config

type AttestationKeyCfg struct {
	// KeyID is looked up in the KeyManager. Auto-provisioned on first
	// run at EnsureKey time with the ECDSA_P256 algorithm.
	KeyID string `koanf:"keyId"`
}

type Auth struct {
	// Type selects the adapter: "static" or "oidc".
	Type       string      `koanf:"type"`
	Static     *AuthStatic `koanf:"static"`
	OIDC       *AuthOIDC   `koanf:"oidc"`
	PublicRead bool        `koanf:"public-read"` // TL only — allow unauthenticated reads.
}

type AuthOIDC struct {
	IssuerURL   string   `koanf:"issuer-url"`
	Audience    string   `koanf:"audience"`
	ClientID    string   `koanf:"client-id"`
	AdminGroups []string `koanf:"admin-groups"`
}

type AuthStatic struct {
	APIKey    string `koanf:"api-key"`
	APISecret string `koanf:"api-secret"`
}

type CA struct {
	Type   string    `koanf:"type"`
	Self   *CASelf   `koanf:"self"`
	Server *CAServer `koanf:"server"`
}

type CASelf struct {
	Org          string `koanf:"org"`
	ValidityDays int    `koanf:"validity-days"`
	DataDir      string `koanf:"data-dir"`
}

type CAServer struct {
	Type string `koanf:"type"`

	// Self-signed issuer settings (type "self").
	Org          string `koanf:"org"`
	ValidityDays int    `koanf:"validity-days"`
	DataDir      string `koanf:"data-dir"`

	// ACME issuer settings (type "acme").
	ACME *CAServerACME `koanf:"acme"`
}

type CAServerACME struct {
	// DirectoryURL is the provider's directory endpoint, e.g.
	// https://acme-staging-v02.api.letsencrypt.org/directory for
	// Let's Encrypt staging. Use staging for testing — production
	// rate limits are unforgiving.
	DirectoryURL string `koanf:"directory-url"`
	// Email becomes the ACME account contact for expiry and incident
	// notices. Optional.
	Email string `koanf:"email"`
	// DataDir persists the ACME account key across restarts.
	DataDir string `koanf:"data-dir"`
}

type DNS struct {
	// Type selects the verifier adapter. "noop" accepts any DNS
	// state; "lookup" queries a real nameserver via miekg/dns and
	// validates TXT, TLSA, and HTTPS records, surfacing the DNSSEC
	// AuthenticatedData bit on TLSA responses.
	Type string `koanf:"type"` // "noop" | "lookup"

	// Server is an optional "host:port" override for the nameserver
	// the "lookup" verifier queries. When empty the system resolver
	// (/etc/resolv.conf) is used. Point at the local `ans-dns` dev
	// server (e.g. "127.0.0.1:15353") for self-contained local
	// testing.
	Server string `koanf:"server"`
}

type Identity struct {
	// Resolver selects the did:web document fetcher.
	Resolver IdentityResolver `koanf:"resolver"`
	// ChallengeTTL bounds the verify-control nonce (default 1h; 5m
	// is the design floor for high-assurance deployments).
	ChallengeTTL time.Duration `koanf:"challenge-ttl"`
	// RegisterRateLimit is the per-owner register/rotate budget per
	// minute (default 10) — each call can trigger an outbound
	// did:web fetch before any proof exists.
	RegisterRateLimit int `koanf:"register-rate-limit"`
	// LinkRateLimit is the per-owner link/unlink budget per minute
	// (default 60) — operational hardening on the link route
	// (design §4.3).
	LinkRateLimit int `koanf:"link-rate-limit"`
	// SealTimeout bounds the inline TL seal call identity operations
	// make before reporting success (seal-before-success, design
	// §5.6.1). Default 5s.
	SealTimeout time.Duration `koanf:"seal-timeout"`
}

type IdentityResolver struct {
	Type string `koanf:"type"` // "noop" | "web"
}

type Keys struct {
	Type string    `koanf:"type"` // "file"
	File *KeysFile `koanf:"file"`
}

type KeysFile struct {
	Path string `koanf:"path"`
}

type Log struct {
	Level  string `koanf:"level"`  // trace|debug|info|warn|error
	Format string `koanf:"format"` // "text" | "json"
}

type Merkle struct {
	Origin             string        `koanf:"origin"`
	TileStorage        TileStorage   `koanf:"tile-storage"`
	CheckpointInterval time.Duration `koanf:"checkpoint-interval"`
}

type ProducerKeyCfg struct {
	RaID         string `koanf:"raId"`
	KeyID        string `koanf:"keyId"`
	Algorithm    string `koanf:"algorithm"`
	PublicKeyPEM string `koanf:"publicKeyPem"`
}

type RAConfig struct {
	Server   Server    `koanf:"server"`
	Auth     Auth      `koanf:"auth"`
	CA       CA        `koanf:"ca"`
	DNS      DNS       `koanf:"dns"`
	Identity Identity  `koanf:"identity"`
	Keys     Keys      `koanf:"keys"`
	Store    Store     `koanf:"store"`
	TLClient TLClient  `koanf:"tl-client"`
	Signer   SignerCfg `koanf:"signer"`
	Log      Log       `koanf:"log"`
}

type Server struct {
	Host string `koanf:"host"`
	Port int    `koanf:"port"`
}

type SignerCfg struct {
	KeyID string `koanf:"keyId"`
	RaID  string `koanf:"raId"`
}

type StatusTokenCfg struct {
	TTL time.Duration `koanf:"ttl"`
}

type Store struct {
	Type   string       `koanf:"type"` // "sqlite"
	SQLite *StoreSQLite `koanf:"sqlite"`
}

type StoreSQLite struct {
	Path string `koanf:"path"`
}

type TLClient struct {
	// BaseURL is the TL's listen URL, e.g. "http://localhost:18081".
	BaseURL string `koanf:"base-url"`
	// PublicBaseURL is the TL's externally-reachable URL used in
	// _ans-badge DNS TXT records. Required — must be an https:// URL
	// with no query string, fragment, or userinfo.
	PublicBaseURL string `koanf:"public-base-url"`
	// APIKey is the bearer token the TL's static auth accepts.
	APIKey string `koanf:"api-key"`
	// Timeout is the per-request HTTP timeout.
	Timeout time.Duration `koanf:"timeout"`
	// BatchSize is how many outbox rows each worker tick claims at
	// once. Larger batches reduce DB roundtrips but delay shutdown.
	BatchSize int `koanf:"batch-size"`
	// PollInterval is how often the worker polls the outbox for
	// newly-enqueued events.
	PollInterval time.Duration `koanf:"poll-interval"`
	// MaxBackoff caps the per-row exponential backoff on failure.
	// A permanently-broken event re-enters the claim list at this
	// cadence.
	MaxBackoff time.Duration `koanf:"max-backoff"`
	// Disabled turns the worker off entirely. Events still accumulate
	// in the outbox; useful for tests and for operators who want to
	// run the worker as a separate process.
	Disabled bool `koanf:"disabled"`
}

type TLConfig struct {
	Server       Server            `koanf:"server"`
	Auth         Auth              `koanf:"auth"`
	Keys         Keys              `koanf:"keys"`
	Store        Store             `koanf:"store"`
	Merkle       Merkle            `koanf:"merkle"`
	Attestation  AttestationKeyCfg `koanf:"attestation"`
	StatusToken  StatusTokenCfg    `koanf:"statusToken"`
	ProducerKeys []ProducerKeyCfg  `koanf:"producerKeys"`
	Log          Log               `koanf:"log"`
}

type TileStorage struct {
	Type       string                 `koanf:"type"` // "filesystem"
	Filesystem *TileStorageFilesystem `koanf:"filesystem"`
}

type TileStorageFilesystem struct {
	Path string `koanf:"path"`
}