config

type Config struct {
	// ListenAddr is the HTTP listen address for the standalone server
	// (ignored under Lambda). Default ":8080".
	ListenAddr string
	// BlobDir, when set, selects a local-directory grain store rooted there.
	// Ignored when S3Bucket is set.
	BlobDir string
	// S3Bucket, when set, selects an S3-compatible grain store (takes
	// precedence over BlobDir). Credentials and region come from the standard
	// AWS environment; AWSEndpoint overrides the endpoint for MinIO/local.
	S3Bucket string
	// DynamoTable, when set, selects a DynamoDB document store for the KV
	// surface (audit trail, queue, drafts, copycat, ...). Empty keeps the
	// in-memory store -- the local/demo default, which resets on restart.
	DynamoTable string
	// StoreDir, when set (and DynamoTable is not), selects the persistent
	// local document store: a journal-backed directory, so the moderation
	// queue, promotions, review decisions, audit trail, drafts, and job
	// records survive restarts without any AWS dependency.
	StoreDir string
	// AWSEndpoint overrides the AWS service endpoint for every AWS client, for
	// a single compatible endpoint such as LocalStack. Empty uses the real AWS
	// endpoints resolved from the region.
	AWSEndpoint string
	// S3Endpoint and DynamoEndpoint override AWSEndpoint for one service each.
	// The off-AWS deployment is two unrelated servers -- MinIO for blobs,
	// ScyllaDB Alternator or DynamoDB Local for documents -- so one endpoint
	// for both stores cannot address it. Empty falls
	// back to AWSEndpoint.
	S3Endpoint     string
	DynamoEndpoint string
	// ShutdownDelay, when positive, holds the server open after SIGTERM with
	// readiness already failing, so an orchestrator has time to take this
	// replica out of its load balancer before connections start being refused
	//. Zero (the default) drains immediately, which is what a
	// single-process or local run wants. In Kubernetes set it to comfortably
	// more than one readiness period, e.g. 5s.
	ShutdownDelay time.Duration
	// ReadOnly puts the instance in demo mode: the blob store is wrapped
	// read-only and editorial/config writes are rejected, so a public
	// playground can be explored without persisting. Auth, reads, search, and
	// dry-run previews still work.
	ReadOnly bool
	// Sandbox is read-only plus a client hint: the editor shows Save and
	// renders edits as if committed (from the dry-run's materialized doc),
	// wiped on refresh. It implies ReadOnly (nothing ever persists).
	Sandbox bool

	// LocalAuth enables built-in user management.
	LocalAuth bool
	// LocalIssuer is the built-in issuer string (must differ from any OIDC
	// issuer). Default "lcatd-local".
	LocalIssuer string
	// LocalSigningKey is the base64 (raw url or std) Ed25519 seed or private
	// key for access tokens. Empty = ephemeral key per boot (dev only:
	// restarts invalidate sessions).
	LocalSigningKey string
	// BootstrapAdmin is an "email:password" spec ensuring a first admin
	// exists at boot.
	BootstrapAdmin string

	// OIDCIssuer enables external-SSO verification when set.
	OIDCIssuer string
	// OIDCAudience, when set, must appear in tokens' aud.
	OIDCAudience string
	// OIDCRoleClaim is the role-bearing claim. Default "role".
	OIDCRoleClaim string
	// OIDCRoleMap maps issuer role names to backend roles
	// ("subject_moderator=moderator,staff=librarian").
	OIDCRoleMap map[string]string
	// OIDCClientID and OIDCClientSecret configure the PKCE token-exchange
	// proxy; an empty secret leaves the proxy returning 503.
	OIDCClientID     string
	OIDCClientSecret string

	// VocabSchemes lists the controlled vocabularies to load from the blob
	// store's authorities tree (comma-separated; empty = all found).
	VocabSchemes []string
	// ExtraFacets lists the lcat:extra/* keys the admin works view facets
	// on (LCATD_EXTRA_FACETS, comma-separated). Defaults to "sources" --
	// the provenance dimension; set it empty to disable.
	ExtraFacets []string
	// VocabUploadCapMB bounds hand-uploaded vocabulary dumps (0 = the 512MB
	// default). Synchronous in-memory installs need some ceiling; size it
	// to the deployment's RAM.
	VocabUploadCapMB int
	// VocabSnapshotCapMB bounds a downloaded snapshot dump's decompressed
	// size (0 = the 4GB default) -- the defensive ceiling against a hostile
	// or misconfigured snapshot endpoint.
	VocabSnapshotCapMB int
	// AuthoritiesPrefix is the blob path prefix holding authority grains.
	// Default "data/authorities/".
	AuthoritiesPrefix string

	// AbuseSecret (>=16 bytes) keys IP pseudonymization and challenge
	// tokens; setting it enables the anonymous suggestion endpoints.
	AbuseSecret string

	// WebhookURL, when set, receives HMAC-signed grains-changed events after
	// each publish (WebhookSecret signs them).
	WebhookURL    string
	WebhookSecret string
	// RebuildCmd, when set, runs after each publish (sh -c; changed paths in
	// $LCAT_CHANGED_PATHS) -- the local dev loop: reserialize/reproject into
	// a running hugo server's data dir for instant preview. RebuildDir is
	// its working directory.
	RebuildCmd string
	RebuildDir string
	// TriggerSQSURL / TriggerEventBus dispatch grains-changed events to AWS
	// messaging -- the async job seam: a queue worker (ECS
	// RunTask, Step Functions) runs the incremental rebuild instead of a
	// synchronous local command.
	TriggerSQSURL   string
	TriggerEventBus string
	// RebuildDebounce, when positive, coalesces a burst of publishes into one
	// trigger event delivered after that quiet period.
	RebuildDebounce time.Duration

	// BrandCSS, when set, is the path of a CSS file that re-brands the SPA
	// at boot without a rebuild: the server reads it once,
	// serves it at /brand.css, and links it from index.html after app.css,
	// so its rules (typically :root / html[data-theme="dark"] token
	// overrides) win the cascade. An unreadable file fails the boot.
	BrandCSS string

	// Provider names the primary feed graph (CSV export projection).
	// Default "overdrive".
	Provider string

	// DisableTickers skips the container-shaped background workers (the
	// 15s vocab-download and export-job drains). Set programmatically by
	// serverless entrypoints, which drain on scheduled invocations instead
	// -- a frozen Lambda never advances a ticker goroutine.
	DisableTickers bool

	// OrgCode is the deployment's MARC organization code. When set, MARC
	// surfaces (the MARC view, exports) derive each record's 040 cataloging
	// source from graph facts at decode time: locally edited
	// records gain this code as a modifying-agency $d, born-digital records
	// synthesize 040 $a/$c. Empty disables the derivation.
	OrgCode string

	// QueueMinConfidence is the review queue's default confidence floor
	// in [0,1]: PIPELINE suggestions below it stay stored but hidden from
	// the default view (a request may override with ?minConfidence=). 0
	// (the default) shows everything.
	QueueMinConfidence float64

	// SIP2Addr, when set (host:port), mounts the public SIP2 availability
	// bridge at POST /v1/availability/sip2: the OPAC's proxied transport for
	// live shelf status, with the ILS credentials held server-side.
	SIP2Addr string
	// SIP2User/SIP2Pass, when set, log the session in (SIP2 93/94).
	SIP2User string
	SIP2Pass string
	// SIP2Location is the login location code (CP); optional.
	SIP2Location string
	// SIP2Institution rides each item request as AO; optional.
	SIP2Institution string
	// SIP2ErrorDetection appends AY/AZ checksums to outbound messages, for
	// ACS servers that require them.
	SIP2ErrorDetection bool

	// EnrichLocsh enables the id.loc.gov LCSH reconciliation source when set
	// to "queue" (moderated) or "direct" (auto-approve).
	EnrichLocsh string

	// EnrichOpenLibrary enables the OpenLibrary external-identity source
	// when set to "queue" or "direct". It needs
	// EnrichOpenLibraryDump; without it the source stays off.
	EnrichOpenLibrary string
	// EnrichOpenLibraryDump is the path to an OpenLibrary editions dump the
	// source builds its ISBN -> work index from at boot (offline, no live API).
	EnrichOpenLibraryDump string

	// EnrichWikidataEndpoint overrides the SPARQL endpoint the wikidata
	// source queries (default: the public Wikidata Query Service). Point it
	// at a mirror (a QLever instance, a corporate proxy) for rate-limit or
	// availability reasons; the query dialect must stay WDQS-compatible.
	EnrichWikidataEndpoint string

	// EnrichWikidata enables the creator-demographics source (resolve
	// creators via cataloged ISBNs against the Wikidata Query Service and
	// cache their explicitly-stated claims). Opt-in and direct-only:
	// creator claims are entity statements, not subject candidates, so
	// there is nothing for the moderation queue to moderate. Set "direct"
	// to enable.
	EnrichWikidata string
	// EnrichBiblioCommons enables the peer-library subject harvest: one or
	// more BiblioCommons subdomains, comma-separated (e.g. "ccslib" or
	// "ccslib,seattle,sfpl"). The harvest drives subject searches from a
	// loaded vocabulary's terms and queues moderated suggestions on ISBN-
	// or title+author-matched works; several hosts turn the run into a
	// consensus vote. Queue-only: another library's cataloging is a
	// candidate, not an assertion. Jobs may override the list per run.
	EnrichBiblioCommons string
	// EnrichBiblioCommonsScheme picks the driver vocabulary (default
	// "homosaurus"); it must be loaded. EnrichBiblioCommonsMaxPages caps RSS
	// pages fetched per term (default 6 -- 600 items at 100/page).
	// EnrichBiblioCommonsConcurrency caps how many peer hosts crawl at once
	// (default 4; politeness stays per host) -- raise it for wide consensus
	// runs over many peers.
	EnrichBiblioCommonsScheme      string
	EnrichBiblioCommonsMaxPages    int
	EnrichBiblioCommonsConcurrency int
	// EnrichVega enables the III Vega Discover peer harvest: comma-separated
	// tenants as <siteCode>.<region> (e.g. "nypl.na2,mdpls.na" -- the
	// library's catalog subdomain and Vega region). Queue-only, like the
	// BiblioCommons harvest it parallels; the concept model states its
	// vocabulary explicitly (source=homoit), so a match is a peer's own
	// Homosaurus assertion.
	EnrichVega string
	// EnrichVegaScheme picks the driver vocabulary (default "homosaurus");
	// EnrichVegaMaxPages caps resources pages per concept (default 6).
	EnrichVegaScheme   string
	EnrichVegaMaxPages int
	// EnrichTLC enables the TLC LS2 PAC peer harvest: comma-separated hosts,
	// each either a bare subdomain of <tenant>.tlcdelivers.com (e.g. "nbpl")
	// or a full vanity catalog host (e.g. "ls2pac.lapl.org", which many TLC
	// libraries including LAPL serve the same API on). Queue-only; the
	// subject index is unscoped, so like the BiblioCommons harvest the match
	// is the exact Homosaurus prefLabel, ISBN-joined.
	EnrichTLC string
	// EnrichTLCScheme picks the driver vocabulary (default "homosaurus");
	// EnrichTLCMaxPages caps search pages per term (default 6 x 24 hits).
	EnrichTLCScheme   string
	EnrichTLCMaxPages int
	// EnrichSirsiDynix enables the SirsiDynix Enterprise peer harvest:
	// comma-separated <host>[/<profile>] entries. A host with no dot is a
	// bare Enterprise subdomain expanded to <host>.ent.sirsidynix.net (e.g.
	// "winca"); the profile defaults to "default". Queue-only; the subject
	// index is unscoped, so like the BiblioCommons harvest the match is the
	// exact Homosaurus prefLabel, ISBN-joined.
	EnrichSirsiDynix string
	// EnrichSirsiDynixScheme picks the driver vocabulary (default
	// "homosaurus").
	EnrichSirsiDynixScheme string
	// EnrichMaxParallel caps how many queued enrichment jobs a single drain
	// runs at once across distinct sources (0 = unlimited, one per queued
	// source). Same-source jobs stay serial regardless.
	EnrichMaxParallel int
	// EnrichLangs are the label languages the peer harvests drive their
	// searches from, comma-separated (default "en"). Set "en,es" to also
	// search each concept's Spanish label, reaching Spanish-cataloged peers
	// (the Chilean/LatAm SirsiDynix cluster, Miami-Dade Vega, ...); a match
	// still maps back to the concept's URI. A language with no label on a
	// given term is skipped for that term.
	EnrichLangs []string
}