appconfig

type AddonConfig struct {
	Variant string `toml:"variant"`
	Version string `toml:"version"`

	// Services names the services an addon's storage attaches to. Empty means
	// every service, matching how addon variables reach every service.
	//
	// It exists because storage an addon supplies can carry constraints that
	// the rest of the app should not have to inherit. A SQLite database allows
	// one writer, so a service holding it must run a single fixed instance;
	// without this an app could not also run a worker at three.
	Services []string `toml:"services"`
}

type AppConfig struct {
	Name         string                    `toml:"name"`
	Static       *StaticConfig             `toml:"static,omitempty"`
	EnvVars      []AppEnvVar               `toml:"env,omitempty"`
	Concurrency  *int                      `toml:"concurrency,omitempty"`
	Services     map[string]*ServiceConfig `toml:"services,omitempty"`
	Tasks        map[string]*TaskConfig    `toml:"tasks,omitempty"`
	Build        *BuildConfig              `toml:"build,omitempty"`
	Include      []string                  `toml:"include,omitempty"`
	Addons       map[string]*AddonConfig   `toml:"addons,omitempty"`
	Aliases      map[string]string         `toml:"aliases,omitempty"`
	WorkloadRole string                    `toml:"workload_role,omitempty"`

	// Web says whether the app has a long-running web process. It is a pointer
	// because `false` is the zero value and "unset" has to stay distinguishable
	// from "explicitly false": unset preserves the historical behavior of
	// synthesizing a web service from the image entrypoint, while `web = false`
	// is how a task-only app opts out.
	Web *bool `toml:"web,omitempty"`
}

type AppEnvVar struct {
	Key         string `json:"key" toml:"key"`
	Value       string `json:"value,omitempty" toml:"value,omitempty"`
	Required    bool   `json:"required,omitempty" toml:"required,omitempty"`
	Sensitive   bool   `json:"sensitive,omitempty" toml:"sensitive,omitempty"`
	Description string `json:"description,omitempty" toml:"description,omitempty"`

	// Backend names the secret backend the value comes from, and Ref addresses
	// the secret within it. Together they replace Value: the credential itself
	// never appears in app.toml, only a pointer to it, so the file stays safe to
	// commit.
	//
	// A reference authored here floats: each new ConfigVersion resolves it to
	// whatever is current, which is how a rotation reaches the app. Note that
	// this is about minting a config, not running one — deploying or rolling
	// back to an existing version keeps the reference that version recorded, so
	// a rotation reaches an app only once a new config is created for it.
	// Appending @version to Ref holds it at that exact version regardless.
	Backend string `json:"backend,omitempty" toml:"backend,omitempty"`
	Ref     string `json:"ref,omitempty" toml:"ref,omitempty"`
}

type AppState struct {
	Cluster string `toml:"cluster"`
}

type BuildConfig struct {
	Dockerfile string   `toml:"dockerfile"`
	OnBuild    []string `toml:"onbuild"`
	Version    string   `toml:"version"`

	AlpineImage string `toml:"alpine_image"`

	// Secrets names secret backends to expose to the build. Each entry is mounted
	// into the build via BuildKit's secret session, so a `RUN --mount=type=secret,id=<id>`
	// step can read the decrypted value without it ever landing in an image layer
	// or build log. This is distinct from a runtime [[env]] reference: a build
	// secret reaches only the build and never becomes an environment variable in
	// the running container.
	Secrets []BuildSecret `toml:"secrets,omitempty"`
}

type BuildSecret struct {
	ID      string `json:"id" toml:"id"`
	Backend string `json:"backend,omitempty" toml:"backend,omitempty"`
	Ref     string `json:"ref" toml:"ref"`
}

type ConfigError struct {
	FilePath    string
	Diagnostics []Diagnostic
}

type DeployConfig struct {
	Targets []DeployTarget `toml:"targets"`
}

type DeployTarget struct {
	Name      string `toml:"name"`
	Cluster   string `toml:"cluster"`
	ClusterID string `toml:"cluster_id,omitempty"`
}

type Diagnostic struct {
	Line    int    // 1-indexed, 0 if unknown
	Column  int    // 1-indexed, 0 if unknown
	Message string // the core error message
	Context string // visual context from go-toml (if available)
	Hint    string // e.g. "did you mean \"command\"?"
}

type DiskConfig struct {
	Name         string `toml:"name"`
	Provider     string `toml:"provider"`
	MountPath    string `toml:"mount_path"`
	ReadOnly     bool   `toml:"read_only"`
	SizeGB       int    `toml:"size_gb"`
	Filesystem   string `toml:"filesystem"`
	LeaseTimeout string `toml:"lease_timeout"`
	Owner        string `toml:"owner"`
}

type PortConfig struct {
	Port     int    `toml:"port"`
	Name     string `toml:"name"`
	Type     string `toml:"type"`
	NodePort int    `toml:"node_port"`
}

type ServiceConcurrencyConfig struct {
	Mode                string `toml:"mode"` // "auto" or "fixed"
	RequestsPerInstance int    `toml:"requests_per_instance"`
	ScaleDownDelay      string `toml:"scale_down_delay"` // e.g. "2m", "15m"
	NumInstances        int    `toml:"num_instances"`
	ShutdownTimeout     string `toml:"shutdown_timeout"` // e.g. "10s", "30s" - time to wait for graceful shutdown
}

type ServiceConfig struct {
	Command     string                    `toml:"command"`
	Args        []string                  `toml:"args"`
	Port        int                       `toml:"port"`
	PortName    string                    `toml:"port_name"`
	PortType    string                    `toml:"port_type"`
	Ports       []PortConfig              `toml:"ports"`
	Image       string                    `toml:"image"`
	EnvVars     []AppEnvVar               `toml:"env"`
	Concurrency *ServiceConcurrencyConfig `toml:"concurrency"`
	Disks       []DiskConfig              `toml:"disks"`
	Metrics     *ServiceMetricsConfig     `toml:"metrics,omitempty"`
	// PortTimeout overrides the default 15s wait for the service to bind
	// its port during startup. Accepts a Go duration string (e.g. "60s", "2m").
	// Empty falls back to the default; invalid duration strings are rejected
	// at parse time by Validate.
	PortTimeout string `toml:"port_timeout,omitempty"`
}

type ServiceMetricsConfig struct {
	Enabled  bool   `toml:"enabled"`
	Path     string `toml:"path"`
	Port     int    `toml:"port"`
	Interval string `toml:"interval"`
	Public   bool   `toml:"public"`
}

type StaticConfig struct {
	Dir string `toml:"dir"`
}

type TaskConfig struct {
	// Command is the default command. An invoke can override it, which is what
	// makes a manually-triggered task useful for ad-hoc work.
	Command string `json:"command" toml:"command"`

	// Trigger is one of "manual", "deploy", or "schedule". Empty means manual.
	Trigger string `json:"trigger,omitempty" toml:"trigger,omitempty"`

	// Every is a Go duration and is pure sugar over Schedule: it is desugared
	// to a day-aligned calendar expression at parse time, so only the calendar
	// form is ever stored. Mutually exclusive with Schedule.
	Every string `json:"every,omitempty" toml:"every,omitempty"`

	// Schedule is a systemd OnCalendar expression. Mutually exclusive with Every.
	Schedule string `json:"schedule,omitempty" toml:"schedule,omitempty"`

	// Timeout bounds the run, after which the sandbox is killed and the run is
	// marked TIMED_OUT. Empty means the platform default.
	Timeout string `json:"timeout,omitempty" toml:"timeout,omitempty"`

	// Retries applies to the deploy and schedule triggers, where nobody is
	// watching to retry by hand. A manually-triggered run that fails just
	// fails, and the caller decides.
	Retries int `json:"retries,omitempty" toml:"retries,omitempty"`

	// MaxConcurrent caps simultaneous runs. Zero means DefaultTaskMaxConcurrent.
	MaxConcurrent int `json:"max_concurrent,omitempty" toml:"max_concurrent,omitempty"`

	EnvVars []AppEnvVar `json:"env,omitempty" toml:"env,omitempty"`
}

type ValidationError struct {
	KeyPath string // e.g. "services.web.concurrency.mode"
	Message string
}