feat(import): resolve references and schema composition

crates/crank-config/src/process.rs

@@ -12,7 +12,9 @@ use std::{
     path::PathBuf,
 };
 use url::Url;
+mod external_references;
 mod list_parsers;
+pub use external_references::ExternalReferenceSettings;
 const MAX_ENV_VALUE_BYTES: usize = 8_192;
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum ProcessKind {
@@ -127,6 +129,7 @@ pub struct ObservabilitySettings {
 pub struct AdminProcessConfig {
     pub database: DatabaseSettings,
     pub runtime: RuntimeSettings,
+    pub external_references: ExternalReferenceSettings,
     pub observability: ObservabilitySettings,
     pub bind_addr: SocketAddr,
     pub storage_root: PathBuf,
@@ -154,8 +157,8 @@ pub struct McpProcessConfig {
 
 #[derive(Clone)]
 enum Projection {
-    Admin(AdminProcessConfig),
-    Mcp(McpProcessConfig),
+    Admin(Box<AdminProcessConfig>),
+    Mcp(Box<McpProcessConfig>),
 }
 
 #[derive(Clone)]
@@ -790,9 +793,10 @@ pub fn parse_process(
             {
                 parser.push(DiagnosticCode::UnsafeCombination, "admin.exposure.tls");
             }
-            Projection::Admin(AdminProcessConfig {
+            Projection::Admin(Box::new(AdminProcessConfig {
                 database,
                 runtime,
+                external_references: external_references::parse(&mut parser),
                 observability,
                 bind_addr,
                 storage_root: parser.absolute_path("CRANK_STORAGE_ROOT", "/var/lib/crank/storage"),
@@ -811,7 +815,7 @@ pub fn parse_process(
                 bootstrap_display_name: parser
                     .string("CRANK_BOOTSTRAP_ADMIN_DISPLAY_NAME", Some("Crank Owner")),
                 demo_seed: parser.boolean("CRANK_DEMO_SEED"),
-            })
+            }))
         }
         ProcessKind::McpServer => {
             let rps = parser.number("CRANK_MCP_RATE_LIMIT_RPS") as u32;
@@ -819,7 +823,7 @@ pub fn parse_process(
             if burst < rps {
                 parser.push(DiagnosticCode::UnsafeCombination, "mcp.rate_limit.burst");
             }
-            Projection::Mcp(McpProcessConfig {
+            Projection::Mcp(Box::new(McpProcessConfig {
                 database,
                 runtime,
                 observability,
@@ -829,7 +833,7 @@ pub fn parse_process(
                     requests_per_second: rps,
                     burst,
                 },
-            })
+            }))
         }
     };
 
@@ -867,6 +871,18 @@ fn fingerprint_parts(kind: ProcessKind, projection: &Projection) -> Vec<String>
                 format!("session_ttl={}", config.session_ttl_hours),
                 format!("trusted_proxies={:?}", config.trusted_proxy_ips),
                 format!("demo={}", config.demo_seed),
+                format!(
+                    "external_reference_prefixes={}",
+                    config.external_references.allowed_url_prefixes.join(",")
+                ),
+                format!(
+                    "external_reference_limits={}:{}:{}:{}:{}",
+                    config.external_references.max_depth,
+                    config.external_references.max_documents,
+                    config.external_references.max_fetch_bytes,
+                    config.external_references.fetch_timeout_ms,
+                    config.external_references.max_expanded_nodes,
+                ),
                 "storage=path-configured".to_owned(),
                 format!("session_secret={}", config.session_secret.is_configured()),
                 format!("pepper={}", config.password_pepper.is_configured()),