config

type CSRF struct {
	CookieName string `conf:"cookie_name" default:"csrf_token" json:"cookie_name" doc:"name of the CSRF token cookie set for browser clients"`
	HeaderName string `conf:"header_name" default:"X-CSRF-Token" json:"header_name" doc:"request header the client must echo the CSRF token in"`
	FieldName  string `` /* 142-byte string literal not displayed */
}

type CapacityMode string

type CapacityProblem struct {
	Replicas        int
	RuntimePoolMax  int
	PlatformPoolMax int
	MigratePoolMax  int
	ReservedAdmin   int
	Demand          int
	DBMaxConns      int
}

type Concurrency struct {
	// HTTPMaxInFlight bounds concurrent in-flight HTTP requests via a bounded
	// semaphore in kernel/httpx's backpressure middleware. 0 disables the
	// limiter (pass-through) — the safe default for existing deployments.
	HTTPMaxInFlight int `` /* 146-byte string literal not displayed */

	// WorkerMaxJobs mirrors kernel/jobs' runner pool size for capacity
	// bookkeeping; it does not itself change runner behavior (products still
	// configure the runner via jobs.WithPoolSize). 0 means "not tracked" here.
	WorkerMaxJobs int `` /* 134-byte string literal not displayed */

	// PlatformMaxInFlight bounds concurrent in-flight requests specifically
	// against the platform (cross-tenant) pool, e.g. API-key verification.
	// 0 means "not tracked" — no separate platform limiter is installed.
	PlatformMaxInFlight int `` /* 139-byte string literal not displayed */

	// Replicas is the number of process replicas of THIS deployment (api or
	// worker) sharing the same database. 0 means "not configured" and the
	// entire capacity-budget check (CheckCapacity) is skipped — the formula is
	// undefined without a declared shape, so leaving this unset must never
	// produce a spurious pass or fail.
	Replicas int `` /* 139-byte string literal not displayed */

	// RuntimePoolMax is the runtime (app_rt) pool's max_conns as budgeted per
	// replica. Distinct from db.max_conns (a single pool's own cap): this is
	// the value the deployment-shape formula multiplies by Replicas. Typically
	// equal to db.max_conns for a single-pool-per-process deployment.
	RuntimePoolMax int `` /* 133-byte string literal not displayed */

	// PlatformPoolMax is the platform (app_platform) pool's max_conns per
	// replica.
	PlatformPoolMax int `` /* 136-byte string literal not displayed */

	// MigratePoolMax is the one-shot migrate process's pool max_conns (not
	// multiplied by Replicas: migrations run as a single job, not per-replica).
	MigratePoolMax int `` /* 128-byte string literal not displayed */

	// ReservedAdmin is connections held back for admin/operator access
	// (psql, pgAdmin, an emergency migration) that must always fit under
	// db_max_connections alongside the application's own budget.
	ReservedAdmin int `` /* 148-byte string literal not displayed */

	// CapacityMode gates whether an oversubscribed shape fails boot
	// ("enforced") or only warns ("advisory", the default — see rollout
	// guidance on the Concurrency type doc).
	CapacityMode CapacityMode `` /* 168-byte string literal not displayed */

	Overload Overload `conf:"overload" json:"overload"`
}

type CookieDefaults struct {
	// SameSite is one of "strict", "lax", or "none" (case-insensitive on
	// input; canonicalized to lowercase). "lax" is the safe, commonly-usable
	// default recommended by OWASP for session-adjacent cookies.
	SameSite string `conf:"same_site" default:"lax" json:"same_site" doc:"cookie SameSite attribute: strict|lax|none"`
	// Secure marks cookies HTTPS-only. Required (validated) when SameSite is
	// "none", since browsers reject SameSite=None without Secure.
	Secure bool `conf:"secure" default:"true" json:"secure" doc:"set the Secure attribute on cookies (required when same_site=none)"`
}

type DB struct {
	DSN         Secret `conf:"dsn" json:"dsn" doc:"runtime database DSN (app_rt role) as a secretref:// reference"`
	MigrateDSN  Secret `` /* 142-byte string literal not displayed */
	PlatformDSN Secret `` /* 444-byte string literal not displayed */
	Pool               // embedded: pool knobs stay flat under db.* and flow to every process view wholesale
}

type Env string

type Fingerprint [sha256.Size]byte

type Framework struct {
	// Environment carries NO default tag: it is fail-closed (D-0010/SEC-1) —
	// the loader errors when it is absent from every layer. The compiled
	// `local` value exists only through Defaults() for tests/local tooling.
	Environment   Env         `` /* 135-byte string literal not displayed */
	SchemaVersion int         `conf:"schema_version" default:"1" json:"schema_version" doc:"config file format version"`
	HTTP          HTTP        `conf:"http" json:"http"`
	Log           Log         `conf:"log" json:"log"`
	DB            DB          `conf:"db" json:"db"`
	Telemetry     Telemetry   `conf:"telemetry" json:"telemetry"`
	Webhook       Webhook     `conf:"webhook" json:"webhook"`
	Privileged    Privileged  `conf:"privileged" json:"privileged"`
	Security      Security    `conf:"security" json:"security"`
	Concurrency   Concurrency `conf:"concurrency" json:"concurrency"`
}

type HTTP struct {
	Addr              string        `conf:"addr" default:":8080" json:"addr" doc:"HTTP listen address"`
	ReadHeaderTimeout time.Duration `conf:"read_header_timeout" default:"5s" json:"read_header_timeout" doc:"maximum time to read request headers"`
	RequestTimeout    time.Duration `conf:"request_timeout" default:"30s" json:"request_timeout" doc:"per-request handler timeout"`
	MaxBodyBytes      int64         `conf:"max_body_bytes" default:"1048576" json:"max_body_bytes" doc:"maximum request body size in bytes"`
	// CORSAllowedOrigins is the exact-match CORS allowlist (deny-by-default when
	// empty). Set per environment, e.g. modules-free base leaves it empty and the
	// prod overlay lists the product's web origins.
	CORSAllowedOrigins []string  `` /* 127-byte string literal not displayed */
	RateLimit          RateLimit `conf:"rate_limit" json:"rate_limit"`
}

type Layer string

type Loaded[T any] struct {
	Config      T
	Fingerprint Fingerprint
	Provenance  Provenance
	// Warnings carries non-fatal findings (e.g. unsafe knobs enabled in stage).
	Warnings []string
}

type Log struct {
	Level  string `conf:"level" default:"info" json:"level" doc:"log level: debug|info|warn|error"`
	Format string `conf:"format" default:"json" json:"format" doc:"log output format: json|text (prod requires json)"`
}

type MapView map[string]any

type ModuleView interface {
	// Decode strict-decodes the module's namespace into the module-owned
	// typed struct. Unknown keys in the namespace are an error (typo
	// defense); the module's own validation runs after decoding. Errors here
	// fail application boot.
	Decode(out any) error
}

type Namespaces map[string]MapView

type Options struct {
	// BaseFile is the committed product config file (configs/base.yaml).
	BaseFile string
	// EnvFile is the environment overlay (configs/<env>.yaml).
	EnvFile string
	// EnvPrefix enables the environment-variable layer:
	// "ACME__" maps ACME__DB__MAX_CONNS=32 onto db.max_conns. Empty = no env layer.
	EnvPrefix string
	// Environ supplies the environment ("KEY=VALUE" pairs); nil = os.Environ().
	Environ []string
	// Secrets resolves secretref:// values at boot. Required if any Secret
	// field is set; resolution failures fail the load.
	Secrets secrets.Provider
	// Flags holds local-tooling overrides by dotted key ("http.addr" → value).
	// The loader refuses to start when flags are set and environment=prod.
	Flags map[string]string
}

type Overload struct {
	// Status is the HTTP status code written on overload. Defaults to 503
	// (Service Unavailable) per benchmark §Concurrency; some deployments may
	// prefer 429 (Too Many Requests) to align with rate-limit semantics —
	// either is accepted, anything else is rejected by Validate.
	Status int `conf:"api_status" default:"503" json:"api_status" doc:"HTTP status returned on overload (503 or 429)"`
	// RetryAfter is the Retry-After hint (seconds, rounded up) sent with the
	// overload response.
	RetryAfter time.Duration `conf:"retry_after" default:"2s" json:"retry_after" doc:"Retry-After hint sent with the overload response"`
}

type Pool struct {
	MaxConns     int           `conf:"max_conns" default:"16" json:"max_conns" doc:"maximum pool connections"`
	QueryTimeout time.Duration `conf:"query_timeout" default:"5s" json:"query_timeout" doc:"per-query context deadline"`
}

type Privileged map[string]PrivilegedGrant

type PrivilegedGrant struct {
	// AllowRelTypes lists relationship-type keys (relationship_types.key) this
	// module may Grant/Revoke beyond its own "<module>." prefix, e.g. a kernel
	// "core.owner_of" type a product module is sanctioned to grant.
	AllowRelTypes []string `` /* 142-byte string literal not displayed */
	// AllowRuleKeys lists rule keys (rule_definitions.key) this module may
	// activate tenant versions of, beyond its own "<module>." prefix.
	AllowRuleKeys []string `` /* 131-byte string literal not displayed */
}

type Provenance map[string]Layer

type RateLimit struct {
	Disabled          bool    `conf:"disabled" json:"disabled" doc:"set true to remove the default per-client rate limiter from the chain"`
	RequestsPerSecond float64 `conf:"requests_per_second" default:"20" json:"requests_per_second" doc:"sustained requests/sec per client key (per replica)"`
	Burst             int     `conf:"burst" default:"40" json:"burst" doc:"burst capacity per client key"`
}

type Secret struct {
	// contains filtered or unexported fields
}

type Security struct {
	// Profile selects the security posture. Empty resolves to
	// SecurityProfileAPI via DefaultSecurity()/Defaults() — see the fail-safe
	// note on Validate().
	Profile SecurityProfile `` /* 152-byte string literal not displayed */
	// CSRF configures the double-submit-cookie token names. Only consulted
	// when Profile is browser.
	CSRF CSRF `conf:"csrf" json:"csrf"`
	// Cookie configures SameSite/Secure defaults for any cookie the browser
	// profile sets (the CSRF cookie today; a product's own session cookie
	// should follow the same defaults). Only consulted when Profile is
	// browser.
	Cookie CookieDefaults `conf:"cookie" json:"cookie"`
	// CSP overrides the Content-Security-Policy value applied by the browser
	// profile's header chain. Empty uses a conservative built-in default
	// (kernel/httpx.SecurityChain's browserCSPDefault). Only applied when
	// Profile is browser — the API profile keeps httpx.SecureHeaders'
	// existing "frame-ancestors 'none'" default untouched.
	CSP string `conf:"csp" json:"csp" doc:"Content-Security-Policy value for the browser profile; empty uses the built-in HTML-safe default"`
}

type SecurityProfile string

type SharedSection struct {
	Environment   Env `json:"environment"`
	SchemaVersion int `json:"schema_version"`
	DB            DB  `json:"db"`
}

type Telemetry struct {
	TraceSampleRatio float64 `` /* 176-byte string literal not displayed */
}

type Webhook struct {
	Outbound WebhookOutbound `conf:"outbound" json:"outbound"`
}

type WebhookOutbound struct {
	SSRFProtectionDisabled bool     `` /* 197-byte string literal not displayed */
	AllowedHosts           []string `` /* 150-byte string literal not displayed */
	AllowedCIDRs           []string `` /* 131-byte string literal not displayed */
}