forgepb

type AuthConfig struct {

	// Whether authentication is required for this service by default.
	AuthRequired bool `protobuf:"varint,1,opt,name=auth_required,json=authRequired,proto3" json:"auth_required,omitempty"`
	// Authentication provider identifier (e.g., "jwt", "api_key", "oauth2").
	AuthProvider string `protobuf:"bytes,2,opt,name=auth_provider,json=authProvider,proto3" json:"auth_provider,omitempty"`
	// contains filtered or unexported fields
}

type ConfigFieldOptions struct {

	// Environment variable name to read this field from (e.g., "DATABASE_URL").
	EnvVar string `protobuf:"bytes,1,opt,name=env_var,json=envVar,proto3" json:"env_var,omitempty"`
	// CLI flag name, without leading dashes (e.g., "database-url").
	Flag string `protobuf:"bytes,2,opt,name=flag,proto3" json:"flag,omitempty"`
	// Default value as a string. Applied when neither env var nor flag is set.
	DefaultValue string `protobuf:"bytes,3,opt,name=default_value,json=defaultValue,proto3" json:"default_value,omitempty"`
	// Whether this field must be provided. Startup fails if missing.
	Required bool `protobuf:"varint,4,opt,name=required,proto3" json:"required,omitempty"`
	// Human-readable description shown in --help output and documentation.
	Description string `protobuf:"bytes,5,opt,name=description,proto3" json:"description,omitempty"`
	// Sensitive marks this field as secret — its value MUST come from a
	// Kubernetes Secret (or equivalent) rather than a literal env-var, and
	// it is never written to forge.yaml inline. The deploy generator emits
	// a `secretKeyRef`-shaped EnvVar referencing a project-level Secret
	// (default name: <project>-secrets, key: <env_var>).
	Sensitive bool `protobuf:"varint,6,opt,name=sensitive,proto3" json:"sensitive,omitempty"`
	// Category groups related fields for KCL emission. Fields with the same
	// category are rendered together as a single env-var group (e.g.
	// category: "stripe" → STRIPE_ENV bundle). Empty category lands the
	// field in the default APP_ENV bundle.
	Category string `protobuf:"bytes,7,opt,name=category,proto3" json:"category,omitempty"`
	// Role tags a field with a SEMANTIC meaning that drives behavior, so
	// forge/pkg/config can offer annotation-driven helpers without matching
	// on the field's NAME. Renaming a field never changes behavior — the
	// behavior follows the annotation. Naming a field "environment" without
	// the annotation does NOT make it the mode field.
	Role ConfigFieldRole `protobuf:"varint,8,opt,name=role,proto3,enum=forge.v1.ConfigFieldRole" json:"role,omitempty"`
	// AllowedValues constrains a STRING field to a closed set of valid
	// values, validated at startup by config.Validate. It is the
	// type/annotation-driven replacement for the old name-matched log-format
	// check ("json"/"text"): a string field carrying allowed_values is a
	// string ENUM, rejected when its resolved value is outside the set. The
	// empty value is always permitted (an unset, non-required field). True
	// proto enum fields don't need this — protoreflect already enforces their
	// domain. Renaming the field changes nothing; the set follows the
	// annotation.
	AllowedValues []string `protobuf:"bytes,9,rep,name=allowed_values,json=allowedValues,proto3" json:"allowed_values,omitempty"`
	// contains filtered or unexported fields
}

type ConfigFieldRole int32

type EntityOptions struct {

	// Database table name. Inferred from the message name (snake_case, pluralized)
	// when left empty.
	Table string `protobuf:"bytes,1,opt,name=table,proto3" json:"table,omitempty"`
	// Enable soft-delete semantics (adds a deleted_at column).
	SoftDelete bool `protobuf:"varint,2,opt,name=soft_delete,json=softDelete,proto3" json:"soft_delete,omitempty"`
	// Automatically manage created_at and updated_at timestamp columns.
	Timestamps bool `protobuf:"varint,3,opt,name=timestamps,proto3" json:"timestamps,omitempty"`
	// Composite or single-column indexes to create on this table.
	Indexes []*IndexDef `protobuf:"bytes,4,rep,name=indexes,proto3" json:"indexes,omitempty"`
	// Contract middleware to wire around generated repository methods.
	// Supported values: "tracing", "metrics", "logging".
	Middleware []string `protobuf:"bytes,5,rep,name=middleware,proto3" json:"middleware,omitempty"`
	// contains filtered or unexported fields
}

type FieldOptions struct {

	// Mark this field as the primary key.
	Pk bool `protobuf:"varint,1,opt,name=pk,proto3" json:"pk,omitempty"`
	// Mark this field as the tenant key for row-level isolation in
	// multi-tenant schemas.
	Tenant bool `protobuf:"varint,2,opt,name=tenant,proto3" json:"tenant,omitempty"`
	// How to store complex or non-scalar types in the database.
	Store StoreAs `protobuf:"varint,3,opt,name=store,proto3,enum=forge.v1.StoreAs" json:"store,omitempty"`
	// Foreign key reference in "table.column" format (e.g., "users.id").
	Ref string `protobuf:"bytes,4,opt,name=ref,proto3" json:"ref,omitempty"`
	// Column has a UNIQUE constraint.
	Unique bool `protobuf:"varint,5,opt,name=unique,proto3" json:"unique,omitempty"`
	// Create a single-column index on this field.
	Index bool `protobuf:"varint,6,opt,name=index,proto3" json:"index,omitempty"`
	// SQL default expression (e.g., "0", "'active'", "NOW()").
	DefaultValue string `protobuf:"bytes,7,opt,name=default_value,json=defaultValue,proto3" json:"default_value,omitempty"`
	// Skip this field in code generation entirely.
	Skip bool `protobuf:"varint,8,opt,name=skip,proto3" json:"skip,omitempty"`
	// Application-layer validation rules for this field.
	Validate *ValidationRules `protobuf:"bytes,9,opt,name=validate,proto3" json:"validate,omitempty"`
	// Field cannot be updated after initial creation.
	Immutable bool `protobuf:"varint,10,opt,name=immutable,proto3" json:"immutable,omitempty"`
	// contains filtered or unexported fields
}

type IndexDef struct {

	// Index name. Auto-generated from field names when left empty.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Column names included in this index, in order.
	Fields []string `protobuf:"bytes,2,rep,name=fields,proto3" json:"fields,omitempty"`
	// Whether this index enforces a uniqueness constraint.
	Unique bool `protobuf:"varint,3,opt,name=unique,proto3" json:"unique,omitempty"`
	// contains filtered or unexported fields
}

type MethodOptions struct {

	// Whether this method requires authentication. Optional so the default
	// (fail-closed: auth required) is distinguishable from an explicit
	// `auth_required = false` opt-out at the proto level.
	// Overrides the service-level AuthConfig.auth_required default.
	AuthRequired *bool `protobuf:"varint,1,opt,name=auth_required,json=authRequired,proto3,oneof" json:"auth_required,omitempty"`
	// Whether this method is idempotent (safe to retry without side effects).
	Idempotent bool `protobuf:"varint,3,opt,name=idempotent,proto3" json:"idempotent,omitempty"`
	// Server-side timeout for this method. Zero means use the service default.
	Timeout *durationpb.Duration `protobuf:"bytes,4,opt,name=timeout,proto3" json:"timeout,omitempty"`
	// Whether callers should supply an idempotency key for this method.
	// This is a convention marker — Forge does not enforce or inspect the key.
	// When set, tooling, docs, and generated clients advise callers to pass a
	// unique key (e.g., an Idempotency-Key header) so the server can safely
	// deduplicate retried mutations.
	IdempotencyKey bool `protobuf:"varint,5,opt,name=idempotency_key,json=idempotencyKey,proto3" json:"idempotency_key,omitempty"`
	// Declared Connect/gRPC error codes this method can return. Codegen
	// surfaces these so handler authors (and LLMs implementing handlers)
	// can see the typed error contract at a glance. Values match
	// connect.Code names — e.g. "NotFound", "PermissionDenied",
	// "InvalidArgument". Empty (or unset) means "no declared errors" — the
	// method either succeeds or returns an undeclared Connect.Code.
	//
	// The list is informational at runtime today; future work may enforce
	// that handlers can only return declared codes.
	Errors []string `protobuf:"bytes,6,rep,name=errors,proto3" json:"errors,omitempty"`
	// Per-method authorization role allow-list. The caller must hold AT LEAST
	// ONE of these roles for the call to be authorized (any-of semantics).
	// Role implication is applied by pkg/authz at decision time (e.g. "admin"
	// implies "user" when an implication map is configured), so listing only
	// the least-privileged sufficient role is the idiom.
	//
	// Presence is what the authz completeness lint checks: a method that sets
	// required_roles (even to a single role) is "explicitly authorized". A
	// method that wants any-authenticated access with NO role restriction must
	// say so explicitly via the `authz_public` marker below — an empty
	// required_roles is treated as "unannotated" and fails the lint, so a
	// method can never silently default to open. When absent, the service's
	// (forge.v1.service).default_roles applies; if neither is set the lint
	// fails the build naming the method.
	RequiredRoles []string `protobuf:"bytes,7,rep,name=required_roles,json=requiredRoles,proto3" json:"required_roles,omitempty"`
	// Marks a method as intentionally reachable by ANY caller the auth layer
	// admits, with no role restriction (e.g. a health check or a public read).
	// This is the explicit, greppable opt-out that satisfies the authz
	// completeness lint without granting it by accident: a method is "open"
	// only when an author typed `authz_public = true`, never by omission.
	// Mutually exclusive with required_roles (setting both fails the lint).
	AuthzPublic bool `protobuf:"varint,8,opt,name=authz_public,json=authzPublic,proto3" json:"authz_public,omitempty"`
	// Marks a method whose authorization is performed by a HAND-WRITTEN
	// per-service authorizer (middleware.Authorizer), not by the shared
	// descriptor RoleInterceptor. Use this ONLY when the decision is genuinely
	// not expressible as a role allow-list — e.g. it gates on a specific
	// subject/identity, a per-request resource scope, or an out-of-band
	// (client-only / reverse-proxied) RPC the local server never serves.
	//
	// It is the explicit, greppable escape that satisfies the authz
	// completeness lint for such methods: the build accepts the method as
	// "intentionally custom-authorized" instead of forcing a role annotation
	// that would mis-state the real policy. It grants NOTHING — pkg/authz's
	// descriptor policy builder still leaves the method OUT of the shared
	// RolePolicy, so if such a method is ever routed through the shared
	// RoleInterceptor it fail-closes (denied). The service must keep its own
	// authorizer (and, when served, route through it) — this marker only
	// records that the proto deliberately delegates the decision to code.
	//
	// Mutually exclusive with required_roles and authz_public (setting more
	// than one fails the lint).
	AuthzCustom bool `protobuf:"varint,9,opt,name=authz_custom,json=authzCustom,proto3" json:"authz_custom,omitempty"`
	// contains filtered or unexported fields
}

type ServiceOptions struct {

	// Human-readable service name used in code generation and logging.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// API version string (e.g., "v1", "v2beta1").
	Version string `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"`
	// Brief description of the service's purpose.
	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	// Controls how the service is exposed.
	Visibility ServiceVisibility `protobuf:"varint,4,opt,name=visibility,proto3,enum=forge.v1.ServiceVisibility" json:"visibility,omitempty"`
	// Other services this service depends on (for dependency injection).
	Dependencies []string `protobuf:"bytes,5,rep,name=dependencies,proto3" json:"dependencies,omitempty"`
	// Authentication configuration for the service.
	Auth *AuthConfig `protobuf:"bytes,6,opt,name=auth,proto3" json:"auth,omitempty"`
	// Service-wide default authorization roles. A method that declares no
	// (forge.v1.method).required_roles inherits this list: the caller must
	// hold at least one of these roles. An empty list here means "no service
	// default" — every method must then declare its own required_roles (the
	// authz completeness lint enforces exactly this, so a method can never
	// silently default to open). See pkg/authz and the `auth` skill.
	DefaultRoles []string `protobuf:"bytes,7,rep,name=default_roles,json=defaultRoles,proto3" json:"default_roles,omitempty"`
	// contains filtered or unexported fields
}

type ServiceVisibility int32

type StoreAs int32

type ValidationRules struct {

	// Field value is required (must be non-zero-value).
	Required bool `protobuf:"varint,1,opt,name=required,proto3" json:"required,omitempty"`
	// Minimum length for string fields.
	MinLength int32 `protobuf:"varint,2,opt,name=min_length,json=minLength,proto3" json:"min_length,omitempty"`
	// Maximum length for string fields.
	MaxLength int32 `protobuf:"varint,3,opt,name=max_length,json=maxLength,proto3" json:"max_length,omitempty"`
	// Regex pattern the value must match.
	Pattern string `protobuf:"bytes,4,opt,name=pattern,proto3" json:"pattern,omitempty"`
	// Semantic format constraint (e.g., "email", "url", "uuid", "ip").
	Format string `protobuf:"bytes,5,opt,name=format,proto3" json:"format,omitempty"`
	// Minimum value for numeric fields.
	Min float64 `protobuf:"fixed64,6,opt,name=min,proto3" json:"min,omitempty"`
	// Maximum value for numeric fields.
	Max float64 `protobuf:"fixed64,7,opt,name=max,proto3" json:"max,omitempty"`
	// Allowed values (for enum-like string fields).
	AllowedValues []string `protobuf:"bytes,8,rep,name=allowed_values,json=allowedValues,proto3" json:"allowed_values,omitempty"`
	// Custom validation function name to call during validation.
	Custom string `protobuf:"bytes,9,opt,name=custom,proto3" json:"custom,omitempty"`
	// contains filtered or unexported fields
}