#ifndef CST_REALM_H
#define CST_REALM_H

#include <stddef.h>
#include <stdint.h>

#ifdef __cplusplus
extern "C" {
#endif

/* User Realm keys (Ed25519). The seed is the durable secret; sk is the
 * Monocypher expanded secret (seed||pk). Same Realm public key ⇒ peers may
 * auto-discover and auto-connect. */
typedef struct cst_realm_keys {
  uint8_t seed[32];
  uint8_t sk[64];
  uint8_t pk[32];
} cst_realm_keys_t;

/* Instance certificate signed by the Realm private key. */
typedef struct cst_realm_cert {
  char instance_id[64];
  char label[128];
  uint8_t instance_pk[32];
  int64_t not_after; /* unix seconds; 0 = no expiry */
  uint8_t realm_pk[32];
  uint8_t sig[64];
} cst_realm_cert_t;

/* Directory helpers: <config>/realm/{private.key,public.key,revoked}. */
int cst_realm_dir(char *out, size_t n);
int cst_realm_generate(cst_realm_keys_t *out);
int cst_realm_derive(cst_realm_keys_t *out, const uint8_t seed[32]);
int cst_realm_save(const char *dir, const cst_realm_keys_t *k);
int cst_realm_load(const char *dir, cst_realm_keys_t *out);
/* 32 hex chars (blake2b-128 of pk). */
int cst_realm_fingerprint(const uint8_t pk[32], char out[33]);

int cst_realm_enroll(const cst_realm_keys_t *realm, const char *instance_id,
                     const char *label, int64_t not_after, cst_realm_cert_t *cert,
                     uint8_t instance_seed[32], uint8_t instance_sk[64]);
int cst_realm_verify_cert(const uint8_t realm_pk[32], const cst_realm_cert_t *cert,
                          int64_t now_unix);
char *cst_realm_cert_to_json(const cst_realm_cert_t *cert);
int cst_realm_cert_from_json(const char *json, cst_realm_cert_t *out);

int cst_realm_challenge_sign(const uint8_t instance_sk[64], const void *chal,
                             size_t n, uint8_t sig[64]);
int cst_realm_challenge_check(const cst_realm_cert_t *cert, const void *chal,
                              size_t n, const uint8_t sig[64]);

int cst_realm_revoke_add(const char *dir, const char *instance_id);
int cst_realm_revoked(const char *dir, const char *instance_id);

#ifdef __cplusplus
}
#endif

#endif