settings

var Fields = []Field{
	{Key: "rl_enabled", Group: "Rate limiting", Label: "Enabled", Type: "bool", Live: true,
		Get: func(v Values) string { return boolStr(v.RLEnabled) },
		Set: func(v *Values, s string) error { v.RLEnabled = truthy(s); return nil }},
	intField("rl_ip_rpm", "Rate limiting", "Per-IP requests / minute", "Sustained per-IP request rate.",
		func(v Values) int { return v.IPPerMin }, func(v *Values, n int) { v.IPPerMin = n }, 1, 1_000_000),
	intField("rl_ip_burst", "Rate limiting", "Per-IP burst", "Bucket size — absorbs short bursts (page loads).",
		func(v Values) int { return v.IPBurst }, func(v *Values, n int) { v.IPBurst = n }, 1, 1_000_000),
	intField("rl_token_rpm", "Rate limiting", "Per-token requests / minute", "Per agent token (MCP).",
		func(v Values) int { return v.TokenPerMin }, func(v *Values, n int) { v.TokenPerMin = n }, 1, 1_000_000),
	intField("rl_token_burst", "Rate limiting", "Per-token burst", "",
		func(v Values) int { return v.TokenBurst }, func(v *Values, n int) { v.TokenBurst = n }, 1, 1_000_000),
	intField("rl_block_after", "Rate limiting", "Auto-block after", "Consecutive over-limit rejections before an IP is blocked (0 = never block).",
		func(v Values) int { return v.BlockAfter }, func(v *Values, n int) { v.BlockAfter = n }, 0, 1_000_000),
	intField("rl_lockout_sec", "Rate limiting", "Auto-block lockout (seconds)", "",
		func(v Values) int { return v.LockoutSec }, func(v *Values, n int) { v.LockoutSec = n }, 1, 7*24*3600),
	{Key: "rl_allow_cidrs", Group: "Rate limiting", Label: "Always-allowed CIDRs", Type: "cidrs", Live: true,
		Help: "Comma-separated CIDRs exempt from rate limiting (loopback is always exempt).",
		Get:  func(v Values) string { return v.AllowCIDRs },
		Set:  setCIDRs(func(v *Values, s string) { v.AllowCIDRs = s })},

	intField("login_max_fails", "Login", "Max failed logins", "Failures from one IP before a lockout.",
		func(v Values) int { return v.LoginMaxFails }, func(v *Values, n int) { v.LoginMaxFails = n }, 1, 10000),
	intField("login_lockout_sec", "Login", "Login lockout (seconds)", "",
		func(v Values) int { return v.LoginLockoutSec }, func(v *Values, n int) { v.LoginLockoutSec = n }, 1, 7*24*3600),
	intField("session_ttl_hours", "Session", "Session lifetime (hours)", "New sessions only.",
		func(v Values) int { return v.SessionTTLHours }, func(v *Values, n int) { v.SessionTTLHours = n }, 1, 24*30),

	{Key: "trusted_proxies", Group: "Network", Label: "Trusted proxy CIDRs", Type: "cidrs", Live: true,
		Help: "X-Forwarded-For is honored only from these peers. Blank = none. Sensitive: over-broad values let a client forge its IP.",
		Get:  func(v Values) string { return v.TrustedProxies },
		Set:  setCIDRs(func(v *Values, s string) { v.TrustedProxies = s })},

	{Key: "tls_mode", Group: "TLS", Label: "TLS mode", Type: "enum", ReadOnly: true,
		Help: "Set via KEN_TLS in the unit; a mode switch (off/acme/file) needs a service restart.",
		Get:  func(v Values) string { return v.TLSMode }},
	{Key: "tls_domains", Group: "TLS", Label: "ACME domains", Type: "domains", Live: true,
		Help: "Comma-separated hostnames the Let's Encrypt cert is issued for. Live (acme mode); a new host is issued on demand.",
		Get:  func(v Values) string { return v.TLSDomains },
		Set:  setDomains(func(v *Values, s string) { v.TLSDomains = s })},
	{Key: "tls_email", Group: "TLS", Label: "ACME account email", Type: "email", ReadOnly: true,
		Help: "Set via KEN_TLS_EMAIL; used when registering the Let's Encrypt account (not editable here).",
		Get:  func(v Values) string { return v.TLSEmail }},

	{Key: "curation_langs", Group: "Curation", Label: "Curation language(s)", Type: "langs", Live: true,
		Help: "Comma-separated language codes you can read (e.g. fr,zh). Agents are told to author entries in these so you can review and promote them; proposals outside them are flagged on the review queue. Blank = off.",
		Get:  func(v Values) string { return v.CurationLangs },
		Set:  setLangs(func(v *Values, s string) { v.CurationLangs = s })},

	intField("comm_max_body_bytes", "Inter-session comms", "Max message size (bytes)",
		"Message bodies are atomic; there is no multi-part send. Keep this small — tool arguments are generated token by token by a model, so even 64 KiB is a five-figure token count.",
		func(v Values) int { return v.CommMaxBodyBytes }, func(v *Values, n int) { v.CommMaxBodyBytes = n }, 256, 1<<20),
	intField("comm_max_unacked", "Inter-session comms", "Max unacknowledged per channel",
		"Backpressure. Past this a send is refused so two auto-processing sessions cannot loop unboundedly.",
		func(v Values) int { return v.CommMaxUnacked }, func(v *Values, n int) { v.CommMaxUnacked = n }, 1, 100_000),
	intField("comm_message_ttl_sec", "Inter-session comms", "Lifetime after delivery (seconds)",
		"How long a DELIVERED but unacknowledged message survives. The clock starts when the recipient is first handed the message, not when it was sent — a session goes 16 h between pulls on a weeknight and 64 h over a weekend, so a send-anchored clock expired mail during the exact window nobody could read it.",
		func(v Values) int { return v.CommMessageTTLSec }, func(v *Values, n int) { v.CommMessageTTLSec = n }, 60, 30*24*3600),
	intField("comm_undelivered_ttl_sec", "Inter-session comms", "Lifetime before delivery (seconds)",
		"Backstop for a message NOBODY has ever polled — it only bounds mail addressed to an endpoint that never comes back. Undelivered mail is bounded first by the per-channel unacknowledged cap, which is a volume limit and therefore immune to how long a human is away. Set this longer than the longest absence you expect: a fortnight's leave is 400 h.",
		func(v Values) int { return v.CommUndeliveredTTLSec }, func(v *Values, n int) { v.CommUndeliveredTTLSec = n }, 3600, 90*24*3600),
	intField("comm_body_retention_sec", "Inter-session comms", "Body retention after settling (seconds)",
		"How long a message's TEXT survives after it is acknowledged or expires. ZERO restores the old behaviour of deleting the body the moment it is acknowledged — which destroyed 97% of one deployment's message bodies through the ordinary poll/act/acknowledge path, because the unacknowledged inbox was the only place a body ever existed.",
		func(v Values) int { return v.CommBodyRetentionSec }, func(v *Values, n int) { v.CommBodyRetentionSec = n }, 0, 90*24*3600),
	intField("comm_metadata_ttl_sec", "Inter-session comms", "Metadata retention (seconds)",
		"How long a settled message's row survives after it was created. NOTE: since bodies now survive acknowledgement (see Body retention), this is also the ONLY bound on a body that was never delivered — retention cannot reclaim one, because a message nobody received has no settle time to measure from. Raising this for a longer audit trail multiplies retained undelivered bytes with it.",
		func(v Values) int { return v.CommMetadataTTLSec }, func(v *Values, n int) { v.CommMetadataTTLSec = n }, 60, 90*24*3600),
	intField("comm_reply_deadline_sec", "Inter-session comms", "Reply deadline (seconds)",
		"Default deadline for a message that requires a response; past it the sender is told the reply is overdue instead of waiting forever.",
		func(v Values) int { return v.CommReplyDeadlineS }, func(v *Values, n int) { v.CommReplyDeadlineS = n }, 30, 7*24*3600),
	intField("comm_pairing_code_ttl_sec", "Inter-session comms", "Pairing code lifetime (seconds)",
		"How long a code you mint stays usable. Short is good: it only has to survive being pasted into two sessions.",
		func(v Values) int { return v.CommPairingCodeTTLS }, func(v *Values, n int) { v.CommPairingCodeTTLS = n }, 30, 24*3600),
	intField("comm_poll_wait_max_sec", "Inter-session comms", "Max long-poll wait (seconds)",
		"Ceiling on how long a receive call may block. Clamped to 30 in code regardless: a wait that ties the client's tool timeout turns a successful empty poll into an error.",
		func(v Values) int { return v.CommPollWaitMaxSec }, func(v *Values, n int) { v.CommPollWaitMaxSec = n }, 1, 30),
	intField("comm_provenance_window_sec", "Inter-session comms", "Hearsay window (seconds)",
		"If a token received an inter-session message this recently, entries it authors are flagged on the review queue as possibly second-hand. 0 disables the flag.",
		func(v Values) int { return v.CommProvenanceWindowSec }, func(v *Values, n int) { v.CommProvenanceWindowSec = n }, 0, 7*24*3600),

	{Key: "comm_files_enabled", Group: "Inter-session comms", Label: "File exchange enabled", Type: "bool", Live: true,
		Help: "Lets paired sessions exchange files (same-host handoff, or relayed through Ken). Off by default — the relay stores bytes on this server's disk.",
		Get:  func(v Values) string { return boolStr(v.CommFilesEnabled) },
		Set:  func(v *Values, s string) error { v.CommFilesEnabled = truthy(s); return nil }},
	intField("comm_file_max_mb", "Inter-session comms", "Max file size (MB)",
		"Cap on one relayed or offered file.",
		func(v Values) int { return v.CommFileMaxMB }, func(v *Values, n int) { v.CommFileMaxMB = n }, 1, 1024),
	intField("comm_file_budget_mb", "Inter-session comms", "Relay storage budget (MB)",
		"Global cap on bytes held in the relay at once. The relay shares this server's disk with the knowledge base; filling it would fail durable writes over chat traffic.",
		func(v Values) int { return v.CommFileBudgetMB }, func(v *Values, n int) { v.CommFileBudgetMB = n }, 1, 100_000),
	intField("comm_file_min_free_mb", "Inter-session comms", "Free-space floor (MB)",
		"Uploads are refused when the disk has less than this free, even under budget, so the knowledge base always has headroom. 0 disables the floor.",
		func(v Values) int { return v.CommFileMinFreeMB }, func(v *Values, n int) { v.CommFileMinFreeMB = n }, 0, 1_000_000),
	intField("comm_file_ttl_sec", "Inter-session comms", "File lifetime (seconds)",
		"How long an offered or undelivered file survives before it expires and its bytes are deleted.",
		func(v Values) int { return v.CommFileTTLSec }, func(v *Values, n int) { v.CommFileTTLSec = n }, 60, 30*24*3600),
	intField("comm_grant_ttl_sec", "Inter-session comms", "Transfer grant lifetime (seconds)",
		"How long a one-time upload/download URL stays valid. Short is right: it only has to survive being handed to curl.",
		func(v Values) int { return v.CommGrantTTLSec }, func(v *Values, n int) { v.CommGrantTTLSec = n }, 60, 3600),
	intField("comm_endpoint_idle_sec", "Inter-session comms", "Idle session cleanup (seconds)",
		"How long a registered session with no message traffic survives before it is removed. An actively polling session refreshes its last-seen and is never removed; this only reaps sessions that registered and went away. Keep it comfortably longer than a working session's idle gaps.",
		func(v Values) int { return v.CommEndpointIdleTTLSec }, func(v *Values, n int) { v.CommEndpointIdleTTLSec = n }, 300, 90*24*3600),
	intField("comm_claim_lease_sec", "Inter-session comms", "Station claim lease (seconds)",
		"When several sessions staff one station, the first to poll a message claims it and the others do not see it. This is how long that claim lasts before the message returns to the queue for another session to pick up. It only matters if you use stations; too short and a session still working gets undercut, too long and a session that died holds its messages out of reach.",
		func(v Values) int { return v.CommClaimLeaseSec }, func(v *Values, n int) { v.CommClaimLeaseSec = n }, 30, 3600),

	intField("station_note_page_kib", "Stations", "Notebook page size (KiB)",
		"The largest a single notebook page may be. A page bigger than this is a document rather than a note, and notebook pages travel in every backup.",
		func(v Values) int { return v.StationNotePageKiB }, func(v *Values, n int) { v.StationNotePageKiB = n }, 1, 1024),
	intField("station_note_revision_kib", "Stations", "Revision history per page (KiB)",
		"How much edit history one page keeps before the oldest revisions are dropped. This is an undo buffer, not an archive — it exists so a session can recover from its own bad overwrite.",
		func(v Values) int { return v.StationNoteRevisionKiB }, func(v *Values, n int) { v.StationNoteRevisionKiB = n }, 0, 4096),
	intField("station_notebook_kib", "Stations", "Notebook per station (KiB)",
		"Total size of a station's current notebook pages, excluding history. Roughly sixty full pages at the default page size.",
		func(v Values) int { return v.StationNotebookKiB }, func(v *Values, n int) { v.StationNotebookKiB = n }, 64, 65536),
	intField("station_locker_blob_kib", "Stations", "Locker file size (KiB)",
		"The largest single file a station may store. The locker is for memory and instruction files, not payloads.",
		func(v Values) int { return v.StationLockerBlobKiB }, func(v *Values, n int) { v.StationLockerBlobKiB = n }, 1, 4096),
	intField("station_locker_total_kib", "Stations", "Locker per station (KiB)",
		"Total locker storage one station may use. Everything here lands verbatim in your backups, and Ken cannot inspect it.",
		func(v Values) int { return v.StationLockerTotalKiB }, func(v *Values, n int) { v.StationLockerTotalKiB = n }, 16, 65536),
	intField("station_max_open_tasks", "Stations", "Open tasks per station",
		"How many tasks a station may have open at once. A list longer than this is not being worked, and refusing is more honest than letting it grow.",
		func(v Values) int { return v.StationMaxOpenTasks }, func(v *Values, n int) { v.StationMaxOpenTasks = n }, 10, 5000),
	intField("station_task_text_bytes", "Stations", "Task line length (bytes)",
		"A task's one-line summary and its resolution line. Short by construction: anything needing more belongs in the detail field or a notebook page.",
		func(v Values) int { return v.StationTaskTextBytes }, func(v *Values, n int) { v.StationTaskTextBytes = n }, 64, 4096),
	intField("station_task_detail_bytes", "Stations", "Task detail size (bytes)",
		"The optional detail and context attached to a task. A task needing more than this is really a notebook page with a plan.",
		func(v Values) int { return v.StationTaskDetailBytes }, func(v *Values, n int) { v.StationTaskDetailBytes = n }, 256, 65536),
	intField("station_task_list_limit", "Stations", "Task list page size",
		"The default AND maximum number of tasks one listing returns. It bounds how much of the pile a session can pull into its context at once.",
		func(v Values) int { return v.StationTaskListLimit }, func(v *Values, n int) { v.StationTaskListLimit = n }, 5, 200),
}