ca

type AIC struct {
	Version                  int                     `asn1:"default:1"`
	AgentId                  string                  `asn1:"utf8"`
	PrincipalUid             PrincipalUid            `asn1:""`
	Capabilities             []Capability            `asn1:"sequence"`
	DelegationMode           DelegationMode          `asn1:"default:0"`
	AuthorizationConstraints []Capability            `asn1:"optional,omitempty,contextspecific,explicit,tag:0"`
	DelegationAuthorization  DelegationAuthorization `asn1:"optional,omitempty"`
	Extensions               []ExtField              `asn1:"optional,omitempty,contextspecific,explicit,tag:1"`
}

type AICConfig struct {
	AgentId                  string
	PrincipalUid             PrincipalUid
	DelegationMode           DelegationMode
	Capabilities             []Capability
	AuthorizationConstraints []Capability
	DelegationAuthorization  *DelegationAuthorization
	Version                  int
}

type AggregatorConfig struct {
	Window       time.Duration // Time window (default 200ms)
	BatchMax     int           // Maximum batch size (default 1000)
	AutoSwitchAt int           // Queue depth threshold for auto-switching to aggregation mode (default 50)
	BufferSize   int           // Pending issuance queue capacity (default 10000)
}

type AggregatorError struct {
	// contains filtered or unexported fields
}

type AggregatorReq struct {
	CN      string
	Profile string
	KeyType string
	CAName  string
	SAN     string
	Result  chan *AggregatorResult // Result channel
}

type AggregatorResult struct {
	Serial string
	Cert   *x509.Certificate
	Err    error
}

type AlgorithmIdentifier struct {
	Algorithm  asn1.ObjectIdentifier
	Parameters asn1.RawValue `asn1:"optional"`
}

type ArchivePolicy struct {
	Enabled        bool     `json:"enabled"`
	RetentionDays  int      `json:"retention_days"` // archive certs after N days from expiry/revocation
	ExcludeCAs     []string `json:"exclude_cas,omitempty"`
	IncludeCA      string   `json:"include_ca,omitempty"`
	ArchiveExpired bool     `json:"archive_expired"`
	ArchiveRevoked bool     `json:"archive_revoked"`
}

type ArchiveResult struct {
	Archived     int `json:"archived"`
	ExpiredCount int `json:"expired_count"`
	RevokedCount int `json:"revoked_count"`
}

type AutoRenewCallback func(caName, serial string, validityDays int) (newSerial string, err error)

type AutoRenewPolicy struct {
	Enabled         bool          `json:"enabled"`
	Interval        time.Duration `json:"interval"`
	WindowDays      int           `json:"window_days"`
	DefaultValidity int           `json:"default_validity_days"`
	Profiles        []string      `json:"profiles,omitempty"`    // only auto-renew these profiles (empty = all)
	ExcludeCAs      []string      `json:"exclude_cas,omitempty"` // skip these CAs
	NotifyOnly      bool          `json:"notify_only"`           // dry-run: notify but don't renew
	MaxRenewals     int           `json:"max_renewals"`          // max per run (0 = unlimited)
}

type AutoRenewResult struct {
	Serial      string `json:"serial"`
	CAName      string `json:"ca_name"`
	CommonName  string `json:"common_name"`
	OldNotAfter string `json:"old_not_after"`
	NewSerial   string `json:"new_serial,omitempty"`
	Action      string `json:"action"` // renewed, skipped, error, notify
	Error       string `json:"error,omitempty"`
}

type CRLConfig struct {
	DB              *db.DB
	CACert          *x509.Certificate
	CAKey           crypto.Signer
	CAName          string
	ValidityDays    int
	ThisUpdate      time.Time
	LastThisUpdate  time.Time // previous thisUpdate to guarantee monotonicity against clock rollback
	LastCRLNumber   *big.Int  // cRLNumber of the base CRL (for Delta CRL's Base CRL Number extension)
	Partition       int       // 0-based partition index. -1 means all (generate full CRL)
	TotalPartitions int       // total partition count. 0 or 1 = no partitioning

	// RevokedEntriesSource overrides the revoked-entries read path. When nil
	// (CLI/init-full) the DB is used directly. When set (serve layer with the
	// memory engine enabled) the engine is authoritative; revoked cross-cert
	// entries are always read from the DB as the engine does not index them.
	RevokedEntriesSource RevokedEntriesSource

	// NumberStore persists the last CRL number per CA (H12 fix). When nil the
	// in-memory counter is used and monotonicity is only guaranteed within a
	// single process lifetime.
	NumberStore CRLNumberStore
}

type CRLNumberStore interface {
	GetLastCRLNumber(caName string) (int64, error)
	SetLastCRLNumber(caName string, number int64) error
}

type Capability struct {
	SchemeId     string `json:"scheme_id,omitempty" asn1:"utf8"`
	CapabilityId string `json:"capability_id,omitempty" asn1:"utf8"`
	Parameters   []byte `json:"parameters,omitempty" asn1:"optional,omitempty,contextspecific,explicit,tag:0"`
}

type CertAggregator struct {
	// contains filtered or unexported fields
}

type CertBufferItem struct {
	Record *db.CertRecord
	Key    crypto.Signer
}

type CertSigner interface {
	SignBatch(items []*AggregatorReq, caName string) []*AggregatorResult
}

type CertSource interface {
	// FindCA returns every configured CA certificate (ca_meta) whose Subject
	// matches the given issuer, plus the trust anchors. Implementations may
	// return nil slices for either group.
	FindIssuerCandidates(issuerRaw string) ([]*x509.Certificate, error)
	// TrustAnchors returns the set of trusted root certificates.
	TrustAnchors() ([]*x509.Certificate, error)
}

type ChainNode struct {
	Subject     string `json:"subject"`
	Fingerprint string `json:"fingerprint"`
	Issuer      string `json:"issuer"`
	Trusted     bool   `json:"trusted"`
	Source      string `json:"source,omitempty"`
}

type ColdBackupEnvelope struct {
	Version       int    `json:"version"`
	CAName        string `json:"ca_name"`
	CreatedAt     string `json:"created_at"`
	CertPEM       string `json:"cert_pem"`
	EncryptedKey  string `json:"encrypted_key"`            // base64(PBES2 DER)
	CertSHA256    string `json:"cert_sha256"`              // hex
	KeyFP         string `json:"key_fingerprint"`          // hex SHA-256 of public key
	MAC           string `json:"mac"`                      // base64(HMAC-SHA256 over canonical fields)
	MACSalt       string `json:"mac_salt,omitempty"`       // base64(16B salt), M11+
	MACIterations int    `json:"mac_iterations,omitempty"` // PBKDF2 iterations, M11+
}

type CreateConfig struct {
	DB                *db.DB
	Name              string
	SubjectName       string // optional, overrides Name as CN
	Profile           Profile
	Parent            *x509.Certificate
	ParentKey         crypto.Signer
	KeyType           string
	ReuseKey          crypto.Signer
	Validity          time.Duration
	CRLBaseURL        string
	PermittedDomains  []string
	ExcludedDomains   []string
	PermittedEmails   []string
	ExcludedEmails    []string
	PermittedURIs     []string
	ExcludedURIs      []string
	PermittedIPRanges []string
	ExcludedIPRanges  []string
	DefaultCountry    string
	DefaultOrg        string
	MaxPathLen        int // override profile default (0 = use profile default)
	OCSPURL           string
	IssuerURL         string
}

type CreateResult struct {
	Cert      *x509.Certificate
	CertDER   []byte
	Signer    crypto.Signer
	SerialHex string
}

type DBSource struct {
	DB *db.DB
}

type DelegationAuthorization struct {
	Reason             Reason              `asn1:""`
	RequestedLifetime  int                 `asn1:"default:0"`
	Timestamp          time.Time           `asn1:"generalized"`
	Nonce              []byte              `asn1:"octet"` // 32-byte random number, anti-replay (REQUIRED)
	SignatureAlgorithm AlgorithmIdentifier `asn1:""`
	SignatureValue     []byte              `asn1:"octet"`
}

type DelegationMode int

type DelegationModeEnum int

type DelegationPolicy struct {
	Version         int `json:"version,omitempty" asn1:"default:1"`
	MaxAgents       int `json:"max_agents,omitempty" asn1:"default:1"`
	AllowedMode     int `json:"allowed_mode,omitempty" asn1:"enum,default:0"`
	MaxSessionHours int `json:"max_session_hours,omitempty" asn1:"optional,omitempty,explicit,tag:0"`
}

type DeltaCRLConfig struct {
	// Since is the base CRL thisUpdate; only certificates revoked at or after
	// this time are included in the delta.
	Since time.Time
	// BaseCRLNumber is the cRLNumber of the base CRL the delta applies to
	// (encoded in the Base CRL Number extension, 2.5.29.31).
	BaseCRLNumber *big.Int
}

type ExtField struct {
	ExtnID    asn1.ObjectIdentifier `asn1:"objectidentifier"`
	Critical  bool                  `asn1:"default:false"`
	ExtnValue []byte                `asn1:"octet"`
}

type IdentitySource interface {
	Lookup(ctx context.Context, source, username string) (*UserIdentity, error)
}

type IdentitySourceConfig struct {
	// Type is the identity source kind: "ldap" (bridge-ldap) or "oauth" (bridge-oauth). Default "ldap".
	Type IdentitySourceType `json:"type,omitempty"`
	// SourceURL is the base URL of the identity bridge service, e.g. "http://127.0.0.1:8082".
	SourceURL string `json:"source_url,omitempty"`
	// Token is the bridge management API bearer token. Empty = no auth.
	Token string `json:"token,omitempty"`
	// Source is the default source_tag used when a request does not specify one.
	Source string `json:"source,omitempty"`
	// Username is the automation account username (oauth type only, resource-owner grant).
	Username string `json:"username,omitempty"`
	// Password is the automation account password (oauth type only, resource-owner grant).
	Password string `json:"password,omitempty"`
	// TimeoutSec bounds each upstream bridge request. Default 10.
	TimeoutSec int `json:"timeout_sec,omitempty"`
	// OUFromGroups maps identity-source groups to certificate OU values
	// (RBAC roles). Matching is exact OR case-insensitive suffix containment
	// of the OU-portion of an LDAP group DN. When no rule matches, DefaultOU
	// (or the source dept) is used.
	OUFromGroups map[string]string `json:"ou_from_groups,omitempty"`
	// DefaultOU is the OU written when no OUFromGroups rule matches and the
	// source carries no dept. Empty = omit OU.
	DefaultOU string `json:"default_ou,omitempty"`
	// DisabledOK allows issuing identity-user certs for disabled accounts.
	// Default false: disabled accounts are rejected (fail-closed).
	DisabledOK bool `json:"disabled_ok,omitempty"`
}

type IdentitySourceType string

type ImportTrustResult struct {
	Imported int
	Skipped  int
	Total    int
}

type IssueResult struct {
	Cert   *x509.Certificate
	Record *db.CertRecord
	Key    crypto.Signer
}

type JWK = aicjwt.JWK

type JWKS = aicjwt.JWKS

type JWTSignOptions struct {
	// Audience is the aud claim (REQUIRED by draft). Empty → defaults to
	// "varwof-core" (the core issuer's own audience).
	Audience []string
	// Issuer overrides the iss claim. Empty → "varwof-core".
	Issuer string
	// TokenType overrides the default typ (aic+jwt). Kept for extensibility.
	TokenType string
	// Scope is an optional OAuth scope string mirroring the AIC capabilities
	// (informational; capabilities remain the authority).
	Scope string
	// StatusListURI, when set, adds a status claim (RFC 9457 status list
	// reference) pointing to the core revocation status list endpoint.
	StatusListURI string
	// StatusListIndex is the index within the status list.
	StatusListIndex int
	// DA is an optional inner DA JWS (typ aic+da+jwt, signed by the principal
	// key). Authorized mode omits it (lifetime-bounded lightweight profile);
	// representative mode REQUIRES it. When set, it is embedded in the outer
	// "da" claim.
	DA string
}

type Job struct {
	ID        string          `json:"id"`
	Status    JobStatus       `json:"status"`
	Progress  int             `json:"progress"` // completed count
	Total     int             `json:"total"`    // total count
	CreatedAt time.Time       `json:"created_at"`
	Error     string          `json:"error,omitempty"`
	Results   []JobResultItem `json:"results,omitempty"`
	// contains filtered or unexported fields
}

type JobProcessor interface {
	Process(items []JobRequestItem) []JobResultItem
}

type JobQueue struct {
	// contains filtered or unexported fields
}

type JobRequest struct {
	Items []JobRequestItem `json:"requests"`
}

type JobRequestItem struct {
	CN      string `json:"cn"`
	SAN     string `json:"san,omitempty"`
	Profile string `json:"profile,omitempty"`
	KeyType string `json:"key_type,omitempty"`
	CA      string `json:"ca,omitempty"`
}

type JobResultItem struct {
	Serial string `json:"serial,omitempty"`
	CN     string `json:"cn"`
	Status string `json:"status"`
	Error  string `json:"error,omitempty"`
}

type JobStatus string

type LDAPConfig struct {
	URL          string `json:"url,omitempty"`
	BindDN       string `json:"bind_dn,omitempty"`
	BindPassword string `json:"bind_password,omitempty"`
	BaseDN       string `json:"base_dn,omitempty"`
	Filter       string `json:"filter,omitempty"`
	UIDAttr      string `json:"uid_attr,omitempty"`
	MapCN        string `json:"map_cn,omitempty"`
	MapOrg       string `json:"map_o,omitempty"`
	MapOU        string `json:"map_ou,omitempty"`
	MapL         string `json:"map_l,omitempty"`
	MapST        string `json:"map_st,omitempty"`
	MapC         string `json:"map_c,omitempty"`
	MapEmail     string `json:"map_email,omitempty"`
}

type LDAPLookup interface {
	Lookup(cfg *LDAPConfig, username string) (*pkix.Name, error)
	CheckMembership(cfg *LDAPConfig, username, groupDN string) (bool, error)
}

type MemoryBuffer struct {
	// contains filtered or unexported fields
}

type NameConstraints struct {
	PermittedDomains  []string
	ExcludedDomains   []string
	PermittedEmails   []string
	ExcludedEmails    []string
	PermittedURIs     []string
	ExcludedURIs      []string
	PermittedIPRanges []string
	ExcludedIPRanges  []string
}

type NonceStorer interface {
	StoreNonce(nonce []byte) error
	ConsumeNonce(nonce []byte) error
}

type OfflineSignConfig struct {
	CACert   *x509.Certificate
	CAKey    crypto.Signer
	CSR      *x509.CertificateRequest
	Validity time.Duration
	Hash     string // sha256, sha384, sha512
	PathLen  int    // 0 = sub-ca, 1+ = intermediate, -1 = no constraint
}

type PathVerificationResult struct {
	// Valid is true when every x509-level check (signature, validity, KU,
	// basic constraints) passed.
	Valid bool `json:"valid"`
	// Chain is the ordered path leaf → root (length ≥ 1).
	Chain []*x509.Certificate `json:"-"`
	// RootIsTrusted is true when the path terminates in a trust anchor.
	RootIsTrusted bool `json:"root_is_trusted"`
	// Policy is the policy-processing outcome (nil when Valid is false or no
	// policy processing was requested).
	Policy *PolicyDecision `json:"policy,omitempty"`
	// RejectReason describes why the path was rejected (empty when Valid).
	RejectReason string `json:"reject_reason,omitempty"`
}

type PersistConfig struct {
	Mode          PersistMode
	BatchSize     int           // Batch trigger count (default 100)
	BatchInterval time.Duration // Timer trigger interval (default 5 seconds)
	QueueSize     int           // Queue capacity limit (default 10000)
}

type PersistMode int

type Policy struct {
	Rules []PolicyRule `json:"rules"`
}

type PolicyDecision struct {
	// AcceptedUserPolicies is the non-empty intersection of the final policy
	// set and the requester's user-initial-policy-set. When the requester
	// accepted anyPolicy (empty user set), AcceptedUserPolicies lists the
	// valid policies actually matched.
	AcceptedUserPolicies []string
	// MappedPolicies lists the effective policy mappings applied along the
	// path (issuerDomainPolicy → subjectDomainPolicy at each mapping CA).
	MappedPolicies []PolicyMappingApplied
	// InhibitAnyPolicyHit is true when anyPolicy was suppressed by an
	// inhibitAnyPolicy constraint along the path.
	InhibitAnyPolicyHit bool
	// ExplicitPolicyRequired is true when a requireExplicitPolicy constraint
	// was in force at the leaf.
	ExplicitPolicyRequired bool
	// ValidPolicyTree describes, per depth, the valid policies at that
	// certificate. Depth 0 is the leaf.
	ValidPolicyTree []ValidPolicyNode
}

type PolicyMapping struct {
	IssuerDomainPolicy  string // Issuer domain policy OID (e.g. "2.5.29.32.0")
	SubjectDomainPolicy string // Subject domain policy OID
}

type PolicyMappingApplied struct {
	Depth               int    `json:"depth"`
	IssuerDomainPolicy  string `json:"issuer_domain_policy"`
	SubjectDomainPolicy string `json:"subject_domain_policy"`
}

type PolicyRule struct {
	Comment         string   `json:"comment,omitempty"`
	AllowedCNs      []string `json:"allowed_cns,omitempty"`
	DeniedCNs       []string `json:"denied_cns,omitempty"`
	AllowedSANs     []string `json:"allowed_sans,omitempty"`
	DeniedSANs      []string `json:"denied_sans,omitempty"`
	AllowedProfiles []string `json:"allowed_profiles,omitempty"`
	AllowedKeyTypes []string `json:"allowed_key_types,omitempty"`
	AllowedCAs      []string `json:"allowed_cas,omitempty"`
	MaxValidityDays int      `json:"max_validity_days,omitempty"`
}

type PrincipalAuthorization struct {
	Version                  int              `asn1:"default:1"`
	Grants                   []Capability     `asn1:"optional,omitempty"`
	AuthorizationConstraints []Capability     `asn1:"optional,omitempty,contextspecific,explicit,tag:0"`
	DelegationPolicy         DelegationPolicy `asn1:"optional,explicit,tag:1"`
	Extensions               []ExtField       `asn1:"optional,omitempty,contextspecific,explicit,tag:2"`
}

type PrincipalAuthorizationConfig struct {
	Grants []Capability `json:"grants,omitempty"`
	// AuthorizationConstraints is the principal's operational boundary — the
	// time window / network / parameter limits that every delegation from this
	// principal inherits.  It is set when the *user* certificate is issued and
	// is the source of truth the DA and AIC copy from; an agent can only
	// narrow it, never widen it.
	AuthorizationConstraints []Capability      `json:"authorization_constraints,omitempty"`
	DelegationPolicy         *DelegationPolicy `json:"delegation_policy,omitempty"`
}

type PrincipalUid struct {
	Version    int                 `asn1:"default:1"`
	Realm      string              `asn1:"utf8"`
	Identifier string              `asn1:"utf8"`
	KeyHash    []byte              `asn1:"octet"`
	HashAlgo   AlgorithmIdentifier `asn1:"optional,omitempty,explicit,tag:0"`
}

type Profile string

type Reason struct {
	ReasonCode  string `asn1:"utf8"`
	Description string `asn1:"utf8"`
}

type RenewalToken struct {
	Version        int          `asn1:"default:1"`
	PrincipalUid   PrincipalUid `asn1:"optional,contextspecific,tag:0"`
	OldCertSerial  []byte       `asn1:"octet"`
	NewKeyHash     []byte       `asn1:"octet"`
	Timestamp      time.Time    `asn1:"generalized"`
	Nonce          []byte       `asn1:"octet"` // SIZE(16)
	ValidityPeriod int          `asn1:"default:300"`
}

type RenewalTokenExt struct {
	Version        int          `asn1:"default:1"`
	PrincipalUid   PrincipalUid `asn1:"optional,contextspecific,tag:0"`
	OldCertSerial  []byte       `asn1:"octet"`
	NewKeyHash     []byte       `asn1:"octet"`
	Timestamp      time.Time    `asn1:"generalized"`
	Nonce          []byte       `asn1:"octet"` // SIZE(16)
	ValidityPeriod int          `asn1:"default:300"`
}

type RevokedEntriesSinceSource interface {
	GetRevokedCertEntriesSince(caName string, since time.Time) ([]*db.RevokedCertEntry, error)
}

type RevokedEntriesSource interface {
	GetRevokedCertEntries(caName string) ([]*db.RevokedCertEntry, error)
}

type RotatingSigner struct {
	// contains filtered or unexported fields
}

type SignCSRCallback func(csrDER []byte, cn, profile, caName string) (serial string, certDER []byte, err error)

type SignConfig struct {
	DB                *db.DB
	SkipDB            bool // true = issue only, no DB write (high-throughput batch mode, caller responsible for persistence)
	CAKey             crypto.Signer
	CACert            *x509.Certificate
	CAName            string
	SubjectPubKey     any
	Profile           Profile
	CommonName        string
	Subject           *pkix.Name
	SANs              []string
	CAScope           []string
	KeyType           string
	Hash              string
	CRLBaseURL        string
	OCSPURL           string
	IssuerURL         string
	Validity          time.Duration
	DefaultCountry    string
	DefaultOrg        string
	IssuerAltNames    []string
	SubjectInfoAccess []string
	PolicyOIDs        []string
	// PolicyMappings is the RFC 5280 §4.2.1.5 Policy Mappings extension,
	// each item maps issuerDomainPolicy to subjectDomainPolicy, allowed only in CA certificates
	// (enterprise bridge / cross-domain trust scenarios).
	PolicyMappings []PolicyMapping
	// RequireExplicitPolicy is the RFC 5280 §4.2.1.11 Policy Constraints
	// requireExplicitPolicy (skipCerts count). nil means this field is not generated.
	RequireExplicitPolicy *int
	// InhibitPolicyMapping is the RFC 5280 §4.2.1.11 Policy Constraints
	// inhibitPolicyMapping (skipCerts count). nil means this field is not generated.
	InhibitPolicyMapping *int
	// InhibitAnyPolicy is the RFC 5280 §4.2.1.14 Inhibit anyPolicy extension's skipCerts
	// count (0 means anyPolicy is prohibited on this certificate chain). nil means this extension is not generated.
	InhibitAnyPolicy  *int
	DedupCN           bool
	MaxPathLen        int
	ExtraEKUOIDs      []string
	MustStaple        bool
	CRLPartitions     int
	NotBefore         *time.Time
	NotAfter          *time.Time
	PermittedDomains  []string
	ExcludedDomains   []string
	PermittedEmails   []string
	ExcludedEmails    []string
	PermittedURIs     []string
	ExcludedURIs      []string
	PermittedIPRanges []string
	ExcludedIPRanges  []string
	Policy            *Policy
	PolicyFile        string
	// RequirePolicy (M4 fix): when true and no issuance policy is loaded, Sign()
	// rejects issuance instead of warn-and-continue. The serve layer derives it
	// from config enforce_policy. Library consumers may set it explicitly.
	RequirePolicy bool
	// RequireTLSServerSAN (F11 fix): when true, a TLS-server certificate with
	// no subjectAltName (RFC 5280 §4.1.2.6 / RFC 6125) is rejected at issuance
	// instead of warn-and-continue. Mirrors RequirePolicy so strict deployments
	// can opt in without breaking existing CN-only issuance.
	RequireTLSServerSAN bool
	AIC                 *AICConfig // Agent Identity Certificate configuration
	// SPIFFEID, when set, is placed in the certificate SAN URIs (RFC 7555
	// spiffe:// URI) as the workload's SPIFFE identity. It is kept distinct from
	// AIC.AgentId so the AIC extension can carry the plain agent name (matching
	// the DA-authorized identity) while the SPIFFE ID lives only in the SAN —
	// this is what the validating side (gateway) actually enforces on.
	SPIFFEID               string
	PrincipalAuthorization *PrincipalAuthorizationConfig // user authorization
	Scope                  string                        // admin scope: which CAs this admin can manage (comma-separated)
	// MaxAgentProxyValidity is the hard upper bound for agent-proxy (authorized mode)
	// certificate validity. 0 uses DefaultAgentProxyMaxValidity (1h); spec P1-B-09/25 and
	// P2-A-04's "authorized certificate validity ≤24h" semantics — default 1h, can be relaxed
	// up to ≤24h via configuration.
	MaxAgentProxyValidity time.Duration

	// ValidateCapabilities is an optional AIC capability registration validation hook.
	// Injected by the upper layer (serve layer): passes the full identifiers of capabilities
	// declared in the AIC ("scheme:capability_id" list) to the register capability registry
	// for validation; returns an error if issuance should fail. nil means skip this validation
	// (capability registration validation not enabled, backward compatible).
	ValidateCapabilities func(caps []string) error

	// UserCert is the DA signer (user) certificate whose SPKI hash must match
	// AIC.PrincipalUid.KeyHash. When set (and AIC is non-nil), Sign() verifies
	// the DelegationAuthorization signature at the library layer (M5 fix) — so
	// library consumers cannot mint AIC certificates carrying unverified DA
	// evidence.
	UserCert *x509.Certificate

	// DelegationAlreadyVerified asserts that the caller has already verified
	// the DelegationAuthorization signature by other means. It is required when
	// AIC carries a DelegationAuthorization but UserCert is nil: without either,
	// Sign() refuses rather than minting a certificate whose delegation was
	// never verified. Set it only where verification genuinely happened
	// elsewhere (the serve /api/aic/issue path verifies the client's signed
	// message itself) or where the DA carries no principal signature to verify
	// (OAuth re-issuance, lab fixtures).
	DelegationAlreadyVerified bool

	// ConsumeDANonce is an optional anti-replay hook called once with the DA nonce
	// after DA signature verification passes. Injected by the serve layer (engine or
	// DB store); library consumers that need replay protection may supply their own.
	// nil skips nonce consumption (no persistence → replayable).
	ConsumeDANonce func(nonce []byte) error
}

type SignJWTResult struct {
	Token     string // JWS compact serialization
	Header    aicjwt.Header
	Claims    aicjwt.OuterClaims
	Principal PrincipalUid
	AgentID   string
	CA        *x509.Certificate
	Alg       string
}

type SignResult struct {
	Cert       *x509.Certificate
	CertDER    []byte
	SerialHex  string
	PrivateKey crypto.Signer
	// Record is the DB record for this certificate. In SkipDB mode, the database is not
	// written; the caller is responsible for persistence (e.g. via RecordBuffer batch
	// persistence); also populated in synchronous write mode.
	Record *db.CertRecord
}

type SignerKey struct {
	Cert *x509.Certificate
	Key  crypto.Signer
}

type StaticSource struct {
	CAs   []*x509.Certificate
	Roots []*x509.Certificate
}

type SubCAConfig struct {
	Name             string        // Unique name for the sub-CA
	ParentCA         string        // Parent CA name (issuing CA)
	KeyType          string        // Key type (ecdsa-p256, ecdsa-p384, rsa-2048, etc.)
	Validity         time.Duration // Certificate validity period
	MaxPathLen       int           // Path length constraint (0 for end-entity only)
	KeyUsage         []string      // Key usage extensions
	Protocol         string        // Protocol identifier (scep, cmp, acme, est)
	PermittedDomains []string      // Name constraints: permitted domains
	ExcludedDomains  []string      // Name constraints: excluded domains
	CRLBaseURL       string        // Base URL for the CRL Distribution Point extension
}

type SubCAMeta struct {
	ID           int64
	Name         string
	ParentCA     string
	Cert         *x509.Certificate
	CertDER      []byte
	KeyEncrypted []byte
	Subject      string
	NotBefore    time.Time
	NotAfter     time.Time
	KeyAlgorithm string
	Fingerprint  string
	Status       string
	Protocol     string
	KeyUsage     string
	MaxPathLen   int
	CreatedAt    time.Time
	RevokedAt    *time.Time
	RevokeReason *int
}

type SubCAResult struct {
	Name        string
	Cert        *x509.Certificate
	CertDER     []byte
	CertPEM     []byte
	Key         crypto.Signer
	KeyPEM      []byte
	SerialHex   string
	Fingerprint string
}

type TrustBridgeConfig struct {
	Bridges []TrustBridgePolicy `json:"bridges,omitempty"`
}

type TrustBridgePolicy struct {
	Enabled         bool     `json:"enabled"`
	IssuerCA        string   `json:"issuer_ca"`
	SubjectCA       string   `json:"subject_ca"`
	Validity        int      `json:"validity_days"`
	NameConstraints []string `json:"name_constraints,omitempty"`
}

type UserIdentity struct {
	Username string   `json:"username"`
	FullName string   `json:"full_name,omitempty"`
	Email    string   `json:"email,omitempty"`
	Dept     string   `json:"dept,omitempty"`
	Groups   []string `json:"groups,omitempty"`
	Source   string   `json:"source,omitempty"`
	Disabled bool     `json:"disabled"`
}

type ValidPolicyNode struct {
	Depth    int      `json:"depth"`
	Policies []string `json:"policies"`
}

type VerifyPathOptions struct {
	// UserInitialPolicySet is the set of acceptable certificate policies.
	// An empty set means "any policy is acceptable" (RFC 5280 §6.1.1 empty
	// user-initial-policy-set).
	UserInitialPolicySet []string
	// PolicyOID strings are parsed once; pass the ASN.1 OIDs to avoid
	// re-parsing.
	UserInitialPolicyOIDs []asn1ObjectIdentifier
	// VerifyPolicy enables RFC 5280 §6.1 policy processing. When false, only
	// structural validation (signatures, validity, trust) is performed.
	VerifyPolicy bool
	// CurrentTime overrides the "now" used for validity checks (default: now).
	CurrentTime time.Time
	// MaxDepth bounds chain length to protect against certificate loops.
	// Default 16 (RFC 5280 recommends ≤ 8 for normal PKIs, but bridge CA
	// chains can be longer).
	MaxDepth int
}

type VerifyResult struct {
	Valid           bool        `json:"valid"`
	Chain           []ChainNode `json:"chain,omitempty"`
	Verified        bool        `json:"verified"`
	RootTrustSource string      `json:"root_trust_source,omitempty"`
}