credential

type EnrollOptions struct {
	// Server is the control-plane address, host:port.
	Server string
	// Token is the provisioning token plaintext.
	Token string
	// BootstrapCA is the PEM trust anchor for the control plane, delivered
	// out of band together with the token. At enrollment the agent holds
	// nothing that could verify the control plane: no credential and no
	// bundle. The token authenticates the agent to the server; this anchor
	// authenticates the server to the agent. Without it the token would be
	// sent to whatever answers at Server. Empty means the host's system
	// trust store, which is right when the control plane presents a
	// certificate the host already trusts.
	BootstrapCA []byte
	// Facts are descriptive host facts sent alongside; they never influence
	// identity or authorization.
	Facts *innerwallv1.HostFacts
}

type EnrollResult struct {
	WorkloadID     identity.WorkloadID
	CertificatePEM []byte
	BundlePEM      []byte
	Labels         []*innerwallv1.Label
}

type Holder struct {
	// contains filtered or unexported fields
}

type RenewOptions struct {
	Server string
	// Credential is the current workload credential, presented over mTLS.
	Credential tls.Certificate
	// Trust is the authority bundle stored at enrollment.
	Trust []byte
}

type RenewResult struct {
	WorkloadID     identity.WorkloadID
	CertificatePEM []byte
	BundlePEM      []byte
}

type Renewer struct {
	Holder *Holder
	// Server is the control-plane address for RenewCredential.
	Server string
	Log    *slog.Logger
	// RetryBase and RetryCap bound the backoff after a failed renewal;
	// one minute and one hour when zero. ExpiredRetryCap bounds it
	// further once the credential has expired.
	RetryBase time.Duration
	RetryCap  time.Duration
	// Now is the wall clock; time.Now if nil.
	Now func() time.Time
	// Elapsed is a monotonic clock: the time since an arbitrary fixed
	// origin, unaffected by changes to the wall clock. Measured from the
	// renewer's start when nil. Tests substitute it.
	Elapsed func() time.Duration
	// After is the timer; time.After if nil. Tests substitute it to run
	// the schedule without waiting.
	After func(d time.Duration) <-chan time.Time
	// Renew performs one renewal; the package's Renew when nil. Tests
	// substitute it.
	Renew func(ctx context.Context, key *ecdsa.PrivateKey, opts RenewOptions) (*RenewResult, error)
	// Renewed, when set, is called after each successful renewal.
	Renewed func(leaf *x509.Certificate)
	// contains filtered or unexported fields
}

type Store struct {
	Dir string
}