keystore

type ExpiryWarningThresholds struct {
	// Critical: OpCert is about to expire, cannot produce blocks soon
	Critical uint64
	// Warning: OpCert should be renewed soon
	Warning uint64
	// Info: OpCert expiry is approaching
	Info uint64
}

type KESSigner interface {
	// Sign signs a message at the specified KES period.
	Sign(period uint64, message []byte) ([]byte, error)
	// VKey returns the KES verification key.
	VKey() []byte
	// CurrentPeriod returns the current KES period the key is evolved to.
	CurrentPeriod() uint64
}

type KeyStore struct {
	// contains filtered or unexported fields
}

type KeyStoreConfig struct {
	// VRFSKeyPath is the path to the VRF signing key file.
	VRFSKeyPath string
	// KESSKeyPath is the path to the KES signing key file.
	KESSKeyPath string
	// OpCertPath is the path to the operational certificate file.
	OpCertPath string
	// SlotsPerKESPeriod is the number of slots in a KES period.
	// Default: 129600 (preview network value)
	SlotsPerKESPeriod uint64
	// MaxKESEvolutions is the maximum number of KES evolutions.
	// Default: 62 (for KES depth 6)
	MaxKESEvolutions uint64
	// Logger for keystore events.
	Logger *slog.Logger
}

type OpCert struct {
	KESVKey     []byte // KES verification key (32 bytes)
	IssueNumber uint64 // Certificate sequence number
	KESPeriod   uint64 // KES period when certificate was created
	Signature   []byte // Cold key signature (64 bytes)
	ColdVKey    []byte // Cold verification key (32 bytes)
}

type SlotClock interface {
	// CurrentSlot returns the current slot number.
	CurrentSlot() (uint64, error)
	// Subscribe returns a channel that receives slot tick notifications.
	Subscribe() <-chan SlotTick
	// Unsubscribe removes a subscriber channel.
	Unsubscribe(ch <-chan SlotTick)
}

type SlotTick struct {
	Slot uint64
}

type VRFSigner interface {
	// Prove generates a VRF proof for the given input.
	// Returns (proof, output, error).
	Prove(alpha []byte) ([]byte, []byte, error)
	// VKey returns the VRF verification key.
	VKey() []byte
}