config

type AuthBackendSettings struct {
	Type  string `json:"type,omitempty"`  // "sqlite" (default) or "file"
	Store string `json:"store,omitempty"` // Backend location (sqlite db path or key file path)
}

type BuiltinPathBoundarySettings struct {
	AllowedRoots     []string
	RelativeBaseRoot string
	ToolPatterns     []string
	ArgumentPaths    []string
	DeniedPaths      []string
}

type BuiltinProcessorSettings struct {
	Processor    string
	Mode         string
	Scope        string
	Rules        []BuiltinRedactionRule
	Presets      []string
	GuardRules   []BuiltinToolGuardRule
	PathBoundary *BuiltinPathBoundarySettings
}

type BuiltinRedactionRule struct {
	Name        string
	Pattern     string
	Replacement string
}

type BuiltinToolGuardArgumentRule struct {
	Path    string
	Pattern string
}

type BuiltinToolGuardRule struct {
	Name          string
	Category      string
	Severity      string
	Message       string
	ToolPatterns  []string
	ArgumentRules []BuiltinToolGuardArgumentRule
}

type CLIProcessorSettings struct {
	Command string
	Args    []string
}

type CapabilitiesSettings struct {
	TaskVerification *TaskVerificationCapabilitySettings `json:"taskVerification,omitempty"`
	EventStorage     *EventStorageCapabilitySettings     `json:"eventStorage,omitempty"`
	TestTools        *TestToolsCapabilitySettings        `json:"testTools,omitempty"`
	UI               *UICapabilitySettings               `json:"ui,omitempty"`
}

type EventStorageCapabilitySettings struct {
	Enabled *bool  `json:"enabled,omitempty"`
	Driver  string `json:"driver,omitempty"`
	Path    string `json:"path,omitempty"`
}

type GatewayConfig struct {
	AllowDynamic            bool                        `json:"allowDynamic,omitempty"`            // Allow dynamic proxy endpoints
	AllowGatewayEndpoint    bool                        `json:"setupGateway,omitempty"`            // Setup gateway endpoint with namespacing
	ForceReadOnlyHints      *bool                       `json:"forceReadOnlyHints,omitempty"`      // Override all tool annotations to readOnlyHint=true
	ForceSafeToolHints      *bool                       `json:"forceSafeToolHints,omitempty"`      // Override all tool annotations to conservative safe defaults for MCP clients
	VerificationRequirement string                      `json:"verificationRequirement,omitempty"` // Gateway task verification policy: off, optional, required
	MCPServers              map[string]*MCPServerConfig `json:"mcpServers"`                        // HTTP MCP servers in this gateway
	Processors              []*ProcessorConfig          `json:"processors,omitempty"`
}

type GlobalConfig struct {
	Name    string `json:"name"`    // Name of the server - simplifies server identification
	Version string `json:"version"` // Config schema version

	// Truly global settings - apply to the whole server process.
	Proxy       *ProxySettings       `json:"proxy,omitempty"`       // Proxy-level settings (host, port, logLevel, logOutput, timeout)
	AuthBackend *AuthBackendSettings `json:"authBackend,omitempty"` // Global principal/credential storage backend

	// Project-based layout: each project is an isolated tenant.
	Projects map[string]*ProjectConfig `json:"projects,omitempty"` // Named project configs

	// Legacy flat fields - auto-migrated into a "default" project by ResolveProjects().
	// When Projects is non-empty these MUST be empty (enforced by validation).
	AuthEnabled *bool                     `json:"auth,omitempty"`       // Enable or disable proxy auth
	AuthHeader  string                    `json:"authHeader,omitempty"` // Header name for proxy auth
	Gateways    map[string]*GatewayConfig `json:"gateways,omitempty"`   // HTTP proxy gateways
	Processors  []*ProcessorConfig        `json:"processors,omitempty"` // Processor chain
	Metadata    map[string]interface{}    `json:"metadata,omitempty"`   // Additional metadata
}

type ImportedServer struct {
	Name        string
	Command     string
	Args        []string
	Env         map[string]string
	URL         string
	Headers     map[string]string
	Transport   string
	Description string
	Source      string
	SourcePath  string
}

type MCPServerConfig struct {
	Name        string                 `json:"name"`                  // MCP Server name - used to reference this specific server
	Command     string                 `json:"command,omitempty"`     // MCP Server Executable command (for stdio/process transport)
	Args        []string               `json:"args,omitempty"`        // MCP Server Command arguments
	Env         map[string]string      `json:"env,omitempty"`         // Environment variables
	URL         string                 `json:"url,omitempty"`         // MCP Server URL (for http/sse transport)
	Headers     map[string]string      `json:"headers,omitempty"`     // HTTP headers (supports ${ENV_VAR} substitution)
	OAuth       *OAuthConfig           `json:"oauth,omitempty"`       // Downstream OAuth settings for HTTP MCP servers
	Enabled     *bool                  `json:"enabled,omitempty"`     // Whether server is active
	Description string                 `json:"description,omitempty"` // Human readable description
	Source      string                 `json:"source,omitempty"`      // Source file path for auto-discovered servers
	Config      map[string]interface{} `json:"config,omitempty"`      // Server-specific config
}

type OAuthConfig struct {
	Enabled               bool     `json:"enabled"`
	ClientID              string   `json:"clientId,omitempty"`
	ClientSecret          string   `json:"clientSecret,omitempty"`
	ClientAuthMethod      string   `json:"clientAuthMethod,omitempty"`
	Scopes                []string `json:"scopes,omitempty"`
	Resource              string   `json:"resource,omitempty"`
	Issuer                string   `json:"issuer,omitempty"`
	AuthorizationEndpoint string   `json:"authorizationEndpoint,omitempty"`
	TokenEndpoint         string   `json:"tokenEndpoint,omitempty"`
}

type ProcessorConfig struct {
	Name    string                 `json:"name"`              // Unique processor name
	Type    string                 `json:"type"`              // Processor type: "cli", "webhook", or "builtin"
	Enabled bool                   `json:"enabled"`           // Whether processor is active
	Timeout int                    `json:"timeout,omitempty"` // Timeout in seconds (default: 15)
	Parts   []string               `json:"parts,omitempty"`   // Which context parts to provide: "payload", "meta", "routing", "auth", "annotations" (default: ["payload","meta"])
	Config  map[string]interface{} `json:"config"`            // Type-specific configuration

	// Determines if processor is required to run, "false" by default,
	// meaning the processor can both fail initiation and
	// processing without causing the whole processor chain to fail.
	// If set to true, a failure will cause subsequent processors NOT to run.
	Required bool `json:"required"`
}

type ProcessorType string

type ProjectConfig struct {
	Slug        string `json:"slug,omitempty"`        // URL-safe project slug (derived from map key if empty)
	Description string `json:"description,omitempty"` // Human readable project description
	AuthEnabled *bool  `json:"auth,omitempty"`        // Enable or disable project-level auth
	AuthHeader  string `json:"authHeader,omitempty"`  // Header name for project-level auth

	Capabilities *CapabilitiesSettings     `json:"capabilities,omitempty"` // Project-scoped feature flags
	Web          *ProxyWebSettings         `json:"web,omitempty"`          // Public web settings (OAuth flows)
	Gateways     map[string]*GatewayConfig `json:"gateways,omitempty"`     // HTTP proxy gateways
	Processors   []*ProcessorConfig        `json:"processors,omitempty"`   // Processor chain
	Metadata     map[string]interface{}    `json:"metadata,omitempty"`     // Additional metadata
}

type ProxySettings struct {
	Host         string                `json:"host,omitempty"`         // Bind address for the proxy
	Port         string                `json:"port,omitempty"`         // HTTP proxy port (if enabled)
	LogLevel     string                `json:"logLevel,omitempty"`     // debug, info, warn, error
	LogOutput    string                `json:"logOutput,omitempty"`    // file, console, both
	LogFile      string                `json:"logFile,omitempty"`      // Log file path for internal logger
	Timeout      int                   `json:"timeout,omitempty"`      // Request timeout in seconds
	Capabilities *CapabilitiesSettings `json:"capabilities,omitempty"` // Optional proxy-owned capabilities
	Web          *ProxyWebSettings     `json:"web,omitempty"`          // Public web settings for hosted OAuth flows
}

type ProxyWebSettings struct {
	PublicBaseURL string `json:"publicBaseUrl,omitempty"`
}

type ServerSearchResult struct {
	// contains filtered or unexported fields
}

type TaskVerificationCapabilitySettings struct {
	Enabled            *bool  `json:"enabled,omitempty"`
	TemplatesPath      string `json:"templatesPath,omitempty"`
	IdleTimeoutSeconds int    `json:"idleTimeoutSeconds,omitempty"`
}

type TestToolsCapabilitySettings struct {
	Enabled *bool `json:"enabled,omitempty"`
}

type UICapabilitySettings struct {
	Enabled *bool `json:"enabled,omitempty"`
}

type WebhookProcessorSettings struct {
	URL     string
	Headers map[string]string
}