config

type AddonsConfig struct {
	// Dir is an operator-owned directory holding one subdirectory per add-on,
	// each with an addon.json and the .wasm it describes.
	//
	// **Unset is the shipped default and it means there is no host**: no WASM
	// runtime is constructed, no goroutine started, no route mounted, no table
	// created and no metric series published. That is asserted by tests in
	// internal/addon rather than promised here, because "off costs nothing" is
	// the kind of claim that stops being true one milestone after somebody writes
	// it down.
	//
	// Operator-owned rather than a path an add-on or a tenant can influence: a
	// module in this directory is code this instance executes, so who may write
	// to it is the whole of the trust boundary. docs/SECURITY.md states that in
	// the same terms.
	Dir string `env:"ADDONS_DIR"`

	// InlineDeadline is how long an add-on holding `redirect.inline` may keep a
	// redirect open before the host stops waiting for it, kills the invocation and
	// answers the visitor without it (M66).
	//
	// **One knob for the instance, with no per-add-on override**, which was fixed
	// as the shape of this answer a phase before the number existed: a second
	// number per add-on would be an operator choosing a latency budget per module
	// with no more information than they had for the first, and the case that
	// argues for one has not arrived.
	//
	// The default is measured rather than chosen — see addon.DefaultInlineDeadline
	// and the runs in docs/slo.md — and it is deliberately larger than the 20 ms
	// cached-redirect target. The target is core's, measured with nothing on the
	// path; this is the point at which the host stops waiting for somebody else's
	// code, and setting it under the target would kill add-ons that were working.
	//
	// It bounds the **guest call and nothing else**. Starting the module is this
	// host's own cost on this host's machine, so it is bounded separately by
	// [AddonsConfig.InstantiateDeadline] below. The two shipped as one number and
	// that was F326: on a machine slower than the one 25 ms was measured on, every
	// invocation was killed before the add-on's code ran, and the counter blamed
	// the add-on.
	InlineDeadline time.Duration `env:"ADDON_INLINE_DEADLINE" envDefault:"25ms"`

	// InstantiateDeadline is how long this instance will spend starting an add-on's
	// module for a redirect — inline or observing — before it gives up and serves
	// the redirect without it (M66, reopened; D327).
	//
	// **Separate from the deadline above because it is somebody else's cost.** What
	// a module does is the add-on's and is bounded by a number an operator sets
	// against their tolerance for latency; what instantiating costs is a property
	// of this machine, this load and this build, none of which the add-on chose.
	// Charging it to the add-on's budget made the add-on's budget a function of how
	// fast the hardware is, which is what F326 found on a CI runner.
	//
	// **Wider, and not borrowed from either number that already exists.**
	// addon.DefaultLoadTimeout bounds a module that hangs at boot at 30 seconds and
	// no redirect may wait that; the inline deadline is the number that proved too
	// small. That first bound is a **constant**, not a variable: this sentence
	// named a `LINKCTRL_ADDON_LOAD_TIMEOUT` until 0.4.0 and no such variable has
	// ever existed — there is no struct field, no `env` tag, no `.env.example`
	// line and no row in docs/configuration.md, and `Options.LoadTimeout` is set by
	// tests and by nothing else (F327). An operator who read the reasoning and
	// acted on it set nothing, and the module that hangs at boot still held the
	// boot for thirty seconds. Whether that bound *should* be an operator's is a
	// question this correction deliberately does not answer, because adding a
	// configuration surface is not a comment's to decide. 500 ms is eight times instantiation measured under contention on
	// the machine the figure was taken on, and it is what a module hanging in
	// package initialization costs the one redirect it arrived on — see
	// addon.DefaultInstantiateDeadline for the measurement and the arithmetic. It
	// leans wide on purpose: a bound that is too small stops add-ons running and
	// blames them for it, which is the defect this variable exists because of.
	InstantiateDeadline time.Duration `env:"ADDON_INSTANTIATE_DEADLINE" envDefault:"500ms"`

	// PoolSize is how many add-on instances this instance keeps ready, across every
	// add-on, when nothing is using them (M66.5).
	//
	// **It is not a concurrency bound**, and the difference is the whole reason it
	// is its own variable. How many add-on invocations run at once is fixed at
	// sixteen in the build and no variable moves it; this is how many of the
	// instances they run in are kept afterwards instead of being destroyed. An
	// invocation that finds the pool empty makes an instance, exactly as every
	// invocation did before this existed.
	//
	// What it buys is the startup: a redirect through a pooled instance skips
	// allocating the module's linear memory and running its package initialization,
	// which for the fixture measured in docs/slo.md was almost the whole of an
	// 11.05 ms invocation — 451 µs once it was pooled. What it costs is memory held at rest — up to this many instances
	// of 8 MiB, on top of the sixteen in flight — which is why the default is small
	// rather than generous. See addon.DefaultPoolSize for the arithmetic.
	PoolSize int `env:"ADDON_POOL_SIZE" envDefault:"8"`

	// PoolTTL is how long an unused add-on instance is kept before it is closed
	// (M66.5).
	//
	// It is what makes the idle cost proportional to traffic rather than to the
	// busiest minute since the process started. On an instance with a redirect an
	// hour it means the pool holds nothing; on one with a redirect a second it means
	// the sweep never finds an idle entry at all.
	PoolTTL time.Duration `env:"ADDON_POOL_TTL" envDefault:"1m"`

	// RouteDeadline is how long one request to an add-on's own page may take
	// (M68.5), start to finish: instantiating the module, running its handler and
	// every host call inside it, including an outbound fetch.
	//
	// **It is a bound inside HTTP_REQUEST_TIMEOUT, not the first bound a route
	// handler ever had.** A route runs under the application tree's request
	// context, which [HTTPConfig.RequestTimeout] already cancels at fifteen
	// seconds — so this only ever fires if it is shorter, which [Config.Validate]
	// enforces. Ten seconds leaves the host five to turn a killed guest into a page
	// and a counter instead of dying with it, holds three fetches at FetchTimeout,
	// and is the only bound at all on an instance that has set HTTP_REQUEST_TIMEOUT
	// to zero. See addon.DefaultRouteDeadline for what the earlier fifteen got
	// wrong and how it was measured.
	RouteDeadline time.Duration `env:"ADDON_ROUTE_DEADLINE" envDefault:"10s"`

	// FetchTimeout bounds one outbound request an add-on makes (M68.5), connect
	// through the last byte of the body.
	//
	// It is a ceiling and not a reservation: a fetch ends at this or at whatever is
	// left of RouteDeadline, whichever comes first, so an add-on cannot buy time by
	// reaching outward. Three seconds is an order of magnitude over what this
	// capability is for and is what lets three of them fit inside RouteDeadline —
	// see addon.DefaultFetchTimeout for the documents that were measured.
	FetchTimeout time.Duration `env:"ADDON_FETCH_TIMEOUT" envDefault:"3s"`

	// FetchMaxBytes is the largest response body an add-on's fetch will carry back
	// (M68.5). A response over it is refused whole rather than truncated, because a
	// truncated JSON document is a parse error blamed on the add-on's author.
	FetchMaxBytes int64 `env:"ADDON_FETCH_MAX_BYTES" envDefault:"262144"`
}

type AliasConfig struct {
	Length          int      `env:"ALIAS_LENGTH" envDefault:"7"`
	MinUserLength   int      `env:"ALIAS_MIN_USER_LENGTH" envDefault:"3"`
	ReservedExtra   []string `env:"ALIAS_RESERVED_EXTRA" envSeparator:","`
	ProfanityFilter bool     `env:"ALIAS_PROFANITY_FILTER" envDefault:"true"`
	// DestSchemes may narrow the scheme allowlist and may never widen it:
	// Validate refuses anything outside {http, https}. Non-http(s) schemes are
	// the unappealable tier (M30), and a variable that could add "javascript"
	// back would be an override switch on a tier documented as having none.
	DestSchemes   []string `env:"DESTINATION_SCHEMES" envSeparator:"," envDefault:"http,https"`
	DestMaxLength int      `env:"DESTINATION_MAX_LENGTH" envDefault:"2048"`

	// DestBlocklist is the operator's own host list. Since M30 it seeds the
	// runtime Postgres blocklist at boot rather than being consulted in memory,
	// and it is reconciled on every boot — an entry removed from here is
	// retired, and nothing the owner added through review is touched.
	DestBlocklist []string `env:"DESTINATION_BLOCKLIST" envSeparator:","`
}

type AnalyticsConfig struct {
	RetentionDays int    `env:"ANALYTICS_RETENTION_DAYS" envDefault:"395"`
	GeoIPPath     string `env:"GEOIP_MMDB_PATH"`
}

type AuditConfig struct {
	RetentionDays int `env:"AUDIT_RETENTION_DAYS" envDefault:"0"`

	// SizeWarnBytes raises an owner notification once the audit partitions pass
	// it. 5 GB, and **on by default** — which is the asymmetry with
	// RetentionDays above, not an inconsistency (D19).
	//
	// The two defaults protect against opposite failures. Retention defaults to
	// inaction because acting unasked destroys data. The warning defaults to
	// acting because inaction is what leaves the operator uninformed, and
	// keep-forever is only a safe default on an instance nobody configured if
	// that instance is the one being warned. A threshold that had to be
	// switched on would be no threshold at all for exactly the operators who
	// need it.
	//
	// 0 disables it, for an operator who has decided and does not want reminding.
	SizeWarnBytes int64 `env:"AUDIT_SIZE_WARN_BYTES" envDefault:"5368709120"`
}

type AuthConfig struct {
	SignupMode         SignupMode    `env:"SIGNUP_MODE" envDefault:"closed"`
	SessionAbsoluteTTL time.Duration `env:"SESSION_ABSOLUTE_TTL" envDefault:"720h"`
	SessionIdleTTL     time.Duration `env:"SESSION_IDLE_TTL" envDefault:"168h"`

	// InviteTTL is how long an invitation stays redeemable, measured from when
	// it was created (decision D29).
	//
	// A knob rather than a constant, for the reason D5 refused a constant for
	// audit retention: time is the one thing an operator cannot work around
	// without a rebuild. The clock starts at creation and not at delivery,
	// because mail leaves through the outbox on the scheduler's tick (D23) and
	// there is no send moment to start it from — so a slow relay spends the
	// operator's TTL, which is exactly why it is tunable.
	InviteTTL time.Duration `env:"INVITE_TTL" envDefault:"168h"`

	// RFC 9106 recommends at least 19 MiB for the memory-constrained profile;
	// 64 MiB is the comfortable default. Validate enforces the floor, because
	// lowering this is the easiest way to silently weaken password storage.
	Argon2MemoryKiB   uint32 `env:"ARGON2_MEMORY_KIB" envDefault:"65536"`
	Argon2Iterations  uint32 `env:"ARGON2_ITERATIONS" envDefault:"3"`
	Argon2Parallelism uint8  `env:"ARGON2_PARALLELISM" envDefault:"2"`

	LoginRatePerMin  int `env:"LOGIN_RATE_PER_MIN" envDefault:"10"`
	LockoutThreshold int `env:"LOGIN_LOCKOUT_THRESHOLD" envDefault:"5"`
	APIRatePerMin    int `env:"API_RATE_PER_MIN" envDefault:"600"`

	// UploadRatePerMin bounds how often one address may upload a file (M50.5).
	//
	// **A bucket of its own because an upload is not an API call.** Every other
	// request under `/api/v1` carries a body this product caps at 256 KiB and
	// parses as JSON; an upload carries a file, which is where a request's cost
	// is set by its content rather than by its shape. `API_RATE_PER_MIN` defaults
	// to 600, and 600 megabyte uploads a minute is a bandwidth and decoder budget
	// nobody chose by setting a number about JSON.
	//
	// **Two endpoints charge it since M67**, and they are not the same size: a
	// logo is `qr.MaxLogoUploadBytes` and is decoded, an add-on install is
	// `addon.MaxUploadBytes` and is compiled. One bucket for both, because what
	// the bucket is about is true of both and a second number would be a second
	// thing to tune. See docs/configuration.md's row for what that costs.
	//
	// Thirty is what somebody restyling a poster does — upload, look, upload
	// again — with room to spare. It charges the *address* like every other
	// limit here rather than the workspace: the resource being protected is this
	// instance's, and an attacker with one account has as many addresses as they
	// have hosts either way.
	UploadRatePerMin int `env:"UPLOAD_RATE_PER_MIN" envDefault:"30"`
}

type Config struct {
	AppEnv  Environment `env:"APP_ENV" envDefault:"production"`
	BaseURL string      `env:"BASE_URL,required"`

	// AppBaseURL and LinkBaseURL split the instance across two hostnames: the
	// dashboard and API on one, short links on the other. Both default to
	// BaseURL, so leaving them unset is the single-host deployment unchanged.
	//
	// After Load they are always populated, so callers use them rather than
	// deciding for themselves whether the split is configured.
	AppBaseURL  string `env:"APP_BASE_URL"`
	LinkBaseURL string `env:"LINK_BASE_URL"`

	HTTP      HTTPConfig
	Log       LogConfig
	DB        DBConfig
	Redis     RedisConfig
	Redirect  RedirectConfig
	Domains   DomainsConfig
	Alias     AliasConfig
	Auth      AuthConfig
	Ingest    IngestConfig
	Analytics AnalyticsConfig
	Audit     AuditConfig
	SMTP      SMTPConfig
	Feed      FeedConfig
	Webhooks  WebhooksConfig
	Addons    AddonsConfig
	Shutdown  ShutdownConfig

	APIKeyPepper Secret `env:"API_KEY_PEPPER,required,unset"`

	// MFASecretKey encrypts the TOTP secret at rest (M53).
	//
	// **Its own variable, never the pepper**, which m53.md refuses by name. The
	// pepper is bound to retained API-key rows and rotating it silently
	// invalidates every issued key; sharing it would mean rotating an API-key
	// secret also locks every account out of its second factor, coupling two
	// credential lifecycles that have nothing to do with each other.
	//
	// **Optional, unlike the pepper, and the asymmetry is deliberate.** Unset is
	// an instance with no second factor available, which is exactly what every
	// deployment was before this milestone — making it required would refuse to
	// boot every existing instance on upgrade to buy a feature nobody had asked
	// for. Losing it after accounts have enrolled locks those accounts out of the
	// second factor and no further: recovery codes are SHA-256 and do not involve
	// this key, so an enrolled account signs in with one, disables the factor with
	// another, and enrols again. docs/configuration.md states that chain beside
	// the variable, in the same terms the pepper's consequence is stated in.
	MFASecretKey Secret `env:"MFA_SECRET_KEY,unset"`

	// UpdateCheck is whether this instance may ask, once a day, whether a newer
	// LinkCtrl has been published (M55).
	//
	// **The deployment's half of a two-part switch, and it only ever says no.**
	// The other half is `instance_settings.update_check_enabled`, which is the
	// answer an operator gave when they were asked (D149, D164). The check runs
	// when both allow it: this variable is what an air-gapped or egress-restricted
	// deployment sets to `false` in the place such a deployment configures
	// everything else, and setting it there cannot be undone from a browser by
	// somebody who does not know why the box has no egress.
	//
	// **Default true, and true is permission rather than instruction.** The owner
	// overruled a recommendation of off-by-default on the grounds that the
	// operator is asked and therefore chooses knowingly (D149) — so what this
	// default buys is that the question gets asked, not that the request gets
	// made. The other half starts unanswered and reads as off (D164), which is
	// where an instance upgrading into 0.3.0 sits until an administrator signs in.
	// What the request carries is enumerated in docs/configuration.md beside this
	// variable, and in internal/update's package comment, where a test holds the
	// enumeration to the wire.
	UpdateCheck bool `env:"UPDATE_CHECK" envDefault:"true"`

	DocsEnabled    bool `env:"DOCS_ENABLED" envDefault:"true"`
	SecureCookies  bool `env:"SECURE_COOKIES" envDefault:"true"`
	MigrateOnStart bool `env:"MIGRATE_ON_START" envDefault:"true"`

	// TrustedProxies must stay empty unless the app really is behind a proxy.
	// A non-empty value makes the app believe X-Forwarded-For, which is how
	// rate limiting and analytics get spoofed when it is set carelessly.
	TrustedProxies []netip.Prefix `env:"TRUSTED_PROXIES" envSeparator:","`
	// contains filtered or unexported fields
}

type DBConfig struct {
	URL Secret `env:"DATABASE_URL,required,unset"`

	// Two pools. The redirect pool is small, separate, and exists so that a
	// slow analytics query on the application pool cannot starve the hot path
	// of connections. M13 asserts empirically that it does not.
	MaxConns         int32         `env:"DB_MAX_CONNS" envDefault:"20"`
	MinConns         int32         `env:"DB_MIN_CONNS" envDefault:"2"`
	RedirectMaxConns int32         `env:"DB_REDIRECT_MAX_CONNS" envDefault:"6"`
	MaxConnLifetime  time.Duration `env:"DB_MAX_CONN_LIFETIME" envDefault:"1h"`
	MaxConnIdleTime  time.Duration `env:"DB_MAX_CONN_IDLE_TIME" envDefault:"15m"`
	ConnectTimeout   time.Duration `env:"DB_CONNECT_TIMEOUT" envDefault:"10s"`
}

type DomainsConfig struct {
	// VerifyInterval is how often the leader re-checks every registered
	// hostname. One hour: the point of the cadence is to make a single failure
	// weak evidence and a sustained one strong, and at this rate a domain must
	// fail twenty-four consecutive checks before serving stops. Zero disables
	// the job entirely, which leaves verification on-demand only.
	VerifyInterval time.Duration `env:"DOMAIN_VERIFY_INTERVAL" envDefault:"1h"`
	// VerifyGrace is how long a *serving* hostname keeps serving after its first
	// failed check. Twenty-four hours: long enough that somebody woken by the
	// notification has a working day to fix their DNS, short enough that the
	// window is stated in the runbook as "one day" rather than as a calculation.
	// It is never zero — an unset or zero value takes the default, because a
	// zero window would turn one resolver hiccup into an outage.
	VerifyGrace time.Duration `env:"DOMAIN_VERIFY_GRACE" envDefault:"24h"`
	// VerifyDNSTimeout bounds one TXT lookup. A nameserver that accepts a query
	// and never answers must cost this and not the whole pass.
	VerifyDNSTimeout time.Duration `env:"DOMAIN_VERIFY_DNS_TIMEOUT" envDefault:"5s"`
	// VerifyBatch caps how many hostnames one pass checks, oldest check first.
	// A bound rather than a limit anybody is expected to reach: it is what keeps
	// an instance with ten thousand registrations from turning one job run into
	// ten thousand DNS queries.
	VerifyBatch int `env:"DOMAIN_VERIFY_BATCH" envDefault:"500"`
}

type Environment string

type FeedConfig struct {
	// URL is the endpoint, and the switch. Empty means no feed, no client, and
	// no code path that sends a destination anywhere.
	URL string `env:"FEED_URL"`
	// Name is the third party in words — "Google Safe Browsing", "urlscan.io" —
	// as the disclosure page and the docs print it.
	Name string `env:"FEED_NAME"`

	// Method is GET or POST. POST by default, which is what most reputation
	// APIs take and which keeps the destination out of the feed's access log
	// query string.
	Method string `env:"FEED_METHOD" envDefault:"POST"`
	// Param names the field carrying the destination: a query parameter on GET,
	// a JSON key on POST.
	Param string `env:"FEED_PARAM" envDefault:"url"`
	// VerdictField is the dotted path into the JSON response holding the
	// answer, e.g. "data.malicious".
	VerdictField string `env:"FEED_VERDICT_FIELD" envDefault:"blocked"`

	// AuthHeader and AuthToken authenticate to the feed. The header is only
	// sent when the token is set.
	AuthHeader string `env:"FEED_AUTH_HEADER" envDefault:"Authorization"`
	AuthToken  Secret `env:"FEED_AUTH_TOKEN,unset"`

	// Timeout bounds one check. Spent inside a link creation somebody is
	// waiting on, so it is small: two seconds is long enough for a healthy API
	// on another continent and short enough that a sick one is not felt as the
	// dashboard being broken.
	Timeout time.Duration `env:"FEED_TIMEOUT" envDefault:"2s"`
}

type HTTPConfig struct {
	Addr              string        `env:"HTTP_ADDR" envDefault:":8080"`
	MetricsAddr       string        `env:"METRICS_ADDR" envDefault:":9090"`
	ReadHeaderTimeout time.Duration `env:"HTTP_READ_HEADER_TIMEOUT" envDefault:"5s"`
	WriteTimeout      time.Duration `env:"HTTP_WRITE_TIMEOUT" envDefault:"30s"`
	RequestTimeout    time.Duration `env:"HTTP_REQUEST_TIMEOUT" envDefault:"15s"`
	ServerTiming      bool          `env:"SERVER_TIMING" envDefault:"false"`
}

type IngestConfig struct {
	QueueSize     int           `env:"INGEST_QUEUE_SIZE" envDefault:"16384"`
	BatchSize     int           `env:"INGEST_BATCH_SIZE" envDefault:"500"`
	FlushInterval time.Duration `env:"INGEST_FLUSH_INTERVAL" envDefault:"250ms"`
}

type LogConfig struct {
	Level  string `env:"LOG_LEVEL" envDefault:"info"`
	Format string `env:"LOG_FORMAT" envDefault:"json"`
}

type RedirectConfig struct {
	TTL           time.Duration `env:"REDIRECT_TTL" envDefault:"24h"`
	NegativeTTL   time.Duration `env:"REDIRECT_NEGATIVE_TTL" envDefault:"60s"`
	Timeout       time.Duration `env:"REDIRECT_TIMEOUT" envDefault:"250ms"`
	DefaultStatus int           `env:"REDIRECT_DEFAULT_STATUS" envDefault:"302"`
	LogSample     int           `env:"REDIRECT_LOG_SAMPLE" envDefault:"0"`
	NotFoundLimit int           `env:"REDIRECT_404_RATE_LIMIT" envDefault:"60"`
	// PasswordLimit caps guesses at a password link, per minute, per address
	// *and* per alias (M35, D54). Twenty rather than the login limit's number:
	// a person who has been handed a link and its password types it once, and a
	// legitimate visitor never approaches this. Zero disables it, which on a
	// public instance means a link password is only as strong as the wordlist
	// somebody is willing to run.
	PasswordLimit int `env:"LINK_PASSWORD_RATE_LIMIT" envDefault:"20"`
}

type RedisConfig struct {
	URL         string        `env:"REDIS_URL" envDefault:"redis://redis:6379/0"`
	DialTimeout time.Duration `env:"REDIS_DIAL_TIMEOUT" envDefault:"1s"`
	ReadTimeout time.Duration `env:"REDIS_READ_TIMEOUT" envDefault:"50ms"`

	// InvalidateBudget is the total an edit will wait for the cache to be
	// invalidated, across every retry rather than per attempt. The retry loop
	// used to spend ReadTimeout three times over, so raising ReadTimeout
	// tripled the worst case an operator saw on a form submission; this is the
	// one number that bounds it. D26.
	InvalidateBudget time.Duration `env:"REDIS_INVALIDATE_BUDGET" envDefault:"250ms"`

	// SubscriberReadTimeout is how long the cache-invalidation subscriber will
	// sit in one read before it makes Redis prove the subscription is still
	// delivering. It is not ReadTimeout and cannot be: on the hot path a
	// timeout means the cache failed, while here it usually means nobody has
	// edited a link, which is the ordinary state of a healthy instance. F30,
	// D42.
	SubscriberReadTimeout time.Duration `env:"REDIS_SUBSCRIBER_READ_TIMEOUT" envDefault:"30s"`

	PoolSize     int  `env:"REDIS_POOL_SIZE" envDefault:"50"`
	CacheEnabled bool `env:"CACHE_ENABLED" envDefault:"true"`
}

type SMTPConfig struct {
	// Host is the switch. Empty means no mailer, which is the default and the
	// state every consumer must degrade to.
	Host string `env:"SMTP_HOST"`
	Port int    `env:"SMTP_PORT" envDefault:"587"`

	// Username and Password authenticate with PLAIN. Both or neither.
	Username string `env:"SMTP_USERNAME"`
	Password Secret `env:"SMTP_PASSWORD,unset"`

	// From is the envelope sender and the From header. Required once Host is
	// set: a message with no sender is refused by most receivers, and finding
	// that out from a bounce is worse than finding it out at boot.
	From string `env:"SMTP_FROM"`

	TLS string `env:"SMTP_TLS" envDefault:"starttls"`

	// Timeout bounds one delivery attempt end to end — dial, handshake, DATA.
	// A hung relay must not hold the scheduler.
	Timeout time.Duration `env:"SMTP_TIMEOUT" envDefault:"10s"`
}

type Secret string

type ShutdownConfig struct {
	DrainDelay time.Duration `env:"SHUTDOWN_DRAIN_DELAY" envDefault:"5s"`
	Timeout    time.Duration `env:"SHUTDOWN_TIMEOUT" envDefault:"15s"`
}

type SignupMode string

type WebhooksConfig struct {
	// Timeout bounds one delivery attempt end to end: connect, write, read. Ten
	// seconds is long enough for a receiver that does real work before answering
	// and short enough that a batch of twenty slow ones fits well inside the
	// job's own bound.
	Timeout time.Duration `env:"WEBHOOK_TIMEOUT" envDefault:"10s"`
	// RetentionDays is how long a delivered or abandoned delivery row is kept.
	// Thirty days, matching the mail outbox, because the two are the same kind
	// of record: what was attempted and what happened, not an archive.
	//
	// Never zero. Zero means "keep forever" elsewhere in this file (audit
	// retention, D5), and a table that grows by one row per link write per
	// webhook with no window is the growth problem that convention exists to
	// make visible rather than to permit here. Validate refuses it.
	RetentionDays int `env:"WEBHOOK_RETENTION_DAYS" envDefault:"30"`
}