{ pkgs, ... }:

{
  # Create the plugdev group (required for user-space USB access to YubiKey)
  users.groups.plugdev = {};

  # Enable PC/SC daemon — required for GPG smartcard (gpg --card-status) and YubiKey
  services.pcscd.enable = true;

  # udev rules so the YubiKey gets plugdev group ownership and correct permissions
  services.udev.packages = with pkgs; [
    yubikey-personalization
    libu2f-host
  ];

  # Add udev rule for YubiKey CCID interface to be readable by pcscd
  services.udev.extraRules = ''
    # YubiKey FIDO+CCID (0x0406) - ensure CCID interface is accessible
    SUBSYSTEM=="usb", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0406", MODE="0666"
    SUBSYSTEM=="usb_device", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0406", MODE="0666"
  '';

  # CCID driver for smartcard access (required for YubiKey CCID functionality)
  # Set up the PC/SC drivers directory with CCID driver bundle
  system.activationScripts.pcscdSetup = ''
    mkdir -p /var/lib/pcsc/drivers
    # Symlink the entire CCID bundle (or create it if it doesn't exist)
    rm -rf /var/lib/pcsc/drivers/ifd-ccid.bundle 2>/dev/null || true
    ln -sf "${pkgs.ccid}/pcsc/drivers/ifd-ccid.bundle" /var/lib/pcsc/drivers/ifd-ccid.bundle
  '';


  # YubiKey management tools
  environment.systemPackages = with pkgs; [
    yubikey-manager          # ykman CLI
    yubikey-personalization  # ykpers / ykchalresp
    yubico-piv-tool          # PIV applet management
  ];
}