config

type AgentConfig struct {
	ID           string   `json:"id,omitempty" yaml:"id,omitempty"`
	Name         string   `json:"name,omitempty" yaml:"name,omitempty"`
	Description  string   `json:"description,omitempty" yaml:"description,omitempty"`
	Provider     string   `json:"provider" yaml:"provider"`
	Model        string   `json:"model" yaml:"model"`
	APIKey       string   `json:"api_key" yaml:"api_key"` //nolint:gosec // G117: APIKey loaded from config file
	BaseURL      string   `json:"base_url" yaml:"base_url"`
	Temperature  float64  `json:"temperature" yaml:"temperature"`
	MaxTokens    int      `json:"max_tokens" yaml:"max_tokens"`
	SystemPrompt string   `json:"system_prompt" yaml:"system_prompt"`
	Timezone     string   `json:"timezone,omitempty" yaml:"timezone,omitempty"` // IANA timezone for temporal context (empty = UTC)
	AllowedTools []string `json:"allowed_tools,omitempty" yaml:"allowed_tools,omitempty"`
	DeniedTools  []string `json:"denied_tools,omitempty" yaml:"denied_tools,omitempty"`
	Enabled      *bool    `json:"enabled,omitempty" yaml:"enabled,omitempty"`
}

type AuthConfig struct {
	// Enabled requires login for the web UI even in personal (single-user)
	// mode, reusing the cookie-session machinery minus the allowlist and
	// multi-user bootstrap. Defaults to false: personal/localhost use stays
	// no-auth. team.enabled=true implies this is true regardless of the
	// configured value — see Config.Capabilities.
	Enabled bool `json:"enabled" yaml:"enabled"`

	// OwnerEmail is the sole account permitted to log in in personal
	// single-account mode (auth.enabled=true, team.enabled=false); it
	// becomes the superadmin on first login (TRD §4 "the sole account is
	// the configured owner"). Ignored when team.enabled=true — team mode's
	// superadmin_email governs instead.
	OwnerEmail string `json:"owner_email,omitempty" yaml:"owner_email,omitempty"`

	// BaseURL is the externally visible origin used to build the magic
	// link and select the session cookie's Secure attribute. Ignored when
	// team.enabled=true — team.base_url governs instead.
	BaseURL string `json:"base_url,omitempty" yaml:"base_url,omitempty"`

	// SMTP delivers the magic-link email. Ignored when team.enabled=true.
	// When unset, links are logged instead of emailed (dev only).
	SMTP TeamSMTPConfig `json:"smtp,omitempty" yaml:"smtp,omitempty"`
}

type BrowserToolConfig struct {
	Enabled  bool   `json:"enabled" yaml:"enabled"`
	Headless bool   `json:"headless" yaml:"headless"`
	UserData string `json:"user_data" yaml:"user_data"`
}

type Capabilities struct {
	// MultiUser is true in team mode: more than one account, RLS isolation,
	// group chats, and admin all become meaningful.
	MultiUser bool `json:"multiUser"`
	// AuthRequired is true when the web UI must show a login screen: either
	// team mode (which implies auth) or personal mode with auth.enabled set.
	AuthRequired bool `json:"authRequired"`
	// GroupChats, Admin, and Catalog are team-only surfaces: a single
	// implicit user has no one to group-chat with, administer, or browse an
	// agent catalog for.
	GroupChats bool `json:"groupChats"`
	Admin      bool `json:"admin"`
	Catalog    bool `json:"catalog"`
	// GoogleSSO and GitHubSSO tell the login screen which SSO buttons to
	// render — true only in team mode when the corresponding provider has
	// both a client ID and secret configured.
	GoogleSSO bool `json:"googleSso"`
	GitHubSSO bool `json:"githubSso"`
	// Translate is true when a deployment-wide LLM (cfg.Agent.APIKey) is
	// configured, so the composer's translate button has something to call
	// (POST /api/translate) — false hides it rather than showing a dead
	// button.
	Translate bool `json:"translate"`
}

type ChannelsConfig struct {
	Telegram  TelegramConfig  `json:"telegram" yaml:"telegram"`
	Discord   DiscordConfig   `json:"discord" yaml:"discord"`
	WhatsApp  WhatsAppConfig  `json:"whatsapp" yaml:"whatsapp"`
	TwilioSMS TwilioSMSConfig `json:"twilio_sms" yaml:"twilio_sms"`
}

type Config struct {
	Gateway       GatewayConfig       `json:"gateway" yaml:"gateway"`
	Agent         AgentConfig         `json:"agent" yaml:"agent"`
	Agents        []AgentConfig       `json:"agents,omitempty" yaml:"agents,omitempty"` // Multi-agent configs
	Sessions      SessionsConfig      `json:"sessions" yaml:"sessions"`
	Auth          AuthConfig          `json:"auth" yaml:"auth"`
	Web           WebConfig           `json:"web" yaml:"web"`
	Team          TeamConfig          `json:"team" yaml:"team"`
	Channels      ChannelsConfig      `json:"channels" yaml:"channels"`
	Tools         ToolsConfig         `json:"tools" yaml:"tools"`
	Skills        SkillsConfig        `json:"skills" yaml:"skills"`
	Memory        MemoryConfig        `json:"memory" yaml:"memory"`
	Voice         VoiceConfig         `json:"voice" yaml:"voice"`
	Image         ImageConfig         `json:"image" yaml:"image"`
	Observability ObservabilityConfig `json:"observability" yaml:"observability"`
	Tokens        TokenConfig         `json:"tokens" yaml:"tokens"`
	// Secrets holds global secret bindings available to all skills —
	// env-var name -> plain value or vault URI (op://, bw://, file://,
	// env://) — resolved in place by ResolveCredentials. Per-skill
	// overrides live in Skills.Config[name].Secrets and take precedence
	// (RMI-OMNIAGENT-201/202).
	Secrets map[string]string `json:"secrets,omitempty" yaml:"secrets,omitempty"`
}

type DiscordConfig struct {
	Enabled bool   `json:"enabled" yaml:"enabled"`
	Token   string `json:"token" yaml:"token"`
	GuildID string `json:"guild_id" yaml:"guild_id"`
}

type Duration time.Duration

type EmbedderConfig struct {
	Provider string `json:"provider" yaml:"provider"` // openai, bedrock, etc.
	Model    string `json:"model" yaml:"model"`       // text-embedding-3-small, etc.
	APIKey   string `json:"api_key" yaml:"api_key"`   //nolint:gosec // G117: APIKey loaded from config file
}

type GatewayConfig struct {
	Address      string        `json:"address" yaml:"address"`
	ReadTimeout  time.Duration `json:"read_timeout" yaml:"read_timeout"`
	WriteTimeout time.Duration `json:"write_timeout" yaml:"write_timeout"`
	PingInterval time.Duration `json:"ping_interval" yaml:"ping_interval"`
}

type ImageConfig struct {
	Enabled  bool   `json:"enabled" yaml:"enabled"`
	Provider string `json:"provider" yaml:"provider"` // openai, fal
	Model    string `json:"model" yaml:"model"`       // Default model (e.g., gpt-image-2, fal-ai/flux-pro)
	APIKey   string `json:"api_key" yaml:"api_key"`   //nolint:gosec // G117: APIKey loaded from config file
	BaseURL  string `json:"base_url" yaml:"base_url"` // Optional custom base URL
}

type MemoryConfig struct {
	Enabled   bool           `json:"enabled" yaml:"enabled"`
	Provider  string         `json:"provider" yaml:"provider"`     // memory, postgres, kvs, mem0, twilio
	DSN       string         `json:"dsn" yaml:"dsn"`               // Database connection string (postgres)
	APIKey    string         `json:"api_key" yaml:"api_key"`       // API key (mem0, twilio) //nolint:gosec // G117: APIKey loaded from config file
	Endpoint  string         `json:"endpoint" yaml:"endpoint"`     // API endpoint (mem0, twilio)
	TenantID  string         `json:"tenant_id" yaml:"tenant_id"`   // Default tenant for this agent
	AgentID   string         `json:"agent_id" yaml:"agent_id"`     // Agent identifier
	Options   map[string]any `json:"options" yaml:"options"`       // Provider-specific options
	Embedder  EmbedderConfig `json:"embedder" yaml:"embedder"`     // Optional embedder configuration
	RecallMax int            `json:"recall_max" yaml:"recall_max"` // Max memories to recall per request
}

type ObservabilityConfig struct {
	Enabled  bool   `json:"enabled" yaml:"enabled"`
	Provider string `json:"provider" yaml:"provider"`
	Endpoint string `json:"endpoint" yaml:"endpoint"`
	APIKey   string `json:"api_key" yaml:"api_key"` //nolint:gosec // G117: APIKey loaded from config file
}

type RolloverConfig struct {
	// Enabled turns automatic rollover on. At least one of IdleTimeout or
	// Daily must be set when enabled.
	Enabled bool `json:"enabled" yaml:"enabled"`

	// IdleTimeout rolls a session over when it has been inactive longer
	// than this duration (e.g. "4h"). Zero disables idle rollover.
	IdleTimeout Duration `json:"idle_timeout" yaml:"idle_timeout"`

	// Daily rolls a session over when a calendar-day boundary is crossed.
	Daily bool `json:"daily" yaml:"daily"`

	// Timezone resolves the day boundary (IANA name). Empty falls back to
	// the agent's timezone, then UTC.
	Timezone string `json:"timezone" yaml:"timezone"`
}

type STTConfig struct {
	Provider string `json:"provider" yaml:"provider"`
	APIKey   string `json:"api_key" yaml:"api_key"` //nolint:gosec // G117: APIKey loaded from config file
	Model    string `json:"model" yaml:"model"`
	Language string `json:"language" yaml:"language"`
}

type ServiceTokenConfig struct {
	// CredentialsName is the name of the credentials in the vault.
	// If empty, defaults to the service name.
	CredentialsName string `json:"credentials_name" yaml:"credentials_name"`

	// Scopes are the OAuth scopes to request (for Google, etc.).
	Scopes []string `json:"scopes" yaml:"scopes"`
}

type SessionsConfig struct {
	// Rollover configures automatic session rollover.
	Rollover RolloverConfig `json:"rollover" yaml:"rollover"`
}

type ShellToolConfig struct {
	Enabled    bool     `json:"enabled" yaml:"enabled"`
	WorkingDir string   `json:"working_dir" yaml:"working_dir"`
	Allowlist  []string `json:"allowlist" yaml:"allowlist"`
}

type SkillConfig struct {
	// Secrets binds this skill's declared secret env-var names to plain
	// values or vault URIs, resolved in place by ResolveCredentials.
	// Takes precedence over the same key in the root Config.Secrets.
	Secrets map[string]string `json:"secrets,omitempty" yaml:"secrets,omitempty"`
}

type SkillsConfig struct {
	Enabled     bool     `json:"enabled" yaml:"enabled"`
	Packs       []string `json:"packs" yaml:"packs"`       // Skill pack names (e.g., "omniagent-skills")
	Paths       []string `json:"paths" yaml:"paths"`       // Directories to search (alias: dirs)
	Includes    []string `json:"includes" yaml:"includes"` // Only load these skills
	Excludes    []string `json:"excludes" yaml:"excludes"` // Skip these skills
	Disabled    []string `json:"disabled" yaml:"disabled"` // Deprecated: use excludes
	MaxInjected int      `json:"max_injected" yaml:"max_injected"`
	// Config holds per-skill settings keyed by skill name, mirroring
	// Tokens.Services' map-by-name shape (RMI-OMNIAGENT-202).
	Config map[string]SkillConfig `json:"config,omitempty" yaml:"config,omitempty"`
}

type TTSConfig struct {
	Provider string `json:"provider" yaml:"provider"`
	APIKey   string `json:"api_key" yaml:"api_key"` //nolint:gosec // G117: APIKey loaded from config file
	Model    string `json:"model" yaml:"model"`
	VoiceID  string `json:"voice_id" yaml:"voice_id"`
}

type TeamConfig struct {
	// Enabled turns team mode on.
	Enabled bool `json:"enabled" yaml:"enabled"`

	// Database is the PostgreSQL connection configuration.
	Database TeamDatabaseConfig `json:"database" yaml:"database"`

	// BaseURL is the externally visible origin (e.g. https://team.example.com),
	// used to build magic links and cookies.
	BaseURL string `json:"base_url" yaml:"base_url"`

	// SuperadminEmail bootstraps the superadmin on first login.
	SuperadminEmail string `json:"superadmin_email" yaml:"superadmin_email"`

	// SuperadminPassword, when set, seeds the superadmin's email+password
	// credential on startup (set-once: applied only if that account has no
	// password yet, so it never clobbers a later change). Lets an operator log
	// in without SMTP. Prefer supplying it via OMNIAGENT_TEAM_SUPERADMIN_PASSWORD
	// or a vault reference rather than a literal in a committed config file.
	SuperadminPassword string `json:"superadmin_password,omitempty" yaml:"superadmin_password,omitempty"` //nolint:gosec // G117: loaded from config/env, not a hardcoded credential

	// AgentHandle is the @-mention handle of the agent in group chats
	// (default "omniagent").
	AgentHandle string `json:"agent_handle,omitempty" yaml:"agent_handle,omitempty"`

	// SMTP configures magic-link email delivery.
	SMTP TeamSMTPConfig `json:"smtp" yaml:"smtp"`

	// Secrets configures the per-agent secret vault. When set, an @-mentioned
	// agent's runtime instance is built with its own agent-scoped secrets
	// injected into secrets-aware skills (per-agent MCP subprocess env). When
	// unset, agents run without injected secrets.
	Secrets TeamSecretsConfig `json:"secrets,omitempty" yaml:"secrets,omitempty"`

	// SSO configures optional OAuth/OIDC sign-in providers, additive to
	// magic-link email. Each provider is independent; a provider is
	// "configured" when both its client ID and secret are set. Redirect URIs
	// are not configurable — derived as
	// {base_url}/api/auth/{provider}/callback.
	SSO TeamSSOConfig `json:"sso,omitempty" yaml:"sso,omitempty"`
}

type TeamDatabaseConfig struct {
	// AppDSN is the non-owner application role connection string.
	AppDSN string `json:"app_dsn" yaml:"app_dsn"`

	// MigrateDSN is the owner role used only for migrations-on-start.
	MigrateDSN string `json:"migrate_dsn" yaml:"migrate_dsn"`

	// AppRole is the application role name granted access by migrations
	// (default "omniagent_app").
	AppRole string `json:"app_role,omitempty" yaml:"app_role,omitempty"`
}

type TeamOAuthProviderConfig struct {
	ClientID     string `json:"client_id,omitempty" yaml:"client_id,omitempty"`
	ClientSecret string `json:"client_secret,omitempty" yaml:"client_secret,omitempty"` //nolint:gosec // G117: loaded from config file
}

type TeamSMTPConfig struct {
	Host     string `json:"host" yaml:"host"`
	Port     int    `json:"port" yaml:"port"`
	Username string `json:"username,omitempty" yaml:"username,omitempty"`
	Password string `json:"password,omitempty" yaml:"password,omitempty"` //nolint:gosec // G117: loaded from config file
	From     string `json:"from" yaml:"from"`
}

type TeamSSOConfig struct {
	Google TeamOAuthProviderConfig `json:"google,omitempty" yaml:"google,omitempty"`
	GitHub TeamOAuthProviderConfig `json:"github,omitempty" yaml:"github,omitempty"`
}

type TeamSecretsConfig struct {
	// Provider selects the OmniVault backing provider: "memory" or "file".
	// Empty disables secret injection.
	Provider string `json:"provider,omitempty" yaml:"provider,omitempty"`

	// Dir is the storage directory for the "file" provider (required for it).
	Dir string `json:"dir,omitempty" yaml:"dir,omitempty"`
}

type TelegramConfig struct {
	Enabled bool   `json:"enabled" yaml:"enabled"`
	Token   string `json:"token" yaml:"token"`
}

type TokenConfig struct {
	// VaultURI is the vault URI for storing credentials and tokens.
	// Examples: "op://MyVault", "bw://org-id"
	VaultURI string `json:"vault_uri" yaml:"vault_uri"`

	// Services maps service names to their credential configuration.
	// The credential name in the vault defaults to the service name.
	Services map[string]ServiceTokenConfig `json:"services" yaml:"services"`
}

type TokenManager struct {
	// contains filtered or unexported fields
}

type ToolsConfig struct {
	Browser BrowserToolConfig `json:"browser" yaml:"browser"`
	Shell   ShellToolConfig   `json:"shell" yaml:"shell"`
}

type TwilioSMSConfig struct {
	Enabled             bool   `json:"enabled" yaml:"enabled"`
	AccountSID          string `json:"account_sid" yaml:"account_sid"`
	AuthToken           string `json:"auth_token" yaml:"auth_token"` //nolint:gosec // G101: Auth token loaded from config file
	PhoneNumber         string `json:"phone_number" yaml:"phone_number"`
	MessagingServiceSid string `json:"messaging_service_sid" yaml:"messaging_service_sid"` // For RCS
	WebhookPath         string `json:"webhook_path" yaml:"webhook_path"`                   // Default: /webhook/twilio/sms
}

type VoiceConfig struct {
	Enabled      bool      `json:"enabled" yaml:"enabled"`
	ResponseMode string    `json:"response_mode" yaml:"response_mode"`
	STT          STTConfig `json:"stt" yaml:"stt"`
	TTS          TTSConfig `json:"tts" yaml:"tts"`
}

type WebConfig struct {
	// Enabled serves the embedded SPA and GET /api/capabilities at the
	// gateway's HTTP address. Defaults to false in personal mode.
	Enabled bool `json:"enabled" yaml:"enabled"`
}

type WhatsAppConfig struct {
	Enabled bool   `json:"enabled" yaml:"enabled"`
	DBPath  string `json:"db_path" yaml:"db_path"`
}