config

type AgentConfig struct {
	Name  string `yaml:"name"`
	Model string `yaml:"model"`
}

type AgentsConfig struct {
	Default        AgentConfig          `yaml:"default"`                            // Default model for all agents
	Chat           ChatAgentConfig      `yaml:"chat"`                               // Main bot - talks to users
	ChatModel      string               `yaml:"-" env:"LAPLACED_AGENTS_CHAT_MODEL"` // Override for chat agent model
	Archivist      ArchivistAgentConfig `yaml:"archivist"`                          // Extracts facts and people from conversations
	Enricher       AgentConfig          `yaml:"enricher"`                           // Expands search queries
	Reactor        ReactorAgentConfig   `yaml:"reactor"`                            // Decides emoji reactions to user messages
	Reranker       RerankerAgentConfig  `yaml:"reranker"`                           // Filters and ranks RAG candidates
	Splitter       AgentConfig          `yaml:"splitter"`                           // Splits large topics
	Merger         AgentConfig          `yaml:"merger"`                             // Merges similar topics
	Extractor      ExtractorAgentConfig `yaml:"extractor"`                          // Extracts content from artifacts
	ImageGenerator ImageGeneratorConfig `yaml:"image_generator"`                    // Generates/edits images (v0.8.0)
}

type ArchivistAgentConfig struct {
	AgentConfig   `yaml:",inline"`
	ThinkingLevel string `yaml:"thinking_level" env:"LAPLACED_ARCHIVIST_THINKING_LEVEL"`
	Timeout       string `yaml:"timeout" env:"LAPLACED_ARCHIVIST_TIMEOUT"`
	MaxToolCalls  int    `yaml:"max_tool_calls" env:"LAPLACED_ARCHIVIST_MAX_TOOL_CALLS"`
}

type ArtifactsConfig struct {
	Enabled      bool     `yaml:"enabled" env:"LAPLACED_ARTIFACTS_ENABLED"`
	StoragePath  string   `yaml:"storage_path" env:"LAPLACED_ARTIFACTS_STORAGE_PATH"`
	AllowedTypes []string `yaml:"allowed_types"`

	// Voice settings (about storage filtering, not extraction)
	MinVoiceDurationSeconds int `yaml:"min_voice_duration_seconds" env:"LAPLACED_ARTIFACTS_MIN_VOICE_DURATION_SECONDS"` // gates RAG-indexing of voice: 0 = index all, -1 = disable voice artifacts, N = index voices >= N sec (shorter are still retained raw for replay)

	// S3, when present, switches the artifact blob store from the local disk
	// (StoragePath) to an S3-compatible bucket. Absence keeps the local backend,
	// so the home deployment is byte-identical. Capability block, not a mode flag.
	S3 *S3Config `yaml:"s3"`
}

type BotConfig struct {
	Language          string          `yaml:"language" env:"LAPLACED_BOT_LANGUAGE"`
	AllowedUserIDs    []int64         `yaml:"allowed_user_ids" env:"LAPLACED_ALLOWED_USER_IDS"`
	SystemPromptExtra string          `yaml:"system_prompt_extra"`
	TurnWaitDuration  string          `yaml:"turn_wait_duration"`
	Streaming         StreamingConfig `yaml:"streaming"`
}

type ChatAgentConfig struct {
	AgentConfig       `yaml:",inline"`
	ThinkingLevel     string `yaml:"thinking_level" env:"LAPLACED_AGENTS_CHAT_THINKING_LEVEL"`
	MaxToolIterations int    `yaml:"max_tool_iterations" env:"LAPLACED_AGENTS_CHAT_MAX_TOOL_ITERATIONS"`
}

type Config struct {
	Log struct {
		Level string `yaml:"level" env:"LAPLACED_LOG_LEVEL"`
	} `yaml:"log"`
	Server struct {
		ListenPort string `yaml:"listen_port" env:"LAPLACED_SERVER_PORT"`
		DebugMode  bool   `yaml:"debug_mode" env:"LAPLACED_SERVER_DEBUG"`
		Auth       struct {
			Enabled  bool   `yaml:"enabled" env:"LAPLACED_AUTH_ENABLED"`
			Username string `yaml:"username" env:"LAPLACED_AUTH_USERNAME"`
			Password string `yaml:"password" env:"LAPLACED_AUTH_PASSWORD"`
		} `yaml:"auth"`
	} `yaml:"server"`
	// Transport selects the chat backend: "telegram" (default) | "mattermost".
	Transport string `yaml:"transport" env:"LAPLACED_TRANSPORT"`
	Telegram  struct {
		Token         string                     `yaml:"token" env:"LAPLACED_TELEGRAM_TOKEN"`
		WebhookURL    string                     `yaml:"webhook_url" env:"LAPLACED_TELEGRAM_WEBHOOK_URL"`
		WebhookPath   string                     // Auto-generated from token hash (not configurable)
		WebhookSecret string                     // Auto-generated from token hash (not configurable)
		ProxyURL      string                     `yaml:"proxy_url" env:"LAPLACED_TELEGRAM_PROXY_URL"`
		RichMessages  TelegramRichMessagesConfig `yaml:"rich_messages"`
	} `yaml:"telegram"`
	Mattermost MattermostConfig `yaml:"mattermost"`
	LLM        LLMConfig        `yaml:"llm"`
	Agents     AgentsConfig     `yaml:"agents"`
	Embedding  EmbeddingConfig  `yaml:"embedding"`
	RAG        RAGConfig        `yaml:"rag"`
	Tools      []ToolConfig     `yaml:"tools"`
	Fetcher    FetcherConfig    `yaml:"fetcher"`
	Bot        BotConfig        `yaml:"bot"`
	Database   struct {
		// Driver selects the storage backend: "sqlite" (default) or "postgres".
		// Empty defaults to sqlite for backward compatibility.
		Driver string `yaml:"driver" env:"LAPLACED_DATABASE_DRIVER"`
		// Path is the SQLite database file path (driver=sqlite).
		Path string `yaml:"path" env:"LAPLACED_DATABASE_PATH"`
		// Postgres holds the connection params for driver=postgres. The password
		// MUST come from the LAPLACED_DATABASE_PASSWORD env var, never a committed literal.
		Postgres struct {
			Host     string `yaml:"host" env:"LAPLACED_DATABASE_HOST"`
			Port     int    `yaml:"port" env:"LAPLACED_DATABASE_PORT"`
			Database string `yaml:"database" env:"LAPLACED_DATABASE_NAME"`
			User     string `yaml:"user" env:"LAPLACED_DATABASE_USER"`
			Password string `yaml:"password" env:"LAPLACED_DATABASE_PASSWORD"`
			SSLMode  string `yaml:"sslmode" env:"LAPLACED_DATABASE_SSLMODE"`
		} `yaml:"postgres"`
		// Retention bounds the periodic trim of debug tables. agent_logs is
		// the only store of full agent prompts/responses (trace retention is
		// much shorter), so an over-eager trim blinds any postmortem.
		Retention RetentionConfig `yaml:"retention"`
	} `yaml:"database"`
	Artifacts ArtifactsConfig `yaml:"artifacts"`
	Memory    MemoryConfig    `yaml:"memory"`
	Search    SearchConfig    `yaml:"search"`
	Telemetry TelemetryConfig `yaml:"telemetry"`
	// Vault, when present, enables pulling secrets from HashiCorp Vault. Absent
	// (nil) = secrets come only from literals / LAPLACED_* env vars (default).
	Vault *VaultConfig `yaml:"vault"`
}

type EmbeddingConfig struct {
	Model      string `yaml:"model" env:"LAPLACED_EMBEDDING_MODEL"`
	Dimensions int    `yaml:"dimensions" env:"LAPLACED_EMBEDDING_DIMENSIONS"`
}

type ExtractorAgentConfig struct {
	AgentConfig `yaml:",inline"` // Name, Model

	// Processing settings (moved from ArtifactsConfig in v0.6.0)
	MaxFileSizeMB      int    `yaml:"max_file_size_mb" env:"LAPLACED_EXTRACTOR_MAX_FILE_SIZE_MB"`
	Timeout            string `yaml:"timeout" env:"LAPLACED_EXTRACTOR_TIMEOUT"`
	MaxRetries         int    `yaml:"max_retries" env:"LAPLACED_EXTRACTOR_MAX_RETRIES"`
	PollingInterval    string `yaml:"polling_interval" env:"LAPLACED_EXTRACTOR_POLLING_INTERVAL"`
	MaxConcurrent      int    `yaml:"max_concurrent" env:"LAPLACED_EXTRACTOR_MAX_CONCURRENT"`
	RecoveryThreshold  string `yaml:"recovery_threshold" env:"LAPLACED_EXTRACTOR_RECOVERY_THRESHOLD"`
	RecentMessageCount int    `yaml:"recent_message_count" env:"LAPLACED_EXTRACTOR_RECENT_MESSAGE_COUNT"` // Number of recent session messages to include in artifact context (0 = disable)
}

type FetcherConfig struct {
	// Backend: "firecrawl" (api.firecrawl.dev REST scrape, JS rendering,
	// 1 credit/page) or "raw" (plain HTTP + text extraction, no external
	// service). "mcp" is reserved for a future backend.
	Backend string `yaml:"backend" env:"LAPLACED_FETCHER_BACKEND"`
	Timeout string `yaml:"timeout" env:"LAPLACED_FETCHER_TIMEOUT"`
	// MaxContentChars caps the tool result size in runes; longer pages are
	// truncated with a marker. Guards the main model's context from page dumps.
	MaxContentChars int `yaml:"max_content_chars" env:"LAPLACED_FETCHER_MAX_CONTENT_CHARS"`
	// AllowPrivateNetworks lets the raw backend fetch RFC1918/CGNAT/ULA
	// addresses — for intranet deployments where the bot reads internal
	// wiki/docs pages. Loopback and link-local (incl. the cloud metadata
	// endpoint) stay blocked regardless: the bot's own host carries its admin
	// surface and no page the model should read. The firecrawl backend is
	// unaffected (an external service fetching from its own network).
	AllowPrivateNetworks bool            `yaml:"allow_private_networks" env:"LAPLACED_FETCHER_ALLOW_PRIVATE_NETWORKS"`
	Firecrawl            FirecrawlConfig `yaml:"firecrawl"`
}

type FirecrawlConfig struct {
	BaseURL string `yaml:"base_url" env:"LAPLACED_FIRECRAWL_BASE_URL"`
	APIKey  string `yaml:"api_key" env:"LAPLACED_FIRECRAWL_API_KEY"`
}

type ImageGeneratorConfig struct {
	AgentConfig `yaml:",inline"` // Name, Model (e.g. google/gemini-3.1-flash-image-preview)

	Timeout            string `yaml:"timeout" env:"LAPLACED_IMAGE_GENERATOR_TIMEOUT"`
	DefaultAspectRatio string `yaml:"default_aspect_ratio" env:"LAPLACED_IMAGE_GENERATOR_DEFAULT_ASPECT_RATIO"`
	DefaultImageSize   string `yaml:"default_image_size" env:"LAPLACED_IMAGE_GENERATOR_DEFAULT_IMAGE_SIZE"`
	// SupportedImageSizes / SupportedAspectRatios drive the generate_image tool
	// JSON schema. They MUST match what the configured Model accepts upstream —
	// see the commented alternative in default.yaml for verified per-model sets.
	SupportedImageSizes   []string `yaml:"supported_image_sizes" env:"LAPLACED_IMAGE_GENERATOR_SUPPORTED_IMAGE_SIZES" env-separator:","`
	SupportedAspectRatios []string `yaml:"supported_aspect_ratios" env:"LAPLACED_IMAGE_GENERATOR_SUPPORTED_ASPECT_RATIOS" env-separator:","`
	MaxInputImages        int      `yaml:"max_input_images" env:"LAPLACED_IMAGE_GENERATOR_MAX_INPUT_IMAGES"`
	MaxOutputImages       int      `yaml:"max_output_images" env:"LAPLACED_IMAGE_GENERATOR_MAX_OUTPUT_IMAGES"`
	MaxInputImageBytes    int      `yaml:"max_input_image_bytes" env:"LAPLACED_IMAGE_GENERATOR_MAX_INPUT_IMAGE_BYTES"`
	// DocumentThresholdBytes: generated images larger than this are sent via
	// sendDocument instead of sendPhoto, preserving full resolution (Telegram
	// recompresses photos to ~1280 px on long side). Default 2 MB covers
	// 2K/4K outputs; set to 0 to always use sendPhoto.
	DocumentThresholdBytes int `yaml:"document_threshold_bytes" env:"LAPLACED_IMAGE_GENERATOR_DOCUMENT_THRESHOLD_BYTES"`
	// MaxConcurrent bounds how many generate_image tool calls from a single
	// assistant turn run in parallel (e.g. "draw three pictures"). Other tools
	// stay sequential. Defaults to 4.
	MaxConcurrent int `yaml:"max_concurrent" env:"LAPLACED_IMAGE_GENERATOR_MAX_CONCURRENT"`
}

type LLMConfig struct {
	APIKey string `yaml:"api_key" env:"LAPLACED_LLM_API_KEY"`
	// BaseURL is the OpenAI-compatible endpoint the LLM client talks to.
	// Defaults to the public OpenRouter API; override to point at a self-hosted
	// OpenAI-compatible backend (litellm, vLLM, …).
	BaseURL string `yaml:"base_url" env:"LAPLACED_LLM_BASE_URL"`
	// ImageInputFormat selects how images/videos are encoded as LLM content
	// parts: "file" (default, OpenRouter/Gemini) or "openai" (image_url/video_url,
	// required by OpenAI-compatible backends like litellm/vLLM which reject "file").
	ImageInputFormat string                `yaml:"image_input_format" env:"LAPLACED_LLM_IMAGE_INPUT_FORMAT"`
	ProxyURL         string                `yaml:"proxy_url" env:"LAPLACED_LLM_PROXY_URL"`
	PDFParserEngine  string                `yaml:"pdf_parser_engine"`
	RequestCost      float64               `yaml:"request_cost"`
	PriceTiers       []PriceTier           `yaml:"price_tiers"`
	Provider         ProviderRoutingConfig `yaml:"provider"`
}

type MattermostConfig struct {
	ServerURL      string   `yaml:"server_url" env:"LAPLACED_MATTERMOST_SERVER_URL"`
	BotToken       string   `yaml:"bot_token" env:"LAPLACED_MATTERMOST_BOT_TOKEN"`
	ProxyURL       string   `yaml:"proxy_url" env:"LAPLACED_MATTERMOST_PROXY_URL"`
	AllowedUserIDs []string `yaml:"allowed_user_ids" env:"LAPLACED_MATTERMOST_ALLOWED_USER_IDS" env-separator:","`
	// PrincipalResolver, when present, turns on principal identity resolution for
	// this transport's DMs. Its mere presence enables resolution
	// (organic config, not a mode flag); absence = passthrough (the default behavior).
	PrincipalResolver *PrincipalResolverConfig `yaml:"principal_resolver"`
}

type MemoryConfig struct {
	FactDefaultImportance int `yaml:"fact_default_importance" env:"LAPLACED_MEMORY_FACT_DEFAULT_IMPORTANCE"`
}

type PriceTier struct {
	UpToTokens     int     `yaml:"up_to_tokens"`
	PromptCost     float64 `yaml:"prompt_cost"`
	CompletionCost float64 `yaml:"completion_cost"`
}

type PrincipalResolverConfig struct {
	// TrustedAuthServices restricts which Mattermost auth_service values are
	// trusted for principal linkage. Empty = trust any non-empty auth_service
	// (the default gate). Local accounts (auth_service == "") are never linked.
	TrustedAuthServices []string `yaml:"trusted_auth_services" env:"LAPLACED_MATTERMOST_TRUSTED_AUTH_SERVICES" env-separator:","`
	// AccessDeniedMessage is the verbatim text sent to a sender denied access
	// because they are not an SSO-authenticated user. Empty falls back to the
	// neutral localized default (i18n bot.access_denied). Deployment-specific
	// wording (e.g. "sign in via your corporate SSO first") belongs here, in a
	// gitignored overlay — never in tracked locale files.
	AccessDeniedMessage string `yaml:"access_denied_message" env:"LAPLACED_MATTERMOST_ACCESS_DENIED_MESSAGE"`
	// TrustedBots lists bot-account usernames (case-insensitive, leading "@"
	// tolerated) allowed to interact with the bot despite being local accounts
	// that fail the SSO trust gate. Empty = no bots trusted (fail-closed). Use for
	// trusted automation such as an alerting bot requesting an incident summary. A
	// bot not on this list is ignored silently — not sent an access-denied notice.
	TrustedBots []string `yaml:"trusted_bots" env:"LAPLACED_MATTERMOST_TRUSTED_BOTS" env-separator:","`
	// MaxBotChainDepth caps consecutive bot replies within a single thread before
	// the bot stops replying, breaking LLM-bot ping-pong loops. <= 0 uses a
	// built-in default. An authorized human posting in the thread resets the count.
	MaxBotChainDepth int `yaml:"max_bot_chain_depth" env:"LAPLACED_MATTERMOST_MAX_BOT_CHAIN_DEPTH"`
}

type ProviderRoutingConfig struct {
	Order []string `yaml:"order" env:"LAPLACED_LLM_PROVIDER_ORDER" env-separator:","`
	// AllowFallbacks is YAML-only: cleanenv doesn't support *bool via env tags.
	// The common case (prefer a provider with default fallback) needs only Order,
	// so this is not a practical limitation.
	AllowFallbacks *bool `yaml:"allow_fallbacks"`
}

type RAGConfig struct {
	Enabled                          bool    `yaml:"enabled" env:"LAPLACED_RAG_ENABLED"`
	MaxContextMessages               int     `yaml:"max_context_messages"`
	AnswerMemoryTokenBudget          int     `yaml:"answer_memory_token_budget" env:"LAPLACED_RAG_ANSWER_MEMORY_TOKEN_BUDGET"`
	MaxProfileFacts                  int     `yaml:"max_profile_facts"`
	RetrievedMessagesCount           int     `yaml:"retrieved_messages_count"`
	RetrievedTopicsCount             int     `yaml:"retrieved_topics_count"`
	SimilarityThreshold              float64 `yaml:"similarity_threshold"`
	ConsolidationSimilarityThreshold float64 `yaml:"consolidation_similarity_threshold"`
	MinSafetyThreshold               float64 `yaml:"min_safety_threshold"`
	MaxChunkSize                     int     `yaml:"max_chunk_size"`
	BackfillBatchSize                int     `yaml:"backfill_batch_size"`
	BackfillInterval                 string  `yaml:"backfill_interval"`
	ChunkInterval                    string  `yaml:"chunk_interval"`
	MaxMergedSizeChars               int     `yaml:"max_merged_size_chars"`
	SplitThresholdChars              int     `yaml:"split_threshold_chars"`
	RecentTopicsInContext            int     `yaml:"recent_topics_in_context"`
}

type ReactorAgentConfig struct {
	Name    string `yaml:"name"`
	Model   string `yaml:"model" env:"LAPLACED_AGENTS_REACTOR_MODEL"`
	Enabled bool   `yaml:"enabled" env:"LAPLACED_AGENTS_REACTOR_ENABLED"`
}

type RerankerAgentConfig struct {
	AgentConfig        `yaml:",inline"`
	Enabled            bool   `yaml:"enabled" env:"LAPLACED_RERANKER_ENABLED"`
	Timeout            string `yaml:"timeout" env:"LAPLACED_RERANKER_TIMEOUT"`
	TurnTimeout        string `yaml:"turn_timeout" env:"LAPLACED_RERANKER_TURN_TIMEOUT"`
	MaxToolCalls       int    `yaml:"max_tool_calls" env:"LAPLACED_RERANKER_MAX_TOOL_CALLS"`
	ThinkingLevel      string `yaml:"thinking_level" env:"LAPLACED_RERANKER_THINKING_LEVEL"`
	TargetContextChars int    `yaml:"target_context_chars" env:"LAPLACED_RERANKER_TARGET_CONTEXT_CHARS"`
	InputTokenBudget   int    `yaml:"input_token_budget" env:"LAPLACED_RERANKER_INPUT_TOKEN_BUDGET"`

	// Per-type limits (v0.6.0)
	Topics    RerankerTypeConfig      `yaml:"topics"`
	People    RerankerTypeConfig      `yaml:"people"`
	Artifacts RerankerArtifactsConfig `yaml:"artifacts"`

	// Legacy fields (deprecated, kept for migration)
	Candidates int `yaml:"candidates" env:"LAPLACED_RERANKER_CANDIDATES"`
	MaxTopics  int `yaml:"max_topics" env:"LAPLACED_RERANKER_MAX_TOPICS"`
	MaxPeople  int `yaml:"max_people" env:"LAPLACED_RERANKER_MAX_PEOPLE"`
}

type RerankerArtifactsConfig struct {
	RerankerTypeConfig `yaml:",inline"`
	Session            RerankerArtifactsSessionConfig `yaml:"session"`
}

type RerankerArtifactsSessionConfig struct {
	Max    int    `yaml:"max" env:"LAPLACED_RERANKER_ARTIFACTS_SESSION_MAX"`
	MaxAge string `yaml:"max_age" env:"LAPLACED_RERANKER_ARTIFACTS_SESSION_MAX_AGE"`
}

type RerankerTypeConfig struct {
	CandidatesLimit int `yaml:"candidates_limit" env:"LAPLACED_RERANKER_TOPICS_CANDIDATES_LIMIT"`
	Max             int `yaml:"max" env:"LAPLACED_RERANKER_TOPICS_MAX"`
	MaxContextBytes int `yaml:"max_context_bytes,omitempty" env:"LAPLACED_RERANKER_TOPICS_MAX_CONTEXT_BYTES"` // For artifacts only (v0.6.0)
}

type RetentionConfig struct {
	// AgentLogsKeep is how many of the newest agent_logs rows survive per
	// (user, agent type) once past the min-age window. 0 uses the default.
	AgentLogsKeep int `yaml:"agent_logs_keep" env:"LAPLACED_DATABASE_AGENT_LOGS_KEEP"`
	// AgentLogsMinAge protects recent rows from the keep-N trim: rows younger
	// than this are never deleted regardless of count. Duration string
	// ("336h" = 14 days). Empty uses the default; "0" disables the protection.
	AgentLogsMinAge string `yaml:"agent_logs_min_age" env:"LAPLACED_DATABASE_AGENT_LOGS_MIN_AGE"`
}

type S3Config struct {
	Endpoint  string `yaml:"endpoint" env:"LAPLACED_ARTIFACTS_S3_ENDPOINT"`
	Region    string `yaml:"region" env:"LAPLACED_ARTIFACTS_S3_REGION"`
	Bucket    string `yaml:"bucket" env:"LAPLACED_ARTIFACTS_S3_BUCKET"`
	AccessKey string `yaml:"access_key" env:"LAPLACED_ARTIFACTS_S3_ACCESS_KEY"`
	SecretKey string `yaml:"secret_key" env:"LAPLACED_ARTIFACTS_S3_SECRET_KEY"`
}

type SearchConfig struct {
	PeopleSimilarityThreshold float64 `yaml:"people_similarity_threshold" env:"LAPLACED_SEARCH_PEOPLE_SIMILARITY_THRESHOLD"`
	PeopleMaxResults          int     `yaml:"people_max_results" env:"LAPLACED_SEARCH_PEOPLE_MAX_RESULTS"`
}

type SecretProvider interface {
	Get(ctx context.Context, ref VaultRef) (string, error)
}

type StreamingConfig struct {
	Enabled        bool `yaml:"enabled" env:"LAPLACED_BOT_STREAMING_ENABLED"`
	EditThrottleMs int  `yaml:"edit_throttle_ms" env:"LAPLACED_BOT_STREAMING_EDIT_THROTTLE_MS"`
	EditMinChars   int  `yaml:"edit_min_chars" env:"LAPLACED_BOT_STREAMING_EDIT_MIN_CHARS"`
	MaxBufferChars int  `yaml:"max_buffer_chars" env:"LAPLACED_BOT_STREAMING_MAX_BUFFER_CHARS"`
}

type TelegramRichMessagesConfig struct {
	Mode string `yaml:"mode" env:"LAPLACED_TELEGRAM_RICH_MESSAGES_MODE"`

	// AllowedUserIDs optionally narrows an explicit shadow/send mode to a
	// canary. An empty list means the mode applies to every Telegram-native
	// user; mode=off remains the kill switch either way.
	AllowedUserIDs []int64 `yaml:"allowed_user_ids" env:"LAPLACED_TELEGRAM_RICH_MESSAGES_ALLOWED_USER_IDS" env-separator:","`

	// DraftStreamingEnabled controls ephemeral sendRichMessageDraft previews
	// for eligible private rich turns. It stays deliberately independent from
	// bot.streaming.enabled: the two paths have different terminal ownership
	// and fallback semantics, so neither should silently imply the other.
	// Mode=off remains the kill switch even when this flag is true.
	DraftStreamingEnabled bool `yaml:"draft_streaming_enabled" env:"LAPLACED_TELEGRAM_RICH_MESSAGES_DRAFT_STREAMING_ENABLED"`
}

type TelemetryConfig struct {
	Enabled bool `yaml:"enabled" env:"LAPLACED_TELEMETRY_ENABLED"`
	// Exporter selects the span exporter backend. Valid values: "otlp"
	// (default, sends to an OTLP/gRPC collector like Alloy) and "stdout"
	// (pretty-prints spans to stderr; for local dev where network-level
	// trace delivery is not being tested).
	Exporter     string `yaml:"exporter" env:"LAPLACED_TELEMETRY_EXPORTER"`
	OTLPEndpoint string `yaml:"otlp_endpoint" env:"LAPLACED_TELEMETRY_OTLP_ENDPOINT"`
	ServiceName  string `yaml:"service_name" env:"LAPLACED_TELEMETRY_SERVICE_NAME"`
	// TraceContent, when true, asks tracing to record full content (LLM
	// request/response bodies, raw RAG queries, tool args/results) as span
	// events. Default off — flip only for debug sessions. Also surfaces as
	// resource attribute laplaced.trace_content on the captured trace.
	TraceContent bool `yaml:"trace_content" env:"LAPLACED_TELEMETRY_TRACE_CONTENT"`
}

type ToolConfig struct {
	Name                 string `yaml:"name"`
	Model                string `yaml:"model"`
	Description          string `yaml:"description"`
	ParameterDescription string `yaml:"parameter_description"`
}

type VaultAuthConfig struct {
	// Method selects the auth backend: "token" | "kubernetes" | "approle".
	Method string `yaml:"method" env:"LAPLACED_VAULT_AUTH_METHOD"`
	// Role is the Vault role for kubernetes auth.
	Role string `yaml:"role" env:"LAPLACED_VAULT_AUTH_ROLE"`
	// MountPath overrides the auth mount (e.g. "kubernetes-2"). Empty = the
	// method's own default mount ("kubernetes" / "approle").
	MountPath string `yaml:"mount_path" env:"LAPLACED_VAULT_AUTH_MOUNT_PATH"`
	// ServiceAccountTokenPath overrides the Kubernetes service-account JWT path
	// (optional; defaults to the in-cluster location).
	ServiceAccountTokenPath string `yaml:"service_account_token_path" env:"LAPLACED_VAULT_K8S_SA_TOKEN_PATH"`
	// RoleID for approle auth. The matching secret_id is read ONLY from the
	// LAPLACED_VAULT_APPROLE_SECRET_ID env var, never from a config literal.
	RoleID string `yaml:"role_id" env:"LAPLACED_VAULT_APPROLE_ROLE_ID"`
}

type VaultConfig struct {
	// Address of the Vault server. May be set here (often as ${VAULT_ADDR}) or
	// left empty to fall back to the standard VAULT_ADDR environment variable.
	Address string `yaml:"address" env:"VAULT_ADDR"`
	// Namespace for Vault Enterprise / HCP (optional).
	Namespace string          `yaml:"namespace" env:"VAULT_NAMESPACE"`
	Auth      VaultAuthConfig `yaml:"auth"`
}

type VaultRef struct {
	Kind  string // "kv2" | "kv1" | "raw"
	Mount string // secrets-engine mount, e.g. "secret"
	Path  string // path under the mount, e.g. "laplaced/dev"
	Key   string // field within the secret
}