writer

type Config struct {
	// Archive is where the copies go: the Object-Locked bucket.
	Archive store.Store
	// Profiles are the deployment's profiles, composed from the presets —
	// preset.ParseDeployment and Compose read the same document the chart
	// renders.
	Profiles map[string]*preset.Profile
	// Keys pseudonymise identifiers. With a provider that can also seal
	// (keys.Transit, keys.Local), the identity behind each pseudonym is kept
	// sealed under the same key, for resolve; see ForgetIdentities.
	//
	// Optional, and nil is the default a deployment should have to argue
	// itself out of rather than into: most trails are of an organisation's
	// own staff, who are kept in clear because that is what accountability
	// is for. Open refuses nil only when a composed profile would actually
	// pseudonymise, which is what GuardKeys decides.
	Keys keys.Provider
	// Catalogues are the application's own. The common catalogue, which
	// describes the writer's own actions, is always registered.
	Catalogues []*catalogue.Catalogue

	// Database, when given, is the deduplication table shared by every
	// replica, and where catalogues registered through the registry service
	// are read from. The writer's role needs those tables and none of the
	// index: observe indexes, by following the bucket. Without a database
	// the writer deduplicates in process, and so may run as one instance
	// only.
	Database *pgxpool.Pool
	// Dedupe, when given, is the deduplication store, in place of the one
	// Database provides: for a deployment that has no database, such as the
	// writer on a function platform, where it is a DynamoDB table
	// (dedupe/dynamodbdedupe). It is shared by every replica, so it lifts the
	// one-instance limit as Database does. Give it or Database, not both.
	Dedupe Dedupe
	// Replicas is how many writers share one stream of records. Above one it
	// needs Database, and keys every replica sees the same way.
	Replicas int

	// Self is this writer's own name as an observer, stamped on records that
	// reach it in process — an embedding application's emitter is the
	// application itself, so this names it. A record that arrives over HTTP
	// carries the caller the auth middleware verified instead.
	Self string
	// ForgetIdentities keeps no sealed identities, which makes resolve
	// impossible for everything this writer writes.
	ForgetIdentities bool
	// Instance names this writer in its own records. It is not in any object
	// key: the key's ULID is what keeps two writers apart.
	// Default: the host name and process id.
	Instance string
	// RollInterval is how long an object stays open within a batch. Default
	// 5 minutes; every batch is flushed before it is acknowledged regardless.
	RollInterval time.Duration
	// Version names this build in the writer's own records.
	Version string
	// Evidence says, in the writer's start-up record, which configuration it
	// ran under: digests of the files it read. Empty says nothing.
	Evidence Evidence
	// FromStream says this writer consumes a stream its own installation's
	// receivers publish to, so a record arriving already stamped keeps that
	// stamp. A consumer reading messages has no caller to verify, and
	// re-stamping would replace the identity the receiver checked with
	// nothing. It has no effect on records reaching the sink's own port.
	FromStream bool

	// Logger, default slog.Default().
	Logger *slog.Logger
	// Meter is where the writer's counters go, default the global provider.
	Meter metric.MeterProvider
}

type Dedupe = inner.Dedupe

type Evidence = inner.Evidence

type Writer struct {
	// contains filtered or unexported fields
}