import { FileHelper } from '@start9labs/start-sdk'

/**
 * SSH private key used to reach the Sparks, stored as a standalone file in the
 * `main` volume. Kept out of config.json so it is never returned in plaintext
 * config reads. The container copies it to a 600 path at runtime.
 *
 * Volume path './ssh/id_spark' -> /data/ssh/id_spark inside the container.
 */
export const sshKeyFile = FileHelper.string('./ssh/id_spark')

/**
 * Optional Hugging Face token (for gated/private model pulls on the Sparks).
 * Passed to the vLLM serving container as HF_TOKEN at launch. In `airgapped`
 * network mode models are served from a pre-pulled cache, so this is only used
 * the first time you warm a model (or in local_services mode).
 *
 * Volume path './secrets/hf_token' -> /data/secrets/hf_token.
 *
 * NOTE: Boardroom Map has NO frontier/cloud key. There is deliberately no Anthropic
 * key and no Gitea token — the whole point is that confidential documents and
 * their reviews never leave your hardware.
 */
export const hfTokenFile = FileHelper.string('./secrets/hf_token')