kernel

type Config struct {
	DatabaseURL string `yaml:"database_url" env:"AFI_DATABASE_URL"`
	RedisURL    string `yaml:"redis_url" env:"AFI_REDIS_URL"`

	ControlPlane struct {
		Addr string `yaml:"addr" env:"AFI_CONTROLPLANE_ADDR" env-default:":8081"`
	} `yaml:"controlplane"`

	Gateway struct {
		Addr                    string        `yaml:"addr" env:"AFI_GATEWAY_ADDR" env-default:":8080"`
		SnapshotPollIntervalRaw string        `yaml:"snapshot_poll_interval" env:"AFI_SNAPSHOT_POLL_INTERVAL" env-default:"2s"`
		SnapshotPollInterval    time.Duration `yaml:"-"`
		// SnapshotBackend is postgres (default, shared DB) or objectstore (hub-and-spoke fan-out).
		SnapshotBackend string `yaml:"snapshot_backend" env:"AFI_SNAPSHOT_BACKEND" env-default:"postgres"`
		// ControlPlaneURL is the hub control plane base URL for heartbeat and usage shipping.
		ControlPlaneURL string `yaml:"control_plane_url" env:"AFI_CONTROL_PLANE_URL"`
		RegionID        string `yaml:"region_id" env:"AFI_REGION_ID"`
		DeploymentID    string `yaml:"deployment_id" env:"AFI_DEPLOYMENT_ID"`
		// DeploymentJoinToken authenticates heartbeat / usage ingest to the hub.
		DeploymentJoinToken  string        `yaml:"deployment_join_token" env:"AFI_DEPLOYMENT_JOIN_TOKEN"`
		HeartbeatIntervalRaw string        `yaml:"heartbeat_interval" env:"AFI_HEARTBEAT_INTERVAL" env-default:"30s"`
		HeartbeatInterval    time.Duration `yaml:"-"`
		// UsageBackend is postgres (local outbox or sync) or http (ship to hub).
		UsageBackend string `yaml:"usage_backend" env:"AFI_USAGE_BACKEND" env-default:"postgres"`
		// UsageSync writes usage_events immediately when UsageBackend=postgres (skips outbox/worker).
		UsageSync bool `yaml:"usage_sync" env:"AFI_USAGE_SYNC"`
		// WasmBeforeCall is an optional path to a TinyGo .wasm exporting before_call.
		WasmBeforeCall string `yaml:"wasm_before_call" env:"AFI_WASM_BEFORE_CALL"`
		// WasmBeforeChat is an optional path to a TinyGo .wasm exporting before_chat.
		WasmBeforeChat string `yaml:"wasm_before_chat" env:"AFI_WASM_BEFORE_CHAT"`
		// WasmS3 is an optional S3-compatible store for module_uri values like s3://bucket/key.
		WasmS3 struct {
			Endpoint  string `yaml:"endpoint" env:"AFI_WASM_S3_ENDPOINT"`
			AccessKey string `yaml:"access_key" env:"AFI_WASM_S3_ACCESS_KEY"`
			SecretKey string `yaml:"secret_key" env:"AFI_WASM_S3_SECRET_KEY"`
			Region    string `yaml:"region" env:"AFI_WASM_S3_REGION"`
			UseSSL    bool   `yaml:"use_ssl" env:"AFI_WASM_S3_USE_SSL"`
			PathStyle bool   `yaml:"path_style" env:"AFI_WASM_S3_PATH_STYLE"`
		} `yaml:"wasm_s3"`
		// SnapshotS3 is the object store for snapshot fan-out (spokes + optional hub mirror).
		SnapshotS3 struct {
			Endpoint  string `yaml:"endpoint" env:"AFI_SNAPSHOT_S3_ENDPOINT"`
			AccessKey string `yaml:"access_key" env:"AFI_SNAPSHOT_S3_ACCESS_KEY"`
			SecretKey string `yaml:"secret_key" env:"AFI_SNAPSHOT_S3_SECRET_KEY"`
			Region    string `yaml:"region" env:"AFI_SNAPSHOT_S3_REGION"`
			Bucket    string `yaml:"bucket" env:"AFI_SNAPSHOT_S3_BUCKET"`
			UseSSL    bool   `yaml:"use_ssl" env:"AFI_SNAPSHOT_S3_USE_SSL"`
			PathStyle bool   `yaml:"path_style" env:"AFI_SNAPSHOT_S3_PATH_STYLE"`
			Prefix    string `yaml:"prefix" env:"AFI_SNAPSHOT_S3_PREFIX" env-default:"snapshots"`
		} `yaml:"snapshot_s3"`
		// GrpcExtensions lists process-isolated gRPC plugins (YAML via AFI_CONFIG).
		GrpcExtensions []GrpcExtension `yaml:"grpc_extensions"`
	} `yaml:"gateway"`

	// SnapshotDistribution mirrors published snapshots to object storage (hub side).
	SnapshotDistribution struct {
		Enabled bool `yaml:"enabled" env:"AFI_SNAPSHOT_DIST_ENABLED"`
	} `yaml:"snapshot_distribution"`

	// Federation configures hub/regional control-plane pull sync (default off = single CP).
	Federation struct {
		// Mode is off (default), home (hub export APIs), or regional (pull loop).
		Mode            string        `yaml:"mode" env:"AFI_FEDERATION_MODE" env-default:"off"`
		HubURL          string        `yaml:"hub_url" env:"AFI_FEDERATION_HUB_URL"`
		PeerID          string        `yaml:"peer_id" env:"AFI_FEDERATION_PEER_ID"`
		JoinToken       string        `yaml:"join_token" env:"AFI_FEDERATION_JOIN_TOKEN"`
		RegionSlug      string        `yaml:"region_slug" env:"AFI_FEDERATION_REGION_SLUG"`
		PullIntervalRaw string        `yaml:"pull_interval" env:"AFI_FEDERATION_PULL_INTERVAL" env-default:"30s"`
		PullInterval    time.Duration `yaml:"-"`
	} `yaml:"federation"`

	Auth struct {
		JWTSecret     string        `yaml:"jwt_secret" env:"AFI_JWT_SECRET"`
		TokenTTLRaw   string        `yaml:"token_ttl" env:"AFI_TOKEN_TTL" env-default:"24h"`
		TokenTTL      time.Duration `yaml:"-"`
		InternalToken string        `yaml:"internal_token" env:"AFI_INTERNAL_TOKEN"`
		// PublicBaseURL is the externally reachable control-plane URL (SSO callbacks).
		PublicBaseURL string `yaml:"public_base_url" env:"AFI_AUTH_PUBLIC_BASE_URL"`
		// SignupEnabled allows self-serve POST /auth/register (default off).
		SignupEnabled bool `yaml:"signup_enabled" env:"AFI_SIGNUP_ENABLED"`
		SSO           struct {
			Enabled bool `yaml:"enabled" env:"AFI_SSO_ENABLED"`
			// StateStore is redis (shared, multi-node) or memory (single-node / tests).
			// Default redis — control plane is expected to scale horizontally.
			StateStore string        `yaml:"state_store" env:"AFI_SSO_STATE_STORE" env-default:"redis"`
			Providers  []SSOProvider `yaml:"providers"`
		} `yaml:"sso"`
	} `yaml:"auth"`

	// Credentials configures encryption for storage_kind=encrypted_db provider credentials.
	// Any non-empty string is accepted (SHA-256 derived); or base64:/raw 32-byte base64.
	Credentials struct {
		MasterKey string `yaml:"master_key" env:"AFI_CREDENTIALS_MASTER_KEY"`
	} `yaml:"credentials"`

	// Secrets configures external vault backends for storage_kind=vault credentials.
	Secrets struct {
		AWSSM struct {
			Enabled bool   `yaml:"enabled" env:"AFI_SECRETS_AWS_SM_ENABLED"`
			Region  string `yaml:"region" env:"AFI_SECRETS_AWS_SM_REGION"`
		} `yaml:"aws_sm"`
		Vault struct {
			Addr  string `yaml:"addr" env:"AFI_SECRETS_VAULT_ADDR"`
			Token string `yaml:"token" env:"AFI_SECRETS_VAULT_TOKEN"`
		} `yaml:"vault"`
	} `yaml:"secrets"`

	Seed struct {
		VirtualAPIKey   string `yaml:"virtual_api_key"`
		AdminEmail      string `yaml:"admin_email"`
		AdminPassword   string `yaml:"admin_password"`
		AdminName       string `yaml:"admin_name"`
		OpenAIBaseURL   string `yaml:"openai_base_url"`
		OpenAIAPIKeyEnv string `yaml:"openai_api_key_env"`
		DefaultModel    string `yaml:"default_model"`
	} `yaml:"seed"`

	// Events configures durable platform domain-event delivery.
	Events struct {
		// OutboxEnabled enqueues platform.Bus events into platform_event_outbox.
		OutboxEnabled bool `yaml:"outbox_enabled" env:"AFI_EVENTS_OUTBOX_ENABLED"`
		// Publisher is log | nats | kafka | noop (worker drain target).
		Publisher string `yaml:"publisher" env:"AFI_EVENTS_PUBLISHER" env-default:"log"`
		NATS      struct {
			URL           string `yaml:"url" env:"AFI_EVENTS_NATS_URL"`
			Stream        string `yaml:"stream" env:"AFI_EVENTS_NATS_STREAM"`
			SubjectPrefix string `yaml:"subject_prefix" env:"AFI_EVENTS_NATS_SUBJECT_PREFIX"`
		} `yaml:"nats"`
		Kafka struct {
			Brokers string `yaml:"brokers" env:"AFI_EVENTS_KAFKA_BROKERS"`
			Topic   string `yaml:"topic" env:"AFI_EVENTS_KAFKA_TOPIC"`
		} `yaml:"kafka"`
	} `yaml:"events"`

	// Telemetry configures OpenTelemetry metrics and traces (OTLP + optional Prometheus).
	Telemetry struct {
		Enabled           bool    `yaml:"enabled" env:"AFI_TELEMETRY_ENABLED"`
		ServiceName       string  `yaml:"service_name" env:"AFI_TELEMETRY_SERVICE_NAME"`
		Environment       string  `yaml:"environment" env:"AFI_TELEMETRY_ENVIRONMENT"`
		OTLPEndpoint      string  `yaml:"otlp_endpoint" env:"AFI_TELEMETRY_OTLP_ENDPOINT"`
		OTLPProtocol      string  `yaml:"otlp_protocol" env:"AFI_TELEMETRY_OTLP_PROTOCOL" env-default:"http"`
		OTLPHeaders       string  `yaml:"otlp_headers" env:"AFI_TELEMETRY_OTLP_HEADERS"`
		OTLPInsecure      bool    `yaml:"otlp_insecure" env:"AFI_TELEMETRY_OTLP_INSECURE"`
		MetricsPrometheus bool    `yaml:"metrics_prometheus" env:"AFI_TELEMETRY_METRICS_PROMETHEUS"`
		TracesSampler     string  `yaml:"traces_sampler" env:"AFI_TELEMETRY_TRACES_SAMPLER" env-default:"parentbased_always_on"`
		TracesSamplerArg  float64 `yaml:"traces_sampler_arg" env:"AFI_TELEMETRY_TRACES_SAMPLER_ARG" env-default:"1.0"`
	} `yaml:"telemetry"`

	// Mail configures outbound email for org member invites.
	Mail struct {
		PublicAppURL    string `yaml:"public_app_url" env:"AFI_MAIL_PUBLIC_APP_URL"`
		From            string `yaml:"from" env:"AFI_MAIL_FROM"`
		DefaultProvider string `yaml:"default_provider" env:"AFI_MAIL_DEFAULT_PROVIDER"`
		SMTP            struct {
			Enabled  bool   `yaml:"enabled" env:"AFI_MAIL_SMTP_ENABLED"`
			Host     string `yaml:"host" env:"AFI_MAIL_SMTP_HOST"`
			Port     int    `yaml:"port" env:"AFI_MAIL_SMTP_PORT"`
			Username string `yaml:"username" env:"AFI_MAIL_SMTP_USERNAME"`
			Password string `yaml:"password" env:"AFI_MAIL_SMTP_PASSWORD"`
			TLS      bool   `yaml:"tls" env:"AFI_MAIL_SMTP_TLS"`
		} `yaml:"smtp"`
		Resend struct {
			Enabled bool   `yaml:"enabled" env:"AFI_MAIL_RESEND_ENABLED"`
			APIKey  string `yaml:"api_key" env:"AFI_MAIL_RESEND_API_KEY"`
		} `yaml:"resend"`
		SES struct {
			Enabled         bool   `yaml:"enabled" env:"AFI_MAIL_SES_ENABLED"`
			Region          string `yaml:"region" env:"AFI_MAIL_SES_REGION"`
			AccessKeyID     string `yaml:"access_key_id" env:"AFI_MAIL_SES_ACCESS_KEY_ID"`
			SecretAccessKey string `yaml:"secret_access_key" env:"AFI_MAIL_SES_SECRET_ACCESS_KEY"`
		} `yaml:"ses"`
	} `yaml:"mail"`
}

type GrpcExtension struct {
	ID           string   `yaml:"id"`
	Address      string   `yaml:"address"` // unix:///path or host:port
	Command      []string `yaml:"command"` // host spawns; sets AFI_PLUGIN_SOCK
	ProviderType string   `yaml:"provider_type"`
}

type SSOProvider struct {
	ID                   string   `yaml:"id"`
	Type                 string   `yaml:"type"` // oidc | oauth2 | saml
	DisplayName          string   `yaml:"display_name"`
	Issuer               string   `yaml:"issuer"`
	ClientID             string   `yaml:"client_id"`
	ClientSecret         string   `yaml:"client_secret"`
	Scopes               []string `yaml:"scopes"`
	AuthURL              string   `yaml:"auth_url"`
	TokenURL             string   `yaml:"token_url"`
	UserInfoURL          string   `yaml:"userinfo_url"`
	RequireEmailVerified *bool    `yaml:"require_email_verified"`
	// SAML fields (type: saml).
	EntityID       string `yaml:"entity_id"`
	IDPMetadataURL string `yaml:"idp_metadata_url"`
	IDPMetadataXML string `yaml:"idp_metadata_xml"`
	SPCertPEM      string `yaml:"sp_cert_pem"`
	SPKeyPEM       string `yaml:"sp_key_pem"`
}