app

type App struct {
	// contains filtered or unexported fields
}

type CVEEvaluationPostureAdapter struct {
	Store update.UpdateStore
}

type CVEPostureAdapter struct {
	Store update.UpdateStore
}

type CertPostureAdapter struct {
	CertSvc *certificate.Service
}

type Config struct {
	// Server
	Addr    string
	BaseURL string

	// Database
	DBPath string
	// DatabaseURL is the operator-supplied PostgreSQL connection string.
	// Empty — the default and the only supported agent setup — means SQLite
	// on DBPath. It carries a password: never log or render it directly,
	// always through store.RedactDSN.
	DatabaseURL string
	Retention   RetentionConfig

	// License
	LicenseKey string

	// SMTP
	SMTP SMTPConfig

	// MCP
	MCP MCPConfig

	// HTTP
	CORSOrigins string
	MaxBodySize int64
	// TrustedProxies lists the CIDRs and addresses whose forwarded headers are
	// believed, comma-separated. Empty means no header is ever read.
	TrustedProxies string

	// CACertFile is a PEM bundle appended to the system roots, so endpoints and
	// certificates signed by an internal PKI validate without disabling checks.
	CACertFile string

	// Branding
	OrgName string

	// Status page
	StatusURL string // public URL of the status page (e.g. https://status.example.com)

	// Kubernetes
	K8sNamespaces string
	K8sExcludeNS  string

	// Security
	SecurityScoreThreshold int

	// ContainerDownAfter is how long a container must stay stopped before it
	// raises an alert. Zero disables the check.
	ContainerDownAfter time.Duration
	// ContainerDownAfterInvalid holds a rejected threshold verbatim, so a typo
	// stops startup instead of silently leaving the check off.
	ContainerDownAfterInvalid string

	// Telemetry
	DisableTelemetry bool

	DisableOSEOLRefresh bool

	ProxyLabels bool

	// Multi-host agent mode (Pro only)
	Mode      string // "embedded" | "server" | "agent"
	MultiHost MultiHostConfig

	// Dev
	AllowPrivateWebhooks bool

	// Runtime / logging (set via CLI flags; runtime override propagated to env)
	LogLevel string

	// Build info (injected via ldflags)
	Version      string
	Commit       string
	BuildDate    string
	PublicKeyB64 string
}

type FlagCategory struct {
	Name  string
	Specs []FlagSpec
}

type FlagSpec struct {
	EnvName     string
	FlagName    string
	Type        FlagType
	Default     string
	Description string
	Sensitive   bool
	// NoEnv marks an action flag that has no environment equivalent
	// (--copy-store-to, --yes): it drives what the process does, it is not
	// part of the configuration an operator writes in maintenant.env.
	NoEnv   bool
	ApplyTo func(*Config, string) error
}

type FlagType int

type InvalidSetting struct {
	Name string
	Raw  string
}

type MCPConfig struct {
	Enabled             bool
	ClientID            string
	ClientSecret        string
	AllowedRedirectURIs string
	// AllowUnauthenticated is the explicit opt-out for serving /mcp with no
	// OAuth at all; without it, MCP without credentials refuses to listen.
	AllowUnauthenticated bool
}

type MultiHostConfig struct {
	GRPCPublicURL              string
	GRPCListen                 string
	AgentRateLimitPerSecond    int
	AgentStaleThresholdSeconds int
	// TLS (for mode=server)
	TLSCertFile  string
	TLSKeyFile   string
	InsecureGRPC bool // h2c mode — use only behind a trusted reverse proxy
	// Agent flags (for mode=agent)
	ServerURL                string
	EnrollmentToken          string
	RuntimeOverride          string
	Label                    string
	NodeName                 string
	InsecureSkipVerify       bool
	EmbeddedAgent            bool
	AgentSpoolMaxMemoryBytes int64
	AgentSpoolMaxDiskBytes   int64
	AgentSpoolMaxAgeSeconds  int64
	InvalidSpoolSettings     []InvalidSetting
}

type RetentionConfig struct {
	// Snapshots is how long raw resource samples are kept. The 24h range is the
	// longest one reading them, so 24h is the floor; longer ranges are served
	// from the hourly rollup and are unaffected.
	Snapshots time.Duration
	Interval  time.Duration
	BatchSize int
}

type SMTPConfig struct {
	Host     string
	Port     string
	Username string
	Password string
	From     string
}

type UpdatePostureAdapter struct {
	Store update.UpdateStore
}