config

type AppliedRevision struct {
	Authority    string `json:"authority"`
	Namespace    string `json:"namespace,omitempty"`
	Desired      int64  `json:"desired,omitempty"`
	Applied      int64  `json:"applied,omitempty"`
	Checksum     string `json:"checksum,omitempty"`
	FileChecksum string `json:"file_checksum,omitempty"`
	Retained     bool   `json:"retained"`
}

type AuditConfig struct {
	// Retention is how long an audit record stays before the trail prunes
	// it. The 9600h default is the audit package's 400-day window.
	Retention time.Duration `env:"RETENTION,default=9600h"`
}

type AuthMode = authmode.Mode

type AuthorityMismatchError struct {
	Setting      string
	Configured   string
	Stored       string
	DeploymentID string
}

type BackupFile = recovery.BackupFile

type BackupInventory = recovery.BackupInventory

type BackupRole = recovery.BackupRole

type BadgerConfig struct {
	Path           string        `env:"PATH,overwrite"`
	SyncWrites     bool          `env:"SYNC_WRITES,default=true"`
	Compression    string        `env:"COMPRESSION,default=snappy"`
	GCInterval     time.Duration `env:"GC_INTERVAL,default=5m"`
	GCDiscardRatio float64       `env:"GC_DISCARD_RATIO,default=0.5"`
	// contains filtered or unexported fields
}

type BudgetAdmissionConfig struct {
	Mode string `env:"MODE,default=atomic"`
}

type CacheConfig struct {
	ChatEnabled        bool   `env:"CHAT_ENABLED,default=true"`
	EmbeddingsEnabled  bool   `env:"EMBEDDINGS_ENABLED,default=true"`
	ModelsEnabled      bool   `env:"MODELS_ENABLED,default=true"`
	ProvidersEnabled   bool   `env:"PROVIDERS_ENABLED,default=true"`
	ExtractionsEnabled bool   `env:"EXTRACTIONS_ENABLED,default=true"`
	CAFile             string `env:"CA_FILE"`
	Enabled            bool   `env:"ENABLED,default=true"`
	Backend            string `env:"BACKEND,default=local"`
	URL                string `env:"URL" redact:"url"`
	AllowInsecure      bool   `env:"ALLOW_INSECURE,default=false"`
}

type CatalogConfig struct {

	// PermissionClock holds node-local bounds parsed through Starmap's canonical schema.
	// Changes require restart. Loading starts no clock observation.
	PermissionClock profile.Config

	// Source selects the catalog source kind.
	Source string `env:"SOURCE"`

	// SourceURL is the safe source endpoint, or the file identity when the
	// source kind is a file.
	SourceURL string `env:"SOURCE_URL" redact:"url"`

	// SourceAPIKey authenticates this instance to an upstream Starmap
	// deployment. It is not a provider credential.
	SourceAPIKey string `env:"SOURCE_API_KEY" secret:"true"`

	// SourceRepository names the signed publication repository.
	SourceRepository string `env:"SOURCE_REPOSITORY"`

	// SourceChannel names the publication channel of that repository.
	SourceChannel string `env:"SOURCE_CHANNEL"`

	// SourceSignerWorkflow names the required publication signing workflow. Empty selects the publisher preset.
	SourceSignerWorkflow string `env:"SOURCE_SIGNER_WORKFLOW"`

	// SourceToken is an optional GitHub API token. It raises the anonymous
	// rate limit and reads a private repository.
	SourceToken string `env:"SOURCE_TOKEN" secret:"true"`

	// SourcePollInterval bounds how often this instance asks the source for
	// a newer publication.
	SourcePollInterval time.Duration `env:"SOURCE_POLL_INTERVAL"`

	// SourceStartupPolicy decides what startup does without a source answer.
	SourceStartupPolicy string `env:"SOURCE_STARTUP_POLICY"`

	// SourceAuthorityID pins the authority used by require_authority.
	SourceAuthorityID string `env:"SOURCE_AUTHORITY_ID"`

	// SourcePolicyID pins the permission policy within the selected authority.
	SourcePolicyID string `env:"SOURCE_POLICY_ID"`

	// SourceMaxAge is the oldest publication this instance accepts.
	SourceMaxAge time.Duration `env:"SOURCE_MAX_AGE"`

	// SourceMaxHops bounds the publication chain this instance follows.
	SourceMaxHops int `env:"SOURCE_MAX_HOPS"`

	// AcquisitionEnabled controls automatic observations. Explicit refresh still checks network and authority policy.
	AcquisitionEnabled bool `env:"ACQUISITION_ENABLED"`

	// AcquisitionInterval is the period between provider observations. Zero
	// means one observation at startup and no repeat.
	AcquisitionInterval time.Duration `env:"ACQUISITION_INTERVAL"`

	// WorkspacePath is an optional local catalog workspace directory. It
	// holds catalog files an operator supplies. It is never the state
	// directory, because a workspace can sit on a volume many instances share.
	WorkspacePath string `env:"WORKSPACE_PATH"`

	// StateDirectory is where this process keeps the state the connected
	// runtime retains: the layer store, the instance identity seed, and the
	// source discovery record. It must belong to one process on one machine.
	// Two processes that share a seed derive one instance identity, which defeats
	// the runtime lease fence. An empty value resolves to the
	// process-local user state directory.
	StateDirectory string `env:"STATE_DIR"`

	// StartupSpread spreads the first source read of a fleet, so many
	// instances that start together do not ask at the same moment.
	StartupSpread time.Duration `env:"STARTUP_SPREAD"`

	// TransferIdleTimeout ends a transfer that stops making progress.
	TransferIdleTimeout time.Duration `env:"TRANSFER_IDLE_TIMEOUT"`

	// TransferMaxDuration bounds one complete transfer. Zero is invalid,
	// because a transfer without a bound never ends.
	TransferMaxDuration time.Duration `env:"TRANSFER_MAX_DURATION"`

	// RefreshTimeout is an added cap on one refresh run. Zero adds no cap,
	// and the transfer bounds alone end a run that does not progress.
	RefreshTimeout time.Duration `env:"REFRESH_TIMEOUT"`
	// contains filtered or unexported fields
}

type Config struct {
	Server  ServerConfig  `env:",prefix=SERVER_"`
	Storage StorageConfig `env:",prefix=STORAGE_"`
	Catalog CatalogConfig `env:",prefix=CATALOG_"`
	// Management selects the deployment configuration authority. It is a
	// bootstrap input and never comes from a shared revision.
	Management        ManagementConfig        `env:",prefix=CONFIG_"`
	CredentialSources CredentialSourcesConfig `env:",prefix=CREDENTIAL_SOURCES_"`
	// InferenceDestinationApprovals holds the applied deployment policy.
	// Nil selects pinned installation defaults. An explicit empty set denies all destinations.
	// The configuration authority supplies this value, never catalog refresh.
	// The noinit option keeps the loader from materializing an empty set,
	// which the gateway would read as an explicit deny-all policy.
	InferenceDestinationApprovals *credentials.DestinationApprovals `env:",noinit" json:"-"`
	Providers                     ProvidersConfig
	RateLimiting                  RateLimitingConfig    `env:",prefix=RATE_LIMITING_"`
	BudgetAdmission               BudgetAdmissionConfig `env:",prefix=BUDGET_ADMISSION_"`
	Security                      SecurityConfig        `env:",prefix=SECURITY_"`
	Logging                       LoggingConfig         `env:",prefix=LOGGING_"`
	Cache                         CacheConfig           `env:",prefix=CACHE_"`
	Files                         FilesConfig           `env:",prefix=FILES_"`
	Jobs                          JobsConfig            `env:",prefix=JOBS_"`
	Console                       ConsoleConfig         `env:",prefix=CONSOLE_"`
	Identity                      IdentityConfig        `env:",prefix=IDENTITY_"`
	Telemetry                     TelemetryConfig       `env:",prefix=TELEMETRY_"`
	Audit                         AuditConfig           `env:",prefix=AUDIT_"`
	Events                        EventsConfig          `env:",prefix=EVENTS_"`
	Guardrails                    GuardrailsConfig      `env:",prefix=GUARDRAILS_"`
	SemanticCache                 SemanticCacheConfig   `env:",prefix=SEMANTIC_CACHE_"`
	// contains filtered or unexported fields
}

type ConnectionResult struct {
	Reachable bool   `json:"reachable"`
	Source    string `json:"source"`
	Error     string `json:"error,omitempty"`
}

type ConsoleConfig struct {
	Enabled bool `env:"ENABLED,default=true"`
}

type CredentialReference struct {
	Reference       string `json:"reference"`
	FallbackAmbient bool   `json:"fallback_ambient,omitempty"`
}

type CredentialSourcesConfig struct {
	Managed ManagedMaterialConfig `env:",prefix=MANAGED_"`
	// AllowStarmapFallback permits acquisition-prefixed keys as the last inference fallback.
	AllowStarmapFallback bool `env:"ALLOW_STARMAP_FALLBACK,default=false"`

	// RemoteRefreshInterval is the period between reads of a remote secret
	// store that holds an inference credential.
	RemoteRefreshInterval time.Duration `env:"REMOTE_REFRESH_INTERVAL,default=5m"`

	// ReconcileInterval is the period between reconciliations of the direct
	// secret sources.
	ReconcileInterval time.Duration `env:"RECONCILE_INTERVAL,default=1m"`

	// ReconcileTimeout bounds one reconciliation.
	ReconcileTimeout time.Duration `env:"RECONCILE_TIMEOUT,default=10s"`
}

type EffectiveReport struct {
	Management string             `json:"management"`
	Controller string             `json:"controller,omitempty"`
	Namespace  string             `json:"namespace,omitempty"`
	Revision   AppliedRevision    `json:"revision"`
	Target     SaveTarget         `json:"target"`
	Paths      Paths              `json:"paths"`
	Storage    []StorageLifetime  `json:"storage"`
	Settings   []EffectiveSetting `json:"settings"`
}

type EffectiveSetting struct {
	ID              string         `json:"id"`
	Name            string         `json:"name"`
	Value           string         `json:"value"`
	Scope           string         `json:"scope"`
	Authority       string         `json:"authority"`
	Origin          string         `json:"origin"`
	Ignored         []IgnoredValue `json:"ignored,omitempty"`
	DesiredRevision int64          `json:"desired_revision,omitempty"`
	AppliedRevision int64          `json:"applied_revision,omitempty"`
}

type EventsConfig struct {
	// WebhookURLs is a comma-separated list of receiver endpoints. Every
	// configured endpoint receives every event. Empty keeps webhooks off.
	WebhookURLs string `env:"WEBHOOK_URLS"`
	// WebhookSecret signs each delivery. A receiver verifies the
	// X-Starport-Signature header with it. Empty signs with the empty
	// secret, which authenticates nothing; set it with any endpoint.
	WebhookSecret string `env:"WEBHOOK_SECRET" secret:"true"`
}

type FieldEdit struct {
	// Name is the canonical Starmap setting name.
	Name string
	// Key is the field-save key that the receipt and the audit record name.
	Key   string
	Value *string
}

type FieldSave struct {
	OperationID      string             `json:"operation_id"`
	DeploymentID     string             `json:"deployment_id"`
	ExpectedRevision string             `json:"expected_revision"`
	Edits            map[string]*string `json:"edits"`
}

type FilesConfig struct {
	// Backend names the store. An absent value selects the filesystem, which
	// needs nothing configured and serves one node.
	Backend string `env:"BACKEND,default=filesystem"`

	// Path roots the filesystem backend. An absent value puts the objects in
	// the platform data directory, beside the record store.
	Path string `env:"PATH"`

	// MaxUploadBytes bounds one upload. It is a deployment decision rather
	// than a wire-format one: the same request that a shared object store
	// absorbs can fill the disk of a single node. FIL6 adds the separate
	// bound on what one account may keep stored at once.
	MaxUploadBytes int64 `env:"MAX_UPLOAD_BYTES,default=536870912"`

	// Retention is how long a stored file stays readable. Every file expires,
	// and an upload may ask for a shorter window but never a longer one.
	Retention time.Duration `env:"RETENTION,default=720h"`

	// SweepInterval is how often the gateway reclaims expired and abandoned
	// files. It is a floor on how long deleted bytes survive, not on how long
	// a file reads: an expired file reads as not found the moment it expires.
	SweepInterval time.Duration `env:"SWEEP_INTERVAL,default=1h"`

	ObjectStore ObjectStoreConfig `env:",prefix=OBJECT_STORE_"`
}

type GuardrailsConfig struct {
	// Checks is a comma-separated list of registered check names, run in
	// the order written. A name no build registers is a startup error.
	// Empty keeps guardrails off.
	Checks string `env:"CHECKS"`
	// PIIMode picks what a PII finding does: redact or refuse. Empty
	// redacts.
	PIIMode string `env:"PII_MODE"`
	// ModerationModel names the catalog moderation model the moderation
	// check calls through the account's own routing. Naming the
	// moderation check without a model is a startup error.
	ModerationModel string `env:"MODERATION_MODEL"`
	// ModerationThreshold refuses when any category scores at or above
	// it. Zero takes the built-in default.
	ModerationThreshold float64 `env:"MODERATION_THRESHOLD"`
	// ModerationThresholds overrides the threshold per category, as
	// comma-separated name=score pairs: "violence=0.8,self-harm=0.2".
	ModerationThresholds string `env:"MODERATION_THRESHOLDS"`
}

type IdentityConfig struct {
	CallbackBaseURL string               `env:"CALLBACK_BASE_URL" redact:"url"`
	OAuth           OAuthIdentityConfig  `env:",prefix=OAUTH_"`
	WorkOS          WorkOSIdentityConfig `env:",prefix=WORKOS_"`
}

type IgnoredValue struct {
	Origin string `json:"origin"`
	Reason string `json:"reason"`
}

type JobsConfig struct {
	// AssetDownloadOrigins grants external video downloads to exact origins.
	AssetDownloadOrigins []string `env:"ASSET_DOWNLOAD_ORIGINS"`
	// MaxWorkers limits concurrent video submissions per replica.
	MaxWorkers int `env:"MAX_WORKERS,default=2"`
	// ExecutionTimeout bounds native generation and its response transfer.
	ExecutionTimeout time.Duration `env:"EXECUTION_TIMEOUT,default=10m"`
	// AssetRetention is how long a finished asset stays readable, measured from
	// the moment this gateway stored it. A caller that comes back past it reads
	// that the asset expired rather than that the job never produced one.
	AssetRetention time.Duration `env:"ASSET_RETENTION,default=24h"`

	// MaxAssetBytes bounds one stored asset. Without it a provider's decision
	// about how large its own answer is would size this deployment's storage.
	MaxAssetBytes int64 `env:"MAX_ASSET_BYTES,default=268435456"`

	// SweepInterval is how often the gateway reclaims expired asset storage. It
	// is a floor on how long expired bytes survive on disk, not on how long an
	// asset reads: an expired asset stops reading the moment it expires.
	SweepInterval time.Duration `env:"SWEEP_INTERVAL,default=1h"`
}

type LegacyPath struct {
	Role         string `json:"role"`
	PreviousPath string `json:"previous_path"`
	SelectedPath string `json:"selected_path"`
	Selector     string `json:"selector"`
	// contains filtered or unexported fields
}

type Loader struct {
	// contains filtered or unexported fields
}

type LocalAudit func(ctx context.Context, actor, action, subject string) error

type LocalWriter struct {
	// contains filtered or unexported fields
}

type LoggingConfig struct {
	Level      string `env:"LEVEL,default=info"`
	Format     string `env:"FORMAT,default=json"`
	Output     string `env:"OUTPUT,default=stdout"`
	FilePath   string `env:"FILE_PATH"`
	MaxSize    int    `env:"MAX_SIZE,default=100"`
	MaxBackups int    `env:"MAX_BACKUPS,default=3"`
	MaxAge     int    `env:"MAX_AGE,default=7"`
	Compress   bool   `env:"COMPRESS,default=true"`
}

type ManagedMaterialConfig struct {
	Entries               int           `env:"ENTRIES,default=1024"`
	SecretBytes           int           `env:"SECRET_BYTES,default=16777216"`
	ConcurrentLoads       int           `env:"CONCURRENT_LOADS,default=4"`
	TenantConcurrentLoads int           `env:"TENANT_CONCURRENT_LOADS,default=2"`
	Validity              time.Duration `env:"VALIDITY,default=5s"`
	LoadTimeout           time.Duration `env:"LOAD_TIMEOUT,default=1s"`
	Idle                  time.Duration `env:"IDLE,default=1m"`
	RefreshInterval       time.Duration `env:"REFRESH_INTERVAL,default=1s"`
}

type ManagementConfig struct {
	// Mode is local, shared, or external. The loader selects shared for a
	// distributed storage recipe and local otherwise. A Config built in code
	// with an empty mode uses local management.
	Mode string `env:"MANAGEMENT"`
}

type OAuthApplicationConfig struct {
	ClientID     string `env:"CLIENT_ID"`
	ClientSecret string `env:"CLIENT_SECRET" secret:"true"`
}

type OAuthIdentityConfig struct {
	Google OAuthApplicationConfig `env:",prefix=GOOGLE_"`
	GitHub OAuthApplicationConfig `env:",prefix=GITHUB_"`
}

type ObjectStoreConfig struct {
	// Bucket names the bucket. It is the one field with no default.
	Bucket string `env:"BUCKET"`

	// Region names the region. AWS S3 needs it. Another implementation
	// usually accepts any value beside an explicit endpoint.
	Region string `env:"REGION"`

	// Endpoint addresses an implementation other than AWS S3. An absent value
	// selects the AWS endpoint for the region.
	Endpoint string `env:"ENDPOINT" redact:"url"`

	// Prefix scopes every key this deployment writes, so one bucket can hold
	// more than one deployment.
	Prefix string `env:"PREFIX"`

	// AccessKeyID and SecretAccessKey state static credentials. Both absent
	// selects the ambient AWS credential chain, which is the usual choice on
	// an instance that carries a role.
	AccessKeyID     string `env:"ACCESS_KEY_ID" secret:"true"`
	SecretAccessKey string `env:"SECRET_ACCESS_KEY" secret:"true"`
}

type Override func(*Config)

type Paths struct {
	RelativePathBase       string                       `json:"relative_path_base"`
	RelativePathBaseOrigin string                       `json:"relative_path_base_origin"`
	ConfigDir              string                       `json:"config_dir"`
	ConfigFile             string                       `json:"config_file"`
	DataDir                string                       `json:"data_dir"`
	StateDir               string                       `json:"state_dir"`
	CacheDir               string                       `json:"cache_dir"`
	RuntimeDir             string                       `json:"runtime_dir"`
	BaselineDir            string                       `json:"baseline_dir"`
	BadgerDir              string                       `json:"badger_dir"`
	SQLiteFile             string                       `json:"sqlite_file"`
	FilesDir               string                       `json:"files_dir"`
	LocalTokenFile         string                       `json:"local_token_file"`
	WelcomeStampFile       string                       `json:"welcome_stamp_file"`
	InstanceID             string                       `json:"instance_id"`
	DeploymentID           string                       `json:"deployment_id"`
	Origins                map[string]productpaths.Path `json:"origins"`
	// contains filtered or unexported fields
}

type ProviderConfig struct {
	BaseURL string `redact:"url"`
	// InferenceOrigin is the operator-approved replacement origin from
	// STARPORT_<PROVIDER>_INFERENCE_BASE_URL. It is empty when the setting is
	// absent or an explicit BaseURL supersedes it. Only this field approves a
	// destination. An explicit BaseURL never does.
	InferenceOrigin      string                                                     `redact:"url"`
	CredentialReferences map[catalogs.ProviderCredentialFieldID]CredentialReference `json:"credential_references,omitempty"`
	Material             credentials.Material                                       `json:"-"`
	CredentialSource     credentials.MaterialSource                                 `json:"-"`
	Timeout              time.Duration                                              `json:"timeout"`
	MaxConnections       int                                                        `json:"max_connections"`
	Enabled              bool                                                       `json:"enabled"`
}

type ProviderEntry struct {
	ProviderID catalogs.ProviderID
	Config     ProviderConfig
}

type ProviderResolutionFailure struct {
	ProviderID catalogs.ProviderID
	Err        error
}

type ProvidersConfig map[catalogs.ProviderID]ProviderConfig

type RateLimitingConfig struct {
	DefaultRequestsPerMinute int           `env:"DEFAULT_REQUESTS_PER_MINUTE,default=60"`
	WindowSize               time.Duration `env:"WINDOW_SIZE,default=1m"`
}

type Receipt struct {
	OperationID     string          `json:"operation_id"`
	DeploymentID    string          `json:"deployment_id"`
	Management      string          `json:"management"`
	Status          string          `json:"status"`
	Saved           ReceiptRevision `json:"saved"`
	Applied         ReceiptRevision `json:"applied"`
	ActivationError string          `json:"activation_error,omitempty"`
	AuditError      string          `json:"audit_error,omitempty"`
	Settings        []string        `json:"settings,omitempty"`
	Actor           string          `json:"actor"`
	CreatedAt       string          `json:"created_at"`
	Refusal         *Refusal        `json:"refusal,omitempty"`
}

type ReceiptRevision struct {
	Revision string `json:"revision"`
	Sequence int64  `json:"sequence"`
	Checksum string `json:"checksum"`
}

type RecoverySelection struct {
	// contains filtered or unexported fields
}

type ReferenceFile struct {
	// Name is the file name in ReferenceDirectory.
	Name string
	Data []byte
}

type Refusal struct {
	Reason   string `json:"reason"`
	Message  string `json:"message"`
	Setting  string `json:"setting,omitempty"`
	Expected string `json:"expected,omitempty"`
	Current  string `json:"current,omitempty"`
}

type RemovedSettingError struct {
	// Name is the complete environment variable the deployment still sets.
	Name string
	// Replacement is the complete environment variable to set instead.
	Replacement string
	// Reason states what changed.
	Reason string
}

type RestoreFile struct {
	ArtifactID  string
	Role        string
	Relative    string
	SHA256      string
	Destination string
	Action      string
	Reason      string
}

type SQLConfig struct {
	Mode     string            `env:"MODE,default=sqlite"`
	SQLite   SQLiteConfig      `env:",prefix=SQLITE_"`
	Postgres SQLPostgresConfig `env:",prefix=POSTGRES_"`
	MySQL    SQLMySQLConfig    `env:",prefix=MYSQL_"`
}

type SQLMySQLConfig struct {
	DSN string `env:"DSN" secret:"true"`
}

type SQLPostgresConfig struct {
	URL string `env:"URL" redact:"url"`
}

type SQLiteConfig struct {
	Path string `env:"PATH,overwrite"`
}

type SaveTarget struct {
	Kind        string `json:"kind"`
	Path        string `json:"path,omitempty"`
	Unavailable string `json:"unavailable,omitempty"`
}

type SchemaSetting struct {
	ID            string   `json:"id"`
	Key           string   `json:"key"`
	Environment   string   `json:"environment"`
	Type          string   `json:"type"`
	Scope         string   `json:"scope"`
	Mutability    string   `json:"mutability"`
	Sensitive     bool     `json:"sensitive"`
	Applicability []string `json:"applicability"`
}

type SecurityConfig struct {
	MasterKey          string `env:"MASTER_KEY" secret:"true"`
	TLSCertPath        string `env:"TLS_CERT_PATH"`
	TLSKeyPath         string `env:"TLS_KEY_PATH"`
	EnableTLS          bool   `env:"ENABLE_TLS,default=false"`
	AllowedOrigins     string `env:"ALLOWED_ORIGINS"`
	EnableCORS         bool   `env:"ENABLE_CORS,default=false"`
	JWTSecret          string `env:"JWT_SECRET" secret:"true"`
	APIKeyHeader       string `env:"API_KEY_HEADER,default=Authorization"`
	EnableRateLimiting bool   `env:"ENABLE_RATE_LIMITING,default=true"`

	// AuthMode selects whether the gateway requires a gateway API key. It
	// carries no default, so an unset value stays empty and startup can tell
	// "the operator said required" from "the operator said nothing". Only the
	// second yields to a mode an operator stored from the console.
	AuthMode AuthMode `env:"AUTH_MODE"`
	// AllowRemoteNoAuth is the second, explicit acknowledgment that an
	// unauthenticated gateway may bind an address the network can reach.
	// Without it, startup refuses that combination; see the tripwire in
	// validation.go.
	AllowRemoteNoAuth bool `env:"ALLOW_REMOTE_NO_AUTH,default=false"`
	// UnauthenticatedScopes lists the scopes a request holds while AuthMode
	// is disabled. An empty list means the built-in default, which is every
	// account scope and never admin. An operator who wants the admin plane
	// open without a key has to name "admin" here.
	UnauthenticatedScopes []string `env:"UNAUTHENTICATED_SCOPES"`
	// LocalTokenPath is the file holding this machine's local admin token.
	//
	// It carries no environment tag on purpose. The gateway reads it from here
	// and the CLI reads it from Paths, and both derive from one function, so
	// the two cannot disagree about where the credential lives. A second knob
	// for this one file would make disagreeing possible, and a CLI that rotates
	// a token the running gateway never reads is worse than no command at all.
	// An operator who needs the file elsewhere moves everything with
	// STARPORT_CONFIG_DIR.
	LocalTokenPath string `json:"local_token_path"`
	// contains filtered or unexported fields
}

type SemanticCacheConfig struct {
	// Enabled turns the layer on for the deployment. A request still opts
	// in per call with the X-Semantic-Cache header.
	Enabled bool `env:"ENABLED"`
	// Model names the catalog embedding model that embeds the canonical
	// prompt text through the gateway's own embeddings path. Enabling the
	// layer without a model is a startup error.
	Model string `env:"MODEL"`
	// Threshold is the minimum cosine similarity that answers, in (0, 1].
	// Zero takes the built-in default.
	Threshold float64 `env:"THRESHOLD"`
	// MaxEntries bounds the vectors one similarity scope holds. Zero takes
	// the built-in default.
	MaxEntries int `env:"MAX_ENTRIES"`
}

type ServerConfig struct {
	Port              int           `env:"PORT,default=8080"`
	Host              string        `env:"HOST,default=127.0.0.1"`
	ReadTimeout       time.Duration `env:"READ_TIMEOUT,default=30s"`
	WriteTimeout      time.Duration `env:"WRITE_TIMEOUT,default=30s"`
	IdleTimeout       time.Duration `env:"IDLE_TIMEOUT,default=120s"`
	RequestTimeout    time.Duration `env:"REQUEST_TIMEOUT,default=60s"`
	MaxRequestSize    int64         `env:"MAX_REQUEST_SIZE,default=33554432"`
	MaxHeaderBytes    int           `env:"MAX_HEADER_BYTES,default=1048576"`
	ShutdownTimeout   time.Duration `env:"SHUTDOWN_TIMEOUT,default=30s"`
	EnableProfiling   bool          `env:"ENABLE_PROFILING,default=false"`
	EnableHealthCheck bool          `env:"ENABLE_HEALTH_CHECK,default=true"`
}

type SharedRevision struct {
	DeploymentID string
	Namespace    string
	Sequence     int64
	RevisionID   string
	Checksum     string
	Values       map[string]string
}

type SharedSettingError struct {
	Name   string
	Reason string
}

type StorageConfig struct {
	Mode   string       `env:"MODE,default=badger"`
	Badger BadgerConfig `env:",prefix=BADGER_"`
	Valkey ValkeyConfig `env:",prefix=VALKEY_"`
	SQL    SQLConfig    `env:",prefix=SQL_"`
}

type StorageLifetime struct {
	ID        string `json:"id"`
	Selection string `json:"selection"`
	Lifetime  string `json:"lifetime"`
	Location  string `json:"location,omitempty"`
}

type TelemetryConfig struct {
	// Metrics states who may read the Prometheus scrape at GET /metrics:
	// "on" (default), "admin", or "off".
	Metrics string `env:"METRICS,default=on"`

	// TracesEndpoint holds the OTLP endpoint the standard OpenTelemetry
	// environment names. The variables are OTEL_EXPORTER_OTLP_ENDPOINT and
	// OTEL_EXPORTER_OTLP_TRACES_ENDPOINT, deliberately unprefixed: they are
	// the cross-vendor contract every collector documents. Empty means the
	// tracer stays a no-op. The loader fills this field; it carries no env
	// tag because the gateway prefix does not apply.
	TracesEndpoint string

	// UsageExport names where finalized usage records stream. An http or
	// https URL posts NDJSON batches; any other value is a file path that
	// NDJSON lines append to. Empty means no export.
	UsageExport string `env:"USAGE_EXPORT"`
}

type Validation struct {
	Valid    bool            `json:"valid"`
	Current  ReceiptRevision `json:"current"`
	Preview  ReceiptRevision `json:"preview"`
	Settings []string        `json:"settings,omitempty"`
	Refusal  *Refusal        `json:"refusal,omitempty"`
}

type ValkeyConfig struct {
	Username       string        `env:"USERNAME"`
	CAFile         string        `env:"CA_FILE"`
	AllowInsecure  bool          `env:"ALLOW_INSECURE,default=false"`
	URL            string        `env:"URL,default=valkey://localhost:6379" redact:"url"`
	MaxConnections int           `env:"MAX_CONNECTIONS,default=50"`
	MinIdleConns   int           `env:"MIN_IDLE_CONNS,default=10"`
	DialTimeout    time.Duration `env:"DIAL_TIMEOUT,default=5s"`
	ReadTimeout    time.Duration `env:"READ_TIMEOUT,default=3s"`
	WriteTimeout   time.Duration `env:"WRITE_TIMEOUT,default=3s"`
	IdleTimeout    time.Duration `env:"IDLE_TIMEOUT,default=5m"`
	ClusterMode    bool          `env:"CLUSTER_MODE,default=false"`
	Password       string        `env:"PASSWORD" secret:"true"`
}

type WorkOSIdentityConfig struct {
	APIKey       string `env:"API_KEY" secret:"true"`
	ClientID     string `env:"CLIENT_ID"`
	Organization string `env:"ORGANIZATION"`
	Connection   string `env:"CONNECTION"`
}