config

type Config struct {
	AppName string
	Stage   string

	StateTableName string

	// PublicBaseURL is the externally reachable origin (scheme + host) for this deployment,
	// used when generating absolute URLs in API responses. If empty, handlers should prefer
	// relative URLs or derive a best-effort base from request headers.
	PublicBaseURL string

	// ENS gateway (CCIP-Read) configuration.
	ENSGatewayResolverAddress     string
	ENSGatewaySigningKeyID        string
	ENSGatewaySigningPrivateKey   string
	ENSGatewaySignatureTTLSeconds int64

	ArtifactBucketName string
	PreviewQueueURL    string
	SafetyQueueURL     string
	ProvisionQueueURL  string
	CommQueueURL       string

	BootstrapWalletAddress string

	AttestationSigningKeyID string
	AttestationPublicKeyIDs []string

	WebAuthnRPID    string
	WebAuthnOrigins []string

	// Tip registry (EVM).
	TipEnabled                  bool
	TipChainID                  int64
	TipRPCURL                   string
	TipRPCURLSSMParam           string
	TipContractAddress          string
	TipAdminSafeAddress         string
	TipDefaultHostWalletAddress string
	TipDefaultHostFeeBps        uint16
	TipTxMode                   string // safe|direct

	// Soul registry (EVM).
	SoulEnabled                              bool
	SoulChainID                              int64
	SoulRPCURL                               string
	SoulRPCURLSSMParam                       string
	SoulRegistryContractAddress              string
	SoulReputationAttestationContractAddress string
	SoulValidationAttestationContractAddress string
	SoulAdminSafeAddress                     string
	SoulTxMode                               string // safe|direct
	SoulSupportedCapabilities                []string
	SoulPackBucketName                       string
	SoulPackBucketNameSSMParam               string // optional override; default is /soul/<stage>/packBucketName
	SoulMintSignerKeySSMParam                string
	SoulMintSignerKey                        string
	SoulPublicCORSOrigins                    []string
	SoulV2StrictIntegrity                    bool // harden signature + artifact integrity checks

	// Soul reputation (v0).
	SoulReputationTipStartBlock       uint64
	SoulReputationTipBlockChunkSize   uint64
	SoulReputationTipScale            float64
	SoulReputationWeightEconomic      float64
	SoulReputationWeightSocial        float64
	SoulReputationWeightValidation    float64
	SoulReputationWeightTrust         float64
	SoulReputationWeightIntegrity     float64
	SoulReputationWeightCommunication float64

	// Soul validation (v0).
	SoulValidationDecayEpochHours int64
	SoulValidationDecayRate       float64

	// Managed hosting (M9 provisioning).
	ManagedProvisioningEnabled        bool
	ManagedOrgVendingRoleARN          string // optional; assume this role for Organizations + instance-account role assumptions
	ManagedParentDomain               string // e.g. greater.website
	ManagedParentHostedZoneID         string // Route53 hosted zone id for greater.website (central account)
	ManagedInstanceRoleName           string // role to assume into instance accounts
	ManagedTargetOrganizationalUnitID string // optional OU id for instance accounts
	ManagedAccountEmailTemplate       string // e.g. "lesser+{slug}@example.com"
	ManagedAccountNamePrefix          string // e.g. "lesser-"
	ManagedDefaultRegion              string // e.g. us-east-1
	ManagedLesserDefaultVersion       string // release tag or "latest", optional
	ManagedProvisionRunnerProjectName string // CodeBuild project name used to run lesser up
	ManagedLesserGitHubOwner          string // GitHub org/user for the lesser repo
	ManagedLesserGitHubRepo           string // GitHub repo name for lesser
	ManagedLesserGitHubTokenSSMParam  string // optional SSM param name for a GitHub token (CodeBuild)
	ManagedLesserBodyDefaultVersion   string // release tag or "latest", optional
	ManagedLesserBodyGitHubOwner      string // GitHub org/user for the lesser-body repo
	ManagedLesserBodyGitHubRepo       string // GitHub repo name for lesser-body

	// Payments (M10).
	PaymentsProvider            string // stripe|mock|none
	PaymentsCheckoutSuccessURL  string // redirect target after checkout completion
	PaymentsCheckoutCancelURL   string // redirect target after checkout cancel
	PaymentsCentsPer1000Credits int64  // pricing policy: cents per 1000 credits
}