// Package dsse models the DSSE envelope shape the signing-service
// produces. dummy-sink does not verify envelopes locally; it simply ships
// the envelope the signing-service returned to the transparency-log.
//
// Shape mirrors services/testagent-transform/internal/dsse.Envelope so a
// future verifier can round-trip the handover envelope through either
// package byte-for-byte.
package dsse

// EnvelopeSignature mirrors the DSSE spec.
type EnvelopeSignature struct {
	KeyID string `json:"keyid"`
	Sig   string `json:"sig"`
}

// Envelope is the DSSE envelope the signing-service returns. Payload is
// base64url (no padding) of the canonical in-toto Statement bytes.
type Envelope struct {
	PayloadType string              `json:"payloadType"`
	Payload     string              `json:"payload"`
	Signatures  []EnvelopeSignature `json:"signatures"`
}