identity

type Anchor struct {
	// PubKey is the agent's Ed25519 public key (base64).
	PubKey string `json:"pub_key"`

	// AnchorType identifies the anchoring system (e.g., "nostr", "bitcoin", "ethereum").
	AnchorType string `json:"anchor_type"`

	// AnchorID is the identifier in the anchoring system (e.g., Nostr npub).
	AnchorID string `json:"anchor_id"`

	// Ed25519Signature is the Ed25519 signature over the anchor binding data.
	Ed25519Signature string `json:"ed25519_signature"`

	// AnchorSignature is the signature from the anchor system (e.g., Nostr/secp256k1).
	AnchorSignature string `json:"anchor_signature"`

	// Timestamp is when the anchor was created.
	Timestamp time.Time `json:"timestamp"`

	// RecoveryKeys lists public keys authorized for identity recovery.
	RecoveryKeys []string `json:"recovery_keys,omitempty"`

	// Domain is the optional DNS-verified domain binding.
	Domain string `json:"domain,omitempty"`

	// ChainID is the reference in the anchoring system (e.g., event ID).
	ChainID string `json:"chain_id,omitempty"`
}

type DomainVerifier struct{}

type IdentityAnchor interface {
	// Publish creates or updates an identity anchor on the external system.
	Publish(ctx context.Context, anchor Anchor) (chainID string, err error)

	// Verify checks if an identity anchor is valid and authentic.
	Verify(ctx context.Context, anchor Anchor) (bool, error)

	// Resolve looks up the current identity anchor for a given public key.
	Resolve(ctx context.Context, pubKey string) (*Anchor, error)

	// RecoveryKeys returns the authorized recovery keys for a public key.
	RecoveryKeys(ctx context.Context, pubKey string) ([]string, error)
}

type NostrAnchor struct {
	// contains filtered or unexported fields
}

type RecoveryConfig struct {
	// RecoveryKeys are the public keys authorized for recovery.
	RecoveryKeys []string

	// Threshold is the minimum number of recovery keys required (threshold-of-n).
	Threshold int
}

type RecoveryManager struct {
	// contains filtered or unexported fields
}

type RecoveryRequest struct {
	// OldPubKey is the public key being recovered.
	OldPubKey string `json:"old_pub_key"`

	// NewPubKey is the new public key to bind.
	NewPubKey string `json:"new_pub_key"`

	// Signatures maps recovery key -> signature over the recovery data.
	Signatures map[string]string `json:"signatures"`
}