-- SPDX-License-Identifier: MIT OR Apache-2.0
-- Copyright 2026 Mark Constable <mc@mixos.dev>
-- The bridged instance config and wire contract as data (docs/docs/spec/bridge/README.md).
-- services/bridged/tests/bridge_core_test.mix holds the core against it.
{
  status:"draft", version:"0.2.0", service:"bridged",
  config:{
    path:"<etc>/bridge/<name>.conf.mix", etc_default:"/etc/mixos", etc_env:"MIXOS_ETC", override_env:"BRIDGED_CONFIG",
    required:["port"],
    keys:[
      {key:"host", type:"string", default:"127.0.0.1", values:["127.0.0.1", "localhost"]},
      {key:"port", type:"integer", min:1, max:65535},
      {key:"auth", type:"string", default:"token", values:["token", "key", "none"]},
      {key:"token_file", type:"string", note:"required with auth token or key, refused with auth none; 64 hex characters; ~/ expands; key: read on every connect"},
      {key:"timeout_s", type:"number", default:5, min_exclusive:0, max:300},
      {key:"connect_timeout_s", type:"number", default:2, min_exclusive:0, max:300},
      {key:"backoff_s", type:"number", default:2, min:0, max:300},
      {key:"max_line", type:"integer", default:1048576, min:64, max:16777216, note:"bounds reply lines (rc 11) and request lines (rc 12)"},
      {key:"instance", type:"string", pattern:"^[A-Za-z0-9_-]{1,64}$"}
    ]
  },
  name:{pattern:"^[a-z][a-z0-9-]{1,30}$", registry:"/opt/mixos/share/bus/verbs.conf.mix", registry_env:"BRIDGED_VERBS"},
  verbs:["call", "commands", "execute", "inspect", "screenshot", "status"],
  rc:{ok:0, app_error:10, transport:11, bad_request:12},
  deadline:{covers:["connect", "auth write", "auth reply", "request write", "request reply"], min_mix:"0.112.1"},
  start:{argv:"mix bridged.mix --start <app>", refusal_exit:2, unexpected_exit:3, otherwise:"the serve child's exit code", clean_stop_exit:143},
  unit_sandbox:{ip_allow:["localhost"], ip_deny:["any"], private_tmp:true, protect_system:"strict", protect_home:"read-only"},
  host_connect:"127.0.0.1", token_mode_mask:63, redaction:"[redacted]",
  name_refused:{prefix:"mixos-", broker:["noded", "noded-*", "^[tc][a-z0-9]{1,7}-[a-z2-7]{22}$"]},
  start_refusals:{exit:2, codes:["RUNTIME", "NAME_INVALID", "NAME_RESERVED", "REGISTRY", "CONFIG", "TOKEN"]}
}