forgepb

type AuthConfig struct {

	// Whether authentication is required for this service by default.
	AuthRequired bool `protobuf:"varint,1,opt,name=auth_required,json=authRequired,proto3" json:"auth_required,omitempty"`
	// Authentication provider identifier (e.g., "jwt", "api_key", "oauth2").
	AuthProvider string `protobuf:"bytes,2,opt,name=auth_provider,json=authProvider,proto3" json:"auth_provider,omitempty"`
	// contains filtered or unexported fields
}

type BinaryConfigOptions struct {

	// Binary is the cmd/<name> leaf whose process loads this config — the same
	// name `forge scaffold binary` creates and the deploy layer names its
	// workload after. A message annotated with a binary that has no cmd/<name>
	// directory is a generate-time error, not a silently unused config.
	Binary string `protobuf:"bytes,1,opt,name=binary,proto3" json:"binary,omitempty"`
	// Command is the cobra command path BELOW the binary whose process loads
	// this config, one command name per element: ["server", "api"] for
	// `reliant server api`. Empty binds the binary's root config. Two
	// messages may not bind the same (binary, command).
	//
	// forge validates the SHAPE at generate time (each element one command
	// name: non-empty, no whitespace, not a flag) but cannot prove the path
	// exists there: a cobra tree is assembled at runtime by AddCommand calls in
	// any package, from `Use` strings that may be computed, so a static scan
	// would be a guess that is wrong in both directions — and a wrong refusal
	// blocks generate. The exact check runs where the tree is real: the
	// generated Load<Msg>(cmd) refuses a command whose path is not this one.
	Command []string `protobuf:"bytes,2,rep,name=command,proto3" json:"command,omitempty"`
	// contains filtered or unexported fields
}

type ConfigFieldOptions struct {

	// Environment variable name to read this field from (e.g., "DATABASE_URL").
	// A variable set to "" counts as unset, whatever the field's type: the file
	// or default value stands. An explicitly empty value is a flag's to set.
	EnvVar string `protobuf:"bytes,1,opt,name=env_var,json=envVar,proto3" json:"env_var,omitempty"`
	// CLI flag name, without leading dashes (e.g., "database-url").
	Flag string `protobuf:"bytes,2,opt,name=flag,proto3" json:"flag,omitempty"`
	// Default value as a string. Applied when neither env var nor flag is set.
	DefaultValue string `protobuf:"bytes,3,opt,name=default_value,json=defaultValue,proto3" json:"default_value,omitempty"`
	// Whether this field must be provided. Startup fails if missing.
	Required bool `protobuf:"varint,4,opt,name=required,proto3" json:"required,omitempty"`
	// Human-readable description shown in --help output and documentation.
	Description string `protobuf:"bytes,5,opt,name=description,proto3" json:"description,omitempty"`
	// Sensitive marks this field as secret — its value MUST come from a
	// Kubernetes Secret (or equivalent) rather than a literal env-var, and
	// it is never written to forge.yaml inline. The deploy generator emits
	// a `secretKeyRef`-shaped EnvVar referencing a project-level Secret
	// (default name: <project>-secrets, key: <env_var>).
	Sensitive bool `protobuf:"varint,6,opt,name=sensitive,proto3" json:"sensitive,omitempty"`
	// Category groups related fields for KCL emission. Fields with the same
	// category are rendered together as a single env-var group (e.g.
	// category: "stripe" → STRIPE_ENV bundle). Empty category lands the
	// field in the default APP_ENV bundle.
	Category string `protobuf:"bytes,7,opt,name=category,proto3" json:"category,omitempty"`
	// Role tags a field with a SEMANTIC meaning that drives behavior, so
	// forge/pkg/config can offer annotation-driven helpers without matching
	// on the field's NAME. Renaming a field never changes behavior — the
	// behavior follows the annotation. Naming a field "environment" without
	// the annotation does NOT make it the mode field.
	Role ConfigFieldRole `protobuf:"varint,8,opt,name=role,proto3,enum=forge.v1.ConfigFieldRole" json:"role,omitempty"`
	// AllowedValues constrains a STRING field to a closed set of valid
	// values, validated at startup by config.Validate. It is the
	// type/annotation-driven replacement for the old name-matched log-format
	// check ("json"/"text"): a string field carrying allowed_values is a
	// string ENUM, rejected when its resolved value is outside the set. The
	// empty value is always permitted (an unset, non-required field). True
	// proto enum fields don't need this — protoreflect already enforces their
	// domain. Renaming the field changes nothing; the set follows the
	// annotation.
	AllowedValues []string `protobuf:"bytes,9,rep,name=allowed_values,json=allowedValues,proto3" json:"allowed_values,omitempty"`
	// Optional marks a field the application TOLERATES being unset, and it is
	// the only way a `sensitive` field is allowed to have no value.
	//
	// WHY sensitive IMPLIES REQUIRED BY DEFAULT. A sensitive field projects to
	// a secret_ref, and forge validates every declared ref against the env's
	// store before anything starts (secrets.ValidateDeclaredRefs). That check
	// exists because the alternative — discovering a missing production
	// credential at runtime — is the failure it was built to prevent, so
	// "declared but absent" must be an error by default.
	//
	// But an OPTIONAL-BY-DESIGN credential is a real thing, and forge had no
	// way to say so. The case that forced this: a config block whose
	// admin_user + admin_password are documented as the tier's ON SWITCH —
	// with either unset the reconciler is deliberately not registered. Every
	// non-sensitive field in that block projects as `str = ""` and unset is
	// fine; only the sensitive one became a hard startup requirement, so an
	// environment that had deliberately not enabled the tier could not start
	// at all. The operator's only recourse was to invent a fake value, which
	// puts a real-looking credential in the store and defeats the check for
	// everyone.
	//
	// So: `optional: true` says the absence is intended. The secret-store
	// validation skips the field, and the runtime required-check skips it too.
	// It is deliberately an OPT-IN — the safe default stays "a declared secret
	// must have a value", and an author has to state the exception.
	//
	// It is an ERROR to set both `required: true` and `optional: true`; they
	// are direct contradictions and forge rejects the pair rather than
	// silently picking one.
	Optional bool `protobuf:"varint,10,opt,name=optional,proto3" json:"optional,omitempty"`
	// EnvVarAliases are further environment variables the field is read from,
	// in order, when env_var is unset: the first one set wins, and a variable
	// set to "" counts as unset, exactly as for env_var. A flag still beats
	// all of them.
	//
	//   string environment = 1 [(forge.v1.config) = {
	//     env_var: "RELIANT_ENV"
	//     env_var_aliases: [{name: "NODE_ENV"}]
	//   }];
	//   int32 port = 2 [(forge.v1.config) = {
	//     env_var: "DAEMON_LISTEN_PORT"
	//     env_var_aliases: [{name: "TOOLS_DAEMON_PORT", deprecated: true}]
	//   }];
	//
	// An alias is for a SETTER forge does not control: a convention another
	// tool owns (NODE_ENV), or an older name a deployment elsewhere still
	// exports. forge's own setters use env_var alone — the KCL env map and the
	// secret store key name only the primary — so every manifest forge renders
	// converges on one name. A flag's --help lists env_var and the permanent
	// aliases; a deprecated alias is never advertised.
	//
	// Aliases need env_var, are read only from the environment, and must not
	// repeat any env var or alias another field of the same process reads;
	// `forge generate` refuses each of those. A frontend config field takes
	// no aliases: its values come from the rendered config document, not
	// from an environment.
	EnvVarAliases []*EnvVarAlias `protobuf:"bytes,11,rep,name=env_var_aliases,json=envVarAliases,proto3" json:"env_var_aliases,omitempty"`
	// contains filtered or unexported fields
}

type ConfigFieldRole int32

type EntityOptions struct {

	// Database table name. Inferred from the message name (snake_case, pluralized)
	// when left empty.
	Table string `protobuf:"bytes,1,opt,name=table,proto3" json:"table,omitempty"`
	// Enable soft-delete semantics (adds a deleted_at column).
	SoftDelete bool `protobuf:"varint,2,opt,name=soft_delete,json=softDelete,proto3" json:"soft_delete,omitempty"`
	// Automatically manage created_at and updated_at timestamp columns.
	Timestamps bool `protobuf:"varint,3,opt,name=timestamps,proto3" json:"timestamps,omitempty"`
	// Composite or single-column indexes to create on this table.
	Indexes []*IndexDef `protobuf:"bytes,4,rep,name=indexes,proto3" json:"indexes,omitempty"`
	// Contract middleware to wire around generated repository methods.
	// Supported values: "tracing", "metrics", "logging".
	Middleware []string `protobuf:"bytes,5,rep,name=middleware,proto3" json:"middleware,omitempty"`
	// contains filtered or unexported fields
}

type EnvVarAlias struct {

	// Name is the environment variable, e.g. "NODE_ENV".
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Deprecated marks a name kept only so existing setters keep working
	// while they move to env_var. A process that finds it set prints one
	// line to stderr at load naming env_var, whether the alias supplied the
	// value or was shadowed by an earlier name. A permanent alias (the
	// default) is read silently: NODE_ENV is somebody else's convention, not
	// a migration in flight, and a notice at every start would be noise.
	Deprecated bool `protobuf:"varint,2,opt,name=deprecated,proto3" json:"deprecated,omitempty"`
	// contains filtered or unexported fields
}

type FieldOptions struct {

	// Mark this field as the primary key.
	Pk bool `protobuf:"varint,1,opt,name=pk,proto3" json:"pk,omitempty"`
	// How to store complex or non-scalar types in the database.
	Store StoreAs `protobuf:"varint,3,opt,name=store,proto3,enum=forge.v1.StoreAs" json:"store,omitempty"`
	// Foreign key reference in "table.column" format (e.g., "users.id").
	Ref string `protobuf:"bytes,4,opt,name=ref,proto3" json:"ref,omitempty"`
	// Column has a UNIQUE constraint.
	Unique bool `protobuf:"varint,5,opt,name=unique,proto3" json:"unique,omitempty"`
	// Create a single-column index on this field.
	Index bool `protobuf:"varint,6,opt,name=index,proto3" json:"index,omitempty"`
	// SQL default expression (e.g., "0", "'active'", "NOW()").
	DefaultValue string `protobuf:"bytes,7,opt,name=default_value,json=defaultValue,proto3" json:"default_value,omitempty"`
	// Skip this field in code generation entirely.
	Skip bool `protobuf:"varint,8,opt,name=skip,proto3" json:"skip,omitempty"`
	// Application-layer validation rules for this field.
	Validate *ValidationRules `protobuf:"bytes,9,opt,name=validate,proto3" json:"validate,omitempty"`
	// Field cannot be updated after initial creation.
	Immutable bool `protobuf:"varint,10,opt,name=immutable,proto3" json:"immutable,omitempty"`
	// contains filtered or unexported fields
}

type FrontendConfigOptions struct {

	// Frontend is the forge.yaml `frontends[].name` whose bundle loads this
	// config — the same name `forge scaffold frontend` creates. A message
	// annotated with a frontend that no forge.yaml declares is a
	// generate-time error, not a silently unused config.
	Frontend string `protobuf:"bytes,1,opt,name=frontend,proto3" json:"frontend,omitempty"`
	// contains filtered or unexported fields
}

type IndexDef struct {

	// Index name. Auto-generated from field names when left empty.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Column names included in this index, in order.
	Fields []string `protobuf:"bytes,2,rep,name=fields,proto3" json:"fields,omitempty"`
	// Whether this index enforces a uniqueness constraint.
	Unique bool `protobuf:"varint,3,opt,name=unique,proto3" json:"unique,omitempty"`
	// contains filtered or unexported fields
}

type MethodOptions struct {

	// Whether this method requires authentication. Optional so the default
	// (fail-closed: auth required) is distinguishable from an explicit
	// `auth_required = false` opt-out at the proto level.
	// Overrides the service-level AuthConfig.auth_required default.
	AuthRequired *bool `protobuf:"varint,1,opt,name=auth_required,json=authRequired,proto3,oneof" json:"auth_required,omitempty"`
	// Whether this method is idempotent (safe to retry without side effects).
	Idempotent bool `protobuf:"varint,3,opt,name=idempotent,proto3" json:"idempotent,omitempty"`
	// Server-side timeout for this method. Zero means use the service default.
	Timeout *durationpb.Duration `protobuf:"bytes,4,opt,name=timeout,proto3" json:"timeout,omitempty"`
	// Whether callers should supply an idempotency key for this method.
	// This is a convention marker — Forge does not enforce or inspect the key.
	// When set, tooling, docs, and generated clients advise callers to pass a
	// unique key (e.g., an Idempotency-Key header) so the server can safely
	// deduplicate retried mutations.
	IdempotencyKey bool `protobuf:"varint,5,opt,name=idempotency_key,json=idempotencyKey,proto3" json:"idempotency_key,omitempty"`
	// Declared Connect/gRPC error codes this method can return. Codegen
	// surfaces these so handler authors (and LLMs implementing handlers)
	// can see the typed error contract at a glance. Values match
	// connect.Code names — e.g. "NotFound", "PermissionDenied",
	// "InvalidArgument". Empty (or unset) means "no declared errors" — the
	// method either succeeds or returns an undeclared Connect.Code.
	//
	// The list is informational at runtime today; future work may enforce
	// that handlers can only return declared codes.
	Errors []string `protobuf:"bytes,6,rep,name=errors,proto3" json:"errors,omitempty"`
	// contains filtered or unexported fields
}

type ServiceOptions struct {

	// Human-readable service name used in code generation and logging.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// API version string (e.g., "v1", "v2beta1").
	Version string `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"`
	// Brief description of the service's purpose.
	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	// Controls how the service is exposed.
	Visibility ServiceVisibility `protobuf:"varint,4,opt,name=visibility,proto3,enum=forge.v1.ServiceVisibility" json:"visibility,omitempty"`
	// Other services this service depends on (for dependency injection).
	Dependencies []string `protobuf:"bytes,5,rep,name=dependencies,proto3" json:"dependencies,omitempty"`
	// Authentication configuration for the service.
	Auth *AuthConfig `protobuf:"bytes,6,opt,name=auth,proto3" json:"auth,omitempty"`
	// The trust domain whose callers this service serves: "user" (the
	// default, when empty) for the product's own signed-in users, or a name
	// the project chooses for another kind of caller ("daemon", "operator").
	// A serverkit.Listener refuses to start when it mounts a service whose
	// audience differs from its chain's Authenticator.Audience(), so a
	// listener authenticating one kind of caller can never serve another
	// kind's RPCs.
	Audience string `protobuf:"bytes,7,opt,name=audience,proto3" json:"audience,omitempty"`
	// contains filtered or unexported fields
}

type ServiceVisibility int32

type StoreAs int32

type ValidationRules struct {

	// Field value is required (must be non-zero-value).
	Required bool `protobuf:"varint,1,opt,name=required,proto3" json:"required,omitempty"`
	// Minimum length for string fields.
	MinLength int32 `protobuf:"varint,2,opt,name=min_length,json=minLength,proto3" json:"min_length,omitempty"`
	// Maximum length for string fields.
	MaxLength int32 `protobuf:"varint,3,opt,name=max_length,json=maxLength,proto3" json:"max_length,omitempty"`
	// Regex pattern the value must match.
	Pattern string `protobuf:"bytes,4,opt,name=pattern,proto3" json:"pattern,omitempty"`
	// Semantic format constraint (e.g., "email", "url", "uuid", "ip").
	Format string `protobuf:"bytes,5,opt,name=format,proto3" json:"format,omitempty"`
	// Minimum value for numeric fields.
	Min float64 `protobuf:"fixed64,6,opt,name=min,proto3" json:"min,omitempty"`
	// Maximum value for numeric fields.
	Max float64 `protobuf:"fixed64,7,opt,name=max,proto3" json:"max,omitempty"`
	// Allowed values (for enum-like string fields).
	AllowedValues []string `protobuf:"bytes,8,rep,name=allowed_values,json=allowedValues,proto3" json:"allowed_values,omitempty"`
	// Custom validation function name to call during validation.
	Custom string `protobuf:"bytes,9,opt,name=custom,proto3" json:"custom,omitempty"`
	// contains filtered or unexported fields
}