config

type APITokensSection struct {
	// Disabled stops serving the API tokens: /api/v2/apiTokens and the
	// tokens screen are not registered, and every API token is refused as
	// an unknown bearer, a token minted while they were served included (it
	// works again if they are served again before it expires). For a
	// platform in front of the engine that decides who may reach it at each
	// sign-in, so no engine credential outlives that decision. False, the
	// zero value, serves them, so a configuration that never mentions it
	// keeps them.
	Disabled bool `mapstructure:"disabled"`
}

type AlertsSection struct {
	// BlockPrivateDestinations refuses alert requests to loopback, private,
	// link-local (including 169.254.169.254), shared, unspecified, multicast and
	// broadcast addresses. The check runs on the address actually dialed, after
	// DNS resolution and on every redirect, and the guarded client does not use
	// the proxy environment. Off by default, so an existing install that alerts
	// an in-cluster endpoint keeps working.
	BlockPrivateDestinations bool `mapstructure:"block_private_destinations"`
	// AllowedCIDRs exempts these ranges (CIDRs or single addresses) from the
	// block, e.g. an on-premises chat server. Validated at startup even while the
	// block is off, so a typo surfaces before anyone turns it on; applied only
	// while it is on.
	AllowedCIDRs []string `mapstructure:"allowed_cidrs"`
}

type AuthSection struct {
	Provider string     `mapstructure:"provider"`
	JWT      JWTSection `mapstructure:"jwt"`
	// OIDC configures the OIDC/SSO login flow. It is read only when Provider is
	// "oidc" (Pro-gated); the JWT authenticator remains the request-path verifier
	// in both modes.
	OIDC OIDCSection `mapstructure:"oidc"`
	// TrustedIssuer lets a platform that already authenticates its users open a
	// UI session for them with a token its own issuer signed (#1284). Empty
	// Issuer disables it.
	TrustedIssuer TrustedIssuerSection `mapstructure:"trusted_issuer"`
	// CIOIDC lets CI pipelines deploy with their provider's OIDC token
	// instead of a stored deploy token (ADR 0092, #1882). No issuer turns
	// it off.
	CIOIDC CIOIDCSection `mapstructure:"ci_oidc"`
	// APITokens can turn the long-lived API tokens (ADR 0074) off.
	APITokens APITokensSection `mapstructure:"api_tokens"`
	// ServiceToken enables the operator service API under /api/v2/service/
	// (#1283), which creates tenants and links users to the trusted issuer. It
	// is the bearer credential for that API: at least 32 characters, kept in a
	// Secret. Empty disables the API.
	ServiceToken string `mapstructure:"service_token"`
	// ExternalSignInURL hands unauthenticated UI visitors to the operator's own
	// sign-in instead of Dexaflow's page, with the requested path in a `next`
	// query parameter (#1288). The operator's flow is expected to return them
	// with a Dexaflow session. Empty keeps Dexaflow's page; `?local=1` reaches it
	// either way.
	ExternalSignInURL string `mapstructure:"external_signin_url"`
	// ExternalSignOutURL is where sign-out lands after clearing the session, so
	// the operator can end their own session too (#1288). Empty returns to
	// Dexaflow's sign-in page.
	ExternalSignOutURL string `mapstructure:"external_signout_url"`
	// DevNoAuth disables authentication entirely, treating every request as an
	// admin. It exists ONLY for `dexaflow lite` (local, unsandboxed). It is false by
	// default and the server logs a prominent warning when it is on. NEVER set
	// this in production (LEOFLOW_AUTH_DEV_NO_AUTH).
	DevNoAuth bool `mapstructure:"dev_no_auth"`
	// LoginRateLimitPerMinute caps failed /auth/token attempts per client IP per
	// minute (anti-brute-force). Only failures count, so a successful login never
	// consumes budget. Lite raises this well above the production default because
	// it is a local single-user tool where lockouts are pure friction.
	LoginRateLimitPerMinute int `mapstructure:"login_rate_limit_per_minute"`
	// SecretScoping is the operator scope-by-declaration policy (ADR 0055 D9):
	// "permissive" | "enforce" | "off". permissive (the default) delivers the
	// whole tenant vault when a DAG declares nothing and warns — but still
	// delivers the whole vault — when a DAG declares a narrower set; enforce
	// delivers only the declared subset (empty declaration → nothing); off
	// disables scoping. It is operator-scoped, NEVER author-settable. Empty = the
	// permissive default.
	SecretScoping string `mapstructure:"secret_scoping"`
	// SecretLivenessMode gates secret delivery on task-instance liveness (ADR 0055
	// E2): "observe" | "enforce". observe (the default) logs + audits a
	// would-have-denied when the caller's TI is not live but still delivers;
	// enforce denies with PermissionDenied. Empty = the observe default.
	SecretLivenessMode string `mapstructure:"secret_liveness_mode"`
	// MaxAttemptCredentialLifetime is the hard ceiling on how long a single task
	// attempt's agent credential may be kept alive by heartbeat renewal (ADR 0055
	// Fix #4). Past this age since first dispatch, the control plane stops renewing
	// the token on heartbeat and lets it lapse, bounding a runaway attempt. The
	// short per-attempt TTL still bounds a stolen/finished token independently;
	// this caps the total renewed lifetime. It governs a second guarantee too: the
	// Kubernetes executor floors a task pod's activeDeadlineSeconds with it when
	// the DAG declares no execution_timeout, so a pod whose agent keeps retrying
	// its report through a total control-plane outage is not left Running
	// forever (a declared timeout is never shortened). Generous by default (24h)
	// so no normal task regresses. Bind via
	// LEOFLOW_AUTH_MAX_ATTEMPT_CREDENTIAL_LIFETIME as a duration (e.g. "24h",
	// "90m"). With warm pools enabled it is also the per-attempt watchdog that
	// keeps a wedged attempt from pinning a warm slot (a warm pod has no pod-level
	// deadline; the worker lifetime cap drains between attempts, never
	// mid-attempt). An attempt whose agent goes silent after running past the
	// ceiling is failed by the heartbeat reaper as a task failure with the
	// credential_ceiling reason (its retry policy applies), never re-placed as an
	// agent_lost infra loss with a fresh credential (#1461). In Lite, which has no
	// pod deadline, the reaper also fails an attempt still running past the
	// ceiling with that reason and stops its task (#1511). A non-positive value
	// disables the renewal ceiling, the pod deadline floor, that watchdog and the
	// credential_ceiling failure together (a wedged task then has no
	// wall-clock bound of its own), so boot logs a WARN naming the key.
	MaxAttemptCredentialLifetime time.Duration `mapstructure:"max_attempt_credential_lifetime"`
	// AgentTokenTransport selects how the in-pod agent obtains its control-plane
	// bearer credential (ADR 0055 Fix #3): "envvar" (the default) sets the token as
	// a plaintext LEOFLOW_AGENT_TOKEN env var on the pod spec — today's behavior,
	// byte-identical; "exchange" mounts a projected ServiceAccount token that the
	// agent exchanges once (via a control-plane TokenReview) for the task-scoped
	// JWT, so no bearer sits in plaintext on the Pod object. The exchange path is
	// Pro/Kubernetes-executor-only (the subprocess executor has no pod/SA/TokenReview
	// and ignores this). It is operator-scoped, NEVER author-settable. Empty = the
	// envvar default. Bind via LEOFLOW_AUTH_AGENT_TOKEN_TRANSPORT.
	AgentTokenTransport string `mapstructure:"agent_token_transport"`
	// SessionCookieInsecure drops the Secure attribute from the browser session
	// cookie (_token) and the OIDC state cookie. It is operator-scoped, NEVER
	// author-settable, and defaults to false, which is the hardened posture.
	//
	// There is exactly one reason to set it: a deployment served over plain http
	// to something that is not a loopback address. A browser refuses a Secure
	// cookie from such an origin outright, so the login page would post valid
	// credentials, get a 200, and land back on itself with no error anywhere. A
	// loopback deployment (localhost, 127.0.0.1) needs nothing: browsers treat it
	// as trustworthy and accept the Secure cookie over http.
	//
	// It cannot be derived from the request. Behind a TLS-terminating ingress the
	// server sees plain http while the browser sees https, so request-derived
	// Secure would strip it from the deployment that most needs it. Boot logs a
	// WARN when it is on. Bind via LEOFLOW_AUTH_SESSION_COOKIE_INSECURE.
	SessionCookieInsecure bool `mapstructure:"session_cookie_insecure"`
	// SessionCookieName is the name of the browser session cookie (#1405).
	// The default, _token, is what every earlier release used, so an existing
	// install keeps its sessions. A name starting with __Host- makes the
	// browser refuse the cookie unless it is Secure, has Path=/ and no Domain,
	// which is how the session cookie is always set: a page on a sibling host
	// under the same parent domain can then no longer plant a session here.
	// Recommended for any deployment that serves several hosts under one
	// parent domain. A __Host- or __Secure- name with SessionCookieInsecure
	// fails boot, because the browser would drop every session cookie.
	// Empty means _token. Bind via LEOFLOW_AUTH_SESSION_COOKIE_NAME.
	SessionCookieName string `mapstructure:"session_cookie_name"`
}

type BuildKitSection struct {
	// Namespace is the namespace of the builder.
	Namespace string `mapstructure:"namespace"`
	// PodSelector is the label selector of the builder pod.
	PodSelector string `mapstructure:"pod_selector"`
}

type CIOIDCIssuerSection struct {
	// Name identifies the entry in logs, metrics, sessions and `ci init`.
	Name string `yaml:"name" json:"name"`
	// Provider is github, gitlab, cloudbuild or other.
	Provider string `yaml:"provider" json:"provider"`
	// Issuer is the exact iss of the provider's tokens.
	Issuer string `yaml:"issuer" json:"issuer"`
	// JWKSURL is where the provider's keys are; empty discovers them.
	JWKSURL string `yaml:"jwks_url" json:"jwks_url"`
	// Audience is the aud the tokens must carry.
	Audience string `yaml:"audience" json:"audience"`
	// Tenant is the only tenant the entry's tokens act in.
	Tenant string `yaml:"tenant" json:"tenant"`
	// MaxLifetimeSeconds caps exp - iat; 0 means 3600, at most 86400.
	MaxLifetimeSeconds int `yaml:"max_lifetime_seconds" json:"max_lifetime_seconds"`
	// Rules map claims to a role; the first that matches decides.
	Rules []cioidc.Rule `yaml:"rules" json:"rules"`
}

type CIOIDCSection struct {
	// SessionTTLSeconds is how long a session from the exchange lives, 300 to
	// 43200; 3600 by default. It is not renewed: a later job exchanges again.
	SessionTTLSeconds int `mapstructure:"session_ttl_seconds"`
	// Issuers are the trusted CI issuers, each with its audience, its one
	// tenant and its rules. Configure them in the server configuration file
	// or, as a JSON array of the same objects, in
	// DEXAFLOW_AUTH_CI_OIDC_ISSUERS. Decoded out of band (mapstructure:"-"),
	// because a claim name may contain dots that viper would split.
	Issuers []CIOIDCIssuerSection `mapstructure:"-" yaml:"issuers"`
}

type CORSSection struct {
	AllowedOrigins []string `mapstructure:"allowed_origins"`
}

type CloudBuildSection struct {
	// Project is the Google Cloud project the build runs in.
	Project string `mapstructure:"project"`
	// Region is the Cloud Build region, such as us-central1.
	Region string `mapstructure:"region"`
	// WorkerPool is a private pool,
	// projects/<project>/locations/<region>/workerPools/<name>.
	WorkerPool string `mapstructure:"worker_pool"`
	// ServiceAccount is the account the build runs as,
	// projects/<project>/serviceAccounts/<email>.
	ServiceAccount string `mapstructure:"service_account"`
}

type Config struct {
	// ServerURL is the control plane base URL used by push and auth create-token.
	ServerURL string `mapstructure:"server_url"`
	// Token is the JWT bearer token persisted by `dexaflow auth login` and used by
	// push and deploy when no --token flag or DEXAFLOW_TOKEN env is set.
	Token string `mapstructure:"token"`
	// LogLevel is reserved for CLI log verbosity (not yet wired).
	LogLevel string `mapstructure:"log_level"`
	// Registry is reserved for the image registry used by image build (ADR 0003).
	Registry string `mapstructure:"registry"`
	// ParserCmd is the command used to invoke the Python parser from compile.
	ParserCmd string `mapstructure:"parser_cmd"`

	// Workspace is the default directory holding the user's DAG projects.
	Workspace string `mapstructure:"workspace"`
	// LiteExecutor is the chosen executor: "subprocess" (local) or "k8s" (mini-cluster).
	LiteExecutor string `mapstructure:"lite_executor"`
	// LitePort is the UI/API port for the Lite control plane.
	LitePort int `mapstructure:"lite_port"`
	// AdminEmail is the Lite admin login created at bootstrap.
	AdminEmail string `mapstructure:"admin_email"`
	// AdminPasswordHash is the bcrypt hash of the generated admin password; the
	// plaintext is shown once at setup and never stored (Lite only).
	AdminPasswordHash string `mapstructure:"admin_password_hash"`
	// JWTSecret is the per-install Lite JWT signing secret, generated by
	// `dexaflow setup` (random, 64 hex chars) and persisted alongside the admin
	// hash.
	//
	// Rotating it on every fresh install invalidates browser tokens from a
	// prior install — so a reinstall greets the user with the login screen and
	// the freshly printed credentials actually do something (#121). Empty on
	// legacy installs; the lite runner falls back to the dev-only constant with
	// a warning so the upgrade does not break existing setups.
	JWTSecret string `mapstructure:"jwt_secret"`
	// SecretKey is the per-install key encrypting connection passwords and extra
	// at rest, generated by `dexaflow setup` (random, 64 hex chars). Lite reads it
	// from this file only: an exported DEXAFLOW_SECRET_KEY does not replace it.
	//
	// Lite used to
	// encrypt with a constant compiled into this repository, identical on every
	// install, so anyone holding a Lite database file read every credential in it
	// (#486). Empty on a legacy install; the lite runner then encrypts with that
	// constant, warns on every start, and names `dexaflow lite migrate-key`, the
	// only path that moves existing rows onto a key of the install's own (ADR
	// 0065). Lite reads the key from the file alone (readLiteKeyConfig in
	// internal/cli), never through this loader, whose environment overlay would
	// let an exported LEOFLOW_SECRET_KEY replace it.
	SecretKey string `mapstructure:"secret_key"`
	// SecretKeyPrevious is a comma-separated list of decrypt-only predecessors.
	// `dexaflow lite migrate-key` writes it while a migration is unfinished and
	// removes it once every stored secret was moved and re-checked; an operator
	// may also set it by hand.
	//
	// With it set, Lite passes every key to the server,
	// which reads with any and writes with the first (#486).
	SecretKeyPrevious string `mapstructure:"secret_key_previous"`
}

type DatabaseSection struct {
	URL          string `mapstructure:"url"`
	MaxOpenConns int    `mapstructure:"max_open_conns"`
	MaxIdleConns int    `mapstructure:"max_idle_conns"`
	// SchedulerMaxConns, when positive, gives the scheduler loop, its reapers
	// and its janitors a pool of their own with this many connections, so API
	// traffic that saturates the main pool cannot stall a scheduler tick. Only
	// a process with scheduler.enabled opens it. 0 (the default) keeps them on
	// the main pool.
	SchedulerMaxConns int `mapstructure:"scheduler_max_conns"`
	// StatementTimeoutMS, when positive, sets statement_timeout on every
	// connection of the main pool, which serves the API. It is never applied to
	// the leader election pool (its session holds the scheduler's advisory
	// lock), the health pool or the scheduler pool, and the few writes that
	// cascade over a DAG's history lift it for their own transaction. Without a
	// scheduler pool the scheduler shares the main pool and so the timeout too.
	// 0 (the default) sets nothing.
	StatementTimeoutMS int `mapstructure:"statement_timeout_ms"`
	// ConnMaxLifetimeJitterMS, when positive, adds up to this much random time
	// to each connection's lifetime in the main, scheduler and health pools, so
	// replicas started together do not all reconnect at the same moment. 0 (the
	// default) leaves the pgx default, or what the DSN sets.
	ConnMaxLifetimeJitterMS int `mapstructure:"conn_max_lifetime_jitter_ms"`
}

type DeployDefaultsSection struct {
	domain.DeployDefaults `mapstructure:",squash"`
	// SourceMode (deploy.defaults.source_mode, default false) advertises
	// execution.source_mode.image as source_mode_image, so a deploy to this
	// cluster that names no runtime image of its own registers dag.py on it
	// with no build (#1772). It requires execution.source_mode.enabled.
	SourceMode bool `mapstructure:"source_mode"`
	// RemoteBuilder (deploy.defaults.remote_builder.cloud_build.*, #1890, or
	// deploy.defaults.remote_builder.buildkit.*, #1883) is the remote builder
	// a deploy to this cluster uses for builds no daemonless path covers,
	// when the project, its target and its workspace name none (ADR 0083).
	// Unset (the default) advertises none.
	RemoteBuilder RemoteBuilderSection `mapstructure:"remote_builder"`
	// AdvertiseTaskServiceAccount (deploy.defaults.task_service_account,
	// default false, #1890) serves executor.task_service_account as
	// task_service_account, so a deploy says which account its tasks run as
	// when they name none. It requires executor.task_service_account.
	AdvertiseTaskServiceAccount bool `mapstructure:"task_service_account"`
	// AdvertiseWarmPools (deploy.defaults.warm_pools, default false, #1890)
	// serves execution.warm_pools_enabled, execution.min_idle_workers and
	// execution.max_pool_size as warm_pools, so a deploy says how many idle
	// workers its DAG gets.
	AdvertiseWarmPools bool `mapstructure:"warm_pools"`
}

type DeploySection struct {
	// Defaults (deploy.defaults.*) are the registry prefix, build platforms,
	// base image and remote builder a deploy to this cluster uses for
	// whatever the project, its workspace, its target and the person's config
	// leave unset, and the switches that advertise the source mode runtime
	// image, the task service account and the warm pools. Served on GET
	// /api/v2/deployDefaults; unset (the default) advertises nothing, so
	// every deploy resolves as it did before. None of them is a secret.
	Defaults DeployDefaultsSection `mapstructure:"defaults"`
	// RequireDigest (deploy.require_digest, #1703) is what registering a
	// version, or making one current again, does with an image not pinned by
	// a full sha256 digest: off (the default) accepts it, warn accepts it with
	// a warning, a log line and a count, enforce refuses it. DEXAFLOW_DEPLOY_REQUIRE_DIGEST (legacy
	// LEOFLOW_DEPLOY_REQUIRE_DIGEST).
	RequireDigest domain.DigestRequirement `mapstructure:"require_digest"`
}

type DispatchSection struct {
	// BufferSize is the depth of the queued-dispatches channel. 0 disables the
	// pool (synchronous passthrough). A full channel returns ErrAtCapacity to
	// the scheduler, which leaves the TI scheduled for the next tick.
	BufferSize int `mapstructure:"buffer_size"`
	// Workers is the number of goroutines draining the queue. Ignored when
	// BufferSize <= 0; otherwise floored to 1.
	Workers int `mapstructure:"workers"`
	// TickBudget bounds the wall time one scheduler tick spends dispatching
	// (#1596). Once it is spent the tick stops dispatching, the remaining ready
	// tasks stay scheduled with no attempt charged, and the next tick starts at
	// the run after the one that was cut, so one wide fan-out under the
	// Kubernetes client rate limit cannot hold every other run, and cron run
	// creation, for minutes. 0 disables it; negative fails boot.
	TickBudget time.Duration `mapstructure:"tick_budget"`
	// MaxPerTenantPerTick caps the tasks one tenant may dispatch in one tick,
	// so a tenant with a wide fan-out or many runs leaves dispatch room for the
	// others. 0 (default) means no cap; negative fails boot.
	MaxPerTenantPerTick int `mapstructure:"max_per_tenant_per_tick"`
}

type ExecutionAllowlistSection struct {
	// Fields lists the execution fields a DAG may set, by their dag.json names
	// (domain.ExecutionPolicyFields). "*" (the default) allows all of them,
	// "none" or an explicitly empty list allows none.
	Fields []string `mapstructure:"fields"`
	// PriorityClasses, when not empty, lists the only priority_class_name values
	// a DAG may set. Empty (the default) allows any.
	PriorityClasses []string `mapstructure:"priority_classes"`
	// ServiceAccounts, when not empty, lists the only execution.service_account
	// values a DAG may name (issue #537 C2). A task that names none runs as
	// executor.task_service_account, which is not checked. Empty allows any.
	ServiceAccounts []string `mapstructure:"service_accounts"`
	// Images, when not empty, lists the DAG images that may run: exact
	// references or prefixes ending in "*" (issue #537 C2). Empty allows any.
	Images []string `mapstructure:"images"`
}

type ExecutionSection struct {
	// WarmPoolsEnabled turns on N:1 pod reuse (ADR 0058). Default false = a
	// dedicated pod per task attempt, today's behavior byte-for-byte. Turning it on
	// is gated at boot on the security prerequisites (token-exchange transport +
	// liveness enforcement) because a warm pod reuses one credential across attempts.
	WarmPoolsEnabled bool `mapstructure:"warm_pools_enabled"`
	// SourceMode runs a version on the operator's runtime image from the dag.py
	// it was registered with, with no image build (ADR 0067 §3). Off by default.
	SourceMode SourceModeSection `mapstructure:"source_mode"`
	// MaxAttemptsPerWorker caps how many attempts a warm worker serves before it is
	// drained and recycled (ADR 0058 D9). Bounds credential-leak and stale-image
	// exposure by forcing a fresh pod periodically. Default 50.
	MaxAttemptsPerWorker int `mapstructure:"max_attempts_per_worker"`
	// MaxWorkerLifetime is the wall-clock cap on a warm worker before it is drained
	// and recycled (ADR 0058 D9), independent of the attempt count. Default 1h. When
	// warm pools are on it MUST be >= auth.max_attempt_credential_lifetime, so a
	// worker is never force-recycled mid-attempt by its token lapsing.
	MaxWorkerLifetime time.Duration `mapstructure:"max_worker_lifetime"`
	// MinIdleWorkers is the number of warm workers kept ready per DAG version
	// (ADR 0058 D6). Default 0 = scale-to-zero, preserving the ADR 0002 zero-idle
	// floor; an operator opts into warmth by raising it.
	MinIdleWorkers int `mapstructure:"min_idle_workers"`
	// WorkerIdleTTL is how long an idle warm worker is kept before it is recycled
	// (ADR 0058 D6). Default 5m.
	WorkerIdleTTL time.Duration `mapstructure:"worker_idle_ttl"`
	// MaxPoolSize caps the total warm workers a single DAG version may hold —
	// registered workers plus in-flight dedicated pods. Default 8, operator-set.
	// N1b1-place records the knob and validates it (>= 1 when warm pools are on)
	// but does NOT enforce the cap yet: defer-at-max needs real pool accounting
	// (registered workers + in-flight pods), which arrives with the worker
	// lifecycle in N1b2/N1d. Today's placer is assign-if-free-else-dedicated.
	MaxPoolSize int `mapstructure:"max_pool_size"`
	// MaxWarmPodsPerTenant caps the TOTAL warm pods a single tenant may hold across
	// ALL its dag_versions on a shared cluster (M4). Where MaxPoolSize bounds one
	// dag_version's pool, this bounds a tenant's aggregate warm footprint so one
	// tenant cannot pin unlimited idle pods and starve neighbors on a shared
	// multi-team cluster. Default 100, operator-set. It is a RESERVE-then-RATION
	// budget, never a starvation lever: the promised idle floors of a tenant's
	// versions with an active run (the sum of their EffectiveMinIdle) are honored
	// even when they exceed this cap (the reconciler raises the effective budget
	// to the floor sum and meters the misconfiguration). A prewarm-only version
	// (ADR 0082) never raises it: the prewarm floors share what the cap leaves,
	// by DAG id, and a prewarm pool above its share shrinks with the worker idle
	// TTL. The floors of versions with an active run are created at once on top
	// of such a pool, so the tenant exceeds the cap until it has shrunk (at
	// most one idle TTL after each share drop). The cap is otherwise enforced
	// only by refusing to CREATE new warm pods, never by deleting a busy worker.
	MaxWarmPodsPerTenant int `mapstructure:"max_warm_pods_per_tenant"`
	// WarmReadOnlyRootFilesystem mounts every warm worker's root filesystem read
	// only and gives each attempt its own HOME and XDG dirs inside the scratch the
	// worker wipes between attempts, plus a sweep of the shared /tmp emptyDir and
	// /dev/shm before each attempt and after it ends. It closes X3.2: on a
	// writable root a file one attempt plants on the image (a module on the
	// working directory's sys.path, a ~/.local site-packages entry) is executed
	// by the next attempt on the same worker. Default false keeps
	// today's writable root, since a task that writes outside $HOME, $TMPDIR, /tmp
	// and /dev/shm would fail with it on. It applies to warm pods created after it
	// is turned on. Dedicated task pods are not affected; they follow
	// executor.defaults.read_only_task_root_filesystem.
	WarmReadOnlyRootFilesystem bool `mapstructure:"warm_read_only_root_filesystem"`
	// WarmRequireAttemptHomeSweep refuses a warm worker that does not confirm,
	// when it registers, that it empties /tmp and /dev/shm between attempts
	// (#1678), so its DAG version's attempts run on dedicated pods. It applies
	// only with WarmReadOnlyRootFilesystem on. Default false logs and meters
	// such a worker and keeps it: agents from runtime v0.5.1 sweep but only the
	// ones built after the report was added can confirm it.
	WarmRequireAttemptHomeSweep bool `mapstructure:"warm_require_attempt_home_sweep"`
	// WarmPoolEventRefill makes warm-pool refill event driven: the reconciler
	// reads the fleet from a dedicated warm-pod informer instead of a LIST per
	// tick, reacts at once to a worker being deleted, failing or claimed, and
	// issues replacement creates concurrently (bounded). Default false keeps
	// today's 30s polling with a LIST and serial creates. The failover reapers
	// and the drained-anchor delete keep their live reads either way.
	WarmPoolEventRefill bool `mapstructure:"warm_pool_event_refill"`
}

type ExecutorSection struct {
	HTTP HTTPExecutorSection `mapstructure:"http"`
	// TaskNamespace is the Kubernetes namespace the server creates task pods and
	// per-run staging PVCs in. It MUST match the namespace the Helm chart grants
	// the executor Role in (chart `taskNamespace` → LEOFLOW_EXECUTOR_TASK_NAMESPACE);
	// a mismatch 403s every dispatch (#480). Defaults to "leoflow".
	TaskNamespace string `mapstructure:"task_namespace"`
	// Type selects the pod-path executor: "kubernetes" (default, pod-per-task) or
	// "subprocess" (dev only, runs the agent on the host without isolation, used
	// by `dexaflow lite`).
	Type string `mapstructure:"type"`
	// AgentPath is the leoflow-agent binary the subprocess executor runs (dev only).
	AgentPath string `mapstructure:"agent_path"`
	// SubprocessWorkDir is the working directory the subprocess executor runs the
	// agent in, so it can import the project's dag.py (dev only). Empty keeps the
	// server's working directory.
	SubprocessWorkDir string `mapstructure:"subprocess_workdir"`
	// AgentControlPlaneAddr is the gRPC address task pods dial back to. Empty
	// falls back to server.grpc_addr; in a local k3d/kind cluster set it to a
	// host-reachable address such as host.k3d.internal:9091.
	AgentControlPlaneAddr string `mapstructure:"agent_control_plane_addr"`
	// AgentTLSCAConfigMap names a ConfigMap (key ca.crt) mounted into task pods so
	// the agent verifies the control plane's gRPC TLS cert (issue #58). Empty =
	// agents use the insecure channel (dev).
	AgentTLSCAConfigMap string `mapstructure:"agent_tls_ca_configmap"`
	// TaskServiceAccount is the ServiceAccount task pods run as when a DAG's task
	// does not set execution.service_account. The chart wires its taskServiceAccount
	// here, so creating that SA makes keyless work without every DAG opting in.
	// Empty keeps pods on the namespace default SA (an explicit per-task value
	// always wins).
	TaskServiceAccount string `mapstructure:"task_service_account"`
	// TaskSecretName names a Kubernetes Secret mounted (read-only) into every task
	// pod at TaskSecretMountPath. It lets a task read a credential that lives in
	// the cluster's secret store (e.g. a GCP service-account key) referenced by a
	// connection's key_path — so Dexaflow never stores the key itself (ADR 0035).
	// Empty = no secret mounted.
	TaskSecretName string `mapstructure:"task_secret_name"`
	// TaskSecretMountPath is where TaskSecretName is mounted in the task pod.
	TaskSecretMountPath string `mapstructure:"task_secret_mount_path"`
	// Defaults holds per-cluster task defaults applied at dispatch to fill gaps the
	// DAG artifact left empty (ADR 0023, layer L0). They never override a value
	// baked into dag.json, keeping the artifact portable across clusters.
	Defaults PlatformDefaultsSection `mapstructure:"defaults"`
	// CollectSettledRunPods deletes a settled run's finished task pods as soon
	// as the reconciler has recorded every outcome, in one DeleteCollection by
	// the run's label instead of one delete per pod after the grace period. It
	// needs the deletecollection verb on pods (the chart grants it only when this
	// is on) and falls back to per-pod deletes without it. Off by default:
	// finished pods stay for the grace period, so they can be inspected with
	// kubectl.
	CollectSettledRunPods bool `mapstructure:"collect_settled_run_pods"`
	// KubeClient sets the client-side rate limits of the control plane's
	// Kubernetes clients.
	KubeClient KubeClientSection `mapstructure:"kube_client"`
	// Unit is the resource unit one pool slot stands for (ADR 0066). Unset (the
	// default) changes nothing. Set, every task pod is sized pool_slots x unit
	// where the task leaves cpu or memory out, and a task that declares more
	// than that is refused at registration and at dispatch.
	Unit ExecutorUnitSection `mapstructure:"unit"`
}

type ExecutorUnitSection struct {
	CPU     string `mapstructure:"cpu"`
	Memory  string `mapstructure:"memory"`
	Enforce string `mapstructure:"enforce"`
	MaxSize int    `mapstructure:"max_size"`
}

type HTTPExecutorSection struct {
	// UserAgent is the default User-Agent header for HTTP requests a task image
	// may make on the platform's behalf.
	UserAgent string `mapstructure:"user_agent"`
}

type HomeLinkSection struct {
	// Label is the link text, for example the operator's portal name.
	Label string `mapstructure:"label"`
	// URL is where the link goes. It must be an absolute http:// or https:// URL.
	URL string `mapstructure:"url"`
}

type JWTSection struct {
	Secret          string `mapstructure:"secret"`
	TokenTTLSeconds int    `mapstructure:"token_ttl_seconds"`
	// MaxLifetimeSeconds is the hard ceiling on how long a user session may be kept
	// alive by transparent token renewal (aresta #5), measured since first login
	// (the token's oiat claim). Past it, POST /api/v2/auth/token/renew is refused
	// and the user must `dexaflow auth login` again. The short TokenTTLSeconds still
	// bounds a stolen token independently; this only caps the total renewed
	// lifetime, mirroring auth.max_attempt_credential_lifetime for agent tokens.
	// Generous by default (24h) so a normal dev day never re-logs in mid-session; a
	// non-positive value disables the ceiling (renewal never expires the session).
	// Bind via LEOFLOW_AUTH_JWT_MAX_LIFETIME_SECONDS.
	MaxLifetimeSeconds int `mapstructure:"max_lifetime_seconds"`
}

type KubeClientSection struct {
	// QPS and Burst limit the dispatch client. Defaults are client-go's own
	// (5 and 10); a non-positive value falls back to them.
	QPS   float64 `mapstructure:"qps"`
	Burst int     `mapstructure:"burst"`
	// MaintenanceQPS and MaintenanceBurst limit a separate maintenance client.
	// 0 (default) keeps maintenance on the dispatch client, one shared budget as
	// before. A non-positive burst with a positive QPS falls back to client-go's
	// default burst.
	MaintenanceQPS   float64 `mapstructure:"maintenance_qps"`
	MaintenanceBurst int     `mapstructure:"maintenance_burst"`
}

type LogTailSection struct {
	// Publish is "always" (default: every line is published, as before) or
	// "on_demand" (lines are published only while someone follows the attempt;
	// a new follower may see its first live lines up to about a second late).
	// Bind via DEXAFLOW_LOGS_TAIL_PUBLISH (legacy LEOFLOW_LOGS_TAIL_PUBLISH).
	Publish string `mapstructure:"publish"`
}

type LogsSection struct {
	// Dir is the root directory for the disk log sink (the default backend).
	Dir string `mapstructure:"dir"`
	// Backend selects the durable task-log store: "disk" (default) writes files
	// under Dir; "s3" ships each attempt to an S3-compatible bucket (AWS S3,
	// MinIO, Ceph RGW); "gcs" ships to Google Cloud Storage via its native SDK.
	// Object storage is opt-in — Lite and every deployment that does not set this
	// keep the exact on-disk path unchanged.
	Backend string `mapstructure:"backend"`
	// Sink configures the object-store backend; read only when Backend is "s3" or
	// "gcs".
	Sink ObjectLogSection `mapstructure:"sink"`
	// Tail configures the live-tail fan-out of task log lines.
	Tail LogTailSection `mapstructure:"tail"`
}

type MetricsSection struct {
	// DropLegacyNames stops publishing every dexaflow_* family a second time
	// under its pre-rename leoflow_* name. Off by default (ADR 0062 gate), so
	// dashboards and alerts written against the old names keep working.
	DropLegacyNames bool `mapstructure:"drop_legacy_names"`
}

type OIDCSection struct {
	// Issuer is the org's single-tenant issuer URL (https). It is pinned: any ID
	// token whose iss claim differs is rejected (fail-closed tenant pin).
	Issuer string `mapstructure:"issuer"`
	// ClientID is the registered application (client) id; it is the expected
	// audience of every ID token.
	ClientID string `mapstructure:"client_id"`
	// ClientSecret is used only for the code exchange. Set via
	// LEOFLOW_AUTH_OIDC_CLIENT_SECRET; never persist it in a config file.
	ClientSecret string `mapstructure:"client_secret"`
	// RedirectURL is this server's callback URL registered with the IdP
	// (…/api/v2/auth/oidc/callback).
	RedirectURL string `mapstructure:"redirect_url"`
	// Scopes are the OAuth scopes requested; defaults to openid, email, profile.
	// Add the IdP's groups scope here when group→role mapping is used.
	Scopes []string `mapstructure:"scopes"`
	// GroupsClaim is the ID-token claim carrying the user's IdP groups (default
	// "groups"). Its values drive RoleMappings.
	GroupsClaim string `mapstructure:"groups_claim"`
	// RoleMappings maps an IdP group value to an existing Dexaflow role name.
	// Default-DENY: a group with no mapping grants no role. Configure via a YAML
	// config file only. The chart ships none today, so this map has no route
	// through Helm (#1143).
	//
	// Decoded OUT-OF-BAND (mapstructure:"-"), not by viper: viper's "." key
	// delimiter splits a dotted MAP KEY (a dotted IdP group like "app.admins")
	// into nested maps and fails to decode. LoadServer parses this map straight
	// from the raw YAML instead (#826). Env-var binding never applied to maps.
	RoleMappings map[string]string `mapstructure:"-" yaml:"role_mappings"`
	// DefaultRole softens the default-deny WITHOUT weakening the secure default:
	// when an authenticated user resolves to zero mapped roles and DefaultRole is
	// set, they are granted this single role (operators are advised to use a
	// read-only role such as "viewer"). Empty (the default) keeps strict
	// default-deny — an unmapped user gets no role. It must name an existing DB
	// role for the resolved tenant; an unknown role fails the login closed.
	DefaultRole string `mapstructure:"default_role"`
	// TenantClaim selects which IdP claim identifies the tenant: "tid" (Entra) or
	// "hd" (Google Workspace).
	TenantClaim string `mapstructure:"tenant_claim"`
	// TenantClaims maps a TenantClaim value to a Dexaflow tenant name. A value not
	// present here is rejected (403) — the login never falls back to "default".
	//
	// Decoded OUT-OF-BAND (mapstructure:"-"), not by viper: a Google Workspace
	// `hd` value is a domain (always dotted, e.g. "example.com" or
	// "sub.example.co.uk"), which viper's "." delimiter would split into nested
	// maps and fail to decode — the #826 crash. LoadServer parses this map from
	// the raw YAML instead.
	TenantClaims map[string]string `mapstructure:"-" yaml:"tenant_claims"`
	// AllowedEmailDomains is an install-time, login-level allowlist layered on TOP
	// of the tid/hd tenant pin — it is NOT the pin itself (that stays issuer +
	// tid/hd + email_verified per D6). The check runs only AFTER the pin and
	// email_verified==true have passed, so the email domain is trustworthy at that
	// point. Empty (the default) imposes no domain restriction — the tid/hd pin is
	// the sole boundary. Non-empty admits a login (pre-provisioned OR JIT) only
	// when the verified email's domain is in the list; every other login is
	// rejected 403. It gates EVERY OIDC login, not just auto-provisioning.
	AllowedEmailDomains []string `mapstructure:"allowed_email_domains"`
	// BreakGlassEmails is the allowlist of local password logins permitted while
	// provider is "oidc"; every other password login is rejected (SSO-only).
	BreakGlassEmails []string `mapstructure:"break_glass_emails"`
	// JITProvisioning creates a user row on first OIDC login when no matching one
	// exists; the new row is granted the roles from RoleMappings. OFF by default.
	//
	// OFF denies every first login. A login matches a user only by
	// (oidc_provider, oidc_subject) and CreateOIDCUser, reached only from this
	// path, is the sole statement that writes those columns, so no API, CLI or
	// migration can pre-create an OIDC identity (ADR 0057, amendment on D4).
	// cmd/dexaflow-server warns about this at boot.
	JITProvisioning bool `mapstructure:"jit_provisioning"`
	// AutoRedirect starts the login flow on the sign-in page instead of rendering
	// it, for a deployment where that page is a screen to acknowledge for nothing
	// (an edge proxy has already authenticated, or SSO is the only way in).
	//
	// OFF by default: turning it on for everyone would remove the sign-in page
	// from deployments that rely on it. It is suppressed on a refused sign-on and
	// behind an explicit ?local=1, so a denial still lands somewhere readable and
	// a break-glass account can always reach the form.
	AutoRedirect bool `mapstructure:"auto_redirect"`
	// ClockSkewSeconds is the tolerance applied to the ID token's exp/iat/nbf
	// checks to absorb small clock differences between the IdP and this server.
	// Defaults to 60.
	ClockSkewSeconds int `mapstructure:"clock_skew_seconds"`
}

type OTelSection struct {
	Enabled  bool   `mapstructure:"enabled"`
	Endpoint string `mapstructure:"endpoint"`
	// SampleRatio is the share of request traces kept (1 keeps every trace).
	// No propagator is installed, so an incoming traceparent is ignored and
	// every request starts a new root trace; spans within a request follow
	// its root's decision.
	SampleRatio float64 `mapstructure:"sample_ratio"`
	// SkipProbeSpans drops spans for /healthz, /readyz and /static/*. Off by
	// default (ADR 0062), so every request is traced as before.
	SkipProbeSpans bool `mapstructure:"skip_probe_spans"`
}

type ObjectLogSection struct {
	// Bucket is the target bucket. Required when Backend is "s3" or "gcs".
	Bucket string `mapstructure:"bucket"`
	// Prefix is an optional key prefix under which attempt objects are laid out.
	Prefix string `mapstructure:"prefix"`
	// Region is the S3 store region (e.g. "us-east-1"). Required by AWS S3;
	// ignored by some S3-compatible stores. S3-only.
	Region string `mapstructure:"region"`
	// Endpoint overrides the S3 endpoint for S3-compatible stores (MinIO, Ceph
	// RGW). Empty uses the AWS default endpoint. S3-only — it is NOT the way to
	// reach GCS, which has its own keyless "gcs" backend.
	Endpoint string `mapstructure:"endpoint"`
	// ForcePathStyle uses path-style addressing (bucket in the path, not the
	// host). Required by MinIO and some S3-compatible stores. S3-only.
	ForcePathStyle bool `mapstructure:"force_path_style"`
	// AccessKeyID is a static S3 access key. Empty (recommended) uses the keyless
	// credential chain (ADR 0035). S3-only.
	AccessKeyID string `mapstructure:"access_key_id"`
	// SecretAccessKey pairs with AccessKeyID. Discouraged; prefer keyless. S3-only.
	SecretAccessKey string `mapstructure:"secret_access_key"`
	// CredentialsFile is a path to a GCS service-account JSON key. Empty
	// (recommended) uses Application Default Credentials — GKE Workload Identity
	// keyless. GCS-only.
	CredentialsFile string `mapstructure:"credentials_file"`
	// Layout selects how new attempts are written to the bucket: "single"
	// (default) keeps one object per attempt at {try}.log, rewritten on every
	// flush; "segmented" writes numbered segments under {try}.log.d/
	// ({try}.e{epoch}.log.d/ for a later execution of the try) so a flush
	// uploads only the open segment. Both layouts are always readable. Turn
	// segmented on only once every replica runs a version that reads it.
	Layout string `mapstructure:"layout"`
}

type ObservabilitySection struct {
	OTel      OTelSection    `mapstructure:"otel"`
	LogLevel  string         `mapstructure:"log_level"`
	LogFormat string         `mapstructure:"log_format"`
	Metrics   MetricsSection `mapstructure:"metrics"`
}

type PlatformDefaultsSection struct {
	// StagingSize/StagingStorageClass default the per-run staging volume when the
	// DAG enabled staging without pinning them (e.g. the cluster's RWX class).
	StagingSize         string `mapstructure:"staging_size"`
	StagingStorageClass string `mapstructure:"staging_storage_class"`
	// StagingAccessMode is the PVC access mode for the staging volume. Defaults to
	// ReadWriteMany (multi-node prod); single-node dev (k3d local-path, no RWX)
	// sets ReadWriteOnce, which is sufficient for a run's sequential same-node pods.
	StagingAccessMode string `mapstructure:"staging_access_mode"`
	// ResourcesCPU/ResourcesMemory default a task's request when neither the task
	// override nor the DAG set any (Kubernetes quantities, e.g. "250m"/"256Mi").
	ResourcesCPU    string `mapstructure:"resources_cpu"`
	ResourcesMemory string `mapstructure:"resources_memory"`
	// LimitsCPU/LimitsMemory are the default task limits (#537): the CPU and
	// memory limit a task pod gets in a dimension its resources leave without
	// one, including a task that declares requests only. Empty (the default)
	// sets no limit, as before. Either may be set alone. Not applied with
	// executor.unit, which always sets both limits.
	LimitsCPU    string `mapstructure:"limits_cpu"`
	LimitsMemory string `mapstructure:"limits_memory"`
	// RunTasksAsNonRoot refuses to start a task container whose image resolves
	// to UID 0, completing Pod Security Admission's `restricted` set. On by
	// default now that the images this repo ships carry a numeric non-root UID:
	// runtime/Dockerfile runs as `USER 65532:65532` and every examples/*/image
	// inherits it, and the executor pairs it with a pod-level fsGroup so the
	// per-run staging PVC stays writable. Turn it off for a cluster whose task
	// images legitimately run as root.
	//
	// Deliberately a cluster setting rather than a DAG field: whether untrusted
	// task code may run as root belongs to whoever operates the cluster, not to
	// whoever authors the DAG.
	RunTasksAsNonRoot bool `mapstructure:"run_tasks_as_non_root"`
	// ReadOnlyTaskRootFilesystem mounts every task container's root filesystem
	// read-only. Off by default because `restricted` does not require it and it
	// breaks ordinary Python tasks (pip cache, /tmp, matplotlib config); turn it
	// on for a fleet of tasks known not to write outside their volumes.
	ReadOnlyTaskRootFilesystem bool `mapstructure:"read_only_task_root_filesystem"`
	// ExecutionAllowlist restricts which task execution (placement) fields a DAG
	// author may set, and optionally which priority classes (issue #629). The
	// default allows everything. Like the two settings above it is a cluster
	// setting: on a shared cluster these fields reach other teams' nodes and
	// preemption order.
	ExecutionAllowlist ExecutionAllowlistSection `mapstructure:"execution_allowlist"`
}

type RedisSection struct {
	URL string `mapstructure:"url"`
	// CAFile is the absolute path to a PEM CA bundle the client trusts when
	// negotiating TLS to a `rediss://` URL (#312). Required to reach managed
	// Redis (Memorystore SERVER_AUTHENTICATION, ElastiCache in-transit
	// encryption, Azure Cache for Redis) whose server cert is signed by a
	// provider / per-instance CA that is not in the container's system
	// roots. Empty falls back to the SDK default — system roots only.
	// The Helm chart sets this via LEOFLOW_REDIS_CA_FILE when
	// `redis.caConfigMap` is configured, pointing at the mounted ConfigMap.
	CAFile string `mapstructure:"ca_file"`
}

type RemoteBuilderSection struct {
	// CloudBuild is deploy.defaults.remote_builder.cloud_build.
	CloudBuild CloudBuildSection `mapstructure:"cloud_build"`
	// BuildKit is deploy.defaults.remote_builder.buildkit.
	BuildKit BuildKitSection `mapstructure:"buildkit"`
}

type RetentionSection struct {
	// DagRunsDays deletes finished (success or failed) dag runs, with their task
	// instances, attempt history and XCom index rows, once they ended more
	// than this many days ago. 0 (default) keeps every run.
	DagRunsDays int `mapstructure:"dag_runs_days"`
	// AuditLogDays deletes audit log entries older than this many days. 0
	// (default) keeps the whole audit log.
	AuditLogDays int `mapstructure:"audit_log_days"`
	// DryRun only counts the rows a cycle would delete, logs the counts and
	// exports them as gauges, and deletes nothing.
	DryRun bool `mapstructure:"dry_run"`
	// Interval is how often a cycle runs. Default 1h.
	Interval time.Duration `mapstructure:"interval"`
	// BatchSize caps the rows one DELETE statement removes, except the task
	// instances of one run larger than it, which go together. Default 1000.
	BatchSize int `mapstructure:"batch_size"`
	// BatchPause is the sleep between two batches, so the janitor never holds
	// the database busy. Default 100ms.
	BatchPause time.Duration `mapstructure:"batch_pause"`
	// MaxRowsPerCycle stops a cycle from starting another batch once this many
	// rows were deleted; the rest waits for the next cycle. Default 100000.
	MaxRowsPerCycle int `mapstructure:"max_rows_per_cycle"`
}

type SchedulerSection struct {
	LoopIntervalMS int  `mapstructure:"loop_interval_ms"`
	Enabled        bool `mapstructure:"enabled"`
	// EagerPromotion cuts the latency between a task settling and its
	// downstreams being dispatched. Within a tick, the scheduler re-plans a run
	// after its own state changes (a newly scheduled task is queued at once, a
	// skip cascades), a bounded number of times; and a task's terminal report
	// triggers an early tick instead of waiting for the next interval, which
	// stays the upper bound. Off by default (ADR 0062): the tick then promotes
	// one step per interval, as it always has.
	EagerPromotion bool            `mapstructure:"eager_promotion"`
	Dispatch       DispatchSection `mapstructure:"dispatch"`
	Alerts         AlertsSection   `mapstructure:"alerts"`
	// PoolStarvationThreshold is how long a task held only by its pool waits
	// before the pool is reserved for it, so tasks of fewer slots cannot keep
	// a larger one out forever (ADR 0066 §4). 0 disables reservations. Pro only:
	// Lite has no pools.
	PoolStarvationThreshold time.Duration `mapstructure:"pool_starvation_threshold"`
}

type SecretsSection struct {
	// Backend is the provider secrets-backend class the in-pod resolver drives
	// (e.g. the Airflow AWS SecretsManagerBackend). Empty disables external secrets.
	Backend string `mapstructure:"backend"`
	// BackendKwargs is the provider kwargs as a JSON object string (connections_prefix,
	// variables_prefix, region_name, …); a kind is served iff its `*_prefix` kwarg is
	// present. A JSON string (not a map) so it is settable via a single
	// LEOFLOW_SECRETS_BACKEND_KWARGS env var, matching the env-only control-plane
	// chart. Empty is treated as `{}`. Delivered verbatim to the pod.
	BackendKwargs string `mapstructure:"backend_kwargs"`
}

type ServerConfig struct {
	Server        ServerSection        `mapstructure:"server"`
	Database      DatabaseSection      `mapstructure:"database"`
	Redis         RedisSection         `mapstructure:"redis"`
	Auth          AuthSection          `mapstructure:"auth"`
	Scheduler     SchedulerSection     `mapstructure:"scheduler"`
	Executor      ExecutorSection      `mapstructure:"executor"`
	Execution     ExecutionSection     `mapstructure:"execution"`
	Logs          LogsSection          `mapstructure:"logs"`
	Observability ObservabilitySection `mapstructure:"observability"`
	UI            UISection            `mapstructure:"ui"`
	Secrets       SecretsSection       `mapstructure:"secrets"`
	Retention     RetentionSection     `mapstructure:"retention"`
	Deploy        DeploySection        `mapstructure:"deploy"`
	// SecretKey (LEOFLOW_SECRET_KEY) encrypts connection secrets at rest (ADR
	// 0019). Raw 32 chars, 64-char hex, or base64. Empty disables connection
	// writes.
	//
	// A COMMA-SEPARATED LIST rotates the key: the first entry encrypts and
	// decrypts, every later entry only decrypts. Nothing is ever written under a
	// later entry. This is the shape Airflow's `fernet_key` uses, so an operator
	// coming from Airflow already knows to put the new key first and the old
	// ones after (#486).
	//
	// Trying keys in order is safe only because AES-GCM is authenticated: a
	// wrong key fails to open rather than returning plausible garbage.
	SecretKey string `mapstructure:"secret_key"`
	// SecretKeyReencryptOnBoot (LEOFLOW_SECRET_KEY_REENCRYPT_ON_BOOT, default
	// true) runs the ADR 0019 boot sweep that moves stored secrets onto the
	// first key of SecretKey. `dexaflow lite` sets it to false: a Lite install
	// migrates only through the explicit `dexaflow lite migrate-key`, which
	// records every key before touching a row and verifies before it commits
	// (ADR 0065). Pro keeps the default.
	SecretKeyReencryptOnBoot bool `mapstructure:"secret_key_reencrypt_on_boot"`
	// SecretKeyMigrationLock (LEOFLOW_SECRET_KEY_MIGRATION_LOCK, default false)
	// makes the server hold the key-migration advisory lock shared for its whole
	// life, refuse to start while a migration holds it, and exit if it loses it.
	// `dexaflow lite` sets it to true (ADR 0065 section 3).
	SecretKeyMigrationLock bool `mapstructure:"secret_key_migration_lock"`
	// VariableEncryption (DEXAFLOW_VARIABLE_ENCRYPTION, default "off") is how
	// Variable values are stored (#507). "off" writes plaintext, as every
	// earlier release did, and still reads values sealed before. "on" seals
	// every write with SecretKey and seals the stored plaintext rows at boot;
	// it requires a usable SecretKey. "decrypt" writes plaintext and restores
	// every sealed row at boot: the step before rolling back to a release that
	// cannot read sealed values.
	VariableEncryption string `mapstructure:"variable_encryption"`
	// DagsArePausedAtCreation (DEXAFLOW_DAGS_ARE_PAUSED_AT_CREATION, default
	// true) is Airflow's [core] dags_are_paused_at_creation: a DAG registered
	// for the first time starts paused, so its schedule creates no run until
	// someone unpauses it. A DAG's own is_paused_upon_creation wins over it.
	// It applies only on creation: a redeploy never pauses or unpauses a DAG
	// (#1705). `dexaflow lite` sets it to false, so a DAG run locally starts
	// active as it always did.
	DagsArePausedAtCreation bool `mapstructure:"dags_are_paused_at_creation"`
}

type ServerSection struct {
	// Role selects which components this process runs (ADR 0049): "all" (default;
	// the monolith Lite always runs), "api" (HTTP + UI, restricted identity), or
	// "scheduler" (reconciler + dispatch + agent gRPC, privileged). Splitting is a
	// Pro-only topology; "all" is behavior-identical to the pre-0049 monolith.
	Role        string      `mapstructure:"role"`
	HTTPAddr    string      `mapstructure:"http_addr"`
	MetricsAddr string      `mapstructure:"metrics_addr"`
	GRPCAddr    string      `mapstructure:"grpc_addr"`
	CORS        CORSSection `mapstructure:"cors"`
	// TrustedProxies lists the proxy IPs/CIDRs whose X-Forwarded-For is honored
	// when resolving the client IP. Empty (the default) trusts no proxy, so a
	// spoofed XFF cannot forge the client IP (audit H1); set it to the ingress
	// CIDR when the API runs behind a reverse proxy so rate-limiting and audit
	// see the real client.
	TrustedProxies []string `mapstructure:"trusted_proxies"`
	// GRPCTLSCert/GRPCTLSKey enable TLS on the agent gRPC listener (issue #58).
	// When both are set the channel is encrypted; empty means plaintext (dev).
	GRPCTLSCert string `mapstructure:"grpc_tls_cert"`
	GRPCTLSKey  string `mapstructure:"grpc_tls_key"`
	// GzipResponses gzips JSON and NDJSON responses of 1 KB or more on the API
	// and UI surfaces for clients that accept it. Log routes and anything that
	// flushes (live tails, SSE) stay uncompressed. Routes that return secrets,
	// tokens or code (variables, connections, XComs, auth and the UI session
	// token, IDE files, DAG sources and specs, a single task or task
	// instance) also stay uncompressed:
	// compressing a secret next to reflected input lets its length leak the
	// secret (BREACH). Other JSON can still echo request input next to private
	// data, which is the trade-off of turning this on. Off by default (ADR 0062).
	GzipResponses bool `mapstructure:"gzip_responses"`
	// MaxPageLimit caps the `limit` a list endpoint accepts, and the
	// `dag_runs_limit` of /ui/dags; a larger value is served as the cap, like
	// Airflow's [api] maximum_page_limit. 0 (the default, ADR 0062 gate) keeps
	// today's behavior: no cap.
	MaxPageLimit int `mapstructure:"max_page_limit"`
	// ReadTimeout bounds reading a whole request, headers and body, on the API
	// and metrics listeners: a slow client cannot hold a connection open by
	// trickling a body. Set it above the slowest legitimate upload. It never
	// limits a response: net/http lifts the read deadline once the body is
	// read, so live log tails are unaffected. 0 (the default, ADR 0062 gate)
	// means no limit, as before.
	ReadTimeout time.Duration `mapstructure:"read_timeout"`
	// IdleTimeout closes a keep-alive connection that has been idle this long.
	// 0 (the default) keeps idle connections open, as before, even when
	// ReadTimeout is set (net/http alone would fall back to ReadTimeout).
	IdleTimeout time.Duration `mapstructure:"idle_timeout"`
	// HTTPTLSCert/HTTPTLSKey serve the API and UI listener (http_addr) over
	// HTTPS with an operator-supplied PEM certificate and key (#638), so a load
	// balancer can re-encrypt to the pod. Both must be set together; both empty
	// (the default) keeps plain HTTP. The files are re-read when they change, so
	// a rotated certificate is picked up without a restart. The metrics listener
	// is not affected.
	HTTPTLSCert string `mapstructure:"http_tls_cert"`
	HTTPTLSKey  string `mapstructure:"http_tls_key"`
	// PoolsReadOnly makes the tenant-facing pool API (/api/v2/pools) serve reads
	// only: create, resize and delete answer 403 for every role, tenant admin
	// included. It is for an engine shared by many tenants, where the platform
	// operator sizes each tenant's pools out of band and a tenant must not be
	// able to raise its own slot budget. It also makes the scheduler admit a task
	// naming a pool its tenant has not defined against default_pool, since a
	// tenant cannot create pools then. Default false keeps pools writable under
	// write:pool and undefined pools unlimited, today's behavior.
	PoolsReadOnly bool `mapstructure:"pools_read_only"`
}

type Session struct {
	Server string `yaml:"server"`
	Token  string `yaml:"token"`
}

type Setting struct {
	// Key is the dotted key in the YAML config file, e.g. "auth.oidc.issuer".
	Key string
	// Env is the DEXAFLOW_* variable that sets the key, or "" when only the
	// config file can set it.
	Env string
	// LegacyEnv is the LEOFLOW_* variable from before the rename, read when Env
	// is unset; "" when Env is.
	LegacyEnv string
	// Type is a short type name: string, int, bool, float, duration, list or map.
	Type string
	// Default is the built-in value, rendered as text ("" when empty).
	Default string
	// Owner is the Go struct type that holds the field, e.g. "OIDCSection".
	Owner string
	// Field is the Go field name in Owner, e.g. "Issuer".
	Field string
}

type SourceModeSection struct {
	// Enabled turns source mode on. Default false: Pro ignores a version's source.
	// Bind via DEXAFLOW_EXECUTION_SOURCE_MODE_ENABLED (legacy
	// LEOFLOW_EXECUTION_SOURCE_MODE_ENABLED).
	Enabled bool `mapstructure:"enabled"`
	// Image is the runtime image, pinned by a full sha256 digest, that
	// source-mode versions name as their image. Bind via
	// DEXAFLOW_EXECUTION_SOURCE_MODE_IMAGE (legacy LEOFLOW_EXECUTION_SOURCE_MODE_IMAGE).
	Image string `mapstructure:"image"`
}

type TrustedIssuerSection struct {
	// Name identifies the issuer; its users are linked under "issuer:<name>".
	// Lowercase letters, digits and '-'. Keep it stable once users exist.
	Name string `mapstructure:"name"`
	// Issuer is the exact `iss` the tokens carry.
	Issuer string `mapstructure:"issuer"`
	// JWKSURL is where the issuer publishes its public signing keys: https, or
	// http on a loopback host for local development.
	JWKSURL string `mapstructure:"jwks_url"`
	// Audience is the `aud` the tokens must carry for this Dexaflow.
	Audience string `mapstructure:"audience"`
	// TenantClaim names the string claim carrying the Dexaflow tenant name.
	TenantClaim string `mapstructure:"tenant_claim"`
	// AllowedTenants lists the tenants the issuer may sign in to; "*" allows
	// every tenant.
	AllowedTenants []string `mapstructure:"allowed_tenants"`
	// MaxLifetimeSeconds caps exp - iat of a token, the replay window of a
	// handoff. Zero uses the 120-second default; at most 600.
	MaxLifetimeSeconds int `mapstructure:"max_lifetime_seconds"`
	// AllowedOrigins are the origins (scheme://host[:port]) whose pages may
	// post a handoff. Any other Origin, or none, is refused, so another site
	// cannot sign a visitor in (login CSRF). Required.
	AllowedOrigins []string `mapstructure:"allowed_origins"`
	// BearerAudiences turns on the bearer mode (#1468): a token whose `aud` is
	// one of these is accepted as the bearer of any /api/v2 request, reused
	// within its lifetime, the way a remote MCP client authenticates (ADR 0050
	// D9). Each must differ from Audience, so a handoff token is never a
	// bearer. Empty (the default) leaves the mode off.
	BearerAudiences []string `mapstructure:"bearer_audiences"`
	// BearerMaxLifetimeSeconds caps exp - iat of a bearer. Zero uses the
	// 900-second default; at most 3600.
	BearerMaxLifetimeSeconds int `mapstructure:"bearer_max_lifetime_seconds"`
	// DeployAudience makes the issuer the only way to deploy (#1773). When
	// set, registering a DAG version (and its dry run) and setting the current
	// version, and deleting a DAG, take only a bearer of this issuer whose
	// `aud` is this audience alone and that carries dexaflow:deploy, besides
	// the role check; a token that also names another audience, a session, a
	// password login token, an API token and a bearer of another audience
	// are refused with 403. It is a bearer audience of its own: it turns the
	// bearer verifier on without BearerAudiences, and a token for it gets
	// the scopes it carries, like any bearer. It must differ from Audience
	// and from every BearerAudiences entry, so a handoff or another client's
	// bearer is never a deploy token. Empty (the default) changes nothing.
	DeployAudience string `mapstructure:"deploy_audience"`
	// HostPattern binds a browser session to its tenant's host (#1463), for
	// an operator that serves each tenant on its own host in front of one
	// engine, for example "{tenant}.example.com". When set, a handoff is
	// accepted only on the host the pattern names for the token's tenant, and
	// a request that authenticates with the session cookie only on the host
	// for the session's tenant. The host is the request's Host, or
	// X-Forwarded-Host from a peer in server.trusted_proxies. A bearer in the
	// Authorization header is not bound. Empty (the default) binds nothing.
	HostPattern string `mapstructure:"host_pattern"`
}

type UISection struct {
	// InstanceName is shown in the UI navbar (Airflow's instance_name). Empty
	// falls back to "Dexaflow"; `dexaflow lite` sets it to mark the environment.
	InstanceName string `mapstructure:"instance_name"`
	// AutoRefreshIntervalSeconds is the SPA's polling cadence for DAG /
	// DagRun / task-instance state refresh (Airflow's auto_refresh_interval).
	// Zero (the default) falls back to api.DefaultUIAutoRefreshIntervalSeconds
	// (30s, production-safe). `dexaflow lite` sets it to 1s for a snappy inner
	// loop so the SPA reflects state changes almost immediately during dev.
	AutoRefreshIntervalSeconds int `mapstructure:"auto_refresh_interval_seconds"`
	// Edition marks the running edition; "lite" shows the silver LITE badge and
	// "pro" shows the gold PRO badge in the UI shell (independent of the auth
	// mode). Empty/any other value shows no badge — Demo intentionally renders
	// without an edition pill.
	Edition string `mapstructure:"edition"`
	// Workspace is the DAG project directory the Lite web editor edits (ADR 0025).
	// Empty disables the editor (Production, or Lite without one).
	Workspace string `mapstructure:"workspace"`
	// MonacoDir is where the pinned Monaco bundle was fetched by `dexaflow setup`;
	// the editor page is served Monaco from it. Empty shows a setup hint.
	MonacoDir string `mapstructure:"monaco_dir"`
	// HomeLink is an optional, persistent link from the UI back to the platform
	// the operator serves Dexaflow from (#1290). Empty shows no link.
	HomeLink HomeLinkSection `mapstructure:"home_link"`
	// Theme is a JSON object in the shape of Airflow's `[api] theme` (#1289):
	// `tokens` (Chakra design tokens, such as colors.brand and fonts),
	// `globalCss`, `icon` and `icon_dark_mode`. The UI applies it through its
	// own theming. Empty keeps the stock look.
	Theme string `mapstructure:"theme"`
	// FaviconURL replaces the UI's favicon. It must be http(s) or root-relative.
	FaviconURL string `mapstructure:"favicon_url"`
	// StylesheetURLs are extra stylesheets loaded by every UI page, typically
	// the web fonts a theme's fonts tokens name. Each must be http(s) or
	// root-relative.
	StylesheetURLs []string `mapstructure:"stylesheet_urls"`
	// ETagRevalidation lets the browser revalidate the UI routes that compute
	// an ETag (the grid's task summaries) with "private, no-cache" instead of
	// no-store, so an unchanged grid poll is answered 304. The browser then
	// keeps the last grid body in its private cache after logout, revalidated
	// before any use. Off by default (ADR 0062 gate): every UI route keeps
	// no-store.
	ETagRevalidation bool `mapstructure:"etag_revalidation"`
}

type UserStore struct {
	// ServerURL and Token are the session `dexaflow auth login` wrote before
	// per-server sessions existed. They are read, and kept, as they are.
	ServerURL string `yaml:"server_url,omitempty"`
	Token     string `yaml:"token,omitempty"`
	// Registry is the user's default image registry prefix, the lowest-ranked
	// source a deploy reads one from.
	Registry string `yaml:"registry,omitempty"`
	// CurrentTarget is the target used outside a workspace (and inside one
	// that selects none).
	CurrentTarget string `yaml:"current_target,omitempty"`
	// Targets are the targets the user defined outside any workspace.
	Targets []UserTarget `yaml:"targets,omitempty"`
	// Sessions holds one saved token per control plane.
	Sessions []Session `yaml:"sessions,omitempty"`
	// WorkspaceTargets records `dexaflow target use` inside a workspace: the
	// user's own choice, which leaves the shared workspace file untouched.
	WorkspaceTargets []WorkspaceTarget `yaml:"workspace_targets,omitempty"`
	// TrustedWorkspaces lists workspace roots whose workspace file is used
	// even though another user owns it ("*" trusts every one). The CLI only
	// reads it; the user writes it.
	TrustedWorkspaces []string `yaml:"trusted_workspaces,omitempty"`
}

type UserTarget struct {
	Name      string   `yaml:"name"`
	Server    string   `yaml:"server"`
	Registry  string   `yaml:"registry,omitempty"`
	Platforms []string `yaml:"platforms,omitempty"`
	BaseImage string   `yaml:"base_image,omitempty"`
	// SourceModeImage is the runtime image deploys to this target register
	// dag.py on, with no build (source mode, #1772).
	SourceModeImage string `yaml:"source_mode_image,omitempty"`
}

type WorkspaceTarget struct {
	Workspace string `yaml:"workspace"`
	Target    string `yaml:"target"`
}