/*
 * v1984 CLI — config and key storage
 *
 * Config is encrypted with a static key (inconvenience barrier)
 * and signed with HMAC (tamper detection). Not security theater —
 * the real protection is vault-side rate limiting, IP whitelisting,
 * and lockout.
 */

#ifndef V84_KEYSTORE_H
#define V84_KEYSTORE_H

#include <stddef.h>

struct v84_config {
    char vault_url[512];      /* e.g. https://use.vault1984.com:1984 */
    char agent_name[128];     /* e.g. claude-code-forge */
    unsigned char l2_key[16]; /* L2 encryption key (16 bytes) */
};

/* Initialize config: encrypt and write to ~/.config/v1984/config */
int keystore_init(const char *vault_url, const char *agent_name,
                  const unsigned char *l2_key, size_t l2_key_len);

/* Load config: read, verify signature, decrypt */
int keystore_load(struct v84_config *cfg);

#endif
