#pragma once

// Include ntifs.h and Domito.MinCrypt.h first. Test support, not a library API.
typedef struct _DOMITO_CI_PROBE_RESULT
{
    ULONG Flags;
    ULONG InputCapacity;
    NTSTATUS Status;
    UINT32 HashSize;
    ALG_ID HashAlgId;
    UCHAR Hash[MINCRYPT_MAX_HASH_LENGTH];
    LARGE_INTEGER SigningTime;
    ULONG PolicyBits;
    ULONG TimeStampPolicyBits;
    NTSTATUS VerificationStatus;
    NTSTATUS TimeStampVerificationStatus;
    BOOLEAN HasChain;
    BOOLEAN HasTimeStampChain;
    BOOLEAN HashGuardIntact;
} DOMITO_CI_PROBE_RESULT;

#define DOMITO_CI_PROBE_RESULT_COUNT 6

// PASSIVE_LEVEL; referenced file object; file bytes must remain stable.
// Writes observations, not an overall trust verdict. Frees both policies per call.
_IRQL_requires_max_(PASSIVE_LEVEL)
void DomitoProbeCiValidateFileObject(
    _In_ PFILE_OBJECT FileObject,
    _Out_writes_(DOMITO_CI_PROBE_RESULT_COUNT) DOMITO_CI_PROBE_RESULT* Results);