config

type AIConfig struct {
	Enabled              bool          `mapstructure:"enabled"`                // Enable AI chatbot functionality
	ChatbotsDir          string        `mapstructure:"chatbots_dir"`           // Directory for chatbot definitions
	AutoLoadOnBoot       bool          `mapstructure:"auto_load_on_boot"`      // Load chatbots from filesystem at boot
	DefaultMaxTokens     int           `mapstructure:"default_max_tokens"`     // Default max tokens per request
	DefaultModel         string        `mapstructure:"default_model"`          // Default AI model
	QueryTimeout         time.Duration `mapstructure:"query_timeout"`          // SQL query execution timeout
	MaxRowsPerQuery      int           `mapstructure:"max_rows_per_query"`     // Max rows returned per query
	ConversationCacheTTL time.Duration `mapstructure:"conversation_cache_ttl"` // TTL for conversation cache
	MaxConversationTurns int           `mapstructure:"max_conversation_turns"` // Max turns per conversation
	SyncAllowedIPRanges  []string      `mapstructure:"sync_allowed_ip_ranges"` // IP CIDR ranges allowed to sync chatbots

	// Provider Configuration (read-only in dashboard when set)
	// If ProviderType is set, a config-based provider will be added to the list
	ProviderType  string `mapstructure:"provider_type"`  // Provider type: openai, azure, ollama, anthropic
	ProviderName  string `mapstructure:"provider_name"`  // Display name for config provider
	ProviderModel string `mapstructure:"provider_model"` // Default model for config provider

	// Embedding Configuration (for vector search)
	EmbeddingEnabled  bool   `mapstructure:"embedding_enabled"`  // Enable embedding generation for vector search
	EmbeddingProvider string `mapstructure:"embedding_provider"` // Embedding provider: openai, azure, ollama (defaults to ProviderType)
	EmbeddingModel    string `mapstructure:"embedding_model"`    // Embedding model: text-embedding-3-small, text-embedding-3-large, etc.

	// OpenAI Settings
	OpenAIAPIKey         string `mapstructure:"openai_api_key"`
	OpenAIOrganizationID string `mapstructure:"openai_organization_id"`
	OpenAIBaseURL        string `mapstructure:"openai_base_url"`

	// Azure Settings
	AzureAPIKey         string `mapstructure:"azure_api_key"`
	AzureEndpoint       string `mapstructure:"azure_endpoint"`
	AzureDeploymentName string `mapstructure:"azure_deployment_name"`
	AzureAPIVersion     string `mapstructure:"azure_api_version"`

	// Azure Embedding Settings (optional, falls back to Azure Settings)
	AzureEmbeddingDeploymentName string `mapstructure:"azure_embedding_deployment_name"` // Separate deployment for embeddings

	// Ollama Settings
	OllamaEndpoint string `mapstructure:"ollama_endpoint"`
	OllamaModel    string `mapstructure:"ollama_model"`

	// Tavily websearch Settings (for Web Agent specialist)
	// When TavilyAPIKey is set, a read-only synthetic FROM_CONFIG tool
	// integration row is exposed so instance-level deployments work the
	// same as multi-tenant dashboard deployments. Mirror the OpenAI/
	// Ollama env-config pattern.
	TavilyAPIKey       string `mapstructure:"tavily_api_key"`
	TavilyDefaultDepth string `mapstructure:"tavily_default_depth"` // "basic" (default) or "advanced"
	TavilyBaseURL      string `mapstructure:"tavily_base_url"`      // optional override

	// OCR Configuration (for image-based PDF extraction in knowledge bases)
	OCREnabled   bool     `mapstructure:"ocr_enabled"`   // Enable OCR for image-based PDFs
	OCRProvider  string   `mapstructure:"ocr_provider"`  // OCR provider: tesseract
	OCRLanguages []string `mapstructure:"ocr_languages"` // Default languages for OCR (e.g., ["eng", "deu"])

	// RAG Configuration (for retrieval-augmented generation)
	RAGGraphBoostWeight float64 `mapstructure:"rag_graph_boost_weight"` // How much to weight entity matches vs vector similarity (0.0-1.0, default 0)

	// Entity Extraction Configuration (knowledge graph quality)
	// Strategy: rules (regex, default), llm (model-backed with rule fallback),
	// hybrid (both merged). Per-KB override via entity_extraction_strategy.
	EntityExtractionStrategy     string        `mapstructure:"entity_extraction_strategy"`       // rules | llm | hybrid
	EntityExtractionMaxTokens    int           `mapstructure:"entity_extraction_max_tokens"`     // Max tokens per LLM extraction request (default 2000)
	EntityExtractionMinTextChars int           `mapstructure:"entity_extraction_min_text_chars"` // Skip the LLM below this text length (default 200)
	EntityExtractionTimeout      time.Duration `mapstructure:"entity_extraction_timeout"`        // Per-extraction-request timeout (default 60s)

	// Rerank Configuration (RAG retrieval quality). When enabled, retrieved
	// chunks are re-ordered by a relevance model before being used. Provider:
	// llm (uses the default chat provider, no extra vendor) or cohere (Cohere
	// Rerank API). Per-KB opt-out via rerank_enabled.
	RerankEnabled  bool          `mapstructure:"rerank_enabled"`  // Enable reranking (default false)
	RerankProvider string        `mapstructure:"rerank_provider"` // llm | cohere (default llm)
	RerankModel    string        `mapstructure:"rerank_model"`    // Model override (cohere default: rerank-v3.5; llm: provider default)
	RerankAPIKey   string        `mapstructure:"rerank_api_key"`  // API key for cohere provider
	RerankBaseURL  string        `mapstructure:"rerank_base_url"` // Optional base URL override (cohere)
	RerankTopN     int           `mapstructure:"rerank_top_n"`    // Max results kept after reranking (default 10)
	RerankTimeout  time.Duration `mapstructure:"rerank_timeout"`  // Per-rerank-request timeout (default 10s)

	// Response Cache Configuration (AI chatbot cost/latency optimization).
	// Opt-in per chatbot via @fluxbase:response-cache; entries expire after
	// this TTL and are invalidated when linked KB documents change. Set to 0s
	// to disable globally.
	ResponseCacheTTL time.Duration `mapstructure:"response_cache_ttl"` // default 1h
}

type APIConfig struct {
	MaxPageSize     int `mapstructure:"max_page_size"`     // Max rows per request (-1 = unlimited)
	MaxTotalResults int `mapstructure:"max_total_results"` // Max total retrievable rows via offset+limit (-1 = unlimited)
	DefaultPageSize int `mapstructure:"default_page_size"` // Auto-applied when no limit specified (-1 = no default)
	MaxBatchSize    int `mapstructure:"max_batch_size"`    // Max records in batch insert/update (-1 = unlimited, default: 1000)
}

type AdaptiveTrustConfig struct {
	Enabled bool `mapstructure:"enabled"` // Enable adaptive trust (skip CAPTCHA for trusted users)

	// Trust token settings
	TrustTokenTTL     time.Duration `mapstructure:"trust_token_ttl"`      // How long a CAPTCHA solution is trusted (default: 15m)
	TrustTokenBoundIP bool          `mapstructure:"trust_token_bound_ip"` // Token only valid from same IP (default: true)

	// Challenge settings
	ChallengeExpiry time.Duration `mapstructure:"challenge_expiry"` // How long a challenge_id is valid (default: 5m)

	// Trust score threshold - score below this requires CAPTCHA
	CaptchaThreshold int `mapstructure:"captcha_threshold"` // Default: 50

	// Trust signal weights (positive signals)
	WeightKnownIP          int `mapstructure:"weight_known_ip"`          // User logged in from this IP before (default: 30)
	WeightKnownDevice      int `mapstructure:"weight_known_device"`      // Device fingerprint seen before (default: 25)
	WeightRecentCaptcha    int `mapstructure:"weight_recent_captcha"`    // Solved CAPTCHA recently (default: 40)
	WeightVerifiedEmail    int `mapstructure:"weight_verified_email"`    // Email address is confirmed (default: 15)
	WeightAccountAge       int `mapstructure:"weight_account_age"`       // Account older than 7 days (default: 10)
	WeightSuccessfulLogins int `mapstructure:"weight_successful_logins"` // 3+ successful logins (default: 10)
	WeightMFAEnabled       int `mapstructure:"weight_mfa_enabled"`       // User has MFA configured (default: 20)

	// Trust signal weights (negative signals)
	WeightNewIP          int `mapstructure:"weight_new_ip"`          // Never seen this IP (default: -30)
	WeightNewDevice      int `mapstructure:"weight_new_device"`      // Unknown device fingerprint (default: -25)
	WeightFailedAttempts int `mapstructure:"weight_failed_attempts"` // Recent failed login attempts (default: -20)

	// Per-endpoint overrides (some actions always need CAPTCHA regardless of trust)
	AlwaysRequireEndpoints []string `mapstructure:"always_require_endpoints"` // Endpoints that always require CAPTCHA (default: ["password_reset"])
}

type AdminConfig struct {
	Enabled bool `mapstructure:"enabled"` // Enable admin dashboard UI (React app). API routes are always available when setup_token is set.
}

type AuthConfig struct {
	JWTSecret           string        `mapstructure:"jwt_secret"`
	JWTExpiry           time.Duration `mapstructure:"jwt_expiry"`
	RefreshExpiry       time.Duration `mapstructure:"refresh_expiry"`
	ServiceRoleTTL      time.Duration `mapstructure:"service_role_ttl"` // TTL for service role tokens (default: 24h)
	AnonTTL             time.Duration `mapstructure:"anon_ttl"`         // TTL for anonymous tokens (default: 24h)
	MagicLinkExpiry     time.Duration `mapstructure:"magic_link_expiry"`
	PasswordResetExpiry time.Duration `mapstructure:"password_reset_expiry"`
	PasswordMinLen      int           `mapstructure:"password_min_length"`
	BcryptCost          int           `mapstructure:"bcrypt_cost"`
	SignupEnabled       bool          `mapstructure:"signup_enabled"`
	MagicLinkEnabled    bool          `mapstructure:"magic_link_enabled"`
	TOTPIssuer          string        `mapstructure:"totp_issuer"` // Issuer name displayed in authenticator apps for 2FA (e.g., "MyApp")

	// OAuth/OIDC provider configuration (unified for all providers)
	// Well-known providers (google, apple, microsoft) auto-detect issuer URLs
	// Custom providers require explicit issuer_url (supports base URLs like https://auth.domain.com or full .well-known URLs)
	OAuthProviders []OAuthProviderConfig `mapstructure:"oauth_providers"`

	// SAML SSO providers for enterprise authentication
	SAMLProviders []SAMLProviderConfig `mapstructure:"saml_providers"`

	// AllowUserClientKeys controls whether regular users can create their own client keys.
	// When false, only admins (service_role or instance_admin) can create/manage client keys,
	// and existing user-created keys are blocked from authenticating.
	// Default: true
	AllowUserClientKeys bool `mapstructure:"allow_user_client_keys"`

	// OAuthStateStorage configures how OAuth state tokens are stored.
	// "memory" - In-memory storage (default, single-instance only)
	// "database" - PostgreSQL storage (required for multi-instance deployments)
	// Default: "memory"
	OAuthStateStorage string `mapstructure:"oauth_state_storage"`
}

type BodyLimitsConfig struct {
	// Enabled controls whether per-endpoint limits are enforced (default: true)
	Enabled bool `mapstructure:"enabled"`
	// DefaultLimit is used when no pattern matches (default: 1MB)
	DefaultLimit int64 `mapstructure:"default_limit"`
	// RESTLimit for REST API CRUD operations (default: 1MB)
	RESTLimit int64 `mapstructure:"rest_limit"`
	// AuthLimit for authentication endpoints (default: 64KB)
	AuthLimit int64 `mapstructure:"auth_limit"`
	// StorageLimit for file uploads (default: 500MB)
	StorageLimit int64 `mapstructure:"storage_limit"`
	// BulkLimit for bulk operations and RPC (default: 10MB)
	BulkLimit int64 `mapstructure:"bulk_limit"`
	// AdminLimit for admin endpoints (default: 5MB)
	AdminLimit int64 `mapstructure:"admin_limit"`
	// MaxJSONDepth limits nesting depth to prevent stack overflow (default: 64)
	MaxJSONDepth int `mapstructure:"max_json_depth"`
}

type BranchingConfig struct {
	Enabled              bool          `mapstructure:"enabled"`                 // Enable database branching feature
	MaxTotalBranches     int           `mapstructure:"max_total_branches"`      // Maximum total branches across all users (default: 50)
	MaxBranchesPerUser   int           `mapstructure:"max_branches_per_user"`   // Maximum branches per user (default: 5)
	MaxBranchesPerTenant int           `mapstructure:"max_branches_per_tenant"` // Maximum branches per tenant (default: 10)
	DefaultDataCloneMode string        `mapstructure:"default_data_clone_mode"` // Default data clone mode: schema_only, full_clone, seed_data
	AutoDeleteAfter      time.Duration `mapstructure:"auto_delete_after"`       // Auto-delete preview branches after this duration (0 = never)
	DatabasePrefix       string        `mapstructure:"database_prefix"`         // Prefix for branch database names (default: "branch_")
	SeedsPath            string        `mapstructure:"seeds_path"`              // Path to seed data files directory (default: "./seeds")
	DefaultBranch        string        `mapstructure:"default_branch"`          // Default branch for all requests (default: "main")
	MaxTotalConnections  int           `mapstructure:"max_total_connections"`   // Global limit for total branch pool connections (default: 500)
	PoolEvictionAge      time.Duration `mapstructure:"pool_eviction_age"`       // Age threshold for evicting idle branch pools (default: 1h)
	// AllowUnsignedWebhooks permits GitHub webhook deliveries without a valid
	// X-Hub-Signature-256 signature for repositories that have no webhook
	// secret configured. Defaults to false (unsigned deliveries are rejected).
	AllowUnsignedWebhooks bool `mapstructure:"allow_unsigned_webhooks"`
}

type CORSConfig struct {
	AllowedOrigins   []string `mapstructure:"allowed_origins"`   // List of allowed origins (use ["*"] for all)
	AllowedMethods   []string `mapstructure:"allowed_methods"`   // List of allowed HTTP methods
	AllowedHeaders   []string `mapstructure:"allowed_headers"`   // List of allowed headers
	ExposedHeaders   []string `mapstructure:"exposed_headers"`   // List of exposed headers
	AllowCredentials bool     `mapstructure:"allow_credentials"` // Allow credentials (cookies, authorization headers)
	MaxAge           int      `mapstructure:"max_age"`           // Max age for preflight cache in seconds
}

type CaptchaConfig struct {
	Enabled        bool     `mapstructure:"enabled"`         // Enable CAPTCHA verification
	Provider       string   `mapstructure:"provider"`        // Provider: hcaptcha, recaptcha_v3, turnstile, cap
	SiteKey        string   `mapstructure:"site_key"`        // Public site key (sent to frontend)
	SecretKey      string   `mapstructure:"secret_key"`      // Secret key for server-side verification
	ScoreThreshold float64  `mapstructure:"score_threshold"` // Min score for reCAPTCHA v3 (0.0-1.0, default 0.5)
	Endpoints      []string `mapstructure:"endpoints"`       // Endpoints requiring CAPTCHA: signup, login, password_reset, magic_link
	// Cap provider settings (self-hosted proof-of-work CAPTCHA)
	CapServerURL string `mapstructure:"cap_server_url"` // URL of Cap server (e.g., http://localhost:3000)
	CapAPIKey    string `mapstructure:"cap_api_key"`    // API key for Cap server authentication
	// Adaptive trust settings for intelligent CAPTCHA decisions
	AdaptiveTrust AdaptiveTrustConfig `mapstructure:"adaptive_trust"`
}

type Config struct {
	Server        ServerConfig     `mapstructure:"server"`
	Database      DatabaseConfig   `mapstructure:"database"`
	Auth          AuthConfig       `mapstructure:"auth"`
	Security      SecurityConfig   `mapstructure:"security"`
	CORS          CORSConfig       `mapstructure:"cors"`
	Storage       StorageConfig    `mapstructure:"storage"`
	Realtime      RealtimeConfig   `mapstructure:"realtime"`
	Email         EmailConfig      `mapstructure:"email"`
	Functions     FunctionsConfig  `mapstructure:"functions"`
	API           APIConfig        `mapstructure:"api"`
	Migrations    MigrationsConfig `mapstructure:"migrations"`
	Jobs          JobsConfig       `mapstructure:"jobs"`
	Deno          DenoConfig       `mapstructure:"deno"`
	Tracing       TracingConfig    `mapstructure:"tracing"`
	Metrics       MetricsConfig    `mapstructure:"metrics"`
	AI            AIConfig         `mapstructure:"ai"`
	RPC           RPCConfig        `mapstructure:"rpc"`
	GraphQL       GraphQLConfig    `mapstructure:"graphql"`
	MCP           MCPConfig        `mapstructure:"mcp"`
	Branching     BranchingConfig  `mapstructure:"branching"`
	Scaling       ScalingConfig    `mapstructure:"scaling"`
	Logging       LoggingConfig    `mapstructure:"logging"`
	Admin         AdminConfig      `mapstructure:"admin"`
	Tenants       TenantsConfig    `mapstructure:"tenants"`
	BaseURL       string           `mapstructure:"base_url"`        // Internal base URL (for server-to-server communication)
	PublicBaseURL string           `mapstructure:"public_base_url"` // Public base URL (for user-facing links, OAuth callbacks, etc.)
	Debug         bool             `mapstructure:"debug"`

	// EncryptionKey is used to encrypt sensitive data stored in the database (e.g., client keys, credentials)
	// Must be exactly 32 bytes for AES-256. Generate with: openssl rand -base64 32 | head -c 32
	// Only required if you configure providers (Email, AI) through the admin dashboard instead of env vars
	EncryptionKey      string `mapstructure:"encryption_key"`
	EncryptionKeyBytes []byte
}

type DatabaseConfig struct {
	Host                 string                      `mapstructure:"host"`
	Port                 int                         `mapstructure:"port"`
	User                 string                      `mapstructure:"user"`           // Database user for normal operations
	AdminUser            string                      `mapstructure:"admin_user"`     // Optional admin user for migrations (defaults to User)
	Password             string                      `mapstructure:"password"`       // Password for runtime user
	AdminPassword        string                      `mapstructure:"admin_password"` // Optional password for admin user (defaults to Password)
	Database             string                      `mapstructure:"database"`
	SSLMode              string                      `mapstructure:"ssl_mode"`
	MaxConnections       int32                       `mapstructure:"max_connections"`
	MinConnections       int32                       `mapstructure:"min_connections"`
	MaxConnLifetime      time.Duration               `mapstructure:"max_conn_lifetime"`
	MaxConnIdleTime      time.Duration               `mapstructure:"max_conn_idle_time"`
	HealthCheck          time.Duration               `mapstructure:"health_check_period"`
	UserMigrationsPath   string                      `mapstructure:"user_migrations_path"`   // Path to user-provided migration files
	SlowQueryThreshold   time.Duration               `mapstructure:"slow_query_threshold"`   // Log queries slower than this (default: 1s)
	DeclarativeAppSchema *DeclarativeAppSchemaConfig `mapstructure:"declarative_app_schema"` // Opt-in declarative schema for application tables (e.g. public)
	ConnectTimeout       time.Duration               `mapstructure:"connect_timeout"`        // Per-attempt TCP connect timeout sent to Postgres (default: 10s)
	RetryAttempts        int                         `mapstructure:"retry_attempts"`         // Startup retry attempts for DB-dependent steps (default: 8)
	RetryInitialBackoff  time.Duration               `mapstructure:"retry_initial_backoff"`  // First retry backoff (default: 1s)
	RetryMaxBackoff      time.Duration               `mapstructure:"retry_max_backoff"`      // Cap on each retry backoff (default: 30s)
}

type DeclarativeAppSchemaConfig struct {
	// Enabled controls whether declarative app-schema management is active.
	Enabled bool `mapstructure:"enabled"`
	// Schema is the target PostgreSQL schema (default "public").
	Schema string `mapstructure:"schema"`
	// Namespaces restricts which synced app namespaces are applied on startup.
	// Empty/nil means all stored namespaces.
	Namespaces []string `mapstructure:"namespaces"`
	// OnStartup applies stored app-schema content during server startup.
	OnStartup bool `mapstructure:"on_startup"`
	// AllowDestructive permits DROP/ALTER destructive changes (default false; they are blocked and reported).
	AllowDestructive bool `mapstructure:"allow_destructive"`
}

type DefaultTenantConfig struct {
	Name           string `mapstructure:"name"`
	AnonKey        string `mapstructure:"anon_key"`
	ServiceKey     string `mapstructure:"service_key"`
	AnonKeyFile    string `mapstructure:"anon_key_file"`
	ServiceKeyFile string `mapstructure:"service_key_file"`
}

type DenoConfig struct {
	NpmRegistry string `mapstructure:"npm_registry"` // Custom npm registry URL (e.g., https://npm.your-company.com/)
	JsrRegistry string `mapstructure:"jsr_registry"` // Custom JSR registry URL (e.g., https://jsr.your-company.com/)
}

type EmailConfig struct {
	Enabled        bool   `mapstructure:"enabled"`
	Provider       string `mapstructure:"provider"` // smtp, sendgrid, mailgun, ses
	FromAddress    string `mapstructure:"from_address"`
	FromName       string `mapstructure:"from_name"`
	ReplyToAddress string `mapstructure:"reply_to_address"`

	// SMTP Settings
	SMTPHost     string `mapstructure:"smtp_host"`
	SMTPPort     int    `mapstructure:"smtp_port"`
	SMTPUsername string `mapstructure:"smtp_username"`
	SMTPPassword string `mapstructure:"smtp_password"`
	SMTPTLS      bool   `mapstructure:"smtp_tls"`

	// SendGrid Settings
	SendGridAPIKey string `mapstructure:"sendgrid_api_key"`

	// Mailgun Settings
	MailgunAPIKey string `mapstructure:"mailgun_api_key"`
	MailgunDomain string `mapstructure:"mailgun_domain"`

	// AWS SES Settings
	SESAccessKey string `mapstructure:"ses_access_key"`
	SESSecretKey string `mapstructure:"ses_secret_key"`
	SESRegion    string `mapstructure:"ses_region"`

	// Templates
	MagicLinkTemplate     string `mapstructure:"magic_link_template"`
	VerificationTemplate  string `mapstructure:"verification_template"`
	PasswordResetTemplate string `mapstructure:"password_reset_template"`
}

type FunctionsConfig struct {
	Enabled                 bool     `mapstructure:"enabled"`
	FunctionsDir            string   `mapstructure:"functions_dir"`
	AutoLoadOnBoot          bool     `mapstructure:"auto_load_on_boot"`         // Load functions from filesystem at boot
	DefaultTimeout          int      `mapstructure:"default_timeout"`           // seconds
	MaxTimeout              int      `mapstructure:"max_timeout"`               // seconds
	DefaultMemoryLimit      int      `mapstructure:"default_memory_limit"`      // MB
	MaxMemoryLimit          int      `mapstructure:"max_memory_limit"`          // MB
	MaxOutputSize           int      `mapstructure:"max_output_size"`           // Max output size in bytes (0 = unlimited, default: 10MB)
	MaxConcurrentExecutions int      `mapstructure:"max_concurrent_executions"` // Global cap on concurrent function executions (0 = default 32)
	SyncAllowedIPRanges     []string `mapstructure:"sync_allowed_ip_ranges"`    // IP CIDR ranges allowed to sync functions
}

type GraphQLConfig struct {
	Enabled         bool `mapstructure:"enabled"`            // Enable GraphQL API endpoint
	MaxDepth        int  `mapstructure:"max_depth"`          // Maximum query depth (default: 10)
	MaxComplexity   int  `mapstructure:"max_complexity"`     // Maximum query complexity score (default: 1000)
	Introspection   bool `mapstructure:"introspection"`      // Enable GraphQL introspection (default: true in dev, false in prod)
	AllowFragments  bool `mapstructure:"allow_fragments"`    // Allow fragment spreads in queries (default: false for security)
	MaxFieldsPerLvl int  `mapstructure:"max_fields_per_lvl"` // Maximum unique fields per query level (default: 50)
}

type JobsConfig struct {
	Enabled                   bool          `mapstructure:"enabled"`
	JobsDir                   string        `mapstructure:"jobs_dir"`
	AutoLoadOnBoot            bool          `mapstructure:"auto_load_on_boot"`            // Load jobs from filesystem at boot
	WorkerMode                string        `mapstructure:"worker_mode"`                  // "embedded", "standalone", "disabled"
	EmbeddedWorkerCount       int           `mapstructure:"embedded_worker_count"`        // Number of embedded workers
	MaxConcurrentPerWorker    int           `mapstructure:"max_concurrent_per_worker"`    // Max concurrent jobs per worker
	MaxConcurrentPerNamespace int           `mapstructure:"max_concurrent_per_namespace"` // Max concurrent jobs per namespace
	DefaultMaxDuration        time.Duration `mapstructure:"default_max_duration"`         // Default job timeout
	MaxMaxDuration            time.Duration `mapstructure:"max_max_duration"`             // Maximum allowed job timeout
	DefaultProgressTimeout    time.Duration `mapstructure:"default_progress_timeout"`     // Default progress timeout
	PollInterval              time.Duration `mapstructure:"poll_interval"`                // Worker poll interval
	WorkerHeartbeatInterval   time.Duration `mapstructure:"worker_heartbeat_interval"`    // Worker heartbeat interval
	WorkerTimeout             time.Duration `mapstructure:"worker_timeout"`               // Worker considered dead after this
	SyncAllowedIPRanges       []string      `mapstructure:"sync_allowed_ip_ranges"`       // IP CIDR ranges allowed to sync jobs
	GracefulShutdownTimeout   time.Duration `mapstructure:"graceful_shutdown_timeout"`    // Time to wait for running jobs during shutdown (default: 5m)
	WorkerMaxRestartBackoff   time.Duration `mapstructure:"worker_max_restart_backoff"`   // Cap for exponential backoff between worker restarts (default: 60s)
}

type LoggingConfig struct {
	// Console output settings
	ConsoleEnabled bool   `mapstructure:"console_enabled"` // Enable console output (default: true)
	ConsoleLevel   string `mapstructure:"console_level"`   // Minimum level for console: trace, debug, info, warn, error
	ConsoleFormat  string `mapstructure:"console_format"`  // Output format: json or console

	// Backend settings
	Backend string `mapstructure:"backend"` // Primary backend: postgres (default), s3, local, timescaledb, loki, elasticsearch, opensearch, clickhouse

	// S3 backend settings (when backend is "s3")
	S3Bucket string `mapstructure:"s3_bucket"` // S3 bucket for logs
	S3Prefix string `mapstructure:"s3_prefix"` // Prefix for log objects (default: "logs")

	// Local backend settings (when backend is "local")
	LocalPath string `mapstructure:"local_path"` // Directory for log files (default: "./logs")

	// TimescaleDB settings (when backend is "timescaledb")
	TimescaleDBEnabled       bool          `mapstructure:"timescaledb_enabled"`
	TimescaleDBCompression   bool          `mapstructure:"timescaledb_compression"`
	TimescaleDBCompressAfter time.Duration `mapstructure:"timescaledb_compress_after"` // Compress after this duration (default: 7d)
	TimescaleDBRetainAfter   time.Duration `mapstructure:"timescaledb_retain_after"`   // Drop chunks older than this (default: 90d)

	// Loki settings (when backend is "loki")
	LokiURL      string   `mapstructure:"loki_url"`       // Loki server URL (required)
	LokiUsername string   `mapstructure:"loki_username"`  // Username for basic auth
	LokiPassword string   `mapstructure:"loki_password"`  // Password for basic auth
	LokiTenantID string   `mapstructure:"loki_tenant_id"` // Tenant ID for multi-tenant Loki
	LokiLabels   []string `mapstructure:"loki_labels"`    // Static labels to add to all logs

	// Elasticsearch settings (when backend is "elasticsearch")
	ElasticsearchURLs     []string `mapstructure:"elasticsearch_urls"`     // Elasticsearch node URLs
	ElasticsearchUsername string   `mapstructure:"elasticsearch_username"` // Username for basic auth
	ElasticsearchPassword string   `mapstructure:"elasticsearch_password"` // Password for basic auth
	ElasticsearchIndex    string   `mapstructure:"elasticsearch_index"`    // Index name pattern (default: "fluxbase-logs")
	ElasticsearchVersion  int      `mapstructure:"elasticsearch_version"`  // Major version: 8 or 9 (default: 8)

	// OpenSearch settings (when backend is "opensearch")
	OpenSearchURLs     []string `mapstructure:"opensearch_urls"`     // OpenSearch node URLs
	OpenSearchUsername string   `mapstructure:"opensearch_username"` // Username for basic auth
	OpenSearchPassword string   `mapstructure:"opensearch_password"` // Password for basic auth
	OpenSearchIndex    string   `mapstructure:"opensearch_index"`    // Index name pattern (default: "fluxbase-logs")
	OpenSearchVersion  int      `mapstructure:"opensearch_version"`  // Major version (default: 2)

	// ClickHouse settings (when backend is "clickhouse")
	ClickHouseAddresses []string `mapstructure:"clickhouse_addresses"` // ClickHouse node addresses (default: ["localhost:9000"])
	ClickHouseUsername  string   `mapstructure:"clickhouse_username"`  // Username (default: "default")
	ClickHousePassword  string   `mapstructure:"clickhouse_password"`  // Password
	ClickHouseDatabase  string   `mapstructure:"clickhouse_database"`  // Database name (default: "fluxbase")
	ClickHouseTable     string   `mapstructure:"clickhouse_table"`     // Table name (default: "logs")
	ClickHouseTTL       int      `mapstructure:"clickhouse_ttl_days"`  // TTL in days (default: 30)

	// Batching settings
	BatchSize     int           `mapstructure:"batch_size"`     // Number of entries per batch (default: 100)
	FlushInterval time.Duration `mapstructure:"flush_interval"` // Max time before flushing (default: 1s)
	BufferSize    int           `mapstructure:"buffer_size"`    // Async buffer size (default: 10000)

	// PubSub notifications (for realtime streaming)
	PubSubEnabled bool `mapstructure:"pubsub_enabled"` // Enable PubSub notifications for execution logs

	// Retention settings (days, 0 = keep forever)
	SystemRetentionDays    int `mapstructure:"system_retention_days"`    // App/system logs (default: 7)
	HTTPRetentionDays      int `mapstructure:"http_retention_days"`      // HTTP access logs (default: 30)
	SecurityRetentionDays  int `mapstructure:"security_retention_days"`  // Security/audit logs (default: 90)
	ExecutionRetentionDays int `mapstructure:"execution_retention_days"` // Function/job/RPC logs (default: 30)
	AIRetentionDays        int `mapstructure:"ai_retention_days"`        // AI query audit logs (default: 30)

	// Retention service settings
	RetentionEnabled       bool          `mapstructure:"retention_enabled"`        // Enable retention cleanup (default: true)
	RetentionCheckInterval time.Duration `mapstructure:"retention_check_interval"` // Interval between cleanup checks (default: 24h)

	// Custom categories
	CustomCategories    []string `mapstructure:"custom_categories"`     // List of allowed custom category names
	CustomRetentionDays int      `mapstructure:"custom_retention_days"` // Retention for custom categories (default: 30)
}

type MCPConfig struct {
	Enabled          bool          `mapstructure:"enabled"`            // Enable MCP server endpoint
	BasePath         string        `mapstructure:"base_path"`          // Base path for MCP endpoints (default: "/mcp")
	SessionTimeout   time.Duration `mapstructure:"session_timeout"`    // Session timeout for stateful connections
	MaxMessageSize   int           `mapstructure:"max_message_size"`   // Maximum message size in bytes
	AllowedTools     []string      `mapstructure:"allowed_tools"`      // Allowed tool names (empty = all enabled)
	AllowedResources []string      `mapstructure:"allowed_resources"`  // Allowed resource URIs (empty = all enabled)
	RateLimitPerMin  int           `mapstructure:"rate_limit_per_min"` // Rate limit per minute per client key

	// Custom MCP tools configuration
	ToolsDir       string `mapstructure:"tools_dir"`         // Directory for custom MCP tool files (default: "/app/mcp-tools")
	AutoLoadOnBoot bool   `mapstructure:"auto_load_on_boot"` // Auto-load custom tools from ToolsDir on startup

	// OAuth 2.1 configuration for MCP
	OAuth MCPOAuthConfig `mapstructure:"oauth"`
}

type MCPOAuthConfig struct {
	Enabled             bool          `mapstructure:"enabled"`               // Enable OAuth for MCP (zero-config Claude Desktop integration)
	DCREnabled          bool          `mapstructure:"dcr_enabled"`           // Enable Dynamic Client Registration (RFC 7591)
	AllowedRedirectURIs []string      `mapstructure:"allowed_redirect_uris"` // Allowed OAuth redirect URIs
	TokenExpiry         time.Duration `mapstructure:"token_expiry"`          // Access token expiry (default: 1h)
	RefreshTokenExpiry  time.Duration `mapstructure:"refresh_token_expiry"`  // Refresh token expiry (default: 168h / 7 days)
}

type MetricsConfig struct {
	Enabled bool   `mapstructure:"enabled"` // Enable Prometheus metrics endpoint
	Port    int    `mapstructure:"port"`    // Port for metrics server (default: 9090)
	Path    string `mapstructure:"path"`    // Path for metrics endpoint (default: /metrics)
}

type MigrationsConfig struct {
	Enabled         bool     `mapstructure:"enabled"`           // Enable migrations API (enabled by default)
	AllowedIPRanges []string `mapstructure:"allowed_ip_ranges"` // IP CIDR ranges allowed to access migrations API
}

type OAuthProviderConfig struct {
	Name         string   `mapstructure:"name"`                    // Provider name (e.g., "google", "apple", "keycloak")
	Enabled      bool     `mapstructure:"enabled"`                 // Enable this provider (default: true)
	ClientID     string   `mapstructure:"client_id"`               // OAuth client ID (REQUIRED)
	ClientSecret string   `mapstructure:"client_secret,omitempty"` // Client secret (optional, can be stored in database)
	IssuerURL    string   `mapstructure:"issuer_url,omitempty"`    // OIDC issuer URL - supports base URLs (e.g., https://auth.domain.com) with auto-discovery or full .well-known URLs (auto-detected for well-known providers)
	RedirectURLs []string `mapstructure:"redirect_urls,omitempty"` // Additional allowed OAuth redirect URLs (the default callback URL is always included)
	Scopes       []string `mapstructure:"scopes,omitempty"`        // OAuth scopes
	DisplayName  string   `mapstructure:"display_name,omitempty"`  // Display name for UI

	// Login targeting
	AllowDashboardLogin bool `mapstructure:"allow_dashboard_login"` // Allow for dashboard admin SSO (default: false)
	AllowAppLogin       bool `mapstructure:"allow_app_login"`       // Allow for app user authentication (default: true)

	// Claims-based access control
	RequiredClaims map[string][]string `mapstructure:"required_claims"` // Claims that must be present in ID token, e.g., {"roles": ["admin"], "department": ["IT"]}
	DeniedClaims   map[string][]string `mapstructure:"denied_claims"`   // Deny access if these claim values are present
}

type RPCConfig struct {
	Enabled             bool     `mapstructure:"enabled"`                // Enable RPC functionality
	ProceduresDir       string   `mapstructure:"procedures_dir"`         // Directory for RPC procedure definitions
	AutoLoadOnBoot      bool     `mapstructure:"auto_load_on_boot"`      // Load procedures from filesystem at boot
	DefaultMaxRows      int      `mapstructure:"default_max_rows"`       // Default max rows returned
	SyncAllowedIPRanges []string `mapstructure:"sync_allowed_ip_ranges"` // IP CIDR ranges allowed to sync procedures
}

type RealtimeConfig struct {
	Enabled                bool          `mapstructure:"enabled"`
	MaxConnections         int           `mapstructure:"max_connections"`
	MaxConnectionsPerUser  int           `mapstructure:"max_connections_per_user"`  // Max connections per authenticated user (0 = unlimited)
	MaxConnectionsPerIP    int           `mapstructure:"max_connections_per_ip"`    // Max connections per IP for anonymous connections (0 = unlimited)
	RLSCacheSize           int           `mapstructure:"rls_cache_size"`            // Maximum entries in RLS cache (default: 100000)
	RLSCacheTTL            time.Duration `mapstructure:"rls_cache_ttl"`             // TTL for RLS cache entries (default: 30s)
	ListenerPoolSize       int           `mapstructure:"listener_pool_size"`        // Number of LISTEN connections for redundancy (default: 2)
	NotificationWorkers    int           `mapstructure:"notification_workers"`      // Number of workers for parallel notification processing (default: 4)
	ClientMessageQueueSize int           `mapstructure:"client_message_queue_size"` // Size of per-client message queue for async sending (default: 256)
	SlowClientThreshold    int           `mapstructure:"slow_client_threshold"`     // Queue length threshold for slow client detection (default: 100)
	SlowClientTimeout      time.Duration `mapstructure:"slow_client_timeout"`       // Duration before disconnecting slow clients (default: 30s)
	MaxMessageSize         int64         `mapstructure:"max_message_size"`          // Max inbound WebSocket message size in bytes (default: 65536, see config_realtime.go)
}

type SAMLProviderConfig struct {
	Name             string            `mapstructure:"name"`              // Provider name (e.g., "okta", "azure-ad")
	Enabled          bool              `mapstructure:"enabled"`           // Enable this provider
	IdPMetadataURL   string            `mapstructure:"idp_metadata_url"`  // IdP metadata URL (recommended)
	IdPMetadataXML   string            `mapstructure:"idp_metadata_xml"`  // IdP metadata XML (alternative to URL)
	EntityID         string            `mapstructure:"entity_id"`         // SP entity ID (unique identifier for this app)
	AcsURL           string            `mapstructure:"acs_url"`           // Assertion Consumer Service URL (callback)
	AttributeMapping map[string]string `mapstructure:"attribute_mapping"` // Map SAML attributes to user fields
	AutoCreateUsers  bool              `mapstructure:"auto_create_users"` // Create user if not exists
	DefaultRole      string            `mapstructure:"default_role"`      // Default role for new users (authenticated)

	// Security options
	AllowIDPInitiated        bool     `mapstructure:"allow_idp_initiated"`         // Allow IdP-initiated SSO (default: false for security)
	AllowedRedirectHosts     []string `mapstructure:"allowed_redirect_hosts"`      // Whitelist for RelayState redirect URLs
	AllowInsecureMetadataURL bool     `mapstructure:"allow_insecure_metadata_url"` // Allow HTTP metadata URLs (default: false)

	// Login targeting
	AllowDashboardLogin bool `mapstructure:"allow_dashboard_login"` // Allow for dashboard admin SSO (default: false)
	AllowAppLogin       bool `mapstructure:"allow_app_login"`       // Allow for app user authentication (default: true)

	// Role/Group-based access control
	RequiredGroups    []string `mapstructure:"required_groups"`     // User must be in at least ONE of these groups (OR logic)
	RequiredGroupsAll []string `mapstructure:"required_groups_all"` // User must be in ALL of these groups (AND logic)
	DeniedGroups      []string `mapstructure:"denied_groups"`       // Reject if user is in any of these groups
	GroupAttribute    string   `mapstructure:"group_attribute"`     // SAML attribute name for groups (default: "groups")

	// SP signing keys for SLO (Single Logout) - PEM-encoded
	SPCertificate string `mapstructure:"sp_certificate"` // PEM-encoded X.509 certificate for signing
	SPPrivateKey  string `mapstructure:"sp_private_key"` // PEM-encoded private key for signing

	// Logout signature verification
	RequireLogoutSignature *bool `mapstructure:"require_logout_signature"` // Require signed SAML logout messages (default: true)
}

type ScalingConfig struct {
	// WorkerOnly mode disables the API server and only runs job workers
	// Use this for dedicated worker containers that only process background jobs
	WorkerOnly bool `mapstructure:"worker_only"`

	// DisableScheduler prevents cron schedulers from running on this instance
	// Use this when running multiple instances to prevent duplicate scheduled jobs
	// Only one instance should run the scheduler (use leader election or manual config)
	DisableScheduler bool `mapstructure:"disable_scheduler"`

	// DisableRealtime prevents the realtime listener from starting
	// Useful for worker-only instances or when using an external realtime service
	DisableRealtime bool `mapstructure:"disable_realtime"`

	// EnableSchedulerLeaderElection enables automatic leader election for schedulers
	// When enabled, only one instance will run schedulers using PostgreSQL advisory locks
	// This is the recommended setting for multi-instance deployments
	EnableSchedulerLeaderElection bool `mapstructure:"enable_scheduler_leader_election"`

	// Backend for distributed state (rate limiting, pub/sub, sessions)
	// Options: "local" (single instance), "postgres", "redis"
	// "redis" works with Dragonfly (recommended), Redis, Valkey, KeyDB
	Backend string `mapstructure:"backend"`

	// RedisURL is the connection URL for Redis-compatible backends (Dragonfly recommended)
	// Only used when Backend is "redis"
	// Format: redis://[password@]host:port[/db]
	RedisURL string `mapstructure:"redis_url"`
}

type SecurityConfig struct {
	EnableGlobalRateLimit bool `mapstructure:"enable_global_rate_limit"` // Global API rate limiting (100 req/min per IP)

	// Service role token revocation behavior
	ServiceRoleFailOpen bool `mapstructure:"service_role_fail_open"` // If false (default), fail-closed when revocation check fails (503). If true, fail-open for backward compatibility.

	// Admin setup security token
	SetupToken string `mapstructure:"setup_token"` // Required token for admin setup. If empty, admin dashboard is disabled.

	// Rate limiting for specific endpoints
	AdminSetupRateLimit         int           `mapstructure:"admin_setup_rate_limit"`          // Max attempts for admin setup
	AdminSetupRateWindow        time.Duration `mapstructure:"admin_setup_rate_window"`         // Time window for admin setup rate limit
	AdminLoginRateLimit         int           `mapstructure:"admin_login_rate_limit"`          // Max attempts for admin login
	AdminLoginRateWindow        time.Duration `mapstructure:"admin_login_rate_window"`         // Time window for admin login rate limit
	DashboardLoginRateLimit     int           `mapstructure:"dashboard_login_rate_limit"`      // Max attempts for dashboard user login
	DashboardLoginRateWindow    time.Duration `mapstructure:"dashboard_login_rate_window"`     // Time window for dashboard user login rate limit
	AuthLoginRateLimit          int           `mapstructure:"auth_login_rate_limit"`           // Max attempts for auth login
	AuthLoginRateWindow         time.Duration `mapstructure:"auth_login_rate_window"`          // Time window for auth login rate limit
	AuthSignupRateLimit         int           `mapstructure:"auth_signup_rate_limit"`          // Max attempts for auth signup
	AuthSignupRateWindow        time.Duration `mapstructure:"auth_signup_rate_window"`         // Time window for auth signup rate limit
	AuthPasswordResetRateLimit  int           `mapstructure:"auth_password_reset_rate_limit"`  // Max attempts for password reset
	AuthPasswordResetRateWindow time.Duration `mapstructure:"auth_password_reset_rate_window"` // Time window for password reset rate limit
	Auth2FARateLimit            int           `mapstructure:"auth_2fa_rate_limit"`             // Max attempts for 2FA verification
	Auth2FARateWindow           time.Duration `mapstructure:"auth_2fa_rate_window"`            // Time window for 2FA rate limit
	AuthRefreshRateLimit        int           `mapstructure:"auth_refresh_rate_limit"`         // Max attempts for token refresh
	AuthRefreshRateWindow       time.Duration `mapstructure:"auth_refresh_rate_window"`        // Time window for token refresh rate limit
	AuthMagicLinkRateLimit      int           `mapstructure:"auth_magic_link_rate_limit"`      // Max attempts for magic link
	AuthMagicLinkRateWindow     time.Duration `mapstructure:"auth_magic_link_rate_window"`     // Time window for magic link rate limit

	// Rate limiting for service_role tokens (bypassed by default, but can be enabled)
	ServiceRoleRateLimit  int           `mapstructure:"service_role_rate_limit"`  // Max requests for service_role tokens (0 = unlimited)
	ServiceRoleRateWindow time.Duration `mapstructure:"service_role_rate_window"` // Time window for service_role rate limit

	// CAPTCHA configuration for bot protection
	Captcha CaptchaConfig `mapstructure:"captcha"`
}

type ServerConfig struct {
	Address         string        `mapstructure:"address"`
	ReadTimeout     time.Duration `mapstructure:"read_timeout"`
	WriteTimeout    time.Duration `mapstructure:"write_timeout"`
	IdleTimeout     time.Duration `mapstructure:"idle_timeout"`
	BodyLimit       int           `mapstructure:"body_limit"`
	AllowedIPRanges []string      `mapstructure:"allowed_ip_ranges"` // Global IP CIDR ranges allowed to access server (empty = allow all)
	TrustedProxies  []string      `mapstructure:"trusted_proxies"`   // Trusted proxy IP ranges for X-Forwarded-For header validation (empty = trust none)

	// DebugPprof exposes Go's pprof handlers at /debug/pprof for operators.
	// Off by default: profiles expose internals (goroutine stacks, heap
	// contents) and sampling can be expensive. Requires admin/instance_admin
	// credentials when enabled. See docs/guides/operational-runbook.md.
	DebugPprof bool `mapstructure:"debug_pprof"`

	// Per-endpoint body limits (if not specified, uses defaults from middleware)
	BodyLimits BodyLimitsConfig `mapstructure:"body_limits"`
}

type StorageConfig struct {
	Enabled          bool     `mapstructure:"enabled"`  // Enable storage functionality
	Provider         string   `mapstructure:"provider"` // local or s3
	LocalPath        string   `mapstructure:"local_path"`
	S3Endpoint       string   `mapstructure:"s3_endpoint"`
	S3AccessKey      string   `mapstructure:"s3_access_key"`
	S3SecretKey      string   `mapstructure:"s3_secret_key"`
	S3Bucket         string   `mapstructure:"s3_bucket"`
	S3Region         string   `mapstructure:"s3_region"`
	S3ForcePathStyle bool     `mapstructure:"s3_force_path_style"` // Use path-style addressing (required for MinIO, R2, Spaces, etc.)
	DefaultBuckets   []string `mapstructure:"default_buckets"`     // Buckets to auto-create on startup
	// Default buckets that serve public-read URLs (object GETs without auth).
	// Kept separate from default_buckets so private-by-default remains the
	// zero-config behavior; apps rendering public object URLs declare their
	// content buckets here.
	DefaultPublicBuckets []string `mapstructure:"default_public_buckets"`
	MaxUploadSize        int64    `mapstructure:"max_upload_size"`

	// Image transformation settings
	Transforms TransformConfig `mapstructure:"transforms"`
}

type TenantConfigLoader struct {
	// contains filtered or unexported fields
}

type TenantDeclarativeConfig struct {
	// Enabled controls whether tenant-specific declarative schemas are applied
	Enabled bool `mapstructure:"enabled"`
	// SchemaDir is the directory containing tenant schema files
	// Structure: {SchemaDir}/{tenant-slug}/public.sql
	// Example: schemas/acme-corp/public.sql
	SchemaDir string `mapstructure:"schema_dir"`
	// OnCreate applies declarative schemas when a tenant database is created
	OnCreate bool `mapstructure:"on_create"`
	// OnStartup applies declarative schemas on server startup (for existing tenants)
	OnStartup bool `mapstructure:"on_startup"`
	// AllowDestructive allows destructive schema changes (DROP, ALTER)
	AllowDestructive bool `mapstructure:"allow_destructive"`
}

type TenantMigrationsConfig struct {
	CheckInterval time.Duration `mapstructure:"check_interval"`
	OnCreate      bool          `mapstructure:"on_create"`
	OnAccess      bool          `mapstructure:"on_access"`
	Background    bool          `mapstructure:"background"`
}

type TenantOverrides struct {
	Auth      *AuthConfig      `mapstructure:"auth"`
	Storage   *StorageConfig   `mapstructure:"storage"`
	Email     *EmailConfig     `mapstructure:"email"`
	Functions *FunctionsConfig `mapstructure:"functions"`
	Jobs      *JobsConfig      `mapstructure:"jobs"`
	AI        *AIConfig        `mapstructure:"ai"`
	Realtime  *RealtimeConfig  `mapstructure:"realtime"`
	API       *APIConfig       `mapstructure:"api"`
	GraphQL   *GraphQLConfig   `mapstructure:"graphql"`
	RPC       *RPCConfig       `mapstructure:"rpc"`
}

type TenantPoolConfig struct {
	MaxTotalConnections int32         `mapstructure:"max_total_connections"`
	EvictionAge         time.Duration `mapstructure:"eviction_age"`
}

type TenantsConfig struct {
	Enabled        bool                       `mapstructure:"enabled"`
	DatabasePrefix string                     `mapstructure:"database_prefix"`
	MaxTenants     int                        `mapstructure:"max_tenants"`
	Pool           TenantPoolConfig           `mapstructure:"pool"`
	Migrations     TenantMigrationsConfig     `mapstructure:"migrations"`
	Declarative    TenantDeclarativeConfig    `mapstructure:"declarative"`
	Default        DefaultTenantConfig        `mapstructure:"default"`
	Configs        map[string]TenantOverrides `mapstructure:"configs"`
	ConfigDir      string                     `mapstructure:"config_dir"`
}

type TracingConfig struct {
	Enabled     bool    `mapstructure:"enabled"`      // Enable OpenTelemetry tracing
	Endpoint    string  `mapstructure:"endpoint"`     // OTLP endpoint (e.g., "localhost:4317")
	ServiceName string  `mapstructure:"service_name"` // Service name for traces (default: "fluxbase")
	Environment string  `mapstructure:"environment"`  // Environment name (development, staging, production)
	SampleRate  float64 `mapstructure:"sample_rate"`  // Sample rate 0.0-1.0 (1.0 = 100%)
	Insecure    bool    `mapstructure:"insecure"`     // Use insecure connection (for local dev)
}

type TransformConfig struct {
	Enabled        bool     `mapstructure:"enabled"`         // Enable on-the-fly image transformations
	DefaultQuality int      `mapstructure:"default_quality"` // Default output quality (1-100)
	MaxWidth       int      `mapstructure:"max_width"`       // Maximum output width in pixels
	MaxHeight      int      `mapstructure:"max_height"`      // Maximum output height in pixels
	AllowedFormats []string `mapstructure:"allowed_formats"` // Allowed output formats (webp, jpg, png, avif)

	// Security settings
	MaxTotalPixels int           `mapstructure:"max_total_pixels"` // Maximum total pixels (width * height), default 16M
	BucketSize     int           `mapstructure:"bucket_size"`      // Dimension bucketing size (default 50px)
	RateLimit      int           `mapstructure:"rate_limit"`       // Transforms per minute per user (default 60)
	Timeout        time.Duration `mapstructure:"timeout"`          // Max transform duration (default 30s)
	MaxConcurrent  int           `mapstructure:"max_concurrent"`   // Max concurrent transforms (default 4)

	// Caching settings
	CacheEnabled bool          `mapstructure:"cache_enabled"`  // Enable transform caching
	CacheTTL     time.Duration `mapstructure:"cache_ttl"`      // Cache TTL (default 24h)
	CacheMaxSize int64         `mapstructure:"cache_max_size"` // Max cache size in bytes (default 1GB)
}