contentstore

type Limits struct {
	Comment         []content.Rate // default 5 per 5 minutes and 20 per hour
	CommentReaction []content.Rate // default 30 per minute
	Reaction        []content.Rate // default 30 per minute
	Favorite        []content.Rate // default 20 per minute
	PollVote        []content.Rate // default 30 per minute

	// Redis (or Garnet) shares the limits across replicas; pass the host's
	// client. Without it each process counts alone, so N replicas allow N
	// times the limit. Redis errors fall back to the per-process count.
	Redis     redis.UniversalClient
	KeyPrefix string // default "contentkit:content:rl:"; the tenant follows it
	// Disabled turns every limit off.
	Disabled bool
}

type Media struct {
	Namespace string              // media partition; empty retains the content catalog key
	Images    content.MediaImages // *media.Manifests
	Folders   MediaFolders        // *media.Jobs
	// Reader reads items as the media read API does; the engine fills it
	// from its Reader.
	Reader   content.MediaReader
	PollKind string // media kind of poll folders; default "poll"
}

type MediaFolders interface {
	RetireItemsTx(ctx context.Context, tx pgx.Tx, items ...media.Deletion) error
}

type Options struct {
	// Pool is the host's shared pgx pool; the runtime does not own its lifecycle.
	Pool *pgxpool.Pool
	// Schema is ContentKit's schema.
	Schema string
	// Tenant scopes every row, index, cursor and result. Required.
	Tenant string

	// Auth says who a request is (authkit/auth; AuthKit's ak.Authenticator()).
	// The routes ask it at most once per request and build the actor from
	// its Verified: anonymous without a credential, 401 for one that fails.
	// Staff hold ContentKit's permissions (access.Permissions) in its root
	// scope (auth.Root), checked by the Verified's Can: declare them in its
	// roles. Required.
	Auth auth.Authenticator
	// UserInfo is the host's directory (authkit/userinfo; AuthKit's
	// ak.UserInfo()): authors' names and usernames, read once per response
	// and never copied. Nil shows authors by id.
	UserInfo userinfo.Lookup
	// Avatars shows authors' avatars (media.Registry.Avatars); nil shows
	// none.
	Avatars content.Avatars
	// Resolver decides interaction targets: content items and their versions
	// (the catalog's) and entities. Required.
	Resolver resolve.Resolver
	// Kinds is the site's content model: interactions target its content
	// kinds and entity kinds, and comments carry one of its languages.
	Kinds kinds.Config

	// PreferenceSyncOverlap bounds how long a preference write may take to
	// commit and still be picked up by SyncPreferences.
	// Default DefaultPreferenceSyncOverlap.
	PreferenceSyncOverlap time.Duration

	// Optional ports (nil -> default).
	Processor content.ContentProcessor // comments; default: trim plain text
	// Moderator screens comment writes, and the catalog's (Screen); nil
	// publishes everything.
	Moderator content.ContentModerator
	// ModeratorTimeout bounds one Screen call (default 5s); a slower
	// moderator counts as failed and the write is held.
	ModeratorTimeout time.Duration
	// ModeratorCooldown is how long writes are held without calling the
	// moderator after it failed repeatedly (default 30s); see CheckModerator.
	ModeratorCooldown time.Duration

	// Media stores poll images in ContentKit media; nil refuses image writes
	// with 501 not_configured. See Media.
	Media *Media

	// ProviderDataEraser is required when moderator ports retain
	// external personal data.
	// Nil explicitly means stateless ports; never remove it during an outage.
	ProviderDataEraser content.ProviderDataEraser

	// Limits are the per-actor interaction rate limits (limits.go); the zero
	// value takes the defaults, counted per process.
	Limits Limits

	// Anonymous is what signed-out visitors may do; the zero value lets them
	// only read.
	Anonymous content.Anonymous
	// CommentMaxLength is the longest comment in characters (runes);
	// default DefaultCommentMaxLength.
	CommentMaxLength int
	// DuplicateWindow refuses identical comments within this duration; zero disables it.
	DuplicateWindow time.Duration

	// NotificationPublisher is AuthKit's scoped account channel. Nil disables
	// user notifications; ContentKit never constructs its own inbox.
	NotificationPublisher notify.Publisher
	// Accounts serves the account lifecycle routes; nil answers them 500.
	Accounts content.AccountLifecycle
	// EraseAccountReceipts connects the existing account cleanup lifecycle.
	// Nil is used by standalone content runtimes without shared account storage.
	EraseAccountReceipts func(context.Context, []string) error

	// Logger receives the access log: each request at DEBUG, a 500 at ERROR
	// with its cause. nil -> slog.Default().
	Logger *slog.Logger
}

type Runtime struct {
	// contains filtered or unexported fields
}