Configuration

php artisan vendor:publish --tag=a1-pdf-sign-config

Every key is a scalar and every one has an env variable or a sensible default. Config\SignetConfigFactory turns them into the engine's own configuration when the container boots, which is where a bad value fails:

a1-pdf-sign.signature.profile is [pades-b-xx], and has to be one of:
legacy, pades-b-b, pades-b-t, pades-b-lt, pades-b-lta

The file holds no objects, so config:cache keeps working. That is an invariant rather than a detail: a config file carrying an enum instance fails to cache, and it fails in your application rather than here, on a command nobody runs until deployment.

Signing

Key	Env	Default
signature.profile	A1_PDF_SIGN_PROFILE	pades-b-b
signature.digest_algorithm	A1_PDF_SIGN_DIGEST	sha256
signature.policy	A1_PDF_SIGN_POLICY	none

profile is what a signature is: legacy, pades-b-b, pades-b-t, pades-b-lt, pades-b-lta. What each requires and what it buys is signet-pdf's profile reference.

policy declares an ICP-Brasil signature policy. Naming a family resolves to the version in force, which is the point of naming a family at all:

'policy' => 'ad-rt',                      // whichever AD-RT is current
'policy' => '2.16.76.1.7.1.12.1.2',       // that version, specifically
'policy' => [                             // a policy from anywhere else
    'oid' => '…',
    'digest_algorithm' => 'sha256',
    'digest' => '…',
    'uri' => 'https://…',
],

The timestamp authority

Key	Env	Default
signature.timestamp.url	A1_TSA_URL	none
signature.timestamp.username	A1_TSA_USERNAME	none
signature.timestamp.password	A1_TSA_PASSWORD	none
signature.timestamp.timeout		20
signature.timestamp.attempts		3
signature.timestamp.backoff		200

Required by every profile above pades-b-b. Signing refuses rather than silently producing a lower profile than you asked for.

signature.ltv.* carries the same three numbers for revocation material, and they are deliberately smaller: a timestamp authority failing fails the signature, and a revocation responder failing only means less material is embedded.

Certificates

Key	Env	Default
certificate.use_path_env	A1_PDF_SIGN_USE_PATH_ENV	false
certificate.legacy	A1_PDF_SIGN_LEGACY_CERTIFICATE	false
certificate.chain_paths		[]

legacy adds openssl's -legacy flag, needed to read old PFX files under OpenSSL 3. chain_paths is a set of intermediate certificates, not a sequence: the engine builds the chain from what the files contain rather than trusting the order they are listed in.

The seal

seal.driver, seal.transparent, seal.background, seal.text.x, seal.text.rows, seal.font.path, seal.font.size, seal.font.color.

What each does to the rendered image is signet-pdf's seal reference.

AI agents

Key	Env	Default
agents.disks		[]
agents.max_bytes		52428800 (50 MB)
agents.expose_registry	A1_PDF_SIGN_AGENTS_EXPOSE_REGISTRY	false
agents.idempotency.store	A1_PDF_SIGN_AGENTS_CACHE_STORE	the default cache store
agents.idempotency.ttl		86400

Read only by the optional agent tools, and inert until laravel/mcp or laravel/ai is installed and a tool is used.

disks is the list of Storage disks an agent may read from and write to. Empty opens none, so every tool refuses every call until you choose. max_bytes is the largest document an agent may have read or signed; null removes it. Who may reach which document is not a key: it is your gate, with the abilities in Agents\Ability. expose_registry hands a signer's CPF or CNPJ to the model, which is personal data sent to a model provider. idempotency is where the signing tool records the calls it already signed; use a store whose add() is atomic in production. All of it is explained in AI agents.

Temporary files

temp_path, A1_PDF_SIGN_TEMP_PATH. Null uses the system temporary directory. A1PdfSign::tempPath() creates it if it is not there, which is what a queued job on a fresh container needs.