identity

type BundleProofs struct {
	Legacy  []byte `json:"legacy,omitempty"`  // secp256k1+keccak256 signature over canonical
	Ed25519 []byte `json:"ed25519,omitempty"` // Ed25519 signature over canonical
	MLDSA65 []byte `json:"mldsa65,omitempty"` // ML-DSA-65 signature over canonical
}

type BundleProvider struct {
	// contains filtered or unexported fields
}

type BundleProviderConfig struct {
	SigningKey       ed25519.PrivateKey
	SettlementPub    []byte // compressed secp256k1 public key from wallet
	PQSigningKeySeed []byte // 32-byte HKDF seed for ML-DSA-65 (optional, nil = no PQ)
	LangoDir         string
	Legacy           *WalletDIDProvider
	Logger           *zap.SugaredLogger
}

type BundleResolver interface {
	ResolveBundle(did string) (*IdentityBundle, error)
}

type DID struct {
	ID        string  `json:"id"`                  // "did:lango:<hex>" or "did:lango:v2:<hash>"
	PublicKey []byte  `json:"publicKey,omitempty"` // signing key (v1: secp256k1, v2: empty until resolved)
	PeerID    peer.ID `json:"peerId,omitempty"`    // libp2p peer ID (v1: derived, v2: empty until resolved)
	Version   int     `json:"version"`             // 1 or 2
}

type DIDAlias struct {
	// contains filtered or unexported fields
}

type IdentityBundle struct {
	Version       int             `json:"version"`
	Generation    uint32          `json:"generation"`               // Ed25519 key derivation generation (default 0)
	SigningKey    PublicKeyEntry  `json:"signing_key"`              // Ed25519 primary signing key
	SettlementKey PublicKeyEntry  `json:"settlement_key"`           // secp256k1 (from wallet)
	LegacyDID     string          `json:"legacy_did,omitempty"`     // did:lango:<secp256k1-hex> for v1 compat
	PQGeneration  uint32          `json:"pq_generation,omitempty"`  // ML-DSA key derivation generation (default 0)
	PQSigningKey  *PublicKeyEntry `json:"pq_signing_key,omitempty"` // ML-DSA-65 PQ signing key (nil if unavailable)
	Proofs        BundleProofs    `json:"proofs"`
	CreatedAt     time.Time       `json:"created_at"`
}

type KeyProvider interface {
	PublicKey(ctx context.Context) ([]byte, error)
}

type LocalIdentityProvider interface {
	DID(ctx context.Context) (*DID, error)
	Bundle() *IdentityBundle
	LegacyDID(ctx context.Context) (*DID, error)
	SignMessage(ctx context.Context, message []byte) ([]byte, error)
	PublicKey(ctx context.Context) ([]byte, error)
	Algorithm() string
	DIDString(ctx context.Context) (string, error)
}

type MemoryBundleCache struct {
	// contains filtered or unexported fields
}

type Provider interface {
	// DID returns the DID for the current identity key.
	DID(ctx context.Context) (*DID, error)
	// VerifyDID checks that a DID matches the claimed peer ID.
	VerifyDID(did *DID, peerID peer.ID) error
}

type PublicKeyEntry struct {
	Algorithm string `json:"algorithm"`
	PublicKey []byte `json:"public_key"`
}

type WalletDIDProvider struct {
	// contains filtered or unexported fields
}