config

type ClientConfig struct {
	// Endpoint is the remote GSEER server URL (e.g. https://gseer.example).
	// Required for the client profile; ignored for self-hosted.
	Endpoint string `yaml:"endpoint"`
}

type Config struct {
	Profile      Profile            `yaml:"profile"`
	Client       ClientConfig       `yaml:"client"`
	Server       ServerConfig       `yaml:"server"`
	Database     DatabaseConfig     `yaml:"database"`
	Policy       PolicyConfig       `yaml:"policy"`
	Log          LogConfig          `yaml:"log"`
	Sources      []SourceConfig     `yaml:"sources"`
	Defaults     DefaultsConfig     `yaml:"defaults"`
	Fingerprints FingerprintsConfig `yaml:"fingerprints"`
	Update       UpdateConfig       `yaml:"update"`

	// Source is the file path the config was loaded from, or "env-only"
	// when no file was present (defaults + env + flags only).  Set by
	// Load; not part of the YAML schema.
	Source string `yaml:"-"`
}

type DatabaseConfig struct {
	// DSN is the full connection string.  When set, it overrides the
	// component fields below.  Format:
	//   postgres://user:password@host:port/dbname?sslmode=disable
	DSN string `yaml:"dsn"`
	// Component fields (used when DSN is not set).
	Host     string `yaml:"host"`
	Port     int    `yaml:"port"`
	User     string `yaml:"user"`
	Password string `yaml:"password,omitempty"` // never logged
	Name     string `yaml:"name"`
	// SSLMode controls connection encryption.  Loopback-only deployments
	// may use "disable"; non-loopback MUST use "require" or "verify-full".
	SSLMode string `yaml:"sslmode"`
	// MigrationLockTimeoutMs bounds how long the migration runner waits
	// for the migration advisory lock before failing with
	// DB_MIGRATION_LOCK_TIMEOUT.  Implemented as a session-scoped
	// statement_timeout inside the migration driver's Lock(): it covers
	// ONLY the pg_advisory_lock acquisition and is reset to 0 (verified)
	// before any migration SQL runs — slow migrations are never killed
	// by the lock-wait limit.  Range 1000..300000 ms; default
	// DefaultMigrationLockTimeoutMs (applied for explicit-DSN configs
	// too — see applyDatabaseDefaults).  Used by the storage layer
	// (internal/storage/postgres/lock.go + migratedriver.go).
	MigrationLockTimeoutMs int `yaml:"migration_lock_timeout_ms"`
}

type DefaultsConfig struct {
	// SearchMode (PD-1) — the default GQL search mode.  Used by v0.0.1.
	SearchMode string `yaml:"search_mode"`
	// CollectionPorts (PD-2) — v0.0.2 planning default.  NOT used in v0.0.1.
	CollectionPorts []int `yaml:"collection_ports"`
	// Protocols (PD-3) — v0.0.2 planning default.  NOT used in v0.0.1.
	Protocols []string `yaml:"protocols"`
	// AuditSpoolBytes (PD-4) — v0.0.2 planning default.  NOT used in v0.0.1.
	AuditSpoolBytes int `yaml:"audit_spool_bytes"`
	// EmergencyReserveBytes (PD-5) — v0.0.2 planning default.  NOT used in v0.0.1.
	EmergencyReserveBytes int `yaml:"emergency_reserve_bytes"`
	// DecompressedCapBytes (PD-6) — v0.0.2 planning default.  NOT used in v0.0.1.
	DecompressedCapBytes int `yaml:"decompressed_cap_bytes"`
	// DecompressedCapMaxBytes (PD-7) — v0.0.2 planning default.  NOT used in v0.0.1.
	DecompressedCapMaxBytes int `yaml:"decompressed_cap_max_bytes"`
	// PostgresMajor (PD-8) — minimum supported PostgreSQL version.  Used by doctor (M3).
	PostgresMajor int `yaml:"postgres_major"`
}

type Error struct {
	// Code is the stable E_* identifier (e.g. E_CONFIG_UNKNOWN_KEY).
	Code string
	// Field is the dotted config path of the offending key, when
	// applicable (e.g. "policy.active.enabled", "server.listen").
	Field string
	// Detail is the short "what failed" sentence.
	Detail string
	// Why is the "likely why" sentence (optional).
	Why string
	// Next is the "exact next command" or fix instruction.
	Next string
}

type FingerprintsConfig struct {
	// Disabled turns OFF rule-derived technology enrichment at
	// ingestion.  Zero value false = enabled (the useful default); the
	// inverted name avoids the YAML bool zero-value trap.
	Disabled bool `yaml:"disabled"`
	// RulesDir optionally loads operator-contributed rules on top of
	// the embedded seed set (contribution format: docs/RULES.md).  A
	// broken operator rule disables the registry — fail-closed, never
	// a silent no-op.
	RulesDir string `yaml:"rules_dir"`
}

type Flags struct {
	// ConfigPath is the --config flag value (path to a YAML file).
	ConfigPath string
	// Profile is the --profile flag value (client | self-hosted).
	Profile string
	// Endpoint is the --server flag value (remote endpoint URL for
	// the client profile).
	Endpoint string
}

type LogConfig struct {
	Level  string `yaml:"level"`  // debug | info | warn | error
	Format string `yaml:"format"` // text | json
}

type PolicyConfig struct {
	// EvaluationFixtures gates `setup --load-fixtures` (QS-6).  Default
	// false on non-dev installs; when false, the loader refuses with a
	// confirmation prompt.
	EvaluationFixtures bool `yaml:"evaluation_fixtures"`
}

type Profile string

type ServerConfig struct {
	// Listen is the bind address for the API + dashboard.  Loopback by
	// default; non-loopback requires explicit operator action + auth.
	Listen string `yaml:"listen"`
	// Token is the plaintext API token from config/env.  After Load, it
	// is hashed to TokenHash and this field is CLEARED so that no
	// in-memory representation retains the plaintext beyond Load.
	Token string `yaml:"token,omitempty"`
	// TokenHash is the SHA-256 hex digest of Token, computed during Load.
	// The API verifies incoming Bearer tokens against this hash.
	TokenHash string `yaml:"-"`
	// TrustedProxies lists the CIDRs (or bare IPs) of reverse proxies in
	// front of the server whose X-Forwarded-For header may be honored
	// for client-IP resolution (rate limiting, audit).  Empty (default)
	// = the peer address is used directly and X-Forwarded-For is
	// IGNORED — a client can never spoof its identity by setting the
	// header.  Only name proxies you actually run (e.g. 127.0.0.1 for a
	// local nginx).  Invalid entries are rejected at config load.
	TrustedProxies []string `yaml:"trusted_proxies,omitempty"`
}

type SourceConfig struct {
	Name     string `yaml:"name"`
	Type     string `yaml:"type"`     // e.g. "ct", "rdap", "dns"
	Endpoint string `yaml:"endpoint"` // the source's API URL (passive)
	Enabled  bool   `yaml:"enabled"`  // always false in v0.0.1 runtime
}

type UpdateConfig struct {
	// ManifestURL is the signed update manifest location (https URL or
	// local path).  The manifest MUST carry an Ed25519 signature that
	// verifies against the key embedded in the binary — the URL alone
	// proves nothing (docs/UPDATE.md).
	ManifestURL string `yaml:"manifest_url"`
}