internal

type AggregatorConfig struct {
	WindowMs   int `json:"window_ms,omitempty"`   // Time window in milliseconds (default 200)
	BatchMax   int `json:"batch_max,omitempty"`   // Maximum batch size (default 1000)
	Threshold  int `json:"threshold,omitempty"`   // Auto-switch threshold (default 50)
	BufferSize int `json:"buffer_size,omitempty"` // Queue capacity (default 10000)
}

type ArchiveConfig struct {
	Enabled        *bool    `json:"enabled,omitempty"`         // Enable certificate archival (*bool so hot reload can disable)
	RetentionDays  int      `json:"retention_days,omitempty"`  // Days to keep archived certificates
	ExcludeCAs     []string `json:"exclude_cas,omitempty"`     // CAs excluded from archival
	ArchiveExpired *bool    `json:"archive_expired,omitempty"` // Archive expired certificates (*bool so hot reload can toggle)
	ArchiveRevoked *bool    `json:"archive_revoked,omitempty"` // Archive revoked certificates (*bool so hot reload can toggle)
}

type AuditSaltConfig struct {
	Enabled         *bool  `json:"enabled,omitempty"`          // Enable salt masking (default true). When false, audit fields stay plaintext.
	RetentionDays   int    `json:"retention_days,omitempty"`   // Days to keep each daily salt (default 365). After this, the day's salt row is deleted → masked identities become irreversible.
	CleanupInterval string `json:"cleanup_interval,omitempty"` // How often to scan and purge expired salts (e.g. "24h"; default 24h).
}

type AuditVerifyConfig struct {
	Enabled  *bool  `json:"enabled,omitempty"`  // Enable periodic chain verification (default true).
	Interval string `json:"interval,omitempty"` // How often to verify (e.g. "1h"; default 24h).
}

type AutoRenewConfig struct {
	Enabled         *bool    `json:"enabled,omitempty"`               // Enable automatic renewal (*bool so hot reload can disable)
	Interval        string   `json:"interval,omitempty"`              // Renewal check interval (e.g. "24h")
	WindowDays      int      `json:"window_days,omitempty"`           // Days before expiry to renew
	DefaultValidity int      `json:"default_validity_days,omitempty"` // Validity days for renewed certificates
	Profiles        []string `json:"profiles,omitempty"`              // Profiles eligible for auto-renewal
	ExcludeCAs      []string `json:"exclude_cas,omitempty"`           // CAs excluded from auto-renewal
	NotifyOnly      *bool    `json:"notify_only,omitempty"`           // Only notify, don't auto-renew (*bool so hot reload can toggle)
	MaxRenewals     int      `json:"max_renewals,omitempty"`          // Max renewals per certificate (0 = unlimited)
}

type CAConfig struct {
	Cert     string `json:"cert,omitempty"`     // CA certificate PEM file path
	Key      string `json:"key,omitempty"`      // CA private key PEM file path
	Chain    string `json:"chain,omitempty"`    // CA chain file (intermediates + root)
	Password string `json:"password,omitempty"` // CA private key password (from env if empty)
}

type CRLConfig struct {
	Addr          string `json:"addr,omitempty"`           // CRL distribution HTTP listen address
	ValidityDays  int    `json:"validity_days,omitempty"`  // CRL validity period in days (default 30)
	OutputDir     string `json:"output_dir,omitempty"`     // CRL file output directory
	CRLBaseURL    string `json:"crl_base_url,omitempty"`   // Base URL for CRL distribution points
	AutoRenew     string `json:"auto_renew,omitempty"`     // Deprecated: use RenewInterval
	RenewInterval string `json:"renew_interval,omitempty"` // CRL auto-regeneration interval (e.g. "24h")
	Partitions    int    `json:"partitions,omitempty"`     // 0 or 1 = no partitioning
}

type CTLogConfig struct {
	URL       string       `json:"url,omitempty"`        // CT log server URL
	APIKey    string       `json:"api_key,omitempty"`    // CT log API key (optional)
	PublicKey string       `json:"public_key,omitempty"` // CT log public key (base64 DER SPKI or PEM). Required for real SCT signature verification (H11); without it verification degrades to structural checks with a warning.
	Logs      []CTLogEntry `json:"logs,omitempty"`       // Additional CT log entries
}

type CTLogEntry struct {
	URL       string `json:"url"`                  // CT log server URL
	APIKey    string `json:"api_key,omitempty"`    // CT log API key (optional)
	PublicKey string `json:"public_key,omitempty"` // CT log public key (base64 DER SPKI or PEM). Required for real SCT signature verification (H11).
}

type Config struct {
	DB          string                   `json:"db,omitempty"`           // SQLite/MySQL DSN (e.g. "/etc/varwof/core/pki.db")
	Locale      string                   `json:"locale,omitempty"`       // "zh" or "en" (default: auto-detect)
	TSA         TSAConfig                `json:"tsa,omitempty"`          // Time-Stamp Authority config
	OCSP        OCSPConfig               `json:"ocsp,omitempty"`         // OCSP responder config
	CAs         map[string]CAConfig      `json:"cas,omitempty"`          // CA definitions (name → CAConfig)
	Serve       ServeConfig              `json:"serve,omitempty"`        // HTTP server & TLS listener config
	Defaults    DefaultsConfig           `json:"defaults,omitempty"`     // Default values for certificate issuance
	CRL         CRLConfig                `json:"crl,omitempty"`          // CRL generation config
	Webhook     WebhookConfig            `json:"webhook,omitempty"`      // Webhook notification config
	KeyEscrow   KeyEscrowConfig          `json:"key_escrow,omitempty"`   // Key escrow (recovery) config
	CTLog       CTLogConfig              `json:"ct_log,omitempty"`       // Certificate Transparency log config
	LDAP        ca.LDAPConfig            `json:"ldap,omitempty"`         // LDAP directory integration config
	Identity    *ca.IdentitySourceConfig `json:"identity,omitempty"`     // Identity-source → certificate automation (identity-user profile)
	RA          RAConfig                 `json:"ra,omitempty"`           // Registration Authority workflow config
	RateLimit   RateLimitConfig          `json:"rate_limit,omitempty"`   // Per-IP rate limiting config
	PG          db.PGConfig              `json:"pg,omitempty"`           // PostgreSQL-specific config (pool size, SSL)
	AutoRenew   AutoRenewConfig          `json:"auto_renew,omitempty"`   // Automatic certificate renewal config
	Archive     ArchiveConfig            `json:"archive,omitempty"`      // Certificate archival config
	TrustBridge TrustBridgeConfig        `json:"trust_bridge,omitempty"` // Cross-CA trust bridge config
	SMTP        SMTPConfig               `json:"smtp,omitempty"`         // SMTP notification config
	Policy      string                   `json:"policy,omitempty"`       // Path to policy JSON file (CN/SAN allow/deny)
	// EnforcePolicy, when true, makes an unconfigured issuance policy (policy)
	// a hard error instead of a warn-and-continue (M4 fix). Default false keeps
	// backward-compatible behavior; deployments that rely on policy restrictions
	// should set this to fail closed when policy.json is missing/unloaded.
	EnforcePolicy *bool `json:"enforce_policy,omitempty"`
	// RequireTLSServerSAN, when true, rejects issuance of TLS-server certificates
	// that carry no subjectAltName (RFC 5280 §4.1.2.6 / RFC 6125). Default false
	// (backward compatible) mirrors enforce_policy.
	RequireTLSServerSAN *bool               `json:"require_tls_server_san,omitempty"`
	RBAC                RBACConfig          `json:"rbac,omitempty"`               // Role-based access control config
	AuthorizationFile   string              `json:"authorization_file,omitempty"` // Path to authz.json policy file
	RoutesFile          string              `json:"routes_file,omitempty"`        // Path to routes.json per-URL rule file
	CapabilitySchemes   string              `json:"capability_schemes,omitempty"` // Path to capability schemes dir (register; embedded default if empty)
	PolicySigning       PolicySigningConfig `json:"policy_signing,omitempty"`     // Signed policy-file verification config
	Hierarchy           string              `json:"hierarchy,omitempty"`          // "simple" | "complex" (CA hierarchy model)
	KeyBackend          KeyBackendConfig    `json:"key_backend,omitempty"`        // Remote signer delegation config
	Persist             PersistConfig       `json:"persist,omitempty"`            // Certificate persistence mode config
	K8sEnabled          *bool               `json:"k8s_enabled,omitempty"`        // Enable /api/v1/k8s/sign endpoint (default false for security)
	Aggregator          AggregatorConfig    `json:"aggregator,omitempty"`         // Batch certificate issuance aggregator config
	RecordBuffer        RecordBufferConfig  `json:"record_buffer,omitempty"`      // RecordBuffer batch persistence config (threshold/max_pending/max_latency/disable)
	Engine              *EngineConfig       `json:"engine,omitempty"`             // In-memory engine config (nil=disabled, reads/writes fall back to DB)
	DeviceProfile       string              `json:"device_profile,omitempty"`     // Optional device tuning preset ("pi5"|"low_mem"|"high_throughput"). Applies device-sensitive defaults (write pipeline sizing) before explicit settings; "" = default (x86/desktop) tuned.
	SPIFFE              *SPIFFEConfig       `json:"spiffe,omitempty"`             // SPIFFE identity integration config (nil=disabled)
}

type DefaultsConfig struct {
	CA             string `json:"ca,omitempty"`              // Default CA name for issuance
	Profile        string `json:"profile,omitempty"`         // Default certificate profile (e.g. "tls-server")
	KeyType        string `json:"key_type,omitempty"`        // Default key type (e.g. "ecdsa-p256")
	Hash           string `json:"hash,omitempty"`            // Default hash algorithm (e.g. "sha256")
	DefaultCountry string `json:"default_country,omitempty"` // Default subject country (C)
	DefaultOrg     string `json:"default_org,omitempty"`     // Default subject organization (O)
	// Org is the legacy alias for DefaultOrg (config key "org"). When both
	// are present, Org wins so that init-full's generated "defaults.org"
	// keeps working. Deprecated: use default_org in new configs.
	Org string `json:"org,omitempty"`
	// Realm is the namespace identifier for PrincipalUid (e.g. "example.com").
	// When empty, defaults to "example.com" (RFC 2606 reserved domain).
	// Used as the Realm field in PrincipalUid when no explicit principal_uid is provided.
	Realm             string   `json:"realm,omitempty"`
	CertValidity      string   `json:"cert_validity,omitempty"`       // Default certificate validity duration (e.g. "2160h")
	OCSPURL           string   `json:"ocsp_url,omitempty"`            // OCSP responder URL (injected into AIA)
	IssuerURL         string   `json:"issuer_url,omitempty"`          // Issuer certificate URL (injected into AIA)
	IssuerAltNames    []string `json:"issuer_alt_names,omitempty"`    // Additional AIA issuer URLs
	SubjectInfoAccess []string `json:"subject_info_access,omitempty"` // Subject Info Access extensions
	PolicyOIDs        []string `json:"policy_oids,omitempty"`         // Certificate policy OIDs to include
	// PolicyMappings is an RFC 5280 §4.2.1.5 Policy Mappings extension list,
	// each item in format "issuerDomainPolicy:subjectDomainPolicy", written only
	// into CA certificates (enterprise bridge / cross-domain trust scenarios,
	// e.g. ["1.2.3.4.1:1.2.3.4.2"]).
	PolicyMappings []string `json:"policy_mappings,omitempty"`
	// RequireExplicitPolicy is the RFC 5280 §4.2.1.11 Policy Constraints
	// requireExplicitPolicy skipCerts count (CA certificates). Not generated by default.
	RequireExplicitPolicy *int `json:"require_explicit_policy,omitempty"`
	// InhibitPolicyMapping is the RFC 5280 §4.2.1.11 Policy Constraints
	// inhibitPolicyMapping skipCerts count (CA certificates). Not generated by default.
	InhibitPolicyMapping *int `json:"inhibit_policy_mapping,omitempty"`
	// InhibitAnyPolicy is the RFC 5280 §4.2.1.14 Inhibit anyPolicy extension's
	// skipCerts count (CA certificates). Not generated by default.
	InhibitAnyPolicy *int `json:"inhibit_any_policy,omitempty"`
	ReportMaxRows    int  `json:"report_max_rows,omitempty"` // Max rows in CSV/PDF reports (default 5000)
	// AgentProxyMaxValidity is the hard upper bound for agent-proxy (authorized mode)
	// certificate validity (Go duration, default "1h", can be relaxed up to ≤24h;
	// spec P1-B-09/25, P2-A-04).
	AgentProxyMaxValidity string `json:"agent_proxy_max_validity,omitempty"`
}

type EngineConfig struct {
	// MaxCerts is the in-memory certificate upper bound (default 200000). When the limit is
	// reached, eviction only occurs if there are expired certificates (beyond the Grace window);
	// if all existing certificates are unexpired, new signings return ErrBackpressure (HTTP 503)
	// until some certificates expire.
	// Production tuning: set to "peak concurrent valid certificates × 1.5" and monitor
	// the `engine WindowEvictions` metric and issuance 503 rate.
	MaxCerts        int    `json:"max_certs,omitempty"`
	MaxNonces       int    `json:"max_nonces,omitempty"`        // In-memory nonce upper bound (default 100000)
	MaxDANonces     int    `json:"max_da_nonces,omitempty"`     // In-memory DA nonce upper bound (default 100000)
	MaxRevoked      int    `json:"max_revoked,omitempty"`       // Per-CA revocation set upper bound (default 50000)
	Grace           string `json:"grace,omitempty"`             // Retention window for expired certificates in memory (default "24h")
	JanitorInterval string `json:"janitor_interval,omitempty"`  // Janitor sweep interval (default "60s")
	NonceTTL        string `json:"nonce_ttl,omitempty"`         // Unused nonce lifetime (default "24h")
	WriteThreshold  int    `json:"write_threshold,omitempty"`   // Certificate batch persistence threshold (default 100)
	WriteMaxPending int32  `json:"write_max_pending,omitempty"` // Pending persistence upper bound (backpressure, default 20000)
	WriteMaxLatency string `json:"write_max_latency,omitempty"` // Maximum persistence latency (default "500ms")
	WriteWorkers    int    `json:"write_workers,omitempty"`     // Backend writer goroutines for revoke/nonce/meta ops (default 4). Raise on multi-core servers for more parallel backend writes.
}

type KeyBackendConfig struct {
	Type     string `json:"type,omitempty"`      // "software" (default) or "remote_hsm"
	URL      string `json:"url,omitempty"`       // Remote signer URL (e.g. "https://127.0.0.1:9443")
	KeyAlias string `json:"key_alias,omitempty"` // Key alias on remote signer (default: auto-detect from cert filename)
	TLS      struct {
		Cert   string `json:"cert,omitempty"`    // Client TLS cert for mTLS
		Key    string `json:"key,omitempty"`     // Client TLS key for mTLS
		CACert string `json:"ca_cert,omitempty"` // CA cert to verify remote signer
	} `json:"tls,omitempty"`
	Token string `json:"token,omitempty"` // Bearer token
}

type KeyEscrowConfig struct {
	AdminPublicKey string `json:"admin_public_key,omitempty"` // PEM-encoded admin public key for key recovery
}

type OCSPConfig struct {
	Addr       string `json:"addr,omitempty"`        // OCSP responder listen address (e.g. ":9080")
	SignerCert string `json:"signer_cert,omitempty"` // OCSP signer certificate PEM file
	SignerKey  string `json:"signer_key,omitempty"`  // OCSP signer private key PEM file
	NextUpdate string `json:"next_update,omitempty"` // Next update interval (e.g. "4h")
	CacheSize  int    `json:"cache_size,omitempty"`  // OCSP response cache size (entries)
	CacheTTL   string `json:"cache_ttl,omitempty"`   // OCSP cache TTL (e.g. "1h")
	CacheFile  string `json:"cache_file,omitempty"`  // persisted cache file; when set, the in-memory cache is replaced by a disk-backed cache loaded at startup and re-saved after each response (stateless OCSP node support)
}

type PersistConfig struct {
	Mode          string `json:"mode,omitempty"`           // "realtime" | "batch" | "async"
	BatchSize     int    `json:"batch_size,omitempty"`     // Accumulate N records before batch flush
	BatchInterval string `json:"batch_interval,omitempty"` // Max wait before batch flush (e.g. "5s")
	QueueSize     int    `json:"queue_size,omitempty"`     // Async queue capacity (default 10000)
	BufferDB      string `json:"buffer_db,omitempty"`      // Buffer database DSN for async mode
}

type PolicySigningConfig struct {
	Enabled        bool   `json:"enabled,omitempty"`          // Enable policy file signature verification
	CAFile         string `json:"ca_file,omitempty"`          // Trusted CA chain PEM (default tls_client_ca)
	RequireAdminOU *bool  `json:"require_admin_ou,omitempty"` // Require signer to have admin OU (default true, nil=unset)
	Require        bool   `json:"require,omitempty"`          // true=reject when signature missing; false=degrade with warning
	SigSuffix      string `json:"sig_suffix,omitempty"`       // Signature file suffix (default ".sig")
}

type RAConfig struct {
	RequiredApprovals int    `json:"required_approvals,omitempty"` // Number of approvals required (default 1)
	DefaultCA         string `json:"default_ca,omitempty"`         // Default CA for RA-issued certificates
	DefaultProfile    string `json:"default_profile,omitempty"`    // Default profile for RA-issued certificates
}

type RBACConfig struct {
	Enabled        *bool               `json:"enabled,omitempty"`         // Master RBAC switch (*bool so hot reload can disable)
	PermissionMode string              `json:"permission_mode,omitempty"` // "simple" | "enterprise"
	CAScopes       map[string][]string `json:"ca_scopes,omitempty"`
}

type RateLimitConfig struct {
	Enabled *bool   `json:"enabled,omitempty"` // Enable per-IP rate limiting (*bool so hot reload can disable)
	Rate    float64 `json:"rate,omitempty"`    // Requests per second allowed
	Burst   int     `json:"burst,omitempty"`   // Burst size (default 200)
}

type RecordBufferConfig struct {
	Disable    bool   `json:"disable,omitempty"`     // Completely disable RecordBuffer (synchronous persistence)
	Threshold  int    `json:"threshold,omitempty"`   // Batch threshold (default 500)
	MaxPending *int   `json:"max_pending,omitempty"` // Pending upper bound pointer; nil=default 20000, 0=disable backpressure (unlimited)
	MaxLatency string `json:"max_latency,omitempty"` // Maximum batch delay (default "500ms", Go duration format)
}

type SMTPConfig struct {
	Host               string `json:"host,omitempty"`                 // SMTP server hostname
	Port               int    `json:"port,omitempty"`                 // SMTP server port (e.g. 587)
	Username           string `json:"username,omitempty"`             // SMTP auth username
	Password           string `json:"password,omitempty"`             // SMTP auth password
	From               string `json:"from,omitempty"`                 // Sender email address
	To                 string `json:"to,omitempty"`                   // Recipient email address (comma-separated)
	TLS                *bool  `json:"tls,omitempty"`                  // Require TLS for SMTP connection (*bool so hot reload can toggle)
	InsecureSkipVerify *bool  `json:"insecure_skip_verify,omitempty"` // Skip TLS cert verification (*bool so hot reload can toggle)
	Events             string `json:"events,omitempty"`               // Comma-separated event types to notify on
}

type SPIFFEConfig struct {
	// TrustDomain is the SPIFFE trust domain (e.g. "varwof.com").
	// Used to construct SPIFFE IDs: "spiffe://{trustDomain}/agent/{agentId}".
	TrustDomain string `json:"trust_domain"`
}

type ServeConfig struct {
	Addr    string `json:"addr,omitempty"`     // HTTP listen address (e.g. ":8443")
	TLSAddr string `json:"tls_addr,omitempty"` // HTTPS mTLS listen address (e.g. ":4433")
	APIAddr string `json:"api_addr,omitempty"` // Internal API listen address (e.g. "127.0.0.1:9090")
	TLSCert string `json:"tls_cert,omitempty"` // TLS certificate file path (leaf)
	TLSKey  string `json:"tls_key,omitempty"`  // TLS private key file path
	// TLSChain is the issuing/intermediate PEM appended to tls_cert at load
	// time, so the handshake presents the full chain to peers that trust only
	// the root.  Keeping it a separate key leaves tls_cert a pure leaf: point
	// at the leaf alone when a chain is not wanted, and skip this key.
	TLSChain           string            `json:"tls_chain,omitempty"`
	Static             string            `json:"static,omitempty"`                // Static file directory (Web UI, CRL distribution)
	TLSClientCA        string            `json:"tls_client_ca,omitempty"`         // Client CA cert for mTLS authentication
	AuthUsername       string            `json:"auth_username,omitempty"`         // Basic auth username (fallback when mTLS unavailable)
	AuthPassword       string            `json:"auth_password,omitempty"`         // Basic auth password
	ReloadPollInterval string            `json:"reload_poll_interval,omitempty"`  // Config file poll interval (e.g. "10s")
	ShutdownTimeout    string            `json:"shutdown_timeout,omitempty"`      // Graceful shutdown timeout (e.g. "10s")
	MetricsEnabled     *bool             `json:"metrics_enabled,omitempty"`       // Enable Prometheus /metrics endpoint (*bool so hot reload can disable)
	MetricsAddr        string            `json:"metrics_addr,omitempty"`          // Dedicated internal /metrics listener (e.g. "127.0.0.1:9102"); empty = only on the main mux. Not hot-reloaded (restart required).
	MetricsPublic      *bool             `json:"metrics_public,omitempty"`        // Serve /metrics on the main mux with NO authentication (default false = require metrics:read). *bool so hot reload can toggle.
	MetricsToken       string            `json:"metrics_token,omitempty"`         // Require `Authorization: Bearer <token>` on every /metrics listener (defense in depth). Applied before auth/role checks.
	LogFormat          string            `json:"log_format,omitempty"`            // "text" or "json" for structured logging
	LogDest            string            `json:"log_dest,omitempty"`              // Log output target: "stderr" (default), "file:/path/to/pki.log", or "syslog" (local /dev/log or UDP localhost:514)
	AgentSessionMaxTTL string            `json:"agent_session_max_ttl,omitempty"` // Max X-Agent-TTL window for delegated sessions (e.g. "24h"; "0" rejects them entirely)
	TrustedGatewayOUs  []string          `json:"trusted_gateway_ous,omitempty"`   // OUs of trusted gateway service certs that may assert delegated identity via X-Client-Cert-DER (B2, recommended) or legacy X-Agent-User (Deprecated, B1); empty = reject gateway-asserted delegation
	AuditSalt          AuditSaltConfig   `json:"audit_salt,omitempty"`            // Per-day salt masking of PII in the audit log (privacy / data minimization)
	AuditVerify        AuditVerifyConfig `json:"audit_verify,omitempty"`          // Periodic Merkle chain integrity verification of the audit log (AUTH-016)
	DAMaxTimestampSkew string            `json:"da_max_timestamp_skew,omitempty"` // Max |now - DelegationAuthorization.timestamp| accepted at issuance (e.g. "1m"; default 1m, "0" disables the freshness check). Second line of the DA nonce/timestamp replay defense (P1-B-13).
	// RequireDelegationIdentity, when true, makes AIC delegated issuance
	// (agent-proxy profile carrying a user DelegationAuthorization) fail-closed
	// unless the DA's PrincipalUid.identifier resolves to a known, active user
	// via the configured identity source (bridge-ldap / bridge-oauth). This
	// closes the "free-text identifier" gap described in security-audit-2026-09-02
	// (C-01): an attacker may not mint an AIC for an arbitrary invented
	// realm:identifier, only for identifiers present in the directory.
	// Requires identity.source_url to be configured. Default false (opt-in).
	RequireDelegationIdentity bool `json:"require_delegation_identity,omitempty"`
}

type TSAConfig struct {
	Addr            string `json:"addr,omitempty"`             // TSA listen address (e.g. ":3180")
	SignerCert      string `json:"signer_cert,omitempty"`      // TSA signer certificate PEM file
	SignerKey       string `json:"signer_key,omitempty"`       // TSA signer private key PEM file
	Chain           string `json:"chain,omitempty"`            // TSA certificate chain (intermediate + root)
	TSAPolicy       string `json:"tsa_policy,omitempty"`       // TSA policy OID (default: 2.16.840.1.101.3.4.2.1)
	Ordering        *bool  `json:"ordering,omitempty"`         // Enforce strict timestamp ordering (*bool so hot reload can toggle)
	AccuracySeconds int    `json:"accuracy_seconds,omitempty"` // Time accuracy in seconds
	AccuracyMillis  int    `json:"accuracy_millis,omitempty"`  // Time accuracy in milliseconds
	AccuracyMicros  int    `json:"accuracy_micros,omitempty"`  // Time accuracy in microseconds
	// Auto-renewal fields
	CoreURL       string `json:"core_url,omitempty"`        // varwof-core API URL for automatic signer renewal
	CAName        string `json:"ca_name,omitempty"`         // CA name to use for signer certificate renewal
	ValidityDays  int    `json:"validity_days,omitempty"`   // Renewed signer cert validity in days
	RenewalWindow string `json:"renewal_window,omitempty"`  // How far before expiry to trigger renewal (e.g. "720h")
	CheckInterval string `json:"check_interval,omitempty"`  // How often to check cert expiry (e.g. "1h")
	TLSClientCert string `json:"tls_client_cert,omitempty"` // mTLS client cert for varwof-core API calls
	TLSClientKey  string `json:"tls_client_key,omitempty"`  // mTLS client key for varwof-core API calls
	TLSCACert     string `json:"tls_ca_cert,omitempty"`     // CA cert to verify varwof-core API TLS
}

type TrustBridgeConfig struct {
	Bridges []TrustBridgePolicy `json:"bridges,omitempty"`
}

type TrustBridgePolicy struct {
	Enabled   bool   `json:"enabled"`                 // Enable this trust bridge
	IssuerCA  string `json:"issuer_ca"`               // Issuer CA name (the trust anchor)
	SubjectCA string `json:"subject_ca"`              // Subject CA name (the bridge target)
	Validity  int    `json:"validity_days,omitempty"` // Cross-cert validity in days
}

type WebhookConfig struct {
	URL                 string `json:"url,omitempty"`                   // Webhook callback URL
	Timeout             string `json:"timeout,omitempty"`               // HTTP request timeout (e.g. "10s")
	ExpiryCheckInterval string `json:"expiry_check_interval,omitempty"` // Expiry check interval (e.g. "24h")
	ExpiryThresholds    []int  `json:"expiry_thresholds,omitempty"`     // Days before expiry to trigger (e.g. [30,7,1])
}