config

type AuditDBConfig struct {
	Enabled bool `yaml:"enabled"`
	// Path is the SQLite file path (supports ~).
	Path string `yaml:"path"`
	// Retention is the retention duration (time.ParseDuration; also supports "7d" for days).
	Retention string `yaml:"retention"`
}

type Config struct {
	Proxy    ProxyConfig    `yaml:"proxy"`
	Patterns PatternsConfig `yaml:"patterns"`
	Targets  []TargetConfig `yaml:"targets"`
	Session  SessionConfig  `yaml:"session"`
	Log      LogConfig      `yaml:"log"`
	// AuditDB controls whether audit events are persisted to SQLite (only available in the "full" build; disabled by default).
	AuditDB AuditDBConfig `yaml:"audit_db"`
}

type KeywordPattern struct {
	Value    string `yaml:"value" json:"value"`
	Category string `yaml:"category" json:"category"`
}

type LogConfig struct {
	Level     string `yaml:"level"`
	File      string `yaml:"file"`
	RedactLog bool   `yaml:"redact_log"`
}

type Manager struct {
	// contains filtered or unexported fields
}

type NERConfig struct {
	Enabled bool `yaml:"enabled"`
	// PresidioURL is the Presidio Analyzer service URL (e.g. http://127.0.0.1:5001).
	// Note: VibeGuard does not bundle Presidio; it only calls an external service.
	PresidioURL string `yaml:"presidio_url"`
	// Language is passed to Presidio (e.g. en / zh / fr ...).
	// Note: Presidio requires a language; for backward compatibility, "auto" is treated as "en".
	Language string `yaml:"language"`
	// Entities specifies enabled entity types (e.g. PERSON/ORG/LOCATION/DATE...). Empty means the implementation default set.
	Entities []string `yaml:"entities"`
	// MinScore is the Presidio confidence threshold (0~1; 0 means Presidio default).
	MinScore float64 `yaml:"min_score"`
}

type PatternsConfig struct {
	Keywords    []KeywordPattern   `yaml:"keywords"`
	Regex       []RegexPattern     `yaml:"regex"`
	Builtin     []string           `yaml:"builtin"`
	Exclude     []string           `yaml:"exclude"`
	SecretFiles []SecretFileConfig `yaml:"secret_files"`
	RuleLists   []RuleListConfig   `yaml:"rule_lists"`
	// NER toggles and configures named-entity recognition (external Presidio engine; off by default).
	NER NERConfig `yaml:"ner"`
}

type ProxyConfig struct {
	Listen            string `yaml:"listen"`
	PlaceholderPrefix string `yaml:"placeholder_prefix"`
	// InterceptMode controls how HTTPS CONNECT is handled:
	// - global: MITM for all hosts (default; best for HTTP(S)_PROXY env usage)
	// - targets: MITM only for enabled hosts in targets (safer; avoids impacting non-target traffic)
	InterceptMode string `yaml:"intercept_mode"`
	// WebSocketRedactionBeta enables best-effort WebSocket text-message redaction/restore.
	// It is intentionally off by default because some servers/extensions may be incompatible.
	WebSocketRedactionBeta bool `yaml:"websocket_redaction_beta"`
}

type RegexPattern struct {
	Pattern  string `yaml:"pattern" json:"pattern"`
	Category string `yaml:"category" json:"category"`
}

type RuleListConfig struct {
	// ID is a stable identifier (generated by the admin UI); may be empty.
	ID string `yaml:"id" json:"id"`
	// Name is a display name (editable in the admin UI); may be empty.
	Name string `yaml:"name" json:"name"`
	// Path is the local rule file path (supports ~); mutually exclusive with URL.
	Path string `yaml:"path" json:"path"`
	// URL is the remote subscription URL (http/https); mutually exclusive with Path.
	URL string `yaml:"url" json:"url"`
	// UpdateInterval is the subscription update interval (e.g. 24h/6h); applies to URL mode only. Default is 24h.
	UpdateInterval string `yaml:"update_interval" json:"update_interval"`
	// AllowHTTP allows http:// subscriptions when true (unsafe; default only allows https://).
	AllowHTTP bool `yaml:"allow_http" json:"allow_http"`
	// Enabled controls whether this rule list participates in matching.
	Enabled bool `yaml:"enabled" json:"enabled"`
	// Priority controls priority (1~99); higher wins on overlaps.
	Priority int `yaml:"priority" json:"priority"`
}

type SecretFileConfig struct {
	// Path is a local file path (supports ~). Relative paths are resolved relative to the config file that defined it.
	Path string `yaml:"path" json:"path"`
	// Format controls how the file is parsed:
	// - dotenv: parse KEY=VALUE lines and import VALUEs as keywords (recommended for .env)
	// - lines: treat each non-empty non-comment line as a keyword
	Format string `yaml:"format" json:"format"`
	// Category is the match category used in audit/logging. Defaults to DOTENV/SECRET_FILE based on format.
	Category string `yaml:"category" json:"category"`
	// MinValueLen filters out short values to reduce false positives. Default is 8.
	MinValueLen int `yaml:"min_value_len" json:"min_value_len"`
	// Enabled defaults to true when omitted.
	Enabled *bool `yaml:"enabled" json:"enabled"`
}

type SessionConfig struct {
	TTL                       string `yaml:"ttl"`
	MaxMappings               int    `yaml:"max_mappings"`
	WALEnabled                bool   `yaml:"wal_enabled"`
	WALPath                   string `yaml:"wal_path"`
	DeterministicPlaceholders bool   `yaml:"deterministic_placeholders"`
}

type TargetConfig struct {
	Host    string `yaml:"host"`
	Enabled bool   `yaml:"enabled"`
}