settings

const (
	// DefaultResolverTimeout is the default timeout for individual resolver execution.
	DefaultResolverTimeout = 30 * time.Second

	// DefaultPhaseTimeout is the default timeout for resolver phase execution.
	DefaultPhaseTimeout = 5 * time.Minute

	// DefaultActionTimeout is the default timeout for action execution.
	DefaultActionTimeout = 5 * time.Minute

	// DefaultGracePeriod is the default grace period for action cancellation.
	DefaultGracePeriod = 30 * time.Second

	// DefaultPluginFetchTimeout is the default timeout for fetching plugins from catalogs.
	DefaultPluginFetchTimeout = 2 * time.Minute

	// DefaultPluginResolveTimeout is the default timeout for plugin resolution
	DefaultPluginResolveTimeout = 30 * time.Second
)

const (
	// DefaultConflictStrategy is the default conflict resolution strategy for file writes.
	DefaultConflictStrategy = "error"

	// DefaultMaxBackups is the maximum number of backup files (.bak, .bak.1, etc.) per source file.
	DefaultMaxBackups = 5
)

const (
	// DefaultHTTPTimeout is the default timeout for HTTP requests.
	DefaultHTTPTimeout = 30 * time.Second

	// DefaultHTTPRetryMax is the default maximum number of HTTP retries.
	DefaultHTTPRetryMax = 3

	// DefaultHTTPRetryWaitMinimum is the minimum wait time between HTTP retries.
	DefaultHTTPRetryWaitMinimum = 1 * time.Second

	// DefaultHTTPRetryWaitMaximum is the maximum wait time between HTTP retries.
	DefaultHTTPRetryWaitMaximum = 30 * time.Second

	// DefaultHTTPCacheTTL is the default TTL for HTTP cache entries.
	DefaultHTTPCacheTTL = 10 * time.Minute

	// DefaultHTTPCacheKeyPrefix is the default prefix for HTTP cache keys.
	DefaultHTTPCacheKeyPrefix = "scafctl:"

	// DefaultArtifactCacheTTL is the default TTL for the artifact cache.
	// Catalog artifacts are cached for 24 hours by default.
	DefaultArtifactCacheTTL = 24 * time.Hour

	// DefaultRegistryConcurrency is the maximum number of concurrent OCI
	// registry requests when listing artifacts. Bounded to avoid
	// rate-limiting (429s) on registries like GHCR or Docker Hub.
	DefaultRegistryConcurrency = 5
)

const (
	// DefaultPluginCacheMaxSize is the default maximum size for the managed
	// plugin cache in API server mode. Parsed as a human-readable byte string
	// (e.g., "512MB", "1GB"). 512 MB comfortably holds ~35 plugins with room
	// for version overlap during updates.
	DefaultPluginCacheMaxSize = "512MB"

	// DefaultMaxResponseBodySize is the maximum HTTP response body size the
	// HTTP provider will read into memory (100 MB). This prevents denial of
	// service via unbounded response bodies from malicious or misconfigured
	// servers. Configurable per-deployment via httpClient.maxResponseBodySize.
	DefaultMaxResponseBodySize int64 = 100 * 1024 * 1024

	// DefaultMaxCacheFileSize is the maximum size for a single cached file (10MB).
	DefaultMaxCacheFileSize = 10 * 1024 * 1024

	// DefaultMemoryCacheSize is the maximum number of entries in memory caches.
	DefaultMemoryCacheSize = 1000

	// DefaultWarnValueSize is the threshold for warning about large resolver values (1MB).
	DefaultWarnValueSize = 1024 * 1024

	// DefaultMaxValueSize is the maximum allowed resolver value size (10MB).
	DefaultMaxValueSize = 10 * 1024 * 1024
)

const (
	// DefaultOTelSamplerType is the default trace sampler. always_on means every
	// span is recorded (appropriate for a CLI tool with low call volume).
	DefaultOTelSamplerType = "always_on"

	// DefaultOTelSamplerArg is the default argument for the sampler.
	// For traceidratio this is the sampling probability (0.0–1.0).
	DefaultOTelSamplerArg = 1.0
)

const (
	// DefaultCELCacheSize is the default size for the CEL program cache.
	DefaultCELCacheSize = 10000

	// DefaultCELCostLimit is the default cost limit for CEL expression evaluation.
	// Set to 0 to disable cost limiting.
	DefaultCELCostLimit = 1000000
)

const (
	// DefaultGRPCMaxMessageSize is the default maximum gRPC message size for
	// plugin communication (64 MB). The Go gRPC library default is 4 MB, which
	// is too small for solutions with legitimately large provider inputs or
	// outputs (e.g., large HCL files, API responses). This applies to both
	// send and receive directions.
	DefaultGRPCMaxMessageSize = 64 * 1024 * 1024

	// MinGRPCMaxMessageSize is the minimum accepted gRPC message size (1 MB).
	// Values below this floor are treated as misconfiguration and the default
	// is used instead. Matches the minimum:"1048576" validation tag on the
	// config struct.
	MinGRPCMaxMessageSize = 1024 * 1024

	// DefaultFetchConcurrency is the max concurrency for plugin fetches in FetchPlugins (errgroup limit).
	DefaultFetchConcurrency = 4
)

const (
	// DefaultAPIPort is the default port for the API server.
	DefaultAPIPort = 8080

	// DefaultAPIHost is the default host for the API server.
	// Binds to localhost only; use --host 0.0.0.0 or config to expose publicly.
	DefaultAPIHost = "127.0.0.1"

	// DefaultAPIVersion is the default API version prefix.
	DefaultAPIVersion = "v1"

	// DefaultAPIShutdownTimeout is the default graceful shutdown timeout.
	DefaultAPIShutdownTimeout = "30s"

	// DefaultAPIRequestTimeout is the default request timeout.
	DefaultAPIRequestTimeout = "60s"

	// DefaultAPIMaxRequestSize is the default maximum request body size in bytes (10MB).
	DefaultAPIMaxRequestSize int64 = 10 * 1024 * 1024

	// DefaultAPICompressionLevel is the default gzip compression level.
	DefaultAPICompressionLevel = 6

	// DefaultAPICORSMaxAge is the default CORS max age in seconds.
	DefaultAPICORSMaxAge = 3600

	// DefaultAPIRateLimitMaxRequests is the default rate limit max requests.
	DefaultAPIRateLimitMaxRequests = 100

	// DefaultAPIRateLimitWindow is the default rate limit window.
	DefaultAPIRateLimitWindow = "1m"

	// DefaultAPIMaxConcurrentRequests is the default max concurrent in-flight requests (chi Throttle).
	DefaultAPIMaxConcurrentRequests = 1000

	// DefaultAPIFilterCostLimit is the CEL cost limit for API filter expressions.
	// Lower than the CLI default (1,000,000) to prevent DoS via user-supplied expressions.
	DefaultAPIFilterCostLimit uint64 = 10000

	// DefaultAPIEvalCostLimit is the CEL cost limit for the eval endpoint.
	// Higher than the filter limit because eval is the primary use-case, but
	// still bounded to protect the server from expensive expressions.
	DefaultAPIEvalCostLimit uint64 = 100000

	// DefaultAPIBodyReadTimeout is the default timeout for reading request bodies.
	DefaultAPIBodyReadTimeout = "15s"

	// DefaultAPIOperationMaxBodyBytes is the default per-operation max body size (1 MiB).
	// This is the Huma-level limit; the chi middleware limit (MaxRequestSize) is the outer bound.
	DefaultAPIOperationMaxBodyBytes int64 = 1 << 20

	// DefaultAPIAdminMaxBodyBytes is the max body size for admin endpoints (1 KiB).
	// Admin POST endpoints have empty or tiny bodies.
	DefaultAPIAdminMaxBodyBytes int64 = 1024

	// DefaultAPIEvalTimeout is the maximum wall-clock time allowed for a single
	// CEL or Go-template evaluation request. Prevents CPU exhaustion from
	// expensive user-supplied expressions.
	DefaultAPIEvalTimeout = 30 * time.Second

	// DefaultAPIIdentityCacheSize is the default LRU cache size for delegated tokens.
	DefaultAPIIdentityCacheSize = 1024
)

const (
	// DefaultCircuitBreakerMaxFailures is the number of consecutive failures before opening the circuit.
	DefaultCircuitBreakerMaxFailures = 5

	// DefaultCircuitBreakerOpenTimeout is how long to wait before transitioning from Open to HalfOpen.
	DefaultCircuitBreakerOpenTimeout = 30 * time.Second

	// DefaultCircuitBreakerHalfOpenRequests is the number of successful requests in HalfOpen before closing.
	DefaultCircuitBreakerHalfOpenRequests = 1
)

const (
	CliBinaryName = "scafctl"
)

const (
	// DefaultGoTemplateCacheSize is the default size for the Go template compilation cache.
	DefaultGoTemplateCacheSize = 10000
)