config

type Archive struct {
	MaxEntries    int      // entries an archive may hold; both archive endpoints refuse larger ones
	MaxTotalBytes int64    // uncompressed bytes one extraction may write
	MaxRatio      int64    // per-entry uncompressed ÷ compressed; the zip-bomb guard
	Extensions    []string // allowlist, lower-case with the leading dot; empty allows every extension

	// MaxDirectoryBytes bounds the central directory's byte span, the only cap
	// that can be applied before archive/zip parses it. Zero does not disable
	// it — it derives the bound from MaxEntries, which is the right answer
	// almost always — because this is what bounds the allocation a crafted
	// directory provokes. Set it only for an archive with unusually long paths.
	MaxDirectoryBytes int64
}

type Config struct {
	HTTPAddr        string        // listen address, e.g. ":8080"
	ShutdownTimeout time.Duration // graceful shutdown grace period
	PresignTTL      time.Duration // lifetime of presigned download URLs
	MaxUploadBytes  int64         // reject uploads larger than this; 0 disables the cap

	Postgres Postgres
	Storage  Storage
	GC       GC
	Archive  Archive
	Jobs     Jobs
}

type GC struct {
	Interval       time.Duration
	GracePeriod    time.Duration
	IdempotencyTTL time.Duration
}

type Jobs struct {
	// Concurrency is how many jobs one replica runs at once. Default 1, on
	// purpose: extraction is IO-bound on the object store, the jobs table
	// already keeps two workers off one archive, and every in-flight run pins
	// a read window plus a multipart part of memory. Raise it with evidence.
	Concurrency int

	// HeartbeatTTL is how long a running job may go without a heartbeat
	// before its worker is presumed dead and the job is returned to the
	// queue. Two-sided, like the lease TTL it replaces: too long and a
	// crashed job blocks its archive for that long; too short and a healthy
	// run is stolen mid-flight. Zero is not "disabled" — it would reap every
	// job instantly — so it is refused.
	HeartbeatTTL time.Duration

	// Retention is how long a finished job stays readable through
	// GET /jobs/{id} before the GC sweep deletes it. Non-positive disables
	// the sweep, like CAIRNMARK_IDEMPOTENCY_TTL.
	Retention time.Duration
}

type Postgres struct {
	DSN string // pgx connection string / URL
}

type Storage struct {
	Endpoint       string // host:port for service-side I/O, no scheme
	PublicEndpoint string // host:port clients are redirected to; defaults to Endpoint
	Region         string
	AccessKey      string
	SecretKey      string
	Bucket         string
	UseSSL         bool // TLS for the service-side endpoint
	PublicUseSSL   bool // TLS scheme for presigned URLs; defaults to UseSSL
}