config

type AuditConfig struct {
	Enabled              bool                  `toml:"enabled"`
	LogFile              string                `toml:"log_file"`
	MaxFileSizeMB        int                   `toml:"max_file_size_mb"`
	AdminRateLimitPerMin int                   `toml:"admin_rate_limit_per_minute"`
	DualWrite            *bool                 `toml:"dual_write"` // Default true; pointer to distinguish unset from false
	Integrity            AuditIntegrityConfig  `toml:"integrity"`
	Encryption           AuditEncryptionConfig `toml:"encryption"`
}

type AuditEncryptionConfig struct {
	Enabled bool   `toml:"enabled"`
	KeyFile string `toml:"key_file"` // Separate 32-byte AES-256 key for interaction log
}

type AuditIntegrityConfig struct {
	Mode       string `toml:"mode"`         // "crc32" (default) or "mac"
	MacKeyFile string `toml:"mac_key_file"` // Separate 32-byte HMAC-SHA256 key for interaction log
}

type CollectionDecayConfig struct {
	HalfLifeDays      float64 `toml:"half_life_days"`
	DecayMode         string  `toml:"decay_mode"`
	StepThresholdDays float64 `toml:"step_threshold_days"`
}

type Config struct {
	Daemon         DaemonConfig         `toml:"daemon"`
	Retrieval      RetrievalConfig      `toml:"retrieval"`
	Consistency    ConsistencyConfig    `toml:"consistency"`
	SecurityEvents SecurityEventsConfig `toml:"security_events"`

	// Sources and Destinations are populated by scanning the sources/ and
	// destinations/ sub-directories. Not decoded from daemon.toml itself.
	Sources      []*Source
	Destinations []*Destination

	// ResolvedSourceKeys maps source name → resolved API key bytes.
	// Pre-computed at startup; never mutated after Load returns.
	// NEVER log these values.
	ResolvedSourceKeys map[string][]byte

	// ResolvedAdminKey is the resolved admin_token bytes.
	// NEVER log this value.
	ResolvedAdminKey []byte

	// ResolvedMCPKey is the resolved MCP api_key bytes.
	// May be nil if MCP is disabled or api_key is empty.
	// NEVER log this value.
	ResolvedMCPKey []byte
}

type ConsistencyConfig struct {
	Enabled         bool `toml:"enabled"`
	IntervalSeconds int  `toml:"interval_seconds"`
	SampleSize      int  `toml:"sample_size"`
}

type DaemonConfig struct {
	Port       int    `toml:"port"`
	Bind       string `toml:"bind"`
	AdminToken string `toml:"admin_token"` // env:/file:/literal reference
	LogLevel   string `toml:"log_level"`
	LogFormat  string `toml:"log_format"`
	Mode       string `toml:"mode"` // safe, balanced, or fast
	QueueSize  int    `toml:"queue_size"`

	Shutdown          ShutdownConfig                `toml:"shutdown"`
	WAL               WALDaemonConfig               `toml:"wal"`
	RateLimit         GlobalRateLimitConfig         `toml:"rate_limit"`
	Embedding         EmbeddingConfig               `toml:"embedding"`
	MCP               MCPConfig                     `toml:"mcp"`
	Web               WebConfig                     `toml:"web"`
	TLS               TLSConfig                     `toml:"tls"`
	TrustedProxies    TrustedProxiesConfig          `toml:"trusted_proxies"`
	Signing           SigningConfig                 `toml:"signing"`
	JWT               JWTConfig                     `toml:"jwt"`
	Events            EventsConfig                  `toml:"events"`
	Audit             AuditConfig                   `toml:"audit"`
	RetrievalFirewall DaemonRetrievalFirewallConfig `toml:"retrieval_firewall"`
	OAuth             OAuthDaemonConfig             `toml:"oauth"`
}

type DaemonRetrievalFirewallConfig struct {
	Enabled     bool     `toml:"enabled"`
	TierOrder   []string `toml:"tier_order"`
	DefaultTier string   `toml:"default_tier"`
}

type Destination struct {
	Name   string
	Type   string
	DBPath string
	DSN    string
	URL    string
	APIKey string
	Decay  DestinationDecayConfig
}

type DestinationDecayConfig struct {
	HalfLifeDays      float64                          `toml:"half_life_days"`
	DecayMode         string                           `toml:"decay_mode"`
	StepThresholdDays float64                          `toml:"step_threshold_days"`
	Collections       map[string]CollectionDecayConfig `toml:"collections"`
}

type EmbeddingConfig struct {
	Enabled        bool   `toml:"enabled"`
	Provider       string `toml:"provider"`
	URL            string `toml:"url"`     // env:/file:/literal reference
	APIKey         string `toml:"api_key"` // env:/file:/literal reference
	Model          string `toml:"model"`
	Dimensions     int    `toml:"dimensions"`
	TimeoutSeconds int    `toml:"timeout_seconds"`
}

type EventSink struct {
	Name           string `toml:"name"`
	URL            string `toml:"url"`
	TimeoutSeconds int    `toml:"timeout_seconds"`
	MaxRetries     int    `toml:"max_retries"`
	Content        string `toml:"content"` // "summary" or "full"
}

type EventsConfig struct {
	Enabled             bool        `toml:"enabled"`
	MaxInFlight         int         `toml:"max_inflight"`
	RetryBackoffSeconds []int       `toml:"retry_backoff_seconds"`
	Sinks               []EventSink `toml:"sinks"`
}

type FieldVisibilityConfig struct {
	IncludeFields []string `toml:"include_fields"`
	StripMetadata bool     `toml:"strip_metadata"`
}

type GlobalRateLimitConfig struct {
	GlobalRequestsPerMinute int `toml:"global_requests_per_minute"`
}

type IdempotencyConfig struct {
	Enabled            bool `toml:"enabled"`
	DedupWindowSeconds int  `toml:"dedup_window_seconds"`
}

type JWTConfig struct {
	Enabled       bool   `toml:"enabled"`
	JWKSUrl       string `toml:"jwks_url"`
	ClaimToSource string `toml:"claim_to_source"`
	Audience      string `toml:"audience"`
}

type MCPConfig struct {
	Enabled    bool   `toml:"enabled"`
	Port       int    `toml:"port"`
	Bind       string `toml:"bind"`
	SourceName string `toml:"source_name"`
	APIKey     string `toml:"api_key"` // env:/file:/literal reference
}

type OAuthClientConfig struct {
	ClientID        string   `toml:"client_id"`
	ClientName      string   `toml:"client_name"`
	RedirectURIs    []string `toml:"redirect_uris"`
	OAuthSourceName string   `toml:"oauth_source_name"`
	AllowedScopes   []string `toml:"allowed_scopes"`
}

type OAuthDaemonConfig struct {
	Enabled            bool                `toml:"enabled"`
	IssuerURL          string              `toml:"issuer_url"`
	PrivateKeyFile     string              `toml:"private_key_file"`
	AccessTokenTTLSecs int                 `toml:"access_token_ttl_seconds"`
	AuthCodeTTLSecs    int                 `toml:"auth_code_ttl_seconds"`
	Clients            []OAuthClientConfig `toml:"clients"`
}

type PayloadLimitsConfig struct {
	MaxBytes int64 `toml:"max_bytes"`
}

type PolicyCacheConfig struct {
	ReadFromCache               bool    `toml:"read_from_cache"`
	WriteToCache                bool    `toml:"write_to_cache"`
	MaxTTLSeconds               int     `toml:"max_ttl_seconds"`
	SemanticSimilarityThreshold float64 `toml:"semantic_similarity_threshold"`
}

type PolicyDecayConfig struct {
	HalfLifeDays      float64 `toml:"half_life_days"`
	DecayMode         string  `toml:"decay_mode"`
	StepThresholdDays float64 `toml:"step_threshold_days"`
}

type RetrievalConfig struct {
	TimeDecay        bool    `toml:"time_decay"`
	HalfLifeDays     float64 `toml:"half_life_days"`
	DecayMode        string  `toml:"decay_mode"` // "exponential" or "step"
	OverSampleFactor int     `toml:"over_sample_factor"`
	DefaultProfile   string  `toml:"default_profile"` // fast, balanced, deep
}

type SecurityEventsConfig struct {
	Enabled bool   `toml:"enabled"`
	LogFile string `toml:"log_file"`
}

type ShutdownConfig struct {
	DrainTimeoutSeconds int `toml:"drain_timeout_seconds"`
}

type SigningConfig struct {
	Enabled bool   `toml:"enabled"`
	KeyFile string `toml:"key_file"` // env:/file:/literal reference
}

type Source struct {
	Name             string
	APIKey           string // raw (unresolved) reference — NEVER log resolved value
	Namespace        string
	CanRead          bool
	CanWrite         bool
	TargetDest       string
	DefaultActorType string
	DefaultActorID   string
	DefaultProfile   string
	RateLimit        SourceRateLimitConfig
	PayloadLimits    PayloadLimitsConfig
	Mapping          map[string]string   // output field → gjson dot-path
	Transform        map[string][]string // output field → transform pipeline
	Idempotency      IdempotencyConfig
	Policy           SourcePolicyConfig
}

type SourcePolicyConfig struct {
	AllowedDestinations   []string                      `toml:"allowed_destinations"`
	AllowedOperations     []string                      `toml:"allowed_operations"`
	AllowedRetrievalModes []string                      `toml:"allowed_retrieval_modes"`
	AllowedProfiles       []string                      `toml:"allowed_profiles"`
	MaxResults            int                           `toml:"max_results"`
	MaxResponseBytes      int                           `toml:"max_response_bytes"`
	FieldVisibility       FieldVisibilityConfig         `toml:"field_visibility"`
	Cache                 PolicyCacheConfig             `toml:"cache"`
	Decay                 PolicyDecayConfig             `toml:"decay"`
	RetrievalFirewall     SourceRetrievalFirewallConfig `toml:"retrieval_firewall"`
}

type SourceRateLimitConfig struct {
	RequestsPerMinute int `toml:"requests_per_minute"`
}

type SourceRetrievalFirewallConfig struct {
	BlockedLabels             []string `toml:"blocked_labels"`
	MaxClassificationTier     string   `toml:"max_classification_tier"`
	RequiredLabels            []string `toml:"required_labels"`
	DefaultClassificationTier string   `toml:"default_classification_tier"`
	VisibleNamespaces         []string `toml:"visible_namespaces"`
	CrossNamespaceRead        bool     `toml:"cross_namespace_read"`

	// Precomputed sets built at config-load time to avoid per-request
	// allocation in the PostFilter hot path. Rebuilt on every config load
	// (including hot-reload), so they are always fresh.
	BlockedLabelsSet     map[string]struct{} `toml:"-"`
	RequiredLabelsSet    map[string]struct{} `toml:"-"`
	VisibleNamespacesSet map[string]struct{} `toml:"-"`
}

type TLSConfig struct {
	Enabled      bool   `toml:"enabled"`
	CertFile     string `toml:"cert_file"` // env:/file:/literal reference
	KeyFile      string `toml:"key_file"`  // env:/file:/literal reference
	MinVersion   string `toml:"min_version"`
	MaxVersion   string `toml:"max_version"`
	ClientCAFile string `toml:"client_ca_file"`
	ClientAuth   string `toml:"client_auth"`
}

type TrustedProxiesConfig struct {
	CIDRs            []string `toml:"cidrs"`
	ForwardedHeaders []string `toml:"forwarded_headers"`
}

type WALDaemonConfig struct {
	Path             string              `toml:"path"`
	MaxSegmentSizeMB int64               `toml:"max_segment_size_mb"`
	Integrity        WALIntegrityConfig  `toml:"integrity"`
	Encryption       WALEncryptionConfig `toml:"encryption"`
	Watchdog         WALWatchdogConfig   `toml:"watchdog"`
}

type WALEncryptionConfig struct {
	Enabled bool   `toml:"enabled"`
	KeyFile string `toml:"key_file"` // env:/file:/literal reference
}

type WALIntegrityConfig struct {
	Mode       string `toml:"mode"`         // "crc32" or "mac"
	MacKeyFile string `toml:"mac_key_file"` // env:/file:/literal reference
}

type WALWatchdogConfig struct {
	IntervalSeconds    int   `toml:"interval_seconds"`
	MinDiskBytes       int64 `toml:"min_disk_bytes"`
	MaxAppendLatencyMS int   `toml:"max_append_latency_ms"`
}

type WebConfig struct {
	Port        int  `toml:"port"`
	RequireAuth bool `toml:"require_auth"`
}