config

type ActionConfig struct {
	// DefaultTimeout is the default timeout per action execution
	DefaultTimeout string `` /* 150-byte string literal not displayed */

	// GracePeriod is the cancellation grace period
	GracePeriod string `` /* 145-byte string literal not displayed */

	// MaxConcurrency is the max concurrent actions (0 = unlimited)
	MaxConcurrency int `` /* 162-byte string literal not displayed */

	// OutputDir is the default target directory for action file operations.
	// When set, actions resolve relative paths against this directory instead of CWD.
	// Can be overridden by the --output-dir CLI flag.
	OutputDir string `` /* 175-byte string literal not displayed */
}

type ActionConfigValues struct {
	DefaultTimeout time.Duration `json:"defaultTimeout" yaml:"defaultTimeout" doc:"Default per-action execution timeout"`
	GracePeriod    time.Duration `json:"gracePeriod" yaml:"gracePeriod" doc:"Cancellation grace period"`
	MaxConcurrency int           `json:"maxConcurrency" yaml:"maxConcurrency" doc:"Maximum concurrent action executions" maximum:"1000" example:"5"`
	OutputDir      string        `json:"outputDir" yaml:"outputDir" doc:"Default target directory for action file operations"`
}

type AuthConfig struct {
	Type        string `json:"type" yaml:"type" mapstructure:"type" doc:"Auth type" example:"token" maxLength:"50"`
	TokenEnvVar string `` /* 168-byte string literal not displayed */
}

type BuildConfig struct {
	// EnableCache enables build-level caching to skip redundant builds.
	EnableCache *bool `json:"enableCache,omitempty" yaml:"enableCache,omitempty" mapstructure:"enableCache" doc:"Enable build-level caching"`

	// CacheDir is the directory for storing build cache entries.
	CacheDir string `` /* 159-byte string literal not displayed */

	// AutoCacheRemoteArtifacts automatically caches remote catalog fetches into the local catalog.
	AutoCacheRemoteArtifacts *bool `` /* 171-byte string literal not displayed */

	// PluginCacheDir is the directory for cached plugin binaries.
	PluginCacheDir string `` /* 181-byte string literal not displayed */
}

type CELConfig struct {
	// CacheSize is the maximum number of compiled programs to cache
	CacheSize int `` /* 141-byte string literal not displayed */

	// CostLimit is the cost limit for expression evaluation (0 = disabled)
	// Prevents runaway expressions from consuming resources
	CostLimit int64 `` /* 150-byte string literal not displayed */

	// UseASTBasedCaching enables AST-based cache key generation for better hit rates
	// Expressions with same structure share cache entries
	UseASTBasedCaching bool `` /* 139-byte string literal not displayed */

	// EnableMetrics enables expression metrics collection
	EnableMetrics *bool `json:"enableMetrics,omitempty" yaml:"enableMetrics,omitempty" mapstructure:"enableMetrics" doc:"Enable expression metrics"`
}

type CELConfigValues struct {
	CacheSize          int   `json:"cacheSize" yaml:"cacheSize" doc:"CEL program cache size" maximum:"100000" example:"1000"`
	CostLimit          int64 `json:"costLimit" yaml:"costLimit" doc:"CEL evaluation cost limit" maximum:"1000000000" example:"100000"`
	UseASTBasedCaching bool  `json:"useASTBasedCaching" yaml:"useASTBasedCaching" doc:"Use AST-based cache keys for deduplication"`
	EnableMetrics      bool  `json:"enableMetrics" yaml:"enableMetrics" doc:"Enable CEL evaluation metrics"`
}

type CatalogConfig struct {
	Name       string            `json:"name" yaml:"name" mapstructure:"name" doc:"Catalog name" example:"internal" maxLength:"255"`
	Type       string            `json:"type" yaml:"type" mapstructure:"type" doc:"Catalog type" example:"filesystem" maxLength:"50"`
	Path       string            `` /* 151-byte string literal not displayed */
	URL        string            `` /* 145-byte string literal not displayed */
	Auth       *AuthConfig       `json:"auth,omitempty" yaml:"auth,omitempty" mapstructure:"auth" doc:"Authentication configuration"`
	Metadata   map[string]string `json:"metadata,omitempty" yaml:"metadata,omitempty" mapstructure:"metadata" doc:"Additional metadata"`
	HTTPClient *HTTPClientConfig `` /* 144-byte string literal not displayed */
}

type Config struct {
	Version    int              `json:"version,omitempty" yaml:"version,omitempty" mapstructure:"version" doc:"Config file version" example:"1" maximum:"100"`
	Catalogs   []CatalogConfig  `json:"catalogs" yaml:"catalogs" mapstructure:"catalogs" doc:"Configured catalogs" maxItems:"50"`
	Settings   Settings         `json:"settings" yaml:"settings" mapstructure:"settings" doc:"Application settings"`
	Logging    LoggingConfig    `json:"logging,omitempty" yaml:"logging,omitempty" mapstructure:"logging" doc:"Logging configuration"`
	Telemetry  TelemetryConfig  `json:"telemetry,omitempty" yaml:"telemetry,omitempty" mapstructure:"telemetry" doc:"OpenTelemetry configuration"`
	HTTPClient HTTPClientConfig `json:"httpClient,omitempty" yaml:"httpClient,omitempty" mapstructure:"httpClient" doc:"Global HTTP client configuration"`
	CEL        CELConfig        `json:"cel,omitempty" yaml:"cel,omitempty" mapstructure:"cel" doc:"CEL expression engine configuration"`
	GoTemplate GoTemplateConfig `json:"goTemplate,omitempty" yaml:"goTemplate,omitempty" mapstructure:"goTemplate" doc:"Go template engine configuration"`
	Resolver   ResolverConfig   `json:"resolver,omitempty" yaml:"resolver,omitempty" mapstructure:"resolver" doc:"Resolver executor configuration"`
	Action     ActionConfig     `json:"action,omitempty" yaml:"action,omitempty" mapstructure:"action" doc:"Action executor configuration"`
	Auth       GlobalAuthConfig `json:"auth,omitempty" yaml:"auth,omitempty" mapstructure:"auth" doc:"Authentication handler configuration"`
	Build      BuildConfig      `json:"build,omitempty" yaml:"build,omitempty" mapstructure:"build" doc:"Build command configuration"`
}

type EntraAuthConfig struct {
	// HTTPClient optionally overrides HTTP settings for Entra auth requests.
	HTTPClient *HTTPClientConfig `json:"httpClient,omitempty" yaml:"httpClient,omitempty" mapstructure:"httpClient" doc:"HTTP client overrides for Entra"`

	// ClientID overrides the default application ID.
	// If not set, uses the default scafctl public client ID.
	ClientID string `` /* 164-byte string literal not displayed */

	// TenantID sets the default tenant for authentication.
	// Use "common" for multi-tenant, "organizations" for work/school only,
	// or a specific tenant GUID.
	TenantID string `` /* 137-byte string literal not displayed */

	// DefaultScopes are requested during login if not specified on command line.
	DefaultScopes []string `` /* 131-byte string literal not displayed */
}

type GCPAuthConfig struct {
	// HTTPClient optionally overrides HTTP settings for GCP auth requests.
	HTTPClient *HTTPClientConfig `json:"httpClient,omitempty" yaml:"httpClient,omitempty" mapstructure:"httpClient" doc:"HTTP client overrides for GCP"`

	// ClientID overrides the default OAuth 2.0 client ID.
	ClientID string `` /* 195-byte string literal not displayed */

	// ClientSecret overrides the default OAuth 2.0 client secret.
	ClientSecret string `` //nolint:gosec // G117: not a hardcoded credential, it's a config field
	/* 169-byte string literal not displayed */

	// DefaultScopes are requested during login if not specified on command line.
	DefaultScopes []string `` /* 154-byte string literal not displayed */

	// ImpersonateServiceAccount is the service account email to impersonate.
	ImpersonateServiceAccount string `` /* 237-byte string literal not displayed */

	// Project is the default GCP project ID.
	Project string `` /* 141-byte string literal not displayed */
}

type GitHubAuthConfig struct {
	// HTTPClient optionally overrides HTTP settings for GitHub auth requests.
	HTTPClient *HTTPClientConfig `json:"httpClient,omitempty" yaml:"httpClient,omitempty" mapstructure:"httpClient" doc:"HTTP client overrides for GitHub"`

	// ClientID overrides the default GitHub OAuth App client ID.
	// If not set, uses the default scafctl OAuth App client ID.
	ClientID string `` /* 150-byte string literal not displayed */

	// ClientSecret is the GitHub OAuth App client secret.
	// Required for the interactive (browser authorization code + PKCE) flow.
	// When not set, the interactive flow automatically uses device code with
	// browser auto-open — the same behaviour as 'gh auth login'.
	ClientSecret string `` //nolint:gosec // G117: config field, not a hardcoded credential
	/* 177-byte string literal not displayed */

	// Hostname sets the GitHub hostname for enterprise server (GHES).
	// Defaults to "github.com".
	Hostname string `` /* 134-byte string literal not displayed */

	// DefaultScopes are requested during login if not specified on command line.
	DefaultScopes []string `` /* 131-byte string literal not displayed */

	// AppID is the GitHub App ID for the installation token flow.
	AppID int64 `` /* 152-byte string literal not displayed */

	// InstallationID is the GitHub App installation ID.
	InstallationID int64 `` /* 166-byte string literal not displayed */

	// PrivateKeyPath is the file path to the PEM-encoded private key for the GitHub App.
	PrivateKeyPath string `` /* 207-byte string literal not displayed */

	// PrivateKey is the inline PEM-encoded private key for the GitHub App.
	PrivateKey string `` //nolint:gosec // Field name, not a credential
	/* 154-byte string literal not displayed */

	// PrivateKeySecretName is the name of the secret store entry containing the private key.
	PrivateKeySecretName string `` /* 206-byte string literal not displayed */
}

type GlobalAuthConfig struct {
	// HTTPClient optionally overrides the global HTTP client settings for all auth handlers.
	// Individual handler configs (Entra, GitHub, GCP) can further override these.
	HTTPClient *HTTPClientConfig `` /* 127-byte string literal not displayed */

	// Entra contains Microsoft Entra ID configuration.
	Entra *EntraAuthConfig `json:"entra,omitempty" yaml:"entra,omitempty" mapstructure:"entra" doc:"Microsoft Entra ID configuration"`

	// GitHub contains GitHub authentication configuration.
	GitHub *GitHubAuthConfig `json:"github,omitempty" yaml:"github,omitempty" mapstructure:"github" doc:"GitHub authentication configuration"`

	// GCP contains Google Cloud Platform authentication configuration.
	GCP *GCPAuthConfig `json:"gcp,omitempty" yaml:"gcp,omitempty" mapstructure:"gcp" doc:"Google Cloud Platform authentication configuration"`
}

type GoTemplateConfig struct {
	// CacheSize is the maximum number of compiled templates to cache
	CacheSize int `` /* 141-byte string literal not displayed */

	// EnableMetrics enables template metrics collection
	EnableMetrics *bool `json:"enableMetrics,omitempty" yaml:"enableMetrics,omitempty" mapstructure:"enableMetrics" doc:"Enable template metrics"`

	// AllowEnvFunctions enables the sprig 'env' and 'expandenv' template functions.
	// When false (the default), these functions are removed from the template
	// function map to prevent solution files from exfiltrating process secrets
	// (e.g. GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY) via {{ env "SECRET" }}.
	// Set to true only if your solutions explicitly require reading env vars.
	AllowEnvFunctions bool `` /* 229-byte string literal not displayed */
}

type GoTemplateConfigValues struct {
	CacheSize         int  `json:"cacheSize" yaml:"cacheSize" doc:"Template compilation cache size" maximum:"100000" example:"500"`
	EnableMetrics     bool `json:"enableMetrics" yaml:"enableMetrics" doc:"Enable template execution metrics"`
	AllowEnvFunctions bool `json:"allowEnvFunctions" yaml:"allowEnvFunctions" doc:"Allow sprig env/expandenv functions"`
}

type HTTPClientConfig struct {
	// Timeout is the maximum time to wait for a request to complete
	Timeout string `` /* 128-byte string literal not displayed */

	// Retry settings
	RetryMax     int    `` /* 132-byte string literal not displayed */
	RetryWaitMin string `` /* 155-byte string literal not displayed */
	RetryWaitMax string `` /* 156-byte string literal not displayed */

	// Cache settings
	EnableCache      *bool  `json:"enableCache,omitempty" yaml:"enableCache,omitempty" mapstructure:"enableCache" doc:"Enable HTTP response caching"`
	CacheType        string `` /* 153-byte string literal not displayed */
	CacheDir         string `` /* 161-byte string literal not displayed */
	CacheTTL         string `` /* 144-byte string literal not displayed */
	CacheKeyPrefix   string `` /* 155-byte string literal not displayed */
	MaxCacheFileSize int64  `` /* 192-byte string literal not displayed */
	MemoryCacheSize  int    `` /* 176-byte string literal not displayed */

	// Circuit breaker settings
	EnableCircuitBreaker              *bool  `` /* 148-byte string literal not displayed */
	CircuitBreakerMaxFailures         int    `` /* 190-byte string literal not displayed */
	CircuitBreakerOpenTimeout         string `` /* 194-byte string literal not displayed */
	CircuitBreakerHalfOpenMaxRequests int    `` /* 229-byte string literal not displayed */

	// Compression
	EnableCompression *bool `` /* 142-byte string literal not displayed */

	// AllowPrivateIPs controls whether HTTP requests to private, loopback, and
	// link-local IP addresses are permitted. Checked against IP literals only
	// (hostnames are not pre-resolved). When false (default), requests to RFC 1918
	// ranges (10.x, 172.16.x, 192.168.x), loopback (127.x, ::1), link-local
	// (169.254.x), and CGNAT (100.64.x) are blocked. Set to true to allow private
	// network access (e.g., for on-premises endpoints or local development).
	AllowPrivateIPs *bool `` /* 241-byte string literal not displayed */

	// MaxResponseBodySize is the maximum number of bytes the HTTP provider will
	// read from a single response body. Prevents denial-of-service via unbounded
	// responses from malicious or misconfigured servers. Defaults to 100 MB.
	MaxResponseBodySize int64 `` /* 217-byte string literal not displayed */
}

type LoggingConfig struct {
	Level           string `` /* 174-byte string literal not displayed */
	Format          string `` /* 144-byte string literal not displayed */
	Timestamps      bool   `json:"timestamps,omitempty" yaml:"timestamps,omitempty" mapstructure:"timestamps" doc:"Include timestamps in logs"`
	EnableProfiling bool   `` /* 142-byte string literal not displayed */
}

type Manager struct {
	// contains filtered or unexported fields
}

type ResolverConfig struct {
	// Timeout is the default timeout per resolver execution
	Timeout string `` /* 132-byte string literal not displayed */

	// PhaseTimeout is the maximum time for each resolution phase
	PhaseTimeout string `` /* 144-byte string literal not displayed */

	// MaxConcurrency is the maximum concurrent resolvers per phase (0 = unlimited)
	MaxConcurrency int `` /* 166-byte string literal not displayed */

	// WarnValueSize is the warn threshold in bytes (0 = disabled)
	WarnValueSize int64 `` /* 159-byte string literal not displayed */

	// MaxValueSize is the max value size in bytes (0 = disabled)
	MaxValueSize int64 `` /* 157-byte string literal not displayed */

	// ValidateAll enables collecting all errors instead of stopping at first
	ValidateAll bool `` /* 126-byte string literal not displayed */
}

type ResolverConfigValues struct {
	Timeout        time.Duration `json:"timeout" yaml:"timeout" doc:"Per-resolver execution timeout"`
	PhaseTimeout   time.Duration `json:"phaseTimeout" yaml:"phaseTimeout" doc:"Per-phase execution timeout"`
	MaxConcurrency int           `json:"maxConcurrency" yaml:"maxConcurrency" doc:"Maximum concurrent resolver executions" maximum:"1000" example:"10"`
	WarnValueSize  int64         `` /* 128-byte string literal not displayed */
	MaxValueSize   int64         `json:"maxValueSize" yaml:"maxValueSize" doc:"Maximum allowed value size (bytes)" maximum:"1073741824" example:"10485760"`
	ValidateAll    bool          `json:"validateAll" yaml:"validateAll" doc:"Run all validators even if one fails"`
}

type SanitizedAuth struct {
	Entra  *SanitizedEntraAuth  `json:"entra,omitempty" yaml:"entra,omitempty" doc:"Entra ID auth configuration (redacted)"`
	GitHub *SanitizedGitHubAuth `json:"github,omitempty" yaml:"github,omitempty" doc:"GitHub auth configuration (redacted)"`
	GCP    *SanitizedGCPAuth    `json:"gcp,omitempty" yaml:"gcp,omitempty" doc:"GCP auth configuration (redacted)"`
}

type SanitizedCatAuth struct {
	Type        string `json:"type" yaml:"type" doc:"Authentication type" maxLength:"64" example:"token"`
	TokenEnvVar string `` /* 139-byte string literal not displayed */
}

type SanitizedCatalog struct {
	Name     string            `json:"name" yaml:"name" doc:"Catalog name" maxLength:"256" example:"my-catalog"`
	Type     string            `json:"type" yaml:"type" doc:"Catalog type" maxLength:"64" example:"git"`
	Path     string            `json:"path,omitempty" yaml:"path,omitempty" doc:"Local filesystem path" maxLength:"1024" example:"/path/to/catalog"`
	URL      string            `json:"url,omitempty" yaml:"url,omitempty" doc:"Remote URL" maxLength:"2048" example:"https://github.com/org/catalog"`
	Auth     *SanitizedCatAuth `json:"auth,omitempty" yaml:"auth,omitempty" doc:"Authentication settings (redacted)"`
	Metadata map[string]string `json:"metadata,omitempty" yaml:"metadata,omitempty" doc:"Additional metadata"`
}

type SanitizedConfig struct {
	Version    int                `json:"version,omitempty" yaml:"version,omitempty" doc:"Config file version" maximum:"10" example:"1"`
	Catalogs   []SanitizedCatalog `json:"catalogs" yaml:"catalogs" doc:"Configured solution catalogs" maxItems:"50"`
	Settings   Settings           `json:"settings" yaml:"settings" doc:"General application settings"`
	Logging    LoggingConfig      `json:"logging" yaml:"logging" doc:"Logging configuration"`
	HTTPClient HTTPClientConfig   `json:"httpClient" yaml:"httpClient" doc:"HTTP client configuration"`
	CEL        CELConfig          `json:"cel" yaml:"cel" doc:"CEL expression engine configuration"`
	Resolver   ResolverConfig     `json:"resolver" yaml:"resolver" doc:"Resolver execution configuration"`
	Action     ActionConfig       `json:"action" yaml:"action" doc:"Action execution configuration"`
	Auth       SanitizedAuth      `json:"auth" yaml:"auth" doc:"Authentication configuration (redacted)"`
	Build      BuildConfig        `json:"build" yaml:"build" doc:"Build configuration"`
}

type SanitizedEntraAuth struct {
	ClientID      string   `` /* 151-byte string literal not displayed */
	TenantID      string   `` /* 139-byte string literal not displayed */
	DefaultScopes []string `json:"defaultScopes,omitempty" yaml:"defaultScopes,omitempty" doc:"Default OAuth scopes" maxItems:"20"`
}

type SanitizedGCPAuth struct {
	ClientID                  string   `` /* 140-byte string literal not displayed */
	GCPClientCredential       string   `` /* 164-byte string literal not displayed */
	DefaultScopes             []string `json:"defaultScopes,omitempty" yaml:"defaultScopes,omitempty" doc:"Default OAuth scopes" maxItems:"20"`
	ImpersonateServiceAccount string   `` /* 183-byte string literal not displayed */
	Project                   string   `json:"project,omitempty" yaml:"project,omitempty" doc:"GCP project ID" maxLength:"256" example:"my-gcp-project"`
}

type SanitizedGitHubAuth struct {
	ClientID      string   `json:"clientId,omitempty" yaml:"clientId,omitempty" doc:"GitHub OAuth app client ID" maxLength:"256" example:"Iv1.abc123"`
	Hostname      string   `json:"hostname,omitempty" yaml:"hostname,omitempty" doc:"GitHub hostname" maxLength:"256" example:"github.com"`
	DefaultScopes []string `json:"defaultScopes,omitempty" yaml:"defaultScopes,omitempty" doc:"Default OAuth scopes" maxItems:"20"`
}

type Settings struct {
	DefaultCatalog string              `` /* 154-byte string literal not displayed */
	NoColor        bool                `json:"noColor,omitempty" yaml:"noColor,omitempty" mapstructure:"noColor" doc:"Disable colored output"`
	Quiet          bool                `json:"quiet,omitempty" yaml:"quiet,omitempty" mapstructure:"quiet" doc:"Suppress non-essential output"`
	VersionCheck   *VersionCheckConfig `json:"versionCheck,omitempty" yaml:"versionCheck,omitempty" mapstructure:"versionCheck" doc:"Version check configuration"`

	// RequireSecureKeyring when true causes scafctl to fail with an error if the
	// OS keyring is unavailable and the secret store would fall back to an insecure
	// file-based or environment-variable-based master key. Enable this in
	// production or shared environments to prevent silent degradation of secret
	// protection.
	RequireSecureKeyring bool `` /* 195-byte string literal not displayed */
}

type TelemetryConfig struct {
	// Endpoint is the OTLP gRPC exporter endpoint (e.g. localhost:4317).
	// Equivalent to the OTEL_EXPORTER_OTLP_ENDPOINT environment variable.
	// When empty, tracing and OTel log export are disabled (noop providers).
	Endpoint string `` /* 151-byte string literal not displayed */

	// Insecure disables TLS for the OTLP gRPC connection. Useful for local
	// development setups where the collector has no TLS configured.
	Insecure bool `` /* 137-byte string literal not displayed */

	// ServiceName overrides the OTel resource service.name attribute.
	// Defaults to the binary name (scafctl).
	ServiceName string `` /* 163-byte string literal not displayed */

	// SamplerType controls the trace sampler. Supported values: always_on, always_off, traceidratio.
	// Defaults to always_on.
	SamplerType string `` /* 182-byte string literal not displayed */

	// SamplerArg is the argument passed to the sampler (e.g. ratio for traceidratio).
	SamplerArg float64 `` /* 152-byte string literal not displayed */
}

type VersionCheckConfig struct {
	// Timeout overrides the version check HTTP timeout (default: 5s).
	Timeout string `` /* 128-byte string literal not displayed */
	// Enabled can disable the automatic version check.
	Enabled *bool `json:"enabled,omitempty" yaml:"enabled,omitempty" mapstructure:"enabled" doc:"Enable version check"`
}