registration

type Config struct {
	// DataDir is the path to the data directory (required).
	DataDir string `yaml:"data_dir"`

	// ProjectID is the platform project UUID the node registers into
	// (required for fresh registration).
	ProjectID string `yaml:"project_id"`

	// ResourceHandle is the platform Resource handle the node binds to
	// (required for fresh registration).
	ResourceHandle string `yaml:"resource_handle"`

	// RequestedResourceID is an optional override used when substrate naming
	// differs from the platform handle.
	RequestedResourceID string `yaml:"requested_resource_id"`

	// TokenFile is the path to the bootstrap token file.
	// Default: /etc/plexd/bootstrap-token
	TokenFile string `yaml:"token_file"`

	// TokenEnv is the environment variable name for the bootstrap token.
	// Default: PLEXD_BOOTSTRAP_TOKEN
	TokenEnv string `yaml:"token_env"`

	// TokenValue is a direct token value override.
	TokenValue string `yaml:"token_value"`

	// UseMetadata enables cloud metadata service for registration.
	// Default: false
	UseMetadata bool `yaml:"use_metadata"`

	// MetadataTokenPath is the metadata key path used to retrieve the
	// bootstrap token from an instance metadata service (e.g. IMDS).
	// Default: /plexd/bootstrap-token
	MetadataTokenPath string `yaml:"metadata_token_path"`

	// MetadataTimeout is the maximum time to wait for a metadata service
	// response.
	// Default: 2s
	MetadataTimeout time.Duration `yaml:"metadata_timeout"`

	// MaxRetryDuration is the maximum duration to retry registration.
	// Default: 5m
	MaxRetryDuration time.Duration `yaml:"max_retry_duration"`
}

type IMDSProvider struct {
	// contains filtered or unexported fields
}

type Keypair struct {
	PrivateKey []byte // 32 bytes, never logged
	PublicKey  []byte // 32 bytes
}

type MetadataProvider interface {
	ReadValue(ctx context.Context, path string) (string, error)
}

type NodeIdentity struct {
	NodeID           string           `json:"node_id"`
	MeshIP           string           `json:"mesh_ip"`
	SigningPublicKey string           `json:"signing_public_key"`
	SigningKeyID     string           `json:"signing_key_id"`
	DomainMeshCIDR   string           `json:"domain_mesh_cidr"`
	LastRotation     *RotationReceipt `json:"last_rotation,omitempty"`
	PrivateKey       []byte           `json:"-"` // never serialized to JSON
	NodeSecretKey    string           `json:"-"` // never serialized to JSON
}

type Registrar struct {
	// contains filtered or unexported fields
}

type RotationReceipt struct {
	RotationID     string `json:"rotation_id"`
	KID            string `json:"kid"`
	WrapKeyVersion int    `json:"wrap_key_version"`
}

type TokenResolver struct {
	// contains filtered or unexported fields
}

type TokenResult struct {
	Value    string // the token value
	FilePath string // non-empty if the token was read from a file (for cleanup)
}