config

type AuthConfig struct {
	// Enabled controls whether authentication is required
	Enabled bool
	// InitialUsername is the default admin username
	InitialUsername string
	// InitialPassword is the default admin password
	InitialPassword string
	// MinPasswordLength for password policy
	MinPasswordLength int
	// TokenExpiry for JWT tokens
	TokenExpiry time.Duration
	// JWTSecret for signing tokens
	JWTSecret string
}

type ComplianceConfig struct {
	// AuditLogging - Required by: GDPR Art.30, HIPAA §164.312(b), FISMA, SOC2
	AuditEnabled       bool
	AuditLogPath       string
	AuditRetentionDays int // How long to keep audit logs (HIPAA: 6 years, SOC2: 7 years)

	// Data Retention - Required by: GDPR Art.5(1)(e), HIPAA §164.530(j)
	// Retention is opt-in and disabled by default.
	RetentionEnabled     bool
	RetentionPolicyDays  int      // Default retention period (0 = indefinite)
	RetentionAutoDelete  bool     // Auto-delete vs archive after retention
	RetentionExemptRoles []string // Roles exempt from retention (default "admin" matches auth.RoleAdmin; config cannot import auth due to cycle)

	// Access Control - Required by: GDPR Art.32, HIPAA §164.312(a), FISMA
	AccessControlEnabled bool
	SessionTimeout       time.Duration
	MaxFailedLogins      int
	LockoutDuration      time.Duration

	// Encryption - Required by: GDPR Art.32, HIPAA §164.312(a)(2)(iv)
	EncryptionAtRest    bool
	EncryptionInTransit bool
	EncryptionKeyPath   string

	// Data Subject Rights - Required by: GDPR Art.15-20
	DataExportEnabled  bool // Right to data portability
	DataErasureEnabled bool // Right to erasure/be forgotten
	DataAccessEnabled  bool // Right of access
	// SubjectIdentifierProperties lists properties used to associate a node with a data subject.
	// Nodes are considered owned by a subject when any configured property matches the subject ID.
	SubjectIdentifierProperties []string
	// SubjectPseudonymizeProperties lists properties whose values should be replaced with an anonymized token.
	// When empty, SubjectIdentifierProperties are used.
	SubjectPseudonymizeProperties []string
	// SubjectRedactProperties lists properties to remove from matching nodes during anonymization.
	SubjectRedactProperties []string

	// Anonymization - Required by: GDPR Recital 26
	AnonymizationEnabled bool
	AnonymizationMethod  string // "pseudonymization", "generalization", "suppression"

	// Consent - Required by: GDPR Art.7
	ConsentRequired   bool
	ConsentVersioning bool
	ConsentAuditTrail bool

	// Breach Notification - Required by: GDPR Art.33-34, HIPAA §164.408
	BreachDetectionEnabled bool
	BreachNotifyEmail      string
	BreachNotifyWebhook    string
}

type Config struct {
	// Authentication (NORNICDB_AUTH format: "username/password" or "none")
	Auth AuthConfig

	// Database settings
	Database DatabaseConfig

	// Storage holds runtime-only storage settings (Plan 04-04). Distinct
	// from Database which mirrors ENV/YAML on-disk schema.
	Storage StorageRuntimeConfig

	// Server settings
	Server ServerConfig

	// Memory/Decay settings (NornicDB-specific)
	Memory MemoryConfig

	// Embedding worker settings (NornicDB-specific)
	EmbeddingWorker EmbeddingWorkerConfig

	// Compliance settings for GDPR/HIPAA/FISMA/SOC2 (NornicDB-specific)
	Compliance ComplianceConfig

	// Retention settings (extended, label-aware)
	Retention RetentionConfig

	// Logging
	Logging LoggingConfig

	// Observability holds telemetry config (metrics, tracing, pprof).
	// Phase 1 introduces this; Phase 2 wires slog from Logging.
	Observability observability.ObservabilityConfig

	// Feature flags for experimental/optional features
	Features FeatureFlagsConfig

	// Logger is the structured *slog.Logger threaded into storage and other
	// runtime subsystems by Phase 2 D-01 logger DI. Optional; nil falls
	// back to discard handlers at storage ctor entry per D-01a. Marked
	// yaml:"-" / json:"-" because it is a runtime-only handle that must
	// not appear in YAML/JSON config payloads.
	Logger *slog.Logger `yaml:"-" json:"-"`

	// PerDBOverrides carries the yaml-declared `databases:` map (loaded
	// from LoadFromFile). The server applies these to dbconfig.Store at
	// boot ONLY when the store has no row for that (dbName, key) pair
	// yet — admin API edits remain authoritative across restarts.
	// Empty/nil for callers that didn't go through LoadFromFile.
	PerDBOverrides map[string]map[string]string `yaml:"-" json:"-"`

	// DeferSearchWarmup tells nornicdb.Open NOT to start the per-DB
	// search-index warmup until the caller explicitly calls
	// db.MarkSearchWarmupReady(). The wiring layer (pkg/server) sets
	// this so it can install the per-DB flags resolver before any
	// warmup goroutine reads it.
	//
	// Default false: Open kicks the warmup gate open before returning
	// so embedded callers (scripts, tests, anyone using the Open +
	// query pattern without a server layer) get today's behaviour with
	// no extra wiring. Setting it true is opt-in and carries the
	// contract that the caller must release the gate; if they forget,
	// search warmup blocks indefinitely. Runtime-only; never serialized.
	DeferSearchWarmup bool `yaml:"-" json:"-"`

	// CLIOverrides captures values that were explicitly set on the
	// command line (only keys where cmd.Flags().Changed(...) is true).
	// Treated as the highest-precedence source by dbconfig.Resolve so
	// an operator's explicit `--search-bm25-enabled=false` at boot
	// overrides any per-DB stored value, YAML, or env. CLI is the
	// kill switch — when an operator types it during an incident, it
	// must take effect even if a tenant's per-DB configuration says
	// otherwise.
	//
	// Keys are the canonical NORNICDB_* env-var names (e.g.
	// NORNICDB_SEARCH_BM25_ENABLED) so the resolver can use the same
	// override key namespace it already uses for dbconfig store
	// entries. Values are stringified to match the dbconfig store's
	// schema. Nil/empty for non-CLI callers; that branch falls back
	// to the existing per-DB > global precedence.
	//
	// Runtime-only; never serialized to YAML/JSON.
	CLIOverrides map[string]string `yaml:"-" json:"-"`
}

type DatabaseConfig struct {
	// DataDir is the directory for data storage
	DataDir string
	// DefaultDatabase name
	DefaultDatabase string
	// ReadOnly mode
	ReadOnly bool
	// TransactionTimeout for long-running queries
	TransactionTimeout time.Duration
	// MaxConcurrentTransactions limit
	MaxConcurrentTransactions int

	// WALSyncMode controls when WAL writes are synced to disk.
	// - "batch" (default): fsync every WALSyncInterval - good balance
	// - "immediate": fsync after each write - safest but 2-5x slower
	// - "none": no fsync - fastest but data loss on crash
	// Environment: NORNICDB_WAL_SYNC_MODE
	WALSyncMode string

	// WALSyncInterval for batch sync mode (default: 100ms).
	// Smaller = safer but slower, larger = faster but more data at risk.
	// Environment: NORNICDB_WAL_SYNC_INTERVAL
	WALSyncInterval time.Duration

	// WALAutoCompactionEnabled controls automatic snapshots + WAL truncation.
	// Default: true (preserves existing behavior).
	// Environment: NORNICDB_WAL_AUTO_COMPACTION_ENABLED
	WALAutoCompactionEnabled bool

	// StrictDurability enables maximum safety settings (opt-in):
	// - WAL: immediate sync (fsync every write)
	// - Badger: SyncWrites=true
	// - AsyncEngine: smaller flush interval (10ms)
	// WARNING: 2-5x slower writes. Use for financial/critical data only.
	// Environment: NORNICDB_STRICT_DURABILITY
	StrictDurability bool

	// WALRetentionMaxSegments keeps at most N sealed segments (0 = unlimited, default: 0).
	// Segments are sealed when they reach MaxFileSize or MaxEntries.
	// Set to > 0 to enable immutable segment retention for audit trails.
	// Environment: NORNICDB_WAL_RETENTION_MAX_SEGMENTS
	WALRetentionMaxSegments int

	// WALRetentionMaxAge keeps segments newer than this duration (0 = unlimited, default: 0).
	// Older segments are eligible for deletion after snapshots.
	// Example: 7 * 24 * time.Hour to keep 7 days of WAL history.
	// Environment: NORNICDB_WAL_RETENTION_MAX_AGE
	WALRetentionMaxAge time.Duration

	// WALRetentionLedgerDefaults enables ledger-grade retention defaults when no explicit
	// retention settings are supplied. This is opt-in and defaults to false.
	// When true, defaults to 24 segments and 7 days if no explicit retention is set.
	// Environment: NORNICDB_WAL_LEDGER_RETENTION_DEFAULTS
	WALRetentionLedgerDefaults bool

	// WALSnapshotRetentionMaxCount is the max number of snapshot files to keep (0 = use storage default, typically 3).
	// Environment: NORNICDB_WAL_SNAPSHOT_RETENTION_MAX_COUNT
	WALSnapshotRetentionMaxCount int

	// WALSnapshotRetentionMaxAge is the max age of snapshot files to keep (0 = unlimited).
	// Environment: NORNICDB_WAL_SNAPSHOT_RETENTION_MAX_AGE
	WALSnapshotRetentionMaxAge time.Duration

	// EncryptionEnabled controls whether database encryption is active
	// Env: NORNICDB_ENCRYPTION_ENABLED
	EncryptionEnabled bool

	// EncryptionPassword for database encryption at rest
	// Required when EncryptionEnabled is true. Use a strong password in production.
	// Env: NORNICDB_ENCRYPTION_PASSWORD
	EncryptionPassword string

	// EncryptionProvider selects key management mode for at-rest DB key material.
	// Supported: "password" (default), "local".
	// Env: NORNICDB_ENCRYPTION_PROVIDER
	EncryptionProvider string

	// EncryptionKeyURI identifies the KEK in provider-backed modes.
	// Env: NORNICDB_ENCRYPTION_KEY_URI
	EncryptionKeyURI string

	// EncryptionMasterKey provides the provider master key material (dev/local).
	// Expected encoding: raw 32-byte string OR hex/base64 depending on provider.
	// Env: NORNICDB_ENCRYPTION_MASTER_KEY
	EncryptionMasterKey string

	// AWS KMS provider settings.
	EncryptionAWSRegion               string
	EncryptionAWSKMSKeyID             string
	EncryptionAWSEndpoint             string
	EncryptionAWSRoleARN              string
	EncryptionAWSRoleSessionName      string
	EncryptionAWSAccessKey            string
	EncryptionAWSSecretKey            string
	EncryptionAWSSessionToken         string
	EncryptionAWSSharedCredsFilename  string
	EncryptionAWSSharedCredsProfile   string
	EncryptionAWSWebIdentityTokenFile string

	// Azure Key Vault provider settings.
	EncryptionAzureVaultName    string
	EncryptionAzureKeyName      string
	EncryptionAzureTenantID     string
	EncryptionAzureClientID     string
	EncryptionAzureClientSecret string
	EncryptionAzureEnvironment  string
	EncryptionAzureResource     string

	// GCP Cloud KMS provider settings.
	EncryptionGCPProject         string
	EncryptionGCPLocation        string
	EncryptionGCPKeyRing         string
	EncryptionGCPKeyName         string
	EncryptionGCPCredentialsFile string

	// Encryption audit settings for provider-backed modes.
	EncryptionAuditLogPath    string
	EncryptionAuditSignEvents bool
	EncryptionAuditSignKey    string

	// Encryption rotation settings for persisted wrapped DEKs.
	EncryptionRotationEnabled  bool
	EncryptionRotationInterval time.Duration

	// AsyncWritesEnabled enables async writes for faster performance.
	// Writes return immediately after caching; flushed to disk in background.
	// Env: NORNICDB_ASYNC_WRITES_ENABLED (default: true)
	AsyncWritesEnabled bool

	// AsyncFlushInterval controls how often pending writes are flushed.
	// Smaller = more consistent, larger = better throughput.
	// Env: NORNICDB_ASYNC_FLUSH_INTERVAL (default: 50ms)
	AsyncFlushInterval time.Duration

	// AsyncMaxNodeCacheSize is the max nodes to buffer before forcing a flush.
	// Prevents unbounded memory growth during bulk inserts.
	// Set to 0 for unlimited (not recommended for bulk operations).
	// Env: NORNICDB_ASYNC_MAX_NODE_CACHE_SIZE (default: 50000)
	AsyncMaxNodeCacheSize int

	// AsyncMaxEdgeCacheSize is the max edges to buffer before forcing a flush.
	// Prevents unbounded memory growth during bulk inserts.
	// Set to 0 for unlimited (not recommended for bulk operations).
	// Env: NORNICDB_ASYNC_MAX_EDGE_CACHE_SIZE (default: 100000)
	AsyncMaxEdgeCacheSize int

	// BadgerNodeCacheMaxEntries is the max nodes to keep in the hot node cache.
	// When exceeded, the cache is cleared (simple eviction).
	// Env: NORNICDB_BADGER_NODE_CACHE_MAX_ENTRIES (default: 10000)
	BadgerNodeCacheMaxEntries int

	// BadgerEdgeTypeCacheMaxTypes is the max distinct edge types to cache for GetEdgesByType.
	// When exceeded, the cache is cleared (simple eviction).
	// Env: NORNICDB_BADGER_EDGE_TYPE_CACHE_MAX_TYPES (default: 50)
	BadgerEdgeTypeCacheMaxTypes int

	// MVCCRetentionMaxVersions keeps at most this many closed historical MVCC versions per key by default.
	// The current head is always preserved separately.
	// Env: NORNICDB_MVCC_RETENTION_MAX_VERSIONS (default: 1)
	MVCCRetentionMaxVersions int

	// MVCCRetentionTTL protects MVCC versions newer than now-TTL from pruning.
	// Zero disables age-based protection.
	// Env: NORNICDB_MVCC_RETENTION_TTL
	MVCCRetentionTTL time.Duration

	// IDFreelistTTL is the debounce window before a deleted node/edge's
	// numID can be recycled. Long enough that any in-flight snapshot
	// reader that started before the delete has finished. Default 30s
	// — query-scoped readers finish in seconds, so 30s is comfortably
	// beyond the normal read window.
	// Env: NORNICDB_ID_FREELIST_TTL (e.g. "30s", "5m", "1h")
	IDFreelistTTL time.Duration

	// MVCCLifecycleEnabled enables the MVCC lifecycle manager.
	MVCCLifecycleEnabled bool

	// MVCCLifecycleCycleInterval controls background lifecycle cadence.
	MVCCLifecycleCycleInterval time.Duration

	// MVCCLifecycleMaxSnapshotAge bounds snapshot lifetime under pressure.
	MVCCLifecycleMaxSnapshotAge time.Duration

	// MVCCLifecycleMaxChainCap bounds pathological MVCC chain growth.
	MVCCLifecycleMaxChainCap int

	// AllowStorageUpgrade authorizes the engine to advance the on-disk
	// storage version through migration arms this binary understands.
	// Without it, opening an out-of-date data directory fails with a
	// clear error message. The upgrade is one-way; operators should
	// back up before enabling this. Set via --upgrade-storage on the CLI.
	AllowStorageUpgrade bool

	// PersistSearchIndexes (EXPERIMENTAL) when true saves BM25, vector, and HNSW indexes under DataDir and loads
	// them on startup so BuildIndexes can skip the full storage iteration. Default: false.
	// Note: if indexes are incompatible/missing and must be rebuilt, startup can be long for large datasets.
	// For example, rebuilding IVF-HNSW for ~1M embeddings can take ~30 minutes on startup (hardware dependent).
	// Env: NORNICDB_PERSIST_SEARCH_INDEXES
	PersistSearchIndexes bool
}

type EmbeddingWorkerConfig struct {
	// NumWorkers is the number of concurrent workers processing embeddings
	// Use more workers for network-based embedders (OpenAI, etc.) or multiple GPUs
	NumWorkers int
	// ScanInterval is how often to scan for nodes without embeddings
	ScanInterval time.Duration
	// BatchDelay is the delay between processing individual nodes
	BatchDelay time.Duration
	// TriggerDebounceDelay delays write-triggered scans until mutation bursts settle.
	TriggerDebounceDelay time.Duration
	// MaxRetries is the max retry attempts per node
	MaxRetries int
	// ChunkSize is max tokens per chunk.
	ChunkSize int
	// ChunkOverlap is tokens to overlap between chunks.
	ChunkOverlap int
	// PropertiesInclude: if non-empty, only these property keys are used when building embedding text.
	// Enables "embed only content" or "embed only title,description". Empty = use all (subject to PropertiesExclude).
	PropertiesInclude []string
	// PropertiesExclude: these property keys are never used when building embedding text (in addition to built-in skips).
	PropertiesExclude []string
	// IncludeLabels: if true (default), node labels are prepended to the embedding text.
	IncludeLabels bool
}

type FeatureFlagsConfig struct {
	// Kalman filtering for predictive smoothing
	KalmanEnabled bool

	// Topological link prediction AUTOMATIC integration
	// NOTE: Neo4j GDS procedures (CALL gds.linkPrediction.*) are ALWAYS available
	// This flag only controls automatic integration with inference.Engine.OnStore()
	TopologyAutoIntegrationEnabled bool    // Enable automatic topology in OnStore()
	TopologyAlgorithm              string  // adamic_adar, jaccard, etc.
	TopologyWeight                 float64 // 0.0-1.0, weight vs semantic
	TopologyTopK                   int
	TopologyMinScore               float64
	TopologyGraphRefreshInterval   int

	// A/B testing for automatic topology integration
	TopologyABTestEnabled    bool
	TopologyABTestPercentage int // 0-100

	// Heimdall - the cognitive guardian of NornicDB
	// When enabled, NornicDB loads a local SLM for anomaly detection,
	// runtime diagnosis, and memory curation.
	// Environment: NORNICDB_HEIMDALL_ENABLED (default: false)
	HeimdallEnabled bool

	// Heimdall model name (without .gguf extension for local; model name for ollama/openai)
	// Environment: NORNICDB_HEIMDALL_MODEL (default: qwen2.5-1.5b-instruct-q4_k_m)
	HeimdallModel string

	// Heimdall provider: "local" (GGUF), "ollama", or "openai"
	// Environment: NORNICDB_HEIMDALL_PROVIDER (default: local)
	HeimdallProvider string

	// Heimdall API URL for remote providers (ollama/openai)
	// Environment: NORNICDB_HEIMDALL_API_URL (e.g. http://localhost:11434 for ollama)
	HeimdallAPIURL string

	// Heimdall API key for openai (and other authenticated providers)
	// Environment: NORNICDB_HEIMDALL_API_KEY
	HeimdallAPIKey string

	// GPU layers for Heimdall SLM (-1=auto, 0=CPU only)
	// Falls back to CPU if GPU memory insufficient
	// Environment: NORNICDB_HEIMDALL_GPU_LAYERS (default: -1)
	HeimdallGPULayers int

	// Context size for Heimdall model (max tokens in context window)
	// This controls GPU memory usage for KV cache. Lower = less memory.
	// Default: 8192 (8K) - memory efficient, saves ~2GB GPU RAM vs 32K
	// For longer conversations, increase to 16384 or 32768
	// Environment: NORNICDB_HEIMDALL_CONTEXT_SIZE (default: 8192)
	HeimdallContextSize int

	// Batch size for Heimdall model (tokens processed at once)
	// Should be <= ContextSize. Higher values may improve throughput.
	// Default: 2048 (2K) - balanced for typical prompt sizes
	// Environment: NORNICDB_HEIMDALL_BATCH_SIZE (default: 2048)
	HeimdallBatchSize int

	// Max tokens for Heimdall generation
	// Environment: NORNICDB_HEIMDALL_MAX_TOKENS (default: 512)
	HeimdallMaxTokens int

	// Temperature for Heimdall (lower = more deterministic)
	// Environment: NORNICDB_HEIMDALL_TEMPERATURE (default: 0.1)
	HeimdallTemperature float32

	// Enable Heimdall anomaly detection on graph
	// Environment: NORNICDB_HEIMDALL_ANOMALY_DETECTION (default: true when Heimdall enabled)
	HeimdallAnomalyDetection bool

	// Enable Heimdall runtime diagnosis
	// Environment: NORNICDB_HEIMDALL_RUNTIME_DIAGNOSIS (default: true when Heimdall enabled)
	HeimdallRuntimeDiagnosis bool

	// Enable Heimdall memory curation (experimental)
	// Environment: NORNICDB_HEIMDALL_MEMORY_CURATION (default: false)
	HeimdallMemoryCuration bool

	// HeimdallCtxType sets the llama.cpp context type for Heimdall model.
	// 0=default, 1=MTP.
	// Env: NORNICDB_HEIMDALL_CTX_TYPE
	HeimdallCtxType int
	// HeimdallPoolingType sets the pooling strategy for Heimdall model.
	// 0=none (default for generation), 1=mean, 2=cls, 3=last.
	// Env: NORNICDB_HEIMDALL_POOLING_TYPE
	HeimdallPoolingType int
	// HeimdallAttentionType sets the attention masking mode for Heimdall model.
	// 0=causal (default for generation), 1=non-causal.
	// Env: NORNICDB_HEIMDALL_ATTENTION_TYPE
	HeimdallAttentionType int
	// HeimdallFlashAttn controls flash attention for Heimdall model.
	// -1=auto (default), 0=disabled, 1=enabled.
	// Env: NORNICDB_HEIMDALL_FLASH_ATTN
	HeimdallFlashAttn int

	// Expose MCP tools (store, recall, discover, link, task, tasks) to the Heimdall agentic loop.
	// When false, the LLM does not see or call MCP tools (reduces context size). Default: false.
	// Environment: NORNICDB_HEIMDALL_MCP_ENABLE (default: false)
	HeimdallMCPEnable bool
	// Allowlist of MCP tool names to expose when HeimdallMCPEnable is true. Nil = expose all tools;
	// empty slice = expose none (disable); non-empty = only those names (e.g. ["store","link"]).
	// Environment: NORNICDB_HEIMDALL_MCP_TOOLS (comma-separated; unset = all, empty string = none)
	HeimdallMCPTools []string

	// SearchRerankEnabled enables Stage-2 reranking for vector/hybrid search.
	// Environment: NORNICDB_SEARCH_RERANK_ENABLED (default: false)
	SearchRerankEnabled bool
	// SearchRerankProvider: "local" (GGUF), "ollama", "openai", or "http" (Cohere/HuggingFace TEI/custom).
	// Environment: NORNICDB_SEARCH_RERANK_PROVIDER (default: local)
	SearchRerankProvider string
	// SearchRerankModel: for local = GGUF filename (e.g. bge-reranker-v2-m3-Q4_K_M.gguf); for API = model name/id.
	// Environment: NORNICDB_SEARCH_RERANK_MODEL
	SearchRerankModel string
	// SearchRerankAPIURL is the rerank API endpoint for ollama/openai/http (e.g. http://localhost:11434/rerank, https://api.cohere.ai/v1/rerank).
	// Environment: NORNICDB_SEARCH_RERANK_API_URL
	SearchRerankAPIURL string
	// SearchRerankAPIKey for authenticated providers (e.g. OpenAI, Cohere).
	// Environment: NORNICDB_SEARCH_RERANK_API_KEY
	SearchRerankAPIKey string
	// RerankCtxType sets the llama.cpp context type for rerank model.
	// 0=default, 1=MTP.
	// Env: NORNICDB_RERANK_CTX_TYPE
	RerankCtxType int
	// RerankPoolingType sets the pooling strategy for rerank model.
	// 1=mean, 2=cls, 3=last, 4=rank.
	// Env: NORNICDB_RERANK_POOLING_TYPE
	RerankPoolingType int
	// RerankAttentionType sets the attention masking mode for rerank model.
	// 0=causal, 1=non-causal.
	// Env: NORNICDB_RERANK_ATTENTION_TYPE
	RerankAttentionType int
	// RerankFlashAttn controls flash attention for rerank model.
	// -1=auto, 0=disabled, 1=enabled.
	// Env: NORNICDB_RERANK_FLASH_ATTN
	RerankFlashAttn int

	// Max context tokens for prompt validation (should match HeimdallContextSize)
	// This is the total token budget for system + user + output combined.
	// Environment: NORNICDB_HEIMDALL_MAX_CONTEXT_TOKENS (default: 8192)
	HeimdallMaxContextTokens int

	// Max tokens reserved for system prompt (actions + instructions + Cypher primer)
	// The system prompt includes: action definitions, Cypher reference, and plugin context.
	// Remaining context is split between user message and model output.
	// Environment: NORNICDB_HEIMDALL_MAX_SYSTEM_TOKENS (default: 6000)
	HeimdallMaxSystemTokens int

	// Max tokens reserved for user message input
	// Longer user messages (complex queries, multi-line inputs) need more budget.
	// Environment: NORNICDB_HEIMDALL_MAX_USER_TOKENS (default: 2000)
	HeimdallMaxUserTokens int

	// QdrantGRPCEnabled enables the Qdrant-compatible gRPC server
	// Environment: NORNICDB_QDRANT_GRPC_ENABLED (default: false)
	QdrantGRPCEnabled bool

	// QdrantGRPCListenAddr is the address for the Qdrant gRPC server
	// Environment: NORNICDB_QDRANT_GRPC_LISTEN_ADDR (default: ":6334")
	QdrantGRPCListenAddr string

	// QdrantGRPCMaxVectorDim is the maximum allowed vector dimension
	// Environment: NORNICDB_QDRANT_GRPC_MAX_VECTOR_DIM (default: 4096)
	QdrantGRPCMaxVectorDim int

	// QdrantGRPCMaxBatchPoints is the max points per upsert batch
	// Environment: NORNICDB_QDRANT_GRPC_MAX_BATCH_POINTS (default: 1000)
	QdrantGRPCMaxBatchPoints int

	// QdrantGRPCMaxTopK is the maximum search results
	// Environment: NORNICDB_QDRANT_GRPC_MAX_TOP_K (default: 1000)
	QdrantGRPCMaxTopK int

	// QdrantGRPCMethodPermissions optionally overrides required permissions for
	// specific Qdrant gRPC RPCs.
	//
	// This is configured via YAML config only (not env vars) under:
	//   qdrant_grpc:
	//     rbac:
	//       methods:
	//         "Points/Upsert": "write"
	//
	// Values are one of: read, write, create, delete, admin, schema, user_manage.
	QdrantGRPCMethodPermissions map[string]string
}

type FeatureStatus struct {
	GlobalEnabled            bool
	KalmanEnabled            bool
	TopologyEnabled          bool
	EdgeProvenanceEnabled    bool
	CooldownEnabled          bool
	EvidenceBufferingEnabled bool
	PerNodeConfigEnabled     bool
	WALEnabled               bool
	GPUClusteringEnabled     bool
	Features                 map[string]bool
}

type FilteredValue struct {
	Raw         float64 // Original unfiltered value
	Filtered    float64 // Filtered value (same as Raw if disabled)
	WasFiltered bool    // True if filtering was applied
	Feature     string  // Which feature flag controlled this
}

type LoggingConfig struct {
	// Level (DEBUG, INFO, WARN, ERROR)
	Level string
	// Format (json, text)
	Format string
	// Output path (stdout, stderr, or file path)
	Output string
	// QueryLogEnabled for query logging
	QueryLogEnabled bool
	// SlowQueryThreshold for logging slow queries (single source of truth
	// per D-04d; replaces the prior pkg/server.Config.SlowQueryThreshold).
	SlowQueryThreshold time.Duration
	// SlowQueryLogFile is the optional file path for the slow-query log
	// stream. Empty => log to the configured server logger. Single source of
	// truth per D-04d.
	SlowQueryLogFile string
}

type MemoryConfig struct {
	// DecayEnabled controls memory decay
	DecayEnabled bool
	// DecayInterval controls how often access metadata is flushed from
	// in-memory accumulators to Badger. Shorter intervals mean access
	// counts reach the scorer faster; longer intervals reduce write I/O.
	DecayInterval time.Duration
	// AccessFlushBufferSize is the maximum number of distinct entities buffered
	// in the access accumulator before an automatic flush is triggered. 0 means
	// unlimited (flush only on the DecayInterval timer).
	AccessFlushBufferSize int
	// VisibilityThreshold is the score below which nodes are suppressed from
	// visibility in query results.
	VisibilityThreshold float64
	// EmbeddingEnabled controls whether embedding generation is active
	// Env: NORNICDB_EMBEDDING_ENABLED
	EmbeddingEnabled bool
	// EmbeddingProvider (local, ollama, openai)
	EmbeddingProvider string
	// EmbeddingModel name
	EmbeddingModel string
	// EmbeddingAPIURL endpoint
	EmbeddingAPIURL string
	// EmbeddingAPIKey for authenticated providers (OpenAI, etc.). Env: NORNICDB_EMBEDDING_API_KEY
	EmbeddingAPIKey string
	// EmbeddingDimensions size
	EmbeddingDimensions int
	// EmbeddingCacheSize is max embeddings to cache (0 = disabled, default: 10000)
	// Each cached embedding uses ~4KB (1024 dims × 4 bytes)
	// 10000 cache = ~40MB memory, provides significant speedup for repeated queries
	EmbeddingCacheSize int
	// SearchMinSimilarity is the minimum cosine similarity threshold for vector search results.
	// Apple Intelligence embeddings produce scores in 0.2-0.8 range, bge-m3/mxbai produce 0.7-0.99.
	// Default: 0.0 (let RRF ranking handle relevance filtering)
	// Env: NORNICDB_SEARCH_MIN_SIMILARITY
	SearchMinSimilarity float64
	// SearchBM25Enabled is the global default for whether BM25 fulltext search
	// is enabled. Per-database overrides via dbconfig.Store always win.
	// Env: NORNICDB_SEARCH_BM25_ENABLED (default: true)
	SearchBM25Enabled bool
	// SearchBM25Warming is the global default trigger for BM25 build:
	// "startup" builds at boot (today's behaviour) or "lazy" defers to the
	// first inbound search query for the database.
	// Env: NORNICDB_SEARCH_BM25_WARMING (default: startup)
	SearchBM25Warming string
	// SearchVectorEnabled is the global default for whether vector search is
	// enabled. When false, no ANN strategy (HNSW, IVF-HNSW, brute-force, GPU,
	// Metal, Qdrant pass-through) is built or queryable for that database;
	// node embeddings are not iterated into RAM. Per-database overrides win.
	// Env: NORNICDB_SEARCH_VECTOR_ENABLED (default: true)
	SearchVectorEnabled bool
	// SearchVectorWarming is the global default trigger for vector index build:
	// "startup" or "lazy". See SearchBM25Warming.
	// Env: NORNICDB_SEARCH_VECTOR_WARMING (default: startup)
	SearchVectorWarming string
	// ModelsDir is the directory containing local GGUF models
	// Env: NORNICDB_MODELS_DIR (default: ./models)
	ModelsDir string
	// EmbeddingGPULayers controls GPU offloading for local embeddings
	// -1 = auto, 0 = CPU only, >0 = specific layers
	// Env: NORNICDB_EMBEDDING_GPU_LAYERS
	EmbeddingGPULayers int
	// EmbeddingWarmupInterval for periodic model warmup
	// Env: NORNICDB_EMBEDDING_WARMUP_INTERVAL
	EmbeddingWarmupInterval time.Duration
	// EmbeddingCtxType sets the llama.cpp context type for embedding model.
	// 0=default, 1=MTP. Only use MTP if the model contains MTP layers.
	// Env: NORNICDB_EMBEDDING_CTX_TYPE
	EmbeddingCtxType int
	// EmbeddingPoolingType sets the embedding pooling strategy.
	// 1=mean (default), 2=cls, 3=last, 4=rank.
	// Env: NORNICDB_EMBEDDING_POOLING_TYPE
	EmbeddingPoolingType int
	// EmbeddingAttentionType sets the attention masking mode for embeddings.
	// 0=causal, 1=non-causal (default for embeddings).
	// Env: NORNICDB_EMBEDDING_ATTENTION_TYPE
	EmbeddingAttentionType int
	// EmbeddingFlashAttn controls flash attention for embedding model.
	// -1=auto, 0=disabled (default), 1=enabled.
	// Env: NORNICDB_EMBEDDING_FLASH_ATTN
	EmbeddingFlashAttn int
	// DefaultNodeLabel is the label applied to nodes when no label is specified.
	// Env: NORNICDB_DEFAULT_NODE_LABEL (default: "Memory")
	DefaultNodeLabel string
	// AutoLinksEnabled for automatic relationship detection
	AutoLinksEnabled bool
	// AutoLinksSimilarityThreshold for similarity-based links
	AutoLinksSimilarityThreshold float64
	// KmeansMinEmbeddings is minimum embeddings required for k-means clustering
	// Env: NORNICDB_KMEANS_MIN_EMBEDDINGS (default: 1000)
	KmeansMinEmbeddings int
	// KmeansClusterInterval is how often to run k-means clustering (0 = disabled)
	// Env: NORNICDB_KMEANS_CLUSTER_INTERVAL (default: 5m)
	KmeansClusterInterval time.Duration
	// KmeansNumClusters is the number of k-means clusters (0 = auto from dataset size).
	// Env: NORNICDB_KMEANS_NUM_CLUSTERS (0 or unset = auto)
	KmeansNumClusters int

	// RuntimeLimit is the soft memory limit (GOMEMLIMIT) in bytes
	// 0 = unlimited (Go manages automatically)
	// Set to 80% of container memory for optimal performance
	RuntimeLimit int64
	// RuntimeLimitStr is the configured value in megabytes as a string (e.g., "500")
	RuntimeLimitStr string
	// GCPercent controls GC aggressiveness (GOGC)
	// 100 = default, lower = more aggressive (less memory, more CPU)
	GCPercent int
	// PoolEnabled controls object pooling for query results
	PoolEnabled bool
	// PoolMaxSize limits pool memory usage per pool
	PoolMaxSize int
	// QueryCacheEnabled controls query plan caching
	QueryCacheEnabled bool
	// QueryCacheSize is the maximum number of cached query plans
	QueryCacheSize int
	// QueryCacheTTL is how long cached plans remain valid
	QueryCacheTTL time.Duration
}

type RetentionConfig struct {
	// SweepIntervalSeconds controls how often the retention sweep runs in whole seconds.
	SweepIntervalSeconds int
	// ExcludedLabels lists labels that are globally exempt from retention deletion.
	ExcludedLabels []string
	// PoliciesFile is the optional JSON persistence path for retention policies.
	PoliciesFile string
	// DefaultPolicies loads the built-in compliance policies on startup.
	DefaultPolicies bool
	// MaxSweepRecords limits how many records a single sweep iteration will process.
	MaxSweepRecords int
	// Policies defines per-category policies inline in config.
	Policies []RetentionPolicyConfig
}

type RetentionPolicyConfig struct {
	ID                   string   `yaml:"id"`
	Name                 string   `yaml:"name"`
	Category             string   `yaml:"category"`
	RetentionDays        int      `yaml:"retention_days"`
	Indefinite           bool     `yaml:"indefinite"`
	ArchiveBeforeDelete  bool     `yaml:"archive_before_delete"`
	ArchivePath          string   `yaml:"archive_path"`
	ComplianceFrameworks []string `yaml:"compliance_frameworks"`
	Description          string   `yaml:"description"`
	Active               *bool    `yaml:"active"`
}

type ServerConfig struct {
	// BoltEnabled controls Bolt protocol server
	BoltEnabled bool
	// BoltPort for Bolt connections (default 7687)
	BoltPort int
	// BoltAddress to bind to
	BoltAddress string
	// BoltServerAnnouncement overrides the Bolt HELLO SUCCESS "server" metadata.
	// Use this only as a client compatibility workaround for strict Neo4j-only tools.
	// Env: NORNICDB_BOLT_SERVER_ANNOUNCEMENT
	BoltServerAnnouncement string
	// BoltTLSEnabled for encrypted connections
	BoltTLSEnabled bool
	// BoltTLSCert path to certificate
	BoltTLSCert string
	// BoltTLSKey path to private key
	BoltTLSKey string
	// BoltTLSRequire rejects any plaintext connection on the Bolt port.
	// Env: NORNICDB_BOLT_TLS_REQUIRE
	BoltTLSRequire bool
	// BoltTLSClientCAFile enables mTLS by verifying client certs against
	// this CA. Env: NORNICDB_BOLT_TLS_CLIENT_CA
	BoltTLSClientCAFile string
	// BoltTLSClientAuthMode controls client-cert handling when ClientCAFile
	// is set. Values: "none", "request", "request_verify", "require_verify".
	// Env: NORNICDB_BOLT_TLS_CLIENT_AUTH_MODE
	BoltTLSClientAuthMode string

	// BoltSniffTimeout bounds the transport-sniff peek (default 5s).
	// Env: NORNICDB_BOLT_SNIFF_TIMEOUT
	BoltSniffTimeout time.Duration
	// BoltAuthTimeout bounds pre-HELLO handshake/auth (default 30s).
	// Env: NORNICDB_BOLT_AUTH_TIMEOUT
	BoltAuthTimeout time.Duration
	// BoltStatementTimeout bounds a single Bolt RUN when the client did
	// not supply tx_timeout. Zero disables the server-side fallback cap.
	// Env: NORNICDB_BOLT_STATEMENT_TIMEOUT
	BoltStatementTimeout time.Duration

	// BoltWebSocketEnabled allows WebSocket transport on the Bolt port
	// (default true). Env: NORNICDB_BOLT_WEBSOCKET_ENABLED
	BoltWebSocketEnabled bool
	// BoltWebSocketAllowedOrigins comma-separated allowlist for WS Origin
	// header. "*" allows any. Env: NORNICDB_BOLT_WEBSOCKET_ALLOWED_ORIGINS
	BoltWebSocketAllowedOrigins string
	// BoltWebSocketMaxMessageSize bounds inbound WS BinaryMessage size
	// (default 65536). Env: NORNICDB_BOLT_WEBSOCKET_MAX_MESSAGE_SIZE
	BoltWebSocketMaxMessageSize int64
	// BoltWebSocketWriteBufferSize bufio writer size for WS sessions
	// (default 262144). Env: NORNICDB_BOLT_WEBSOCKET_WRITE_BUFFER_SIZE
	BoltWebSocketWriteBufferSize int
	// BoltWebSocketPingInterval cadence for WS ping control frames
	// (default 30s). Env: NORNICDB_BOLT_WEBSOCKET_PING_INTERVAL
	BoltWebSocketPingInterval time.Duration
	// BoltWebSocketPongTimeout pong arrival deadline (default 60s).
	// Env: NORNICDB_BOLT_WEBSOCKET_PONG_TIMEOUT
	BoltWebSocketPongTimeout time.Duration

	// HTTPEnabled controls HTTP API server
	HTTPEnabled bool
	// HTTPPort for HTTP connections (default 7474)
	HTTPPort int
	// HTTPAddress to bind to
	HTTPAddress string
	// HTTPSEnabled for encrypted connections
	HTTPSEnabled bool
	// HTTPSPort for HTTPS connections (default 7473)
	HTTPSPort int
	// HTTPTLSCert path to certificate
	HTTPTLSCert string
	// HTTPTLSKey path to private key
	HTTPTLSKey string

	// Environment is the runtime environment (development, production)
	// Env: NORNICDB_ENV (default: development)
	Environment string
	// AllowHTTP permits non-TLS connections (development only)
	// Env: NORNICDB_ALLOW_HTTP (default: true in development)
	AllowHTTP bool
	// PluginsDir is the directory for APOC plugins
	// Env: NORNICDB_PLUGINS_DIR (default: ./plugins)
	PluginsDir string
	// HeimdallPluginsDir is the directory for Heimdall plugins
	// Env: NORNICDB_HEIMDALL_PLUGINS_DIR (default: ./plugins/heimdall)
	HeimdallPluginsDir string

	// EnableCORS enables CORS headers for cross-origin requests
	// Env: NORNICDB_CORS_ENABLED (default: false for security)
	EnableCORS bool
	// CORSOrigins is a comma-separated list of allowed origins
	// Use "*" to allow all origins (not recommended for production with credentials)
	// Env: NORNICDB_CORS_ORIGINS (default: empty - must be explicitly configured)
	// Example: "https://myapp.com,https://admin.myapp.com"
	CORSOrigins []string
}

type StorageRuntimeConfig struct {
	// BytesMetricInterval overrides the bytes_metrics_sweeper cadence.
	// Zero/unset uses storage.DefaultBytesMetricsInterval (30s).
	BytesMetricInterval time.Duration `yaml:"bytes_metric_interval"`
}

type YAMLConfig struct {
	// Server configuration
	Server struct {
		BoltPort               int    `yaml:"bolt_port"`
		HTTPPort               int    `yaml:"http_port"`
		Port                   int    `yaml:"port"`                     // Alias for bolt_port
		Host                   string `yaml:"host"`                     // Bind address
		Address                string `yaml:"address"`                  // Alias for host
		DataDir                string `yaml:"data_dir"`                 // Data directory
		Auth                   string `yaml:"auth"`                     // Format: "username:password" or "none"
		BoltEnabled            bool   `yaml:"bolt_enabled"`             // Enable Bolt protocol
		HTTPEnabled            bool   `yaml:"http_enabled"`             // Enable HTTP API
		BoltServerAnnouncement string `yaml:"bolt_server_announcement"` // Override Bolt HELLO server metadata
		BoltStatementTimeout   string `yaml:"bolt_statement_timeout"`
		TLS                    struct {
			Enabled  bool   `yaml:"enabled"`
			CertFile string `yaml:"cert_file"`
			KeyFile  string `yaml:"key_file"`
		} `yaml:"tls"`
	} `yaml:"server"`

	// Database/Storage configuration
	Database struct {
		DataDir                           string `yaml:"data_dir"`
		DefaultDatabase                   string `yaml:"default_database"`
		ReadOnly                          bool   `yaml:"read_only"`
		TransactionTimeout                string `yaml:"transaction_timeout"`
		MaxConcurrentTransactions         int    `yaml:"max_concurrent_transactions"`
		StrictDurability                  bool   `yaml:"strict_durability"`
		WALSyncMode                       string `yaml:"wal_sync_mode"`
		WALSyncInterval                   string `yaml:"wal_sync_interval"`
		WALAutoCompactionEnabled          *bool  `yaml:"wal_auto_compaction_enabled"`
		WALRetentionMaxSegments           int    `yaml:"wal_retention_max_segments"`
		WALRetentionMaxAge                string `yaml:"wal_retention_max_age"`
		WALRetentionLedgerDefaults        bool   `yaml:"wal_ledger_retention_defaults"`
		WALSnapshotRetentionMaxCount      int    `yaml:"wal_snapshot_retention_max_count"`
		WALSnapshotRetentionMaxAge        string `yaml:"wal_snapshot_retention_max_age"`
		EncryptionEnabled                 bool   `yaml:"encryption_enabled"`
		EncryptionPassword                string `yaml:"encryption_password"`
		EncryptionProvider                string `yaml:"encryption_provider"`
		EncryptionKeyURI                  string `yaml:"encryption_key_uri"`
		EncryptionMasterKey               string `yaml:"encryption_master_key"`
		EncryptionAWSRegion               string `yaml:"encryption_aws_region"`
		EncryptionAWSKMSKeyID             string `yaml:"encryption_aws_kms_key_id"`
		EncryptionAWSEndpoint             string `yaml:"encryption_aws_endpoint"`
		EncryptionAWSRoleARN              string `yaml:"encryption_aws_role_arn"`
		EncryptionAWSRoleSessionName      string `yaml:"encryption_aws_role_session_name"`
		EncryptionAWSAccessKey            string `yaml:"encryption_aws_access_key"`
		EncryptionAWSSecretKey            string `yaml:"encryption_aws_secret_key"`
		EncryptionAWSSessionToken         string `yaml:"encryption_aws_session_token"`
		EncryptionAWSSharedCredsFilename  string `yaml:"encryption_aws_shared_creds_filename"`
		EncryptionAWSSharedCredsProfile   string `yaml:"encryption_aws_shared_creds_profile"`
		EncryptionAWSWebIdentityTokenFile string `yaml:"encryption_aws_web_identity_token_file"`
		EncryptionAzureVaultName          string `yaml:"encryption_azure_vault_name"`
		EncryptionAzureKeyName            string `yaml:"encryption_azure_key_name"`
		EncryptionAzureTenantID           string `yaml:"encryption_azure_tenant_id"`
		EncryptionAzureClientID           string `yaml:"encryption_azure_client_id"`
		EncryptionAzureClientSecret       string `yaml:"encryption_azure_client_secret"`
		EncryptionAzureEnvironment        string `yaml:"encryption_azure_environment"`
		EncryptionAzureResource           string `yaml:"encryption_azure_resource"`
		EncryptionGCPProject              string `yaml:"encryption_gcp_project"`
		EncryptionGCPLocation             string `yaml:"encryption_gcp_location"`
		EncryptionGCPKeyRing              string `yaml:"encryption_gcp_key_ring"`
		EncryptionGCPKeyName              string `yaml:"encryption_gcp_key_name"`
		EncryptionGCPCredentialsFile      string `yaml:"encryption_gcp_credentials_file"`
		EncryptionAuditLogPath            string `yaml:"encryption_audit_log_path"`
		EncryptionAuditSignEvents         *bool  `yaml:"encryption_audit_sign_events"`
		EncryptionAuditSignKey            string `yaml:"encryption_audit_sign_key"`
		EncryptionRotationEnabled         *bool  `yaml:"encryption_rotation_enabled"`
		EncryptionRotationInterval        string `yaml:"encryption_rotation_interval"`
		AsyncWritesEnabled                *bool  `yaml:"async_writes_enabled"`
		AsyncFlushInterval                string `yaml:"async_flush_interval"`
		AsyncMaxNodeCacheSize             *int   `yaml:"async_max_node_cache_size"`
		AsyncMaxEdgeCacheSize             *int   `yaml:"async_max_edge_cache_size"`
		AsyncWrites                       struct {
			Enabled          *bool  `yaml:"enabled"`
			FlushInterval    string `yaml:"flush_interval"`
			MaxNodeCacheSize *int   `yaml:"max_node_cache_size"`
			MaxEdgeCacheSize *int   `yaml:"max_edge_cache_size"`
		} `yaml:"async_writes"`
		BadgerNodeCacheMaxEntries   int    `yaml:"badger_node_cache_max_entries"`
		BadgerEdgeTypeCacheMaxTypes int    `yaml:"badger_edge_type_cache_max_types"`
		MVCCRetentionMaxVersions    int    `yaml:"mvcc_retention_max_versions"`
		MVCCRetentionTTL            string `yaml:"mvcc_retention_ttl"`
		IDFreelistTTL               string `yaml:"id_freelist_ttl"`
		MVCCLifecycleEnabled        *bool  `yaml:"mvcc_lifecycle_enabled"`
		MVCCLifecycleCycleInterval  string `yaml:"mvcc_lifecycle_interval"`
		MVCCLifecycleMaxSnapshotAge string `yaml:"mvcc_lifecycle_max_snapshot_age"`
		MVCCLifecycleMaxChainCap    int    `yaml:"mvcc_lifecycle_max_chain_cap"`
		PersistSearchIndexes        bool   `yaml:"persist_search_indexes"`
	} `yaml:"database"`

	// Storage alias for database
	Storage struct {
		Path string `yaml:"path"`
		// BytesMetricInterval is the cadence for the Plan 04-04 D-07
		// bytes_metrics_sweeper lifecycle.Component. Default 30s when
		// zero/unset. Configurable for tests + ops who want denser or
		// sparser cadence.
		BytesMetricInterval time.Duration `yaml:"bytes_metric_interval"`
	} `yaml:"storage"`

	// Authentication configuration
	Auth struct {
		Enabled           *bool  `yaml:"enabled"`
		Username          string `yaml:"username"`
		Password          string `yaml:"password"`
		MinPasswordLength int    `yaml:"min_password_length"`
		TokenExpiry       string `yaml:"token_expiry"`
		JWTSecret         string `yaml:"jwt_secret"`
	} `yaml:"auth"`

	// Embedding configuration
	Embedding struct {
		Enabled       bool    `yaml:"enabled"`
		Provider      string  `yaml:"provider"`
		Model         string  `yaml:"model"`
		URL           string  `yaml:"url"`
		APIKey        string  `yaml:"api_key"`
		Dimensions    int     `yaml:"dimensions"`
		CacheSize     int     `yaml:"cache_size"`
		MinSimilarity float64 `yaml:"min_similarity"`
	} `yaml:"embedding"`

	// Per-database search index master switches and warming triggers
	// (global defaults; per-DB overrides via dbconfig.Store always win).
	// `enabled`: bool, default true. `warming`: "startup"|"lazy", default startup.
	Search struct {
		BM25Enabled   *bool  `yaml:"bm25_enabled"`
		BM25Warming   string `yaml:"bm25_warming"`
		VectorEnabled *bool  `yaml:"vector_enabled"`
		VectorWarming string `yaml:"vector_warming"`
	} `yaml:"search"`

	// Memory/Decay configuration
	Memory struct {
		DecayEnabled                 bool    `yaml:"decay_enabled"`
		DecayIntervalSeconds         int     `yaml:"decay_interval"`
		AccessFlushBufferSize        int     `yaml:"access_flush_buffer_size"`
		VisibilityThreshold          float64 `yaml:"visibility_threshold"`
		AutoLinksEnabled             bool    `yaml:"auto_links_enabled"`
		AutoLinksSimilarityThreshold float64 `yaml:"auto_links_similarity_threshold"`
		RuntimeLimit                 string  `yaml:"runtime_limit"`
		GCPercent                    int     `yaml:"gc_percent"`
		PoolEnabled                  bool    `yaml:"pool_enabled"`
		PoolMaxSize                  int     `yaml:"pool_max_size"`
		QueryCacheEnabled            bool    `yaml:"query_cache_enabled"`
		QueryCacheSize               int     `yaml:"query_cache_size"`
		QueryCacheTTL                string  `yaml:"query_cache_ttl"`
	} `yaml:"memory"`

	// Embedding worker configuration
	EmbeddingWorker struct {
		ScanInterval      string   `yaml:"scan_interval"`
		BatchDelay        string   `yaml:"batch_delay"`
		TriggerDebounce   string   `yaml:"trigger_debounce"`
		MaxRetries        int      `yaml:"max_retries"`
		ChunkSize         int      `yaml:"chunk_size"`
		ChunkOverlap      int      `yaml:"chunk_overlap"`
		PropertiesInclude []string `yaml:"properties_include"`
		PropertiesExclude []string `yaml:"properties_exclude"`
		IncludeLabels     *bool    `yaml:"include_labels"`
	} `yaml:"embedding_worker"`

	// K-means clustering
	Kmeans struct {
		Enabled bool `yaml:"enabled"`
	} `yaml:"kmeans"`

	// Auto-TLP (Topology Link Prediction)
	AutoTLP struct {
		Enabled              bool    `yaml:"enabled"`
		Algorithm            string  `yaml:"algorithm"`
		Weight               float64 `yaml:"weight"`
		TopK                 int     `yaml:"top_k"`
		MinScore             float64 `yaml:"min_score"`
		GraphRefreshInterval int     `yaml:"graph_refresh_interval"`
		ABTestEnabled        bool    `yaml:"ab_test_enabled"`
		ABTestPercentage     int     `yaml:"ab_test_percentage"`
	} `yaml:"auto_tlp"`

	// Heimdall AI guardian
	Heimdall struct {
		Enabled          bool     `yaml:"enabled"`
		Model            string   `yaml:"model"`
		Provider         string   `yaml:"provider"` // local, ollama, openai
		APIURL           string   `yaml:"api_url"`  // for ollama/openai
		APIKey           string   `yaml:"api_key"`  // for openai
		GPULayers        *int     `yaml:"gpu_layers"`
		ContextSize      int      `yaml:"context_size"`
		BatchSize        int      `yaml:"batch_size"`
		MaxTokens        int      `yaml:"max_tokens"`
		Temperature      float64  `yaml:"temperature"`
		AnomalyDetection bool     `yaml:"anomaly_detection"`
		RuntimeDiagnosis bool     `yaml:"runtime_diagnosis"`
		MemoryCuration   bool     `yaml:"memory_curation"`
		MaxContextTokens int      `yaml:"max_context_tokens"`
		MaxSystemTokens  int      `yaml:"max_system_tokens"`
		MaxUserTokens    int      `yaml:"max_user_tokens"`
		MCPEnable        bool     `yaml:"mcp_enable"` // expose MCP tools to agentic loop (default: false)
		MCPTools         []string `yaml:"mcp_tools"`  // allowlist: nil/omit = all, [] = none, [store,link] = only those
	} `yaml:"heimdall"`

	// Search rerank (Stage-2 reranking: local GGUF or external API like embeddings/Heimdall).
	SearchRerank struct {
		Enabled  bool   `yaml:"enabled"`
		Provider string `yaml:"provider"` // local, ollama, openai, http
		Model    string `yaml:"model"`
		APIURL   string `yaml:"api_url"`
		APIKey   string `yaml:"api_key"`
	} `yaml:"search_rerank"`

	// Feature flags (subset supported in YAML).
	Features struct {
		// Qdrant gRPC compatibility endpoint.
		QdrantGRPCEnabled        bool   `yaml:"qdrant_grpc_enabled"`
		QdrantGRPCListenAddr     string `yaml:"qdrant_grpc_listen_addr"`
		QdrantGRPCMaxVectorDim   int    `yaml:"qdrant_grpc_max_vector_dim"`
		QdrantGRPCMaxBatchPoints int    `yaml:"qdrant_grpc_max_batch_points"`
		QdrantGRPCMaxTopK        int    `yaml:"qdrant_grpc_max_top_k"`

		QdrantGRPCRBAC struct {
			Methods map[string]string `yaml:"methods"`
		} `yaml:"qdrant_grpc_rbac"`
	} `yaml:"features"`

	// Qdrant gRPC compatibility endpoint (legacy YAML shape; supported for compatibility).
	QdrantGRPC struct {
		Enabled        bool   `yaml:"enabled"`
		ListenAddr     string `yaml:"listen_addr"`
		MaxVectorDim   int    `yaml:"max_vector_dim"`
		MaxBatchPoints int    `yaml:"max_batch_points"`
		MaxTopK        int    `yaml:"max_top_k"`

		RBAC struct {
			Methods map[string]string `yaml:"methods"`
		} `yaml:"rbac"`
	} `yaml:"qdrant_grpc"`

	// Compliance settings
	Compliance struct {
		// Audit
		AuditEnabled       bool   `yaml:"audit_enabled"`
		AuditLogPath       string `yaml:"audit_log_path"`
		AuditRetentionDays int    `yaml:"audit_retention_days"`
		// Retention
		RetentionEnabled     bool     `yaml:"retention_enabled"`
		RetentionPolicyDays  int      `yaml:"retention_policy_days"`
		RetentionAutoDelete  bool     `yaml:"retention_auto_delete"`
		RetentionExemptRoles []string `yaml:"retention_exempt_roles"`
		// Access Control
		AccessControlEnabled bool   `yaml:"access_control_enabled"`
		SessionTimeout       string `yaml:"session_timeout"`
		MaxFailedLogins      int    `yaml:"max_failed_logins"`
		LockoutDuration      string `yaml:"lockout_duration"`
		// Encryption
		EncryptionAtRest    bool   `yaml:"encryption_at_rest"`
		EncryptionInTransit bool   `yaml:"encryption_in_transit"`
		EncryptionKeyPath   string `yaml:"encryption_key_path"`
		// Data Subject Rights
		DataExportEnabled             bool     `yaml:"data_export_enabled"`
		DataErasureEnabled            bool     `yaml:"data_erasure_enabled"`
		DataAccessEnabled             bool     `yaml:"data_access_enabled"`
		SubjectIdentifierProperties   []string `yaml:"subject_identifier_properties"`
		SubjectPseudonymizeProperties []string `yaml:"subject_pseudonymize_properties"`
		SubjectRedactProperties       []string `yaml:"subject_redact_properties"`
		// Anonymization
		AnonymizationEnabled bool   `yaml:"anonymization_enabled"`
		AnonymizationMethod  string `yaml:"anonymization_method"`
		// Consent
		ConsentRequired   bool `yaml:"consent_required"`
		ConsentVersioning bool `yaml:"consent_versioning"`
		ConsentAuditTrail bool `yaml:"consent_audit_trail"`
		// Breach
		BreachDetectionEnabled bool   `yaml:"breach_detection_enabled"`
		BreachNotifyEmail      string `yaml:"breach_notify_email"`
		BreachNotifyWebhook    string `yaml:"breach_notify_webhook"`
	} `yaml:"compliance"`

	Retention struct {
		SweepInterval   int                     `yaml:"sweep_interval"`
		ExcludedLabels  []string                `yaml:"excluded_labels"`
		PoliciesFile    string                  `yaml:"policies_file"`
		DefaultPolicies bool                    `yaml:"default_policies"`
		MaxSweepRecords int                     `yaml:"max_sweep_records"`
		Policies        []RetentionPolicyConfig `yaml:"policies"`
	} `yaml:"retention"`

	// Logging configuration
	Logging struct {
		Level              string `yaml:"level"`
		Format             string `yaml:"format"`
		Output             string `yaml:"output"`
		QueryLogEnabled    bool   `yaml:"query_log_enabled"`
		SlowQueryThreshold string `yaml:"slow_query_threshold"`
	} `yaml:"logging"`

	// Observability configuration (Phase 1 — OBS-02)
	Observability struct {
		Metrics struct {
			Enabled             *bool  `yaml:"enabled"`
			Listen              string `yaml:"listen"`
			TenantLabelsEnabled *bool  `yaml:"tenant_labels_enabled"`
		} `yaml:"metrics"`
		Tracing struct {
			Enabled  *bool  `yaml:"enabled"`
			Endpoint string `yaml:"endpoint"`
			Protocol string `yaml:"protocol"`
			Insecure *bool  `yaml:"insecure"`
			Timeout  string `yaml:"timeout"`
		} `yaml:"tracing"`
		Pprof struct {
			Enabled *bool  `yaml:"enabled"`
			Listen  string `yaml:"listen"`
		} `yaml:"pprof"`
	} `yaml:"observability"`

	// Plugins configuration
	Plugins struct {
		Dir         string `yaml:"dir"`          // APOC plugins directory
		HeimdallDir string `yaml:"heimdall_dir"` // Heimdall plugins directory
	} `yaml:"plugins"`

	// Databases is a per-database override map (keyed by database name).
	// Each entry is a free-form string→string map of dbconfig keys (e.g.
	// NORNICDB_SEARCH_BM25_ENABLED) → values. Loaded into dbconfig.Store
	// at first boot ONLY when the store has no row for that (dbName, key)
	// pair yet — admin API edits made later are authoritative across
	// restarts. See pkg/config/dbconfig/store.go LoadWithYAMLDefaults.
	//
	// Example:
	//
	//   databases:
	//     analytics:
	//       NORNICDB_SEARCH_BM25_ENABLED: "false"
	//       NORNICDB_SEARCH_VECTOR_WARMING: "lazy"
	//     audit_logs:
	//       NORNICDB_SEARCH_BM25_ENABLED: "false"
	//       NORNICDB_SEARCH_VECTOR_ENABLED: "false"
	Databases map[string]map[string]string `yaml:"databases"`
}