config

type APIBlock struct {
	Listen       string
	ListenQuoted bool
	Prefix       string
	PrefixQuoted bool

	TLS *TLSBlock

	// AuthTokens holds token references for Pull/Admin API auth.
	// For now, only Pull API tokens are used by the runtime.
	AuthTokens       []string
	AuthTokensQuoted []bool

	MaxBatch       string
	MaxBatchQuoted bool
	MaxBatchSet    bool

	GRPCListen       string
	GRPCListenQuoted bool
	GRPCListenSet    bool

	DefaultLeaseTTL       string
	DefaultLeaseTTLQuoted bool
	DefaultLeaseTTLSet    bool

	MaxLeaseTTL       string
	MaxLeaseTTLQuoted bool
	MaxLeaseTTLSet    bool

	DefaultMaxWait       string
	DefaultMaxWaitQuoted bool
	DefaultMaxWaitSet    bool

	MaxWait       string
	MaxWaitQuoted bool
	MaxWaitSet    bool
}

type APIConfig struct {
	Listen string
	Prefix string

	GRPCListen string

	TLS TLSConfig

	AuthTokens []string

	MaxBatch        int
	DefaultLeaseTTL time.Duration
	MaxLeaseTTL     time.Duration
	DefaultMaxWait  time.Duration
	MaxWait         time.Duration
}

type AccessLogBlock struct {
	Enabled       string
	EnabledQuoted bool
	EnabledSet    bool

	Output       string
	OutputQuoted bool
	OutputSet    bool

	Path       string
	PathQuoted bool
	PathSet    bool

	Format       string
	FormatQuoted bool
	FormatSet    bool
}

type AdaptiveBackpressureBlock struct {
	Enabled       string
	EnabledQuoted bool
	EnabledSet    bool

	MinTotal       string
	MinTotalQuoted bool
	MinTotalSet    bool

	QueuedPercent       string
	QueuedPercentQuoted bool
	QueuedPercentSet    bool

	ReadyLag       string
	ReadyLagQuoted bool
	ReadyLagSet    bool

	OldestQueuedAge       string
	OldestQueuedAgeQuoted bool
	OldestQueuedAgeSet    bool

	SustainedGrowth       string
	SustainedGrowthQuoted bool
	SustainedGrowthSet    bool
}

type AdaptiveBackpressureConfig struct {
	Enabled bool

	MinTotal      int
	QueuedPercent int

	ReadyLag        time.Duration
	OldestQueuedAge time.Duration

	SustainedGrowth bool
}

type BasicAuth struct {
	User       string
	UserQuoted bool
	Pass       string
	PassQuoted bool
}

type ChannelType string

type Compiled struct {
	Ingress            IngressConfig
	Defaults           DefaultsConfig
	Vars               map[string]string
	Secrets            map[string]SecretConfig
	PullAPI            APIConfig
	AdminAPI           APIConfig
	Observability      ObservabilityConfig
	QueueRetention     QueueRetentionConfig
	DeliveredRetention DeliveredRetentionConfig
	DLQRetention       DLQRetentionConfig
	QueueLimits        QueueLimitsConfig
	SharedListener     bool
	HasPullRoutes      bool
	HasDeliverRoutes   bool

	// Routes are in evaluation order (top-down).
	Routes []CompiledRoute

	// PathToRoute maps Pull paths (relative to PullAPI.Prefix) to route paths.
	PathToRoute map[string]string
}

type CompiledDeliver struct {
	URL         string
	Timeout     time.Duration
	Retry       RetryConfig
	SigningHMAC DeliverSigningHMACConfig
}

type CompiledRoute struct {
	ChannelType ChannelType
	Path        string
	Pull        *PullConfig

	Application    string
	EndpointName   string
	Publish        bool
	PublishDirect  bool
	PublishManaged bool

	Match MatchConfig

	RateLimit RateLimitConfig

	AuthBasic               map[string]string
	AuthForward             ForwardAuthConfig
	AuthHMACSecrets         []string
	AuthHMACSecretRefs      []string
	AuthHMACSignatureHeader string
	AuthHMACTimestampHeader string
	AuthHMACNonceHeader     string
	AuthHMACTolerance       time.Duration
	QueueBackend            string

	MaxBodyBytes   int64
	MaxHeaderBytes int

	DeliverConcurrency int
	Deliveries         []CompiledDeliver
}

type Config struct {
	// Preamble holds leading comment lines (including the leading '#').
	// It is preserved by `config fmt` to avoid losing file headers.
	Preamble []string

	Ingress *IngressBlock

	Defaults *DefaultsBlock
	Vars     *VarsBlock

	Secrets *SecretsBlock

	PullAPI            *APIBlock
	AdminAPI           *APIBlock
	Observability      *ObservabilityBlock
	QueueRetention     *QueueRetentionBlock
	DeliveredRetention *DeliveredRetentionBlock
	DLQRetention       *DLQRetentionBlock
	QueueLimits        *QueueLimitsBlock

	NamedMatchers []NamedMatcher

	// Routes are evaluated top-down (first match wins).
	Routes []Route
}

type DLQRetentionBlock struct {
	MaxAge         string
	MaxAgeQuoted   bool
	MaxAgeSet      bool
	MaxDepth       string
	MaxDepthQuoted bool
	MaxDepthSet    bool
}

type DLQRetentionConfig struct {
	MaxAge   time.Duration
	MaxDepth int
	Enabled  bool
}

type DefaultsBlock struct {
	MaxBody       string
	MaxBodyQuoted bool
	MaxBodySet    bool

	MaxHeaders       string
	MaxHeadersQuoted bool
	MaxHeadersSet    bool

	Egress        *EgressBlock
	PublishPolicy *PublishPolicyBlock

	Deliver      *DeliverBlock
	TrendSignals *TrendSignalsBlock

	AdaptiveBackpressure *AdaptiveBackpressureBlock
}

type DefaultsConfig struct {
	MaxBodyBytes   int64
	MaxHeaderBytes int

	DeliverRetry         RetryConfig
	DeliverTimeout       time.Duration
	DeliverConcurrency   int
	TrendSignals         TrendSignalsConfig
	AdaptiveBackpressure AdaptiveBackpressureConfig

	EgressPolicy  EgressPolicyConfig
	PublishPolicy PublishPolicyConfig
}

type Deliver struct {
	URL       string
	URLQuoted bool

	Retry   *RetryBlock
	Timeout string

	TimeoutQuoted bool
	TimeoutSet    bool

	SignHMACSecret       string
	SignHMACSecretQuoted bool
	SignHMACSecretSet    bool

	SignHMACSecretRefs       []string
	SignHMACSecretRefsQuoted []bool

	SignHMACSignatureHeader       string
	SignHMACSignatureHeaderQuoted bool
	SignHMACSignatureHeaderSet    bool

	SignHMACTimestampHeader       string
	SignHMACTimestampHeaderQuoted bool
	SignHMACTimestampHeaderSet    bool

	SignHMACSecretSelection       string
	SignHMACSecretSelectionQuoted bool
	SignHMACSecretSelectionSet    bool
}

type DeliverBlock struct {
	Retry   *RetryBlock
	Timeout string

	TimeoutQuoted bool
	TimeoutSet    bool

	Concurrency       string
	ConcurrencyQuoted bool
	ConcurrencySet    bool
}

type DeliverSigningHMACConfig struct {
	Enabled bool

	SecretRef      string
	SecretVersions []DeliverSigningSecretVersion

	SecretSelection string

	SignatureHeader string
	TimestampHeader string
}

type DeliverSigningSecretVersion struct {
	ID string

	ValueRef string

	ValidFrom  time.Time
	ValidUntil time.Time
	HasUntil   bool
}

type DeliveredRetentionBlock struct {
	MaxAge       string
	MaxAgeQuoted bool
	MaxAgeSet    bool
}

type DeliveredRetentionConfig struct {
	MaxAge  time.Duration
	Enabled bool
}

type DiffOp struct {
	Kind  byte // '=', '-', '+'
	Text  string
	OldNo int
	NewNo int
}

type EgressBlock struct {
	Allow       []string
	AllowQuoted []bool

	Deny       []string
	DenyQuoted []bool

	HTTPSOnly       string
	HTTPSOnlyQuoted bool
	HTTPSOnlySet    bool

	Redirects       string
	RedirectsQuoted bool
	RedirectsSet    bool

	DNSRebindProtection       string
	DNSRebindProtectionQuoted bool
	DNSRebindProtectionSet    bool
}

type EgressPolicyConfig struct {
	HTTPSOnly           bool
	Redirects           bool
	DNSRebindProtection bool

	Allow []EgressRule
	Deny  []EgressRule
}

type EgressRule struct {
	Host       string
	Subdomains bool
	CIDR       netip.Prefix
	IsCIDR     bool
}

type ForwardAuthBlock struct {
	URL       string
	URLQuoted bool
	BlockSet  bool

	Timeout       string
	TimeoutQuoted bool
	TimeoutSet    bool

	CopyHeaders       []string
	CopyHeadersQuoted []bool

	BodyLimit       string
	BodyLimitQuoted bool
	BodyLimitSet    bool
}

type ForwardAuthConfig struct {
	Enabled bool

	URL string

	Timeout time.Duration

	CopyHeaders []string

	BodyLimitBytes int64
}

type HeaderMatch struct {
	Name        string
	NameQuoted  bool
	Value       string
	ValueQuoted bool
}

type HeaderMatchConfig struct {
	Name  string
	Value string
}

type IngressBlock struct {
	Listen       string
	ListenQuoted bool
	TLS          *TLSBlock
	RateLimit    *RateLimitBlock
}

type IngressConfig struct {
	Listen string
	TLS    TLSConfig

	RateLimit RateLimitConfig
}

type MatchBlock struct {
	Methods       []string
	MethodsQuoted []bool

	Hosts       []string
	HostsQuoted []bool

	Headers []HeaderMatch
	Query   []QueryMatch

	RemoteIPs       []string
	RemoteIPsQuoted []bool

	HeaderExists       []string
	HeaderExistsQuoted []bool

	QueryExists       []string
	QueryExistsQuoted []bool
}

type MatchConfig struct {
	Methods []string
	Hosts   []string
	Headers []HeaderMatchConfig
	Query   []QueryMatchConfig

	RemoteIPs []netip.Prefix

	HeaderExists []string
	QueryExists  []string
}

type MetricsBlock struct {
	Enabled       string
	EnabledQuoted bool
	EnabledSet    bool

	Listen       string
	ListenQuoted bool
	ListenSet    bool
	Prefix       string
	PrefixQuoted bool
	PrefixSet    bool
	// contains filtered or unexported fields
}

type MetricsConfig struct {
	Enabled bool
	Listen  string
	Prefix  string
}

type NamedMatcher struct {
	Name  string
	Match *MatchBlock
}

type ObservabilityBlock struct {
	AccessLog       string
	AccessLogQuoted bool
	AccessLogSet    bool
	AccessLogBlock  *AccessLogBlock

	RuntimeLog       string
	RuntimeLogQuoted bool
	RuntimeLogSet    bool
	RuntimeLogBlock  *RuntimeLogBlock

	Metrics *MetricsBlock
	Tracing *TracingBlock
}

type ObservabilityConfig struct {
	AccessLogEnabled             bool
	AccessLogOutput              string
	AccessLogPath                string
	RuntimeLogLevel              string
	RuntimeLogDisabled           bool
	RuntimeLogOutput             string
	RuntimeLogPath               string
	RuntimeLogSet                bool
	Metrics                      MetricsConfig
	TracingEnabled               bool
	TracingCollector             string
	TracingURLPath               string
	TracingCompression           string
	TracingInsecure              bool
	TracingTimeout               time.Duration
	TracingTimeoutSet            bool
	TracingProxyURL              string
	TracingTLSCAFile             string
	TracingTLSCertFile           string
	TracingTLSKeyFile            string
	TracingTLSServerName         string
	TracingTLSInsecureSkipVerify bool
	TracingRetry                 *TracingRetryConfig
	TracingHeaders               []TracingHeaderConfig
}

type PublishBlock struct {
	Enabled       string
	EnabledQuoted bool
	EnabledSet    bool

	Direct       string
	DirectQuoted bool
	DirectSet    bool

	Managed       string
	ManagedQuoted bool
	ManagedSet    bool
	// contains filtered or unexported fields
}

type PublishPolicyBlock struct {
	Direct       string
	DirectQuoted bool
	DirectSet    bool

	Managed       string
	ManagedQuoted bool
	ManagedSet    bool

	AllowPullRoutes       string
	AllowPullRoutesQuoted bool
	AllowPullRoutesSet    bool

	AllowDeliverRoutes       string
	AllowDeliverRoutesQuoted bool
	AllowDeliverRoutesSet    bool

	RequireActor       string
	RequireActorQuoted bool
	RequireActorSet    bool

	RequireRequestID       string
	RequireRequestIDQuoted bool
	RequireRequestIDSet    bool

	FailClosed       string
	FailClosedQuoted bool
	FailClosedSet    bool

	ActorAllow       []string
	ActorAllowQuoted []bool

	ActorPrefix       []string
	ActorPrefixQuoted []bool
}

type PublishPolicyConfig struct {
	DirectEnabled      bool
	ManagedEnabled     bool
	AllowPullRoutes    bool
	AllowDeliverRoutes bool
	RequireActor       bool
	RequireRequestID   bool
	FailClosed         bool

	ActorAllowlist []string
	ActorPrefixes  []string
}

type Pull struct {
	Path       string
	PathQuoted bool

	AuthTokens       []string
	AuthTokensQuoted []bool
}

type PullConfig struct {
	Path       string
	AuthTokens []string
}

type QueryMatch struct {
	Name        string
	NameQuoted  bool
	Value       string
	ValueQuoted bool
}

type QueryMatchConfig struct {
	Name  string
	Value string
}

type QueueBlock struct {
	Backend       string
	BackendQuoted bool
	BackendSet    bool
	// contains filtered or unexported fields
}

type QueueLimitsBlock struct {
	MaxDepth         string
	MaxDepthQuoted   bool
	MaxDepthSet      bool
	DropPolicy       string
	DropPolicyQuoted bool
	DropPolicySet    bool
}

type QueueLimitsConfig struct {
	MaxDepth   int
	DropPolicy string
}

type QueueRetentionBlock struct {
	MaxAge              string
	MaxAgeQuoted        bool
	MaxAgeSet           bool
	PruneInterval       string
	PruneIntervalQuoted bool
	PruneIntervalSet    bool
}

type QueueRetentionConfig struct {
	MaxAge        time.Duration
	PruneInterval time.Duration
	Enabled       bool
}

type RateLimitBlock struct {
	RPS       string
	RPSQuoted bool
	RPSSet    bool

	Burst       string
	BurstQuoted bool
	BurstSet    bool
}

type RateLimitConfig struct {
	Enabled bool
	RPS     float64
	Burst   int
}

type RetryBlock struct {
	Type       string
	TypeQuoted bool

	Max       string
	MaxQuoted bool
	MaxSet    bool

	Base       string
	BaseQuoted bool
	BaseSet    bool

	Cap       string
	CapQuoted bool
	CapSet    bool

	Jitter       string
	JitterQuoted bool
	JitterSet    bool
}

type RetryConfig struct {
	Type   string
	Max    int
	Base   time.Duration
	Cap    time.Duration
	Jitter float64
}

type Route struct {
	ChannelType ChannelType

	Path       string
	PathQuoted bool

	Application       string
	ApplicationQuoted bool
	ApplicationSet    bool

	EndpointName       string
	EndpointNameQuoted bool
	EndpointNameSet    bool

	Match     *MatchBlock
	MatchRefs []string
	RateLimit *RateLimitBlock

	// Pull and deliver are mutually exclusive in the current MVP slice.
	Pull *Pull

	Queue *QueueBlock

	Deliveries []Deliver

	DeliverConcurrency       string
	DeliverConcurrencyQuoted bool
	DeliverConcurrencySet    bool

	MaxBody       string
	MaxBodyQuoted bool
	MaxBodySet    bool

	MaxHeaders       string
	MaxHeadersQuoted bool
	MaxHeadersSet    bool

	Publish *PublishBlock

	AuthBasic []BasicAuth

	AuthForward *ForwardAuthBlock

	// AuthHMACSecrets holds secret references for ingress HMAC verification.
	AuthHMACSecrets       []string
	AuthHMACSecretsQuoted []bool
	AuthHMACSecretIsRef   []bool
	AuthHMACBlockSet      bool

	AuthHMACSignatureHeader       string
	AuthHMACSignatureHeaderQuoted bool
	AuthHMACSignatureHeaderSet    bool

	AuthHMACTimestampHeader       string
	AuthHMACTimestampHeaderQuoted bool
	AuthHMACTimestampHeaderSet    bool

	AuthHMACNonceHeader       string
	AuthHMACNonceHeaderQuoted bool
	AuthHMACNonceHeaderSet    bool

	AuthHMACTolerance       string
	AuthHMACToleranceQuoted bool
	AuthHMACToleranceSet    bool
}

type RuntimeLogBlock struct {
	Level       string
	LevelQuoted bool
	LevelSet    bool

	Output       string
	OutputQuoted bool
	OutputSet    bool

	Path       string
	PathQuoted bool
	PathSet    bool

	Format       string
	FormatQuoted bool
	FormatSet    bool
}

type SecretBlock struct {
	ID       string
	IDQuoted bool

	Value       string
	ValueQuoted bool
	ValueSet    bool

	ValidFrom       string
	ValidFromQuoted bool
	ValidFromSet    bool

	ValidUntil       string
	ValidUntilQuoted bool
	ValidUntilSet    bool
}

type SecretConfig struct {
	ID         string
	ValueRef   string
	ValidFrom  time.Time
	ValidUntil time.Time
	HasUntil   bool
}

type SecretsBlock struct {
	Items []SecretBlock
}

type TLSBlock struct {
	CertFile       string
	CertFileQuoted bool
	CertFileSet    bool

	KeyFile       string
	KeyFileQuoted bool
	KeyFileSet    bool

	ClientCA       string
	ClientCAQuoted bool
	ClientCASet    bool

	ClientAuth       string
	ClientAuthQuoted bool
	ClientAuthSet    bool
}

type TLSConfig struct {
	Enabled  bool
	CertFile string
	KeyFile  string

	ClientCA   string
	ClientAuth tls.ClientAuthType
}

type TracingBlock struct {
	Enabled       string
	EnabledQuoted bool
	EnabledSet    bool

	Collector       string
	CollectorQuoted bool
	CollectorSet    bool

	URLPath       string
	URLPathQuoted bool
	URLPathSet    bool

	Timeout       string
	TimeoutQuoted bool
	TimeoutSet    bool

	Compression       string
	CompressionQuoted bool
	CompressionSet    bool

	Insecure       string
	InsecureQuoted bool
	InsecureSet    bool

	ProxyURL       string
	ProxyURLQuoted bool
	ProxyURLSet    bool

	TLS *TracingTLSBlock

	Retry *TracingRetryBlock

	Headers []TracingHeader
	// contains filtered or unexported fields
}

type TracingHeader struct {
	Name        string
	NameQuoted  bool
	Value       string
	ValueQuoted bool
}

type TracingHeaderConfig struct {
	Name  string
	Value string
}

type TracingRetryBlock struct {
	Enabled       string
	EnabledQuoted bool
	EnabledSet    bool

	InitialInterval       string
	InitialIntervalQuoted bool
	InitialIntervalSet    bool

	MaxInterval       string
	MaxIntervalQuoted bool
	MaxIntervalSet    bool

	MaxElapsedTime       string
	MaxElapsedTimeQuoted bool
	MaxElapsedTimeSet    bool
}

type TracingRetryConfig struct {
	Enabled         bool
	InitialInterval time.Duration
	MaxInterval     time.Duration
	MaxElapsedTime  time.Duration
}

type TracingTLSBlock struct {
	CAFile       string
	CAFileQuoted bool
	CAFileSet    bool

	CertFile       string
	CertFileQuoted bool
	CertFileSet    bool

	KeyFile       string
	KeyFileQuoted bool
	KeyFileSet    bool

	ServerName       string
	ServerNameQuoted bool
	ServerNameSet    bool

	InsecureSkipVerify       string
	InsecureSkipVerifyQuoted bool
	InsecureSkipVerifySet    bool
}

type TrendSignalsBlock struct {
	Window       string
	WindowQuoted bool
	WindowSet    bool

	ExpectedCaptureInterval       string
	ExpectedCaptureIntervalQuoted bool
	ExpectedCaptureIntervalSet    bool

	StaleGraceFactor       string
	StaleGraceFactorQuoted bool
	StaleGraceFactorSet    bool

	SustainedGrowthConsecutive       string
	SustainedGrowthConsecutiveQuoted bool
	SustainedGrowthConsecutiveSet    bool

	SustainedGrowthMinSamples       string
	SustainedGrowthMinSamplesQuoted bool
	SustainedGrowthMinSamplesSet    bool

	SustainedGrowthMinDelta       string
	SustainedGrowthMinDeltaQuoted bool
	SustainedGrowthMinDeltaSet    bool

	RecentSurgeMinTotal       string
	RecentSurgeMinTotalQuoted bool
	RecentSurgeMinTotalSet    bool

	RecentSurgeMinDelta       string
	RecentSurgeMinDeltaQuoted bool
	RecentSurgeMinDeltaSet    bool

	RecentSurgePercent       string
	RecentSurgePercentQuoted bool
	RecentSurgePercentSet    bool

	DeadShareHighMinTotal       string
	DeadShareHighMinTotalQuoted bool
	DeadShareHighMinTotalSet    bool

	DeadShareHighPercent       string
	DeadShareHighPercentQuoted bool
	DeadShareHighPercentSet    bool

	QueuedPressureMinTotal       string
	QueuedPressureMinTotalQuoted bool
	QueuedPressureMinTotalSet    bool

	QueuedPressurePercent       string
	QueuedPressurePercentQuoted bool
	QueuedPressurePercentSet    bool

	QueuedPressureLeasedMultiplier       string
	QueuedPressureLeasedMultiplierQuoted bool
	QueuedPressureLeasedMultiplierSet    bool
}

type TrendSignalsConfig struct {
	Window                  time.Duration
	ExpectedCaptureInterval time.Duration
	StaleGraceFactor        int

	SustainedGrowthConsecutive int
	SustainedGrowthMinSamples  int
	SustainedGrowthMinDelta    int

	RecentSurgeMinTotal int
	RecentSurgeMinDelta int
	RecentSurgePercent  int

	DeadShareHighMinTotal int
	DeadShareHighPercent  int

	QueuedPressureMinTotal         int
	QueuedPressurePercent          int
	QueuedPressureLeasedMultiplier int
}

type ValidationOptions struct {
	// SecretPreflight loads all compiled secret refs (`env:`, `file:`, `vault:`,
	// `raw:`) to catch missing/unreachable secrets during validation.
	SecretPreflight bool
}

type ValidationResult struct {
	OK       bool     `json:"ok"`
	Errors   []string `json:"errors,omitempty"`
	Warnings []string `json:"warnings,omitempty"`
}

type VarItem struct {
	Name        string
	NameQuoted  bool
	Value       string
	ValueQuoted bool
}

type VarsBlock struct {
	Items []VarItem
}