// Copyright © Albert Lane. All Rights Reserved.
// Proprietary and Confidential — Albert Lane Proprietary Software License.
// Unauthorized use, copying, modification, or distribution is prohibited.
// License inquiries: https://albertlane.net
// t1237: real ECDSA (libsecp256k1 recoverable) + SHA-256 / Keccak-256 (OpenSSL EVP) for the Lane-VM Sovereign Sentry.
#pragma once
#include <cstdint>
#include <string>
#include <vector>

namespace lane_crypto {
using Bytes = std::vector<uint8_t>;
Bytes sha256(const std::string& data);
Bytes keccak256(const std::string& data);
std::string to_hex(const Bytes& b);                 // lowercase, no 0x
std::string normalize_address(const std::string& a); // "0x" + 40 lowercase hex, or "" if invalid
// EIP-191 personal_sign digest over an ASCII message: keccak256("\x19Ethereum Signed Message:\n" + len + msg)
Bytes eip191_digest(const std::string& message);
// Recover the signer address ("0x" + 40 lowercase hex) of a 65-byte r||s||v signature (v in {27,28} or {0,1}).
// Returns false (with err set) on bad length, bad v, high-s (malleable) or failed recovery.
bool recover_address(const Bytes& digest32, const std::string& sig65, std::string& out_addr, std::string& err);
bool self_test(std::string& err); // known-answer tests, run at startup (fail closed)
}