sealruntime

type Codec interface {
	ScanType(t reflect.Type) (Spec, error)
	NewSealer(spec Spec, eventType string, rt *Runtime) (Sealer, error)
}

type Envelope struct {
	JTI        string
	IssuedAt   time.Time
	EventType  string
	TenantID   string
	SignKid    string
	SignFamily string
	EncKid     string
}

type KeyStore interface {
	PublicKey(name string) (*rsa.PublicKey, error)
	PrivateKey(name string) (*rsa.PrivateKey, error)
}

type Metrics struct {
	// contains filtered or unexported fields
}

type OpenRefusedError struct {
	Code        string
	Details     map[string]string
	Recoverable bool
	Cause       error
}

type Opener interface {
	Open(ctx context.Context, body []byte, want TenantRule, out any) (Envelope, error)
}

type OpenerProvider interface {
	NewOpener(spec Spec, eventType string, rt *Runtime) (Opener, error)
}

type Runtime struct {
	// KeyStore is the registered keystore, nil when no keystore module is registered.
	KeyStore KeyStore
	// Active is the messaging.seal.active selector: Logical kid -> "v<N>".
	Active map[string]string
	// Tenancy is the deployment's messaging tenancy as the opener must judge tid.
	Tenancy Tenancy
	// Meter feeds the seal metrics; nil means no-op instruments.
	Meter metric.MeterProvider
}

type Sealer interface {
	Seal(ctx context.Context, evt any) (data []byte, jti string, err error)
}

type Spec interface {
	SignLogical() string
	EncryptLogical() string
}

type Tenancy uint8

type TenantRule struct {
	Required bool
	Expected string
}

type Verifier interface {
	Verify(ctx context.Context, body []byte) (Envelope, error)
}

type VerifierProvider interface {
	NewVerifier(spec Spec, eventType string, rt *Runtime) (Verifier, error)
}