config

type CORSConfig struct {
	AllowOrigins     []string
	AllowMethods     []string
	AllowHeaders     []string
	ExposeHeaders    []string
	AllowCredentials bool
	MaxAge           string
}

type CacheConfig struct {
	LocalTTL time.Duration
}

type CatalogConfig struct {
	ModelsDevBaseURL string
}

type Config struct {
	AppEnv             string
	Server             ServerConfig
	Database           DatabaseConfig
	Redis              RedisConfig
	Cache              CacheConfig
	SemanticCache      SemanticCacheConfig
	SessionStore       SessionStoreConfig
	Kafka              KafkaConfig
	Telemetry          TelemetryConfig
	Metrics            MetricsConfig
	Playground         PlaygroundConfig
	Upstream           UpstreamConfig
	Provider           ProviderConfig
	Catalog            CatalogConfig
	CORS               CORSConfig
	Logger             LoggerConfig
	TrustGuard         TrustGuardConfig
	FirewallComplexity FirewallComplexityConfig
	OpenAIModeration   OpenAIModerationConfig
	ConfigSync         ConfigSyncConfig
	RateLimit          RateLimitConfig
}

type ConfigSyncConfig struct {
	DataPlaneEnabled bool
	Token            string // #nosec G117 -- config struct field, not a hardcoded credential
	// TokenPrevious is the prior bearer accepted alongside Token so a token can be
	// rotated without a window where in-flight data planes fail to authenticate.
	TokenPrevious string // #nosec G117 -- config struct field, not a hardcoded credential
	AuthMode      string
	// JWTSecret is the HS256 shared secret used to verify config-sync credentials
	// minted by DataCore. JWTSecretPrevious is the prior secret accepted alongside
	// it so the secret can be rotated without a window where data planes fail to
	// authenticate.
	JWTSecret         string // #nosec G117 -- config struct field, not a hardcoded credential
	JWTSecretPrevious string // #nosec G117 -- config struct field, not a hardcoded credential
	JWTIssuer         string
	JWTAudience       string
	LKGPath           string
	LKGKey            string // #nosec G117 -- config struct field, not a hardcoded credential
	PollInterval      time.Duration
	RecompileDebounce time.Duration
	// RecompileBackstop periodically recompiles even without a write signal so the
	// control plane recovers from a failed boot compile and picks up out-of-band
	// mutations.
	RecompileBackstop time.Duration
	InstanceID        string
	// GRPCEndpoint is the control-plane host:port the data plane dials for the
	// config-sync gRPC transport (ENG-959).
	GRPCEndpoint string
	// GRPCListenAddr is the control-plane listen address for the config-sync gRPC
	// server.
	GRPCListenAddr string
	TLSCAPath      string
	TLSServerName  string
	// TLSInsecure disables transport security on the data-plane dial. It is a
	// dev-only escape hatch and is rejected in deployed environments.
	TLSInsecure          bool
	GRPCTLSCertPath      string
	GRPCTLSKeyPath       string // #nosec G117 -- config struct field, not a hardcoded credential
	GRPCKeepaliveTime    time.Duration
	GRPCKeepaliveTimeout time.Duration
	GRPCMinBackoff       time.Duration
	GRPCMaxBackoff       time.Duration
	OutboxRetention      time.Duration
	OutboxMaxRows        int64
}

type DatabaseConfig struct {
	Login             string
	Host              string
	Port              int
	User              string
	Password          string // #nosec G117 -- config struct field, not a hardcoded credential
	Name              string
	SSLMode           string
	SSLRootCert       string
	MinConns          int32
	MaxConns          int32
	MaxConnLifetime   time.Duration
	MaxConnIdleTime   time.Duration
	HealthCheckPeriod time.Duration
	ConnectTimeout    time.Duration
}

type FirewallComplexityConfig struct {
	BaseURL string
	Token   string // #nosec G117 -- config struct field, not a hardcoded credential
	Timeout time.Duration
}

type KafkaConfig struct {
	Brokers []string
}

type LoggerConfig struct {
	Level       slog.Level
	Format      string
	FileEnabled bool
}

type MCPDefaultIdPConfig struct {
	// Issuer is the authorization server's issuer URL (e.g.
	// https://app.neuraltrust.ai/api/mcp/oauth). Empty disables the default.
	Issuer string
	// AuthorizeURL/TokenURL/JWKSURL default to {Issuer}/authorize, /token and
	// /jwks respectively when left empty.
	AuthorizeURL string
	TokenURL     string
	JWKSURL      string
	ClientID     string
	ClientSecret string // #nosec G117 -- config struct field, not a hardcoded credential
	Audiences    []string
	Scopes       []string
}

type MetricsConfig struct {
	Enabled       bool
	QueueSize     int
	WorkerCount   int
	FlushInterval time.Duration
}

type OTLPConfig struct {
	Endpoint    string
	Headers     map[string]string
	Protocol    string
	Timeout     time.Duration
	Insecure    bool
	Compression string
}

type OpenAIModerationConfig struct {
	BaseURL string
	Timeout time.Duration
}

type PlaygroundConfig struct {
	TraceStoreEnabled bool
	TraceStoreTTL     time.Duration
}

type ProviderConfig struct {
	RequestTimeout time.Duration
	MaxRetries     int
}

type RateLimitConfig struct {
	Enabled bool
}

type RedisConfig struct {
	Login             string
	Host              string
	Port              int
	Password          string
	DB                int
	TLSEnabled        bool
	TLSInsecureVerify bool
	Username          string
	CacheName         string
	AWSServerless     bool
}

type SemanticCacheConfig struct {
	VectorStore string
}

type ServerConfig struct {
	AdminPort    int
	ProxyPort    int
	MCPPort      int
	ReadTimeout  time.Duration
	WriteTimeout time.Duration
	IdleTimeout  time.Duration
	// SecretKey signs and verifies admin-plane JWTs and encrypts vault material.
	// Empty disables admin auth token acceptance until resolved. In prod, when
	// empty at boot, the DI layer auto-provisions a shared value in Redis
	// (see crypto.ResolveSharedSecretKey) so replicas converge.
	SecretKey         string
	GatewayBaseDomain string
	MCPBaseDomain     string
	STSIssuer         string
	STSSigningKey     string
	TrustXFCCFrom     []string
	// MCPDefaultIdP is the built-in NeuralTrust identity provider used as the
	// fallback OAuth2 login for MCP consumers that have no identity provider of
	// their own. Empty Issuer disables it (behaviour unchanged).
	MCPDefaultIdP MCPDefaultIdPConfig
}

type SessionStoreConfig struct {
	Enabled bool
	TTL     time.Duration
}

type TelemetryConfig struct {
	Enabled             bool
	KafkaTopic          string
	ExportersFile       string
	EnableRequestTraces bool
	EnablePluginTraces  bool
	// OpsMetricsEnabled turns on AgentGateway operational OTel metrics
	// (http.server.request.duration / agentgateway.request.outcome_total).
	// Independent of Enabled (product-event pipeline). Default false.
	OpsMetricsEnabled bool
	OTLP              OTLPConfig
}

type TrustGuardConfig struct {
	BaseURL      string
	Timeout      time.Duration
	ClientID     string
	ClientSecret string
}

type UpstreamConfig struct {
	Timeout          time.Duration
	ErrorPassthrough bool
}