config

type AccessConfig struct {
	Mode        string            `yaml:"mode"`
	GeoIP       GeoIPConfig       `yaml:"geoip"`
	SelfDefense SelfDefenseConfig `yaml:"self_defense"`
}

type AccountingAdminConfig struct {
	Enabled      bool   `yaml:"enabled"`
	Path         string `yaml:"path"`
	MaxBodyBytes int64  `yaml:"max_body_bytes"`
}

type AccountingAuthorityConfig struct {
	Enabled            bool   `yaml:"enabled"`
	Mode               string `yaml:"mode"`
	Store              string `yaml:"store"`
	SQLitePath         string `yaml:"sqlite_path"`
	PostgresDSN        string `yaml:"postgres_dsn"`
	StartupPosture     string `yaml:"startup_posture"`
	UnknownAttribution string `yaml:"unknown_attribution"`
	EvaluationTimeout  string `yaml:"evaluation_timeout"`
	CleanupTimeout     string `yaml:"cleanup_timeout"`
	// SnapshotVersion is the immutable config-backed policy version (requirement 11.5).
	// Empty defaults to "static" at source construction.
	SnapshotVersion string                          `yaml:"snapshot_version"`
	Query           AccountingAuthorityQueryConfig  `yaml:"query"`
	Rules           []AccountingAuthorityRuleConfig `yaml:"rules"`
	// Quota is an optional provider account-window authority. Its presence is
	// the explicit opt-in; no telemetry is inferred as quota authority when it
	// is omitted.
	Quota *AccountingQuotaConfig `yaml:"quota"`
}

type AccountingAuthorityDimensionMatcherConfig struct {
	Value        scope.Value `yaml:"value"`
	MatchUnknown bool        `yaml:"match_unknown"`
}

type AccountingAuthorityDimensionsConfig struct {
	Principal    AccountingAuthorityDimensionMatcherConfig            `yaml:"principal"`
	Credential   AccountingAuthorityDimensionMatcherConfig            `yaml:"credential"`
	Tenant       AccountingAuthorityDimensionMatcherConfig            `yaml:"tenant"`
	Organization AccountingAuthorityDimensionMatcherConfig            `yaml:"organization"`
	Workspace    AccountingAuthorityDimensionMatcherConfig            `yaml:"workspace"`
	Project      AccountingAuthorityDimensionMatcherConfig            `yaml:"project"`
	Department   AccountingAuthorityDimensionMatcherConfig            `yaml:"department"`
	CostCenter   AccountingAuthorityDimensionMatcherConfig            `yaml:"cost_center"`
	Backend      AccountingAuthorityDimensionMatcherConfig            `yaml:"backend"`
	Model        AccountingAuthorityDimensionMatcherConfig            `yaml:"model"`
	Route        AccountingAuthorityDimensionMatcherConfig            `yaml:"route"`
	Labels       map[string]AccountingAuthorityDimensionMatcherConfig `yaml:"labels"`
}

type AccountingAuthorityQueryConfig struct {
	Enabled         bool   `yaml:"enabled"`
	PathPrefix      string `yaml:"path_prefix"`
	DefaultPageSize int    `yaml:"default_page_size"`
	MaxPageSize     int    `yaml:"max_page_size"`
}

type AccountingAuthorityRuleConfig struct {
	ID                   string                              `yaml:"id"`
	Kind                 string                              `yaml:"kind"`
	Mode                 string                              `yaml:"mode"`
	Unit                 string                              `yaml:"unit"`
	Limit                int64                               `yaml:"limit"`
	Currency             string                              `yaml:"currency"`
	AuthorityRequirement string                              `yaml:"authority_requirement"`
	FailureBehavior      string                              `yaml:"failure_behavior"`
	Perspective          string                              `yaml:"perspective"`
	LifecycleScope       string                              `yaml:"lifecycle_scope"`
	Basis                string                              `yaml:"basis"`
	Namespace            string                              `yaml:"namespace"`
	Version              string                              `yaml:"version"`
	Window               AccountingAuthorityWindowConfig     `yaml:"window"`
	Match                AccountingAuthorityDimensionsConfig `yaml:"match"`
}

type AccountingAuthorityWindowConfig struct {
	Algorithm string `yaml:"algorithm"`
	Size      string `yaml:"size"`
	Anchor    string `yaml:"anchor"`
}

type AccountingBillingConfig struct {
	// ReportsPath selects the protected billing report surface for an injected
	// billing composition. Empty selects /admin/billing.
	ReportsPath string `yaml:"reports_path"`
}

type AccountingConfig struct {
	Enabled bool   `yaml:"enabled"`
	Mode    string `yaml:"mode"`
	// CountTimeout bounds provider/local count calls; empty selects the composition-root default.
	CountTimeout  string                        `yaml:"count_timeout"`
	Tokenizer     AccountingTokenizerConfig     `yaml:"tokenizer"`
	Preflight     AccountingPreflightConfig     `yaml:"preflight"`
	Ledger        AccountingLedgerConfig        `yaml:"ledger"`
	Admin         AccountingAdminConfig         `yaml:"admin"`
	Observability AccountingObservabilityConfig `yaml:"observability"`
	// StrictAuthoritative rejects backend wiring unless every configured backend can provide authoritative usage.
	StrictAuthoritative bool                       `yaml:"strict_authoritative"`
	Pricing             AccountingPricingConfig    `yaml:"pricing"`
	Authority           AccountingAuthorityConfig  `yaml:"authority"`
	Concurrency         ConcurrencyAuthorityConfig `yaml:"concurrency"`
	// Billing contains report-path configuration for an injected composition.
	// Billing is enabled only by complete host composition.
	Billing AccountingBillingConfig `yaml:"billing"`
}

type AccountingLedgerConfig struct {
	// Store/SQLitePath/PostgresDSN/WritePolicy remain accepted for
	// backward-compatible YAML. Phase 8 no longer opens or writes this ledger;
	// Bun billingstore is the monetary journal.
	Store       string `yaml:"store"`
	SQLitePath  string `yaml:"sqlite_path"`
	PostgresDSN string `yaml:"postgres_dsn"`
	WritePolicy string `yaml:"write_policy"`
}

type AccountingModelPriceConfig struct {
	Backend              string `yaml:"backend"`
	Model                string `yaml:"model"`
	InputPer1M           string `yaml:"input_per_1m"`
	CachedInputPer1M     string `yaml:"cached_input_per_1m"`
	CacheWriteInputPer1M string `yaml:"cache_write_input_per_1m"`
	OutputPer1M          string `yaml:"output_per_1m"`
	ReasoningOutputPer1M string `yaml:"reasoning_output_per_1m"`
}

type AccountingObservabilityConfig struct {
	Enabled bool `yaml:"enabled"`
}

type AccountingPreflightConfig struct {
	Mode                 string `yaml:"mode"`
	MaxInputTokens       int64  `yaml:"max_input_tokens"`
	MaxOutputTokens      int64  `yaml:"max_output_tokens"`
	MaxContextTokens     int64  `yaml:"max_context_tokens"`
	ClampMaxOutputTokens bool   `yaml:"clamp_max_output_tokens"`
	// UnknownOutputPolicy selects how to bound exposure when the client omits
	// max_output_tokens: require_client_limit | configured_default |
	// model_backend_maximum | clamp | deny. Empty applies the documented default.
	UnknownOutputPolicy string `yaml:"unknown_output_policy"`
}

type AccountingPricingConfig struct {
	Currency       string                       `yaml:"currency"`
	CatalogVersion string                       `yaml:"catalog_version"`
	Models         []AccountingModelPriceConfig `yaml:"models"`
}

type AccountingQuotaConfig struct {
	ID                 string                           `yaml:"id"`
	Version            string                           `yaml:"version"`
	Method             string                           `yaml:"method"`
	StoreID            string                           `yaml:"store_id"`
	TenantID           string                           `yaml:"tenant_id"`
	ProviderAccountKey string                           `yaml:"provider_account_key"`
	PoolID             string                           `yaml:"pool_id"`
	WindowID           string                           `yaml:"window_id"`
	ResetAt            string                           `yaml:"reset_at"`
	Freshness          string                           `yaml:"freshness"`
	Required           []metering.ComponentKey          `yaml:"required"`
	Thresholds         []AccountingQuotaThresholdConfig `yaml:"thresholds"`
	Failures           AccountingQuotaFailureConfig     `yaml:"failures"`
}

type AccountingQuotaFailureConfig struct {
	Missing     string `yaml:"missing"`
	Stale       string `yaml:"stale"`
	Partial     string `yaml:"partial"`
	Unavailable string `yaml:"unavailable"`
	Mismatch    string `yaml:"mismatch"`
	Future      string `yaml:"future"`
}

type AccountingQuotaThresholdConfig struct {
	Kind      string                `yaml:"kind"`
	Field     metering.ComponentKey `yaml:"field"`
	ValueKind string                `yaml:"value_kind"`
	Value     string                `yaml:"value"`
}

type AccountingTokenizerConfig struct {
	DefaultEncoding string            `yaml:"default_encoding"`
	ModelMappings   map[string]string `yaml:"model_mappings"`
}

type AuthConfig struct {
	Handler            string `yaml:"handler"`
	RequiredLevel      string `yaml:"required_level"`
	EventFailurePolicy string `yaml:"event_failure_policy"`
	// EventDelivery selects how auth/session events are delivered: default (structured log sink),
	// disabled (no sink; explicit no delivery), or custom (requires BuildOptions.AuthEventSink at wiring).
	// Empty behaves like default.
	EventDelivery string                  `yaml:"event_delivery"`
	LocalAPIKeys  []AuthLocalAPIKeyRecord `yaml:"local_api_keys"`
	Remote        AuthRemoteConfig        `yaml:"remote"`
}

type AuthLocalAPIKeyRecord struct {
	KeyID       string `yaml:"key_id"`
	PrincipalID string `yaml:"principal_id"`
	Key         string `yaml:"key"`
	// Attribution carries optional operator-controlled safe attribution for this key.
	// Missing optional fields remain unknown (no inference). Raw secrets and transport
	// headers must never be placed here.
	Attribution AuthLocalAttribution `yaml:"attribution"`
}

type AuthLocalAttribution struct {
	DisplayName    string            `yaml:"display_name"`
	AuthMethod     string            `yaml:"auth_method"`
	TenantID       string            `yaml:"tenant_id"`
	OrganizationID string            `yaml:"organization_id"`
	WorkspaceID    string            `yaml:"workspace_id"`
	ProjectID      string            `yaml:"project_id"`
	DepartmentID   string            `yaml:"department_id"`
	CostCenterID   string            `yaml:"cost_center_id"`
	Roles          []string          `yaml:"roles"`
	SafeClaims     map[string]string `yaml:"safe_claims"`
	PolicyLabels   map[string]string `yaml:"policy_labels"`
}

type AuthMode string

type AuthRemoteConfig struct {
	Endpoint string `yaml:"endpoint"`
	Handler  string `yaml:"handler"`
}

type AutoResumeConfig struct {
	Enabled           *bool  `yaml:"enabled"`
	IdleTimeout       string `yaml:"idle_timeout"`
	GracePeriod       string `yaml:"grace_period"`
	PostOutputPolicy  string `yaml:"post_output_policy"`
	EmitWarning       *bool  `yaml:"emit_warning"`
	KeepaliveInterval string `yaml:"keepalive_interval"`
}

type BackendDiscoveryConfig struct {
	Enabled         bool     `yaml:"enabled"`
	Paths           []string `yaml:"paths"`
	Strict          bool     `yaml:"strict"`
	DevelopmentMode bool     `yaml:"development_mode"`
}

type CircuitBreakerConfig struct {
	Enabled          bool   `yaml:"enabled"`
	FailureThreshold int    `yaml:"failure_threshold"`
	OpenFor          string `yaml:"open_for"`
}

type ClientIPSource string

type CompatibleModeConfig struct {
	BackendPrefix         string
	BaseURL               string
	APIKeyEnvVarRoot      string
	TokenizerID           string
	MaxConcurrentRequests int
	Models                CompatibleModeModelsConfig
}

type CompatibleModeModelItem struct {
	CanonicalID string
	NativeID    string
	DisplayName string
}

type CompatibleModeModelsConfig struct {
	Source string
	Path   string
	Items  []CompatibleModeModelItem
}

type CompiledGeoIP struct {
	// contains filtered or unexported fields
}

type CompiledSelfDefense struct {
	// contains filtered or unexported fields
}

type ConcurrencyAuthorityConfig struct {
	Enabled     bool   `yaml:"enabled"`
	Store       string `yaml:"store"` // memory | sqlite | postgres
	StoreID     string `yaml:"store_id"`
	SQLitePath  string `yaml:"sqlite_path"`
	PostgresDSN string `yaml:"postgres_dsn"`
	LeaseTTL    string `yaml:"lease_ttl"`
	RenewBefore string `yaml:"renew_before"`
	// SnapshotVersion is the immutable config-backed concurrency policy version (11.5).
	// Empty defaults to "static" at source construction.
	SnapshotVersion string `yaml:"snapshot_version"`
	// AuxiliaryLeasePolicy controls whether auxiliary requests inherit the parent
	// lease (default) or acquire their own top-level slot (requirement 10.10).
	// Values: ""|"inherit" (default) | "acquire_own".
	AuxiliaryLeasePolicy string                           `yaml:"auxiliary_lease_policy"`
	Rules                []ConcurrencyAuthorityRuleConfig `yaml:"rules"`
}

type ConcurrencyAuthorityRuleConfig struct {
	ID                string                              `yaml:"id"`
	Mode              string                              `yaml:"mode"` // strict | advisory
	MaxActiveRequests int                                 `yaml:"max_active_requests"`
	Match             AccountingAuthorityDimensionsConfig `yaml:"match"`
	LeaseTTL          string                              `yaml:"lease_ttl"`
	RenewBefore       string                              `yaml:"renew_before"`
	FailureBehavior   string                              `yaml:"failure_behavior"` // fail_closed | fail_open
	Namespace         string                              `yaml:"namespace"`
	Version           string                              `yaml:"version"`
}

type Config struct {
	Server         ServerConfig         `yaml:"server"`
	HTTPHeaders    HTTPHeadersConfig    `yaml:"http_headers"`
	Access         AccessConfig         `yaml:"access"`
	Auth           AuthConfig           `yaml:"auth"`
	Logging        LoggingConfig        `yaml:"logging"`
	Diagnostics    DiagnosticsConfig    `yaml:"diagnostics"`
	Observability  ObservabilityConfig  `yaml:"observability"`
	HTTPClient     HTTPClientConfig     `yaml:"http_client"`
	Database       DatabaseConfig       `yaml:"database"`
	Routing        RoutingConfig        `yaml:"routing"`
	Continuity     ContinuityConfig     `yaml:"continuity"`
	SecureSession  SecureSessionConfig  `yaml:"secure_session"`
	StreamRecovery StreamRecoveryConfig `yaml:"stream_recovery"`
	Hooks          HooksConfig          `yaml:"hooks"`
	Accounting     AccountingConfig     `yaml:"accounting"`
	Interleaved    InterleavedConfig    `yaml:"interleaved"`
	Plugins        PluginsConfig        `yaml:"plugins"`
	ModelAliases   []ModelAliasConfig   `yaml:"model_aliases"`
	ModelCatalog   ModelCatalogConfig   `yaml:"model_catalog"`
	ModelInventory ModelInventoryConfig `yaml:"model_inventory"`
	// ControlPlane is the optional control-plane persistence/query/event-ledger
	// capability. Disabled by default; enabled requires explicit startup
	// validation (see validateControlPlane).
	ControlPlane ControlPlaneConfig `yaml:"control_plane"`
	// Metering is the optional durable metering journal (Phase 5). Disabled by
	// default so Executor.MeteringRecorder stays nil until explicitly enabled.
	Metering MeteringConfig `yaml:"metering"`
	// Identity controls proxy-wide upstream and downstream identity presentation.
	// Defaults identify as LIP (not client passthrough). Backend connector wiring
	// and A-leg Server middleware are applied in later integration waves.
	Identity identity.Config `yaml:"identity"`
	// ConfigDir is the directory containing the loaded config file. Set by [LoadFile];
	// empty when Config is constructed without loading from disk.
	ConfigDir string `yaml:"-"`
}

type ContinuityConfig struct {
	InMemory bool `yaml:"in_memory"`
	// Store names the continuity backing when InMemory is true. Empty is normalized to "memory" in LoadFile.
	// Use "sqlite" for local durable storage (requires sqlite_path) or "postgres" for managed durable
	// (requires postgres_dsn).
	Store string `yaml:"store"`
	// SQLitePath is the database file path when store is "sqlite".
	SQLitePath string `yaml:"sqlite_path"`
	// PostgresDSN is the connection string when store is "postgres".
	PostgresDSN string `yaml:"postgres_dsn"`
	// TTL is in-memory store only (A-leg eviction). Ignored by SQLite until pruning is implemented.
	TTL string `yaml:"ttl"`
	// MaxLegs is in-memory store only when TTL is empty. Must be >= 0. Ignored by SQLite until pruning exists.
	MaxLegs int `yaml:"max_legs"`
}

type ControlPlaneConfig struct {
	Enabled            bool                        `yaml:"enabled"`
	Store              string                      `yaml:"store"`
	SQLitePath         string                      `yaml:"sqlite_path"`
	PostgresDSN        string                      `yaml:"postgres_dsn"`
	RecordingPolicy    string                      `yaml:"recording_policy"`
	RequiredCategories []string                    `yaml:"required_categories"`
	Query              ControlPlaneQueryConfig     `yaml:"query"`
	Retention          ControlPlaneRetentionConfig `yaml:"retention"`
	RedactionDefault   string                      `yaml:"redaction_default"`
}

type ControlPlaneQueryConfig struct {
	Enabled         bool   `yaml:"enabled"`
	PathPrefix      string `yaml:"path_prefix"`
	DefaultPageSize int    `yaml:"default_page_size"`
	MaxPageSize     int    `yaml:"max_page_size"`
	MaxTimeWindow   string `yaml:"max_time_window"`
}

type ControlPlaneRetentionConfig struct {
	Enabled bool   `yaml:"enabled"`
	Window  string `yaml:"window"`
}

type DatabaseConfig struct {
	ConnectionMode  DatabaseConnectionMode `yaml:"connection_mode"`
	SchemaMode      DatabaseSchemaMode     `yaml:"schema_mode"`
	MaxOpenConns    int                    `yaml:"max_open_conns"`
	MaxIdleConns    int                    `yaml:"max_idle_conns"`
	ConnMaxLifetime string                 `yaml:"conn_max_lifetime"`
	ConnMaxIdleTime string                 `yaml:"conn_max_idle_time"`
}

type DatabaseConnectionMode string

type DatabasePoolSettings struct {
	MaxOpenConns    int
	MaxIdleConns    int
	ConnMaxLifetime time.Duration
	ConnMaxIdleTime time.Duration
}

type DatabaseSchemaMode string

type DiagnosticsConfig struct {
	Enabled      bool   `yaml:"enabled"`
	HealthPath   string `yaml:"health_path"`
	AttemptsPath string `yaml:"attempts_path"`
	// InventoryPath registers a JSON plugin inventory endpoint when non-empty (e.g. "/debug/inventory").
	InventoryPath string `yaml:"inventory_path"`
	// RouteTracePath registers a JSON ring buffer of recent routing decisions when non-empty.
	RouteTracePath string `yaml:"route_trace_path"`
	// PprofPath registers net/http/pprof handlers under this prefix when diagnostics.enabled is true
	// (e.g. "/debug/pprof"). Leave empty to disable. Do not expose publicly without access controls.
	PprofPath string `yaml:"pprof_path"`
	// SharedSecret when non-empty requires header X-LIP-Diagnostics-Secret on attempts, inventory,
	// route trace, and pprof routes (not on health). Use a long random value in production.
	SharedSecret string `yaml:"shared_secret"`
}

type EffectiveAutoResumeConfig struct {
	Enabled           bool
	IdleTimeout       time.Duration
	GracePeriod       time.Duration
	PostOutputPolicy  StreamRecoveryPostOutputPolicy
	EmitWarning       bool
	KeepaliveInterval time.Duration
}

type EffectiveConfig struct {
	Config   *Config
	Identity EffectiveIdentity
	Category LoadCategory
	LoadedAt time.Time
}

type EffectiveIdentity struct {
	PrivateDigest     [32]byte
	PublicFingerprint string
}

type EffectivePreRequestKeepaliveConfig struct {
	Enabled  bool
	Interval time.Duration
}

type ExecutionCompositionPolicy string

type GeoIPClientConfig struct {
	Source         ClientIPSource `yaml:"source"`
	TrustedProxies []string       `yaml:"trusted_proxies"`
}

type GeoIPConfig struct {
	Enabled  bool              `yaml:"enabled"`
	Order    string            `yaml:"order"`
	Allow    GeoIPRuleConfig   `yaml:"allow"`
	Deny     GeoIPRuleConfig   `yaml:"deny"`
	ClientIP GeoIPClientConfig `yaml:"client_ip"`
	Database GeoIPDBConfig     `yaml:"database"`
}

type GeoIPDBConfig struct {
	Source    GeoIPDatabaseSource `yaml:"source"`
	Edition   string              `yaml:"edition"`
	Directory string              `yaml:"directory"`
	LocalPath string              `yaml:"local_path"`
	Update    GeoIPUpdateConfig   `yaml:"update"`
}

type GeoIPDatabaseSource string

type GeoIPRuleConfig struct {
	Countries []string `yaml:"countries"`
	CIDRs     []string `yaml:"cidrs"`
}

type GeoIPUpdateConfig struct {
	Enabled  bool   `yaml:"enabled"`
	Interval string `yaml:"interval"`
}

type HTTPClientConfig struct {
	// TrustEnvironmentProxy when true (default) uses http.ProxyFromEnvironment for outbound requests.
	// When false, the transport ignores HTTP_PROXY/HTTPS_PROXY/NO_PROXY (reduces deputy risk if env is untrusted).
	// Omitted or null in YAML defaults to true in [LoadFile] / [EffectiveTrustEnvironmentProxy].
	TrustEnvironmentProxy *bool `yaml:"trust_environment_proxy"`
	// MaxIdleConns is the Transport MaxIdleConns pool cap. Omit to use the bundled default (~100).
	MaxIdleConns *int `yaml:"max_idle_conns,omitempty"`
	// MaxIdleConnsPerHost defaults to 64 when omitted (Go's default of 2 is usually too low for LLM APIs).
	MaxIdleConnsPerHost *int `yaml:"max_idle_conns_per_host,omitempty"`
	// IdleConnTimeout is a Go duration string (e.g. "90s"). Empty uses the httpclient default.
	IdleConnTimeout string `yaml:"idle_conn_timeout"`
	// ResponseHeaderTimeout bounds waiting for response headers (e.g. "60s"). Empty uses default.
	ResponseHeaderTimeout string `yaml:"response_header_timeout"`
	// DialTimeout is the net.Dialer Timeout for establishing connections (e.g. "30s").
	DialTimeout string `yaml:"dial_timeout"`
	// KeepAlive is the net.Dialer KeepAlive interval (e.g. "30s").
	KeepAlive string `yaml:"keep_alive"`
	// TLSHandshakeTimeout caps TLS handshakes (e.g. "10s").
	TLSHandshakeTimeout string `yaml:"tls_handshake_timeout"`
	// ExpectContinueTimeout is the Transport expect-continue timeout (e.g. "1s").
	ExpectContinueTimeout string `yaml:"expect_continue_timeout"`
	// ClientTimeout is [http.Client.Timeout] for the full request including body (e.g. "120s").
	ClientTimeout string `yaml:"client_timeout"`
}

type HTTPHeadersConfig struct {
	APIKey            []string `yaml:"api_key"`
	Route             []string `yaml:"route"`
	SessionID         []string `yaml:"session_id"`
	ResumeToken       []string `yaml:"resume_token"`
	ALegID            []string `yaml:"a_leg_id"`
	SessionHint       []string `yaml:"session_hint"`
	Trace             []string `yaml:"trace"`
	DiagnosticsSecret []string `yaml:"diagnostics_secret"`
}

type HooksConfig struct {
	// ToolReactorErrorPolicy is one of: fail_open (default), fail_closed, swallow_event.
	ToolReactorErrorPolicy string `yaml:"tool_reactor_error_policy"`
}

type InterleavedConfig struct {
	// Enabled turns on interleaved thinking. Disabled by default.
	Enabled bool `yaml:"enabled"`
}

type LargePayloadFastPathConfig struct {
	// Enabled gates the optimization. Default false.
	Enabled bool `yaml:"enabled"`
	// ThresholdBytes is the decoded-size consideration gate. Required > 0 when
	// enabled.
	ThresholdBytes int64 `yaml:"threshold_bytes"`
	// MemorySpoolBytes bounds retained request bytes in Go heap per capture.
	// Required > 0 and <= MaxInflightSpoolBytes when enabled.
	MemorySpoolBytes int64 `yaml:"memory_spool_bytes"`
	// MaxInflightSpoolBytes bounds global logical spool reservation.
	// Required > 0 when enabled. Optimization budget only (see above).
	MaxInflightSpoolBytes int64 `yaml:"max_inflight_spool_bytes"`
	// MaxSemanticFactBytes bounds profile-derived metadata. Required > 0 when
	// enabled.
	MaxSemanticFactBytes int64 `yaml:"max_semantic_fact_bytes"`
	// SpoolDir optionally overrides the spill directory. Empty selects the OS
	// default temp directory. Validated during candidate generation/reload;
	// an invalid value rejects the candidate and preserves last-good.
	SpoolDir string `yaml:"spool_dir"`
}

type LoadCategory string

type LoadEffectiveOptions struct {
	// ConfigDir sets Config.ConfigDir when non-empty (typically the directory of
	// the fixed source path).
	ConfigDir string
	// FixedStreamRecovery, when non-nil, materializes CLI/env stream-recovery
	// overrides into the effective config (even when the struct is zero).
	FixedStreamRecovery *StreamRecoveryOverrides
	// NormalizeYAML, when non-nil, transforms raw configuration bytes before
	// strict decode (e.g. legacy feature syntax normalization).
	NormalizeYAML func([]byte) ([]byte, error)
	// InjectFeatures is the standard-distribution feature injection seam.
	InjectFeatures func(*Config) error
	// ExtraValidate runs after core Validate (routing aliases, prefix checks, …).
	ExtraValidate func(*Config) error
}

type LoadError struct {
	Category LoadCategory
	// contains filtered or unexported fields
}

type LoggingConfig struct {
	// Level is one of: debug, info, warn, error (case-insensitive). Empty defaults to info in LoadFile/Validate.
	Level string `yaml:"level"`
	// Format is json or text (case-insensitive). Empty defaults to json in LoadFile/Validate.
	Format string `yaml:"format"`
	// AddSource adds source file/line to each record when true.
	AddSource bool `yaml:"add_source"`
	// AccessLog emits one structured line per HTTP request when true.
	AccessLog bool `yaml:"access_log"`
	// AccessLogSkipPaths are URL path prefixes (must start with /) for which access logs are suppressed.
	AccessLogSkipPaths []string `yaml:"access_log_skip_paths"`
	// AccessLogIncludeRawPath when true adds the full URL path to access logs (higher cardinality).
	// Default false: only route_group.
	AccessLogIncludeRawPath bool `yaml:"access_log_include_raw_path"`
}

type MeteringConfig struct {
	Enabled bool                  `yaml:"enabled"`
	Journal MeteringJournalConfig `yaml:"journal"`
}

type MeteringJournalConfig struct {
	Store       string `yaml:"store"` // memory | sqlite | postgres; empty with enabled defaults to memory
	SQLitePath  string `yaml:"sqlite_path"`
	PostgresDSN string `yaml:"postgres_dsn"`
}

type MetricsConfig struct {
	// Enabled exposes lip_http_* metrics and process/go collectors when true.
	// When false (zero value), no /metrics handler is registered (legacy behavior).
	Enabled bool `yaml:"enabled"`
	// Path is the HTTP path for Prometheus scraping (e.g. "/metrics"). Empty defaults to /metrics in LoadFile.
	Path string `yaml:"path"`
	// ExemplarsEnabled attaches trace_id exemplars to selected histograms and enables OpenMetrics on /metrics.
	ExemplarsEnabled bool `yaml:"exemplars_enabled"`
}

type ModelAliasConfig struct {
	Pattern     string `yaml:"pattern"`
	Replacement string `yaml:"replacement"`
}

type ModelCatalogBackendModelOverrideEntry struct {
	Backend string `yaml:"backend"`
	Model   string `yaml:"model"`

	Tools             *bool `yaml:"tools,omitempty"`
	StructuredOutputs *bool `yaml:"structured_outputs,omitempty"`
	Reasoning         *bool `yaml:"reasoning,omitempty"`
	Vision            *bool `yaml:"vision,omitempty"`
	Documents         *bool `yaml:"documents,omitempty"`

	ContextLimitTokens *int64 `yaml:"context_limit_tokens,omitempty"`
	InputLimitTokens   *int64 `yaml:"input_limit_tokens,omitempty"`
	OutputLimitTokens  *int64 `yaml:"output_limit_tokens,omitempty"`
}

type ModelCatalogConfig struct {
	// Enabled when true uses the latest valid local catalog snapshot for request-time decisions (when present).
	Enabled bool `yaml:"enabled"`
	// ExternalUpdatesEnabled when true allows periodic background fetches of the catalog source (independent of Enabled).
	ExternalUpdatesEnabled bool `yaml:"external_updates_enabled"`
	// UpdateInterval is a Go duration string (e.g. "1h") for automatic refresh when ExternalUpdatesEnabled is true.
	UpdateInterval string `yaml:"update_interval"`
	// FetchTimeout is an optional Go duration string applied to catalog HTTP GET when the request context has no
	// deadline (0 or empty = rely on transport/client timeouts only).
	FetchTimeout string `yaml:"fetch_timeout"`
	// SourceURL is the HTTPS (or HTTP) URL for the catalog snapshot when ExternalUpdatesEnabled is true.
	SourceURL string `yaml:"source_url"`
	// CachePath is the local filesystem path for the persisted snapshot file used when Enabled or ExternalUpdatesEnabled.
	CachePath string `yaml:"cache_path"`
	// DiagnosticsPath when non-empty registers catalog status JSON under this absolute URL path (must not overlap other diagnostics paths).
	DiagnosticsPath string `yaml:"diagnostics_path"`
	// ModelOverrides are operator facts keyed by route/catalog model name (see spec requirement 5.1).
	ModelOverrides []ModelCatalogModelOverrideEntry `yaml:"model_overrides"`
	// BackendModelOverrides take precedence over ModelOverrides for matching backend/model pairs (requirement 5.2).
	BackendModelOverrides []ModelCatalogBackendModelOverrideEntry `yaml:"backend_model_overrides"`
}

type ModelCatalogModelOverrideEntry struct {
	Model string `yaml:"model"`

	Tools             *bool `yaml:"tools,omitempty"`
	StructuredOutputs *bool `yaml:"structured_outputs,omitempty"`
	Reasoning         *bool `yaml:"reasoning,omitempty"`
	Vision            *bool `yaml:"vision,omitempty"`
	Documents         *bool `yaml:"documents,omitempty"`

	ContextLimitTokens *int64 `yaml:"context_limit_tokens,omitempty"`
	InputLimitTokens   *int64 `yaml:"input_limit_tokens,omitempty"`
	OutputLimitTokens  *int64 `yaml:"output_limit_tokens,omitempty"`
}

type ModelInventoryConfig struct {
	CachePath       string `yaml:"cache_path"`
	RefreshEnabled  *bool  `yaml:"refresh_enabled"`
	RefreshInterval string `yaml:"refresh_interval"`
	FetchTimeout    string `yaml:"fetch_timeout"`
	// DiagnosticsPath registers protected backend model-registry discovery JSON when non-empty
	// (e.g. "/debug/model-registry"). Distinct from model_catalog.diagnostics_path (models.dev).
	DiagnosticsPath string `yaml:"diagnostics_path"`
}

type ObservabilityConfig struct {
	Metrics MetricsConfig `yaml:"metrics"`
	Tracing TracingConfig `yaml:"tracing"`
}

type PluginConfig struct {
	// Kind is the bundled factory id used for registry lookup (e.g. openai-responses).
	// When empty, ID is treated as both factory kind and instance id (legacy single-field configs).
	Kind string `yaml:"kind,omitempty"`
	// ID is the runtime instance id: routing keys, executor backend map keys, and duplicate detection.
	ID      string    `yaml:"id"`
	Enabled bool      `yaml:"enabled"`
	Config  yaml.Node `yaml:"config"`
}

type PluginsConfig struct {
	BackendDiscovery BackendDiscoveryConfig `yaml:"backend_discovery"`
	Frontends        []PluginConfig         `yaml:"frontends"`
	Backends         []PluginConfig         `yaml:"backends"`
	Features         []PluginConfig         `yaml:"features"`
}

type PreRequestKeepaliveConfig struct {
	Enabled  bool   `yaml:"enabled"`
	Interval string `yaml:"interval"`
}

type RoutingAffinityConfig struct {
	Store           string `yaml:"store"`
	MissingIdentity string `yaml:"missing_identity"`
}

type RoutingConfig struct {
	MaxAttempts int `yaml:"max_attempts"`
	// DefaultRoute is the selector used when the client omits X-LIP-Route (e.g. "openai-responses:gpt-4o-mini").
	DefaultRoute string                 `yaml:"default_route"`
	Health       RoutingHealthConfig    `yaml:"health"`
	Affinity     RoutingAffinityConfig  `yaml:"affinity"`
	Transport    RoutingTransportConfig `yaml:"transport"`
	// ExecutionCompositionPolicy controls whether multi-leaf routing compositions (weighted, parallel, thinker, failover)
	// can include whole-agent/orchestration runtimes. Defaults to "safe".
	ExecutionCompositionPolicy ExecutionCompositionPolicy `yaml:"execution_composition_policy"`
	// OverrideAdmin is the opt-in protected HTTP surface for A-leg routing overrides.
	// Disabled by default. Disabling the endpoint does not clear persisted override state.
	OverrideAdmin RoutingOverrideAdminConfig `yaml:"override_admin"`
}

type RoutingHealthConfig struct {
	CircuitBreaker CircuitBreakerConfig `yaml:"circuit_breaker"`
}

type RoutingOverrideAdminConfig struct {
	Enabled      bool   `yaml:"enabled"`
	PathPrefix   string `yaml:"path_prefix"`
	MaxBodyBytes int64  `yaml:"max_body_bytes"`
}

type RoutingTransportConfig struct {
	FallbackPolicy string `yaml:"fallback_policy"`
}

type SecureSessionConfig struct {
	// Enabled turns on secure-session validation and runtime wiring (store, tokens, audit gates).
	// Omitted in YAML defaults to enabled; use a pointer so explicit false can be rejected at validation time.
	Enabled *bool `yaml:"enabled"`
	// Store is "memory" (non-durable), "sqlite" (local durable), or "postgres" (managed durable).
	// Empty is normalized to "memory" in [LoadFile] when Enabled.
	Store string `yaml:"store"`
	// SQLitePath is the database file path when store is "sqlite".
	SQLitePath string `yaml:"sqlite_path"`
	// PostgresDSN is the connection string when store is "postgres".
	PostgresDSN string `yaml:"postgres_dsn"`
	// ResumeWindow is a Go duration string for inactivity-based resume limits; empty means no fixed
	// window (policy default).
	ResumeWindow string `yaml:"resume_window"`
	// TokenFingerprintKey is deployment secret material used to HMAC resume-token fingerprints; required for sqlite store.
	TokenFingerprintKey string `yaml:"token_fingerprint_key"`
	// AuditDurability is "best_effort" or "durable"; durable requires a durable store (sqlite or postgres)
	// and a long token fingerprint key.
	AuditDurability string `yaml:"audit_durability"`
	// RedactionDefault is "standard" or "strict" for operator-visible session payloads (diagnostics);
	// invalid values rejected when enabled.
	RedactionDefault string `yaml:"redaction_default"`
	// DiagnosticsExposeSummaries registers operator session summary routes when true (requires DiagnosticsPathPrefix
	// and a non-empty diagnostics.shared_secret, same minimum length as other protected diagnostics routes).
	DiagnosticsExposeSummaries bool `yaml:"diagnostics_expose_summaries"`
	// DiagnosticsPathPrefix is the URL prefix for secure-session diagnostics (e.g. "/debug/sessions");
	// must start with "/".
	DiagnosticsPathPrefix string `yaml:"diagnostics_path_prefix"`
	// NonDurableWarning is "silent", "log", or "strict" when store is non-durable (memory): strict fails
	// validation when audit requires durability.
	NonDurableWarning string `yaml:"non_durable_warning"`
	// RequireWorkspaceID when true rejects secure-session turns when no workspace id was resolved
	// (maps to [WorkspaceMatchRequired] on BeginTurn; Req 11.1 / 11.6).
	RequireWorkspaceID bool `yaml:"require_workspace_id"`
	// WorkspaceResolveOnError is "fail_open" (default) or "fail_closed". When fail_closed, workspace
	// resolver errors reject the request instead of continuing with an empty workspace (Req 11.6).
	WorkspaceResolveOnError string `yaml:"workspace_resolve_on_error"`
	// ResumeTokenBindPrincipalOnly when true fingerprints resume tokens using only the authenticated
	// principal id (not agent digest or first-message digest), so benign client metadata drift
	// between turns does not invalidate bearer resumes.
	ResumeTokenBindPrincipalOnly bool `yaml:"resume_token_bind_principal_only"`
	// SQLQueryCacheTTL is a Go duration string enabling process-local TTL caching of session existence
	// and transcript_enabled reads in durable SQL secure-session stores. Empty disables caching.
	SQLQueryCacheTTL string `yaml:"sql_query_cache_ttl"`
	// SQLQueryCacheMaxEntries caps entries per logical cache when SQLQueryCacheTTL is set; zero uses a store default.
	SQLQueryCacheMaxEntries int `yaml:"sql_query_cache_max_entries"`
}

type SelfDefenseAdaptiveConfig struct {
	AuthFailures      *int     `yaml:"auth_failures"`
	Window            string   `yaml:"window"`
	InitialQuarantine string   `yaml:"initial_quarantine"`
	MaxQuarantine     string   `yaml:"max_quarantine"`
	StateTTL          string   `yaml:"state_ttl"`
	MaxEntries        *int     `yaml:"max_entries"`
	ExemptCIDRs       []string `yaml:"exempt_cidrs"`
}

type SelfDefenseConfig struct {
	Enabled         *bool                     `yaml:"enabled"`
	ImpossiblePaths *bool                     `yaml:"impossible_paths"`
	Adaptive        SelfDefenseAdaptiveConfig `yaml:"adaptive"`
}

type ServerConfig struct {
	Address  string   `yaml:"address"`
	AuthMode AuthMode `yaml:"auth_mode"`
	// MaxRequestBodyBytes caps HTTP request bodies for bundled frontends. Zero selects
	// each handler's default limit (see internal/plugins/frontends/reqbody).
	MaxRequestBodyBytes int64 `yaml:"max_request_body_bytes"`
	// ReadHeaderTimeout is a Go duration string (e.g. "10s") for [http.Server.ReadHeaderTimeout].
	// Empty defaults to 10s (historical stdhttp behavior).
	ReadHeaderTimeout string `yaml:"read_header_timeout"`
	// ReadTimeout is [http.Server.ReadTimeout] (full request body read + per-connection read deadlines).
	// Empty defaults to 30s.
	ReadTimeout string `yaml:"read_timeout"`
	// WriteTimeout is [http.Server.WriteTimeout]. Empty defaults to 120s.
	WriteTimeout string `yaml:"write_timeout"`
	// IdleTimeout is [http.Server.IdleTimeout]. Empty defaults to 120s.
	IdleTimeout string `yaml:"idle_timeout"`
	// ShutdownTimeout bounds HTTP drain and host close on process shutdown.
	// Empty defaults to 15s.
	ShutdownTimeout string `yaml:"shutdown_timeout"`
	// MaxConcurrentDecodes caps concurrent frontend protocol decode/materialization work.
	// Zero selects the documented default (32) during validation. Body ReadAll and JSON
	// preflight run before admission.
	MaxConcurrentDecodes int `yaml:"max_concurrent_decodes"`
	// MaxInflightDecodeBytes caps weighted in-flight decode bytes across concurrent decodes
	// while decode is active. Zero selects the documented default (64 MiB) during validation.
	MaxInflightDecodeBytes int64 `yaml:"max_inflight_decode_bytes"`
	// MaxPendingWireEvents caps backend adapter-internal pending-event queues per stream (0 = unlimited).
	MaxPendingWireEvents int `yaml:"max_pending_wire_events"`
	// LargePayloadFastPath controls the optional large-payload streaming fast
	// path (design section 3). Default off; see LargePayloadFastPathConfig for
	// plaintext-spool and optimization-budget semantics.
	LargePayloadFastPath LargePayloadFastPathConfig `yaml:"large_payload_fast_path"`
	// PreRequestKeepalive optionally emits SSE comment keepalives while streaming frontends wait for
	// pre-request admission handlers to finish inside executor setup.
	PreRequestKeepalive PreRequestKeepaliveConfig `yaml:"pre_request_keepalive"`
}

type StreamRecoveryConfig struct {
	AutoResume AutoResumeConfig `yaml:"auto_resume"`
}

type StreamRecoveryOverrides struct {
	EnvEnabled          *bool
	CLIEnabled          *bool
	EnvIdleTimeout      time.Duration
	CLIIdleTimeout      time.Duration
	EnvGracePeriod      time.Duration
	CLIGracePeriod      time.Duration
	EnvPostOutputPolicy StreamRecoveryPostOutputPolicy
	CLIPostOutputPolicy StreamRecoveryPostOutputPolicy
	EnvEmitWarning      *bool
	CLIEmitWarning      *bool
}

type StreamRecoveryPostOutputPolicy string

type TracingConfig struct {
	// Enabled turns on SDK wiring, W3C propagation, and outbound HTTP tracing on the shared upstream client.
	Enabled bool `yaml:"enabled"`
	// ServiceName sets otel resource service.name when non-empty; otherwise OTEL_SERVICE_NAME or "lipstd".
	ServiceName string `yaml:"service_name"`
	// SampleRatio when set and strictly between 0 and 1 applies ParentBased(TraceIDRatioBased) for root spans.
	// When nil or 1, the SDK default sampler applies (typically full sampling for new roots).
	SampleRatio *float64 `yaml:"sample_ratio"`
}

type WireModelForBackend func(factoryID string) string