config

type AdminUser struct {
	Username    string               `json:"username" yaml:"username"`
	Email       string               `json:"email" yaml:"email"`
	Key         *Key                 `json:"key" yaml:"key"`
	Permissions []aschema.Permission `json:"permissions,omitempty" yaml:"permissions,omitempty"`
}

type AdminUsers struct {
	InnerVal AdminUsersType `json:"-" yaml:"-"`
}

type AdminUsersExternalSource struct {
	KeysPath         string               `json:"keys_path" yaml:"keys_path"`
	Permissions      []aschema.Permission `json:"permissions,omitempty" yaml:"permissions,omitempty"`
	SyncCronSchedule string               `json:"sync_cron_schedule,omitempty" yaml:"sync_cron_schedule,omitempty"`
}

type AdminUsersList []*AdminUser

type AdminUsersType interface {
	All() []*AdminUser
	GetByUsername(username string) (*AdminUser, bool)
	GetByJwtSubject(subject string) (*AdminUser, bool)
}

type ApiKeyPlacement = connectors.ApiKeyPlacement

type AppMetrics struct {
	// AutoMigrate controls if the migration to build the indexes for app metrics happens automatically on startup.
	// If this value is not specified in the config, it defaults to true.
	AutoMigrate *bool `json:"auto_migrate,omitempty" yaml:"auto_migrate,omitempty"`

	// Database is the database provider for app metrics. This can be the same database as the main database but would
	// typically be a data warehouse in production.
	Database *Database `json:"database" yaml:"database"`

	// BlobStorage configures the blob storage backend used for storing full request/response logs.
	// If not configured, full request-event logging will use an in-memory store (not suitable for production).
	BlobStorage *BlobStorage `json:"blob_storage,omitempty" yaml:"blob_storage,omitempty"`

	// ResourceSnapshotInterval is how often resource snapshot jobs should write metrics samples.
	// If unset, defaults to 15 minutes.
	ResourceSnapshotInterval *HumanDuration `json:"resource_snapshot_interval,omitempty" yaml:"resource_snapshot_interval,omitempty"`

	// RequestEvents configures request-event capture into the app metrics store.
	RequestEvents *AppMetricsRequestEvents `json:"request_events,omitempty" yaml:"request_events,omitempty"`
}

type AppMetricsRequestEvents struct {
	// Retention is how long the high-level logs should be retained. If unset, defaults to 30 days.
	Retention *HumanDuration `json:"retention" yaml:"retention"`

	// MaxRequestSize is the max size of request that will be stored. Values over this will be truncated.
	MaxRequestSize *HumanByteSize `json:"max_request_size,omitempty" yaml:"max_request_size,omitempty"`

	// MaxResponseSize is the max size of the response that will be stored. Values over this will be truncated.
	MaxResponseSize *HumanByteSize `json:"max_response_size,omitempty" yaml:"max_response_size,omitempty"`

	// MaxResponseWait is the maximum amount of time to wait for a response before logging it. Defaults to 60 seconds.
	MaxResponseWait *HumanDuration `json:"max_response_wait" yaml:"max_response_wait"`

	// FullRequestRecording flags if the full body/headers be logged for requests. Defaults to never, or can be enabled
	// with API calls to specific resources, or always on.
	FullRequestRecording *FullRequestRecording `json:"full_request_recording,omitempty" yaml:"full_request_recording,omitempty"`

	// FullRequestRetention is how long the full request events should be retained. If unset, defaults to 30 days.
	FullRequestRetention *HumanDuration `json:"full_request_retention,omitempty" yaml:"full_request_retention,omitempty"`

	// FlushInterval is how often buffered records are flushed the database. Defaults to 5s.
	FlushInterval *HumanDuration `json:"flush_interval,omitempty" yaml:"flush_interval,omitempty"`

	// FlushBatchSize is the number of records that triggers a flush. Defaults to 1000.
	FlushBatchSize *int `json:"flush_batch_size,omitempty" yaml:"flush_batch_size,omitempty"`
}

type Auth = connectors.Auth

type AuthApiKey = connectors.AuthApiKey

type AuthNoAuth = connectors.AuthNoAuth

type AuthOAuth2 = connectors.AuthOAuth2

type AuthOauth2Authorization = connectors.AuthOauth2Authorization

type AuthOauth2PKCE = connectors.AuthOauth2PKCE

type AuthOauth2Token = connectors.AuthOauth2Token

type AuthType = connectors.AuthType

type AwsCredentials = common.AwsCredentials

type AwsCredentialsAccessKey = common.AwsCredentialsAccessKey

type AwsCredentialsImpl = common.AwsCredentialsImpl

type AwsCredentialsImplicit = common.AwsCredentialsImplicit

type AwsCredentialsType = common.AwsCredentialsType

type BlobStorage struct {
	InnerVal BlobStorageImpl `json:"-" yaml:"-"`
}

type BlobStorageFilesystem struct {
	Provider BlobStorageProvider `json:"provider" yaml:"provider"`
	Path     string              `json:"path" yaml:"path"`
}

type BlobStorageImpl interface {
	GetProvider() BlobStorageProvider
}

type BlobStorageMemory struct {
	Provider BlobStorageProvider `json:"provider" yaml:"provider"`
}

type BlobStorageProvider string

type BlobStorageS3 struct {
	Provider       BlobStorageProvider `json:"provider" yaml:"provider"`
	Endpoint       string              `json:"endpoint,omitempty" yaml:"endpoint,omitempty"`
	Region         string              `json:"region,omitempty" yaml:"region,omitempty"`
	Bucket         string              `json:"bucket" yaml:"bucket"`
	Credentials    *AwsCredentials     `json:"credentials,omitempty" yaml:"credentials,omitempty"`
	ForcePathStyle bool                `json:"force_path_style,omitempty" yaml:"force_path_style,omitempty"`
	Prefix         string              `json:"prefix,omitempty" yaml:"prefix,omitempty"`
}

type ConfiguredActor struct {
	ExternalId  string               `json:"external_id" yaml:"external_id"`
	Key         *Key                 `json:"key" yaml:"key"`
	Permissions []aschema.Permission `json:"permissions,omitempty" yaml:"permissions,omitempty"`
	Labels      map[string]string    `json:"labels,omitempty" yaml:"labels,omitempty"`
}

type ConfiguredActors struct {
	InnerVal ConfiguredActorsType `json:"-" yaml:"-"`
}

type ConfiguredActorsExternalSource struct {
	KeysPath         string               `json:"keys_path" yaml:"keys_path"`
	Permissions      []aschema.Permission `json:"permissions,omitempty" yaml:"permissions,omitempty"`
	SyncCronSchedule string               `json:"sync_cron_schedule,omitempty" yaml:"sync_cron_schedule,omitempty"`
}

type ConfiguredActorsList []*ConfiguredActor

type ConfiguredActorsType interface {
	All() []*ConfiguredActor
	GetByExternalId(externalId string) (*ConfiguredActor, bool)
	GetBySubject(subject string) (*ConfiguredActor, bool)
}

type Connections struct {
	// SetupTtl is the maximum time a connection can remain in an incomplete setup state
	// before it is automatically cleaned up. Defaults to 24 hours.
	SetupTtl *HumanDuration `json:"setup_ttl,omitempty" yaml:"setup_ttl,omitempty"`
}

type Connector = connectors.Connector

type Connectors = connectors.Connectors

type CookieConfig struct {
	DomainVal   *string `json:"domain,omitempty" yaml:"domain,omitempty"`
	SameSiteVal *string `json:"same_site,omitempty" yaml:"same_site,omitempty"`
}

type CorsConfig struct {
	AllowedOrigins   []string       `json:"allowed_origins,omitempty" yaml:"allowed_origins,omitempty"`
	AllowedMethods   []string       `json:"allowed_methods,omitempty" yaml:"allowed_methods,omitempty"`
	AllowedHeaders   []string       `json:"allowed_headers,omitempty" yaml:"allowed_headers,omitempty"`
	ExposedHeaders   []string       `json:"exposed_headers,omitempty" yaml:"exposed_headers,omitempty"`
	MaxAge           *HumanDuration `json:"max_age,omitempty" yaml:"max_age,omitempty"`
	AllowCredentials *bool          `json:"allow_credentials,omitempty" yaml:"allow_credentials,omitempty"`
}

type DataEncryptionKeyInfo = keyschema.DataEncryptionKeyInfo

type DataEncryptionKeys struct {
	// RotationInterval is how old the current DEK can be before a new current DEK
	// is generated. Defaults to 90 days.
	RotationInterval *HumanDuration `json:"rotation_interval,omitempty" yaml:"rotation_interval,omitempty"`

	// EnsureCurrent controls whether the DEK generator creates a current DEK
	// when a data-encryption key has none. Defaults to true.
	EnsureCurrent *bool `json:"ensure_current,omitempty" yaml:"ensure_current,omitempty"`
}

type Database struct {
	InnerVal DatabaseImpl `json:"-" yaml:"-"`
}

type DatabaseClickhouse struct {
	Provider                  DatabaseProvider `json:"provider" yaml:"provider"`
	Addresses                 []string         `json:"addresses,omitempty" yaml:"addresses,omitempty"`
	Address                   *StringValue     `json:"address,omitempty" yaml:"address,omitempty"`
	AddressList               *StringValue     `json:"address_list,omitempty" yaml:"address_list,omitempty"`
	Database                  *StringValue     `json:"database" yaml:"database"`
	User                      *StringValue     `json:"user,omitempty" yaml:"user,omitempty"`
	Password                  *StringValue     `json:"password,omitempty" yaml:"password,omitempty"`
	Protocol                  *string          `json:"protocol,omitempty" yaml:"protocol,omitempty"`
	AutoMigrate               bool             `json:"auto_migrate,omitempty" yaml:"auto_migrate,omitempty"`
	AutoMigrationLockDuration *HumanDuration   `json:"auto_migration_lock_duration,omitempty" yaml:"auto_migration_lock_duration,omitempty"`
}

type DatabaseImpl interface {
	GetProvider() DatabaseProvider
	GetAutoMigrate() bool
	GetAutoMigrationLockDuration() time.Duration
	GetSoftDeleteRetention() *time.Duration
	GetUri() string
	GetDsn() string
	GetDriver() string
	GetPlaceholderFormat() sq.PlaceholderFormat
	Validate(vc *common.ValidationContext) error
}

type DatabasePostgres struct {
	Provider                  DatabaseProvider  `json:"provider" yaml:"provider"`
	Host                      *StringValue      `json:"host" yaml:"host"`
	Port                      *IntegerValue     `json:"port,omitempty" yaml:"port,omitempty"`
	User                      *StringValue      `json:"user,omitempty" yaml:"user,omitempty"`
	Password                  *StringValue      `json:"password,omitempty" yaml:"password,omitempty"`
	Database                  *StringValue      `json:"database" yaml:"database"`
	SSLMode                   *StringValue      `json:"sslmode,omitempty" yaml:"sslmode,omitempty"`
	Params                    map[string]string `json:"params,omitempty" yaml:"params,omitempty"`
	MaxOpenConns              *IntegerValue     `json:"max_open_conns,omitempty" yaml:"max_open_conns,omitempty"`
	MaxIdleConns              *IntegerValue     `json:"max_idle_conns,omitempty" yaml:"max_idle_conns,omitempty"`
	ConnMaxLifetime           *HumanDuration    `json:"conn_max_lifetime,omitempty" yaml:"conn_max_lifetime,omitempty"`
	ConnMaxIdleTime           *HumanDuration    `json:"conn_max_idle_time,omitempty" yaml:"conn_max_idle_time,omitempty"`
	AutoMigrate               bool              `json:"auto_migrate,omitempty" yaml:"auto_migrate,omitempty"`
	AutoMigrationLockDuration *HumanDuration    `json:"auto_migration_lock_duration,omitempty" yaml:"auto_migration_lock_duration,omitempty"`
	SoftDeleteRetention       *HumanDuration    `json:"soft_delete_retention,omitempty" yaml:"soft_delete_retention,omitempty"`
}

type DatabaseProvider string

type DatabaseSqlite struct {
	Provider                  DatabaseProvider `json:"provider" yaml:"provider"`
	Path                      string           `json:"path" yaml:"path"`
	AutoMigrate               bool             `json:"auto_migrate,omitempty" yaml:"auto_migrate,omitempty"`
	AutoMigrationLockDuration *HumanDuration   `json:"auto_migration_lock_duration,omitempty" yaml:"auto_migration_lock_duration,omitempty"`
	SoftDeleteRetention       *HumanDuration   `json:"soft_delete_retention,omitempty" yaml:"soft_delete_retention,omitempty"`
}

type DevSettings struct {
	Enabled                  bool `json:"enabled" yaml:"enabled"`
	FakeEncryption           bool `json:"fake_encryption" yaml:"fake_encryption"`
	FakeEncryptionSkipBase64 bool `json:"fake_encryption_skip_base64" yaml:"fake_encryption_skip_base64"`
}

type ErrorPage string

type ErrorPages struct {
	NotFound      string       `json:"not_found,omitempty" yaml:"not_found,omitempty"`
	Unauthorized  string       `json:"unauthorized,omitempty" yaml:"unauthorized,omitempty"`
	InternalError string       `json:"internal_error,omitempty" yaml:"internal_error,omitempty"`
	Template      *StringValue `json:"template,omitempty" yaml:"template,omitempty"`
}

type ErrorTemplateValues struct {
	Error       ErrorPage
	Title       string
	Description string
}

type FullRequestRecording string

type GeneratedDataEncryptionKey = keyschema.GeneratedDataEncryptionKey

type HostApplication struct {
	// InitiateSessionUrl is the URL that will be redirected to in order to establish a session for an actor. This
	// happens if the marketplace portal is accessed without coming from a pre-authorized context. This URL should
	// take a `redirect_url` query parameter where the actor should be redirected to following successful authentication.
	// When redirecting to `redirect_url`, the host application should append an `auth_token` query param with a signed
	// JWT for authenticating the user. This JWT should use a nonce and expiration to protect against session
	// hijacking
	InitiateSessionUrl *StringValue `json:"initiate_session_url" yaml:"initiate_session_url"`
}

type HttpService interface {
	Service
	Port() uint64
	IsHttps() bool
	TlsConfig() (*tls.Config, error)
	Domain() string
	GetBaseUrl() string
	SupportsSession() bool
	GetServerAndHealthChecker(
		server http.Handler,
		healthChecker http.Handler,
	) (httpServer *http.Server, httpHealthChecker *http.Server, err error)
}

type HttpServiceLike interface {
	Domain() string
	GetBaseUrl() string
}

type HttpServiceWithSession interface {
	HttpService
	SessionTimeout() time.Duration
	CookieDomain() string
	CookieSameSite() http.SameSite
	XsrfRequestQueueDepth() int
}

type HumanByteSize = common.HumanByteSize

type HumanDuration = common.HumanDuration

type Image = common.Image

type ImageBase64 = common.ImageBase64

type ImagePublicUrl = common.ImagePublicUrl

type IntegerValue = common.IntegerValue

type IntegerValueDirect = common.IntegerValueDirect

type IntegerValueEnvVar = common.IntegerValueEnvVar

type Key = keyschema.Key

type KeyData = keyschema.KeyData

type KeyDataAwsKMS = keyschema.KeyDataAwsKMS

type KeyDataAwsSecret = keyschema.KeyDataAwsSecret

type KeyDataBase64Val = keyschema.KeyDataBase64Val

type KeyDataEnvBase64Var = keyschema.KeyDataEnvBase64Var

type KeyDataEnvVar = keyschema.KeyDataEnvVar

type KeyDataFile = keyschema.KeyDataFile

type KeyDataGcpKMS = keyschema.KeyDataGcpKMS

type KeyDataGcpSecret = keyschema.KeyDataGcpSecret

type KeyDataGeneratesDataEncryptionKeys = keyschema.KeyDataGeneratesDataEncryptionKeys

type KeyDataMock = keyschema.KeyDataMock

type KeyDataMockKMS = keyschema.KeyDataMockKMS

type KeyDataRandomBytes = keyschema.KeyDataRandomBytes

type KeyDataRawVal = keyschema.KeyDataRawVal

type KeyDataRequiresDataEncryptionKeys = keyschema.KeyDataRequiresDataEncryptionKeys

type KeyDataType = keyschema.KeyDataType

type KeyDataValue = keyschema.KeyDataValue

type KeyDataVault = keyschema.KeyDataVault

type KeyDataVaultTransit = keyschema.KeyDataVaultTransit

type KeyDataWrapsDataEncryptionKeys = keyschema.KeyDataWrapsDataEncryptionKeys

type KeyPublicPrivate = keyschema.KeyPublicPrivate

type KeyShared = keyschema.KeyShared

type KeyType = keyschema.KeyType

type KeyVersionInfo = keyschema.KeyVersionInfo

type KeyVersionProtectedData = keyschema.KeyVersionProtectedData

type KeyWrappingKeyInfo = keyschema.KeyWrappingKeyInfo

type LoggingConfig struct {
	InnerVal LoggingImpl `json:"-" yaml:"-"`
}

type LoggingConfigJson struct {
	Type   LoggingConfigType   `json:"type" yaml:"type"`
	To     LoggingConfigOutput `json:"to,omitempty" yaml:"to,omitempty"`
	Level  LoggingConfigLevel  `json:"level,omitempty" yaml:"level,omitempty"`
	Source bool                `json:"source,omitempty" yaml:"source,omitempty"`
}

type LoggingConfigLevel string

type LoggingConfigNone struct {
	Type LoggingConfigType `json:"type" yaml:"type"`
}

type LoggingConfigOutput string

type LoggingConfigText struct {
	Type   LoggingConfigType   `json:"type" yaml:"type"`
	To     LoggingConfigOutput `json:"to,omitempty" yaml:"to,omitempty"`
	Level  LoggingConfigLevel  `json:"level,omitempty" yaml:"level,omitempty"`
	Source bool                `json:"source,omitempty" yaml:"source,omitempty"`
}

type LoggingConfigTint struct {
	Type       LoggingConfigType   `json:"type" yaml:"type"`
	To         LoggingConfigOutput `json:"to,omitempty" yaml:"to,omitempty"`
	Level      LoggingConfigLevel  `json:"level,omitempty" yaml:"level,omitempty"`
	Source     bool                `json:"source,omitempty" yaml:"source,omitempty"`
	NoColor    *bool               `json:"no_color,omitempty" yaml:"no_color,omitempty"`
	TimeFormat *string             `json:"time_format,omitempty" yaml:"time_format,omitempty"`
}

type LoggingConfigType string

type LoggingImpl interface {
	GetRootLogger() *slog.Logger
	GetType() LoggingConfigType
}

type Marketplace struct {
	BaseUrl *StringValue `json:"base_url,omitempty" yaml:"base_url,omitempty"`
}

type OAuth struct {
	// InitiateToRedirectTtl is the time allowed between the oauth initiate API call, and the time when the browser
	// completes the redirect from the auth proxy public service. This value must be less than RoundTripTtl. This value
	// should be as small as possible as the handoff from the API to the redirect involves a one-time-use auth token
	// in the query parameters, which could be used to steal the session.
	InitiateToRedirectTtl HumanDuration `json:"initiate_to_redirect_ttl" yaml:"initiate_to_redirect_ttl"`

	// RoundTripTtl is the time we allow for the user to go through the oauth flow, from the initiate call, all the
	// way back to returning to AuthProxy to exchange the auth token for an access token. The purpose of this timeout
	// is to reduce the time that a redirect link from auth proxy would be valid for the purposes of phishing other
	// peoples credentials using this link as the basis.
	RoundTripTtl HumanDuration `json:"round_trip_ttl" yaml:"round_trip_ttl"`

	// RefreshTokensInBackground controls if the system should proactively refresh tokens in the background. Default
	// value is `true`. If set to false, tokens will not be refreshed until they are detected to be expired when used.
	RefreshTokensInBackground *bool `json:"refresh_tokens_in_background" yaml:"refresh_tokens_in_background"`

	// RefreshTokensTimeBeforeExpiry is the default time prior to token expiry to refresh the tokens. This value can be
	// overridden on a per-connector basis, but the granularity of this value is limited by the cron for running refresh.
	// If not specified the default value is 10 minutes.
	RefreshTokensTimeBeforeExpiry *HumanDuration `json:"refresh_tokens_time_before_expiry" yaml:"refresh_tokens_time_before_expiry"`

	// RefreshTokensCronSchedule is the schedule at which the background job to refresh oauth tokens will run. If not
	// specified, runs every 10 minutes.
	RefreshTokensCronSchedule string `json:"refresh_tokens_cron_schedule" yaml:"refresh_tokens_cron_schedule"`
}

type OAuth2GrantType = connectors.OAuth2GrantType

type PKCEMethod = connectors.PKCEMethod

type Predicate = common.Predicate

type ProviderType = keyschema.ProviderType

type Redis struct {
	InnerVal RedisImpl `json:"-" yaml:"-"`
}

type RedisImpl interface {
	GetProvider() RedisProvider
}

type RedisMiniredis struct {
	Provider RedisProvider `json:"provider" yaml:"provider"`
}

type RedisProvider string

type RedisReal struct {
	Provider RedisProvider `json:"provider" yaml:"provider"`

	// The network type, either tcp or unix.
	// Default is tcp.
	Network string `json:"network" yaml:"network"`

	// host:port address.
	Address string `json:"address" yaml:"address"`

	// Protocol 2 or 3. Use the version to negotiate RESP version with redis-server.
	// Default is 3.
	Protocol int `json:"protocol" yaml:"protocol"`

	// Use the specified Username to authenticate the current connection
	// with one of the connections defined in the ACL list when connecting
	// to a Redis 6.0 instance, or greater, that is using the Redis ACL system.
	Username *StringValue `json:"username" yaml:"username"`

	// Optional password. Must match the password specified in the
	// requirepass server configuration option (if connecting to a Redis 5.0 instance, or lower),
	// or the User Password when connecting to a Redis 6.0 instance, or greater,
	// that is using the Redis ACL system.
	Password *StringValue `json:"password" yaml:"password"`

	// Database to be selected after connecting to the server.
	DB int `json:"db" yaml:"db"`
}

type Root struct {
	AdminApi        ServiceAdminApi `json:"admin_api" yaml:"admin_api"`
	Api             ServiceApi      `json:"api" yaml:"api"`
	Public          ServicePublic   `json:"public" yaml:"public"`
	Worker          ServiceWorker   `json:"worker" yaml:"worker"`
	Marketplace     *Marketplace    `json:"marketplace,omitempty" yaml:"marketplace,omitempty"`
	HostApplication HostApplication `json:"host_application" yaml:"host_application"`
	SystemAuth      SystemAuth      `json:"system_auth" yaml:"system_auth"`
	Database        *Database       `json:"database" yaml:"database"`
	Logging         *LoggingConfig  `json:"logging,omitempty" yaml:"logging,omitempty"`
	Redis           *Redis          `json:"redis" yaml:"redis"`
	Oauth           OAuth           `json:"oauth" yaml:"oauth"`
	ErrorPages      ErrorPages      `json:"error_pages,omitempty" yaml:"error_pages,omitempty"`
	Connectors      *Connectors     `json:"connectors" yaml:"connectors"`
	AppMetrics      *AppMetrics     `json:"app_metrics,omitempty" yaml:"app_metrics,omitempty"`
	Connections     *Connections    `json:"connections,omitempty" yaml:"connections,omitempty"`
	Tasks           *Tasks          `json:"tasks,omitempty" yaml:"tasks,omitempty"`
	Telemetry       *Telemetry      `json:"telemetry,omitempty" yaml:"telemetry,omitempty"`
	DevSettings     *DevSettings    `json:"dev_settings,omitempty" yaml:"dev_settings,omitempty"`
}

type Scope = connectors.Scope

type ScopeRequired = connectors.ScopeRequired

type Service interface {
	GetId() ServiceId
	HealthCheckPort() uint64
}

type ServiceAdminApi struct {
	ServiceHttp
	Ui                       *ServiceAdminUi                   `json:"ui" yaml:"ui"`
	SessionTimeoutVal        *HumanDuration                    `json:"session_timeout" yaml:"session_timeout"`
	XsrfRequestQueueDepthVal *int                              `json:"xsrf_request_queue_depth" yaml:"xsrf_request_queue_depth"`
	StaticVal                *ServicePublicStaticContentConfig `json:"static,omitempty" yaml:"static,omitempty"`
	CookieVal                *CookieConfig                     `json:"cookie,omitempty" yaml:"cookie,omitempty"`
}

type ServiceAdminUi struct {
	Enabled bool         `json:"enabled" yaml:"enabled"`
	BaseUrl *StringValue `json:"base_url" yaml:"base_url"`

	// InitiateSessionUrl is the URL that will be redirected to in order to establish a session for an actor. This
	// happens if the admin portal is accessed without coming from a pre-authorized context. This URL should
	// take a `redirect_url` query parameter where the actor should be redirected to following successful authentication.
	// When redirecting to `redirect_url`, the host application should append an `auth_token` query param with a signed
	// JWT for authenticating the user. This JWT should use a nonce and expiration to protect against session
	// hijacking
	InitiateSessionUrl *StringValue `json:"initiate_session_url" yaml:"initiate_session_url"`
}

type ServiceApi struct {
	ServiceHttp
}

type ServiceCommon struct {
	HealthCheckPortVal *IntegerValue `json:"health_check_port,omitempty" yaml:"health_check_port,omitempty"`
}

type ServiceHttp struct {
	ServiceCommon `json:",inline" yaml:",inline"`
	PortVal       *IntegerValue `json:"port" yaml:"port"`
	BaseUrl       *StringValue  `json:"base_url,omitempty" yaml:"base_url,omitempty"`
	DomainVal     string        `json:"domain" yaml:"domain"`
	IsHttpsVal    bool          `json:"https" yaml:"https"`
	CorsVal       *CorsConfig   `json:"cors,omitempty" yaml:"cors,omitempty"`
	TlsVal        TlsConfig     `json:"tls,omitempty" yaml:"tls,omitempty"`
}

type ServiceId string

type ServicePublic struct {
	ServiceHttp
	SessionTimeoutVal        *HumanDuration                    `json:"session_timeout" yaml:"session_timeout"`
	XsrfRequestQueueDepthVal *int                              `json:"xsrf_request_queue_depth" yaml:"xsrf_request_queue_depth"`
	EnableMarketplaceApisVal *bool                             `json:"enable_marketplace_apis,omitempty" yaml:"enable_marketplace_apis,omitempty"`
	EnableProxyVal           *bool                             `json:"enable_proxy,omitempty" yaml:"enable_proxy,omitempty"`
	StaticVal                *ServicePublicStaticContentConfig `json:"static,omitempty" yaml:"static,omitempty"`
	CookieVal                *CookieConfig                     `json:"cookie,omitempty" yaml:"cookie,omitempty"`
}

type ServicePublicStaticContentConfig struct {
	MountAtPath   string `json:"mount_at" yaml:"mount_at"`
	ServeFromPath string `json:"serve_from" yaml:"serve_from"`
}

type ServiceWorker struct {
	ServiceCommon             `json:",inline" yaml:",inline"`
	ConcurrencyVal            *StringValue   `json:"concurrency" yaml:"concurrency"`
	CronSyncInterval          *HumanDuration `json:"cron_sync_interval,omitempty" yaml:"cron_sync_interval,omitempty"`
	WorkflowPollers           *StringValue   `json:"workflow_pollers,omitempty" yaml:"workflow_pollers,omitempty"`
	ActivityPollers           *StringValue   `json:"activity_pollers,omitempty" yaml:"activity_pollers,omitempty"`
	MaxParallelWorkflowTasks  *StringValue   `json:"max_parallel_workflow_tasks,omitempty" yaml:"max_parallel_workflow_tasks,omitempty"`
	MaxParallelActivityTasks  *StringValue   `json:"max_parallel_activity_tasks,omitempty" yaml:"max_parallel_activity_tasks,omitempty"`
	WorkflowHeartbeatInterval *HumanDuration `json:"workflow_heartbeat_interval,omitempty" yaml:"workflow_heartbeat_interval,omitempty"`
}

type StringValue = common.StringValue

type StringValueBase64 = common.StringValueBase64

type StringValueDirect = common.StringValueDirect

type StringValueEnvVar = common.StringValueEnvVar

type StringValueEnvVarBase64 = common.StringValueEnvVarBase64

type StringValueFile = common.StringValueFile

type SystemAuth struct {
	JwtSigningKey       *Key                `json:"jwt_signing_key" yaml:"jwt_signing_key"`
	JwtIssuerVal        string              `json:"jwt_issuer" yaml:"jwt_issuer"`
	JwtTokenDurationVal time.Duration       `json:"jwt_token_duration" yaml:"jwt_token_duration"`
	DisableXSRF         bool                `json:"disable_xsrf" yaml:"disable_xsrf"`
	Actors              *ConfiguredActors   `json:"actors" yaml:"actors"`
	GlobalAESKey        *KeyData            `json:"global_aes_key" yaml:"global_aes_key"`
	DataEncryptionKeys  *DataEncryptionKeys `json:"data_encryption_keys,omitempty" yaml:"data_encryption_keys,omitempty"`
}

type Tasks struct {
	// Default retention for tasks unless a value is explicitly set
	DefaultRetention *HumanDuration `json:"default_retention,omitempty" yaml:"default_retention,omitempty"`
}

type Telemetry struct {
	// Enabled controls whether OpenTelemetry is initialised at all. When
	// nil or false, no exporter is started and no resource is initialised
	// beyond SDK defaults; the application receives no-op providers.
	Enabled *bool `json:"enabled,omitempty" yaml:"enabled,omitempty"`

	// Exporter configures the OTLP exporter destination.
	Exporter *TelemetryExporter `json:"exporter,omitempty" yaml:"exporter,omitempty"`

	// Resource configures the OTel resource attributes attached to every
	// emitted telemetry signal.
	Resource *TelemetryResource `json:"resource,omitempty" yaml:"resource,omitempty"`

	// Sampling controls trace sampling behaviour.
	Sampling *TelemetrySampling `json:"sampling,omitempty" yaml:"sampling,omitempty"`

	// Signals controls which OTel signals are emitted.
	Signals *TelemetrySignals `json:"signals,omitempty" yaml:"signals,omitempty"`

	// HTTP configures behaviour of inbound HTTP instrumentation (used by
	// later instrumentation tickets; carried in this config block so the
	// schema is complete).
	HTTP *TelemetryHTTP `json:"http,omitempty" yaml:"http,omitempty"`

	// Proxy configures label projection for proxy telemetry. The two
	// allowlists are applied independently against the request's already-
	// computed effective label set; telemetry does no merging of its own.
	Proxy *TelemetryProxy `json:"proxy,omitempty" yaml:"proxy,omitempty"`

	// Propagation configures W3C trace context injection on outbound calls.
	// Outbound propagation is opt-in.
	Propagation *TelemetryPropagation `json:"propagation,omitempty" yaml:"propagation,omitempty"`
}

type TelemetryExporter struct {
	// Protocol selects the OTLP transport. One of "grpc" or "http/protobuf".
	Protocol *TelemetryExporterProtocol `json:"protocol,omitempty" yaml:"protocol,omitempty"`

	// Endpoint is the OTLP endpoint URL. Honors env-var fallthrough; falls
	// back to OTEL_EXPORTER_OTLP_ENDPOINT when unset.
	Endpoint *StringValue `json:"endpoint,omitempty" yaml:"endpoint,omitempty"`

	// Headers are additional headers sent with every OTLP request (e.g.
	// auth tokens). Each value supports env-var fallthrough.
	Headers map[string]*StringValue `json:"headers,omitempty" yaml:"headers,omitempty"`

	// Insecure disables TLS on the OTLP connection. Defaults to false.
	Insecure *bool `json:"insecure,omitempty" yaml:"insecure,omitempty"`
}

type TelemetryExporterProtocol string

type TelemetryHTTP struct {
	// ExcludedPaths is the list of HTTP request paths to exclude from
	// spans and metrics. Defaults to /ping and /healthz when nil. An empty
	// slice (explicitly configured) disables exclusion entirely.
	ExcludedPaths []string `json:"excluded_paths,omitempty" yaml:"excluded_paths,omitempty"`
}

type TelemetryPropagation struct {
	// InjectOutboundDefault is the global default for injecting W3C
	// traceparent/tracestate on outbound proxy requests. Defaults to false
	// (opt-in). Per-connector settings override this default.
	InjectOutboundDefault *bool `json:"inject_outbound_default,omitempty" yaml:"inject_outbound_default,omitempty"`
}

type TelemetryProxy struct {
	// SpanAttributeLabels are label keys whose values are projected as
	// attributes on the proxy span. Cheap; can tolerate higher cardinality.
	SpanAttributeLabels []string `json:"span_attribute_labels,omitempty" yaml:"span_attribute_labels,omitempty"`

	// MetricDimensionLabels are label keys whose values become metric
	// dimensions on proxy metrics. Strictly bounded to control cardinality.
	MetricDimensionLabels []string `json:"metric_dimension_labels,omitempty" yaml:"metric_dimension_labels,omitempty"`

	// MetricDimensionValueCap, when > 0, caps the number of distinct values
	// per metric dimension key. Values beyond the cap collapse to "other"
	// to bound cardinality. Off by default.
	MetricDimensionValueCap *int `json:"metric_dimension_value_cap,omitempty" yaml:"metric_dimension_value_cap,omitempty"`
}

type TelemetryResource struct {
	// ServiceNamePrefix is prepended (with a hyphen) to the service id to
	// produce the OTel service.name. Defaults to "authproxy" so services
	// appear as "authproxy-api", "authproxy-admin-api", etc.
	ServiceNamePrefix *string `json:"service_name_prefix,omitempty" yaml:"service_name_prefix,omitempty"`

	// Attributes are user-supplied resource attributes merged into the
	// resource. OTEL_RESOURCE_ATTRIBUTES env var entries are merged in
	// addition to these (SDK behaviour).
	Attributes map[string]string `json:"attributes,omitempty" yaml:"attributes,omitempty"`
}

type TelemetrySampling struct {
	// Ratio is the parent-based head-sampling ratio in [0, 1]. Sampling
	// decisions made by upstream callers are honored; this ratio applies
	// when there is no parent context.
	Ratio *float64 `json:"ratio,omitempty" yaml:"ratio,omitempty"`
}

type TelemetrySignals struct {
	Traces  *bool `json:"traces,omitempty" yaml:"traces,omitempty"`
	Metrics *bool `json:"metrics,omitempty" yaml:"metrics,omitempty"`
	Logs    *bool `json:"logs,omitempty" yaml:"logs,omitempty"`
}

type TlsConfig interface {
	TlsConfig(ctx context.Context, s HttpServiceLike) (*tls.Config, error)
}

type TlsConfigLetsEncrypt struct {
	AcceptTos     bool           `json:"accept_tos" yaml:"accept_tos"`
	Email         string         `json:"email" yaml:"email"`
	HostWhitelist []string       `json:"host_whitelist" yaml:"host_whitelist"`
	RenewBefore   *HumanDuration `json:"renew_before,omitempty" yaml:"renew_before,omitempty"`
	CacheDir      string         `json:"cache_dir" yaml:"cache_dir"`
}

type TlsConfigSelfSignedAutogen struct {
	AutoGenPath string `json:"auto_gen_path" yaml:"auto_gen_path"`
}

type TlsConfigVals struct {
	Cert *KeyData `json:"cert" yaml:"cert"`
	Key  *KeyData `json:"key" yaml:"key"`
}

type TokenEndpointAuthMethod = connectors.TokenEndpointAuthMethod