config

type Config struct {
	CleanupInterval               time.Duration      `mapstructure:"cleanupInterval"`
	DefaultNamespace              string             `mapstructure:"defaultNamespace"`
	HostType                      armotypes.HostType `mapstructure:"hostType"`
	DisableVirtualCRDs            bool               `mapstructure:"disableVirtualCRDs"`
	DisableSeccompProfileEndpoint bool               `mapstructure:"disableSeccompProfileEndpoint"`
	ExcludeJsonPaths              []string           `mapstructure:"excludeJsonPaths"`
	MaxContainerProfileSize       int                `mapstructure:"maxContainerProfileSize"`
	MaxSniffingTime               time.Duration      `mapstructure:"maxSniffingTimePerContainer"`
	RateLimitPerClient            float64            `mapstructure:"rateLimitPerClient"`
	RateLimitTotal                int                `mapstructure:"rateLimitTotal"`
	ServerBindAddress             string             `mapstructure:"serverBindAddress"`
	ServerBindPort                int                `mapstructure:"serverBindPort"`
	TlsClientCaFile               string             `mapstructure:"tlsClientCaFile"`
	TlsServerCertFile             string             `mapstructure:"tlsServerCertFile"`
	TlsServerKeyFile              string             `mapstructure:"tlsServerKeyFile"`

	// SqlitePoolSize is the capacity of the SQLite connection pool. Defaults
	// to file.DefaultPoolSize (10) when unset. This is a cheap, reversible
	// tuning knob for Phase 0 of the storage-locking investigation (see
	// docs/features/storage-lock-pool-metrics.md) — it does not change any
	// lock/connection acquisition ordering.
	SqlitePoolSize int `mapstructure:"sqlitePoolSize"`
	// SqliteBusyTimeout is the busy-timeout applied to every pooled SQLite
	// connection. Defaults to file.DefaultBusyTimeout (60s) when unset.
	SqliteBusyTimeout time.Duration `mapstructure:"sqliteBusyTimeout"`
	// PoolTimeout bounds how long a caller blocks in pool.Take() waiting for a free
	// connection from the SQLite connection pool, before failing fast with a
	// ServerTimeout+Retry-After signal. Defaults to file.DefaultPoolTimeout (15s) when
	// unset. This is distinct from SqliteBusyTimeout, which governs SQLite's own
	// internal busy-handler on a single already-acquired connection. See
	// docs/features/storage-lock-pool-metrics.md.
	PoolTimeout time.Duration `mapstructure:"poolTimeout"`

	// SingleWriterEnabled gates the single-dedicated-writer + priority-queue
	// write path (see pkg/registry/file/singlewriter.go). Defaults to true.
	// When enabled, that path always shards its commit goroutines by key hash
	// (file.DefaultSingleWriterShards, currently 8) so commits for different
	// keys run in parallel while commits for the same key stay serialized —
	// this isn't independently configurable; it's part of what
	// SingleWriterEnabled turns on.
	SingleWriterEnabled bool `mapstructure:"singleWriterEnabled"`

	// CustomKnownServersRestEnabled gates the hand-written rest.Storage
	// implementation for the knownservers resource (see
	// pkg/registry/softwarecomposition/knownservers/custom_rest.go), built as
	// Phase 4's first per-resource migration off genericregistry.Store (see
	// docs/features/generic-rest-storage-phase4.md). Defaults to false: when
	// unset, pkg/apiserver/apiserver.go registers knownservers via the OLD
	// genericregistry.Store-based knownservers.NewREST, exactly as before
	// this flag existed, even though live validation on armo-dev-stage
	// (2026-08-31) found zero regressions across all 11 Phase 4 resources --
	// that validation covers one cluster, not every deployment of this
	// binary, so the code-level default stays conservative. The old
	// implementation is kept alive as the reference implementation for
	// differential testing regardless of this flag's value. See
	// CustomRestEnabledEnvVar for a single env var that opts a deployment
	// into all 11 flags at once (e.g. for a design-partner test environment)
	// without changing this default for everyone else.
	CustomKnownServersRestEnabled bool `mapstructure:"customKnownServersRestEnabled"`

	// CustomOpenVulnerabilityExchangeRestEnabled gates the hand-written
	// rest.Storage implementation for the openvulnerabilityexchangecontainers
	// resource (see
	// pkg/registry/softwarecomposition/openvulnerabilityexchange/custom_rest.go),
	// built as Phase 4's second per-resource migration off
	// genericregistry.Store (see docs/features/generic-rest-storage-phase4.md).
	// Defaults to false, for the same reason as CustomKnownServersRestEnabled
	// above: when unset, pkg/apiserver/apiserver.go registers
	// openvulnerabilityexchangecontainers via the OLD genericregistry.Store-based
	// openvulnerabilityexchange.NewREST. The old implementation is kept alive
	// as the reference implementation for differential testing regardless of
	// this flag's value.
	CustomOpenVulnerabilityExchangeRestEnabled bool `mapstructure:"customOpenVulnerabilityExchangeRestEnabled"`

	// CustomContainerProfileRestEnabled gates the hand-written rest.Storage
	// implementation for the containerprofiles resource (see
	// pkg/registry/softwarecomposition/containerprofile/custom_rest.go),
	// built as Phase 4's third per-resource migration off
	// genericregistry.Store (see docs/features/generic-rest-storage-phase4.md).
	// Defaults to false, for the same reason as CustomKnownServersRestEnabled
	// above: when unset, pkg/apiserver/apiserver.go registers containerprofiles
	// via the OLD genericregistry.Store-based containerprofile.NewREST. The old
	// implementation is kept alive as the reference implementation for
	// differential testing regardless of this flag's value.
	CustomContainerProfileRestEnabled bool `mapstructure:"customContainerProfileRestEnabled"`

	// ContainerProfileSqliteBackend selects the SQLite-native, fully-ACID
	// ContainerProfile backend (pkg/registry/file/sqliteobject_*.go: metadata
	// row + payload BLOB + time_series row in one transaction, one write gate,
	// background PASSIVE checkpointer) for the containerprofiles resource in
	// place of the legacy row+gob-file StorageImpl. Defaults to false. When
	// on, main.go reconciles the existing rows and gob files into the new
	// schema at every start before serving (file.MigrateContainerProfiles;
	// legacy files are left in place for rollback), and the legacy
	// StorageImpl refuses every full-object operation on a containerprofile
	// key (the kind-ownership guard). See
	// .omc/plans/full-acid-storage-architecture.md and
	// docs/features/containerprofile-sqlite-backend.md.
	ContainerProfileSqliteBackend bool `mapstructure:"containerProfileSqliteBackend"`

	// ContainerProfileMigrationDryRun runs the ContainerProfile data
	// migration's reconcile at startup in count-only mode — nothing is
	// written — and logs what a real run would do (§8.3: required before the
	// backend flag is turned on anywhere). Refused together with
	// ContainerProfileSqliteBackend: the backend cannot serve unmigrated
	// rows. Defaults to false.
	ContainerProfileMigrationDryRun bool `mapstructure:"containerProfileMigrationDryRun"`

	// The following gate the remaining Phase 4 per-resource rest.Storage
	// migrations off genericregistry.Store (see
	// docs/features/generic-rest-storage-phase4.md), following the same pattern as
	// CustomContainerProfileRestEnabled above: each defaults to false, and
	// the OLD genericregistry.Store-based NewREST for that resource remains
	// the default and the differential-testing reference regardless of the
	// flag's value.
	//
	// All 11 of these flags can also be set at once via the CUSTOM_REST_ENABLED
	// env var (see CustomRestEnabledEnvVar/LoadConfig), which -- when set --
	// overrides every flag below regardless of what config.json says. This is
	// the intended way to opt a specific deployment (e.g. a design-partner
	// test environment) into the new REST path without changing the
	// conservative code-level default for every other deployment of this
	// binary.
	CustomCollapseConfigurationRestEnabled            bool `mapstructure:"customCollapseConfigurationRestEnabled"`
	CustomSBOMSyftFilteredRestEnabled                 bool `mapstructure:"customSBOMSyftFilteredRestEnabled"`
	CustomSBOMSyftRestEnabled                         bool `mapstructure:"customSBOMSyftRestEnabled"`
	CustomSeccompProfileRestEnabled                   bool `mapstructure:"customSeccompProfileRestEnabled"`
	CustomVulnerabilityManifestRestEnabled            bool `mapstructure:"customVulnerabilityManifestRestEnabled"`
	CustomVulnerabilityManifestSummaryRestEnabled     bool `mapstructure:"customVulnerabilityManifestSummaryRestEnabled"`
	CustomWorkloadConfigurationScanRestEnabled        bool `mapstructure:"customWorkloadConfigurationScanRestEnabled"`
	CustomWorkloadConfigurationScanSummaryRestEnabled bool `mapstructure:"customWorkloadConfigurationScanSummaryRestEnabled"`

	// New fields for per-kind queue/worker/object size config
	KindQueues           map[string]KindQueueConfig `mapstructure:"kindQueues"`
	DefaultQueueLength   int                        `mapstructure:"defaultQueueLength"`
	DefaultWorkerCount   int                        `mapstructure:"defaultWorkerCount"`
	DefaultMaxObjectSize int                        `mapstructure:"defaultMaxObjectSize"`

	// Debugging
	QueueManagerEnabled       bool `mapstructure:"queueManagerEnabled"`
	QueueTimeoutPrint         bool `mapstructure:"queueTimeoutPrint"`
	QueueTimeout              int  `mapstructure:"queueTimeout"`
	QueueProcessingStatsPrint bool `mapstructure:"queueProcessingStatsPrint"`
}

type KindQueueConfig struct {
	QueueLength   int `mapstructure:"queueLength"`
	WorkerCount   int `mapstructure:"workerCount"`
	MaxObjectSize int `mapstructure:"maxObjectSize"`
}