config

type AuditConfig struct {
	// Retention is how long an audit record stays before the trail prunes
	// it. The 9600h default is the audit package's 400-day window.
	Retention time.Duration `env:"RETENTION,default=9600h"`
}

type AuthMode = authmode.Mode

type BadgerConfig struct {
	Path           string        `env:"PATH,overwrite"`
	SyncWrites     bool          `env:"SYNC_WRITES,default=false"`
	Compression    string        `env:"COMPRESSION,default=snappy"`
	GCInterval     time.Duration `env:"GC_INTERVAL,default=5m"`
	GCDiscardRatio float64       `env:"GC_DISCARD_RATIO,default=0.5"`
	// contains filtered or unexported fields
}

type CacheConfig struct {
	Enabled bool `env:"ENABLED,default=true"`
}

type CatalogConfig struct {
	// Source selects the catalog source kind.
	Source string `env:"SOURCE,default=public"`

	// SourceURL is the safe source endpoint, or the file identity when the
	// source kind is a file.
	SourceURL string `env:"SOURCE_URL" redact:"url"`

	// SourceAPIKey authenticates this instance to an upstream Starmap
	// deployment. It is not a provider credential.
	SourceAPIKey string `env:"SOURCE_API_KEY" secret:"true"`

	// SourceRepository names the signed publication repository.
	SourceRepository string `env:"SOURCE_REPOSITORY,default=agentstation/starmap"`

	// SourceChannel names the publication channel of that repository.
	SourceChannel string `env:"SOURCE_CHANNEL,default=catalog/v1"`

	// SourceSignerWorkflow names the workflow that must have signed a
	// publication. Empty selects the publisher preset.
	SourceSignerWorkflow string `env:"SOURCE_SIGNER_WORKFLOW"`

	// SourceToken is an optional GitHub API token. It raises the anonymous
	// rate limit and reads a private repository.
	SourceToken string `env:"SOURCE_TOKEN" secret:"true"`

	// SourcePollInterval bounds how often this instance asks the source for
	// a newer publication.
	SourcePollInterval time.Duration `env:"SOURCE_POLL_INTERVAL,default=1h"`

	// SourceStartupPolicy decides what startup does without a source answer.
	SourceStartupPolicy string `env:"SOURCE_STARTUP_POLICY,default=prefer_source"`

	// SourceMaxAge is the oldest publication this instance accepts.
	SourceMaxAge time.Duration `env:"SOURCE_MAX_AGE,default=6h"`

	// SourceMaxHops bounds the publication chain this instance follows.
	SourceMaxHops int `env:"SOURCE_MAX_HOPS,default=8"`

	// AcquisitionEnabled decides whether this instance observes providers.
	AcquisitionEnabled bool `env:"ACQUISITION_ENABLED,default=true"`

	// AcquisitionInterval is the period between provider observations. Zero
	// means one observation at startup and no repeat.
	AcquisitionInterval time.Duration `env:"ACQUISITION_INTERVAL,default=4h"`

	// WorkspacePath is an optional local catalog workspace directory. It
	// holds catalog files an operator supplies. It is never the state
	// directory, because a workspace can sit on a volume many instances share.
	WorkspacePath string `env:"WORKSPACE_PATH"`

	// StateDirectory is where this process keeps the state the connected
	// runtime retains: the layer store, the instance identity seed, and the
	// source discovery record. It must belong to one process on one machine,
	// because two processes that share a seed derive one instance identity and
	// the runtime lease then fences nothing. An empty value resolves to the
	// process-local user state directory.
	StateDirectory string `env:"STATE_DIR"`

	// StartupSpread spreads the first source read of a fleet, so many
	// instances that start together do not ask at the same moment.
	StartupSpread time.Duration `env:"STARTUP_SPREAD,default=15m"`

	// TransferIdleTimeout ends a transfer that stops making progress.
	TransferIdleTimeout time.Duration `env:"TRANSFER_IDLE_TIMEOUT,default=2m"`

	// TransferMaxDuration bounds one complete transfer. Zero is invalid,
	// because a transfer without a bound never ends.
	TransferMaxDuration time.Duration `env:"TRANSFER_MAX_DURATION,default=60m"`

	// RefreshTimeout is an added cap on one refresh run. Zero adds no cap,
	// and the transfer bounds alone end a run that does not progress.
	RefreshTimeout time.Duration `env:"REFRESH_TIMEOUT,default=0s"`
	// contains filtered or unexported fields
}

type Config struct {
	Server            ServerConfig            `env:",prefix=SERVER_"`
	Storage           StorageConfig           `env:",prefix=STORAGE_"`
	Catalog           CatalogConfig           `env:",prefix=CATALOG_"`
	CredentialSources CredentialSourcesConfig `env:",prefix=CREDENTIAL_SOURCES_"`
	Providers         ProvidersConfig
	RateLimiting      RateLimitingConfig  `env:",prefix=RATE_LIMITING_"`
	Security          SecurityConfig      `env:",prefix=SECURITY_"`
	Logging           LoggingConfig       `env:",prefix=LOGGING_"`
	Cache             CacheConfig         `env:",prefix=CACHE_"`
	Files             FilesConfig         `env:",prefix=FILES_"`
	Jobs              JobsConfig          `env:",prefix=JOBS_"`
	Console           ConsoleConfig       `env:",prefix=CONSOLE_"`
	Identity          IdentityConfig      `env:",prefix=IDENTITY_"`
	Telemetry         TelemetryConfig     `env:",prefix=TELEMETRY_"`
	Audit             AuditConfig         `env:",prefix=AUDIT_"`
	Events            EventsConfig        `env:",prefix=EVENTS_"`
	Guardrails        GuardrailsConfig    `env:",prefix=GUARDRAILS_"`
	SemanticCache     SemanticCacheConfig `env:",prefix=SEMANTIC_CACHE_"`
	// contains filtered or unexported fields
}

type ConsoleConfig struct {
	Enabled bool `env:"ENABLED,default=true"`
}

type CredentialReference struct {
	Reference       string `json:"reference"`
	FallbackAmbient bool   `json:"fallback_ambient,omitempty"`
}

type CredentialSourcesConfig struct {
	// RemoteRefreshInterval is the period between reads of a remote secret
	// store that holds an inference credential.
	RemoteRefreshInterval time.Duration `env:"REMOTE_REFRESH_INTERVAL,default=5m"`

	// ReconcileInterval is the period between reconciliations of the direct
	// secret sources.
	ReconcileInterval time.Duration `env:"RECONCILE_INTERVAL,default=1m"`

	// ReconcileTimeout bounds one reconciliation.
	ReconcileTimeout time.Duration `env:"RECONCILE_TIMEOUT,default=10s"`
}

type EventsConfig struct {
	// WebhookURLs is a comma-separated list of receiver endpoints. Every
	// configured endpoint receives every event. Empty keeps webhooks off.
	WebhookURLs string `env:"WEBHOOK_URLS"`
	// WebhookSecret signs each delivery. A receiver verifies the
	// X-Starport-Signature header with it. Empty signs with the empty
	// secret, which authenticates nothing; set it with any endpoint.
	WebhookSecret string `env:"WEBHOOK_SECRET"`
}

type FilesConfig struct {
	// Backend names the store. An absent value selects the filesystem, which
	// needs nothing configured and serves one node.
	Backend string `env:"BACKEND,default=filesystem"`

	// Path roots the filesystem backend. An absent value puts the objects in
	// the platform data directory, beside the record store.
	Path string `env:"PATH"`

	// MaxUploadBytes bounds one upload. It is a deployment decision rather
	// than a wire-format one: the same request that a shared object store
	// absorbs can fill the disk of a single node. FIL6 adds the separate
	// bound on what one account may keep stored at once.
	MaxUploadBytes int64 `env:"MAX_UPLOAD_BYTES,default=536870912"`

	// Retention is how long a stored file stays readable. Every file expires,
	// and an upload may ask for a shorter window but never a longer one.
	Retention time.Duration `env:"RETENTION,default=720h"`

	// SweepInterval is how often the gateway reclaims expired and abandoned
	// files. It is a floor on how long deleted bytes survive, not on how long
	// a file reads: an expired file reads as not found the moment it expires.
	SweepInterval time.Duration `env:"SWEEP_INTERVAL,default=1h"`

	ObjectStore ObjectStoreConfig `env:",prefix=OBJECT_STORE_"`
}

type GuardrailsConfig struct {
	// Checks is a comma-separated list of registered check names, run in
	// the order written. A name no build registers is a startup error.
	// Empty keeps guardrails off.
	Checks string `env:"CHECKS"`
	// PIIMode picks what a PII finding does: redact or refuse. Empty
	// redacts.
	PIIMode string `env:"PII_MODE"`
	// ModerationModel names the catalog moderation model the moderation
	// check calls through the account's own routing. Naming the
	// moderation check without a model is a startup error.
	ModerationModel string `env:"MODERATION_MODEL"`
	// ModerationThreshold refuses when any category scores at or above
	// it. Zero takes the built-in default.
	ModerationThreshold float64 `env:"MODERATION_THRESHOLD"`
	// ModerationThresholds overrides the threshold per category, as
	// comma-separated name=score pairs: "violence=0.8,self-harm=0.2".
	ModerationThresholds string `env:"MODERATION_THRESHOLDS"`
}

type IdentityConfig struct {
	CallbackBaseURL string               `env:"CALLBACK_BASE_URL" redact:"url"`
	OAuth           OAuthIdentityConfig  `env:",prefix=OAUTH_"`
	WorkOS          WorkOSIdentityConfig `env:",prefix=WORKOS_"`
}

type JobsConfig struct {
	// AssetRetention is how long a finished asset stays readable, measured from
	// the moment this gateway stored it. A caller that comes back past it reads
	// that the asset expired rather than that the job never produced one.
	AssetRetention time.Duration `env:"ASSET_RETENTION,default=24h"`

	// MaxAssetBytes bounds one stored asset. Without it a provider's decision
	// about how large its own answer is would size this deployment's storage.
	MaxAssetBytes int64 `env:"MAX_ASSET_BYTES,default=268435456"`

	// SweepInterval is how often the gateway reclaims expired asset storage. It
	// is a floor on how long expired bytes survive on disk, not on how long an
	// asset reads: an expired asset stops reading the moment it expires.
	SweepInterval time.Duration `env:"SWEEP_INTERVAL,default=1h"`
}

type Loader struct {
	// contains filtered or unexported fields
}

type LoggingConfig struct {
	Level      string `env:"LEVEL,default=info"`
	Format     string `env:"FORMAT,default=json"`
	Output     string `env:"OUTPUT,default=stdout"`
	FilePath   string `env:"FILE_PATH"`
	MaxSize    int    `env:"MAX_SIZE,default=100"`
	MaxBackups int    `env:"MAX_BACKUPS,default=3"`
	MaxAge     int    `env:"MAX_AGE,default=7"`
	Compress   bool   `env:"COMPRESS,default=true"`
}

type OAuthApplicationConfig struct {
	ClientID     string `env:"CLIENT_ID"`
	ClientSecret string `env:"CLIENT_SECRET" secret:"true"`
}

type OAuthIdentityConfig struct {
	Google OAuthApplicationConfig `env:",prefix=GOOGLE_"`
	GitHub OAuthApplicationConfig `env:",prefix=GITHUB_"`
}

type ObjectStoreConfig struct {
	// Bucket names the bucket. It is the one field with no default.
	Bucket string `env:"BUCKET"`

	// Region names the region. AWS S3 needs it. Another implementation
	// usually accepts any value beside an explicit endpoint.
	Region string `env:"REGION"`

	// Endpoint addresses an implementation other than AWS S3. An absent value
	// selects the AWS endpoint for the region.
	Endpoint string `env:"ENDPOINT" redact:"url"`

	// Prefix scopes every key this deployment writes, so one bucket can hold
	// more than one deployment.
	Prefix string `env:"PREFIX"`

	// AccessKeyID and SecretAccessKey state static credentials. Both absent
	// selects the ambient AWS credential chain, which is the usual choice on
	// an instance that carries a role.
	AccessKeyID     string `env:"ACCESS_KEY_ID" secret:"true"`
	SecretAccessKey string `env:"SECRET_ACCESS_KEY" secret:"true"`
}

type Override func(*Config)

type Paths struct {
	ConfigDir  string `json:"config_dir"`
	ConfigFile string `json:"config_file"`
	DataDir    string `json:"data_dir"`
	BadgerDir  string `json:"badger_dir"`
	// SQLiteFile holds the embedded relational database. It sits in the data
	// directory beside the Badger store: the same machine state, the other
	// shape.
	SQLiteFile string `json:"sqlite_file"`
	// FilesDir roots the filesystem blob backend. It sits in the data
	// directory beside the record store, because the bytes are state this
	// machine holds rather than a decision an operator wrote down.
	FilesDir string `json:"files_dir"`
	// LocalTokenFile holds this machine's local admin token. It sits in the
	// data directory rather than beside the configuration file, because it is
	// state this machine generated and not a decision an operator wrote down.
	LocalTokenFile string `json:"local_token_file"`
	// WelcomeStampFile records that this machine has been told how to open the
	// console. It exists so the greeting prints once: an operator who has run
	// the gateway before is not a new operator, and a banner that repeats every
	// start is one an experienced reader learns to skip past the day they
	// needed it.
	WelcomeStampFile string `json:"welcome_stamp_file"`
}

type ProviderConfig struct {
	BaseURL              string                                                     `redact:"url"`
	CredentialReferences map[catalogs.ProviderCredentialFieldID]CredentialReference `json:"credential_references,omitempty"`
	Material             credentials.Material                                       `json:"-"`
	CredentialSource     credentials.MaterialSource                                 `json:"-"`
	Timeout              time.Duration                                              `json:"timeout"`
	MaxConnections       int                                                        `json:"max_connections"`
	Enabled              bool                                                       `json:"enabled"`
}

type ProviderEntry struct {
	ProviderID catalogs.ProviderID
	Config     ProviderConfig
}

type ProviderResolutionFailure struct {
	ProviderID catalogs.ProviderID
	Err        error
}

type ProvidersConfig map[catalogs.ProviderID]ProviderConfig

type RateLimitingConfig struct {
	DefaultRequestsPerMinute int           `env:"DEFAULT_REQUESTS_PER_MINUTE,default=60"`
	WindowSize               time.Duration `env:"WINDOW_SIZE,default=1m"`
}

type RemovedSettingError struct {
	// Name is the complete environment variable the deployment still sets.
	Name string
	// Replacement is the complete environment variable to set instead.
	Replacement string
	// Reason states what changed.
	Reason string
}

type SQLConfig struct {
	Mode     string            `env:"MODE,default=sqlite"`
	SQLite   SQLiteConfig      `env:",prefix=SQLITE_"`
	Postgres SQLPostgresConfig `env:",prefix=POSTGRES_"`
	MySQL    SQLMySQLConfig    `env:",prefix=MYSQL_"`
}

type SQLMySQLConfig struct {
	DSN string `env:"DSN" secret:"true"`
}

type SQLPostgresConfig struct {
	URL string `env:"URL" redact:"url"`
}

type SQLiteConfig struct {
	Path string `env:"PATH,overwrite"`
}

type SecurityConfig struct {
	MasterKey          string `env:"MASTER_KEY" secret:"true"`
	TLSCertPath        string `env:"TLS_CERT_PATH"`
	TLSKeyPath         string `env:"TLS_KEY_PATH"`
	EnableTLS          bool   `env:"ENABLE_TLS,default=false"`
	AllowedOrigins     string `env:"ALLOWED_ORIGINS"`
	EnableCORS         bool   `env:"ENABLE_CORS,default=false"`
	JWTSecret          string `env:"JWT_SECRET" secret:"true"`
	APIKeyHeader       string `env:"API_KEY_HEADER,default=Authorization"`
	EnableRateLimiting bool   `env:"ENABLE_RATE_LIMITING,default=true"`

	// AuthMode selects whether the gateway requires a gateway API key. It
	// carries no default, so an unset value stays empty and startup can tell
	// "the operator said required" from "the operator said nothing". Only the
	// second yields to a mode an operator stored from the console.
	AuthMode AuthMode `env:"AUTH_MODE"`
	// AllowRemoteNoAuth is the second, explicit acknowledgment that an
	// unauthenticated gateway may bind an address the network can reach.
	// Without it, startup refuses that combination; see the tripwire in
	// validation.go.
	AllowRemoteNoAuth bool `env:"ALLOW_REMOTE_NO_AUTH,default=false"`
	// UnauthenticatedScopes lists the scopes a request holds while AuthMode
	// is disabled. An empty list means the built-in default, which is every
	// account scope and never admin. An operator who wants the admin plane
	// open without a key has to name "admin" here.
	UnauthenticatedScopes []string `env:"UNAUTHENTICATED_SCOPES"`
	// LocalTokenPath is the file holding this machine's local admin token.
	//
	// It carries no environment tag on purpose. The gateway reads it from here
	// and the CLI reads it from Paths, and both derive from one function, so
	// the two cannot disagree about where the credential lives. A second knob
	// for this one file would make disagreeing possible, and a CLI that rotates
	// a token the running gateway never reads is worse than no command at all.
	// An operator who needs the file elsewhere moves everything with
	// STARPORT_CONFIG_DIR.
	LocalTokenPath string `json:"local_token_path"`
	// contains filtered or unexported fields
}

type SemanticCacheConfig struct {
	// Enabled turns the layer on for the deployment. A request still opts
	// in per call with the X-Semantic-Cache header.
	Enabled bool `env:"ENABLED"`
	// Model names the catalog embedding model that embeds the canonical
	// prompt text through the gateway's own embeddings path. Enabling the
	// layer without a model is a startup error.
	Model string `env:"MODEL"`
	// Threshold is the minimum cosine similarity that answers, in (0, 1].
	// Zero takes the built-in default.
	Threshold float64 `env:"THRESHOLD"`
	// MaxEntries bounds the vectors one similarity scope holds. Zero takes
	// the built-in default.
	MaxEntries int `env:"MAX_ENTRIES"`
}

type ServerConfig struct {
	Port              int           `env:"PORT,default=8080"`
	Host              string        `env:"HOST,default=127.0.0.1"`
	ReadTimeout       time.Duration `env:"READ_TIMEOUT,default=30s"`
	WriteTimeout      time.Duration `env:"WRITE_TIMEOUT,default=30s"`
	IdleTimeout       time.Duration `env:"IDLE_TIMEOUT,default=120s"`
	RequestTimeout    time.Duration `env:"REQUEST_TIMEOUT,default=60s"`
	MaxRequestSize    int64         `env:"MAX_REQUEST_SIZE,default=33554432"`
	MaxHeaderBytes    int           `env:"MAX_HEADER_BYTES,default=1048576"`
	ShutdownTimeout   time.Duration `env:"SHUTDOWN_TIMEOUT,default=30s"`
	EnableProfiling   bool          `env:"ENABLE_PROFILING,default=false"`
	EnableHealthCheck bool          `env:"ENABLE_HEALTH_CHECK,default=true"`
}

type StorageConfig struct {
	Mode   string       `env:"MODE,default=badger"`
	Badger BadgerConfig `env:",prefix=BADGER_"`
	Valkey ValkeyConfig `env:",prefix=VALKEY_"`
	SQL    SQLConfig    `env:",prefix=SQL_"`
}

type TelemetryConfig struct {
	// Metrics states who may read the Prometheus scrape at GET /metrics:
	// "on" (default), "admin", or "off".
	Metrics string `env:"METRICS,default=on"`

	// TracesEndpoint holds the OTLP endpoint the standard OpenTelemetry
	// environment names. The variables are OTEL_EXPORTER_OTLP_ENDPOINT and
	// OTEL_EXPORTER_OTLP_TRACES_ENDPOINT, deliberately unprefixed: they are
	// the cross-vendor contract every collector documents. Empty means the
	// tracer stays a no-op. The loader fills this field; it carries no env
	// tag because the gateway prefix does not apply.
	TracesEndpoint string

	// UsageExport names where finalized usage records stream. An http or
	// https URL posts NDJSON batches; any other value is a file path that
	// NDJSON lines append to. Empty means no export.
	UsageExport string `env:"USAGE_EXPORT"`
}

type ValkeyConfig struct {
	URL            string        `env:"URL,default=valkey://localhost:6379" redact:"url"`
	MaxConnections int           `env:"MAX_CONNECTIONS,default=50"`
	MinIdleConns   int           `env:"MIN_IDLE_CONNS,default=10"`
	DialTimeout    time.Duration `env:"DIAL_TIMEOUT,default=5s"`
	ReadTimeout    time.Duration `env:"READ_TIMEOUT,default=3s"`
	WriteTimeout   time.Duration `env:"WRITE_TIMEOUT,default=3s"`
	IdleTimeout    time.Duration `env:"IDLE_TIMEOUT,default=5m"`
	ClusterMode    bool          `env:"CLUSTER_MODE,default=false"`
	Password       string        `env:"PASSWORD" secret:"true"`
}

type WorkOSIdentityConfig struct {
	APIKey       string `env:"API_KEY" secret:"true"`
	ClientID     string `env:"CLIENT_ID"`
	Organization string `env:"ORGANIZATION"`
	Connection   string `env:"CONNECTION"`
}