config

type CORSConfig struct {
	AllowOrigins     []string
	AllowMethods     []string
	AllowHeaders     []string
	ExposeHeaders    []string
	AllowCredentials bool
	MaxAge           string
}

type CacheConfig struct {
	LocalTTL time.Duration
}

type CatalogConfig struct {
	ModelsDevBaseURL string
}

type Config struct {
	AppEnv           string
	Server           ServerConfig
	Database         DatabaseConfig
	Redis            RedisConfig
	Cache            CacheConfig
	SemanticCache    SemanticCacheConfig
	SessionStore     SessionStoreConfig
	Kafka            KafkaConfig
	Telemetry        TelemetryConfig
	Metrics          MetricsConfig
	Playground       PlaygroundConfig
	Upstream         UpstreamConfig
	Provider         ProviderConfig
	Catalog          CatalogConfig
	CORS             CORSConfig
	Logger           LoggerConfig
	TrustGuard       TrustGuardConfig
	OpenAIModeration OpenAIModerationConfig
	ConfigSync       ConfigSyncConfig
}

type ConfigSyncConfig struct {
	DataPlaneEnabled bool
	Token            string // #nosec G117 -- config struct field, not a hardcoded credential
	// TokenPrevious is the prior bearer accepted alongside Token so a token can be
	// rotated without a window where in-flight data planes fail to authenticate.
	TokenPrevious     string // #nosec G117 -- config struct field, not a hardcoded credential
	AuthMode          string
	JWTPublicKey      string // #nosec G117 -- config struct field, not a hardcoded credential
	JWTJWKSURL        string
	JWTIssuer         string
	JWTAudience       string
	LKGPath           string
	LKGKey            string // #nosec G117 -- config struct field, not a hardcoded credential
	PollInterval      time.Duration
	RecompileDebounce time.Duration
	// RecompileBackstop periodically recompiles even without a write signal so the
	// control plane recovers from a failed boot compile and picks up out-of-band
	// mutations.
	RecompileBackstop time.Duration
	InstanceID        string
	// GRPCEndpoint is the control-plane host:port the data plane dials for the
	// config-sync gRPC transport (ENG-959).
	GRPCEndpoint string
	// GRPCListenAddr is the control-plane listen address for the config-sync gRPC
	// server.
	GRPCListenAddr string
	TLSCAPath      string
	TLSServerName  string
	// TLSInsecure disables transport security on the data-plane dial. It is a
	// dev-only escape hatch and is rejected in deployed environments.
	TLSInsecure          bool
	GRPCTLSCertPath      string
	GRPCTLSKeyPath       string // #nosec G117 -- config struct field, not a hardcoded credential
	GRPCKeepaliveTime    time.Duration
	GRPCKeepaliveTimeout time.Duration
	GRPCMinBackoff       time.Duration
	GRPCMaxBackoff       time.Duration
	OutboxRetention      time.Duration
	OutboxMaxRows        int64
}

type DatabaseConfig struct {
	Host              string
	Port              int
	User              string
	Password          string // #nosec G117 -- config struct field, not a hardcoded credential
	Name              string
	SSLMode           string
	SSLRootCert       string
	MinConns          int32
	MaxConns          int32
	MaxConnLifetime   time.Duration
	MaxConnIdleTime   time.Duration
	HealthCheckPeriod time.Duration
	ConnectTimeout    time.Duration
}

type KafkaConfig struct {
	Brokers []string
}

type LoggerConfig struct {
	Level       slog.Level
	Format      string
	FileEnabled bool
}

type MetricsConfig struct {
	Enabled       bool
	QueueSize     int
	WorkerCount   int
	FlushInterval time.Duration
}

type OTLPConfig struct {
	Endpoint    string
	Headers     map[string]string
	Protocol    string
	Timeout     time.Duration
	Insecure    bool
	Compression string
}

type OpenAIModerationConfig struct {
	BaseURL string
	Timeout time.Duration
}

type PlaygroundConfig struct {
	TraceStoreEnabled bool
	TraceStoreTTL     time.Duration
}

type ProviderConfig struct {
	RequestTimeout time.Duration
	MaxRetries     int
}

type RedisConfig struct {
	Host              string
	Port              int
	Password          string
	DB                int
	TLSEnabled        bool
	TLSInsecureVerify bool
}

type SemanticCacheConfig struct {
	VectorStore string
}

type ServerConfig struct {
	AdminPort    int
	ProxyPort    int
	MCPPort      int
	ReadTimeout  time.Duration
	WriteTimeout time.Duration
	IdleTimeout  time.Duration
	// SecretKey signs and verifies admin-plane JWTs. Empty disables admin auth
	// token acceptance (every token is rejected).
	SecretKey            string
	GatewayBaseDomain    string
	MCPBaseDomain        string
	GatewayDiscoveryMode string
	STSIssuer            string
	STSSigningKey        string
	TrustXFCCFrom        []string
}

type SessionStoreConfig struct {
	Enabled bool
	TTL     time.Duration
}

type TelemetryConfig struct {
	Enabled             bool
	KafkaTopic          string
	ExportersFile       string
	EnableRequestTraces bool
	EnablePluginTraces  bool
	OTLP                OTLPConfig
}

type TrustGuardConfig struct {
	BaseURL      string
	Timeout      time.Duration
	ClientID     string
	ClientSecret string
}

type UpstreamConfig struct {
	Timeout          time.Duration
	ErrorPassthrough bool
}