certstore

type AIAFetcher func(ctx context.Context, url string) ([]byte, error)

type BundleExportInput struct {
	Bundle     *certkit.BundleResult
	KeyPEM     []byte
	KeyType    string
	BitLength  int
	Prefix     string              // sanitized file name prefix
	SecretName string              // Kubernetes secret metadata.name
	CSRSubject *CSRSubjectOverride // optional; nil uses cert's own subject
}

type BundleFile struct {
	Name      string
	Data      []byte
	Sensitive bool // true for files containing private key material (mode 0600)
}

type BundleWriter interface {
	WriteBundleFiles(folder string, files []BundleFile) error
}

type CSRSubjectOverride struct {
	Country            []string
	Province           []string
	Locality           []string
	Organization       []string
	OrganizationalUnit []string
}

type CertHandler interface {
	HandleCertificate(cert *x509.Certificate, source string) error
	HandleKey(key any, pemData []byte, source string) error
}

type CertRecord struct {
	Cert       *x509.Certificate
	SKI        string // hex-encoded RFC 7093 SKI
	CertType   string // "root", "intermediate", "leaf"
	KeyType    string // e.g. "RSA 2048 bits", "ECDSA P-256"
	NotAfter   time.Time
	NotBefore  time.Time
	Source     string // filename that contributed this cert
	BundleName string // determined by CLI bundle config matching
}

type ContainerContents struct {
	Leaf       *x509.Certificate
	Key        crypto.PrivateKey
	ExtraCerts []*x509.Certificate
}

type ExportMatchedBundleInput struct {
	Store         *MemStore
	SKIs          []string // matched-pair SKIs to export
	BundleOpts    certkit.BundleOptions
	Writer        BundleWriter
	CSRSubject    *CSRSubjectOverride // optional; nil uses cert's own subject
	RetryNoVerify bool                // retry bundle without verification on failure
}

type K8sMetadata struct {
	Name        string            `yaml:"name"`
	Annotations map[string]string `yaml:"annotations,omitempty"`
}

type K8sSecret struct {
	APIVersion string            `yaml:"apiVersion"`
	Kind       string            `yaml:"kind"`
	Type       string            `yaml:"type"`
	Metadata   K8sMetadata       `yaml:"metadata"`
	Data       map[string]string `yaml:"data"`
}

type KeyRecord struct {
	Key       crypto.PrivateKey
	SKI       string // hex-encoded RFC 7093 SKI
	KeyType   string // "RSA", "ECDSA", "Ed25519"
	BitLength int
	PEM       []byte // PEM-encoded key data for export
	Source    string // filename that contributed this key
}

type MemStore struct {
	// contains filtered or unexported fields
}

type ProcessInput struct {
	Data      []byte      // raw file content
	Path      string      // virtual path for logging and extension detection
	Passwords []string    // passwords to try for encrypted formats
	Handler   CertHandler // receives parsed items
}

type ResolveAIAInput struct {
	Store    *MemStore
	Fetch    AIAFetcher
	MaxDepth int // 0 defaults to 5
}

type ScanSummary struct {
	Roots         int `json:"roots"`
	Intermediates int `json:"intermediates"`
	Leaves        int `json:"leaves"`
	Keys          int `json:"keys"`
	Matched       int `json:"key_cert_pairs"`
}