feat: add Realm Ed25519 keys and instance enrollment (0.9.9)

Introduce a user Realm keypair (Monocypher) that signs instance
certificates so same-domain peers can later auto-discover and connect.

Co-authored-by: Cursor <cursoragent@cursor.com>

include/cst_realm.h

@@ -0,0 +1,59 @@
+#ifndef CST_REALM_H
+#define CST_REALM_H
+
+#include <stddef.h>
+#include <stdint.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* User Realm keys (Ed25519). The seed is the durable secret; sk is the
+ * Monocypher expanded secret (seed||pk). Same Realm public key ⇒ peers may
+ * auto-discover and auto-connect. */
+typedef struct cst_realm_keys {
+  uint8_t seed[32];
+  uint8_t sk[64];
+  uint8_t pk[32];
+} cst_realm_keys_t;
+
+/* Instance certificate signed by the Realm private key. */
+typedef struct cst_realm_cert {
+  char instance_id[64];
+  char label[128];
+  uint8_t instance_pk[32];
+  int64_t not_after; /* unix seconds; 0 = no expiry */
+  uint8_t realm_pk[32];
+  uint8_t sig[64];
+} cst_realm_cert_t;
+
+/* Directory helpers: <config>/realm/{private.key,public.key,revoked}. */
+int cst_realm_dir(char *out, size_t n);
+int cst_realm_generate(cst_realm_keys_t *out);
+int cst_realm_derive(cst_realm_keys_t *out, const uint8_t seed[32]);
+int cst_realm_save(const char *dir, const cst_realm_keys_t *k);
+int cst_realm_load(const char *dir, cst_realm_keys_t *out);
+/* 32 hex chars (blake2b-128 of pk). */
+int cst_realm_fingerprint(const uint8_t pk[32], char out[33]);
+
+int cst_realm_enroll(const cst_realm_keys_t *realm, const char *instance_id,
+                     const char *label, int64_t not_after, cst_realm_cert_t *cert,
+                     uint8_t instance_seed[32], uint8_t instance_sk[64]);
+int cst_realm_verify_cert(const uint8_t realm_pk[32], const cst_realm_cert_t *cert,
+                          int64_t now_unix);
+char *cst_realm_cert_to_json(const cst_realm_cert_t *cert);
+int cst_realm_cert_from_json(const char *json, cst_realm_cert_t *out);
+
+int cst_realm_challenge_sign(const uint8_t instance_sk[64], const void *chal,
+                             size_t n, uint8_t sig[64]);
+int cst_realm_challenge_check(const cst_realm_cert_t *cert, const void *chal,
+                              size_t n, const uint8_t sig[64]);
+
+int cst_realm_revoke_add(const char *dir, const char *instance_id);
+int cst_realm_revoked(const char *dir, const char *instance_id);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif

include/cst_version.h

@@ -3,7 +3,7 @@
 
 #define CST_VERSION_MAJOR 0
 #define CST_VERSION_MINOR 9
-#define CST_VERSION_PATCH 8
+#define CST_VERSION_PATCH 9
 
 #define CST_VERSION_STR_(x) #x
 #define CST_VERSION_STR(x) CST_VERSION_STR_(x)