//! Extension negotiation carried in the announce `app_data` field (§6.1).
//!
//! Reticulum treats `app_data` as opaque, so we append our own TLV sequence
//! after a two-byte sentinel:
//!
//! ```text
//! app_data := [ user_app_data ] || EXT_SENTINEL || ext_tlv_seq
//! ext_tlv  := type:u8 || length:u16(BE) || value[length]
//! ```
//!
//! Reticulum-only peers see trailing bytes after the standard app_data and
//! ignore them; extension-aware peers parse the TLVs and act on them.

/// Sentinel marking the boundary between user app_data and the extension TLVs.
///
/// Chosen to be vanishingly unlikely to occur in existing app_data (§6.1).
pub const EXT_SENTINEL: [u8; 2] = [0xEE, 0xEE];

/// Standard extension type tags (§6.1).
///
/// `0x04..=0x7F` are reserved for future standard extensions; `0x80..=0xFF` are
/// reserved for vendor-private extensions.
pub mod ext_type {
    /// PQ link support: KEM id(1) + sig id(1) + static PQ pubkey hash(32).
    pub const PQ_LINK: u8 = 0x01;
    /// Hardware identity attestation (opaque blob signed by a HW root).
    pub const HW_ATTESTATION: u8 = 0x02;
    /// Extended capability set (bitfield).
    pub const CAPABILITIES: u8 = 0x03;
}

/// A single extension TLV.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Tlv {
    /// Type tag (see [`ext_type`]).
    pub ty: u8,
    /// Value bytes.
    pub value: Vec<u8>,
}

/// Split announce `app_data` into the user portion and any extension TLVs.
///
/// Returns `(user_app_data, tlvs)`. With no sentinel present, all bytes are user
/// data and the TLV list is empty.
#[must_use]
pub fn parse(app_data: &[u8]) -> (&[u8], Vec<Tlv>) {
    todo!()
}

/// Build an `app_data` field from a user portion and a set of extension TLVs.
#[must_use]
pub fn encode(user_app_data: &[u8], tlvs: &[Tlv]) -> Vec<u8> {
    todo!()
}
