config

type CacheConfig struct {
	// Dir is the directory the cache opens its store under.
	Dir string
}

type CryptoConfig struct {
	EncryptionKey string
}

type DBConfig struct {
	// DSN is the Postgres connection string. LoadDB reads it verbatim, with
	// no environment-specific default: a caller that wants a development
	// convenience DSN applies its own fallback before calling Validate.
	DSN string
	// MaxConns caps the connection pool. Zero means "let the pool decide".
	MaxConns int32
	// ConnTimeout bounds the initial connectivity check at startup.
	ConnTimeout time.Duration
	// Provider selects the database backend (default DBProviderPostgres).
	// The Postgres path is byte-for-byte identical to before this field
	// existed.
	Provider DBProvider
	// PoolMode declares the Supabase pooler endpoint the DSN targets;
	// consulted only when Provider is DBProviderSupabase (default
	// DBPoolModeSession).
	PoolMode DBPoolMode
	// SSLRootCert is an optional path to a CA bundle. When set, the
	// connection upgrades to sslmode=verify-full and verifies the server
	// certificate against this CA.
	SSLRootCert string
	// MigrateDSN is an optional override (MIGRATE_DATABASE_URL) for the
	// connection a migration tool uses; empty means "use DSN". This lets an
	// operator point migrations at a Supabase direct/session connection
	// (port 5432) so DDL and version bookkeeping run on a session
	// connection while the app server uses the transaction pooler (port
	// 6543).
	MigrateDSN string
}

type DBPoolMode string

type DBProvider string

type EmailConfig struct {
	// Enabled turns the email channel on.
	Enabled bool
	// FromAddress is the verified sending address messages are sent from.
	// Required when Enabled.
	FromAddress string
	// Region is passed to every email API request. Required when Enabled.
	Region string
	// AccessKeyID / SecretAccessKey are optional static credentials. When
	// BOTH are blank, the AWS SDK's default credential chain supplies
	// credentials instead — mirrors SMSConfig's identical field pair.
	AccessKeyID     string
	SecretAccessKey string
}

type HSTSConfig struct {
	// Enabled turns the Strict-Transport-Security header on.
	Enabled bool
	// MaxAge is the max-age directive (emitted as whole seconds). It is
	// only meaningful when MaxAgeSet is true; see EffectiveMaxAge.
	MaxAge time.Duration
	// MaxAgeSet records whether HSTS_MAX_AGE was explicitly provided. It
	// lets an explicit max-age=0 (which clears a previously-sent HSTS
	// policy in browsers) be distinguished from "unset" (apply
	// DefaultHSTSMaxAge). A negative explicit value is invalid.
	MaxAgeSet bool
	// IncludeSubdomains adds the includeSubDomains directive.
	IncludeSubdomains bool
	// Preload adds the preload directive (requires includeSubDomains +
	// max-age >= 1y).
	Preload bool
}

type S3Config struct {
	// Endpoint is the S3-compatible API's base URL. Blank targets real AWS
	// S3 (the SDK's regional default endpoint); a custom endpoint (MinIO,
	// Garage, Cloudflare R2, ...) is a first-class target, not an
	// afterthought.
	Endpoint string
	// Region is passed to every S3 request. AWS S3 requires a real region;
	// most S3-compatible servers (MinIO, Garage) accept any non-empty value
	// since they do not partition by region.
	Region string
	// Bucket is the bucket objects are stored under.
	Bucket string
	// AccessKeyID / SecretAccessKey are optional static credentials. When
	// BOTH are blank, the AWS SDK's default credential chain (environment,
	// shared config/credentials file, EC2/ECS instance role, etc.) supplies
	// credentials instead, so a deployment that already provisions
	// credentials another way (e.g. an IAM role) never needs to duplicate
	// them here. Validate enforces both-or-neither, mirroring TLSConfig's
	// CertFile/KeyFile pairing.
	AccessKeyID     string
	SecretAccessKey string
	// UsePathStyle forces path-style bucket addressing
	// (https://endpoint/bucket/key instead of https://bucket.endpoint/key).
	// MinIO and most self-hosted S3-compatible servers require this; real
	// AWS S3 does not.
	UsePathStyle bool
	// PresignTTL is how long a presigned GET URL stays valid when the
	// caller passes a non-positive ttl of its own — the applied default.
	// Kept short: a presigned URL is a bearer credential for as long as it
	// is valid, so the default favors a tight window over convenience.
	PresignTTL time.Duration
}

type SMSConfig struct {
	// Enabled turns the SMS channel on.
	Enabled bool
	// OriginationIdentity is the verified sending number (or its ARN, or a
	// pool id/ARN) messages are sent from. Required when Enabled.
	OriginationIdentity string
	// Region is passed to every SMS API request. Required when Enabled.
	Region string
	// AccessKeyID / SecretAccessKey are optional static credentials. When
	// BOTH are blank, the AWS SDK's default credential chain supplies
	// credentials instead — mirrors S3Config's identical field pair.
	AccessKeyID     string
	SecretAccessKey string
	// RetryMaxAttempts caps the AWS SDK's own built-in retryer.
	RetryMaxAttempts int
}

type SchemaConfig struct {
	// Identity is the shared schema nestcore's identity package owns:
	// household, member, credentials, and sessions.
	Identity string
	// Nestova is Nestova's own schema for its non-identity tables.
	Nestova string
	// Nestorage is Nestorage's own schema for its non-identity tables.
	Nestorage string
}

type ServerConfig struct {
	// Addr is the TCP address the HTTP server listens on, e.g. ":8080".
	Addr string
	// TrustedProxies is the raw, comma-separated CIDR list (from
	// TRUSTED_PROXIES) of reverse-proxy source networks whose
	// X-Forwarded-* headers are trusted. It is validated at Validate; call
	// TrustedProxyPrefixes for the parsed form. Forwarded headers should be
	// honored only when the immediate peer falls inside one of these
	// networks, so an external client cannot spoof a secure context. An
	// empty value trusts no proxy.
	TrustedProxies string
	// RequestTimeout bounds how long the server allows a single request to
	// take end to end — both the connection-level ReadTimeout/WriteTimeout
	// and (minus a small margin) the per-request context deadline applied
	// to every handler.
	RequestTimeout time.Duration
	// PublicBaseURL is the externally-reachable origin (scheme + host, no
	// trailing slash, e.g. "https://app.tailxxxx.ts.net") a caller builds
	// absolute links against. Empty (the default) means "derive it from the
	// incoming request" instead.
	//
	// A caller that pins a fixed Relying Party ID for WebAuthn, or anything
	// else that cannot tolerate a per-request derived origin, additionally
	// REQUIRES this to be set: changing PublicBaseURL's host after such an
	// identity has been registered against it breaks every credential
	// registered under the old value, since the value is baked in at
	// registration time, not re-derived per request.
	PublicBaseURL string
}

type SessionConfig struct {
	// Secret is a high-entropy key reserved for cryptographic signing; it
	// must be at least minSecretLen bytes.
	Secret string
	// Secure marks the session cookie Secure (HTTPS-only). It is resolved
	// from SESSION_COOKIE_SECURE: auto (the default) keeps Secure only when
	// the deployment environment is EnvProd, while true/false force it —
	// letting a TLS-terminated deployment emit Secure cookies regardless of
	// environment.
	Secure bool
	// Lifetime is the maximum session duration.
	Lifetime time.Duration
}

type TLSConfig struct {
	// CertFile is the path to the PEM server certificate (chain).
	CertFile string
	// KeyFile is the path to the PEM private key for CertFile.
	KeyFile string
}