//! Key derivation (`ARCHITECTURE.md` §3.3).

use zeroize::ZeroizeOnDrop;

/// The 64-byte key material produced by HKDF-SHA-256 from an ECDH shared secret.
///
/// Split convention (§3.3): the first 32 bytes are the signing key, the last 32
/// bytes are the encryption key. Zeroized on drop.
#[derive(ZeroizeOnDrop)]
pub struct DerivedKey([u8; 64]);

impl DerivedKey {
    /// Wrap raw 64-byte key material.
    #[must_use]
    pub fn from_bytes(bytes: [u8; 64]) -> Self {
        Self(bytes)
    }

    /// The signing half (first 32 bytes).
    #[must_use]
    pub fn signing_half(&self) -> &[u8; 32] {
        (&self.0[..32])
            .try_into()
            .expect("64-byte key always has a 32-byte prefix")
    }

    /// The encryption half (last 32 bytes).
    #[must_use]
    pub fn encryption_half(&self) -> &[u8; 32] {
        (&self.0[32..])
            .try_into()
            .expect("64-byte key always has a 32-byte suffix")
    }
}
