config

type ABACCondition struct {
	Attribute string `yaml:"attribute"` // e.g. "subject.role", "resource.name", "env.source_ip"
	Operator  string `yaml:"operator"`  // eq, neq, in, not_in, gt, lt, gte, lte, contains, regex, exists, not_exists
	Value     string `yaml:"value"`     // single value or comma-separated for "in"/"not_in"
}

type ABACObligation struct {
	Type   string `yaml:"type"`   // row_filter, mask_column, deny_column, query_limit
	Target string `yaml:"target"` // column name or table name
	Value  string `yaml:"value"`  // filter expression, mask function, limit value
}

type ABACPolicy struct {
	Name        string     `yaml:"name"`
	Description string     `yaml:"description"`
	Priority    int        `yaml:"priority"` // lower = evaluated first
	Enabled     *bool      `yaml:"enabled"`  // nil = true
	Rules       []ABACRule `yaml:"rules"`
}

type ABACRule struct {
	Effect      string           `yaml:"effect"` // "allow" or "deny"
	Conditions  []ABACCondition  `yaml:"conditions"`
	Obligations []ABACObligation `yaml:"obligations"` // only for "allow" rules
}

type Alerts struct {
	Enabled bool `yaml:"enabled"` // enable CREATE ALERT DDL and the scheduler
}

type Auth struct {
	Enabled      bool         `yaml:"enabled"`
	APIKeys      []AuthAPIKey `yaml:"api_keys"`
	JWT          AuthJWT      `yaml:"jwt"`
	MTLS         AuthMTLS     `yaml:"mtls"`
	Roles        []AuthRole   `yaml:"roles"`
	Policies     []AuthPolicy `yaml:"policies"`      // cell-level access policies (legacy)
	ABACPolicies []ABACPolicy `yaml:"abac_policies"` // ABAC access control policies
}

type AuthAPIKey struct {
	Key  string `yaml:"key"`
	Name string `yaml:"name"`
	Role string `yaml:"role"`
}

type AuthJWT struct {
	Enabled       bool   `yaml:"enabled"`
	Secret        string `yaml:"secret"`
	PublicKeyFile string `yaml:"public_key_file"`
	RoleClaim     string `yaml:"role_claim"`
	Issuer        string `yaml:"issuer"`
}

type AuthMTLS struct {
	Enabled     bool              `yaml:"enabled"`
	CAFile      string            `yaml:"ca_file"`
	CertFile    string            `yaml:"cert_file"` // server TLS cert
	KeyFile     string            `yaml:"key_file"`  // server TLS key
	RoleMap     map[string]string `yaml:"role_map"`  // CN/SAN -> role
	DefaultRole string            `yaml:"default_role"`
}

type AuthPolicy struct {
	Table     string            `yaml:"table"`
	Role      string            `yaml:"role"`
	Columns   map[string]string `yaml:"columns"`    // column -> "allow", "mask", "deny"
	RowFilter string            `yaml:"row_filter"` // SQL WHERE predicate
}

type AuthRole struct {
	Name        string       `yaml:"name"`
	Tables      []string     `yaml:"tables"`       // table names or "*" for all
	Allow       []string     `yaml:"allow"`        // "read", "write", "admin"
	QueryLimits *QueryLimits `yaml:"query_limits"` // per-role overrides (nil = use global)
}

type ChangeEvent struct {
	Old *Config
	New *Config
}

type Config struct {
	Mode        string      `yaml:"mode"` // standalone, coordinator, worker
	Storage     Storage     `yaml:"storage"`
	NATS        NATS        `yaml:"nats"`
	HTTP        HTTP        `yaml:"http"`
	GRPC        GRPC        `yaml:"grpc"`
	Worker      Worker      `yaml:"worker"`
	Parquet     Parquet     `yaml:"parquet"`
	Auth        Auth        `yaml:"auth"`
	GeoIP       GeoIP       `yaml:"geoip"`
	Alerts      Alerts      `yaml:"alerts"`       // CREATE ALERT DDL + scheduler
	QueryLimits QueryLimits `yaml:"query_limits"` // global query cost limits
	Query       Query       `yaml:"query"`        // coordinator query lifecycle
	Telemetry   Telemetry   `yaml:"telemetry"`    // OpenTelemetry tracing export
}

type FlagValues interface {
	// Changed reports whether the flag was set on the command line.
	Changed(flag string) bool
	// Value returns the flag's current value (its default when not
	// Changed), or ok=false when the resolver's flag name is unknown.
	Value(flag string) (any, bool)
	// Default returns the flag's registered default, snapshotted before the
	// command line was parsed. It is the DEFAULT TIER for every key that
	// has a flag: the binary runs on the flag's default today, and
	// DefaultConfig()'s value is not always the same one (DefaultConfig
	// sets storage.access_key to "minioadmin" where --access-key defaults
	// to "" and means "auto-detect from env/IAM").
	Default(flag string) (any, bool)
}

type GRPC struct {
	Addr string `yaml:"addr"`
}

type GeoIP struct {
	CityDB string `yaml:"city_db"` // path to GeoLite2-City.mmdb
	ASNDB  string `yaml:"asn_db"`  // path to GeoLite2-ASN.mmdb
}

type HTTP struct {
	Addr string `yaml:"addr"`
}

type Inputs struct {
	// File is the config file merged over DefaultConfig() — i.e. Load()'s
	// result — or nil when no --config was given. Sections outside the
	// registry (auth, abac_policies, per-role query limits) are carried
	// through from here unchanged.
	File *Config
	// FileKeys names the registry keys the file actually set. Use
	// LoadWithKeys to build it; a key absent here never wins its tier even
	// when File carries a merged default for it.
	FileKeys map[string]bool
	// Lookup reads an environment variable. nil means os.LookupEnv.
	Lookup func(string) (string, bool)
	// Flags is the parsed command line. nil means no flag tier, in which
	// case DefaultConfig() supplies the default tier.
	Flags FlagValues
}

type Key struct {
	// Name is the dotted config-file path, e.g. "storage.bucket".
	Name string
	// Env is the environment variable that sets this key ("" = none).
	Env string
	// Flag is the root command's persistent flag name ("" = none).
	Flag string
	// Kind is the value type.
	Kind Kind
	// Secret marks a value that must never be echoed back (admin GET
	// reports its SOURCE but redacts the value).
	Secret bool
	// Deferred marks a key that is parsed, resolved and reported but does
	// NOT reach a runtime consumer, with the structural change that would
	// be required named in DeferredWhy. Rule 11 of
	// docs/design/correctness-fix-protocol.md: such a key is deferred
	// explicitly, never left half-live — every write path refuses it.
	Deferred    bool
	DeferredWhy string
	// contains filtered or unexported fields
}

type Kind int

type Manager struct {
	// contains filtered or unexported fields
}

type NATS struct {
	Port        int      `yaml:"port"`
	URL         string   `yaml:"url"`          // for worker mode: coordinator's NATS URL
	StoreDir    string   `yaml:"store_dir"`    // JetStream storage directory
	ClusterID   string   `yaml:"cluster_id"`   // unique cluster identifier (e.g., "central", "afb-east")
	LeafRemotes []string `yaml:"leaf_remotes"` // remote NATS URLs for leaf node connections
	TLSCert     string   `yaml:"tls_cert"`     // TLS certificate file (server or client)
	TLSKey      string   `yaml:"tls_key"`      // TLS private key file
	TLSCA       string   `yaml:"tls_ca"`       // CA certificate for verifying peers (enables mTLS)
}

type Parquet struct {
	Compression    string `yaml:"compression"`      // snappy, zstd, gzip, lz4, none
	RowGroupSize   int    `yaml:"row_group_size"`   // rows per row group
	PageBufferSize int    `yaml:"page_buffer_size"` // page size in bytes
}

type Query struct {
	// IntermediateTTL is the age after which the coordinator's periodic
	// sweep reclaims a queries/<id>/* prefix the per-query cleanup did not.
	IntermediateTTL time.Duration `yaml:"intermediate_ttl"`
	// IntermediateSweep is how often that sweep runs.
	IntermediateSweep time.Duration `yaml:"intermediate_sweep"`
}

type QueryLimits struct {
	MaxScanBytes            int64 `yaml:"max_scan_bytes"`             // max estimated bytes across all scans
	MaxScanRows             int64 `yaml:"max_scan_rows"`              // max estimated rows across all scans
	MaxScanFiles            int   `yaml:"max_scan_files"`             // max files across all scans
	RequireFilterAboveBytes int64 `yaml:"require_filter_above_bytes"` // require WHERE on tables exceeding this size
	RequireLimitAboveRows   int64 `yaml:"require_limit_above_rows"`   // require LIMIT on scans exceeding this row count
}

type Resolution struct {
	// contains filtered or unexported fields
}

type Source string

type Storage struct {
	Type      string `yaml:"type"`     // "s3" (default) or "file"
	DataDir   string `yaml:"data_dir"` // local directory for type=file
	Endpoint  string `yaml:"endpoint"`
	AccessKey string `yaml:"access_key"`
	SecretKey string `yaml:"secret_key"`
	Bucket    string `yaml:"bucket"`
	UseSSL    bool   `yaml:"use_ssl"`
	Region    string `yaml:"region"`
	// Circuit configures the per-operation-class object-store circuit
	// breaker (ADR-0028).
	Circuit StorageCircuit `yaml:"circuit"`
}

type StorageCircuit struct {
	FailureThreshold int           `yaml:"failure_threshold"` // consecutive failures in one class before the class opens
	ResetTimeout     time.Duration `yaml:"reset_timeout"`     // how long an open breaker stays open
	RequestTimeout   time.Duration `yaml:"request_timeout"`   // per-request timeout for non-streaming operations
}

type Subscriber func(event ChangeEvent)

type Telemetry struct {
	Endpoint   string  `yaml:"endpoint"`    // OTLP gRPC endpoint (e.g., "localhost:4317")
	Insecure   bool    `yaml:"insecure"`    // use plaintext gRPC (no TLS)
	SampleRate float64 `yaml:"sample_rate"` // 0.0-1.0 (default: 1.0 = always)
}

type Watcher struct {
	// contains filtered or unexported fields
}

type WatcherConfig struct {
	Path     string        // config file path
	Interval time.Duration // poll interval (default 2s)
	Debounce time.Duration // debounce window after change detected (default 500ms)
}

type Worker struct {
	MaxConcurrent    int    `yaml:"max_concurrent"`
	CacheBytes       int64  `yaml:"cache_bytes"`
	MemoryBudget     int64  `yaml:"memory_budget"`      // per-task memory budget in bytes (0 = unlimited, no spill)
	SpillDir         string `yaml:"spill_dir"`          // directory for spill files (default: os temp dir)
	ResultStoreBytes int64  `yaml:"result_store_bytes"` // in-memory result store capacity (0 = disabled)
}