repo

type Built struct {
	Repository service.Repository
	DB         service.DB

	// ProjectStore is the control-plane registry store. It is non-nil
	// ONLY for the postgres driver — projects are a control-plane concern
	// and memory has no control plane. The composition root uses it
	// to seed the default project on boot. It shares Repository's pool, so
	// closing the repository releases it too; do not close it separately.
	ProjectStore *pgrepo.ProjectStore

	// AutoFormStore auto-forms a company tenant from a new user's email
	// domain at signup. Non-nil ONLY for the postgres driver; shares
	// Repository's pool.
	AutoFormStore *pgrepo.AutoFormStore

	// DomainStore, TenantStore, MembershipStore and LoginPolicyStore are the
	// per-project governance stores. They back the tenant domain-verification
	// RPCs (DomainStore/TenantStore/MembershipStore) and the login path's
	// LoginPolicy enforcement (TenantStore/DomainStore/LoginPolicyStore).
	// Non-nil ONLY for the postgres driver (the only one with a governance
	// plane); each shares Repository's pool.
	DomainStore      *pgrepo.DomainStore
	TenantStore      *pgrepo.TenantStore
	MembershipStore  *pgrepo.MembershipStore
	LoginPolicyStore *pgrepo.LoginPolicyStore

	// InvitationStore backs the tenant-invitation RPCs. Non-nil ONLY for the
	// postgres driver; shares Repository's pool.
	InvitationStore *pgrepo.InvitationStore

	// PlatformAdminStore backs the zero-config first-admin bootstrap
	// (CreateFirstPlatformAdmin). Non-nil ONLY for the postgres driver (the
	// only one with a platform_admins table); shares Repository's pool.
	PlatformAdminStore *pgrepo.PlatformAdminStore
}

type Config struct {
	// Driver is the chosen backend. Required.
	Driver Driver

	// ProjectID is the storage shard the boot-default Repository/DB binds
	// to (ADR-0002): the Project is identity's isolation shard, so the
	// data-plane partition is the project id. Per-request scopes are derived
	// from it via WithProject. Required for postgres.
	ProjectID string

	// Postgres-specific.
	PostgresDSN      string
	PostgresMaxConns int
	// PostgresConnTimeoutMs is the per-acquire pgx pool connection timeout in
	// milliseconds; Build converts it to a time.Duration for pgrepo.Config.
	// Zero leaves pgrepo's own DefaultConnTimeout in effect.
	PostgresConnTimeoutMs int
	PostgresAutoMigrate   bool

	// SQLite-specific. SQLitePath is the database file path or ":memory:".
	SQLitePath     string
	SQLiteMaxConns int

	// RequireVerifiedAuthDomain restricts a project's primary auth-domain
	// (the host that drives branded link URLs) to DNS-verified hostnames
	// when true (the safe default). When false, a deployer opts into letting
	// an unverified is_primary host drive branded links. Threaded into the
	// postgres ProjectStore resolver.
	RequireVerifiedAuthDomain bool
}

type Driver string