config

type AgentAIConfig struct {
	// Enable gates whether the AI SRE is called at all. When false
	// (the default) detect mode still classifies patterns but never calls
	// the LLM — it only logs what it would have sent. This allows operators
	// to run detect mode in a "dry-run" fashion without an API key.
	Enable bool `mapstructure:"enable"`
	// APIKey is the bearer token sent in the Authorization header.
	APIKey string `mapstructure:"api_key"`
	// Model is the model identifier, e.g. "gpt-4o-mini".
	Model string `mapstructure:"model"`
	// Temperature controls randomness (0.0–2.0). Default 0.2.
	Temperature float64 `mapstructure:"temperature"`
	// MaxTokens caps the response length. Default 512.
	MaxTokens int `mapstructure:"max_tokens"`
	// MaxCallsPerHour is a sliding-window rate limit. 0 = unlimited.
	MaxCallsPerHour int `mapstructure:"max_calls_per_hour"`
	// CacheTTL is how long an AI result for a pattern_id is cached to
	// avoid re-asking about the same pattern. Default "1h".
	CacheTTL string `mapstructure:"cache_ttl"`
}

type AgentCatalogConfig struct {
	PersistInterval  string `mapstructure:"persist_interval"`   // e.g. "30s"
	AutoPromoteAfter int    `mapstructure:"auto_promote_after"` // 0 = never
	// SpikeMultiplier flags a tick as a frequency spike when the tick
	// count exceeds the pattern's prior EWMA baseline by this factor.
	// 0 disables spike detection. Default 5.0.
	SpikeMultiplier float64 `mapstructure:"spike_multiplier"`
	// SpikeMinFrequency is the minimum tick count required before a spike
	// can fire. Avoids triggering on tiny absolute counts (e.g. baseline
	// 0.5 → tickFreq 3 is technically 6× but not interesting). Default 5.
	SpikeMinFrequency int `mapstructure:"spike_min_frequency"`
	// SpikeMinBaselineCount is the minimum total observations required on
	// a pattern before spike detection considers it. Avoids treating a
	// barely-seen pattern's first big tick as a spike. Default 20.
	SpikeMinBaselineCount int `mapstructure:"spike_min_baseline_count"`
}

type AgentCloudWatchLogsSourceConfig struct {
	// Region, e.g. "us-east-1". Required.
	Region string `mapstructure:"region"`
	// LogGroupName is the CloudWatch log group, e.g. "/aws/lambda/my-fn".
	// Required.
	LogGroupName string `mapstructure:"log_group_name"`
	// LogStreamPrefix optionally restricts events to streams whose name
	// starts with this prefix (cheaper than scanning the whole group).
	LogStreamPrefix string `mapstructure:"log_stream_prefix"`
	// FilterPattern is a CloudWatch Logs filter pattern (NOT a regex).
	// See AWS docs. Empty matches every event.
	FilterPattern string `mapstructure:"filter_pattern"`
	// PageSize is the per-call limit (max 10000). Default 500.
	PageSize int `mapstructure:"page_size"`
}

type AgentConfig struct {
	Enable         bool   `mapstructure:"enable"`
	Mode           string `mapstructure:"mode"`          // training | shadow | detect
	PollInterval   string `mapstructure:"poll_interval"` // e.g. "30s"
	Lookback       string `mapstructure:"lookback"`      // e.g. "5m"
	BatchMax       int    `mapstructure:"batch_max"`
	SignalMaxBytes int    `mapstructure:"signal_max_bytes"`

	// NewServiceGrace is the duration a newly discovered service stays in
	// implicit training mode before detect-mode AI analysis begins. Signals
	// from a service still in its grace period flow through the full pipeline
	// (redact → regex → miner → catalog) but are not forwarded to the AI
	// analyzer. Set to "0" to disable (all services analysed immediately).
	NewServiceGrace string `mapstructure:"new_service_grace"` // e.g. "30m"
	// ServicePatterns is an ordered list of regexes applied to each
	// (post-redaction) log message to discover the service name.
	ServicePatterns []string `mapstructure:"service_patterns"`

	Redaction AgentRedactionConfig `mapstructure:"redaction"`
	Catalog   AgentCatalogConfig   `mapstructure:"catalog"`
	Miner     AgentMinerConfig     `mapstructure:"miner"`
	Regex     AgentRegexConfig     `mapstructure:"regex"`
	AI        AgentAIConfig        `mapstructure:"ai"`

	// Sources is the list of enabled signal sources. Versus loads it from
	// the file `agent_sources.yaml` sitting next to the main config file
	// (path is hardcoded; missing file is OK — the agent simply has no
	// sources). The file's top-level key is `sources`. ${VAR} references
	// in the file are expanded against the process environment.
	Sources []AgentSourceConfig `mapstructure:"sources"`
}

type AgentElasticsearchSourceConfig struct {
	Addresses          []string `mapstructure:"addresses"`
	Username           string   `mapstructure:"username"`
	Password           string   `mapstructure:"password"`
	APIKey             string   `mapstructure:"api_key"`
	InsecureSkipVerify bool     `mapstructure:"insecure_skip_verify"`
	Index              string   `mapstructure:"index"`
	TimeField          string   `mapstructure:"time_field"`
	Query              string   `mapstructure:"query"` // Lucene-style query string
	MessageField       string   `mapstructure:"message_field"`
	SeverityField      string   `mapstructure:"severity_field"`
	ExtraFields        []string `mapstructure:"extra_fields"`
	PageSize           int      `mapstructure:"page_size"`
}

type AgentFileSourceConfig struct {
	// Path to the log file. Globs are NOT supported (one source = one file).
	Path string `mapstructure:"path"`
	// Format: "text" (default) or "json" (one JSON object per line).
	Format string `mapstructure:"format"`
	// CursorPath overrides the default sidecar cursor file location
	// (default: <agent.data_dir>/cursors/file-<source_name>.cursor).
	CursorPath string `mapstructure:"cursor_path"`
	// FromBeginning controls behavior when there is no cursor yet.
	// false (default) starts at the current end of the file (tail-like).
	// true reads the whole file from the start (replay-like — useful for tests).
	FromBeginning bool `mapstructure:"from_beginning"`
	// MaxLineBytes caps a single line's length to protect memory; longer
	// lines are truncated. Default 64 KiB.
	MaxLineBytes int `mapstructure:"max_line_bytes"`
	// MaxLinesPerPull caps the number of lines returned by a single Pull.
	// When the file has a large backlog (e.g. from_beginning=true on a 100k-
	// line file), this paginates the backfill across ticks so the worker's
	// batch_max truncation never silently drops unread tail content. The
	// byte offset only advances over what was actually consumed in this
	// Pull, so the next tick resumes exactly where this one stopped.
	// Default 1000.
	MaxLinesPerPull int `mapstructure:"max_lines_per_pull"`

	// TimestampLayout is a Go time layout (e.g. "2006-01-02T15:04:05Z07:00")
	// used to parse a leading timestamp from each line. When empty the
	// source uses time.Now() at read time. Default tries RFC3339Nano then
	// RFC3339, then "2006-01-02 15:04:05".
	TimestampLayout string `mapstructure:"timestamp_layout"`

	MessageField   string `mapstructure:"message_field"`   // default: "message"
	TimestampField string `mapstructure:"timestamp_field"` // default: "@timestamp"
	SeverityField  string `mapstructure:"severity_field"`  // default: "level"
}

type AgentLokiSourceConfig struct {
	// Address is the Loki base URL, e.g. "http://loki:3100".
	Address string `mapstructure:"address"`
	// TenantID, when set, is sent as the `X-Scope-OrgID` header (multi-tenant
	// Loki / Grafana Cloud).
	TenantID string `mapstructure:"tenant_id"`
	// Username/Password enable HTTP Basic auth (Grafana Cloud uses
	// instance ID / API token).
	Username string `mapstructure:"username"`
	Password string `mapstructure:"password"`
	// BearerToken is sent as `Authorization: Bearer <token>` when set.
	// Mutually exclusive with Username/Password (Bearer wins).
	BearerToken        string `mapstructure:"bearer_token"`
	InsecureSkipVerify bool   `mapstructure:"insecure_skip_verify"`
	// Query is a LogQL selector, e.g. `{app="api",env="prod"} |= "error"`.
	// Required.
	Query string `mapstructure:"query"`
	// SeverityField, when set, is read from each entry's stream labels
	// (e.g. "level") to populate Signal.Severity.
	SeverityField string `mapstructure:"severity_field"`
	// ExtraLabels are additional stream labels copied into Signal.Fields.
	ExtraLabels []string `mapstructure:"extra_labels"`
	// PageSize is the per-query limit (Loki caps this around 5000 by
	// default). Default 500.
	PageSize int `mapstructure:"page_size"`
}

type AgentMinerConfig struct {
	SimilarityThreshold float64 `mapstructure:"similarity_threshold"`
	TreeDepth           int     `mapstructure:"tree_depth"`
	MaxChildren         int     `mapstructure:"max_children"`
}

type AgentRedactionConfig struct {
	Enable        bool     `mapstructure:"enable"`
	RedactIPs     bool     `mapstructure:"redact_ips"`
	ExtraPatterns []string `mapstructure:"extra_patterns"`
}

type AgentRegexConfig struct {
	DefaultPattern string           `mapstructure:"default_pattern"`
	Rules          []AgentRegexRule `mapstructure:"rules"`
}

type AgentRegexRule struct {
	Name    string `mapstructure:"name"`
	Pattern string `mapstructure:"pattern"`
}

type AgentSourceConfig struct {
	Name           string                          `mapstructure:"name"`
	Type           string                          `mapstructure:"type"` // "elasticsearch" | "file" | "loki" | "cloudwatchlogs"
	Enable         bool                            `mapstructure:"enable"`
	Elasticsearch  AgentElasticsearchSourceConfig  `mapstructure:"elasticsearch"`
	File           AgentFileSourceConfig           `mapstructure:"file"`
	Loki           AgentLokiSourceConfig           `mapstructure:"loki"`
	CloudWatchLogs AgentCloudWatchLogsSourceConfig `mapstructure:"cloudwatchlogs"`
}

type AlertConfig struct {
	DebugBody bool `mapstructure:"debug_body"`
	Slack     SlackConfig
	Telegram  TelegramConfig
	Viber     ViberConfig
	Email     EmailConfig
	MSTeams   MSTeamsConfig
	Lark      LarkConfig
}

type AwsIncidentManagerConfig struct {
	ResponsePlanArn       string            `mapstructure:"response_plan_arn"`
	OtherResponsePlanArns map[string]string `mapstructure:"other_response_plan_arns"`
}

type AzBusConfig struct {
	Enable bool `mapstructure:"enable"`
}

type Config struct {
	Name       string
	Host       string
	Port       int
	PublicHost string `mapstructure:"public_host"`

	// GatewaySecret is the shared secret required by every admin endpoint
	// (`/api/admin/*` and `/api/agent/*`). Clients send the same value in
	// the `X-Gateway-Secret` header. When empty, admin endpoints are NOT
	// registered and the agent refuses to start.
	GatewaySecret string `mapstructure:"gateway_secret"`

	Alert  AlertConfig
	Queue  QueueConfig
	OnCall OnCallConfig
	Proxy  ProxyConfig

	Redis RedisConfig `mapstructure:"redis"`

	Storage StorageConfig `mapstructure:"storage"`

	Agent AgentConfig `mapstructure:"agent"`
}

type EmailConfig struct {
	Enable       bool
	SMTPHost     string `mapstructure:"smtp_host"`
	SMTPPort     string `mapstructure:"smtp_port"`
	Username     string
	Password     string
	To           string
	Subject      string
	TemplatePath string `mapstructure:"template_path"`
}

type LarkConfig struct {
	Enable           bool
	WebhookURL       string            `mapstructure:"webhook_url"`
	TemplatePath     string            `mapstructure:"template_path"`
	OtherWebhookURLs map[string]string `mapstructure:"other_webhook_urls"`
	UseProxy         bool              `mapstructure:"use_proxy"`
}

type MSTeamsConfig struct {
	Enable         bool
	TemplatePath   string            `mapstructure:"template_path"`
	OtherPowerURLs map[string]string `mapstructure:"other_power_urls"` // Optional alternative Power Automate URLs
	// Power Automate Workflow URL for Teams integration
	PowerAutomateURL string `mapstructure:"power_automate_url"`
}

type OnCallConfig struct {
	Enable             bool
	InitializedOnly    bool                     `mapstructure:"initialized_only"` // Initialize infrastructure but don't enable by default
	WaitMinutes        int                      `mapstructure:"wait_minutes"`
	Provider           string                   `mapstructure:"provider"` // "aws_incident_manager" or "pagerduty"
	AwsIncidentManager AwsIncidentManagerConfig `mapstructure:"aws_incident_manager"`
	PagerDuty          PagerDutyConfig          `mapstructure:"pagerduty"`
}

type PagerDutyConfig struct {
	RoutingKey       string            `mapstructure:"routing_key"`
	OtherRoutingKeys map[string]string `mapstructure:"other_routing_keys"`
}

type ProxyConfig struct {
	URL      string `mapstructure:"url"`      // HTTP/HTTPS/SOCKS5 proxy URL
	Username string `mapstructure:"username"` // Optional proxy username
	Password string `mapstructure:"password"` // Optional proxy password
}

type PubSubConfig struct {
	Enable bool `mapstructure:"enable"`
}

type QueueConfig struct {
	Enable    bool         `mapstructure:"enable"`
	DebugBody bool         `mapstructure:"debug_body"`
	SNS       SNSConfig    `mapstructure:"sns"`
	SQS       SQSConfig    `mapstructure:"sqs"`
	PubSub    PubSubConfig `mapstructure:"pubsub"`
	AzBus     AzBusConfig  `mapstructure:"azbus"`
}

type RedisConfig struct {
	Host               string `mapstructure:"host"`
	Port               int    `mapstructure:"port"`
	Password           string `mapstructure:"password"`
	DB                 int    `mapstructure:"db"`
	InsecureSkipVerify bool   `mapstructure:"insecure_skip_verify"`
}

type SNSConfig struct {
	Enable       bool   `mapstructure:"enable"`
	TopicARN     string `mapstructure:"topic_arn"`
	Endpoint     string `mapstructure:"https_endpoint_subscription"`
	EndpointPath string `mapstructure:"https_endpoint_subscription_path"`
}

type SQSConfig struct {
	Enable   bool   `mapstructure:"enable"`
	QueueURL string `mapstructure:"queue_url"`
}

type SlackConfig struct {
	Enable            bool
	Token             string
	ChannelID         string                 `mapstructure:"channel_id"`
	TemplatePath      string                 `mapstructure:"template_path"`
	MessageProperties SlackMessageProperties `mapstructure:"message_properties"`
}

type SlackMessageProperties struct {
	DisableButton bool   `mapstructure:"disable_button"`
	ButtonText    string `mapstructure:"button_text"`
	ButtonStyle   string `mapstructure:"button_style"`
}

type StorageConfig struct {
	Type     string                `mapstructure:"type"` // file | redis | database (default: file)
	File     StorageFileConfig     `mapstructure:"file"`
	Redis    StorageRedisConfig    `mapstructure:"redis"`
	Database StorageDatabaseConfig `mapstructure:"database"`
}

type StorageDatabaseConfig struct {
	Driver       string `mapstructure:"driver"` // postgres | mysql | sqlite
	DSN          string `mapstructure:"dsn"`
	MaxIncidents int    `mapstructure:"max_incidents"`
}

type StorageFileConfig struct {
	DataDir      string `mapstructure:"data_dir"`
	MaxIncidents int    `mapstructure:"max_incidents"` // rolling cap; default 1000
}

type StorageRedisConfig struct {
	Host               string `mapstructure:"host"`
	Port               int    `mapstructure:"port"`
	Password           string `mapstructure:"password"`
	DB                 int    `mapstructure:"db"`
	InsecureSkipVerify bool   `mapstructure:"insecure_skip_verify"`
	KeyPrefix          string `mapstructure:"key_prefix"`
	MaxIncidents       int    `mapstructure:"max_incidents"`
}

type TelegramConfig struct {
	Enable       bool
	BotToken     string `mapstructure:"bot_token"`
	ChatID       string `mapstructure:"chat_id"`
	TemplatePath string `mapstructure:"template_path"`
	UseProxy     bool   `mapstructure:"use_proxy"`
}

type ViberConfig struct {
	Enable  bool
	APIType string `mapstructure:"api_type"` // "bot" or "channel" - defaults to "channel"
	// Bot API configuration
	BotToken     string `mapstructure:"bot_token"`
	UserID       string `mapstructure:"user_id"`
	TemplatePath string `mapstructure:"template_path"`
	// Channel configuration for Channels Post API
	ChannelID string `mapstructure:"channel_id"`
	UseProxy  bool   `mapstructure:"use_proxy"`
}