config

type Config struct {
	// ListenAddr is the HTTP listen address for the standalone server
	// (ignored under Lambda). Default ":8080".
	ListenAddr string
	// BlobDir, when set, selects a local-directory grain store rooted there.
	// Ignored when S3Bucket is set.
	BlobDir string
	// S3Bucket, when set, selects an S3-compatible grain store (takes
	// precedence over BlobDir). Credentials and region come from the standard
	// AWS environment; AWSEndpoint overrides the endpoint for MinIO/local.
	S3Bucket string
	// DynamoTable, when set, selects a DynamoDB document store for the KV
	// surface (audit trail, queue, drafts, copycat, ...). Empty keeps the
	// in-memory store -- the local/demo default, which resets on restart.
	DynamoTable string
	// AWSEndpoint overrides the AWS service endpoint for every AWS client, for
	// a single compatible endpoint such as LocalStack. Empty uses the real AWS
	// endpoints resolved from the region.
	AWSEndpoint string
	// S3Endpoint and DynamoEndpoint override AWSEndpoint for one service each.
	// The off-AWS deployment is two unrelated servers -- MinIO for blobs,
	// ScyllaDB Alternator or DynamoDB Local for documents -- so one endpoint
	// for both stores cannot address it. Empty falls
	// back to AWSEndpoint.
	S3Endpoint     string
	DynamoEndpoint string
	// ShutdownDelay, when positive, holds the server open after SIGTERM with
	// readiness already failing, so an orchestrator has time to take this
	// replica out of its load balancer before connections start being refused
	//. Zero (the default) drains immediately, which is what a
	// single-process or local run wants. In Kubernetes set it to comfortably
	// more than one readiness period, e.g. 5s.
	ShutdownDelay time.Duration
	// ReadOnly puts the instance in demo mode: the blob store is wrapped
	// read-only and editorial/config writes are rejected, so a public
	// playground can be explored without persisting. Auth, reads, search, and
	// dry-run previews still work.
	ReadOnly bool
	// Sandbox is read-only plus a client hint: the editor shows Save and
	// renders edits as if committed (from the dry-run's materialized doc),
	// wiped on refresh. It implies ReadOnly (nothing ever persists).
	Sandbox bool

	// LocalAuth enables built-in user management.
	LocalAuth bool
	// LocalIssuer is the built-in issuer string (must differ from any OIDC
	// issuer). Default "lcatd-local".
	LocalIssuer string
	// LocalSigningKey is the base64 (raw url or std) Ed25519 seed or private
	// key for access tokens. Empty = ephemeral key per boot (dev only:
	// restarts invalidate sessions).
	LocalSigningKey string
	// BootstrapAdmin is an "email:password" spec ensuring a first admin
	// exists at boot.
	BootstrapAdmin string

	// OIDCIssuer enables external-SSO verification when set.
	OIDCIssuer string
	// OIDCAudience, when set, must appear in tokens' aud.
	OIDCAudience string
	// OIDCRoleClaim is the role-bearing claim. Default "role".
	OIDCRoleClaim string
	// OIDCRoleMap maps issuer role names to backend roles
	// ("subject_moderator=moderator,staff=librarian").
	OIDCRoleMap map[string]string
	// OIDCClientID and OIDCClientSecret configure the PKCE token-exchange
	// proxy; an empty secret leaves the proxy returning 503.
	OIDCClientID     string
	OIDCClientSecret string

	// VocabSchemes lists the controlled vocabularies to load from the blob
	// store's authorities tree (comma-separated; empty = all found).
	VocabSchemes []string
	// ExtraFacets lists the lcat:extra/* keys the admin works view facets
	// on (LCATD_EXTRA_FACETS, comma-separated). Defaults to "sources" --
	// the provenance dimension; set it empty to disable.
	ExtraFacets []string
	// VocabUploadCapMB bounds hand-uploaded vocabulary dumps (0 = the 512MB
	// default). Synchronous in-memory installs need some ceiling; size it
	// to the deployment's RAM.
	VocabUploadCapMB int
	// VocabSnapshotCapMB bounds a downloaded snapshot dump's decompressed
	// size (0 = the 4GB default) -- the defensive ceiling against a hostile
	// or misconfigured snapshot endpoint.
	VocabSnapshotCapMB int
	// AuthoritiesPrefix is the blob path prefix holding authority grains.
	// Default "data/authorities/".
	AuthoritiesPrefix string

	// AbuseSecret (>=16 bytes) keys IP pseudonymization and challenge
	// tokens; setting it enables the anonymous suggestion endpoints.
	AbuseSecret string

	// WebhookURL, when set, receives HMAC-signed grains-changed events after
	// each publish (WebhookSecret signs them).
	WebhookURL    string
	WebhookSecret string
	// RebuildCmd, when set, runs after each publish (sh -c; changed paths in
	// $LCAT_CHANGED_PATHS) -- the local dev loop: reserialize/reproject into
	// a running hugo server's data dir for instant preview. RebuildDir is
	// its working directory.
	RebuildCmd string
	RebuildDir string
	// TriggerSQSURL / TriggerEventBus dispatch grains-changed events to AWS
	// messaging -- the async job seam: a queue worker (ECS
	// RunTask, Step Functions) runs the incremental rebuild instead of a
	// synchronous local command.
	TriggerSQSURL   string
	TriggerEventBus string
	// RebuildDebounce, when positive, coalesces a burst of publishes into one
	// trigger event delivered after that quiet period.
	RebuildDebounce time.Duration

	// BrandCSS, when set, is the path of a CSS file that re-brands the SPA
	// at boot without a rebuild: the server reads it once,
	// serves it at /brand.css, and links it from index.html after app.css,
	// so its rules (typically :root / html[data-theme="dark"] token
	// overrides) win the cascade. An unreadable file fails the boot.
	BrandCSS string

	// Provider names the primary feed graph (CSV export projection).
	// Default "overdrive".
	Provider string

	// DisableTickers skips the container-shaped background workers (the
	// 15s vocab-download and export-job drains). Set programmatically by
	// serverless entrypoints, which drain on scheduled invocations instead
	// -- a frozen Lambda never advances a ticker goroutine.
	DisableTickers bool

	// OrgCode is the deployment's MARC organization code. When set, MARC
	// surfaces (the MARC view, exports) derive each record's 040 cataloging
	// source from graph facts at decode time: locally edited
	// records gain this code as a modifying-agency $d, born-digital records
	// synthesize 040 $a/$c. Empty disables the derivation.
	OrgCode string

	// EnrichLocsh enables the id.loc.gov LCSH reconciliation source when set
	// to "queue" (moderated) or "direct" (auto-approve).
	EnrichLocsh string

	// EnrichOpenLibrary enables the OpenLibrary external-identity source
	// when set to "queue" or "direct". It needs
	// EnrichOpenLibraryDump; without it the source stays off.
	EnrichOpenLibrary string
	// EnrichOpenLibraryDump is the path to an OpenLibrary editions dump the
	// source builds its ISBN -> work index from at boot (offline, no live API).
	EnrichOpenLibraryDump string

	// EnrichWikidata enables the creator-demographics source (resolve
	// creators via cataloged ISBNs against the Wikidata Query Service and
	// cache their explicitly-stated claims). Opt-in and direct-only:
	// creator claims are entity statements, not subject candidates, so
	// there is nothing for the moderation queue to moderate. Set "direct"
	// to enable.
	EnrichWikidata string
}