system

type Config struct {
	SensitiveData SensitiveDataConfig `yaml:"sensitive_data"`
	Redaction     RedactionConfig     `yaml:"redaction"`
	Security      SecurityConfig      `yaml:"security"`
	Capabilities  []struct {
		Kind    string `yaml:"kind"`
		Pattern string `yaml:"pattern"`
	} `yaml:"capabilities"`
	WasmMemoryLimitMB    int `yaml:"wasm_memory_limit_mb"`
	MaxEvidenceSizeBytes int `yaml:"max_evidence_size_bytes"`
}

type ConfigLoader struct{}

type HashModeConfig struct {
	Salt    string `yaml:"salt"`
	Enabled bool   `yaml:"enabled"`
}

type RedactionConfig struct {
	HashMode HashModeConfig `yaml:"hash_mode"`
	Patterns []string       `yaml:"patterns"`
	Paths    []string       `yaml:"paths"`
}

type SecretsConfig struct {
	// Local defines static secrets for development (name -> value)
	Local map[string]string `yaml:"local"`

	// Env defines environment variable mappings (secret_name -> env_var_name)
	Env map[string]string `yaml:"env"`

	// Files defines file path mappings (secret_name -> file_path)
	Files map[string]string `yaml:"files"`
}

type SecurityConfig struct {
	// Level defines the security policy: "strict", "standard", or "permissive"
	// - strict: Deny all broad capabilities
	// - standard: Warn about broad capabilities (default)
	// - permissive: Allow all capabilities without warnings
	Level string `yaml:"level"`

	// CustomBroadPatterns allows users to define additional patterns considered "broad"
	// Format: "kind:pattern" (e.g., "fs:write:/tmp/**")
	CustomBroadPatterns []string `yaml:"custom_broad_patterns"`
}

type SecurityLevel string

type SensitiveDataConfig struct {
	Secrets SecretsConfig `yaml:"secrets"`
}