+        .map_err(|error| AttestationError::SignatureCreationFailed { error })?;
+
+    // Step 3: Normalize the signature to ensure consistent format
+    normalize_signature(raw_signature, private_key_data.key_type())
+}
+
 /// Creates a remote attestation with both the attested record and proof record.
 ///
 /// This is the recommended way to create remote attestations. It generates both:
···
         assert!(sig.get("signature").is_some());
         assert!(sig.get("key").is_some());
         assert!(sig.get("repository").is_none()); // Should not be in final signature
+
+        Ok(())
+    }
+
+    #[test]
+    fn create_signature_returns_valid_bytes() -> Result<(), Box<dyn std::error::Error>> {
+        let private_key = generate_key(KeyType::K256Private)?;
+        let public_key = to_public(&private_key)?;
+
+        let record = json!({
+            "$type": "app.example.record",
+            "body": "Test signature creation"
+        });
+
+        let metadata = json!({
+            "$type": "com.example.signature",
+            "key": format!("{}", public_key)
+        });
+
+        let repository = "did:plc:test123";
+
+        // Create signature
+        let signature_bytes = create_signature(
+            AnyInput::Serialize(record.clone()),
+            AnyInput::Serialize(metadata.clone()),
+            repository,
+            &private_key,
+        )?;
+
+        // Verify signature is not empty
+        assert!(!signature_bytes.is_empty(), "Signature bytes should not be empty");
+
+        // Verify signature length is reasonable for ECDSA (typically 64-72 bytes for secp256k1)
+        assert!(
+            signature_bytes.len() >= 64 && signature_bytes.len() <= 73,
+            "Signature length should be between 64 and 73 bytes, got {}",
+            signature_bytes.len()
+        );
+
+        // Verify we can validate the signature
+        let content_cid = create_attestation_cid(
+            AnyInput::Serialize(record),
+            AnyInput::Serialize(metadata),
+            repository,
+        )?;
+
+        validate(&public_key, &signature_bytes, &content_cid.to_bytes())?;
+
+        Ok(())
+    }
+
+    #[test]
+    fn create_signature_different_inputs_produce_different_signatures() -> Result<(), Box<dyn std::error::Error>> {
+        let private_key = generate_key(KeyType::K256Private)?;
+
+        let record1 = json!({"$type": "app.example.record", "body": "First message"});
+        let record2 = json!({"$type": "app.example.record", "body": "Second message"});
+        let metadata = json!({"$type": "com.example.signature"});
+        let repository = "did:plc:test123";
+
+        let sig1 = create_signature(
+            AnyInput::Serialize(record1),
+            AnyInput::Serialize(metadata.clone()),
+            repository,
+            &private_key,
+        )?;
+
+        let sig2 = create_signature(
+            AnyInput::Serialize(record2),
+            AnyInput::Serialize(metadata),
+            repository,
+            &private_key,
+        )?;
+
+        assert_ne!(sig1, sig2, "Different records should produce different signatures");
+
+        Ok(())
+    }
+
+    #[test]
+    fn create_signature_different_repositories_produce_different_signatures() -> Result<(), Box<dyn std::error::Error>> {
+        let private_key = generate_key(KeyType::K256Private)?;
+
+        let record = json!({"$type": "app.example.record", "body": "Message"});
+        let metadata = json!({"$type": "com.example.signature"});
+
+        let sig1 = create_signature(
+            AnyInput::Serialize(record.clone()),
+            AnyInput::Serialize(metadata.clone()),
+            "did:plc:repo1",
+            &private_key,
+        )?;
+
+        let sig2 = create_signature(
+            AnyInput::Serialize(record),
+            AnyInput::Serialize(metadata),
+            "did:plc:repo2",
+            &private_key,
+        )?;
+
+        assert_ne!(
+            sig1, sig2,
+            "Different repository DIDs should produce different signatures"
+        );
 
         Ok(())
     }

crates/atproto-attestation/src/lib.rs

···
 // Re-export attestation functions
 pub use attestation::{
     append_inline_attestation, append_remote_attestation, create_inline_attestation,
-    create_remote_attestation,
+    create_remote_attestation, create_signature,
 };
 
 // Re-export input types