config

type AppConfig struct {
	Name      string        `koanf:"name" json:"name" yaml:"name" toml:"name" mapstructure:"name"`
	Version   string        `koanf:"version" json:"version" yaml:"version" toml:"version" mapstructure:"version"`
	Env       string        `koanf:"env" json:"env" yaml:"env" toml:"env" mapstructure:"env"`
	Debug     bool          `koanf:"debug" json:"debug" yaml:"debug" toml:"debug" mapstructure:"debug"`
	Namespace string        `koanf:"namespace" json:"namespace" yaml:"namespace" toml:"namespace" mapstructure:"namespace"`
	Rate      RateConfig    `koanf:"rate" json:"rate" yaml:"rate" toml:"rate" mapstructure:"rate"`
	Startup   StartupConfig `koanf:"startup" json:"startup" yaml:"startup" toml:"startup" mapstructure:"startup"`
}

type BrokerConfig struct {
	URL         string `koanf:"url" json:"url" yaml:"url" toml:"url" mapstructure:"url"`
	VirtualHost string `koanf:"virtualhost" json:"virtualhost" yaml:"virtualhost" toml:"virtualhost" mapstructure:"virtualhost"`
}

type CacheConfig struct {
	Enabled bool `koanf:"enabled" json:"enabled" yaml:"enabled" toml:"enabled" mapstructure:"enabled"`
	// Critical fails /ready with 503 when the cache probe errors. Absent means
	// non-critical (ADR-094), so a plain bool: no koanf default is registered
	// (#1316). Read through Config.IsCacheCritical. See wiki/cache.md#readiness.
	Critical bool               `koanf:"critical" json:"critical" yaml:"critical" toml:"critical" mapstructure:"critical"`
	Type     string             `koanf:"type" json:"type" yaml:"type" toml:"type" mapstructure:"type"` // redis
	Redis    RedisConfig        `koanf:"redis" json:"redis" yaml:"redis" toml:"redis" mapstructure:"redis"`
	Manager  CacheManagerConfig `koanf:"manager" json:"manager" yaml:"manager" toml:"manager" mapstructure:"manager"`

	// LoadTimeout bounds each cache leg of cache.LoadThrough — the lookup and the
	// detached write-back — so a slow-but-reachable cache cannot spend the caller's
	// whole request budget before the origin loader runs. Default 500ms; 0 means
	// "unset, use the default" and a negative value is rejected, so there is no way
	// to express an unbounded leg. Per-tenant values are honored: the bound travels
	// on the resolved cache instance, not on a process-wide global.
	// See wiki/cache.md#load-through-reads.
	LoadTimeout time.Duration `koanf:"loadtimeout" json:"loadtimeout" yaml:"loadtimeout" toml:"loadtimeout" mapstructure:"loadtimeout"`
}

type CacheManagerConfig struct {
	// MaxSize is the maximum number of active cache instances. 0 = use default
	// (100 single-tenant; in multi-tenant mode zero is preserved so
	// app.ManagerConfigBuilder scales the pool to multitenant.limits.tenants);
	// negative values are invalid.
	MaxSize int `koanf:"maxsize" json:"maxsize" yaml:"maxsize" toml:"maxsize" mapstructure:"maxsize"`

	// IdleTTL is the idle timeout before cache instances are closed.
	// Default: 15m. Set lower for memory-constrained environments.
	IdleTTL time.Duration `koanf:"idlettl" json:"idlettl" yaml:"idlettl" toml:"idlettl" mapstructure:"idlettl"`

	// CleanupInterval is how often the cleanup goroutine runs.
	// Default: 5m. Should be less than IdleTTL for effective cleanup.
	CleanupInterval time.Duration `koanf:"cleanupinterval" json:"cleanupinterval" yaml:"cleanupinterval" toml:"cleanupinterval" mapstructure:"cleanupinterval"`
}

type Config struct {
	App         AppConfig                 `koanf:"app" json:"app" yaml:"app" toml:"app" mapstructure:"app"`
	Server      ServerConfig              `koanf:"server" json:"server" yaml:"server" toml:"server" mapstructure:"server"`
	Database    DatabaseConfig            `koanf:"database" json:"database" yaml:"database" toml:"database" mapstructure:"database"`
	Databases   map[string]DatabaseConfig `koanf:"databases" json:"databases" yaml:"databases" toml:"databases" mapstructure:"databases"`
	Cache       CacheConfig               `koanf:"cache" json:"cache" yaml:"cache" toml:"cache" mapstructure:"cache"`
	Log         LogConfig                 `koanf:"log" json:"log" yaml:"log" toml:"log" mapstructure:"log"`
	Messaging   MessagingConfig           `koanf:"messaging" json:"messaging" yaml:"messaging" toml:"messaging" mapstructure:"messaging"`
	Multitenant MultitenantConfig         `koanf:"multitenant" json:"multitenant" yaml:"multitenant" toml:"multitenant" mapstructure:"multitenant"`
	Debug       DebugConfig               `koanf:"debug" json:"debug" yaml:"debug" toml:"debug" mapstructure:"debug"`
	Source      SourceConfig              `koanf:"source" json:"source" yaml:"source" toml:"source" mapstructure:"source"`
	Scheduler   SchedulerConfig           `koanf:"scheduler" json:"scheduler" yaml:"scheduler" toml:"scheduler" mapstructure:"scheduler"`
	Outbox      OutboxConfig              `koanf:"outbox" json:"outbox" yaml:"outbox" toml:"outbox" mapstructure:"outbox"`
	Inbox       InboxConfig               `koanf:"inbox" json:"inbox" yaml:"inbox" toml:"inbox" mapstructure:"inbox"`
	KeyStore    KeyStoreConfig            `koanf:"keystore" json:"keystore" yaml:"keystore" toml:"keystore" mapstructure:"keystore"`
	// contains filtered or unexported fields
}

type ConfigError struct {
	Category string   // error category: "missing", "invalid", "not_configured", "connection"
	Field    string   // config field path (e.g., "database.host", "messaging.broker.url")
	Message  string   // user-friendly error message (lowercase)
	Action   string   // actionable instruction (lowercase)
	Details  []string // additional details or examples
}

type DatabaseConfig struct {
	Type     string `koanf:"type" json:"type" yaml:"type" toml:"type" mapstructure:"type"`
	Host     string `koanf:"host" json:"host" yaml:"host" toml:"host" mapstructure:"host"`
	Port     int    `koanf:"port" json:"port" yaml:"port" toml:"port" mapstructure:"port"`
	Database string `koanf:"database" json:"database" yaml:"database" toml:"database" mapstructure:"database"`
	Username string `koanf:"username" json:"username" yaml:"username" toml:"username" mapstructure:"username"`
	Password string `koanf:"password" json:"password" yaml:"password" toml:"password" mapstructure:"password"`

	ConnectionString string `` /* 128-byte string literal not displayed */

	// Timezone is the IANA timezone name applied to every new database session.
	// Validated via time.LoadLocation at startup (fail-fast on invalid names).
	// Default: "UTC". Set to "-" to disable session-level timezone enforcement
	// (sessions then inherit the database server's default timezone).
	// The literal "Local" is rejected; "-" is the only host-local spelling (ADR-093).
	// Applies to both PostgreSQL (via pgx RuntimeParams) and Oracle (via
	// ALTER SESSION SET TIME_ZONE on every new physical connection).
	Timezone string `koanf:"timezone" json:"timezone" yaml:"timezone" toml:"timezone" mapstructure:"timezone"`

	Pool  PoolConfig  `koanf:"pool" json:"pool" yaml:"pool" toml:"pool" mapstructure:"pool"`
	Query QueryConfig `koanf:"query" json:"query" yaml:"query" toml:"query" mapstructure:"query"`
	TLS   TLSConfig   `koanf:"tls" json:"tls" yaml:"tls" toml:"tls" mapstructure:"tls"`

	PostgreSQL PostgreSQLConfig `koanf:"postgresql" json:"postgresql" yaml:"postgresql" toml:"postgresql" mapstructure:"postgresql"`
	Oracle     OracleConfig     `koanf:"oracle" json:"oracle" yaml:"oracle" toml:"oracle" mapstructure:"oracle"`

	// Manager applies only to the primary Config.Database, whose single
	// database.DbManager also caches named databases.<name> and per-tenant handles.
	Manager DatabaseManagerConfig `koanf:"manager" json:"manager" yaml:"manager" toml:"manager" mapstructure:"manager"`
}

type DatabaseManagerConfig struct {
	// MaxSize is the maximum number of active database handles. 0 = use default
	// (10 single-tenant / tenant limit multi-tenant); negative values are invalid.
	MaxSize int `koanf:"maxsize" json:"maxsize" yaml:"maxsize" toml:"maxsize" mapstructure:"maxsize"`

	// IdleTTL is the idle timeout before a database handle is closed.
	// Default: 1h single-tenant / 30m multi-tenant.
	IdleTTL time.Duration `koanf:"idlettl" json:"idlettl" yaml:"idlettl" toml:"idlettl" mapstructure:"idlettl"`

	// CleanupInterval is how often the cleanup goroutine runs. Default: 5m.
	CleanupInterval time.Duration `koanf:"cleanupinterval" json:"cleanupinterval" yaml:"cleanupinterval" toml:"cleanupinterval" mapstructure:"cleanupinterval"`
}

type DebugConfig struct {
	Enabled    bool     `koanf:"enabled" json:"enabled" yaml:"enabled" toml:"enabled" mapstructure:"enabled"`                // Enable debug endpoints
	PathPrefix string   `koanf:"pathprefix" json:"pathprefix" yaml:"pathprefix" toml:"pathprefix" mapstructure:"pathprefix"` // URL path prefix for debug endpoints
	AllowedIPs []string `koanf:"allowedips" json:"allowedips" yaml:"allowedips" toml:"allowedips" mapstructure:"allowedips"` // List of allowed IP addresses/CIDRs
	// TrustedProxies holds CIDR ranges of reverse proxies trusted to set X-Forwarded-For.
	// X-Real-IP is never honored (ADR-057, completed by ADR-080), and a default route is
	// rejected at startup.
	// When empty (the default), proxy headers are IGNORED and the immediate peer
	// IP is used for the AllowedIPs check — so the allowlist cannot be bypassed by spoofing
	// X-Forwarded-For. Only set this to the CIDRs of proxies actually in front of the service.
	TrustedProxies []string             `koanf:"trustedproxies" json:"trustedproxies" yaml:"trustedproxies" toml:"trustedproxies" mapstructure:"trustedproxies"`
	BearerToken    string               `koanf:"bearertoken" json:"bearertoken" yaml:"bearertoken" toml:"bearertoken" mapstructure:"bearertoken"`
	Endpoints      DebugEndpointsConfig `koanf:"endpoints" json:"endpoints" yaml:"endpoints" toml:"endpoints" mapstructure:"endpoints"` // Individual endpoint settings
}

type DebugEndpointsConfig struct {
	Goroutines bool `koanf:"goroutines" json:"goroutines" yaml:"goroutines" toml:"goroutines" mapstructure:"goroutines"` // Enable goroutine analysis endpoint
	GC         bool `koanf:"gc" json:"gc" yaml:"gc" toml:"gc" mapstructure:"gc"`                                         // Enable garbage collection endpoints
	Health     bool `koanf:"health" json:"health" yaml:"health" toml:"health" mapstructure:"health"`                     // Enable enhanced health endpoint
	Info       bool `koanf:"info" json:"info" yaml:"info" toml:"info" mapstructure:"info"`                               // Enable system info endpoint
}

type ForwardedClientCertConfig struct {
	Enabled bool `koanf:"enabled" json:"enabled" yaml:"enabled" toml:"enabled" mapstructure:"enabled"`
	// Require rejects (401) any non-probe request whose identity headers are
	// absent (neither -Subject nor -Serial-Number present); a malformed -Leaf
	// alone never rejects. False = parse-and-expose only.
	Require bool `koanf:"require" json:"require" yaml:"require" toml:"require" mapstructure:"require"`
}

type GzipConfig struct {
	// MinLength is the minimum response size in bytes before gzip compression is
	// applied. Responses smaller than this are sent uncompressed, since the gzip
	// header/overhead can exceed the savings for small payloads. Default: 1024.
	MinLength int `koanf:"minlength" json:"minlength" yaml:"minlength" toml:"minlength" mapstructure:"minlength"`
}

type IPPreGuardConfig struct {
	Enabled   bool `koanf:"enabled" json:"enabled" yaml:"enabled" toml:"enabled" mapstructure:"enabled"`           // enable IP pre-guard rate limiting
	Threshold int  `koanf:"threshold" json:"threshold" yaml:"threshold" toml:"threshold" mapstructure:"threshold"` // requests per second limit per IP
}

type InboxConfig struct {
	// Enabled activates the consumer-side inbox.
	// When false, the inbox module is a no-op and deps.Inbox is nil.
	Enabled bool `koanf:"enabled" json:"enabled" yaml:"enabled" toml:"enabled" mapstructure:"enabled"`

	// TableName is the inbox ledger table name in the database.
	// Default: "gobricks_inbox". Must be unqualified (no schema prefix) because the
	// Oracle store derives a primary-key constraint name from it.
	TableName string `koanf:"tablename" json:"tablename" yaml:"tablename" toml:"tablename" mapstructure:"tablename"`

	// AutoCreateTable creates the inbox table on first use if it doesn't exist.
	// Default: false (opt-in). Set true to auto-create (e.g. in development); leave
	// false in production with managed migrations.
	AutoCreateTable bool `koanf:"autocreatetable" json:"autocreatetable" yaml:"autocreatetable" toml:"autocreatetable" mapstructure:"autocreatetable"`

	// RetentionPeriod is how long processed-event records are kept before cleanup.
	// It MUST exceed the broker's maximum redelivery window, or a late redelivery
	// could be reprocessed. The same window bounds every DLQ drain and every outbox
	// re-drive: a message replayed after its ledger row was swept is processed
	// again, so the retention period IS the replay window a deployment accepts.
	// A zero value is treated as unset and replaced by the default; increase it to
	// retain longer. Default: 168h (7 days).
	RetentionPeriod time.Duration `koanf:"retentionperiod" json:"retentionperiod" yaml:"retentionperiod" toml:"retentionperiod" mapstructure:"retentionperiod"`

	// Tenancy selects where the ledger lives when multitenant.enabled is true:
	//   - "per-tenant" (default): one dedup ledger per tenant DB; the retention
	//     cleanup job fans out across static multitenant.tenants.
	//   - "shared": one control-plane ledger resolved via the empty ("") key —
	//     the root database: block for the built-in store, or whatever a custom
	//     resource source returns for "". The cleanup job runs a single pass and
	//     ProcessOnce records/dedups against the shared ledger. See
	//     wiki/outbox.md and ADR-041.
	// In single-tenant mode both values behave identically.
	Tenancy string `koanf:"tenancy" json:"tenancy" yaml:"tenancy" toml:"tenancy" mapstructure:"tenancy"`

	// Hold configures per-tenant parking of failed stream deliveries.
	Hold InboxHoldConfig `koanf:"hold" json:"hold" yaml:"hold" toml:"hold" mapstructure:"hold"`
}

type InboxHoldConfig struct {
	// Enabled activates the hold ledger and its drain job.
	// Default: false (opt-in).
	Enabled bool `koanf:"enabled" json:"enabled" yaml:"enabled" toml:"enabled" mapstructure:"enabled"`

	// TableName is the hold row table; the tenant table is "<tablename>_tenant".
	// Must be unqualified. Default: "gobricks_inbox_hold".
	TableName string `koanf:"tablename" json:"tablename" yaml:"tablename" toml:"tablename" mapstructure:"tablename"`

	// DrainInterval is how often the drain job looks for due tenants.
	// Default: 5s.
	DrainInterval time.Duration `koanf:"draininterval" json:"draininterval" yaml:"draininterval" toml:"draininterval" mapstructure:"draininterval"`

	// MaxBackoff caps the drain's per-tenant retry backoff. Default: 5m.
	MaxBackoff time.Duration `koanf:"maxbackoff" json:"maxbackoff" yaml:"maxbackoff" toml:"maxbackoff" mapstructure:"maxbackoff"`

	// MaxAge is how long a tenant may stay held before each drain pass logs one
	// WARN naming it. Default: 1h.
	MaxAge time.Duration `koanf:"maxage" json:"maxage" yaml:"maxage" toml:"maxage" mapstructure:"maxage"`

	// LeaseDuration is how long one drainer holds a tenant, and therefore the
	// time bound on a replayed handler. Default: 60s.
	LeaseDuration time.Duration `koanf:"leaseduration" json:"leaseduration" yaml:"leaseduration" toml:"leaseduration" mapstructure:"leaseduration"`
}

type KeyPairConfig struct {
	Public  KeySourceConfig `koanf:"public" json:"public" yaml:"public" toml:"public" mapstructure:"public"`
	Private KeySourceConfig `koanf:"private" json:"private" yaml:"private" toml:"private" mapstructure:"private"`
	// Secret holds raw symmetric key material (HMAC/CMAC key, HKDF input).
	// Mutually exclusive with Public/Private.
	Secret KeySourceConfig `koanf:"secret" json:"secret" yaml:"secret" toml:"secret" mapstructure:"secret"`
	// PKCS12 loads the RSA pair from a password-protected PKCS#12 bundle.
	// Mutually exclusive with Public/Private and Secret.
	PKCS12 PKCS12SourceConfig `koanf:"pkcs12" json:"pkcs12" yaml:"pkcs12" toml:"pkcs12" mapstructure:"pkcs12"`
}

type KeySourceConfig struct {
	File  string `koanf:"file" json:"file" yaml:"file" toml:"file" mapstructure:"file"`
	Value string `koanf:"value" json:"value" yaml:"value" toml:"value" mapstructure:"value"`
}

type KeyStoreConfig struct {
	// Keys maps logical names to key material configurations; see
	// KeyPairConfig for the accepted shapes.
	// Example names: "signing", "encryption", "legacy", "my-mac-key".
	Keys map[string]KeyPairConfig `koanf:"keys" json:"keys" yaml:"keys" toml:"keys" mapstructure:"keys"`

	// SecretMinLength is the minimum byte length enforced for symmetric secret
	// entries at startup. nil means the default applies
	// (DefaultKeyStoreSecretMinLength, 32), filled by normalize; a set value
	// can only raise the floor — anything below 32, the former 0 opt-out
	// included, is rejected by check (ADR-095). A pointer so the koanf and
	// literal doors both tell absent from explicit, see CONTEXT.md.
	SecretMinLength *int `koanf:"secretminlength" json:"secretminlength" yaml:"secretminlength" toml:"secretminlength" mapstructure:"secretminlength"`
}

type LifetimeConfig struct {
	// Max is the maximum duration a connection may be reused before closing.
	// This forces periodic connection recycling for memory hygiene, DNS re-resolution,
	// and server-side resource cleanup.
	// Default: 30m. Set to 0 for no lifetime limit (not recommended for cloud deployments).
	Max time.Duration `koanf:"max" json:"max" yaml:"max" toml:"max" mapstructure:"max"`
}

type LimitsConfig struct {
	Tenants int `koanf:"tenants" json:"tenants" yaml:"tenants" toml:"tenants" mapstructure:"tenants"`
}

type LogConfig struct {
	Level  string       `koanf:"level" json:"level" yaml:"level" toml:"level" mapstructure:"level"`
	Pretty bool         `koanf:"pretty" json:"pretty" yaml:"pretty" toml:"pretty" mapstructure:"pretty"`
	Output OutputConfig `koanf:"output" json:"output" yaml:"output" toml:"output" mapstructure:"output"`

	// SensitiveFields extends logger.DefaultFilterConfig with extra field
	// names whose values must be masked in log output. Matching is
	// case-insensitive substring on the field name, so "pan" masks "pan",
	// "card_pan", and "panHash" — not the reverse; "primary_account_number"
	// is its own default needle.
	// Use this for PAN variants and service-specific PII (SSN, tax ID, etc.) without writing
	// Go code. For full control over the FilterConfig (e.g., custom MaskValue
	// or opting out of defaults), set app.Options.LoggerFilterConfig instead;
	// that field takes precedence over this one.
	SensitiveFields []string `koanf:"sensitivefields" json:"sensitivefields" yaml:"sensitivefields" toml:"sensitivefields" mapstructure:"sensitivefields"`
}

type MessagingConfig struct {
	Broker    BrokerConfig        `koanf:"broker" json:"broker" yaml:"broker" toml:"broker" mapstructure:"broker"`
	Routing   RoutingConfig       `koanf:"routing" json:"routing" yaml:"routing" toml:"routing" mapstructure:"routing"`
	Headers   map[string]string   `koanf:"headers" json:"headers" yaml:"headers" toml:"headers" mapstructure:"headers"`
	Reconnect ReconnectConfig     `koanf:"reconnect" json:"reconnect" yaml:"reconnect" toml:"reconnect" mapstructure:"reconnect"`
	Publisher PublisherPoolConfig `koanf:"publisher" json:"publisher" yaml:"publisher" toml:"publisher" mapstructure:"publisher"`
	Streams   StreamsConfig       `koanf:"streams" json:"streams" yaml:"streams" toml:"streams" mapstructure:"streams"`

	// Tenancy selects which key the messaging kind's consumers and publishers are
	// resolved and replayed under when multitenant.enabled is true:
	//   - "per-tenant" (default): one client per tenant, replayed lazily from
	//     multitenant.tenants.<id>.messaging or the resource source.
	//   - "shared": one control-plane client resolved via the empty ("") key —
	//     the root messaging: block, or whatever a custom resource source returns
	//     for "". Consumers replay once at boot and the tenant travels as the
	//     x-tenant-id stamp. That is the contract this key names; it is served
	//     from the classic-lane slice onward, and the config layer accepts it
	//     first so the two land as reviewable steps. See wiki/messaging.md and
	//     ADR-087.
	// In single-tenant mode both values behave identically.
	Tenancy string `koanf:"tenancy" json:"tenancy" yaml:"tenancy" toml:"tenancy" mapstructure:"tenancy"`

	// Seal holds the producer-side AMQP payload-sealing settings.
	Seal SealConfig `koanf:"seal" json:"seal" yaml:"seal" toml:"seal" mapstructure:"seal"`

	// PublishTimeout is the aggregate per-publish bound: when set (> 0), the whole
	// publish — readiness pre-flight plus the entire retry loop — runs under a
	// context deadline of this duration, layered under any tighter caller deadline.
	// Unset or zero is unbounded (the pre-key behavior). Startup rejects a negative
	// value, and any value below messaging.reconnect.readytimeout +
	// messaging.reconnect.connectiontimeout, which could truncate a healthy
	// cold-path first attempt into a false failure. A value below
	// reconnect.maxpublishattempts × reconnect.connectiontimeout deliberately
	// lowers the effective retry count, and is accepted without a warning.
	// The bound governs waiting, not an in-flight socket write: waiting for the
	// publish slot is bounded by the deadline, the socket write is not.
	// amqp091-go's PublishWithContext checks the context only before it starts,
	// so a broker that stops reading can hold that one publish past the deadline
	// until the write returns; the publishers queued behind it acquire the slot
	// under their own context and are released at their own deadlines with
	// context.DeadlineExceeded.
	// See wiki/messaging.md#aggregate-publish-bound-publishtimeout.
	PublishTimeout time.Duration `koanf:"publishtimeout" json:"publishtimeout" yaml:"publishtimeout" toml:"publishtimeout" mapstructure:"publishtimeout"`
}

type MultitenantConfig struct {
	Enabled  bool                   `koanf:"enabled" json:"enabled" yaml:"enabled" toml:"enabled" mapstructure:"enabled"`
	Resolver ResolverConfig         `koanf:"resolver" json:"resolver" yaml:"resolver" toml:"resolver" mapstructure:"resolver"`
	Limits   LimitsConfig           `koanf:"limits" json:"limits" yaml:"limits" toml:"limits" mapstructure:"limits"`
	Tenants  map[string]TenantEntry `koanf:"tenants" json:"tenants" yaml:"tenants" toml:"tenants" mapstructure:"tenants"`
}

type OracleConfig struct {
	Service ServiceConfig `koanf:"service" json:"service" yaml:"service" toml:"service" mapstructure:"service"`
}

type OutboxConfig struct {
	// Enabled activates the transactional outbox pattern.
	// When false, the outbox module is a no-op and deps.Outbox is nil.
	Enabled bool `koanf:"enabled" json:"enabled" yaml:"enabled" toml:"enabled" mapstructure:"enabled"`

	// TableName is the outbox table name in the database.
	// The table segment is bounded at 49 bytes so every identifier derived from it — the
	// "idx_<name>_published" index and the "<name>_leader" companion table — stays distinct
	// under PostgreSQL's 63-byte truncation.
	// Default: "gobricks_outbox".
	TableName string `koanf:"tablename" json:"tablename" yaml:"tablename" toml:"tablename" mapstructure:"tablename"`

	// AutoCreateTable creates the outbox table on first use if it doesn't exist.
	// Default: false (opt-in). Set true to auto-create (e.g. in development); leave
	// false in production with managed migrations.
	AutoCreateTable bool `koanf:"autocreatetable" json:"autocreatetable" yaml:"autocreatetable" toml:"autocreatetable" mapstructure:"autocreatetable"`

	// DefaultExchange is the fallback AMQP exchange when Event.Exchange is empty.
	// Default: "" (empty, which publishes to the default exchange). It must fit the AMQP
	// shortstr limit (255 bytes) — a longer value makes every event that falls back to it
	// unpublishable, so the outbox module fails to start.
	DefaultExchange string `koanf:"defaultexchange" json:"defaultexchange" yaml:"defaultexchange" toml:"defaultexchange" mapstructure:"defaultexchange"`

	// PollInterval is how often the relay checks for pending events.
	// Default: 5s. Lower values reduce latency but increase database load.
	PollInterval time.Duration `koanf:"pollinterval" json:"pollinterval" yaml:"pollinterval" toml:"pollinterval" mapstructure:"pollinterval"`

	// BatchSize is the maximum number of events processed per relay cycle.
	// Default: 100. Higher values improve throughput but increase memory usage.
	BatchSize int `koanf:"batchsize" json:"batchsize" yaml:"batchsize" toml:"batchsize" mapstructure:"batchsize"`

	// MaxRetries is the retry ceiling after which a *poison* event — one of the
	// deterministic, broker-independent classes enumerated in wiki/outbox.md under
	// Retry & Dead-Lettering — is dead-lettered to status "failed" and stops being
	// retried. Connectivity failures (broker down, NACK, confirmation timeout) advance
	// retry_count but are NEVER dead-lettered by this count, so neither a prolonged outage
	// nor a transient broker fault can park healthy events. Default: 5.
	MaxRetries int `koanf:"maxretries" json:"maxretries" yaml:"maxretries" toml:"maxretries" mapstructure:"maxretries"`

	// RetentionPeriod is how long published events are kept before cleanup.
	// Set to 0 to disable automatic cleanup.
	// Default: 72h.
	RetentionPeriod time.Duration `koanf:"retentionperiod" json:"retentionperiod" yaml:"retentionperiod" toml:"retentionperiod" mapstructure:"retentionperiod"`

	// PublishTimeout bounds a single relay publish attempt so one stuck record cannot
	// block the whole relay cycle (and starve the rest of the batch). It MUST be >=
	// messaging.reconnect.connectiontimeout — the outbox module fails to start otherwise,
	// because a shorter value truncates every legitimate confirmation into a false failure
	// and re-publishes the (already-delivered) event every cycle. Default: 60s.
	PublishTimeout time.Duration `koanf:"publishtimeout" json:"publishtimeout" yaml:"publishtimeout" toml:"publishtimeout" mapstructure:"publishtimeout"`

	// Tenancy selects where the ledger lives when multitenant.enabled is true:
	//   - "per-tenant" (default): one ledger per tenant DB; relay/cleanup fan out
	//     across static multitenant.tenants.
	//   - "shared": one control-plane ledger resolved via the empty ("") key —
	//     the root database:/messaging: blocks for the built-in store, or
	//     whatever a custom resource source returns for "". Relay/cleanup run a
	//     single pass. See wiki/outbox.md and ADR-041.
	// In single-tenant mode both values behave identically.
	Tenancy string `koanf:"tenancy" json:"tenancy" yaml:"tenancy" toml:"tenancy" mapstructure:"tenancy"`

	// SuperStreams lists the super streams the relay may publish to over the native streams
	// lane. Each name must be declared as a super stream by a module's DeclareStreams; the
	// outbox declares its own publisher for each. Requires messaging.streams.uri.
	// Default: none — every event stays on the AMQP lane.
	// Listing a name here declares one publisher for it, so a super stream the outbox
	// targets cannot also be published to directly by another module in the process.
	SuperStreams []string `koanf:"superstreams" json:"superstreams" yaml:"superstreams" toml:"superstreams" mapstructure:"superstreams"`
}

type OutputConfig struct {
	Format string `koanf:"format" json:"format" yaml:"format" toml:"format" mapstructure:"format"`
	File   string `koanf:"file" json:"file" yaml:"file" toml:"file" mapstructure:"file"`
}

type PKCS12SourceConfig struct {
	File     string               `koanf:"file" json:"file" yaml:"file" toml:"file" mapstructure:"file"`
	Value    string               `koanf:"value" json:"value" yaml:"value" toml:"value" mapstructure:"value"`
	Password PasswordSourceConfig `koanf:"password" json:"password" yaml:"password" toml:"password" mapstructure:"password"`
}

type PasswordSourceConfig struct {
	Env  string `koanf:"env" json:"env" yaml:"env" toml:"env" mapstructure:"env"`
	File string `koanf:"file" json:"file" yaml:"file" toml:"file" mapstructure:"file"`
}

type PathConfig struct {
	Base   string `koanf:"base" json:"base" yaml:"base" toml:"base" mapstructure:"base"`
	Health string `koanf:"health" json:"health" yaml:"health" toml:"health" mapstructure:"health"`
	Ready  string `koanf:"ready" json:"ready" yaml:"ready" toml:"ready" mapstructure:"ready"`
}

type PathResolverConfig struct {
	Segment int    `koanf:"segment" json:"segment" yaml:"segment" toml:"segment" mapstructure:"segment"`
	Prefix  string `koanf:"prefix" json:"prefix" yaml:"prefix" toml:"prefix" mapstructure:"prefix"`
}

type PoolConfig struct {
	Max       PoolMaxConfig       `koanf:"max" json:"max" yaml:"max" toml:"max" mapstructure:"max"`
	Idle      PoolIdleConfig      `koanf:"idle" json:"idle" yaml:"idle" toml:"idle" mapstructure:"idle"`
	Lifetime  LifetimeConfig      `koanf:"lifetime" json:"lifetime" yaml:"lifetime" toml:"lifetime" mapstructure:"lifetime"`
	KeepAlive PoolKeepAliveConfig `koanf:"keepalive" json:"keepalive" yaml:"keepalive" toml:"keepalive" mapstructure:"keepalive"`
}

type PoolIdleConfig struct {
	// Connections is the maximum number of idle connections kept open in the pool.
	// This is a cap (database/sql clamps it to Max.Connections), not a floor — the
	// pool does not pre-warm connections.
	// Default: tracks Max.Connections. Keeping idle below max causes the pool to
	// churn physical connections under sustained load; set a lower value only when
	// you deliberately want to release idle connections back to the database.
	Connections int32 `koanf:"connections" json:"connections" yaml:"connections" toml:"connections" mapstructure:"connections"`

	// Time is the maximum duration an idle connection may remain unused before closing.
	// This prevents stale connections from accumulating when traffic decreases.
	// Default: 5m. Should be shorter than NAT/firewall idle timeouts (AWS: 350s, GCP: 30s).
	// Combined with KeepAlive, connections are recycled before becoming stale.
	Time time.Duration `koanf:"time" json:"time" yaml:"time" toml:"time" mapstructure:"time"`
}

type PoolKeepAliveConfig struct {
	// Enabled enables TCP keep-alive probes on database connections.
	// Default: true. Recommended for all cloud deployments.
	//
	// A pointer is used so an absent key (nil) is distinguishable from an
	// explicit false: validation defaults nil to true, but an explicit
	// enabled=false is always honored — even when Interval is left at its
	// zero default. Use IsEnabled for nil-safe reads.
	Enabled *bool `koanf:"enabled" json:"enabled" yaml:"enabled" toml:"enabled" mapstructure:"enabled"`

	// Interval is the time between keep-alive probes (TCP_KEEPINTVL).
	// The kernel sends a probe every Interval to keep the connection alive.
	// Default: 60s. Should be less than NAT/LB idle timeout (AWS: 350s, GCP: 600s).
	Interval time.Duration `koanf:"interval" json:"interval" yaml:"interval" toml:"interval" mapstructure:"interval"`
}

type PoolMaxConfig struct {
	// Connections is the maximum number of open connections to the database.
	// Default: 25. Set based on your workload and database server capacity.
	Connections int32 `koanf:"connections" json:"connections" yaml:"connections" toml:"connections" mapstructure:"connections"`
}

type PostgreSQLConfig struct {
	Schema string `koanf:"schema" json:"schema" yaml:"schema" toml:"schema" mapstructure:"schema"`
}

type PublisherPoolConfig struct {
	// MaxCached is the maximum number of publisher clients to keep in the cache.
	// Default: 50. Set higher for applications with many tenants.
	MaxCached int `koanf:"maxcached" json:"maxcached" yaml:"maxcached" toml:"maxcached" mapstructure:"maxcached"`

	// IdleTTL is the time after which idle publisher clients are evicted.
	// Default: 1h when multitenant.enabled is false, 10m when true (see
	// config/messaging_section.go: applyMessagingDefaults). Set lower for
	// memory-constrained environments.
	IdleTTL time.Duration `koanf:"idlettl" json:"idlettl" yaml:"idlettl" toml:"idlettl" mapstructure:"idlettl"`

	// CleanupInterval is how often the publisher-pool cleanup goroutine runs.
	// Default: 2m. Should be less than IdleTTL for effective cleanup.
	CleanupInterval time.Duration `koanf:"cleanupinterval" json:"cleanupinterval" yaml:"cleanupinterval" toml:"cleanupinterval" mapstructure:"cleanupinterval"`
}

type QueryConfig struct {
	Slow SlowQueryConfig `koanf:"slow" json:"slow" yaml:"slow" toml:"slow" mapstructure:"slow"`
	Log  QueryLogConfig  `koanf:"log" json:"log" yaml:"log" toml:"log" mapstructure:"log"`
}

type QueryLogConfig struct {
	Parameters bool `koanf:"parameters" json:"parameters" yaml:"parameters" toml:"parameters" mapstructure:"parameters"`
	MaxLength  int  `koanf:"max" json:"max" yaml:"max" toml:"max" mapstructure:"max"`
}

type RateConfig struct {
	Limit      int              `koanf:"limit" json:"limit" yaml:"limit" toml:"limit" mapstructure:"limit"`
	Burst      int              `koanf:"burst" json:"burst" yaml:"burst" toml:"burst" mapstructure:"burst"`
	IPPreGuard IPPreGuardConfig `koanf:"ippreguard" json:"ippreguard" yaml:"ippreguard" toml:"ippreguard" mapstructure:"ippreguard"`
}

type ReconnectConfig struct {
	// Delay is the initial delay between reconnection attempts.
	// Default: 5s. Set higher for unstable networks.
	Delay time.Duration `koanf:"delay" json:"delay" yaml:"delay" toml:"delay" mapstructure:"delay"`

	// ReinitDelay is the delay before channel reinitialization after failure.
	// Default: 2s.
	ReinitDelay time.Duration `koanf:"reinitdelay" json:"reinitdelay" yaml:"reinitdelay" toml:"reinitdelay" mapstructure:"reinitdelay"`

	// ResendDelay is the delay before retrying a failed publish operation.
	// Default: 5s.
	ResendDelay time.Duration `koanf:"resenddelay" json:"resenddelay" yaml:"resenddelay" toml:"resenddelay" mapstructure:"resenddelay"`

	// ConnectionTimeout is the per-publish broker confirmation timeout — how long a
	// confirmed publish waits for the broker's ACK/NACK before the attempt is retried.
	// The TCP/AMQP connection dial itself is bounded by amqp091-go's amqp.Dial default,
	// not by this value. Default: 30s. Set higher for high-latency networks.
	ConnectionTimeout time.Duration `` /* 133-byte string literal not displayed */

	// ReadyTimeout bounds how long a publish will wait, before entering the
	// bounded retry loop, for a not-yet-ready client (cold start or
	// mid-reconnect) to become ready. The wait does not consume a
	// MaxPublishAttempts slot. Default: 5s. Must be >= 0.
	ReadyTimeout time.Duration `koanf:"readytimeout" json:"readytimeout" yaml:"readytimeout" toml:"readytimeout" mapstructure:"readytimeout"`

	// MaxPublishAttempts bounds the per-publish retry loop: after this many failed
	// attempts a publish returns an error instead of retrying forever. This is what
	// lets the outbox relay regain control and advance an event's retry_count.
	// Default: 5. Must be >= 1 (0 applies the default).
	MaxPublishAttempts int `` /* 138-byte string literal not displayed */

	// MaxDelay is the maximum delay for exponential backoff during reconnection.
	// Default: 60s. Prevents unbounded delays during prolonged outages.
	MaxDelay time.Duration `koanf:"maxdelay" json:"maxdelay" yaml:"maxdelay" toml:"maxdelay" mapstructure:"maxdelay"`
}

type RedisConfig struct {
	Host            string        `koanf:"host" json:"host" yaml:"host" toml:"host" mapstructure:"host"`
	Port            int           `koanf:"port" json:"port" yaml:"port" toml:"port" mapstructure:"port"`
	Password        string        `koanf:"password" json:"password" yaml:"password" toml:"password" mapstructure:"password"`
	Database        int           `koanf:"database" json:"database" yaml:"database" toml:"database" mapstructure:"database"`
	PoolSize        int           `koanf:"poolsize" json:"poolsize" yaml:"poolsize" toml:"poolsize" mapstructure:"poolsize"`
	DialTimeout     time.Duration `koanf:"dialtimeout" json:"dialtimeout" yaml:"dialtimeout" toml:"dialtimeout" mapstructure:"dialtimeout"`
	ReadTimeout     time.Duration `koanf:"readtimeout" json:"readtimeout" yaml:"readtimeout" toml:"readtimeout" mapstructure:"readtimeout"`
	WriteTimeout    time.Duration `koanf:"writetimeout" json:"writetimeout" yaml:"writetimeout" toml:"writetimeout" mapstructure:"writetimeout"`
	MaxRetries      int           `koanf:"maxretries" json:"maxretries" yaml:"maxretries" toml:"maxretries" mapstructure:"maxretries"`
	MinRetryBackoff time.Duration `koanf:"minretrybackoff" json:"minretrybackoff" yaml:"minretrybackoff" toml:"minretrybackoff" mapstructure:"minretrybackoff"`
	MaxRetryBackoff time.Duration `koanf:"maxretrybackoff" json:"maxretrybackoff" yaml:"maxretrybackoff" toml:"maxretrybackoff" mapstructure:"maxretrybackoff"`
}

type ResolverConfig struct {
	Type    string             `koanf:"type" json:"type" yaml:"type" toml:"type" mapstructure:"type"`                // header, subdomain, path, composite
	Header  string             `koanf:"header" json:"header" yaml:"header" toml:"header" mapstructure:"header"`      // default: X-Tenant-ID
	Domain  string             `koanf:"domain" json:"domain" yaml:"domain" toml:"domain" mapstructure:"domain"`      // e.g., api.example.com or .api.example.com (leading dot optional)
	Proxies bool               `koanf:"proxies" json:"proxies" yaml:"proxies" toml:"proxies" mapstructure:"proxies"` // trust X-Forwarded-Host
	Path    PathResolverConfig `koanf:"path" json:"path" yaml:"path" toml:"path" mapstructure:"path"`                // path-segment resolver settings
	// Order controls composite sub-resolver precedence (type: composite only) and
	// is REQUIRED when type is composite — there is no implicit default; a
	// composite config with an empty Order fails validation. Valid entries:
	// header, subdomain, path. A sub-resolver named in Order must also be
	// configured: Validate REJECTS a composite naming path without
	// path.segment > 0, or subdomain without a domain. (Only a config that
	// bypasses Validate entirely reaches the builder, where an unconfigured
	// sub-resolver is skipped instead.) See DefaultResolverOrder for the
	// recommended value and the rationale for not defaulting it.
	Order []string `koanf:"order" json:"order" yaml:"order" toml:"order" mapstructure:"order"`
}

type ResponseTimeConfig struct {
	// Enabled adds an X-Response-Time response header (per-request processing
	// time) when true. Default false: the header costs a per-response header
	// allocation and OTel provides richer latency telemetry. Opt in for local
	// debugging or when a consumer depends on the header.
	Enabled bool `koanf:"enabled" json:"enabled" yaml:"enabled" toml:"enabled" mapstructure:"enabled"`
}

type RoutingConfig struct {
	Exchange string `koanf:"exchange" json:"exchange" yaml:"exchange" toml:"exchange" mapstructure:"exchange"`
	Key      string `koanf:"key" json:"key" yaml:"key" toml:"key" mapstructure:"key"`
}

type SchedulerConfig struct {
	Security SchedulerSecurityConfig `koanf:"security" json:"security" yaml:"security" toml:"security" mapstructure:"security"`
	Timeout  SchedulerTimeoutConfig  `koanf:"timeout" json:"timeout" yaml:"timeout" toml:"timeout" mapstructure:"timeout"`

	// Timezone is the IANA timezone name the scheduler uses to interpret
	// wall-clock schedules (DailyAt/WeeklyAt/MonthlyAt/HourlyAt). Validated via
	// time.LoadLocation at startup (fail-fast on invalid names).
	// Default: "UTC". Set to "-" to use the host's local time (legacy behavior).
	// The literal "Local" is rejected; "-" is the only host-local spelling (ADR-093).
	Timezone string `koanf:"timezone" json:"timezone" yaml:"timezone" toml:"timezone" mapstructure:"timezone"`
}

type SchedulerSecurityConfig struct {
	// CIDRAllowlist holds CIDR ranges allowed to access /_sys/job* endpoints.
	// Empty list = localhost-only access (127.0.0.1, ::1).
	// Non-empty list = restrict to matching IP ranges only.
	CIDRAllowlist []string `koanf:"cidrallowlist" json:"cidrallowlist" yaml:"cidrallowlist" toml:"cidrallowlist" mapstructure:"cidrallowlist"`

	// TrustedProxies holds CIDR ranges of trusted reverse proxies.
	// X-Forwarded-For is ONLY honored if the immediate peer matches one of these CIDR
	// ranges. Empty list = do not trust any proxy headers. X-Real-IP is never honored
	// (ADR-057, completed by ADR-080). A default route is rejected at startup.
	TrustedProxies []string `koanf:"trustedproxies" json:"trustedproxies" yaml:"trustedproxies" toml:"trustedproxies" mapstructure:"trustedproxies"`
}

type SchedulerTimeoutConfig struct {
	// Shutdown is the graceful shutdown timeout for in-flight jobs.
	// Zero applies the default; negative is rejected. Default: 30s.
	Shutdown time.Duration `koanf:"shutdown" json:"shutdown" yaml:"shutdown" toml:"shutdown" mapstructure:"shutdown"`

	// SlowJob is the execution duration threshold for marking jobs as slow.
	// Jobs exceeding this duration are logged with result_code="WARN" even if successful.
	// Zero applies the default; negative is rejected. Default: 25s.
	SlowJob time.Duration `koanf:"slowjob" json:"slowjob" yaml:"slowjob" toml:"slowjob" mapstructure:"slowjob"`
}

type SealConfig struct {
	// Active is the Activation selector: Logical kid -> generation ("v2") that
	// seals new traffic. Its domain is every Logical kid the producer resolves,
	// sign and encrypt alike. Absent for a family with exactly one provisioned
	// generation, that one is active; with several, startup refuses to guess.
	// The value grammar is ^v[1-9][0-9]*$ (checked here); resolution against
	// the keystore is keystore.ActiveGeneration. Environment form:
	// MESSAGING_SEAL_ACTIVE_<LOGICAL>=v2 — a hyphenated Logical kid is settable
	// only where the runtime permits '-' in a variable name (ADR-090).
	Active map[string]string `koanf:"active" json:"active" yaml:"active" toml:"active" mapstructure:"active"`
}

type ServerConfig struct {
	Host    string        `koanf:"host" json:"host" yaml:"host" toml:"host" mapstructure:"host"`
	Port    int           `koanf:"port" json:"port" yaml:"port" toml:"port" mapstructure:"port"`
	Timeout TimeoutConfig `koanf:"timeout" json:"timeout" yaml:"timeout" toml:"timeout" mapstructure:"timeout"`
	Path    PathConfig    `koanf:"path" json:"path" yaml:"path" toml:"path" mapstructure:"path"`
	Gzip    GzipConfig    `koanf:"gzip" json:"gzip" yaml:"gzip" toml:"gzip" mapstructure:"gzip"`

	TLS ServerTLSConfig `koanf:"tls" json:"tls" yaml:"tls" toml:"tls" mapstructure:"tls"`

	ForwardedClientCert ForwardedClientCertConfig `` /* 143-byte string literal not displayed */

	// TrustedProxies holds CIDR ranges of reverse proxies whose
	// X-Forwarded-For entries are believed when deriving the client IP for
	// rate limiting and request logging. Loopback, link-local and RFC1918
	// ranges are trusted by default, so a service behind an in-VPC load
	// balancer needs no entry here; add one only when a proxy sits on a
	// public address. An invalid entry fails startup rather than silently
	// changing who is trusted.
	TrustedProxies []string `koanf:"trustedproxies" json:"trustedproxies" yaml:"trustedproxies" toml:"trustedproxies" mapstructure:"trustedproxies"`

	// BodyLimit is the maximum request body size in bytes. A value of 0 is filled
	// with the framework default (10 MB) by config normalization; a negative value
	// is rejected by config validation.
	BodyLimit int64 `koanf:"bodylimit" json:"bodylimit" yaml:"bodylimit" toml:"bodylimit" mapstructure:"bodylimit"`

	ResponseTime ResponseTimeConfig `koanf:"responsetime" json:"responsetime" yaml:"responsetime" toml:"responsetime" mapstructure:"responsetime"`

	// LogRoutes toggles the per-route "Route registered" startup log lines
	// (one Info line per registered HTTP route). Pointer tri-state: an explicit
	// server.logroutes value always wins; an absent key (nil) defaults to
	// app-env development via Config.ShouldLogRoutes (on in dev/local, off in
	// prod/staging), so a large service pays zero extra boot lines in production
	// unless an operator opts in. Env override: SERVER_LOGROUTES.
	LogRoutes *bool `koanf:"logroutes" json:"logroutes" yaml:"logroutes" toml:"logroutes" mapstructure:"logroutes"`
}

type ServerTLSConfig struct {
	Enabled bool `koanf:"enabled" json:"enabled" yaml:"enabled" toml:"enabled" mapstructure:"enabled"`

	CertFile  string `koanf:"certfile" json:"certfile" yaml:"certfile" toml:"certfile" mapstructure:"certfile"`
	CertValue string `koanf:"certvalue" json:"certvalue" yaml:"certvalue" toml:"certvalue" mapstructure:"certvalue"`
	KeyFile   string `koanf:"keyfile" json:"keyfile" yaml:"keyfile" toml:"keyfile" mapstructure:"keyfile"`
	KeyValue  string `koanf:"keyvalue" json:"keyvalue" yaml:"keyvalue" toml:"keyvalue" mapstructure:"keyvalue"`

	// MinVersion: "" or "1.2" (default floor) | "1.3".
	MinVersion string `koanf:"minversion" json:"minversion" yaml:"minversion" toml:"minversion" mapstructure:"minversion"`
}

type ServiceConfig struct {
	Name string `koanf:"name" json:"name" yaml:"name" toml:"name" mapstructure:"name"`
	SID  string `koanf:"sid" json:"sid" yaml:"sid" toml:"sid" mapstructure:"sid"`
}

type SlowQueryConfig struct {
	Threshold time.Duration `koanf:"threshold" json:"threshold" yaml:"threshold" toml:"threshold" mapstructure:"threshold"`
	Enabled   bool          `koanf:"enabled" json:"enabled" yaml:"enabled" toml:"enabled" mapstructure:"enabled"`
}

type SourceConfig struct {
	Type string `koanf:"type" json:"type" yaml:"type" toml:"type" mapstructure:"type"` // SourceTypeStatic for YAML config, SourceTypeDynamic for external stores
}

type StartupConfig struct {
	// Timeout is the overall startup timeout (fallback when component-specific not set).
	// Default: 10s.
	Timeout time.Duration `koanf:"timeout" json:"timeout" yaml:"timeout" toml:"timeout" mapstructure:"timeout"`

	// Database is the timeout for database health check during startup.
	// Default: 10s. Set higher for slow network connections.
	Database time.Duration `koanf:"database" json:"database" yaml:"database" toml:"database" mapstructure:"database"`

	// Messaging is the timeout for broker connection during startup.
	// Default: 10s. Set higher for cluster failover scenarios.
	Messaging time.Duration `koanf:"messaging" json:"messaging" yaml:"messaging" toml:"messaging" mapstructure:"messaging"`

	// Cache is the timeout for cache initialization during startup.
	// Default: 5s. Cache is fast to connect; lower timeout prevents blocking.
	Cache time.Duration `koanf:"cache" json:"cache" yaml:"cache" toml:"cache" mapstructure:"cache"`

	// Observability is the timeout for OTLP provider initialization.
	// Default: 15s. Remote OTLP endpoints may need extra time for TLS handshake.
	Observability time.Duration `koanf:"observability" json:"observability" yaml:"observability" toml:"observability" mapstructure:"observability"`
}

type StreamsAddressResolverConfig struct {
	// Host is the entry-point hostname clients dial instead of the address the
	// broker advertises in its metadata response.
	Host string `koanf:"host" json:"host" yaml:"host" toml:"host" mapstructure:"host"`

	// Port is the entry-point port. Must be 1-65535 when Host is set.
	Port int `koanf:"port" json:"port" yaml:"port" toml:"port" mapstructure:"port"`
}

type StreamsConfig struct {
	// URI is the stream-protocol endpoint, scheme rabbitmq-stream:// (or
	// rabbitmq-stream+tls://), default port 5552. Required when any module
	// declares stream consumers. Deliberately NOT derived from
	// messaging.broker.url — the stream protocol is a separate listener that a
	// deployment may not expose at all (explicit > implicit).
	URI string `koanf:"uri" json:"uri" yaml:"uri" toml:"uri" mapstructure:"uri"`

	// AddressResolver pins the client to a single entry point (load balancer,
	// NAT, or Docker port mapping), which the broker's own metadata cannot
	// describe. Set both fields or neither.
	AddressResolver StreamsAddressResolverConfig `koanf:"addressresolver" json:"addressresolver" yaml:"addressresolver" toml:"addressresolver" mapstructure:"addressresolver"`

	// OffsetStore tunes how often successfully handled offsets are committed
	// server-side.
	OffsetStore StreamsOffsetStoreConfig `koanf:"offsetstore" json:"offsetstore" yaml:"offsetstore" toml:"offsetstore" mapstructure:"offsetstore"`
}

type StreamsOffsetStoreConfig struct {
	// CountBeforeStorage is how many successfully handled messages accumulate
	// before the offset is committed. Default: 500. Must be >= 0 (0 applies the default).
	CountBeforeStorage int `` /* 138-byte string literal not displayed */

	// FlushInterval is how long after the last commit a pending offset is
	// committed even if CountBeforeStorage was not reached. Default: 5s.
	// Must be >= 0 (0 applies the default).
	FlushInterval time.Duration `koanf:"flushinterval" json:"flushinterval" yaml:"flushinterval" toml:"flushinterval" mapstructure:"flushinterval"`
}

type TLSConfig struct {
	Mode     string `koanf:"mode" json:"mode" yaml:"mode" toml:"mode" mapstructure:"mode"`
	CertFile string `koanf:"cert" json:"cert" yaml:"cert" toml:"cert" mapstructure:"cert"`
	KeyFile  string `koanf:"key" json:"key" yaml:"key" toml:"key" mapstructure:"key"`
	CAFile   string `koanf:"ca" json:"ca" yaml:"ca" toml:"ca" mapstructure:"ca"`
}

type TenantEntry struct {
	Database  DatabaseConfig        `koanf:"database" json:"database" yaml:"database" toml:"database" mapstructure:"database"`
	Messaging TenantMessagingConfig `koanf:"messaging" json:"messaging" yaml:"messaging" toml:"messaging" mapstructure:"messaging"`
	Cache     CacheConfig           `koanf:"cache" json:"cache" yaml:"cache" toml:"cache" mapstructure:"cache"`
}

type TenantMessagingConfig struct {
	URL string `koanf:"url" json:"url" yaml:"url" toml:"url" mapstructure:"url"`
}

type TenantStore struct {
	// contains filtered or unexported fields
}

type TimeoutConfig struct {
	Read       time.Duration `koanf:"read" json:"read" yaml:"read" toml:"read" mapstructure:"read"`
	Write      time.Duration `koanf:"write" json:"write" yaml:"write" toml:"write" mapstructure:"write"`
	Idle       time.Duration `koanf:"idle" json:"idle" yaml:"idle" toml:"idle" mapstructure:"idle"`
	Middleware time.Duration `koanf:"middleware" json:"middleware" yaml:"middleware" toml:"middleware" mapstructure:"middleware"`
	Shutdown   time.Duration `koanf:"shutdown" json:"shutdown" yaml:"shutdown" toml:"shutdown" mapstructure:"shutdown"`
}