project

type API struct {
	Name        string `` /* 136-byte string literal not displayed */
	Version     string `yaml:"version,omitempty" json:"version,omitempty" jsonschema_description:"API version segment, for example v1."`
	BasePath    string `` /* 130-byte string literal not displayed */
	Description string `yaml:"description,omitempty" json:"description,omitempty" jsonschema_description:"What this API is for."`
	// Permissions decides whether generated handlers check one.
	//
	// derived, the default, gives every endpoint a permission taken from its
	// resource and its operation — note.read, note.write, note.delete — and
	// generates the check. An authenticated caller with no grants then reaches
	// nothing, which is the right posture and a real behaviour change for a
	// project that had none.
	//
	// none generates no checks, for a project with no authorization at all.
	// `public:` on a resource or an endpoint is the per-endpoint escape hatch and
	// works either way.
	Permissions PermissionMode `` /* 226-byte string literal not displayed */

	SearchMethod SearchMethod `` /* 210-byte string literal not displayed */

	// RevisionHeader carries the revision a client was built against, and the
	// one the server was generated from on the way back.
	//
	// It is configurable because it is a name in a namespace rig does not own:
	// a gateway in front of the server may already mean something else by it.
	RevisionHeader string `` /* 170-byte string literal not displayed */

	// OpenAPI says whether the generated document is a route as well as a file.
	OpenAPI APIOpenAPI `` /* 162-byte string literal not displayed */
}

type APIOpenAPI struct {
	// Serve mounts the document beside the routes it describes, at
	// <base_path>/openapi.json and <base_path>/openapi.yaml.
	//
	// Nothing else to write. An embed directive resolves against the directory of
	// the file it is written in and cannot climb out of it, and the document is
	// written to the openapi generator's out_dir rather than beside the router —
	// so that generator writes the embed beside the document, in a package of its
	// own, and the router imports it at `project.module` joined to that out_dir
	// read from the module root, which the nearest go.mod is what locates.
	//
	// What it costs is that the directory becomes a Go package: its name has to
	// be one Go would accept, and it has to be inside the module the router is
	// generated into. RIG3011 is where both are said.
	Serve bool `` /* 221-byte string literal not displayed */
}

type Auth struct {
	// Enabled says this project authenticates its callers.
	//
	// Off by default, and deliberately explicit: a project with an `auth:` block
	// it never turned on is easier to spot than one that started mounting a
	// sign-in endpoint because a file appeared. It is what makes `server-go`
	// write the wiring at all, and everything else in this block is read only
	// when it is set.
	Enabled bool `` /* 185-byte string literal not displayed */

	// BasePath prefixes the endpoints. The provider routes sit under it, at
	// <base>/oauth/{provider}/start.
	BasePath string `` /* 144-byte string literal not displayed */

	Tenant    AuthTenant    `yaml:"tenant,omitempty" json:"tenant,omitempty" jsonschema_description:"How a request names the tenant it is for."`
	Session   AuthSession   `` /* 126-byte string literal not displayed */
	EmailCode AuthEmailCode `` /* 192-byte string literal not displayed */
	Limits    AuthLimits    `` /* 138-byte string literal not displayed */

	// AllowTenantCreation mounts POST <base>/tenants, where somebody signed in
	// makes one and becomes its Owner. The policy — who may, what a name may be,
	// what else a new tenant needs — stays in Go, because each of those is a
	// function.
	AllowTenantCreation bool `` /* 201-byte string literal not displayed */

	// RequireVerifiedEmail refuses a sign-in until the address is verified.
	RequireVerifiedEmail bool `` /* 158-byte string literal not displayed */

	// AllowedIdentityDomains restricts who may become a person in this
	// deployment. Empty, the default, restricts nobody.
	//
	// It is the declarative half of `AllowIdentity` on the generated Hooks, and
	// it generates one: a gate that refuses a stranger whose address is outside
	// the list, on every door at once — a provider sign-in and a mailed code
	// alike. An application that sets the hook itself wins wholesale, because
	// two rules merged is a rule nobody can read.
	//
	// Two things about it that are not obvious from the name.
	//
	// It is **not** `rig_tenant.allowed_email_domains`, which is a different
	// question at a different time: that one governs whether somebody may hold
	// an account in a particular tenant, and it is per tenant and set at
	// runtime. This one governs whether they may exist here at all, and a
	// sign-in that names no tenant — the ordinary browser flow — never reaches
	// the other.
	//
	// And an administrator is not asked. An invitation or a direct provision
	// goes through whatever this says, because somebody who is already here
	// typed that address in, and a deployment that could not invite an auditor
	// or a contractor would be one nobody could run.
	AllowedIdentityDomains []string `` /* 440-byte string literal not displayed */

	// TrustedProxies are the networks whose X-Forwarded-For may be believed.
	//
	// Empty means none, and that is deliberate: an address read from a header a
	// client controls is an address a client chooses, and a rate limit keyed on
	// one is a rate limit an attacker walks around.
	TrustedProxies []string `` /* 192-byte string literal not displayed */

	// LogRetention is how long an entry in rig_auth_log is kept. Zero, the
	// default, keeps everything.
	//
	// Keeping everything is the honest default rather than the good one: nothing
	// prunes this table today, and the alternative — rig choosing a window — would
	// be rig deciding how long somebody's compliance obligation runs.
	//
	// It cannot be shorter than the longest rate limit window, and that is refused
	// rather than clamped. This table is what the limiter counts, so deleting rows
	// inside a window clears the lockout they were adding up to: a limiter that
	// silently stops limiting, which is the failure nobody notices until it is
	// being exploited.
	LogRetention Duration `` /* 285-byte string literal not displayed */

	OAuth AuthOAuth `` /* 144-byte string literal not displayed */

	// Expose names foundation tables to generate for anyway.
	//
	// It adds the model, the repository and whatever API the table's
	// configuration asks for — for an administration screen listing the people
	// in a tenant, most often. `rig setup-project --expose rig_account` writes the
	// configuration to go with it.
	//
	// It changes nothing about authentication: the auth package still reaches
	// these tables through its own queries, and a generated repository beside
	// them is a second door into the same rows, which is exactly why the
	// scaffolded configuration keeps `rig_account` free of a Create.
	Expose []string `` /* 143-byte string literal not displayed */

	// Own treats the foundation as ordinary tables and generates for all of it.
	//
	// For a project that has taken the schema over — forked the migrations,
	// stopped importing rig/auth, and now maintains the tables itself. It is a
	// one-way door in practice: the generated repositories will not enforce what
	// the auth package enforces, so a password reaching a table through one of
	// them is a password nobody hashed.
	Own bool `` /* 176-byte string literal not displayed */
}

type AuthEmailCode struct {
	// Enabled mounts POST <base>/email-code and POST <base>/email-code/verify.
	// Off means the routes do not exist rather than answering 403, so there is
	// nothing to probe.
	Enabled bool `` /* 140-byte string literal not displayed */

	// Length is how many digits. Default 6.
	Length int `` /* 248-byte string literal not displayed */
	// TTL is how long a code lasts. Default 10m.
	TTL Duration `` /* 131-byte string literal not displayed */
	// MaxAttempts is how many wrong guesses kill a code. Default 3.
	//
	// A ceiling on one code, not a rate limit on an address, and the two are not
	// substitutes: a limit counts failures over a rolling window, so a fresh
	// code would arrive with the old code's failures still against it and five
	// mistypes would lock the address rather than killing one code.
	MaxAttempts int `` /* 330-byte string literal not displayed */

	// AllowProvisioning sends a code to an address rig has never seen, creating
	// the person when the code is asked for.
	//
	// Off by default, which makes the deployment invite-only: a code goes only
	// to an address that already has an identity. On, it is self-registration,
	// and `auth.oauth.allow_provisioning` is the same decision for the other
	// door.
	AllowProvisioning bool `` /* 234-byte string literal not displayed */
}

type AuthLimit struct {
	Max    int      `yaml:"max,omitempty" json:"max,omitempty" jsonschema:"minimum=1" jsonschema_description:"How many are allowed in one window."`
	Window Duration `yaml:"window,omitempty" json:"window,omitempty" jsonschema_description:"How long the window is."`
}

type AuthLimits struct {
	// LoginByEmail locks one account after a handful of wrong codes.
	// Default 5 per 15m, cleared by a success.
	LoginByEmail AuthLimit `` /* 173-byte string literal not displayed */
	// LoginByIP throttles one source spraying many accounts. Default 50 per 15m.
	//
	// Deliberately looser than the address limit and deliberately not cleared by
	// a success: an email-only limit lets an attacker lock a victim out on
	// purpose, and an IP-only limit lets a botnet spray one guess everywhere.
	LoginByIP AuthLimit `` /* 222-byte string literal not displayed */

	// EmailCodeRequest bounds code requests per address. Default 5 per 1h.
	EmailCodeRequest AuthLimit `` /* 152-byte string literal not displayed */
	// EmailCodeByIP bounds code requests per source, across every address.
	// Default 100 per 1h.
	//
	// The limit that matters most when auth.email_code.allow_provisioning is
	// set: asking for a code then writes a person, and without this one script
	// makes ten thousand identities.
	EmailCodeByIP AuthLimit `` /* 243-byte string literal not displayed */
	// VerificationResend bounds verification mail per address. Default 5 per 1h.
	VerificationResend AuthLimit `` /* 152-byte string literal not displayed */
	// Refresh bounds one session's rotations. Default 60 per 1m: a client
	// refreshing sixty times a minute is looping, not working.
	Refresh AuthLimit `` /* 182-byte string literal not displayed */
	// APIKeyFailures bounds wrong keys per key. Default 20 per 1m.
	APIKeyFailures AuthLimit `` /* 155-byte string literal not displayed */
	// InvitationPreview bounds reading an invitation link per source. Default
	// 60 per 1h.
	//
	// The one unauthenticated endpoint keyed by a secret rather than by an
	// address, so what this bounds is one source walking the token space.
	InvitationPreview AuthLimit `` /* 164-byte string literal not displayed */
}

type AuthOAuth struct {
	// BaseURL is this application's own origin. The callback URL is built from
	// it, and a provider compares that exactly.
	BaseURL string `` /* 216-byte string literal not displayed */
	// BaseURLEnv names an environment variable that overrides BaseURL, which is
	// the ordinary case: the origin differs per deployment and the file does not.
	BaseURLEnv string `` /* 236-byte string literal not displayed */
	// OriginFromHost derives the origin per request from the Host instead.
	//
	// What an application serving a tenant per subdomain needs: the state cookie
	// carrying the PKCE verifier is set on the host the sign-in started at, and a
	// browser will not send it to a sibling subdomain — so the callback URL is per
	// host, and every one of them is registered with the provider.
	OriginFromHost bool `` /* 247-byte string literal not displayed */

	// SigningKeyEnv names the environment variable holding the key that signs the
	// state parameter. Default OAUTH_SIGNING_KEY.
	//
	// A random key is generated when the variable is empty, which is fine for one
	// process and wrong for several: a callback may arrive at a different replica
	// than the one that started the flow.
	SigningKeyEnv string `` /* 272-byte string literal not displayed */

	// StateTTL bounds how long a sign-in round trip may take. Default 10m:
	// generous for a redirect, short enough that a stolen state is useless.
	StateTTL Duration `` /* 205-byte string literal not displayed */

	// AllowProvisioning creates an account the first time somebody signs in with
	// a provider.
	//
	// Off by default: a provider authenticates anybody, so joining a tenant stays
	// a decision. Without it a provider sign-in works only for an address that
	// already has an account.
	AllowProvisioning bool `` /* 241-byte string literal not displayed */

	// AllowJoining creates an account in the tenant a sign-in named, for
	// somebody who is not in it yet. Unset follows allow_provisioning, which is
	// what one key did when it gated both doors.
	//
	// Separate because the two are separate decisions and a deployment can want
	// opposite answers. "A provider may create a person, but only an invitation
	// may put them in a tenant" is the ordinary one: where the tenant comes
	// from a request, the join is the half a crafted /start link would abuse,
	// and an identity on its own reaches nothing.
	//
	// Read only by a sign-in that named a tenant. Where none was named, joining
	// is the picker's job rather than the callback's.
	AllowJoining *bool `` /* 275-byte string literal not displayed */

	// AllowedReturnTo bounds where a finished sign-in may land. An open redirect
	// is the classic mistake here.
	//
	// Origins, each scheme://host with nothing after the host — not paths. A
	// relative path is always allowed and is never matched against this list, so
	// an entry that is one does nothing at all, and neither does one with a
	// trailing slash. Both are refused rather than accepted and ignored.
	AllowedReturnTo []string `` /* 351-byte string literal not displayed */

	// Insecure allows the state cookie over plain HTTP, for local development
	// where a browser would refuse the __Host- prefixed one. Never anywhere real.
	Insecure bool `` /* 176-byte string literal not displayed */

	// Providers are the identity providers to offer.
	Providers []AuthProvider `` /* 140-byte string literal not displayed */
}

type AuthProvider struct {
	// Name selects the provider, and is also the route segment: a provider called
	// google is reached at <base>/oauth/google/start.
	Name string `` /* 199-byte string literal not displayed */

	// ClientIDEnv and ClientSecretEnv default to the provider's name in upper
	// case: GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET.
	ClientIDEnv     string `` /* 164-byte string literal not displayed */
	ClientSecretEnv string `` /* 180-byte string literal not displayed */

	// TenantEnv is Microsoft's own idea of a tenant, which has nothing to do with
	// rig's: "common" accepts any account, "organizations" excludes personal
	// ones, and a directory id restricts sign-in to one organization. Empty means
	// common. Default MICROSOFT_TENANT.
	TenantEnv string `` /* 251-byte string literal not displayed */

	// Required fails startup when the credentials are absent.
	//
	// The default skips the provider instead, which is what makes one
	// configuration work in both places: set the pair and the button appears, set
	// nothing and it does not.
	Required bool `` /* 211-byte string literal not displayed */
}

type AuthSession struct {
	// AccessTTL is the lifetime of the token that travels on every request.
	// Shorter is safer and refreshes more often. Default 10m.
	AccessTTL Duration `` /* 202-byte string literal not displayed */
	// RefreshTTL is how long an ordinary session lasts. Default 12h.
	RefreshTTL Duration `` /* 135-byte string literal not displayed */
	// RememberTTL is how long one lasts when somebody asked to stay signed in.
	// Default 30d.
	RememberTTL Duration `` /* 165-byte string literal not displayed */

	// RotationLeeway is how long a refresh token stays usable after it has been
	// exchanged. Default 30s.
	//
	// Without one, a dropped response is a logout: the client never received the
	// new pair, retries with the old one, and has its whole family revoked for a
	// network blip. Longer forgives more retries and widens the replay window.
	RotationLeeway Duration `` /* 283-byte string literal not displayed */

	// IdentityTTL is the lifetime of the tenant-less credential somebody holds
	// between signing in and picking a tenant. Default 30m.
	IdentityTTL Duration `` /* 186-byte string literal not displayed */
}

type AuthTenant struct {
	// From lists the sources to try, in order, and the first that names a tenant
	// wins. Default: header.
	//
	// A request that names none is not an error — a single sign-in page cannot
	// know which tenants an address belongs to before the password has been
	// checked — so the sources are consulted and their silence is an answer.
	//
	//   header  a header, X-Tenant-Id by default
	//   host    the leftmost label of the Host, looked up as a tenant slug
	//   query   a query parameter, for a local demonstration
	//   hook    the application's own resolver, handed to the generated wiring
	//
	// host is what a real deployment uses, and the only one that survives a
	// provider redirect: a callback URL is registered with the provider and fixed,
	// so it carries no header and no parameter of yours. A host does.
	From []string `` /* 207-byte string literal not displayed */

	// Header is what the header source reads. Default X-Tenant-Id.
	Header string `` /* 129-byte string literal not displayed */
	// Query is what the query source reads. Default tenant.
	Query string `` /* 130-byte string literal not displayed */

	// DefaultSlugEnv names an environment variable holding the slug to fall back
	// to when the host names no tenant.
	//
	// It exists for one real problem: Google and Microsoft will not register a
	// plain-http redirect URI for anything but localhost, so the subdomain a
	// host-based deployment is built around cannot be used on a laptop. Naming a
	// tenant for the host that has no subdomain is what lets a real sign-in be
	// tried there.
	DefaultSlugEnv string `` /* 177-byte string literal not displayed */
}

type Cache struct {
	// Enabled is what turns the caching on. Off by default: a cache is a second
	// answer to a question the database was already answering correctly, and
	// switching that on for somebody is not an upgrade.
	Enabled bool `` /* 283-byte string literal not displayed */

	// TTL is how long an answer may be reused when no invalidation arrives, and
	// the honest statement of what the cache costs.
	TTL Duration `` /* 250-byte string literal not displayed */

	// Channel is the Postgres channel invalidations travel on.
	Channel string `` /* 260-byte string literal not displayed */

	// MaxEntries bounds each cache.
	MaxEntries int `` /* 165-byte string literal not displayed */
}

type Config struct {
	Version int `yaml:"version,omitempty" json:"version,omitempty" jsonschema_description:"Configuration format version."`

	Project    ProjectInfo `yaml:"project" json:"project" jsonschema_description:"Identity of the application being generated."`
	Layout     Layout      `yaml:"layout,omitempty" json:"layout,omitempty" jsonschema_description:"Where table configuration and generated code live."`
	API        API         `yaml:"api,omitempty" json:"api,omitempty" jsonschema_description:"Shape of the generated HTTP API."`
	Servers    Servers     `` /* 239-byte string literal not displayed */
	Web        Web         `` /* 227-byte string literal not displayed */
	Database   Database    `` /* 126-byte string literal not displayed */
	Migrations Migrations  `yaml:"migrations,omitempty" json:"migrations,omitempty" jsonschema_description:"Migration file location."`
	Auth       Auth        `yaml:"auth,omitempty" json:"auth,omitempty" jsonschema_description:"How the authentication foundation's tables are treated."`
	Files      Files       `` /* 128-byte string literal not displayed */

	Notifications Notifications `` /* 134-byte string literal not displayed */
	Presence      Presence      `yaml:"presence,omitempty" json:"presence,omitempty" jsonschema_description:"Who is here, and what they are looking at."`
	Throttle      Throttle      `` /* 188-byte string literal not displayed */
	Cache         Cache         `` /* 217-byte string literal not displayed */

	Tracing Tracing `` /* 128-byte string literal not displayed */

	Monitoring Monitoring `` /* 147-byte string literal not displayed */

	Naming   Naming   `yaml:"naming,omitempty" json:"naming,omitempty" jsonschema_description:"How database names become Go and JSON names."`
	Validate Validate `yaml:"validate,omitempty" json:"validate,omitempty" jsonschema_description:"Severity of each configurable convention rule."`

	Generators []Generator `yaml:"generators,omitempty" json:"generators,omitempty" jsonschema_description:"Generators to run, in order."`
}

type Database struct {
	Image         string `yaml:"image,omitempty" json:"image,omitempty" jsonschema_description:"Container image for the throwaway database."`
	ContainerName string `yaml:"container_name,omitempty" json:"container_name,omitempty" jsonschema_description:"Name of the throwaway container."`
	Port          int    `yaml:"port,omitempty" json:"port,omitempty" jsonschema_description:"Host port the throwaway database listens on."`
	Name          string `yaml:"name,omitempty" json:"name,omitempty" jsonschema_description:"Database name."`
	User          string `yaml:"user,omitempty" json:"user,omitempty" jsonschema_description:"Database user."`
	Password      string `` /* 162-byte string literal not displayed */
	Schema        string `yaml:"schema,omitempty" json:"schema,omitempty" jsonschema_description:"Postgres schema to read. Defaults to public."`

	// Settings are extra server parameters for the throwaway container, passed
	// as -c flags. electric.enabled adds wal_level=logical when nothing lists
	// one, because logical replication cannot be turned on after the server has
	// started.
	Settings []string `` /* 169-byte string literal not displayed */

	// Electric is a sync-service container `rig db up` manages beside the
	// database. Nested here rather than top-level because its lifecycle is the
	// database container's: up starts it, down stops it, reset removes it.
	Electric DatabaseElectric `` /* 153-byte string literal not displayed */

	// URL, when set, is used as-is and no container is started.
	URL string `` /* 157-byte string literal not displayed */
}

type DatabaseElectric struct {
	Enabled       bool   `` /* 136-byte string literal not displayed */
	Image         string `yaml:"image,omitempty" json:"image,omitempty" jsonschema_description:"Container image for the sync service."`
	ContainerName string `yaml:"container_name,omitempty" json:"container_name,omitempty" jsonschema_description:"Name of the sync-service container."`
	Port          int    `yaml:"port,omitempty" json:"port,omitempty" jsonschema_description:"Host port the sync service listens on."`
}

type Duration time.Duration

type Files struct {
	// Enabled says this project accepts uploads. Off by default, and what makes
	// `server-go` write the wiring at all.
	Enabled bool `` /* 175-byte string literal not displayed */

	// Expose projects rig_file as a read-only resource.
	//
	// It is here rather than assumed because the row is the only place the file's
	// URL lives, and a client that cannot sync rig_file cannot use the column
	// that exists for it. Off leaves the table managed and unprojected, which is
	// right for a project whose files are only ever fetched through the download
	// route.
	//
	// There is no write path to find either way: the endpoints rig synthesizes
	// are the upload and the download, and a client that could POST a row with an
	// arbitrary storage key and no bytes has found a way around the rules.
	Expose bool `` /* 201-byte string literal not displayed */

	// Backend is where the bytes go: memory or s3.
	Backend string `` /* 204-byte string literal not displayed */

	S3 FilesS3 `yaml:"s3,omitempty" json:"s3,omitempty" jsonschema_description:"Bucket settings, read only when backend is s3."`

	// MaxBytes caps one upload. It is a hard per-file cap and not a quota: rig
	// does not do storage quotas, and saying so is better than implying one.
	MaxBytes int64 `` /* 184-byte string literal not displayed */

	// InlineTypes are the sniffed content types served without an attachment
	// disposition.
	//
	// Everything else downloads. The list is short on purpose: a file served
	// inline from the API origin runs there, and the URL is in a synced row that
	// will end up in an <img> or an <a> without anybody thinking about it.
	// text/html is the one that must never be on it.
	InlineTypes []string `` /* 247-byte string literal not displayed */

	// AbandonedAfter is how long a file row may sit with no bytes behind it
	// before the sweeper takes it.
	//
	// A row is inserted before the upload and finalized after it, so one with a
	// null uploaded_at is either in flight or the remains of a request that died.
	// This is how long it gets the benefit of the doubt.
	AbandonedAfter Duration `` /* 194-byte string literal not displayed */

	// RestoreWindow is how long a deleted file stays restorable, and therefore
	// how long its bytes outlive the delete.
	//
	// It lives here rather than in a table configuration because rig_file does
	// not have one — an asymmetry with `restore_window_days` worth knowing about
	// before going to look for the key. The key is refused on rig_file for the
	// same reason: this number is how long the bytes are kept as well as how
	// long the row can be brought back, and a second copy of it could only ever
	// disagree.
	//
	// A projected rig_file gets a generated restore endpoint, whose window is a
	// whole number of days — see [Files.RestoreWindowDays] — so with
	// `files.expose` set this has to be at least 24h.
	//
	// If the bucket has a lifecycle rule of its own, that rule has to outlive
	// this, or a restore inside the window succeeds and hands back a row pointing
	// at nothing. The S3 adapter refuses to start when it can tell that is the
	// case.
	RestoreWindow Duration `` /* 244-byte string literal not displayed */

	// CookieDownloads accepts the session cookie on file GET routes.
	//
	// A stored URL is stable and unsigned and sits in a synced row, which means
	// it exists to be used directly: <img src>, <a download>, a background-image.
	// None of those attach an Authorization header, and a bearer token is the
	// only credential rig's authentication otherwise understands.
	//
	// GET only, and that is not an oversight: widening it past GET reintroduces
	// exactly the cross-site request problem the bearer header avoids. It is
	// opt-in because an application that never renders a file in a browser should
	// not be carrying a cookie path at all.
	CookieDownloads bool `` /* 291-byte string literal not displayed */
}

type FilesS3 struct {
	Bucket string `` /* 129-byte string literal not displayed */
	// BucketEnv names an environment variable holding the bucket, for a name
	// that differs per deployment.
	BucketEnv string `` /* 168-byte string literal not displayed */

	Region string `yaml:"region,omitempty" json:"region,omitempty" jsonschema_description:"Bucket region."`
	// Endpoint points at something other than AWS — MinIO, R2, a test double.
	Endpoint string `` /* 136-byte string literal not displayed */

	AccessKeyEnv string `` /* 167-byte string literal not displayed */
	SecretKeyEnv string `` /* 175-byte string literal not displayed */
}

type FoundationMode string

type Generator struct {
	Name string `yaml:"name" json:"name" jsonschema_description:"Registered generator name, for example persist-go."`
	// OutDir overrides the generator's default output directory, relative to
	// the project root.
	OutDir string `yaml:"out_dir,omitempty" json:"out_dir,omitempty" jsonschema_description:"Output directory, relative to the project root."`
	// Options is validated against the generator's own schema, not this one.
	Options map[string]any `` /* 158-byte string literal not displayed */
}

type Layout struct {
	TableDir   string `` /* 171-byte string literal not displayed */
	ConfigFile string `` /* 147-byte string literal not displayed */
}

type Migrations struct {
	Dir string `yaml:"dir,omitempty" json:"dir,omitempty" jsonschema_description:"Directory holding goose migration files."`
	// Table is the goose bookkeeping table.
	Table string `yaml:"table,omitempty" json:"table,omitempty" jsonschema_description:"Name of the migration bookkeeping table."`
	// Foundation is who keeps rig's own migrations. See [FoundationMode].
	//
	// It is chosen once. The two modes record their history in different tables,
	// so a project that switches after it has a database would re-apply a schema
	// that is already there — which rig refuses to discover in psql, and says so
	// from `rig validate` instead.
	Foundation FoundationMode `` /* 332-byte string literal not displayed */
}

type Monitoring struct {
	// Enabled says this project serves the page. Off by default, and off means
	// there is no listener rather than a port answering 404 — `server-go`
	// writes no wiring for a project without it, so the API package names no
	// page at all.
	Enabled bool `` /* 197-byte string literal not displayed */

	// Addr is where the page listens, as host:port — "127.0.0.1:9090", or
	// ":9090" for every interface. Required when [Monitoring.Enabled] is set.
	//
	// The page has its own listener and its own [net/http.Server] inside the
	// same binary, rather than a route on the API's mux, because the bind
	// address is the only boundary here that a client cannot talk its way
	// around. [Monitoring.Allow] is matched against the connection's own
	// address, which behind a load balancer is the balancer's, so it matches
	// everything or nothing; a port bound to loopback is enforced by the kernel
	// and says the same thing in every deployment.
	//
	// There is no default, deliberately. A default port is one two rig services
	// on a host would fight over, and a default interface is a decision about
	// who can reach a page that lists every path, request id and error cause
	// this server has seen — neither is rig's to make quietly.
	//
	// $RIG_MONITOR_ADDR overrides it at run time, for the reason the span
	// destination is an environment variable: where a thing listens is a
	// property of the deployment, and moving it should not need a regenerate.
	Addr string `` /* 251-byte string literal not displayed */

	// BasePath is where the page is mounted on its own listener, defaulting to
	// [DefaultMonitorBasePath].
	//
	// It has nothing to collide with now that the page is not on the API's mux,
	// so this is a prefix a reverse proxy in front of [Monitoring.Addr] can key
	// on, and the reason the default is kept is that it is the URL projects
	// already have.
	BasePath string `` /* 152-byte string literal not displayed */

	// MaxTraces is how many requests the page lists, newest first. Zero means
	// [DefaultMonitorMaxTraces].
	MaxTraces int `` /* 145-byte string literal not displayed */

	// MaxLogs is how many log lines the page reads, newest first. Zero means
	// [DefaultMonitorMaxLogs].
	//
	// The lines themselves are a run-time arrangement — a file the deployment
	// names and a handler the application tees in — and this is the one part of
	// them the project decides, for [MaxTraces]'s reason: how much of a page
	// somebody reads is a property of the page.
	MaxLogs int `` /* 142-byte string literal not displayed */

	// PasswordEnv names the variable the page reads its password from,
	// defaulting to [DefaultMonitorPasswordEnv]. With nothing in it the page
	// does not listen at all — the port is closed, not guarded — and the server
	// says so once at startup: a project running where there is no password to
	// give is a project that gets no page rather than one that gets an open
	// one.
	PasswordEnv string `` /* 218-byte string literal not displayed */

	// Password is the password itself, for a project that would rather write it
	// here than arrange an environment.
	//
	// It is accepted and it warns, because rig.yaml is checked in and this page
	// shows every path, request id and error cause the server has seen. Whether
	// that trade is worth making is the project's call — a throwaway staging
	// box and a production deployment are not the same decision — and rig makes
	// it once, out loud, rather than for you.
	Password string `` /* 183-byte string literal not displayed */

	// Allow is the addresses that may reach the page, as CIDR ranges or single
	// addresses. Empty, the default, allows any and leaves the password as the
	// only check.
	//
	// It narrows rather than replaces: an address that is not on the list is
	// answered 404 before the password is compared, so a scan learns nothing
	// and a leaked password is not enough on its own. There is deliberately no
	// way to have the list without the password — an allowlist keyed on the
	// connection's address is not a boundary behind a load balancer, where
	// every request arrives from the balancer, and that failure is silent and
	// total.
	//
	// [Monitoring.Addr] is the boundary that does hold in that deployment, and
	// this list is the layer above it: the port decides which networks can open
	// a connection at all, and this decides which addresses on those networks
	// are answered.
	//
	// It is matched against the connection's own address and never against a
	// forwarded header, for the reason [Auth.TrustedProxies] exists: an address
	// read from a header a client controls is an address a client chooses.
	Allow []string `` /* 331-byte string literal not displayed */
}

type Naming struct {
	JSONCase string `` /* 174-byte string literal not displayed */
	// Initialisms are added to the built-in list of acronyms that stay
	// uppercase in Go identifiers.
	Initialisms []string `` /* 153-byte string literal not displayed */
	// Plurals overrides derived plurals, keyed by the singular table name.
	Plurals map[string]string `` /* 157-byte string literal not displayed */
}

type Notifications struct {
	// Enabled says this project has an inbox. Off by default, and what makes
	// `server-go` write the wiring and the compiler keep rig's two notification
	// tables in the schema at all.
	Enabled bool `` /* 172-byte string literal not displayed */

	// Expose projects rig_notification_recipient as a resource, so the inbox
	// gets the filter grammar, the sort keys and a generated client.
	//
	// Off is the ordinary case and still leaves a working inbox: the routes
	// under /notifications are hand-written, because the tables are the same in
	// every project and there is nothing for a generator to vary. This is for
	// the project those routes are not enough for — and both stay, because the
	// difference between them is the point.
	//
	// It does not decide whether the tables are in the schema. They are, as soon
	// as `enabled` is set, because a link table pointing at a table rig has
	// dropped is not a link table any more.
	Expose bool `` /* 208-byte string literal not displayed */

	// DefaultDigest is what an account gets on a channel it has never set a
	// preference for. The last step of the three-step resolution.
	DefaultDigest string `` /* 240-byte string literal not displayed */

	// ClaimTTL is how long a dispatcher's claim on a delivery is honoured before
	// another one may take it.
	//
	// It exists for crashes: a process that claimed a row and died leaves it
	// Pending with a stale claim, and the next dispatcher past it takes it once
	// this has elapsed. A clean shutdown gives its claims back immediately and
	// does not wait this out.
	//
	// The number that matters is the slowest channel's own timeout, which rig
	// cannot know. Shorter than that and every message is claimed twice under
	// ordinary load — at-least-once stops being a crash-recovery property and
	// becomes an everyday one. Longer and a crashed pod's queue sits idle for
	// that long while healthy replicas walk past it.
	ClaimTTL Duration `` /* 254-byte string literal not displayed */

	// SendTimeout bounds one call into a channel.
	//
	// It is the deadline on the context a channel is handed, and the answer to
	// the relationship ClaimTTL's own comment above calls the one
	// misconfiguration worth understanding: rig could not know the slowest
	// channel's timeout while the channel owned it, and now the channel is told
	// what it is. Shorter than ClaimTTL, necessarily — a send that may outlive
	// the lease protecting it is a send whose row somebody else has already
	// taken.
	//
	// A channel is the only outbound call rig does not make itself, which is why
	// this is the only such value in this file. It is also cooperative: a Sender
	// that ignores the deadline hangs its dispatcher anyway, and the interface
	// documentation says so.
	SendTimeout Duration `` /* 234-byte string literal not displayed */

	// MaxAttempts is how many times a delivery is tried before it is Failed and
	// stops being claimed.
	MaxAttempts int `` /* 224-byte string literal not displayed */

	// BackoffBase is the first retry delay. Each attempt doubles it, up to
	// BackoffCap.
	BackoffBase Duration `` /* 174-byte string literal not displayed */

	// BackoffCap is the longest one wait may be, which is what makes a long
	// schedule safe to have.
	//
	// The three retry numbers are one decision, and this is the one that decides
	// what the tail of the schedule looks like. Doubling from a minute fourteen
	// times is five days, so without a ceiling the late attempts are not retries
	// — they are a row nobody will look at again. Capped, the tail is a series of
	// hourly knocks, which is what somebody watching a provider's status page
	// would do by hand.
	BackoffCap Duration `` /* 197-byte string literal not displayed */

	// Retention is how long a read and deleted inbox line is kept before the
	// dispatch task prunes it, along with the notifications and link rows left
	// with nothing pointing at them.
	//
	// It has to outlive the longest digest window: a weekly digest under a daily
	// retention is a digest assembled from rows that were deleted before it ran,
	// and it would present as "the weekly mail is sometimes empty" rather than
	// as a configuration error.
	Retention Duration `` /* 217-byte string literal not displayed */
}

type PermissionMode string

type Presence struct {
	// Enabled says this project tracks presence. Off by default, and what makes
	// `server-go` write the wiring and the compiler keep rig_presence in the
	// schema at all.
	Enabled bool `` /* 175-byte string literal not displayed */

	// Expose projects rig_presence as a resource, so presence gets the filter
	// grammar, the sort keys and a generated client.
	//
	// Off is the ordinary case and still leaves presence working: the routes
	// under /presence are hand-written, because the table is the same in every
	// project and there is nothing for a generator to vary, and the live shape is
	// how a browser actually reads it. This is for the project those are not
	// enough for.
	//
	// Read-only either way. The scaffolded table configuration is
	// `operations: [Get, List]` and no more: a client that could POST one of
	// these could claim to be somebody else, and the heartbeat route exists
	// precisely so that it cannot.
	Expose bool `` /* 236-byte string literal not displayed */

	// TTL is how long a session stays present after its last heartbeat.
	//
	// It is the cost of the whole feature stated as one number. Short, and
	// somebody on hotel wifi flickers in and out of everybody else's view; long,
	// and a closed laptop goes on editing the title for that long.
	//
	// The long end is survivable because this is the *backstop*: an ordinary
	// close, a navigation or a tab going to the background sends a leave, so the
	// TTL only has to cover a crashed tab and a dead network. That is what makes
	// a minute affordable rather than five seconds.
	TTL Duration `` /* 212-byte string literal not displayed */

	// Heartbeat is how often a browser says it is still there, and it is
	// answered to the browser rather than configured in it.
	//
	// Every beat is one row changed, which every subscriber to the presence
	// shape hears about. So this is not a latency knob: it is the write rate and
	// the fan-out rate, multiplied by tabs. See docs/presence.md for the
	// arithmetic before lowering it.
	Heartbeat Duration `` /* 258-byte string literal not displayed */

	// Sweep is how often the in-process sweeper deletes rows past their window.
	//
	// It is not what makes somebody disappear — whoever is reading decides that,
	// against the clock, and within a second. This is what keeps the table, and
	// every new subscriber's first fetch, from growing forever.
	//
	// **There is no value here that turns the sweeper off**, and there was going
	// to be: a negative duration cannot be written in this file, because
	// [DurationPattern] does not admit a sign. That turned out to be the right
	// answer rather than a limitation to work around. Whether a process runs a
	// background loop is a line in its own main function, not a number in a
	// configuration file — the `notifications:` block has no key for it either,
	// and an operator who wants the cron job to own this simply does not call
	// Start on the sweeper. This key is how often it ticks when it is running.
	Sweep Duration `` /* 208-byte string literal not displayed */

	// Grace is how long past the TTL a row is kept before it is deleted.
	//
	// It exists so the two expiry mechanisms cannot disagree. A subscriber stops
	// drawing a row at the TTL and the sweeper deletes it at TTL plus this, so a
	// row is always invisible before it is gone — never the other way round,
	// which would be a row that came back when a slow client caught up.
	Grace Duration `` /* 243-byte string literal not displayed */
}

type Project struct {
	// Root is the directory holding rig.yaml. Every relative path in the
	// configuration is resolved against it.
	Root string
	// ConfigPath is the configuration file itself.
	ConfigPath string

	Config *Config
	Index  *yamlconf.Index
	// contains filtered or unexported fields
}

type ProjectInfo struct {
	Name string `yaml:"name" json:"name" jsonschema_description:"Short name of the application."`
	// Module is the Go module path of the generated application. Generated
	// imports are built from it.
	Module string `yaml:"module" json:"module" jsonschema_description:"Go module path of the application, used to build generated import paths."`
}

type SearchMethod string

type Server struct {
	// Name identifies the deployment, and becomes an identifier in every
	// generated SDK: production is Go's ServerProduction and TypeScript's
	// servers.production.
	//
	// Lower snake case, which is the one spelling that becomes an ordinary name
	// in both languages without a rule anybody has to remember.
	Name string `` /* 215-byte string literal not displayed */

	// URL is where that deployment answers, origin and any prefix it sits
	// behind. The API's own base_path is appended to it, so it is not repeated
	// here.
	URL string `` /* 197-byte string literal not displayed */

	// Description is one line about what this deployment is for. It reaches the
	// OpenAPI document and the doc comment beside the generated constant.
	Description string `` /* 205-byte string literal not displayed */

	// Default is the deployment a caller who names none gets. At most one entry
	// may claim it; with nobody claiming it the first entry is the default, so a
	// project naming a single deployment writes no marker at all.
	Default bool `` /* 199-byte string literal not displayed */
}

type Servers []Server

type Throttle struct {
	// Enabled is what makes `server-go` write the wiring. Off by default: an API
	// that starts refusing calls after an upgrade nobody asked for is worse than
	// one that does not limit yet.
	Enabled bool `` /* 184-byte string literal not displayed */

	// APIKey, Account and Tenant apply to a caller who said who they were.
	APIKey  AuthLimit `` /* 129-byte string literal not displayed */
	Account AuthLimit `` /* 139-byte string literal not displayed */
	Tenant  AuthLimit `` /* 214-byte string literal not displayed */

	// IP applies only to a caller who did not say who they were.
	IP AuthLimit `` /* 244-byte string literal not displayed */

	// Interval is how long one replica may hold its own count before publishing
	// it. It is the accuracy of the whole feature, stated as time.
	Interval Duration `` /* 260-byte string literal not displayed */

	// Routes are extra limits on particular routes, on top of the per-caller
	// ones above.
	Routes []ThrottleRoute `` /* 179-byte string literal not displayed */

	// Exempt are route patterns nothing applies to.
	Exempt []string `` /* 209-byte string literal not displayed */
}

type ThrottleRoute struct {
	// Pattern is the route as the router registers it, for example
	// "POST /api/v1/todos". It is matched exactly against what net/http
	// reports, not against the request path.
	Pattern string   `` /* 204-byte string literal not displayed */
	Max     int      `` /* 131-byte string literal not displayed */
	Window  Duration `yaml:"window,omitempty" json:"window,omitempty" jsonschema_description:"How long the window is."`
}

type Tracing struct {
	// Enabled says this project emits spans.
	Enabled bool `` /* 216-byte string literal not displayed */
}

type Validate struct {
	UnmentionedColumn    string `` /* 220-byte string literal not displayed */
	MissingComment       string `` /* 167-byte string literal not displayed */
	ForeignKeyNotIndexed string `` /* 180-byte string literal not displayed */
	TenantIndexLeading   string `` /* 188-byte string literal not displayed */
	BooleanPrefix        string `` /* 178-byte string literal not displayed */
	TimestampSuffix      string `` /* 372-byte string literal not displayed */
	DateSuffix           string `` /* 192-byte string literal not displayed */
	ForeignKeyNaming     string `` /* 186-byte string literal not displayed */
	CascadeDelete        string `` /* 173-byte string literal not displayed */
	MigrationFilename    string `` /* 191-byte string literal not displayed */
}

type Web struct {
	// Origin is where the front end is served, as scheme://host[:port] with
	// nothing after the host.
	Origin string `` /* 209-byte string literal not displayed */

	// OriginEnv names the environment variable the origin comes from, for a
	// deployment whose front end differs per environment.
	//
	// This exists here and deliberately not beside `servers[].url`, and the
	// asymmetry is the same one `auth.oauth.base_url_env` makes: this value is
	// read by *this* server as it starts, so it can see its own environment. A
	// server URL is a constant compiled into somebody else's program, which
	// cannot.
	OriginEnv string `` /* 248-byte string literal not displayed */

	// CallbackPath is the path on the front end that receives a finished
	// sign-in. Default /auth/callback.
	CallbackPath string `` /* 179-byte string literal not displayed */

	// CORS is what a preflight from that front end is answered with.
	CORS WebCORS `` /* 171-byte string literal not displayed */
}

type WebCORS struct {
	// AllowedOrigins are origins besides [Web.Origin] that may call this API —
	// an administrative front end, most often.
	//
	// Each is scheme://host[:port]. One leading `*.` label is allowed, so
	// `https://*.example.com` matches any single subdomain; a bare `*` is not,
	// because this API answers bearer credentials and a policy that admits every
	// origin is one somebody should have to write out.
	AllowedOrigins []string `` /* 223-byte string literal not displayed */

	// AllowedOriginsEnv names the environment variable that replaces the list
	// above, as a comma-separated string. Default CORS_ORIGINS.
	//
	// Replaces rather than extends, which is how `base_url_env` behaves: a
	// deployment overriding a value should not have to know what it is
	// overriding.
	AllowedOriginsEnv string `` /* 302-byte string literal not displayed */

	// MaxAge is how long a browser may cache a preflight. Default 10m, which is
	// as long as Safari will honour.
	MaxAge Duration `` /* 170-byte string literal not displayed */
}