config

type AgentAIAnalyzeConfig struct {
	// Model overrides the shared ai.model for analyze deep dives.
	// Empty inherits ai.model.
	Model string `mapstructure:"model"`
}

type AgentAIConfig struct {
	// Enable gates whether the AI SRE is called at all. When false
	// (the default) detect mode still classifies patterns but never calls
	// the LLM — it only logs what it would have sent. This allows operators
	// to run detect mode in a "dry-run" fashion without an API key.
	Enable bool `mapstructure:"enable"`
	// APIKey is the bearer token sent in the Authorization header.
	APIKey string `mapstructure:"api_key"`
	// Model is the model identifier, e.g. "gpt-4o-mini".
	Model string `mapstructure:"model"`
	// Temperature controls randomness (0.0–2.0). Default 0.2.
	Temperature float64 `mapstructure:"temperature"`
	// MaxTokens caps the response length. Default 512.
	MaxTokens int `mapstructure:"max_tokens"`
	// MaxCallsPerHour is a sliding-window rate limit. 0 = unlimited.
	MaxCallsPerHour int `mapstructure:"max_calls_per_hour"`
	// CacheTTL is how long an AI result for a pattern_id is cached to
	// avoid re-asking about the same pattern. Default "1h".
	CacheTTL string `mapstructure:"cache_ttl"`

	// Detect and Analyze are per-task overrides. Empty fields fall back
	// to the top-level defaults above, so a single shared block keeps
	// working unchanged. Detect is used by the worker for unknown /
	// spiking pattern classification; Analyze is used by the on-demand
	// analyzer (E4).
	//
	// There is no `framework` knob: Eino is the only LLM path.
	Detect  AgentAITaskConfig    `mapstructure:"detect"`
	Analyze AgentAIAnalyzeConfig `mapstructure:"analyze"`
}

type AgentAITaskConfig struct {
	Model           string  `mapstructure:"model"`
	Temperature     float64 `mapstructure:"temperature"`
	MaxTokens       int     `mapstructure:"max_tokens"`
	MaxCallsPerHour int     `mapstructure:"max_calls_per_hour"`
	CacheTTL        string  `mapstructure:"cache_ttl"`
}

type AgentCatalogConfig struct {
	PersistInterval  string `mapstructure:"persist_interval"`   // e.g. "30s"
	AutoPromoteAfter int    `mapstructure:"auto_promote_after"` // 0 = never
	// SpikeMultiplier flags a tick as a frequency spike when the tick
	// count exceeds the pattern's prior EWMA baseline by this factor.
	// 0 disables spike detection. Default 5.0.
	SpikeMultiplier float64 `mapstructure:"spike_multiplier"`
	// SpikeMinFrequency is the minimum tick count required before a spike
	// can fire. Avoids triggering on tiny absolute counts (e.g. baseline
	// 0.5 → tickFreq 3 is technically 6× but not interesting). Default 5.
	SpikeMinFrequency int `mapstructure:"spike_min_frequency"`
	// SpikeMinBaselineCount is the minimum total observations required on
	// a pattern before spike detection considers it. Avoids treating a
	// barely-seen pattern's first big tick as a spike. Default 20.
	SpikeMinBaselineCount int `mapstructure:"spike_min_baseline_count"`
}

type AgentCloudWatchLogsSourceConfig struct {
	// Region, e.g. "us-east-1". Required.
	Region string `mapstructure:"region"`
	// LogGroupName is the CloudWatch log group, e.g. "/aws/lambda/my-fn".
	// Required.
	LogGroupName string `mapstructure:"log_group_name"`
	// LogStreamPrefix optionally restricts events to streams whose name
	// starts with this prefix (cheaper than scanning the whole group).
	LogStreamPrefix string `mapstructure:"log_stream_prefix"`
	// FilterPattern is a CloudWatch Logs filter pattern (NOT a regex).
	// See AWS docs. Empty matches every event.
	FilterPattern string `mapstructure:"filter_pattern"`
	// PageSize is the per-call limit (max 10000). Default 500.
	PageSize int `mapstructure:"page_size"`
}

type AgentConfig struct {
	Enable         bool   `mapstructure:"enable"`
	Mode           string `mapstructure:"mode"`          // training | shadow | detect
	PollInterval   string `mapstructure:"poll_interval"` // e.g. "30s"
	Lookback       string `mapstructure:"lookback"`      // e.g. "5m"
	BatchMax       int    `mapstructure:"batch_max"`
	SignalMaxBytes int    `mapstructure:"signal_max_bytes"`

	// NewServiceGrace is the duration a newly discovered service stays in
	// implicit training mode before detect-mode AI analysis begins. Signals
	// from a service still in its grace period flow through the full pipeline
	// (redact → regex → miner → catalog) but are not forwarded to the AI
	// analyzer. Set to "0" to disable (all services analysed immediately).
	NewServiceGrace string `mapstructure:"new_service_grace"` // e.g. "30m"
	// ServicePatterns is an ordered list of regexes applied to each
	// (post-redaction) log message to discover the service name.
	ServicePatterns []string `mapstructure:"service_patterns"`

	Redaction AgentRedactionConfig `mapstructure:"redaction"`
	Catalog   AgentCatalogConfig   `mapstructure:"catalog"`
	Miner     AgentMinerConfig     `mapstructure:"miner"`
	Regex     AgentRegexConfig     `mapstructure:"regex"`
	AI        AgentAIConfig        `mapstructure:"ai"`

	// Sources is the list of enabled signal sources. Versus loads it from
	// the file `agent_sources.yaml` sitting next to the main config file
	// (path is hardcoded; missing file is OK — the agent simply has no
	// sources). The file's top-level key is `sources`. ${VAR} references
	// in the file are expanded against the process environment.
	Sources []AgentSourceConfig `mapstructure:"sources"`

	// Tools holds per-tool configuration for analyze-mode tools that need
	// external data (e.g. the `recent_changes` tool's git repository and
	// the `describe_dependencies` tool's service-dependency graph).
	// Versus loads it from the file `tools.yaml` sitting next to the main
	// config file (path is hardcoded; missing file is OK — tools needing
	// config then simply degrade to a clean "nothing found"). The file's
	// top-level key is `tools`. This is per-tool DATA config, not a
	// registration allow-list: tools are still registered in code via
	// `analyzetools.Default`.
	Tools ToolsConfig `mapstructure:"tools"`
}

type AgentElasticsearchSourceConfig struct {
	Addresses          []string `mapstructure:"addresses"`
	Username           string   `mapstructure:"username"`
	Password           string   `mapstructure:"password"`
	APIKey             string   `mapstructure:"api_key"`
	InsecureSkipVerify bool     `mapstructure:"insecure_skip_verify"`
	Index              string   `mapstructure:"index"`
	TimeField          string   `mapstructure:"time_field"`
	Query              string   `mapstructure:"query"` // Lucene-style query string
	MessageField       string   `mapstructure:"message_field"`
	SeverityField      string   `mapstructure:"severity_field"`
	ExtraFields        []string `mapstructure:"extra_fields"`
	PageSize           int      `mapstructure:"page_size"`
}

type AgentFileSourceConfig struct {
	// Path to the log file. Globs are NOT supported (one source = one file).
	Path string `mapstructure:"path"`
	// Format: "text" (default) or "json" (one JSON object per line).
	Format string `mapstructure:"format"`
	// CursorPath overrides the default sidecar cursor file location
	// (default: <agent.data_dir>/cursors/file-<source_name>.cursor).
	CursorPath string `mapstructure:"cursor_path"`
	// FromBeginning controls behavior when there is no cursor yet.
	// false (default) starts at the current end of the file (tail-like).
	// true reads the whole file from the start (replay-like — useful for tests).
	FromBeginning bool `mapstructure:"from_beginning"`
	// MaxLineBytes caps a single line's length to protect memory; longer
	// lines are truncated. Default 64 KiB.
	MaxLineBytes int `mapstructure:"max_line_bytes"`
	// MaxLinesPerPull caps the number of lines returned by a single Pull.
	// When the file has a large backlog (e.g. from_beginning=true on a 100k-
	// line file), this paginates the backfill across ticks so the worker's
	// batch_max truncation never silently drops unread tail content. The
	// byte offset only advances over what was actually consumed in this
	// Pull, so the next tick resumes exactly where this one stopped.
	// Default 1000.
	MaxLinesPerPull int `mapstructure:"max_lines_per_pull"`

	// TimestampLayout is a Go time layout (e.g. "2006-01-02T15:04:05Z07:00")
	// used to parse a leading timestamp from each line. When empty the
	// source uses time.Now() at read time. Default tries RFC3339Nano then
	// RFC3339, then "2006-01-02 15:04:05".
	TimestampLayout string `mapstructure:"timestamp_layout"`

	MessageField   string `mapstructure:"message_field"`   // default: "message"
	TimestampField string `mapstructure:"timestamp_field"` // default: "@timestamp"
	SeverityField  string `mapstructure:"severity_field"`  // default: "level"
}

type AgentGraylogSourceConfig struct {
	// Address is the Graylog base URL, e.g. "https://graylog:9000".
	Address string `mapstructure:"address"`
	// Username + Password for HTTP Basic auth. Standard Graylog login.
	Username string `mapstructure:"username"`
	Password string `mapstructure:"password"`
	// APIToken is an alternative to Username/Password. When set the
	// source sends Basic auth with the token as the username and the
	// literal string "token" as the password (Graylog convention).
	APIToken           string `mapstructure:"api_token"`
	InsecureSkipVerify bool   `mapstructure:"insecure_skip_verify"`
	// Query is a Graylog search string, e.g. `level:ERROR AND service:api`.
	// Defaults to "*" (match all) when empty.
	Query string `mapstructure:"query"`
	// StreamID optionally restricts the search to a single stream
	// (Graylog stream ids look like "000000000000000000000001").
	StreamID string `mapstructure:"stream_id"`
	// MessageField is the field copied into Signal.Message.
	// Default "message".
	MessageField string `mapstructure:"message_field"`
	// SeverityField is the field copied into Signal.Severity.
	// Default "level".
	SeverityField string `mapstructure:"severity_field"`
	// Fields, when non-empty, restricts the server-side projection to
	// these fields (faster + smaller responses).
	Fields []string `mapstructure:"fields"`
	// ExtraFields are additional fields copied into Signal.Fields. They
	// must also appear in Fields (or Fields must be empty so the server
	// returns the whole document).
	ExtraFields []string `mapstructure:"extra_fields"`
	// PageSize caps results per tick (Graylog default cap is 150).
	// Default 500.
	PageSize int `mapstructure:"page_size"`
}

type AgentLokiSourceConfig struct {
	// Address is the Loki base URL, e.g. "http://loki:3100".
	Address string `mapstructure:"address"`
	// TenantID, when set, is sent as the `X-Scope-OrgID` header (multi-tenant
	// Loki / Grafana Cloud).
	TenantID string `mapstructure:"tenant_id"`
	// Username/Password enable HTTP Basic auth (Grafana Cloud uses
	// instance ID / API token).
	Username string `mapstructure:"username"`
	Password string `mapstructure:"password"`
	// BearerToken is sent as `Authorization: Bearer <token>` when set.
	// Mutually exclusive with Username/Password (Bearer wins).
	BearerToken        string `mapstructure:"bearer_token"`
	InsecureSkipVerify bool   `mapstructure:"insecure_skip_verify"`
	// Query is a LogQL selector, e.g. `{app="api",env="prod"} |= "error"`.
	// Required.
	Query string `mapstructure:"query"`
	// SeverityField, when set, is read from each entry's stream labels
	// (e.g. "level") to populate Signal.Severity.
	SeverityField string `mapstructure:"severity_field"`
	// ExtraLabels are additional stream labels copied into Signal.Fields.
	ExtraLabels []string `mapstructure:"extra_labels"`
	// PageSize is the per-query limit (Loki caps this around 5000 by
	// default). Default 500.
	PageSize int `mapstructure:"page_size"`
}

type AgentMinerConfig struct {
	SimilarityThreshold float64 `mapstructure:"similarity_threshold"`
	TreeDepth           int     `mapstructure:"tree_depth"`
	MaxChildren         int     `mapstructure:"max_children"`
}

type AgentRedactionConfig struct {
	Enable        bool     `mapstructure:"enable"`
	RedactIPs     bool     `mapstructure:"redact_ips"`
	ExtraPatterns []string `mapstructure:"extra_patterns"`
}

type AgentRegexConfig struct {
	DefaultPattern string           `mapstructure:"default_pattern"`
	Rules          []AgentRegexRule `mapstructure:"rules"`
}

type AgentRegexRule struct {
	Name    string `mapstructure:"name"`
	Pattern string `mapstructure:"pattern"`
}

type AgentSourceConfig struct {
	Name           string                          `mapstructure:"name"`
	Type           string                          `mapstructure:"type"` // "elasticsearch" | "file" | "loki" | "cloudwatchlogs" | "graylog" | "splunk"
	Enable         bool                            `mapstructure:"enable"`
	Elasticsearch  AgentElasticsearchSourceConfig  `mapstructure:"elasticsearch"`
	File           AgentFileSourceConfig           `mapstructure:"file"`
	Loki           AgentLokiSourceConfig           `mapstructure:"loki"`
	CloudWatchLogs AgentCloudWatchLogsSourceConfig `mapstructure:"cloudwatchlogs"`
	Graylog        AgentGraylogSourceConfig        `mapstructure:"graylog"`
	Splunk         AgentSplunkSourceConfig         `mapstructure:"splunk"`
}

type AgentSplunkSourceConfig struct {
	// Address is the Splunk REST base URL, e.g. "https://splunk:8089".
	Address string `mapstructure:"address"`
	// Token is sent as `Authorization: Bearer <token>` and takes
	// priority over Username/Password when set.
	Token string `mapstructure:"token"`
	// Username + Password fall back to HTTP Basic auth.
	Username           string `mapstructure:"username"`
	Password           string `mapstructure:"password"`
	InsecureSkipVerify bool   `mapstructure:"insecure_skip_verify"`
	// Search is the SPL query. May start with the `search` command
	// (added automatically when missing). Example:
	// `index=main sourcetype=api level=error`.
	Search string `mapstructure:"search"`
	// TimeField is the timestamp field on each result. Default "_time".
	TimeField string `mapstructure:"time_field"`
	// MessageField is the field copied into Signal.Message.
	// Default "_raw".
	MessageField string `mapstructure:"message_field"`
	// SeverityField is the field copied into Signal.Severity. Empty by
	// default — Splunk events do not have a canonical severity field.
	SeverityField string `mapstructure:"severity_field"`
	// ExtraFields are copied into Signal.Fields.
	ExtraFields []string `mapstructure:"extra_fields"`
	// PageSize caps results per tick. Default 500.
	PageSize int `mapstructure:"page_size"`
}

type AlertConfig struct {
	DebugBody bool `mapstructure:"debug_body"`
	Slack     SlackConfig
	Telegram  TelegramConfig
	Viber     ViberConfig
	Email     EmailConfig
	MSTeams   MSTeamsConfig
	Lark      LarkConfig
}

type AwsIncidentManagerConfig struct {
	ResponsePlanArn       string            `mapstructure:"response_plan_arn"`
	OtherResponsePlanArns map[string]string `mapstructure:"other_response_plan_arns"`
}

type AzBusConfig struct {
	Enable bool `mapstructure:"enable"`
}

type Config struct {
	Name       string
	Host       string
	Port       int
	PublicHost string `mapstructure:"public_host"`

	// GatewaySecret is the shared secret required by every admin endpoint
	// (`/api/admin/*` and `/api/agent/*`). Clients send the same value in
	// the `X-Gateway-Secret` header. When empty, admin endpoints are NOT
	// registered and the agent refuses to start.
	GatewaySecret string `mapstructure:"gateway_secret"`

	Alert  AlertConfig
	Queue  QueueConfig
	OnCall OnCallConfig
	Proxy  ProxyConfig

	Redis RedisConfig `mapstructure:"redis"`

	Storage StorageConfig `mapstructure:"storage"`

	Agent AgentConfig `mapstructure:"agent"`
}

type DescribeDependenciesToolConfig struct {
	// Services is the operator-authored service-dependency graph. Each
	// entry has a `name` and a `depends_on` list of upstream services;
	// the reverse (downstream) edges are derived automatically at build
	// time. Empty leaves the `describe_dependencies` tool unregistered.
	Services []ServiceDependency `mapstructure:"services"`
}

type EmailConfig struct {
	Enable       bool
	SMTPHost     string `mapstructure:"smtp_host"`
	SMTPPort     string `mapstructure:"smtp_port"`
	Username     string
	Password     string
	To           string
	Subject      string
	TemplatePath string `mapstructure:"template_path"`
}

type GitAuthConfig struct {
	// Token is an HTTPS access token / personal access token used for
	// https:// remotes (sent via an Authorization header, never persisted
	// to the local mirror's config).
	Token string `mapstructure:"token"`
	// SSHKeyPath is the path to a private SSH key used for ssh:// or
	// scp-like (git@host:org/repo) remotes.
	SSHKeyPath string `mapstructure:"ssh_key_path"`
}

type LarkConfig struct {
	Enable           bool
	WebhookURL       string            `mapstructure:"webhook_url"`
	TemplatePath     string            `mapstructure:"template_path"`
	OtherWebhookURLs map[string]string `mapstructure:"other_webhook_urls"`
	UseProxy         bool              `mapstructure:"use_proxy"`
}

type MSTeamsConfig struct {
	Enable         bool
	TemplatePath   string            `mapstructure:"template_path"`
	OtherPowerURLs map[string]string `mapstructure:"other_power_urls"` // Optional alternative Power Automate URLs
	// Power Automate Workflow URL for Teams integration
	PowerAutomateURL string `mapstructure:"power_automate_url"`
}

type OnCallConfig struct {
	Enable             bool
	InitializedOnly    bool                     `mapstructure:"initialized_only"` // Initialize infrastructure but don't enable by default
	WaitMinutes        int                      `mapstructure:"wait_minutes"`
	Provider           string                   `mapstructure:"provider"` // "aws_incident_manager" or "pagerduty"
	AwsIncidentManager AwsIncidentManagerConfig `mapstructure:"aws_incident_manager"`
	PagerDuty          PagerDutyConfig          `mapstructure:"pagerduty"`
}

type PagerDutyConfig struct {
	RoutingKey       string            `mapstructure:"routing_key"`
	OtherRoutingKeys map[string]string `mapstructure:"other_routing_keys"`
}

type ProxyConfig struct {
	URL      string `mapstructure:"url"`      // HTTP/HTTPS/SOCKS5 proxy URL
	Username string `mapstructure:"username"` // Optional proxy username
	Password string `mapstructure:"password"` // Optional proxy password
}

type PubSubConfig struct {
	Enable bool `mapstructure:"enable"`
}

type QueueConfig struct {
	Enable    bool         `mapstructure:"enable"`
	DebugBody bool         `mapstructure:"debug_body"`
	SNS       SNSConfig    `mapstructure:"sns"`
	SQS       SQSConfig    `mapstructure:"sqs"`
	PubSub    PubSubConfig `mapstructure:"pubsub"`
	AzBus     AzBusConfig  `mapstructure:"azbus"`
}

type RecentChangesGitConfig struct {
	// Auth is the global default authentication applied to every repo that
	// does not define its own. Empty means rely on the ambient git
	// credentials (credential helper / default SSH keys).
	Auth GitAuthConfig `mapstructure:"auth"`
	// Repos is the set of remote git repositories to read commits from.
	// Empty leaves the `recent_changes` tool unregistered.
	Repos []RecentChangesGitRepo `mapstructure:"repos"`
}

type RecentChangesGitRepo struct {
	// URL is the remote clone URL (https or scp-like git@host:org/repo).
	// Empty entries are ignored.
	URL string `mapstructure:"url"`
	// Branch optionally pins which branch to read. Empty reads the
	// repository's default HEAD.
	Branch string `mapstructure:"branch"`
	// Service maps every commit in this repository to a service name. When
	// empty the service is auto-detected from the repository name in the
	// URL (e.g. git@github.com:acme/web.git → "web").
	Service string `mapstructure:"service"`
	// Auth optionally overrides the global git auth for this repo. Empty
	// fields fall back to the global default in RecentChangesGitConfig.
	Auth GitAuthConfig `mapstructure:"auth"`
}

type RecentChangesToolConfig struct {
	// Git points the tool at a set of remote git repositories' commit
	// histories. An empty Repos list leaves the tool unregistered.
	Git RecentChangesGitConfig `mapstructure:"git"`
}

type RedisConfig struct {
	Host               string `mapstructure:"host"`
	Port               int    `mapstructure:"port"`
	Password           string `mapstructure:"password"`
	DB                 int    `mapstructure:"db"`
	InsecureSkipVerify bool   `mapstructure:"insecure_skip_verify"`
}

type SNSConfig struct {
	Enable       bool   `mapstructure:"enable"`
	TopicARN     string `mapstructure:"topic_arn"`
	Endpoint     string `mapstructure:"https_endpoint_subscription"`
	EndpointPath string `mapstructure:"https_endpoint_subscription_path"`
}

type SQSConfig struct {
	Enable   bool   `mapstructure:"enable"`
	QueueURL string `mapstructure:"queue_url"`
}

type ServiceDependency struct {
	Name      string   `mapstructure:"name"`
	DependsOn []string `mapstructure:"depends_on"`
}

type SlackConfig struct {
	Enable            bool
	Token             string
	ChannelID         string                 `mapstructure:"channel_id"`
	TemplatePath      string                 `mapstructure:"template_path"`
	MessageProperties SlackMessageProperties `mapstructure:"message_properties"`
}

type SlackMessageProperties struct {
	DisableButton bool   `mapstructure:"disable_button"`
	ButtonText    string `mapstructure:"button_text"`
	ButtonStyle   string `mapstructure:"button_style"`
}

type StorageConfig struct {
	Type     string                `mapstructure:"type"` // file | redis | database (default: file)
	File     StorageFileConfig     `mapstructure:"file"`
	Redis    StorageRedisConfig    `mapstructure:"redis"`
	Database StorageDatabaseConfig `mapstructure:"database"`
}

type StorageDatabaseConfig struct {
	Driver       string `mapstructure:"driver"` // postgres | mysql | sqlite
	DSN          string `mapstructure:"dsn"`
	MaxIncidents int    `mapstructure:"max_incidents"`
}

type StorageFileConfig struct {
	DataDir      string `mapstructure:"data_dir"`
	MaxIncidents int    `mapstructure:"max_incidents"` // rolling cap; default 1000
}

type StorageRedisConfig struct {
	Host               string `mapstructure:"host"`
	Port               int    `mapstructure:"port"`
	Password           string `mapstructure:"password"`
	DB                 int    `mapstructure:"db"`
	InsecureSkipVerify bool   `mapstructure:"insecure_skip_verify"`
	KeyPrefix          string `mapstructure:"key_prefix"`
	MaxIncidents       int    `mapstructure:"max_incidents"`
}

type TelegramConfig struct {
	Enable       bool
	BotToken     string `mapstructure:"bot_token"`
	ChatID       string `mapstructure:"chat_id"`
	TemplatePath string `mapstructure:"template_path"`
	UseProxy     bool   `mapstructure:"use_proxy"`
}

type ToolsConfig struct {
	// ToolTimeout caps how long a single tool dispatch may run before it
	// is abandoned, e.g. "20s". A timeout surfaces as a tool error in the
	// audit trace (not a hard failure) so one slow tool cannot consume
	// the whole analysis budget. Empty, "0", or an unparseable value
	// inherits the built-in default (20s).
	ToolTimeout string `mapstructure:"tool_timeout"`
	// ParallelTools controls whether multiple tool calls emitted in one
	// model turn run concurrently. Off by default: tool dispatch is
	// sequential, which keeps load on downstream sources predictable. The
	// per-call audit trace is ordered deterministically regardless.
	ParallelTools bool `mapstructure:"parallel_tools"`
	// RecentChanges configures the `recent_changes` tool.
	RecentChanges RecentChangesToolConfig `mapstructure:"recent_changes"`
	// DescribeDependencies configures the `describe_dependencies` tool.
	DescribeDependencies DescribeDependenciesToolConfig `mapstructure:"describe_dependencies"`
}

type ViberConfig struct {
	Enable  bool
	APIType string `mapstructure:"api_type"` // "bot" or "channel" - defaults to "channel"
	// Bot API configuration
	BotToken     string `mapstructure:"bot_token"`
	UserID       string `mapstructure:"user_id"`
	TemplatePath string `mapstructure:"template_path"`
	// Channel configuration for Channels Post API
	ChannelID string `mapstructure:"channel_id"`
	UseProxy  bool   `mapstructure:"use_proxy"`
}