@stackonward/cli 0.0.1 → 1.0.1

package/dist/resources/templates/go-backend/internal/core/config/config.go

@@ -0,0 +1,2069 @@
+package config
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/netip"
+	"net/url"
+	"os"
+	"regexp"
+	"strings"
+	"time"
+	"unicode"
+
+	"github.com/spf13/viper"
+	"github.com/subosito/gotenv"
+
+	"{{module}}/internal/common/canonicaljson"
+	"{{module}}/internal/common/serviceidentity"
+)
+
+const (
+	defaultInternalServiceTokenTTLSeconds = 120
+	maxInternalServiceTokenTTLSeconds     = 900
+	defaultIAMConsistencyTokenTTLSeconds  = 120
+	maxIAMConsistencyTokenTTLSeconds      = 300
+	defaultDelegatedAccessTokenTTLSeconds = 300
+	maxDelegatedAccessTokenTTLSeconds     = 900
+	defaultIdentityClockSkewLeeway        = 30 * time.Second
+	maxIdentityClockSkewLeeway            = time.Minute
+)
+
+// Config 应用配置，聚合所有子配置
+type Config struct {
+	App        AppConfig        `mapstructure:"app"`
+	Database   DatabaseConfig   `mapstructure:"database"`
+	ClickHouse ClickHouseConfig `mapstructure:"clickhouse"`
+	Redis      RedisConfig      `mapstructure:"redis"`
+	OpenAI     OpenAIConfig     `mapstructure:"openai"`
+	Anthropic  AnthropicConfig  `mapstructure:"anthropic"`
+	Kafka      KafkaConfig      `mapstructure:"kafka"`
+	Log        LogConfig        `mapstructure:"log"`
+	Audit      AuditConfig      `mapstructure:"audit"`
+	Throttle   ThrottleConfig   `mapstructure:"throttle"`
+	Export     ExportConfig     `mapstructure:"export"`
+	Tracing    TracingConfig    `mapstructure:"tracing"`
+	// AES-256-GCM 加密密钥（64 位 hex 字符串）
+	EncryptionKey         string              `mapstructure:"encryption_key"`
+	EncryptionKeyID       string              `mapstructure:"encryption_key_id"`
+	EncryptionKeyringFile string              `mapstructure:"encryption_keyring_file"`
+	ClamAV                ClamAVConfig        `mapstructure:"clamav"`
+	Storage               StorageConfig       `mapstructure:"storage"`
+	Documentation         DocumentationConfig `mapstructure:"documentation"`
+	APIContract           APIContractConfig   `mapstructure:"api_contract"`
+	Sentry                SentryConfig        `mapstructure:"sentry"`
+	GeoIP                 GeoIPConfig         `mapstructure:"geoip"`
+	AI                    AIConfig            `mapstructure:"ai"`
+	ContentSafety         ContentSafetyConfig `mapstructure:"content_safety"`
+	Communication         CommunicationConfig `mapstructure:"communication"`
+	Payment               PaymentConfig       `mapstructure:"payment"`
+	Checkout              CheckoutConfig      `mapstructure:"checkout"`
+	Identity              IdentityConfig      `mapstructure:"identity"`
+	FeatureFlag           FeatureFlagConfig   `mapstructure:"feature_flag"`
+	Secret                SecretConfig        `mapstructure:"secret"`
+	// IntegrationEvent 定义跨产品 Integration Event 接收端的运行时证据与信任边界。
+	IntegrationEvent IntegrationEventConfig `mapstructure:"integration_event"`
+	// 内部服务调用配置
+	InternalService InternalServiceConfig `mapstructure:"internal_service"`
+	// 管理端体验外部产品贡献配置
+	AdminExperience AdminExperienceConfig `mapstructure:"admin_experience"`
+	// 外部产品管理控制面目标注册表
+	ProductAdmin ProductAdminConfig `mapstructure:"product_admin"`
+	// Temporal 工作流引擎
+	Temporal TemporalConfig `mapstructure:"temporal"`
+	// ExchangeRate-API 密钥（免费版）
+	ExchangeRateAPIKey string `mapstructure:"exchange_rate_api_key"`
+}
+
+// DatabaseCommandConfig 为只读数据库治理命令提供最小启动配置。
+type DatabaseCommandConfig struct {
+	Database DatabaseConfig
+	Log      LogConfig
+}
+
+// BootstrapCommandConfig 为配置初始化命令提供最小启动配置。
+type BootstrapCommandConfig struct {
+	Database      DatabaseConfig
+	Log           LogConfig
+	EncryptionKey string
+}
+
+// SecretCutoverCommandConfig 为长期凭证迁移提供旧密文和 SecretBroker 驱动所需的最小配置。
+type SecretCutoverCommandConfig struct {
+	EncryptionKey         string
+	EncryptionKeyID       string
+	EncryptionKeyringFile string
+	Secret                SecretConfig
+}
+
+// AppConfig 应用基础配置
+type AppConfig struct {
+	Name string `mapstructure:"name"`
+	Port int    `mapstructure:"port"`
+	Host string `mapstructure:"host"`
+	Env  string `mapstructure:"env"`
+	// 受信任的代理 IP（APISIX 网关地址），用于正确解析 X-Forwarded-For
+	TrustedProxies []string `mapstructure:"trusted_proxies"`
+}
+
+// DatabaseConfig 数据库配置
+type DatabaseConfig struct {
+	Host            string        `mapstructure:"host"`
+	Port            int           `mapstructure:"port"`
+	Username        string        `mapstructure:"username"`
+	Password        string        `mapstructure:"password"`
+	Name            string        `mapstructure:"name"`
+	SSL             bool          `mapstructure:"ssl"`
+	Logging         bool          `mapstructure:"logging"`
+	MaxOpenConns    int           `mapstructure:"max_open_conns"`
+	MaxIdleConns    int           `mapstructure:"max_idle_conns"`
+	ConnMaxLifetime time.Duration `mapstructure:"conn_max_lifetime"`
+	ConnMaxIdleTime time.Duration `mapstructure:"conn_max_idle_time"`
+}
+
+// ClickHouseConfig ClickHouse 列存配置
+//
+// 行业参考：clickhouse-go/v2 官方 Options 字段命名（Addr / Auth / DialTimeout
+// / ReadTimeout / MaxOpenConns）。Insights 模块通过该配置接入列存分析能力。
+type ClickHouseConfig struct {
+	// Enabled 控制是否在启动时创建 ClickHouse 连接。本地/CI 环境可关闭。
+	Enabled bool `mapstructure:"enabled"`
+	// Host ClickHouse 服务地址（host:port 中的 host 部分）
+	Host string `mapstructure:"host"`
+	// Port ClickHouse Native TCP 端口（默认 9000）
+	Port int `mapstructure:"port"`
+	// Database 默认数据库（默认 insights）
+	Database string `mapstructure:"database"`
+	// Username 用户名
+	Username string `mapstructure:"username"`
+	// Password 密码（生产从 env 注入）
+	Password string `mapstructure:"password"`
+	// DialTimeout 拨号超时
+	DialTimeout time.Duration `mapstructure:"dial_timeout"`
+	// ReadTimeout 单次查询读超时
+	ReadTimeout time.Duration `mapstructure:"read_timeout"`
+	// MaxOpenConns 最大连接数
+	MaxOpenConns int `mapstructure:"max_open_conns"`
+	// MaxIdleConns 最大空闲连接数
+	MaxIdleConns int `mapstructure:"max_idle_conns"`
+	// ConnMaxLifetime 连接最大生命周期
+	ConnMaxLifetime time.Duration `mapstructure:"conn_max_lifetime"`
+	// Compression 是否启用 LZ4 压缩（默认 true）
+	Compression bool `mapstructure:"compression"`
+	// Secure 是否启用 TLS（默认 false；ClickHouse Cloud 必须 true）
+	Secure bool `mapstructure:"secure"`
+}
+
+// RedisConfig Redis 配置
+type RedisConfig struct {
+	Host     string `mapstructure:"host"`
+	Port     int    `mapstructure:"port"`
+	Password string `mapstructure:"password"`
+	DB       int    `mapstructure:"db"`
+}
+
+// OpenAIConfig OpenAI 配置
+type OpenAIConfig struct {
+	APIKey  string `mapstructure:"api_key"`
+	Model   string `mapstructure:"model"`
+	BaseURL string `mapstructure:"base_url"`
+}
+
+// AnthropicConfig Anthropic 配置
+type AnthropicConfig struct {
+	APIKey string `mapstructure:"api_key"`
+	Model  string `mapstructure:"model"`
+}
+
+// ContentSafetyConfig 内容安全 provider 配置。
+type ContentSafetyConfig struct {
+	Aliyun AliyunContentSafetyConfig `mapstructure:"aliyun"`
+}
+
+// CommunicationConfig 通信平台进程级配置。
+type CommunicationConfig struct {
+	Reputation               CommunicationReputationConfig `mapstructure:"reputation"`
+	UnsubscribeSigningSecret string                        `mapstructure:"unsubscribe_signing_secret"`
+}
+
+// CommunicationReputationConfig 通信信誉检测配置。
+type CommunicationReputationConfig struct {
+	IPBlocklistZones        []string `mapstructure:"ip_blocklist_zones"`
+	DomainBlocklistZones    []string `mapstructure:"domain_blocklist_zones"`
+	DNSLookupTimeoutSeconds int      `mapstructure:"dns_lookup_timeout_seconds"`
+	RecheckIntervalHours    int      `mapstructure:"recheck_interval_hours"`
+	RecheckBatchLimit       int      `mapstructure:"recheck_batch_limit"`
+}
+
+// PaymentConfig 支付模块进程级配置。
+type PaymentConfig struct {
+	// RiskSubjectHashKey 支付风控主体 HMAC-SHA256 密钥。
+	RiskSubjectHashKey string `mapstructure:"risk_subject_hash_key"`
+	// StorePurchaseReferenceHashKey 商店购买凭证 HMAC-SHA256 密钥。
+	StorePurchaseReferenceHashKey string `mapstructure:"store_purchase_reference_hash_key"`
+}
+
+// IdentityConfig 身份模块进程级配置。
+type IdentityConfig struct {
+	// PhoneHashKey 手机号绑定 HMAC-SHA256 密钥。
+	PhoneHashKey string `mapstructure:"phone_hash_key"`
+	// OAuthStateSigningSecret OAuth 授权 state HMAC-SHA256 密钥。
+	OAuthStateSigningSecret string `mapstructure:"oauth_state_signing_secret"`
+	// Clients 注册一方客户端的 canonical 产品、主体类型与注册来源。
+	Clients map[string]IdentityClientConfig `mapstructure:"clients"`
+	// AccessToken 用户访问令牌授权服务器配置。
+	AccessToken IdentityAccessTokenConfig `mapstructure:"access_token"`
+	// GuestCapability 定义 Identity-owned guest capability 密钥材料来源与实例租约身份。
+	GuestCapability IdentityGuestCapabilityConfig `mapstructure:"guest_capability"`
+	// LegacyPasswordSchemes 注册仅用于登录后渐进升级的旧密码验证方案。
+	LegacyPasswordSchemes map[string]IdentityLegacyPasswordSchemeConfig `mapstructure:"legacy_password_schemes"`
+}
+
+// IdentityLegacyPasswordSchemeConfig 定义旧密码方案的驱动与受控密钥引用。
+type IdentityLegacyPasswordSchemeConfig struct {
+	Driver    string `mapstructure:"driver"`
+	SecretRef string `mapstructure:"secret_ref"`
+	RetireAt  string `mapstructure:"retire_at"`
+}
+
+// IdentityClientConfig 定义一个已注册一方客户端的授权边界。
+type IdentityClientConfig struct {
+	// ProductCode 是客户端唯一允许签发的 canonical 产品资源。
+	ProductCode string `mapstructure:"product_code" json:"product_code"`
+	// ApplicationCode 是 Product owner 中客户端应用的稳定编码。
+	ApplicationCode string `mapstructure:"application_code" json:"application_code"`
+	// AllowedPrincipalTypes 限定客户端可建立的会话主体类型。
+	AllowedPrincipalTypes []string `mapstructure:"allowed_principal_types" json:"allowed_principal_types"`
+	// RegistrationSource 记录身份首次物化的业务入口。
+	RegistrationSource string `mapstructure:"registration_source" json:"registration_source"`
+	// TokenExchangeServiceAccounts 限定可代表此客户端执行 RFC 8693 交换的机密服务账号。
+	TokenExchangeServiceAccounts []string `mapstructure:"token_exchange_service_accounts" json:"token_exchange_service_accounts"`
+	// TokenExchangeResources 限定此客户端可交换到的精确资源服务器受众。
+	TokenExchangeResources []string `mapstructure:"token_exchange_resources" json:"token_exchange_resources"`
+}
+
+// FeatureFlagConfig 定义已发布快照的新鲜度和有界陈旧策略。
+type FeatureFlagConfig struct {
+	FreshnessTTL    time.Duration `mapstructure:"freshness_ttl"`
+	MaximumStaleAge time.Duration `mapstructure:"maximum_stale_age"`
+	CacheTTL        time.Duration `mapstructure:"cache_ttl"`
+}
+
+// IdentityGuestCapabilityConfig 只引用进程本地秘密文件；活动 generation 由数据库注册表决定。
+type IdentityGuestCapabilityConfig struct {
+	SecretProviderFile string `mapstructure:"secret_provider_file"`
+	// InitialKeyID 仅在注册表为空时注册为首个签发密钥。
+	InitialKeyID       string `mapstructure:"initial_key_id"`
+	VerifierInstanceID string `mapstructure:"verifier_instance_id"`
+}
+
+// IdentityAccessTokenConfig 定义 RFC 9068 访问令牌签发与校验边界。
+type IdentityAccessTokenConfig struct {
+	Issuer             string                                       `mapstructure:"issuer"`
+	SigningKeyID       string                                       `mapstructure:"signing_key_id"`
+	PrivateKeyPath     string                                       `mapstructure:"private_key_path"`
+	PublicKeyDirectory string                                       `mapstructure:"public_key_directory"`
+	ClockSkewLeeway    time.Duration                                `mapstructure:"clock_skew_leeway"`
+	DelegatedTokenTTL  time.Duration                                `mapstructure:"delegated_token_ttl"`
+	ProtectedResources map[string]IdentityProtectedResourceConfig   `mapstructure:"protected_resources"`
+	Resources          map[string]IdentityAccessTokenResourceConfig `mapstructure:"resources"`
+}
+
+// IdentityProtectedResourceConfig 定义 RFC 9728 资源标识到内部精确 audience 的映射。
+type IdentityProtectedResourceConfig struct {
+	ResourceIdentifier string `mapstructure:"resource_identifier" json:"resource_identifier"`
+	Audience           string `mapstructure:"audience" json:"audience"`
+	ResourceName       string `mapstructure:"resource_name" json:"resource_name"`
+}
+
+// IdentityAccessTokenResourceConfig 定义单个产品资源服务器的 audience 与主体 scope 上限。
+type IdentityAccessTokenResourceConfig struct {
+	Audience    string   `mapstructure:"audience"`
+	UserScopes  []string `mapstructure:"user_scopes"`
+	GuestScopes []string `mapstructure:"guest_scopes"`
+}
+
+// IntegrationEventConfig 定义 Integration Event 平台进程配置。
+type IntegrationEventConfig struct {
+	Inbound IntegrationEventInboundConfig `mapstructure:"inbound"`
+}
+
+// IntegrationEventInboundConfig 定义入站接收端的只读信任与发布证据文件。
+type IntegrationEventInboundConfig struct {
+	TrustRegistryFile   string `mapstructure:"trust_registry_file"`
+	RuntimeArtifactFile string `mapstructure:"runtime_artifact_file"`
+	ReleaseManifestFile string `mapstructure:"release_manifest_file"`
+	MigrationMarkerFile string `mapstructure:"migration_marker_file"`
+}
+
+// InternalServiceConfig 内部服务调用配置。
+type InternalServiceConfig struct {
+	// PlatformBaseURL platform-api 内部 API 根地址。
+	PlatformBaseURL string `mapstructure:"platform_base_url"`
+	// DocumentationBaseURL documentation-api 机器读取 API 根地址。
+	DocumentationBaseURL string `mapstructure:"documentation_base_url"`
+	// ServiceTokenSigning 定义 IAM 服务令牌独立 RSA 密钥域。
+	ServiceTokenSigning ServiceTokenSigningConfig `mapstructure:"service_token_signing"`
+	// OutboundIdentities 按 owner 自定义名称声明独立发送身份与目标资源策略。
+	OutboundIdentities map[string]InternalServiceIdentityConfig `mapstructure:"outbound_identities"`
+	// TokenTTLSeconds 内部服务令牌有效期秒数。
+	TokenTTLSeconds int `mapstructure:"token_ttl_seconds"`
+	// AuthorizationConsistencyTokenTTLSeconds IAM 权威裁决一致性令牌有效期秒数。
+	AuthorizationConsistencyTokenTTLSeconds int `mapstructure:"authorization_consistency_token_ttl_seconds"`
+	// RequestTimeout 限制内部服务请求与令牌交换时长。
+	RequestTimeout time.Duration `mapstructure:"request_timeout"`
+}
+
+// ServiceTokenSigningConfig 定义 IAM 服务令牌 RSA 签名与验签材料。
+type ServiceTokenSigningConfig struct {
+	KeyID              string `mapstructure:"key_id"`
+	PrivateKeyPath     string `mapstructure:"private_key_path"`
+	PublicKeyDirectory string `mapstructure:"public_key_directory"`
+}
+
+// InternalServiceIdentityConfig 定义单个发送身份到目标资源的不可变策略。
+type InternalServiceIdentityConfig struct {
+	CredentialRef              string   `mapstructure:"credential_ref" json:"credential_ref"`
+	AllowedProductCodes        []string `mapstructure:"allowed_product_codes" json:"allowed_product_codes"`
+	Audience                   string   `mapstructure:"audience" json:"audience"`
+	ExpectedServiceAccountCode string   `mapstructure:"expected_service_account_code" json:"expected_service_account_code"`
+}
+
+// AdminExperienceConfig 管理独立部署产品的数据集贡献端点。
+type AdminExperienceConfig struct {
+	ExternalProducts []AdminExperienceExternalProductConfig `mapstructure:"external_products"`
+}
+
+// AdminExperienceExternalProductConfig 声明一个外部产品的受信端点和固定数据集。
+type AdminExperienceExternalProductConfig struct {
+	ProductCode string                                 `mapstructure:"product_code"`
+	BaseURL     string                                 `mapstructure:"base_url"`
+	Datasets    []AdminExperienceExternalDatasetConfig `mapstructure:"datasets"`
+}
+
+// AdminExperienceExternalDatasetConfig 声明一个外部产品数据集契约。
+type AdminExperienceExternalDatasetConfig struct {
+	Key            string `mapstructure:"key"`
+	DescriptorHash string `mapstructure:"descriptor_hash"`
+}
+
+// ProductAdminConfig 按产品编码注册外部产品管理控制面。
+type ProductAdminConfig struct {
+	Targets map[string]ProductAdminTargetConfig `mapstructure:"targets"`
+}
+
+// ProductAdminTargetConfig 定义一个外部产品管理控制面的受信网络与服务身份边界。
+type ProductAdminTargetConfig struct {
+	AllowedOrigin       string        `mapstructure:"allowed_origin"`
+	BaseURL             string        `mapstructure:"base_url"`
+	RequestTimeout      time.Duration `mapstructure:"request_timeout"`
+	ServiceIdentityName string        `mapstructure:"service_identity_name"`
+	SignatureKeyID      string        `mapstructure:"signature_key_id"`
+	SignatureSecretRef  string        `mapstructure:"signature_secret_ref"`
+}
+
+type productAdminTargetEnvironmentConfig struct {
+	AllowedOrigin       string `json:"allowed_origin"`
+	BaseURL             string `json:"base_url"`
+	RequestTimeout      string `json:"request_timeout"`
+	ServiceIdentityName string `json:"service_identity_name"`
+	SignatureKeyID      string `json:"signature_key_id"`
+	SignatureSecretRef  string `json:"signature_secret_ref"`
+}
+
+// CheckoutConfig 客户在场结账的进程级安全配置。
+type CheckoutConfig struct {
+	// MethodReferenceSigningKey 为短期支付方式引用提供独立 HMAC-SHA256 密钥。
+	MethodReferenceSigningKey string `mapstructure:"method_reference_signing_key"`
+	// GuestActorScopeSigningKey 为匿名结账幂等主体范围提供独立 HMAC-SHA256 密钥。
+	GuestActorScopeSigningKey string `mapstructure:"guest_actor_scope_signing_key"`
+	// ReplayEncryptionKeyVersion 标识当前幂等敏感响应使用的加密密钥版本。
+	ReplayEncryptionKeyVersion string `mapstructure:"replay_encryption_key_version"`
+}
+
+// SecretConfig 定义 SecretBroker 驱动、指纹和 worker 启动配置。
+type SecretConfig struct {
+	ActiveDriverCode    string                      `mapstructure:"active_driver_code"`
+	FingerprintKey      string                      `mapstructure:"fingerprint_key"`
+	DriverHealthTimeout time.Duration               `mapstructure:"driver_health_timeout"`
+	Envelope            SecretEnvelopeDriverConfig  `mapstructure:"envelope"`
+	Runtime             SecretRuntimeIdentityConfig `mapstructure:"runtime"`
+	Retention           SecretRetentionConfig       `mapstructure:"retention"`
+	Worker              SecretWorkerConfig          `mapstructure:"worker"`
+}
+
+type SecretEnvelopeDriverConfig struct {
+	DriverCode            string `mapstructure:"driver_code"`
+	MaximumPlaintextBytes int    `mapstructure:"maximum_plaintext_bytes"`
+}
+
+// SecretRuntimeIdentityConfig 定义当前进程兑换短时 Secret 租约时使用的 IAM 工作负载身份。
+type SecretRuntimeIdentityConfig struct {
+	ServiceAccountCode string        `mapstructure:"service_account_code"`
+	Audience           string        `mapstructure:"audience"`
+	DefaultProductCode string        `mapstructure:"default_product_code"`
+	LeaseTTL           time.Duration `mapstructure:"lease_ttl"`
+}
+
+// SecretRetentionConfig 定义密文销毁和访问证据清理的保留边界。
+type SecretRetentionConfig struct {
+	MinimumDestructionDelay time.Duration `mapstructure:"minimum_destruction_delay"`
+	AccessEventPurgeEnabled bool          `mapstructure:"access_event_purge_enabled"`
+	LegalHoldOwnerResources []string      `mapstructure:"legal_hold_owner_resources"`
+}
+
+type SecretWorkerConfig struct {
+	ServiceAccountCode   string `mapstructure:"service_account_code"`
+	BatchSize            int    `mapstructure:"batch_size"`
+	PartitionMonthsAhead int    `mapstructure:"partition_months_ahead"`
+}
+
+// AliyunContentSafetyConfig 阿里云内容安全 2.0 / AI 安全护栏配置。
+type AliyunContentSafetyConfig struct {
+	// Enabled 控制是否注册阿里云安全检测器；false 时不会产生外部 API 调用。
+	Enabled bool `mapstructure:"enabled"`
+	// ProviderCode p_ai_providers 中保存加密 AK/SK 的 Provider 编码。
+	ProviderCode string `mapstructure:"provider_code"`
+	// RegionID 接入区域。
+	RegionID string `mapstructure:"region_id"`
+	// Endpoint 内容安全接入地址。
+	Endpoint string `mapstructure:"endpoint"`
+	// TextService 文本前置审核 service code。
+	TextService string `mapstructure:"text_service"`
+	// ImageService 图片后置审核 service code。
+	ImageService string `mapstructure:"image_service"`
+	// VideoService 视频后置审核 service code。
+	VideoService string `mapstructure:"video_service"`
+	// ConnectTimeoutMs SDK 连接超时，单位毫秒。
+	ConnectTimeoutMs int `mapstructure:"connect_timeout_ms"`
+	// ReadTimeoutMs SDK 读超时，单位毫秒。
+	ReadTimeoutMs int `mapstructure:"read_timeout_ms"`
+	// VideoPollInitialDelayMs 视频异步任务提交后首次查询等待时间，单位毫秒。
+	VideoPollInitialDelayMs int `mapstructure:"video_poll_initial_delay_ms"`
+	// VideoPollIntervalMs 视频异步结果轮询间隔，单位毫秒。
+	VideoPollIntervalMs int `mapstructure:"video_poll_interval_ms"`
+	// VideoPollMaxAttempts 视频异步结果最大轮询次数。
+	VideoPollMaxAttempts int `mapstructure:"video_poll_max_attempts"`
+}
+
+// KafkaConfig Kafka 配置
+type KafkaConfig struct {
+	Brokers               string `mapstructure:"brokers"`
+	ClientID              string `mapstructure:"client_id"`
+	GroupID               string `mapstructure:"group_id"`
+	ConnectionTimeout     int    `mapstructure:"connection_timeout"`
+	AuthenticationTimeout int    `mapstructure:"authentication_timeout"`
+	RequestTimeout        int    `mapstructure:"request_timeout"`
+	SASLUsername          string `mapstructure:"sasl_username"`
+	SASLPassword          string `mapstructure:"sasl_password"`
+	SASLMechanism         string `mapstructure:"sasl_mechanism"`
+	SSLEnabled            bool   `mapstructure:"ssl_enabled"`
+}
+
+// LogConfig 日志配置
+type LogConfig struct {
+	Level                    string        `mapstructure:"level"`
+	Env                      string        `mapstructure:"env"`
+	RequestSuccessLevel      string        `mapstructure:"request_success_level"`
+	RequestSuccessSampleRate float64       `mapstructure:"request_success_sample_rate"`
+	RequestSlowThreshold     time.Duration `mapstructure:"request_slow_threshold"`
+}
+
+// AuditConfig 审计与访问日志治理配置
+type AuditConfig struct {
+	AccessLog AccessLogConfig `mapstructure:"access_log"`
+}
+
+// AccessLogConfig 控制高频 HTTP 访问日志的保留策略
+type AccessLogConfig struct {
+	Enabled               bool          `mapstructure:"enabled"`
+	SuccessReadSampleRate float64       `mapstructure:"success_read_sample_rate"`
+	SlowRequestThreshold  time.Duration `mapstructure:"slow_request_threshold"`
+	RecordWriteMethods    bool          `mapstructure:"record_write_methods"`
+	RecordClientErrors    bool          `mapstructure:"record_client_errors"`
+}
+
+// ThrottleConfig 限流配置
+type ThrottleConfig struct {
+	TTL   int `mapstructure:"ttl"`
+	Limit int `mapstructure:"limit"`
+}
+
+// TracingConfig 分布式追踪配置
+type TracingConfig struct {
+	// 是否启用追踪
+	Enabled bool `mapstructure:"enabled"`
+	// OTLP 采集端点（host:port 格式）
+	Endpoint string `mapstructure:"endpoint"`
+	// 服务名称
+	ServiceName string `mapstructure:"service_name"`
+	// 服务版本
+	ServiceVersion string `mapstructure:"service_version"`
+	// 运行环境
+	Environment string `mapstructure:"environment"`
+	// 采样率（0.0 ~ 1.0）
+	SamplingRatio float64 `mapstructure:"sampling_ratio"`
+}
+
+// ExportConfig 数据导出配置
+// 存储凭证复用平台存储模块（p_config_storage_configs），不再独立配置 S3
+type ExportConfig struct {
+	// 本地文件存储目录（开发环境无平台存储配置时使用）
+	LocalDir string `mapstructure:"local_dir"`
+	// 导出文件在存储桶内的路径前缀（默认 "exports"）
+	PathPrefix string `mapstructure:"path_prefix"`
+}
+
+// ClamAVConfig ClamAV 病毒扫描配置
+type ClamAVConfig struct {
+	// 是否启用病毒扫描
+	Enabled bool `mapstructure:"enabled"`
+	// clamd 守护进程地址，格式: tcp://host:port
+	Address string `mapstructure:"address"`
+	// 扫描超时时间（秒）
+	Timeout int `mapstructure:"timeout"`
+}
+
+// StorageConfig 存储资产管理配置
+type StorageConfig struct {
+	// 软删除资产保留天数，超过后由清理任务物理删除并清理 OSS 文件
+	RetentionDays int `mapstructure:"retention_days"`
+}
+
+// DocumentationConfig 定义文档编译和隐私指纹的进程边界，只保存密钥引用。
+type DocumentationConfig struct {
+	NodeExecutable string        `mapstructure:"node_executable"`
+	SiteRoot       string        `mapstructure:"site_root"`
+	CompilerScript string        `mapstructure:"compiler_script"`
+	BuildTimeout   time.Duration `mapstructure:"build_timeout"`
+	// PrivacyHMACKeyRef 指向跨 platform-api 与 documentation-api 共享的 32 字节以上伪名化密钥。
+	PrivacyHMACKeyRef        string `mapstructure:"privacy_hmac_key_ref"`
+	DomainBindingProviderKey string `mapstructure:"domain_binding_provider_key"`
+	DomainGatewayAdminURL    string `mapstructure:"domain_gateway_admin_url"`
+	DomainGatewayAdminKeyRef string `mapstructure:"domain_gateway_admin_key_ref"`
+	DomainOriginUpstreamID   string `mapstructure:"domain_origin_upstream_id"`
+	DomainCertificateRoot    string `mapstructure:"domain_certificate_root"`
+	DomainRoutePriority      int    `mapstructure:"domain_route_priority"`
+}
+
+// APIContractConfig 定义 API 契约平台的进程级运行时边界。
+type APIContractConfig struct {
+	CompatibilityEvaluator APIContractCompatibilityEvaluatorConfig `mapstructure:"compatibility_evaluator"`
+}
+
+// APIContractCompatibilityEvaluatorConfig 定义兼容性评估引擎的受控执行配置。
+type APIContractCompatibilityEvaluatorConfig struct {
+	Executable string        `mapstructure:"executable"`
+	Timeout    time.Duration `mapstructure:"timeout"`
+}
+
+// SentryConfig Sentry 错误追踪配置
+type SentryConfig struct {
+	// 是否启用 Sentry
+	Enabled bool `mapstructure:"enabled"`
+	// Sentry DSN
+	DSN string `mapstructure:"dsn"`
+	// 运行环境（development / staging / production）
+	Environment string `mapstructure:"environment"`
+	// 发布版本
+	Release string `mapstructure:"release"`
+	// 事件采样率（0.0 ~ 1.0）
+	SampleRate float64 `mapstructure:"sample_rate"`
+	// 事务追踪采样率（0.0 ~ 1.0）
+	TracesSampleRate float64 `mapstructure:"traces_sample_rate"`
+	// 是否启用调试模式
+	Debug bool `mapstructure:"debug"`
+}
+
+// GeoIPConfig GeoIP 地理定位配置
+type GeoIPConfig struct {
+	// MaxMind GeoLite2 数据库文件路径（为空则禁用地理定位）
+	DatabasePath string `mapstructure:"database_path"`
+}
+
+// TemporalConfig Temporal 工作流引擎配置
+type TemporalConfig struct {
+	// 是否启用 Temporal Worker（false 则不启动 Worker）
+	Enabled bool `mapstructure:"enabled"`
+	// Temporal Server 地址（如 localhost:7233）
+	HostPort string `mapstructure:"host_port"`
+	// Temporal Namespace（启用时必填）
+	Namespace string `mapstructure:"namespace"`
+	// TLS 连接配置
+	TLS TemporalTLSConfig `mapstructure:"tls"`
+	// Worker 执行限流配置
+	Worker TemporalWorkerConfig `mapstructure:"worker"`
+	// ProviderPollWorker Provider 轮询 Worker 执行限流配置
+	ProviderPollWorker TemporalWorkerConfig `mapstructure:"provider_poll_worker"`
+}
+
+// TemporalWorkerConfig Temporal Worker 执行限流配置
+type TemporalWorkerConfig struct {
+	// 单进程最大并发 Activity 数，避免媒体转码/上传类 activity 抢占所有 CPU。
+	MaxConcurrentActivities int `mapstructure:"max_concurrent_activities"`
+	// 单进程最大并发 Workflow Task 数，不能配置为 1。
+	MaxConcurrentWorkflowTasks int `mapstructure:"max_concurrent_workflow_tasks"`
+	// Activity poller 数量。
+	MaxConcurrentActivityTaskPollers int `mapstructure:"max_concurrent_activity_task_pollers"`
+	// Workflow Task poller 数量，不能配置为 1。
+	MaxConcurrentWorkflowTaskPollers int `mapstructure:"max_concurrent_workflow_task_pollers"`
+}
+
+// TemporalTLSConfig Temporal TLS 连接配置
+type TemporalTLSConfig struct {
+	// 是否启用 TLS / mTLS
+	Enabled bool `mapstructure:"enabled"`
+	// 覆盖 TLS ServerName（SNI）；为空时由 HostPort 推导
+	ServerName string `mapstructure:"server_name"`
+	// 是否跳过主机名校验（仅限受控内网/自签场景）
+	DisableHostVerification bool `mapstructure:"disable_host_verification"`
+	// 自定义 CA 证书路径（可选）
+	CAPath string `mapstructure:"ca_path"`
+	// 客户端证书路径（mTLS 可选）
+	CertPath string `mapstructure:"cert_path"`
+	// 客户端私钥路径（mTLS 可选）
+	KeyPath string `mapstructure:"key_path"`
+}
+
+// AIConfig AI 模块数据源配置
+type AIConfig struct {
+	// Products 按产品配置数据源
+	Products map[string]AIProductDataSource `mapstructure:"products"`
+}
+
+// AIProductDataSource 单个产品的数据源配置
+type AIProductDataSource struct {
+	// DB 数据库数据源（可选）
+	DB *AIDBSourceConfig `mapstructure:"db"`
+	// Logs 日志数据源列表
+	Logs []AILogSourceConfig `mapstructure:"logs"`
+}
+
+// AIDBSourceConfig 数据库数据源配置
+type AIDBSourceConfig struct {
+	// Driver 数据库驱动：postgres（复用主库连接）或 mysql（独立连接）
+	Driver   string `mapstructure:"driver"`
+	Host     string `mapstructure:"host"`
+	Port     int    `mapstructure:"port"`
+	Username string `mapstructure:"username"`
+	Password string `mapstructure:"password"`
+	Database string `mapstructure:"database"`
+}
+
+// AILogSourceConfig 日志数据源配置
+type AILogSourceConfig struct {
+	// Type 日志类型：file（磁盘 JSON 日志）、zap（进程内 zap 日志）、loki（远程 Loki API）
+	Type string `mapstructure:"type"`
+	// Service 服务名标识
+	Service string `mapstructure:"service"`
+	// Dir 日志文件目录（type=file 时使用）
+	Dir string `mapstructure:"dir"`
+	// Endpoint Loki HTTP 端点（type=loki 时使用），如 http://loki:3100
+	Endpoint string `mapstructure:"endpoint"`
+	// Labels Loki 标签选择器（type=loki 时使用），如 {service="data-service"}
+	Labels string `mapstructure:"labels"`
+}
+
+// IsDevelopment 是否开发环境
+func (c *Config) IsDevelopment() bool {
+	return c.App.Env == "development"
+}
+
+// IsProduction 是否生产环境
+func (c *Config) IsProduction() bool {
+	return c.App.Env == "production"
+}
+
+// IsIdentityAccessTokenIssuer 标识当前进程是否承担用户访问令牌签发职责。
+func (c *Config) IsIdentityAccessTokenIssuer() bool {
+	return strings.TrimSpace(c.Identity.AccessToken.PrivateKeyPath) != ""
+}
+
+// IsIAMServiceTokenIssuer 标识当前进程是否承担服务令牌签发职责。
+func (c *Config) IsIAMServiceTokenIssuer() bool {
+	return strings.TrimSpace(c.InternalService.ServiceTokenSigning.PrivateKeyPath) != ""
+}
+
+// Load 加载配置，优先级：环境变量 > config.{env}.yaml > config.yaml > 代码默认值
+func Load() (*Config, error) {
+	cfg, err := loadConfig()
+	if err != nil {
+		return nil, err
+	}
+	if err := validate(cfg); err != nil {
+		return nil, err
+	}
+	return cfg, nil
+}
+
+// LoadDatabaseCommandConfig 加载只读数据库命令所需配置，不要求无关运行时密钥。
+func LoadDatabaseCommandConfig() (*DatabaseCommandConfig, error) {
+	cfg, err := loadConfig()
+	if err != nil {
+		return nil, err
+	}
+	if err := validateDatabaseCommandConfig(cfg.Database); err != nil {
+		return nil, err
+	}
+	return &DatabaseCommandConfig{Database: cfg.Database, Log: cfg.Log}, nil
+}
+
+// LoadBootstrapCommandConfig 加载配置初始化命令所需配置，不要求无关服务运行时密钥。
+func LoadBootstrapCommandConfig() (*BootstrapCommandConfig, error) {
+	cfg, err := loadConfig()
+	if err != nil {
+		return nil, err
+	}
+	if err := validateDatabaseCommandConfig(cfg.Database); err != nil {
+		return nil, err
+	}
+	return &BootstrapCommandConfig{
+		Database:      cfg.Database,
+		Log:           cfg.Log,
+		EncryptionKey: cfg.EncryptionKey,
+	}, nil
+}
+
+// LoadSecretCutoverCommandConfig 加载长期凭证切换所需配置，不要求无关服务运行时密钥。
+func LoadSecretCutoverCommandConfig() (*SecretCutoverCommandConfig, error) {
+	cfg, err := loadConfig()
+	if err != nil {
+		return nil, err
+	}
+	if strings.TrimSpace(cfg.EncryptionKey) == "" {
+		return nil, fmt.Errorf("secret cutover requires ENCRYPTION_KEY")
+	}
+	if strings.TrimSpace(cfg.EncryptionKeyID) == "" {
+		return nil, fmt.Errorf("secret cutover requires ENCRYPTION_KEY_ID")
+	}
+	if strings.TrimSpace(cfg.Secret.ActiveDriverCode) == "" || strings.TrimSpace(cfg.Secret.Envelope.DriverCode) == "" {
+		return nil, fmt.Errorf("secret cutover requires SECRET_ACTIVE_DRIVER_CODE and SECRET_ENVELOPE_DRIVER_CODE")
+	}
+	if cfg.Secret.Envelope.MaximumPlaintextBytes <= 0 || cfg.Secret.DriverHealthTimeout <= 0 {
+		return nil, fmt.Errorf("secret cutover driver limits must be positive")
+	}
+	return &SecretCutoverCommandConfig{
+		EncryptionKey:         cfg.EncryptionKey,
+		EncryptionKeyID:       cfg.EncryptionKeyID,
+		EncryptionKeyringFile: cfg.EncryptionKeyringFile,
+		Secret:                cfg.Secret,
+	}, nil
+}
+
+func validateDatabaseCommandConfig(cfg DatabaseConfig) error {
+	if strings.TrimSpace(cfg.Host) == "" || cfg.Port <= 0 ||
+		strings.TrimSpace(cfg.Username) == "" || strings.TrimSpace(cfg.Name) == "" {
+		return fmt.Errorf("database command requires host, port, username, and database name")
+	}
+	return nil
+}
+
+func loadConfig() (*Config, error) {
+	v := viper.New()
+	if err := ValidateDocumentationEnvironmentVariables(documentationEnvironmentVariables); err != nil {
+		return nil, fmt.Errorf("validate documentation environment metadata: %w", err)
+	}
+
+	// 1. 代码默认值（最低优先级）
+	setDefaults(v)
+
+	// 2. 本地 dotenv（仅补充运行时环境变量，不覆盖显式导出的系统环境变量）
+	loadLocalEnvFiles()
+
+	// 3. 基础配置文件
+	v.SetConfigType("yaml")
+	v.AddConfigPath("./configs")
+	v.AddConfigPath(".")
+
+	v.SetConfigName("config")
+	_ = v.ReadInConfig() //nolint:errcheck // viper 配置加载，文件不存在时静默降级
+
+	// 4. 环境配置文件（覆盖基础配置）
+	// S4 例外: 引导阶段 Config 尚未创建，此处直接读取环境变量
+	env := os.Getenv("APP_ENV")
+	if env == "" {
+		env = "local"
+	}
+	v.SetConfigName("config." + env)
+	_ = v.MergeInConfig() //nolint:errcheck // viper 配置加载，文件不存在时静默降级
+
+	// 5. 环境变量（最高优先级）
+	v.AutomaticEnv()
+	if err := bindEnvVars(v); err != nil {
+		return nil, err
+	}
+	if err := applyInternalServiceOutboundIdentitiesEnvironment(v); err != nil {
+		return nil, err
+	}
+	if err := applyJSONRegistryEnvironment[IdentityProtectedResourceConfig](v, "ONEX_IDENTITY_PROTECTED_RESOURCES", "identity.access_token.protected_resources"); err != nil {
+		return nil, err
+	}
+	if err := applyJSONRegistryEnvironment[IdentityClientConfig](v, "ONEX_IDENTITY_CLIENTS", "identity.clients"); err != nil {
+		return nil, err
+	}
+	if err := applyProductAdminTargetsEnvironment(v); err != nil {
+		return nil, err
+	}
+
+	// 解析到 struct
+	cfg := &Config{}
+	if err := v.Unmarshal(cfg); err != nil {
+		return nil, fmt.Errorf("unmarshal config: %w", err)
+	}
+
+	// 用 APP_ENV 覆盖 app.env（确保一致性）
+	if cfg.App.Env == "" || cfg.App.Env == "development" {
+		cfg.App.Env = env
+	}
+
+	return cfg, nil
+}
+
+func applyInternalServiceOutboundIdentitiesEnvironment(v *viper.Viper) error {
+	raw := strings.TrimSpace(os.Getenv("ONEX_INTERNAL_SERVICE_OUTBOUND_IDENTITIES"))
+	if raw == "" {
+		return nil
+	}
+	identities := make(map[string]InternalServiceIdentityConfig)
+	decoder := json.NewDecoder(strings.NewReader(raw))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&identities); err != nil {
+		return fmt.Errorf("decode ONEX_INTERNAL_SERVICE_OUTBOUND_IDENTITIES: %w", err)
+	}
+	var trailing any
+	if err := decoder.Decode(&trailing); err != io.EOF {
+		return fmt.Errorf("decode ONEX_INTERNAL_SERVICE_OUTBOUND_IDENTITIES: trailing JSON value is not allowed")
+	}
+	v.Set("internal_service.outbound_identities", identities)
+	return nil
+}
+
+func applyJSONRegistryEnvironment[T any](v *viper.Viper, environmentKey, configKey string) error {
+	raw, exists := os.LookupEnv(environmentKey)
+	if !exists {
+		return nil
+	}
+	registry := make(map[string]T)
+	decoder := json.NewDecoder(strings.NewReader(raw))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&registry); err != nil {
+		return fmt.Errorf("decode %s: %w", environmentKey, err)
+	}
+	if registry == nil {
+		return fmt.Errorf("decode %s: registry must be a JSON object", environmentKey)
+	}
+	var trailing any
+	if err := decoder.Decode(&trailing); err != io.EOF {
+		return fmt.Errorf("decode %s: trailing JSON value is not allowed", environmentKey)
+	}
+	v.Set(configKey, registry)
+	return nil
+}
+
+func applyProductAdminTargetsEnvironment(v *viper.Viper) error {
+	raw, exists := os.LookupEnv("PRODUCT_ADMIN_TARGETS")
+	if !exists {
+		return nil
+	}
+	canonical, err := canonicaljson.Canonicalize(json.RawMessage(raw))
+	if err != nil {
+		return fmt.Errorf("decode PRODUCT_ADMIN_TARGETS: %w", err)
+	}
+
+	environmentTargets := make(map[string]*productAdminTargetEnvironmentConfig)
+	decoder := json.NewDecoder(strings.NewReader(string(canonical)))
+	decoder.DisallowUnknownFields()
+	if err := decoder.Decode(&environmentTargets); err != nil {
+		return fmt.Errorf("decode PRODUCT_ADMIN_TARGETS: %w", err)
+	}
+	if environmentTargets == nil {
+		return fmt.Errorf("decode PRODUCT_ADMIN_TARGETS: registry must be a JSON object")
+	}
+
+	targets := make(map[string]ProductAdminTargetConfig, len(environmentTargets))
+	for productCode, environmentTarget := range environmentTargets {
+		if environmentTarget == nil {
+			return fmt.Errorf("decode PRODUCT_ADMIN_TARGETS: target %q must be a JSON object", productCode)
+		}
+		requestTimeout, parseErr := time.ParseDuration(environmentTarget.RequestTimeout)
+		if parseErr != nil {
+			return fmt.Errorf("decode PRODUCT_ADMIN_TARGETS: target %q request_timeout: %w", productCode, parseErr)
+		}
+		targets[productCode] = ProductAdminTargetConfig{
+			AllowedOrigin:       environmentTarget.AllowedOrigin,
+			BaseURL:             environmentTarget.BaseURL,
+			RequestTimeout:      requestTimeout,
+			ServiceIdentityName: environmentTarget.ServiceIdentityName,
+			SignatureKeyID:      environmentTarget.SignatureKeyID,
+			SignatureSecretRef:  environmentTarget.SignatureSecretRef,
+		}
+	}
+	v.Set("product_admin.targets", targets)
+	return nil
+}
+
+func loadLocalEnvFiles() {
+	baseFiles := []string{
+		".env",
+		".env.local",
+	}
+
+	for _, path := range baseFiles {
+		loadEnvFile(path)
+	}
+
+	env := os.Getenv("APP_ENV")
+	if env == "" {
+		env = "local"
+	}
+
+	envFiles := []string{
+		".env." + env,
+		".env." + env + ".local",
+	}
+
+	switch env {
+	case "local", "development", "dev":
+		envFiles = append(envFiles, ".env.dev")
+	}
+
+	for _, path := range envFiles {
+		loadEnvFile(path)
+	}
+}
+
+func loadEnvFile(path string) {
+	if _, err := os.Stat(path); err != nil {
+		return
+	}
+	_ = gotenv.Load(path) //nolint:errcheck // 本地 dotenv 缺失或格式异常不应阻断启动
+}
+
+func setDefaults(v *viper.Viper) {
+	// 应用
+	v.SetDefault("app.name", "ai-chat-platform")
+	v.SetDefault("app.port", 3000)
+	v.SetDefault("app.host", "0.0.0.0")
+	v.SetDefault("app.env", "development")
+	v.SetDefault("app.trusted_proxies", []string{"127.0.0.1", "::1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"})
+
+	// 数据库
+	v.SetDefault("database.host", "localhost")
+	v.SetDefault("database.port", 5432)
+	v.SetDefault("database.username", "postgres")
+	v.SetDefault("database.password", "")
+	v.SetDefault("database.name", "ai_chat_platform")
+	v.SetDefault("database.ssl", false)
+	v.SetDefault("database.logging", false)
+	v.SetDefault("database.max_open_conns", 25)
+	v.SetDefault("database.max_idle_conns", 10)
+	v.SetDefault("database.conn_max_lifetime", "5m")
+	v.SetDefault("database.conn_max_idle_time", "5m")
+
+	// ClickHouse（Insights 列存仓库 — 默认 disabled，CI/本地无需启动）
+	v.SetDefault("clickhouse.enabled", false)
+	v.SetDefault("clickhouse.host", "localhost")
+	v.SetDefault("clickhouse.port", 9000)
+	v.SetDefault("clickhouse.database", "insights")
+	v.SetDefault("clickhouse.username", "default")
+	v.SetDefault("clickhouse.password", "")
+	v.SetDefault("clickhouse.dial_timeout", "10s")
+	v.SetDefault("clickhouse.read_timeout", "30s")
+	v.SetDefault("clickhouse.max_open_conns", 20)
+	v.SetDefault("clickhouse.max_idle_conns", 5)
+	v.SetDefault("clickhouse.conn_max_lifetime", "1h")
+	v.SetDefault("clickhouse.compression", true)
+	v.SetDefault("clickhouse.secure", false)
+
+	// Redis
+	v.SetDefault("redis.host", "localhost")
+	v.SetDefault("redis.port", 6379)
+	v.SetDefault("redis.password", "")
+	v.SetDefault("redis.db", 0)
+
+	// OpenAI
+	v.SetDefault("openai.api_key", "")
+	v.SetDefault("openai.model", "gpt-4")
+	v.SetDefault("openai.base_url", "https://api.openai.com/v1")
+
+	// Anthropic
+	v.SetDefault("anthropic.api_key", "")
+	v.SetDefault("anthropic.model", "claude-3-opus-20240229")
+
+	// Kafka
+	v.SetDefault("kafka.brokers", "localhost:9092")
+	v.SetDefault("kafka.client_id", "ai-chat-platform")
+	v.SetDefault("kafka.group_id", "ai-chat-api-consumer")
+	v.SetDefault("kafka.connection_timeout", 10000)
+	v.SetDefault("kafka.authentication_timeout", 10000)
+	v.SetDefault("kafka.request_timeout", 30000)
+	v.SetDefault("kafka.sasl_mechanism", "plain")
+	v.SetDefault("kafka.ssl_enabled", false)
+
+	// 日志
+	v.SetDefault("log.level", "debug")
+	v.SetDefault("log.env", "development")
+	v.SetDefault("log.request_success_level", "debug")
+	v.SetDefault("log.request_success_sample_rate", 0.0)
+	v.SetDefault("log.request_slow_threshold", "2s")
+
+	// 审计与访问日志治理
+	v.SetDefault("audit.access_log.enabled", true)
+	v.SetDefault("audit.access_log.success_read_sample_rate", 0.05)
+	v.SetDefault("audit.access_log.slow_request_threshold", "2s")
+	v.SetDefault("audit.access_log.record_write_methods", true)
+	v.SetDefault("audit.access_log.record_client_errors", true)
+
+	// 限流
+	v.SetDefault("throttle.ttl", 60)
+	v.SetDefault("throttle.limit", 100)
+
+	// 导出
+	v.SetDefault("export.local_dir", "/tmp/exports")
+	v.SetDefault("export.path_prefix", "exports")
+
+	// 追踪
+	v.SetDefault("tracing.enabled", false)
+	v.SetDefault("tracing.endpoint", "localhost:4318")
+	v.SetDefault("tracing.service_name", "onex-backend")
+	v.SetDefault("tracing.service_version", "1.0.0")
+	v.SetDefault("tracing.environment", "development")
+	v.SetDefault("tracing.sampling_ratio", 1.0)
+
+	// Sentry
+	v.SetDefault("sentry.enabled", false)
+	v.SetDefault("sentry.dsn", "")
+	v.SetDefault("sentry.environment", "development")
+	v.SetDefault("sentry.release", "")
+	v.SetDefault("sentry.sample_rate", 1.0)
+	v.SetDefault("sentry.traces_sample_rate", 0.1)
+	v.SetDefault("sentry.debug", false)
+
+	// ClamAV
+	v.SetDefault("clamav.enabled", false)
+	v.SetDefault("clamav.address", "tcp://localhost:3310")
+	v.SetDefault("clamav.timeout", 30)
+
+	// 存储
+	v.SetDefault("storage.retention_days", 30)
+
+	applyDocumentationDefaults(v)
+
+	// GeoIP
+	v.SetDefault("geoip.database_path", "data/geoip/GeoLite2-City.mmdb")
+
+	// ExchangeRate-API
+	v.SetDefault("exchange_rate_api_key", "")
+
+	// 内部服务调用。
+	v.SetDefault("internal_service.platform_base_url", "http://platform-api:3002/internal/v1")
+	v.SetDefault("integration_event.inbound.trust_registry_file", "configs/trust/integration-event-inbound.json")
+	v.SetDefault("integration_event.inbound.runtime_artifact_file", "api/openapi/services/platform-api/dist/runtime-contract.json")
+	v.SetDefault("integration_event.inbound.release_manifest_file", "api/openapi/dist/release-manifest.json")
+	v.SetDefault("integration_event.inbound.migration_marker_file", "migrations/000001_platform_baseline.up.sql")
+	v.SetDefault("internal_service.service_token_signing.key_id", "iam-service-local-2026-08")
+	v.SetDefault("internal_service.service_token_signing.private_key_path", "")
+	v.SetDefault("internal_service.service_token_signing.public_key_directory", "")
+	v.SetDefault("internal_service.outbound_identities", map[string]InternalServiceIdentityConfig{})
+	v.SetDefault("internal_service.token_ttl_seconds", defaultInternalServiceTokenTTLSeconds)
+	v.SetDefault("internal_service.authorization_consistency_token_ttl_seconds", defaultIAMConsistencyTokenTTLSeconds)
+	v.SetDefault("internal_service.request_timeout", "10s")
+	v.SetDefault("admin_experience.external_products", []AdminExperienceExternalProductConfig{})
+	v.SetDefault("product_admin.targets", map[string]ProductAdminTargetConfig{})
+
+	// 内容安全 provider 默认关闭，避免仅接入代码就产生外部调用和计费。
+	v.SetDefault("content_safety.aliyun.enabled", false)
+	v.SetDefault("content_safety.aliyun.provider_code", "aliyun_content_safety")
+	v.SetDefault("content_safety.aliyun.region_id", "ap-southeast-1")
+	v.SetDefault("content_safety.aliyun.endpoint", "green-cip.ap-southeast-1.aliyuncs.com")
+	v.SetDefault("content_safety.aliyun.text_service", "query_security_check_intl")
+	v.SetDefault("content_safety.aliyun.image_service", "postImageCheckByVL_global")
+	v.SetDefault("content_safety.aliyun.video_service", "videoDetection_global")
+	v.SetDefault("content_safety.aliyun.connect_timeout_ms", 3000)
+	v.SetDefault("content_safety.aliyun.read_timeout_ms", 10000)
+	v.SetDefault("content_safety.aliyun.video_poll_initial_delay_ms", 30000)
+	v.SetDefault("content_safety.aliyun.video_poll_interval_ms", 30000)
+	v.SetDefault("content_safety.aliyun.video_poll_max_attempts", 10)
+
+	// 通信信誉检测默认使用 DNSBL；生产可替换为私有 DQS/商业区。
+	v.SetDefault("communication.reputation.ip_blocklist_zones", []string{"zen.spamhaus.org"})
+	v.SetDefault("communication.reputation.domain_blocklist_zones", []string{"dbl.spamhaus.org"})
+	v.SetDefault("communication.reputation.dns_lookup_timeout_seconds", 5)
+	v.SetDefault("communication.reputation.recheck_interval_hours", 24)
+	v.SetDefault("communication.reputation.recheck_batch_limit", 50)
+	v.SetDefault("communication.unsubscribe_signing_secret", "")
+
+	// 用户访问令牌采用单资源 RFC 9068 profile；私钥路径与 HMAC 密钥由部署环境注入。
+	v.SetDefault("identity.oauth_state_signing_secret", "")
+	v.SetDefault("identity.clients", map[string]map[string]any{
+		"admin-web": {
+			"product_code":                    "platform",
+			"application_code":                "admin_web",
+			"allowed_principal_types":         []string{"user"},
+			"registration_source":             "admin",
+			"token_exchange_service_accounts": []string{},
+			"token_exchange_resources":        []string{},
+		},
+	})
+	v.SetDefault("identity.access_token.issuer", "http://localhost:3002")
+	v.SetDefault("identity.access_token.signing_key_id", "onex-local-2026-07")
+	v.SetDefault("identity.access_token.private_key_path", "")
+	v.SetDefault("identity.access_token.public_key_directory", "")
+	v.SetDefault("identity.access_token.clock_skew_leeway", defaultIdentityClockSkewLeeway.String())
+	v.SetDefault("identity.access_token.delegated_token_ttl", (time.Duration(defaultDelegatedAccessTokenTTLSeconds) * time.Second).String())
+	v.SetDefault("identity.access_token.protected_resources", map[string]map[string]any{
+		"platform_internal_api": {
+			"resource_identifier": "http://localhost:3002",
+			"audience":            serviceidentity.AudiencePlatformInternalAPI,
+			"resource_name":       "OneX Platform Internal API",
+		},
+		"documentation_api": {
+			"resource_identifier": "http://localhost:3010",
+			"audience":            serviceidentity.AudienceDocumentationAPI,
+			"resource_name":       "OneX Documentation API",
+		},
+	})
+	v.SetDefault("identity.guest_capability.secret_provider_file", "")
+	v.SetDefault("identity.guest_capability.initial_key_id", "")
+	v.SetDefault("identity.guest_capability.verifier_instance_id", "")
+	v.SetDefault("identity.access_token.resources", map[string]map[string]any{
+		"platform": {
+			"audience":     "urn:onex:resource:onex-api",
+			"user_scopes":  []string{"email", "openid", "profile"},
+			"guest_scopes": []string{"openid", "profile"},
+		},
+	})
+
+	// FeatureFlag 运行时快照必须在有界陈旧窗口内服务。
+	v.SetDefault("feature_flag.freshness_ttl", "30s")
+	v.SetDefault("feature_flag.maximum_stale_age", "15m")
+	v.SetDefault("feature_flag.cache_ttl", "30m")
+
+	// 支付风控主体哈希密钥。
+	v.SetDefault("payment.risk_subject_hash_key", "")
+	v.SetDefault("payment.store_purchase_reference_hash_key", "")
+
+	// 客户在场结账安全配置由部署环境注入，缺失时对应服务拒绝启动。
+	v.SetDefault("checkout.method_reference_signing_key", "")
+	v.SetDefault("checkout.guest_actor_scope_signing_key", "")
+	v.SetDefault("checkout.replay_encryption_key_version", "")
+
+	// SecretBroker 驱动与密钥必须由部署环境选择；只有非敏感运行边界提供默认值。
+	v.SetDefault("secret.active_driver_code", "")
+	v.SetDefault("secret.fingerprint_key", "")
+	v.SetDefault("secret.driver_health_timeout", "5s")
+	v.SetDefault("secret.envelope.driver_code", "")
+	v.SetDefault("secret.envelope.maximum_plaintext_bytes", 256*1024)
+	v.SetDefault("secret.runtime.service_account_code", "")
+	v.SetDefault("secret.runtime.audience", "")
+	v.SetDefault("secret.runtime.default_product_code", "platform")
+	v.SetDefault("secret.runtime.lease_ttl", "30s")
+	v.SetDefault("secret.retention.minimum_destruction_delay", "24h")
+	v.SetDefault("secret.retention.access_event_purge_enabled", false)
+	v.SetDefault("secret.retention.legal_hold_owner_resources", []string{})
+	v.SetDefault("secret.worker.service_account_code", "")
+	v.SetDefault("secret.worker.batch_size", 100)
+	v.SetDefault("secret.worker.partition_months_ahead", 3)
+
+	// Temporal
+	v.SetDefault("temporal.enabled", false)
+	v.SetDefault("temporal.host_port", "")
+	v.SetDefault("temporal.namespace", "")
+	v.SetDefault("temporal.tls.enabled", false)
+	v.SetDefault("temporal.tls.server_name", "")
+	v.SetDefault("temporal.tls.disable_host_verification", false)
+	v.SetDefault("temporal.tls.ca_path", "")
+	v.SetDefault("temporal.tls.cert_path", "")
+	v.SetDefault("temporal.tls.key_path", "")
+	v.SetDefault("temporal.worker.max_concurrent_activities", 4)
+	v.SetDefault("temporal.worker.max_concurrent_workflow_tasks", 16)
+	v.SetDefault("temporal.worker.max_concurrent_activity_task_pollers", 2)
+	v.SetDefault("temporal.worker.max_concurrent_workflow_task_pollers", 2)
+}
+
+//nolint:errcheck // 既有静态绑定保持当前契约；注册表新增绑定显式传播错误。
+func bindEnvVars(v *viper.Viper) error {
+	_ = v.BindEnv("app.env", "NODE_ENV")
+	_ = v.BindEnv("app.name", "APP_NAME")
+	_ = v.BindEnv("app.port", "APP_PORT")
+	_ = v.BindEnv("app.host", "APP_HOST")
+	_ = v.BindEnv("app.trusted_proxies", "TRUSTED_PROXIES")
+
+	_ = v.BindEnv("database.host", "DATABASE_HOST")
+	_ = v.BindEnv("database.port", "DATABASE_PORT")
+	_ = v.BindEnv("database.username", "DATABASE_USERNAME")
+	_ = v.BindEnv("database.password", "DATABASE_PASSWORD")
+	_ = v.BindEnv("database.name", "DATABASE_NAME")
+	_ = v.BindEnv("database.ssl", "DATABASE_SSL")
+	_ = v.BindEnv("database.logging", "DATABASE_LOGGING")
+	_ = v.BindEnv("database.max_open_conns", "DATABASE_MAX_OPEN_CONNS")
+	_ = v.BindEnv("database.max_idle_conns", "DATABASE_MAX_IDLE_CONNS")
+	_ = v.BindEnv("database.conn_max_lifetime", "DATABASE_CONN_MAX_LIFETIME")
+	_ = v.BindEnv("database.conn_max_idle_time", "DATABASE_CONN_MAX_IDLE_TIME")
+
+	_ = v.BindEnv("clickhouse.enabled", "CLICKHOUSE_ENABLED")
+	_ = v.BindEnv("clickhouse.host", "CLICKHOUSE_HOST")
+	_ = v.BindEnv("clickhouse.port", "CLICKHOUSE_PORT")
+	_ = v.BindEnv("clickhouse.database", "CLICKHOUSE_DATABASE")
+	_ = v.BindEnv("clickhouse.username", "CLICKHOUSE_USERNAME")
+	_ = v.BindEnv("clickhouse.password", "CLICKHOUSE_PASSWORD")
+	_ = v.BindEnv("clickhouse.dial_timeout", "CLICKHOUSE_DIAL_TIMEOUT")
+	_ = v.BindEnv("clickhouse.read_timeout", "CLICKHOUSE_READ_TIMEOUT")
+	_ = v.BindEnv("clickhouse.max_open_conns", "CLICKHOUSE_MAX_OPEN_CONNS")
+	_ = v.BindEnv("clickhouse.max_idle_conns", "CLICKHOUSE_MAX_IDLE_CONNS")
+	_ = v.BindEnv("clickhouse.conn_max_lifetime", "CLICKHOUSE_CONN_MAX_LIFETIME")
+	_ = v.BindEnv("clickhouse.compression", "CLICKHOUSE_COMPRESSION")
+	_ = v.BindEnv("clickhouse.secure", "CLICKHOUSE_SECURE")
+
+	_ = v.BindEnv("redis.host", "REDIS_HOST")
+	_ = v.BindEnv("redis.port", "REDIS_PORT")
+	_ = v.BindEnv("redis.password", "REDIS_PASSWORD")
+	_ = v.BindEnv("redis.db", "REDIS_DB")
+
+	_ = v.BindEnv("openai.api_key", "OPENAI_API_KEY")
+	_ = v.BindEnv("openai.model", "OPENAI_MODEL")
+	_ = v.BindEnv("openai.base_url", "OPENAI_BASE_URL")
+
+	_ = v.BindEnv("anthropic.api_key", "ANTHROPIC_API_KEY")
+	_ = v.BindEnv("anthropic.model", "ANTHROPIC_MODEL")
+
+	_ = v.BindEnv("kafka.brokers", "KAFKA_BROKERS")
+	_ = v.BindEnv("kafka.client_id", "KAFKA_CLIENT_ID")
+	_ = v.BindEnv("kafka.group_id", "KAFKA_GROUP_ID")
+	_ = v.BindEnv("kafka.sasl_username", "KAFKA_SASL_USERNAME")
+	_ = v.BindEnv("kafka.sasl_password", "KAFKA_SASL_PASSWORD")
+	_ = v.BindEnv("kafka.ssl_enabled", "KAFKA_SSL_ENABLED")
+
+	_ = v.BindEnv("log.level", "LOG_LEVEL")
+	_ = v.BindEnv("log.env", "LOG_ENV")
+	_ = v.BindEnv("log.request_success_level", "LOG_REQUEST_SUCCESS_LEVEL")
+	_ = v.BindEnv("log.request_success_sample_rate", "LOG_REQUEST_SUCCESS_SAMPLE_RATE")
+	_ = v.BindEnv("log.request_slow_threshold", "LOG_REQUEST_SLOW_THRESHOLD")
+
+	_ = v.BindEnv("audit.access_log.enabled", "AUDIT_ACCESS_LOG_ENABLED")
+	_ = v.BindEnv("audit.access_log.success_read_sample_rate", "AUDIT_ACCESS_LOG_SUCCESS_READ_SAMPLE_RATE")
+	_ = v.BindEnv("audit.access_log.slow_request_threshold", "AUDIT_ACCESS_LOG_SLOW_REQUEST_THRESHOLD")
+	_ = v.BindEnv("audit.access_log.record_write_methods", "AUDIT_ACCESS_LOG_RECORD_WRITE_METHODS")
+	_ = v.BindEnv("audit.access_log.record_client_errors", "AUDIT_ACCESS_LOG_RECORD_CLIENT_ERRORS")
+
+	_ = v.BindEnv("throttle.ttl", "THROTTLE_TTL")
+	_ = v.BindEnv("throttle.limit", "THROTTLE_LIMIT")
+
+	_ = v.BindEnv("encryption_key", "ENCRYPTION_KEY")
+	_ = v.BindEnv("encryption_key_id", "ENCRYPTION_KEY_ID")
+	_ = v.BindEnv("encryption_keyring_file", "ENCRYPTION_KEYRING_FILE")
+
+	_ = v.BindEnv("export.local_dir", "EXPORT_LOCAL_DIR")
+	_ = v.BindEnv("export.path_prefix", "EXPORT_PATH_PREFIX")
+
+	_ = v.BindEnv("tracing.enabled", "TRACING_ENABLED")
+	_ = v.BindEnv("tracing.endpoint", "TRACING_ENDPOINT")
+	_ = v.BindEnv("tracing.service_name", "TRACING_SERVICE_NAME")
+	_ = v.BindEnv("tracing.service_version", "TRACING_SERVICE_VERSION")
+	_ = v.BindEnv("tracing.environment", "TRACING_ENVIRONMENT")
+	_ = v.BindEnv("tracing.sampling_ratio", "TRACING_SAMPLING_RATIO")
+
+	_ = v.BindEnv("sentry.enabled", "SENTRY_ENABLED")
+	_ = v.BindEnv("sentry.dsn", "SENTRY_DSN")
+	_ = v.BindEnv("sentry.environment", "SENTRY_ENVIRONMENT")
+	_ = v.BindEnv("sentry.release", "SENTRY_RELEASE")
+	_ = v.BindEnv("sentry.sample_rate", "SENTRY_SAMPLE_RATE")
+	_ = v.BindEnv("sentry.traces_sample_rate", "SENTRY_TRACES_SAMPLE_RATE")
+	_ = v.BindEnv("sentry.debug", "SENTRY_DEBUG")
+
+	_ = v.BindEnv("clamav.enabled", "CLAMAV_ENABLED")
+	_ = v.BindEnv("clamav.address", "CLAMAV_ADDRESS")
+	_ = v.BindEnv("clamav.timeout", "CLAMAV_TIMEOUT")
+
+	_ = v.BindEnv("geoip.database_path", "GEOIP_DATABASE_PATH")
+	if err := bindDocumentationEnvironment(v); err != nil {
+		return err
+	}
+
+	_ = v.BindEnv("temporal.enabled", "TEMPORAL_ENABLED")
+	_ = v.BindEnv("temporal.host_port", "TEMPORAL_HOST_PORT")
+	_ = v.BindEnv("temporal.namespace", "TEMPORAL_NAMESPACE")
+	_ = v.BindEnv("temporal.tls.enabled", "TEMPORAL_TLS_ENABLED")
+	_ = v.BindEnv("temporal.tls.server_name", "TEMPORAL_TLS_SERVER_NAME")
+	_ = v.BindEnv("temporal.tls.disable_host_verification", "TEMPORAL_TLS_DISABLE_HOST_VERIFICATION")
+	_ = v.BindEnv("temporal.tls.ca_path", "TEMPORAL_TLS_CA_PATH")
+	_ = v.BindEnv("temporal.tls.cert_path", "TEMPORAL_TLS_CERT_PATH")
+	_ = v.BindEnv("temporal.tls.key_path", "TEMPORAL_TLS_KEY_PATH")
+	_ = v.BindEnv("temporal.worker.max_concurrent_activities", "TEMPORAL_WORKER_MAX_CONCURRENT_ACTIVITIES")
+	_ = v.BindEnv("temporal.worker.max_concurrent_workflow_tasks", "TEMPORAL_WORKER_MAX_CONCURRENT_WORKFLOW_TASKS")
+	_ = v.BindEnv("temporal.worker.max_concurrent_activity_task_pollers", "TEMPORAL_WORKER_MAX_CONCURRENT_ACTIVITY_TASK_POLLERS")
+	_ = v.BindEnv("temporal.worker.max_concurrent_workflow_task_pollers", "TEMPORAL_WORKER_MAX_CONCURRENT_WORKFLOW_TASK_POLLERS")
+	_ = v.BindEnv("temporal.provider_poll_worker.max_concurrent_activities", "TEMPORAL_PROVIDER_POLL_WORKER_MAX_CONCURRENT_ACTIVITIES")
+	_ = v.BindEnv("temporal.provider_poll_worker.max_concurrent_workflow_tasks", "TEMPORAL_PROVIDER_POLL_WORKER_MAX_CONCURRENT_WORKFLOW_TASKS")
+	_ = v.BindEnv("temporal.provider_poll_worker.max_concurrent_activity_task_pollers", "TEMPORAL_PROVIDER_POLL_WORKER_MAX_CONCURRENT_ACTIVITY_TASK_POLLERS")
+	_ = v.BindEnv("temporal.provider_poll_worker.max_concurrent_workflow_task_pollers", "TEMPORAL_PROVIDER_POLL_WORKER_MAX_CONCURRENT_WORKFLOW_TASK_POLLERS")
+
+	_ = v.BindEnv("exchange_rate_api_key", "EXCHANGE_RATE_API_KEY")
+
+	_ = v.BindEnv("internal_service.platform_base_url", "INTERNAL_SERVICE_PLATFORM_BASE_URL", "PLATFORM_INTERNAL_BASE_URL")
+	_ = v.BindEnv("integration_event.inbound.trust_registry_file", "ONEX_INTEGRATION_EVENT_INBOUND_TRUST_REGISTRY_FILE")
+	_ = v.BindEnv("integration_event.inbound.runtime_artifact_file", "ONEX_INTEGRATION_EVENT_INBOUND_RUNTIME_ARTIFACT_FILE")
+	_ = v.BindEnv("integration_event.inbound.release_manifest_file", "ONEX_INTEGRATION_EVENT_INBOUND_RELEASE_MANIFEST_FILE")
+	_ = v.BindEnv("integration_event.inbound.migration_marker_file", "ONEX_INTEGRATION_EVENT_INBOUND_MIGRATION_MARKER_FILE")
+	_ = v.BindEnv("internal_service.service_token_signing.key_id", "ONEX_IAM_SERVICE_TOKEN_SIGNING_KEY_ID")
+	_ = v.BindEnv("internal_service.service_token_signing.private_key_path", "ONEX_IAM_SERVICE_TOKEN_PRIVATE_KEY_PATH")
+	_ = v.BindEnv("internal_service.service_token_signing.public_key_directory", "ONEX_IAM_SERVICE_TOKEN_PUBLIC_KEY_DIRECTORY")
+	_ = v.BindEnv("identity.access_token.delegated_token_ttl", "IDENTITY_DELEGATED_ACCESS_TOKEN_TTL")
+	_ = v.BindEnv("internal_service.token_ttl_seconds", "ONEX_IAM_SERVICE_TOKEN_TTL_SECONDS")
+	_ = v.BindEnv("internal_service.authorization_consistency_token_ttl_seconds", "ONEX_IAM_AUTHORIZATION_CONSISTENCY_TOKEN_TTL_SECONDS")
+	_ = v.BindEnv("internal_service.request_timeout", "INTERNAL_SERVICE_REQUEST_TIMEOUT")
+	_ = v.BindEnv("content_safety.aliyun.enabled", "CONTENT_SAFETY_ALIYUN_ENABLED")
+	_ = v.BindEnv("content_safety.aliyun.provider_code", "CONTENT_SAFETY_ALIYUN_PROVIDER_CODE")
+	_ = v.BindEnv("content_safety.aliyun.region_id", "CONTENT_SAFETY_ALIYUN_REGION_ID")
+	_ = v.BindEnv("content_safety.aliyun.endpoint", "CONTENT_SAFETY_ALIYUN_ENDPOINT")
+	_ = v.BindEnv("content_safety.aliyun.text_service", "CONTENT_SAFETY_ALIYUN_TEXT_SERVICE")
+	_ = v.BindEnv("content_safety.aliyun.image_service", "CONTENT_SAFETY_ALIYUN_IMAGE_SERVICE")
+	_ = v.BindEnv("content_safety.aliyun.video_service", "CONTENT_SAFETY_ALIYUN_VIDEO_SERVICE")
+	_ = v.BindEnv("content_safety.aliyun.connect_timeout_ms", "CONTENT_SAFETY_ALIYUN_CONNECT_TIMEOUT_MS")
+	_ = v.BindEnv("content_safety.aliyun.read_timeout_ms", "CONTENT_SAFETY_ALIYUN_READ_TIMEOUT_MS")
+	_ = v.BindEnv("content_safety.aliyun.video_poll_initial_delay_ms", "CONTENT_SAFETY_ALIYUN_VIDEO_POLL_INITIAL_DELAY_MS")
+	_ = v.BindEnv("content_safety.aliyun.video_poll_interval_ms", "CONTENT_SAFETY_ALIYUN_VIDEO_POLL_INTERVAL_MS")
+	_ = v.BindEnv("content_safety.aliyun.video_poll_max_attempts", "CONTENT_SAFETY_ALIYUN_VIDEO_POLL_MAX_ATTEMPTS")
+	_ = v.BindEnv("communication.reputation.ip_blocklist_zones", "COMMUNICATION_REPUTATION_IP_BLOCKLIST_ZONES")
+	_ = v.BindEnv("communication.reputation.domain_blocklist_zones", "COMMUNICATION_REPUTATION_DOMAIN_BLOCKLIST_ZONES")
+	_ = v.BindEnv("communication.reputation.dns_lookup_timeout_seconds", "COMMUNICATION_REPUTATION_DNS_LOOKUP_TIMEOUT_SECONDS")
+	_ = v.BindEnv("communication.reputation.recheck_interval_hours", "COMMUNICATION_REPUTATION_RECHECK_INTERVAL_HOURS")
+	_ = v.BindEnv("communication.reputation.recheck_batch_limit", "COMMUNICATION_REPUTATION_RECHECK_BATCH_LIMIT")
+	_ = v.BindEnv("communication.unsubscribe_signing_secret", "COMMUNICATION_UNSUBSCRIBE_SIGNING_SECRET")
+	_ = v.BindEnv("payment.risk_subject_hash_key", "PAYMENT_RISK_SUBJECT_HASH_KEY")
+	_ = v.BindEnv("checkout.method_reference_signing_key", "CHECKOUT_METHOD_REFERENCE_SIGNING_KEY")
+	_ = v.BindEnv("checkout.guest_actor_scope_signing_key", "CHECKOUT_GUEST_ACTOR_SCOPE_SIGNING_KEY")
+	_ = v.BindEnv("checkout.replay_encryption_key_version", "CHECKOUT_REPLAY_ENCRYPTION_KEY_VERSION")
+	_ = v.BindEnv("secret.active_driver_code", "SECRET_ACTIVE_DRIVER_CODE")
+	_ = v.BindEnv("secret.fingerprint_key", "SECRET_FINGERPRINT_KEY")
+	_ = v.BindEnv("secret.driver_health_timeout", "SECRET_DRIVER_HEALTH_TIMEOUT")
+	_ = v.BindEnv("secret.envelope.driver_code", "SECRET_ENVELOPE_DRIVER_CODE")
+	_ = v.BindEnv("secret.envelope.maximum_plaintext_bytes", "SECRET_ENVELOPE_MAXIMUM_PLAINTEXT_BYTES")
+	_ = v.BindEnv("secret.runtime.service_account_code", "SECRET_RUNTIME_SERVICE_ACCOUNT_CODE")
+	_ = v.BindEnv("secret.runtime.audience", "SECRET_RUNTIME_AUDIENCE")
+	_ = v.BindEnv("secret.runtime.default_product_code", "SECRET_RUNTIME_DEFAULT_PRODUCT_CODE")
+	_ = v.BindEnv("secret.runtime.lease_ttl", "SECRET_RUNTIME_LEASE_TTL")
+	_ = v.BindEnv("secret.retention.minimum_destruction_delay", "SECRET_MINIMUM_DESTRUCTION_DELAY")
+	_ = v.BindEnv("secret.retention.access_event_purge_enabled", "SECRET_ACCESS_EVENT_PURGE_ENABLED")
+	_ = v.BindEnv("secret.retention.legal_hold_owner_resources", "SECRET_LEGAL_HOLD_OWNER_RESOURCES")
+	_ = v.BindEnv("secret.worker.service_account_code", "SECRET_WORKER_SERVICE_ACCOUNT_CODE")
+	_ = v.BindEnv("secret.worker.batch_size", "SECRET_WORKER_BATCH_SIZE")
+	_ = v.BindEnv("secret.worker.partition_months_ahead", "SECRET_WORKER_PARTITION_MONTHS_AHEAD")
+	_ = v.BindEnv("payment.store_purchase_reference_hash_key", "PAYMENT_STORE_PURCHASE_REFERENCE_HASH_KEY")
+	_ = v.BindEnv("identity.phone_hash_key", "IDENTITY_PHONE_HASH_KEY")
+	_ = v.BindEnv("identity.oauth_state_signing_secret", "IDENTITY_OAUTH_STATE_SIGNING_SECRET")
+	_ = v.BindEnv("identity.access_token.issuer", "IDENTITY_ACCESS_TOKEN_ISSUER")
+	_ = v.BindEnv("identity.access_token.signing_key_id", "IDENTITY_ACCESS_TOKEN_SIGNING_KEY_ID")
+	_ = v.BindEnv("identity.access_token.private_key_path", "IDENTITY_ACCESS_TOKEN_PRIVATE_KEY_PATH")
+	_ = v.BindEnv("identity.access_token.public_key_directory", "IDENTITY_ACCESS_TOKEN_PUBLIC_KEY_DIRECTORY")
+	_ = v.BindEnv("identity.access_token.clock_skew_leeway", "IDENTITY_ACCESS_TOKEN_CLOCK_SKEW_LEEWAY")
+	_ = v.BindEnv("identity.guest_capability.secret_provider_file", "IDENTITY_GUEST_CAPABILITY_SECRET_PROVIDER_FILE")
+	_ = v.BindEnv("identity.guest_capability.initial_key_id", "IDENTITY_GUEST_CAPABILITY_INITIAL_KEY_ID")
+	_ = v.BindEnv("identity.guest_capability.verifier_instance_id", "IDENTITY_GUEST_CAPABILITY_VERIFIER_INSTANCE_ID")
+	_ = v.BindEnv("feature_flag.freshness_ttl", "FEATURE_FLAG_FRESHNESS_TTL")
+	_ = v.BindEnv("feature_flag.maximum_stale_age", "FEATURE_FLAG_MAXIMUM_STALE_AGE")
+	_ = v.BindEnv("feature_flag.cache_ttl", "FEATURE_FLAG_CACHE_TTL")
+	return nil
+}
+
+func validate(cfg *Config) error {
+	if err := validateSecretBrokerConfig(cfg.App.Name, cfg.Secret); err != nil {
+		return err
+	}
+	if requiresIdentityRuntimeConfig(cfg.App.Name) {
+		if err := validateSecretConfig("IDENTITY_PHONE_HASH_KEY", cfg.Identity.PhoneHashKey, 32); err != nil {
+			return err
+		}
+		if err := validateSecretConfig("IDENTITY_OAUTH_STATE_SIGNING_SECRET", cfg.Identity.OAuthStateSigningSecret, 32); err != nil {
+			return err
+		}
+		if err := validateIdentityLegacyPasswordSchemes(cfg.Identity.LegacyPasswordSchemes); err != nil {
+			return err
+		}
+	}
+	if requiresIdentityAccessTokenRuntimeConfig(cfg.App.Name) {
+		if err := validateIdentityAccessTokenConfig(cfg); err != nil {
+			return err
+		}
+	}
+	if cfg.IsIdentityAccessTokenIssuer() {
+		if err := validateIdentityGuestCapabilityConfig(cfg.Identity.GuestCapability); err != nil {
+			return err
+		}
+	}
+	if err := validatePort(cfg.App.Port); err != nil {
+		return err
+	}
+	if err := validateInternalServiceConfig(cfg); err != nil {
+		return err
+	}
+	if err := validateDocumentationConfig(cfg); err != nil {
+		return err
+	}
+	if err := validateAdminExperienceConfig(cfg.AdminExperience); err != nil {
+		return err
+	}
+	if err := validateProductAdminConfig(cfg); err != nil {
+		return err
+	}
+	if err := validateTemporalWorkerConfig(cfg.Temporal.Worker); err != nil {
+		return err
+	}
+	if err := validateTemporalWorkerConfigWithPrefix(
+		cfg.Temporal.ProviderPollWorker,
+		"TEMPORAL_PROVIDER_POLL_WORKER",
+	); err != nil {
+		return err
+	}
+	if requiresFeatureFlagRuntimeConfig(cfg.App.Name) {
+		if err := validateFeatureFlagConfig(cfg.FeatureFlag); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func requiresFeatureFlagRuntimeConfig(appName string) bool {
+	switch strings.ToLower(strings.TrimSpace(appName)) {
+	case "platform-api", "admin-api", "platform", "onex-platform":
+		return true
+	default:
+		return false
+	}
+}
+
+func validateFeatureFlagConfig(cfg FeatureFlagConfig) error {
+	if cfg.FreshnessTTL <= 0 {
+		return fmt.Errorf("required config FEATURE_FLAG_FRESHNESS_TTL must be positive")
+	}
+	if cfg.MaximumStaleAge < cfg.FreshnessTTL {
+		return fmt.Errorf("required config FEATURE_FLAG_MAXIMUM_STALE_AGE must not be shorter than freshness TTL")
+	}
+	if cfg.CacheTTL < cfg.MaximumStaleAge {
+		return fmt.Errorf("required config FEATURE_FLAG_CACHE_TTL must not be shorter than maximum stale age")
+	}
+	return nil
+}
+
+var (
+	adminExperienceProductCodePattern   = regexp.MustCompile(`^[a-z][a-z0-9_]{1,49}$`)
+	adminExperienceDatasetKeyPattern    = regexp.MustCompile(`^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)+$`)
+	adminExperienceHashPattern          = regexp.MustCompile(`^[0-9a-f]{64}$`)
+	identityAccessTokenKeyIDPattern     = regexp.MustCompile(`^[A-Za-z0-9._-]{1,64}$`)
+	identityAccessTokenScopePattern     = regexp.MustCompile(`^[A-Za-z0-9._:-]+$`)
+	identityGuestCapabilityKeyIDPattern = regexp.MustCompile(`^[A-Za-z0-9][A-Za-z0-9._-]{7,63}$`)
+	identityLegacyPasswordSchemePattern = regexp.MustCompile(`^[a-z][a-z0-9_]{2,63}$`)
+	identityLegacyPasswordDriverPattern = regexp.MustCompile(`^[a-z][a-z0-9_]{2,63}$`)
+	internalServiceIdentityNamePattern  = regexp.MustCompile(`^[a-z][a-z0-9_]{1,63}$`)
+	serviceSignatureKeyIDPattern        = regexp.MustCompile(`^[a-z][a-z0-9_]{2,79}$`)
+	serviceAccountCodePattern           = regexp.MustCompile(`^svc_[a-z0-9_]{3,95}$`)
+	identityClientIDPattern             = regexp.MustCompile(`^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$`)
+	identityApplicationCodePattern      = regexp.MustCompile(`^[a-z][a-z0-9_]{1,79}$`)
+	secretDriverCodePattern             = regexp.MustCompile(`^[a-z][a-z0-9._-]{0,63}$`)
+)
+
+func validateSecretBrokerConfig(appName string, cfg SecretConfig) error {
+	activeDriverCode := strings.TrimSpace(cfg.ActiveDriverCode)
+	envelopeDriverCode := strings.TrimSpace(cfg.Envelope.DriverCode)
+	runtimeServiceAccountCode := strings.TrimSpace(cfg.Runtime.ServiceAccountCode)
+	workerServiceAccountCode := strings.TrimSpace(cfg.Worker.ServiceAccountCode)
+	configured := activeDriverCode != "" || envelopeDriverCode != "" || strings.TrimSpace(cfg.FingerprintKey) != "" ||
+		runtimeServiceAccountCode != "" || workerServiceAccountCode != ""
+	if !configured {
+		return nil
+	}
+	if activeDriverCode != cfg.ActiveDriverCode || !secretDriverCodePattern.MatchString(activeDriverCode) {
+		return fmt.Errorf("required config SECRET_ACTIVE_DRIVER_CODE is invalid")
+	}
+	if envelopeDriverCode != cfg.Envelope.DriverCode || !secretDriverCodePattern.MatchString(envelopeDriverCode) {
+		return fmt.Errorf("required config SECRET_ENVELOPE_DRIVER_CODE is invalid")
+	}
+	if err := validateSecretConfig("SECRET_FINGERPRINT_KEY", cfg.FingerprintKey, 32); err != nil {
+		return err
+	}
+	if cfg.DriverHealthTimeout <= 0 || cfg.DriverHealthTimeout > 30*time.Second {
+		return fmt.Errorf("required config SECRET_DRIVER_HEALTH_TIMEOUT must be between zero and thirty seconds")
+	}
+	if cfg.Envelope.MaximumPlaintextBytes <= 0 || cfg.Envelope.MaximumPlaintextBytes > 256*1024 {
+		return fmt.Errorf("required config SECRET_ENVELOPE_MAXIMUM_PLAINTEXT_BYTES must be between 1 and 262144")
+	}
+	if runtimeServiceAccountCode != cfg.Runtime.ServiceAccountCode || !serviceAccountCodePattern.MatchString(runtimeServiceAccountCode) {
+		return fmt.Errorf("required config SECRET_RUNTIME_SERVICE_ACCOUNT_CODE is invalid")
+	}
+	if err := serviceidentity.ValidateAudience(cfg.Runtime.Audience); err != nil {
+		return fmt.Errorf("required config SECRET_RUNTIME_AUDIENCE is invalid: %w", err)
+	}
+	defaultProductCode := strings.TrimSpace(cfg.Runtime.DefaultProductCode)
+	if defaultProductCode != cfg.Runtime.DefaultProductCode || !adminExperienceProductCodePattern.MatchString(defaultProductCode) {
+		return fmt.Errorf("required config SECRET_RUNTIME_DEFAULT_PRODUCT_CODE is invalid")
+	}
+	if cfg.Runtime.LeaseTTL < 30*time.Second || cfg.Runtime.LeaseTTL > 5*time.Minute {
+		return fmt.Errorf("required config SECRET_RUNTIME_LEASE_TTL must be between thirty and three hundred seconds")
+	}
+	if cfg.Retention.MinimumDestructionDelay < time.Hour || cfg.Retention.MinimumDestructionDelay > 30*24*time.Hour {
+		return fmt.Errorf("required config SECRET_MINIMUM_DESTRUCTION_DELAY must be between one hour and thirty days")
+	}
+	for _, ownerResource := range cfg.Retention.LegalHoldOwnerResources {
+		if ownerResource == "" || ownerResource != strings.TrimSpace(ownerResource) {
+			return fmt.Errorf("required config SECRET_LEGAL_HOLD_OWNER_RESOURCES contains an invalid value")
+		}
+	}
+	if strings.TrimSpace(appName) != "worker" {
+		return nil
+	}
+	if workerServiceAccountCode != cfg.Worker.ServiceAccountCode || !serviceAccountCodePattern.MatchString(workerServiceAccountCode) {
+		return fmt.Errorf("required config SECRET_WORKER_SERVICE_ACCOUNT_CODE is invalid")
+	}
+	if cfg.Worker.BatchSize <= 0 || cfg.Worker.BatchSize > 500 {
+		return fmt.Errorf("required config SECRET_WORKER_BATCH_SIZE must be between 1 and 500")
+	}
+	if cfg.Worker.PartitionMonthsAhead <= 0 || cfg.Worker.PartitionMonthsAhead > 24 {
+		return fmt.Errorf("required config SECRET_WORKER_PARTITION_MONTHS_AHEAD must be between 1 and 24")
+	}
+	return nil
+}
+
+func validateIdentityLegacyPasswordSchemes(schemes map[string]IdentityLegacyPasswordSchemeConfig) error {
+	for schemeID, scheme := range schemes {
+		if !identityLegacyPasswordSchemePattern.MatchString(schemeID) {
+			return fmt.Errorf("identity legacy password scheme %q is invalid", schemeID)
+		}
+		if !identityLegacyPasswordDriverPattern.MatchString(scheme.Driver) {
+			return fmt.Errorf("identity legacy password scheme %q driver is invalid", schemeID)
+		}
+		if err := validateSecretReferenceValue(
+			"identity.legacy_password_schemes["+schemeID+"].secret_ref",
+			scheme.SecretRef,
+		); err != nil {
+			return err
+		}
+		retireAt, err := time.Parse(time.RFC3339, strings.TrimSpace(scheme.RetireAt))
+		if err != nil || retireAt.Format(time.RFC3339) != scheme.RetireAt {
+			return fmt.Errorf("identity legacy password scheme %q retire_at is invalid", schemeID)
+		}
+	}
+	return nil
+}
+
+func validateAdminExperienceConfig(cfg AdminExperienceConfig) error {
+	products := make(map[string]struct{}, len(cfg.ExternalProducts))
+	datasets := make(map[string]struct{})
+	for i := range cfg.ExternalProducts {
+		product := cfg.ExternalProducts[i]
+		productCode := strings.TrimSpace(product.ProductCode)
+		if productCode != product.ProductCode || !adminExperienceProductCodePattern.MatchString(productCode) {
+			return fmt.Errorf("admin_experience.external_products[%d].product_code is invalid", i)
+		}
+		if _, duplicate := products[productCode]; duplicate {
+			return fmt.Errorf("admin_experience external product %q is duplicated", productCode)
+		}
+		products[productCode] = struct{}{}
+		endpoint, err := url.Parse(strings.TrimSpace(product.BaseURL))
+		if err != nil || endpoint.Host == "" || (endpoint.Scheme != "http" && endpoint.Scheme != "https") ||
+			endpoint.User != nil || endpoint.RawQuery != "" || endpoint.Fragment != "" {
+			return fmt.Errorf("admin_experience external product %q base_url is invalid", productCode)
+		}
+		if len(product.Datasets) == 0 {
+			return fmt.Errorf("admin_experience external product %q requires at least one dataset", productCode)
+		}
+		for j := range product.Datasets {
+			dataset := product.Datasets[j]
+			if !adminExperienceDatasetKeyPattern.MatchString(dataset.Key) || !strings.HasPrefix(dataset.Key, productCode+".") {
+				return fmt.Errorf("admin_experience external product %q dataset %d key is invalid", productCode, j)
+			}
+			if !adminExperienceHashPattern.MatchString(dataset.DescriptorHash) {
+				return fmt.Errorf("admin_experience external dataset %q descriptor_hash is invalid", dataset.Key)
+			}
+			if _, duplicate := datasets[dataset.Key]; duplicate {
+				return fmt.Errorf("admin_experience external dataset %q is duplicated", dataset.Key)
+			}
+			datasets[dataset.Key] = struct{}{}
+		}
+	}
+	return nil
+}
+
+func validateProductAdminConfig(cfg *Config) error {
+	if cfg == nil {
+		return fmt.Errorf("product-admin config is required")
+	}
+	if !strings.EqualFold(strings.TrimSpace(cfg.App.Name), "admin-api") {
+		return nil
+	}
+	if len(cfg.ProductAdmin.Targets) == 0 {
+		return nil
+	}
+	for productCode, target := range cfg.ProductAdmin.Targets {
+		if !adminExperienceProductCodePattern.MatchString(productCode) {
+			return fmt.Errorf("product_admin target product code %q is invalid", productCode)
+		}
+		prefix := fmt.Sprintf("PRODUCT_ADMIN_TARGETS[%q]", productCode)
+		baseURL, err := validateServiceBaseURL(prefix+".base_url", target.BaseURL)
+		if err != nil {
+			return err
+		}
+		if baseURL.Path != "" && baseURL.Path != "/" {
+			return fmt.Errorf("required config %s.base_url must be an origin URL", prefix)
+		}
+		if err := validateServiceEndpoint(
+			cfg,
+			prefix+".base_url",
+			baseURL,
+			prefix+".allowed_origin",
+			target.AllowedOrigin,
+		); err != nil {
+			return err
+		}
+		if target.RequestTimeout < time.Second || target.RequestTimeout > time.Minute {
+			return fmt.Errorf("invalid %s.request_timeout: must be between 1s and 1m", prefix)
+		}
+		identityName := strings.TrimSpace(target.ServiceIdentityName)
+		if identityName != target.ServiceIdentityName || !internalServiceIdentityNamePattern.MatchString(identityName) {
+			return fmt.Errorf("required config %s.service_identity_name is invalid", prefix)
+		}
+		if _, exists := cfg.InternalService.OutboundIdentities[identityName]; !exists {
+			return fmt.Errorf("required internal service identity %q is not configured", identityName)
+		}
+		if !serviceSignatureKeyIDPattern.MatchString(target.SignatureKeyID) {
+			return fmt.Errorf("required config %s.signature_key_id is invalid", prefix)
+		}
+		if err := validateSecretReferenceValue(prefix+".signature_secret_ref", target.SignatureSecretRef); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func validateServiceEndpoint(
+	cfg *Config,
+	baseURLName string,
+	endpoint *url.URL,
+	allowedOriginName string,
+	allowedOriginValue string,
+) error {
+	allowedOrigin, err := validateServiceBaseURL(allowedOriginName, allowedOriginValue)
+	if err != nil {
+		return err
+	}
+	if allowedOrigin.Path != "" && allowedOrigin.Path != "/" {
+		return fmt.Errorf("required config %s must be an origin URL", allowedOriginName)
+	}
+	if serviceOrigin(endpoint) != serviceOrigin(allowedOrigin) {
+		return fmt.Errorf("required config %s is not allowed by %s", baseURLName, allowedOriginName)
+	}
+	if requiresServiceTLS(cfg.App.Env) && endpoint.Scheme != "https" {
+		return fmt.Errorf("required config %s must use https in this environment", baseURLName)
+	}
+	if isLocalEnvironment(cfg.App.Env) && endpoint.Scheme == "http" && !isLoopbackServiceHost(endpoint.Hostname()) {
+		return fmt.Errorf("required config %s may use http only on a loopback host in local development", baseURLName)
+	}
+	return nil
+}
+
+func requiresServiceTLS(environment string) bool {
+	environment = strings.ToLower(strings.TrimSpace(environment))
+	return !isLocalEnvironment(environment) && environment != "docker"
+}
+
+func isLocalEnvironment(environment string) bool {
+	switch strings.ToLower(strings.TrimSpace(environment)) {
+	case "", "local", "development", "dev":
+		return true
+	default:
+		return false
+	}
+}
+
+func isLoopbackServiceHost(host string) bool {
+	host = strings.TrimSuffix(strings.ToLower(strings.TrimSpace(host)), ".")
+	if host == "localhost" {
+		return true
+	}
+	address, err := netip.ParseAddr(host)
+	return err == nil && address.IsLoopback()
+}
+
+func serviceOrigin(endpoint *url.URL) string {
+	return strings.ToLower(endpoint.Scheme + "://" + endpoint.Host)
+}
+
+func validateServiceBaseURL(name, value string) (*url.URL, error) {
+	trimmed := strings.TrimSpace(value)
+	endpoint, err := url.Parse(trimmed)
+	if err != nil || trimmed != value || endpoint.Host == "" ||
+		(endpoint.Scheme != "http" && endpoint.Scheme != "https") || endpoint.Opaque != "" ||
+		endpoint.User != nil || endpoint.RawQuery != "" || endpoint.Fragment != "" {
+		return nil, fmt.Errorf("required config %s is invalid", name)
+	}
+	return endpoint, nil
+}
+
+func requiresIdentityRuntimeConfig(appName string) bool {
+	switch strings.ToLower(strings.TrimSpace(appName)) {
+	case "platform-api", "admin-api", "worker", "platform", "onex-platform":
+		return true
+	default:
+		return false
+	}
+}
+
+func requiresIdentityAccessTokenRuntimeConfig(appName string) bool {
+	return requiresIdentityRuntimeConfig(appName)
+}
+
+func validateIdentityAccessTokenConfig(cfg *Config) error {
+	accessToken := cfg.Identity.AccessToken
+	issuer, err := url.Parse(strings.TrimSpace(accessToken.Issuer))
+	if err != nil || issuer.Scheme == "" || issuer.Host == "" || issuer.Opaque != "" || issuer.Path != "" ||
+		issuer.User != nil || issuer.RawQuery != "" || issuer.Fragment != "" || strings.HasSuffix(accessToken.Issuer, "/") {
+		return fmt.Errorf("required config IDENTITY_ACCESS_TOKEN_ISSUER is invalid")
+	}
+	if err := validateIdentityIssuerTransport(cfg, issuer); err != nil {
+		return err
+	}
+	if !identityAccessTokenKeyIDPattern.MatchString(accessToken.SigningKeyID) {
+		return fmt.Errorf("required config IDENTITY_ACCESS_TOKEN_SIGNING_KEY_ID is invalid")
+	}
+	if err := validateReferenceConfig("IDENTITY_ACCESS_TOKEN_PUBLIC_KEY_DIRECTORY", accessToken.PublicKeyDirectory); err != nil {
+		return err
+	}
+	if accessToken.ClockSkewLeeway < 0 || accessToken.ClockSkewLeeway > maxIdentityClockSkewLeeway {
+		return fmt.Errorf("invalid IDENTITY_ACCESS_TOKEN_CLOCK_SKEW_LEEWAY: must be between 0s and 1m")
+	}
+	if accessToken.DelegatedTokenTTL <= 0 || accessToken.DelegatedTokenTTL > time.Duration(maxDelegatedAccessTokenTTLSeconds)*time.Second {
+		return fmt.Errorf("invalid IDENTITY_DELEGATED_ACCESS_TOKEN_TTL: must be between 1s and 15m")
+	}
+	if cfg.IsIdentityAccessTokenIssuer() {
+		if err := validateReferenceConfig("IDENTITY_ACCESS_TOKEN_PRIVATE_KEY_PATH", accessToken.PrivateKeyPath); err != nil {
+			return err
+		}
+	}
+	if len(accessToken.Resources) == 0 {
+		return fmt.Errorf("identity.access_token.resources requires at least one resource")
+	}
+	if err := validateIdentityProtectedResources(cfg, accessToken.ProtectedResources); err != nil {
+		return err
+	}
+	audiences := make(map[string]string, len(accessToken.Resources))
+	for productCode, resource := range accessToken.Resources {
+		if !adminExperienceProductCodePattern.MatchString(productCode) {
+			return fmt.Errorf("identity.access_token.resources product code %q is invalid", productCode)
+		}
+		audienceValue := strings.TrimSpace(resource.Audience)
+		audience, err := url.Parse(audienceValue)
+		if err != nil || audienceValue != resource.Audience || audience.Scheme == "" || strings.ContainsFunc(resource.Audience, unicode.IsSpace) {
+			return fmt.Errorf("identity.access_token.resources[%q].audience is invalid", productCode)
+		}
+		if existingProductCode, duplicate := audiences[audienceValue]; duplicate {
+			return fmt.Errorf(
+				"identity.access_token.resources[%q].audience duplicates resource %q",
+				productCode,
+				existingProductCode,
+			)
+		}
+		audiences[audienceValue] = productCode
+		if err := validateAccessTokenScopes(productCode, "user_scopes", resource.UserScopes); err != nil {
+			return err
+		}
+		if err := validateAccessTokenScopes(productCode, "guest_scopes", resource.GuestScopes); err != nil {
+			return err
+		}
+	}
+	return validateIdentityClients(cfg.Identity.Clients, accessToken.Resources, accessToken.ProtectedResources)
+}
+
+func validateIdentityProtectedResources(cfg *Config, resources map[string]IdentityProtectedResourceConfig) error {
+	if len(resources) == 0 {
+		return fmt.Errorf("identity.access_token.protected_resources requires at least one resource")
+	}
+	identifiers := make(map[string]string, len(resources))
+	audiences := make(map[string]string, len(resources))
+	for code, resource := range resources {
+		if !adminExperienceProductCodePattern.MatchString(code) {
+			return fmt.Errorf("identity.access_token.protected_resources resource code %q is invalid", code)
+		}
+		if err := serviceidentity.ValidateResourceIdentifier(resource.ResourceIdentifier); err != nil {
+			return fmt.Errorf("identity.access_token.protected_resources[%q].resource_identifier is invalid", code)
+		}
+		parsed, _ := url.Parse(resource.ResourceIdentifier)
+		if cfg.IsProduction() && parsed.Scheme != "https" {
+			return fmt.Errorf("identity.access_token.protected_resources[%q].resource_identifier must use https in production", code)
+		}
+		if existingCode, duplicate := identifiers[resource.ResourceIdentifier]; duplicate {
+			return fmt.Errorf("identity.access_token.protected_resources[%q].resource_identifier duplicates resource %q", code, existingCode)
+		}
+		identifiers[resource.ResourceIdentifier] = code
+		if err := serviceidentity.ValidateAudience(resource.Audience); err != nil ||
+			resource.Audience == serviceidentity.AudienceIdentityTokenService {
+			return fmt.Errorf("identity.access_token.protected_resources[%q].audience is invalid", code)
+		}
+		if existingCode, duplicate := audiences[resource.Audience]; duplicate {
+			return fmt.Errorf("identity.access_token.protected_resources[%q].audience duplicates resource %q", code, existingCode)
+		}
+		audiences[resource.Audience] = code
+		if strings.TrimSpace(resource.ResourceName) != resource.ResourceName || resource.ResourceName == "" || len(resource.ResourceName) > 160 {
+			return fmt.Errorf("identity.access_token.protected_resources[%q].resource_name is invalid", code)
+		}
+	}
+	return nil
+}
+
+func validateIdentityClients(
+	clients map[string]IdentityClientConfig,
+	resources map[string]IdentityAccessTokenResourceConfig,
+	protectedResources map[string]IdentityProtectedResourceConfig,
+) error {
+	if len(clients) == 0 {
+		return fmt.Errorf("identity.clients requires at least one client")
+	}
+	registeredResourceAudiences := make(map[string]struct{}, len(protectedResources))
+	for _, resource := range protectedResources {
+		registeredResourceAudiences[resource.Audience] = struct{}{}
+	}
+	for clientID, client := range clients {
+		if strings.TrimSpace(clientID) != clientID || !identityClientIDPattern.MatchString(clientID) {
+			return fmt.Errorf("identity.clients client id %q is invalid", clientID)
+		}
+		productCode := strings.TrimSpace(client.ProductCode)
+		if productCode != client.ProductCode || !adminExperienceProductCodePattern.MatchString(productCode) {
+			return fmt.Errorf("identity.clients[%q].product_code is invalid", clientID)
+		}
+		if _, ok := resources[productCode]; !ok {
+			return fmt.Errorf("identity.clients[%q].product_code references unknown resource %q", clientID, productCode)
+		}
+		applicationCode := strings.TrimSpace(client.ApplicationCode)
+		if applicationCode != client.ApplicationCode || !identityApplicationCodePattern.MatchString(applicationCode) {
+			return fmt.Errorf("identity.clients[%q].application_code is invalid", clientID)
+		}
+		registrationSource := strings.TrimSpace(client.RegistrationSource)
+		if registrationSource != client.RegistrationSource || !adminExperienceProductCodePattern.MatchString(registrationSource) {
+			return fmt.Errorf("identity.clients[%q].registration_source is invalid", clientID)
+		}
+		if len(client.AllowedPrincipalTypes) == 0 {
+			return fmt.Errorf("identity.clients[%q].allowed_principal_types requires at least one principal type", clientID)
+		}
+		seenPrincipalTypes := make(map[string]struct{}, len(client.AllowedPrincipalTypes))
+		for _, principalType := range client.AllowedPrincipalTypes {
+			if strings.TrimSpace(principalType) != principalType || (principalType != "user" && principalType != "guest") {
+				return fmt.Errorf("identity.clients[%q].allowed_principal_types contains invalid principal type %q", clientID, principalType)
+			}
+			if _, duplicate := seenPrincipalTypes[principalType]; duplicate {
+				return fmt.Errorf("identity.clients[%q].allowed_principal_types contains duplicate principal type %q", clientID, principalType)
+			}
+			seenPrincipalTypes[principalType] = struct{}{}
+		}
+		seenServiceAccounts := make(map[string]struct{}, len(client.TokenExchangeServiceAccounts))
+		for _, serviceAccountCode := range client.TokenExchangeServiceAccounts {
+			if strings.TrimSpace(serviceAccountCode) != serviceAccountCode || !serviceAccountCodePattern.MatchString(serviceAccountCode) {
+				return fmt.Errorf("identity.clients[%q].token_exchange_service_accounts contains invalid service account %q", clientID, serviceAccountCode)
+			}
+			if _, duplicate := seenServiceAccounts[serviceAccountCode]; duplicate {
+				return fmt.Errorf("identity.clients[%q].token_exchange_service_accounts contains duplicate service account %q", clientID, serviceAccountCode)
+			}
+			seenServiceAccounts[serviceAccountCode] = struct{}{}
+		}
+		seenResources := make(map[string]struct{}, len(client.TokenExchangeResources))
+		for _, audience := range client.TokenExchangeResources {
+			if err := serviceidentity.ValidateAudience(audience); err != nil || audience == serviceidentity.AudienceIdentityTokenService {
+				return fmt.Errorf("identity.clients[%q].token_exchange_resources contains invalid audience %q", clientID, audience)
+			}
+			if _, registered := registeredResourceAudiences[audience]; !registered {
+				return fmt.Errorf("identity.clients[%q].token_exchange_resources references unknown protected resource audience %q", clientID, audience)
+			}
+			if _, duplicate := seenResources[audience]; duplicate {
+				return fmt.Errorf("identity.clients[%q].token_exchange_resources contains duplicate audience %q", clientID, audience)
+			}
+			seenResources[audience] = struct{}{}
+		}
+		if (len(client.TokenExchangeServiceAccounts) == 0) != (len(client.TokenExchangeResources) == 0) {
+			return fmt.Errorf("identity.clients[%q] token exchange actors and resources must be configured together", clientID)
+		}
+	}
+	return nil
+}
+
+func validateIdentityGuestCapabilityConfig(cfg IdentityGuestCapabilityConfig) error {
+	if err := validatePathValue("IDENTITY_GUEST_CAPABILITY_SECRET_PROVIDER_FILE", cfg.SecretProviderFile, true); err != nil {
+		return err
+	}
+	if !identityGuestCapabilityKeyIDPattern.MatchString(cfg.InitialKeyID) {
+		return fmt.Errorf("required config IDENTITY_GUEST_CAPABILITY_INITIAL_KEY_ID is invalid")
+	}
+	if err := validateReferenceConfig("IDENTITY_GUEST_CAPABILITY_VERIFIER_INSTANCE_ID", cfg.VerifierInstanceID); err != nil {
+		return err
+	}
+	if len(cfg.VerifierInstanceID) > 128 {
+		return fmt.Errorf("required config IDENTITY_GUEST_CAPABILITY_VERIFIER_INSTANCE_ID must not exceed 128 characters")
+	}
+	return nil
+}
+
+func validateIdentityIssuerTransport(cfg *Config, issuer *url.URL) error {
+	if issuer.Scheme == "https" {
+		return nil
+	}
+	if issuer.Scheme == "http" && isIdentityLocalRuntimeEnvironment(cfg.App.Env) && isLoopbackServiceHost(issuer.Hostname()) {
+		return nil
+	}
+	if cfg.IsProduction() {
+		return fmt.Errorf("required config IDENTITY_ACCESS_TOKEN_ISSUER must use https in production")
+	}
+	return fmt.Errorf("required config IDENTITY_ACCESS_TOKEN_ISSUER may use http only on a loopback host in local development")
+}
+
+func isIdentityLocalRuntimeEnvironment(environment string) bool {
+	return isLocalEnvironment(environment) || strings.EqualFold(strings.TrimSpace(environment), "docker")
+}
+
+func validateAccessTokenScopes(productCode, field string, scopes []string) error {
+	if len(scopes) == 0 {
+		return fmt.Errorf("identity.access_token.resources[%q].%s requires at least one scope", productCode, field)
+	}
+	seen := make(map[string]struct{}, len(scopes))
+	for _, scope := range scopes {
+		if !identityAccessTokenScopePattern.MatchString(scope) {
+			return fmt.Errorf("identity.access_token.resources[%q].%s contains invalid scope %q", productCode, field, scope)
+		}
+		if _, duplicate := seen[scope]; duplicate {
+			return fmt.Errorf("identity.access_token.resources[%q].%s contains duplicate scope %q", productCode, field, scope)
+		}
+		seen[scope] = struct{}{}
+	}
+	return nil
+}
+
+func validatePort(port int) error {
+	if port < 1 || port > 65535 {
+		return fmt.Errorf("invalid APP_PORT: %d, must be 1-65535", port)
+	}
+	return nil
+}
+
+func validateInternalServiceConfig(cfg *Config) error {
+	internal := cfg.InternalService
+	if internal.RequestTimeout < time.Second || internal.RequestTimeout > time.Minute {
+		return fmt.Errorf("invalid INTERNAL_SERVICE_REQUEST_TIMEOUT: must be between 1s and 1m")
+	}
+	if internal.TokenTTLSeconds < 1 || internal.TokenTTLSeconds > maxInternalServiceTokenTTLSeconds {
+		return fmt.Errorf("invalid ONEX_IAM_SERVICE_TOKEN_TTL_SECONDS: %d, must be 1-%d", internal.TokenTTLSeconds, maxInternalServiceTokenTTLSeconds)
+	}
+	if internal.AuthorizationConsistencyTokenTTLSeconds < 1 ||
+		internal.AuthorizationConsistencyTokenTTLSeconds > maxIAMConsistencyTokenTTLSeconds {
+		return fmt.Errorf(
+			"invalid ONEX_IAM_AUTHORIZATION_CONSISTENCY_TOKEN_TTL_SECONDS: %d, must be 1-%d",
+			internal.AuthorizationConsistencyTokenTTLSeconds,
+			maxIAMConsistencyTokenTTLSeconds,
+		)
+	}
+	signing := internal.ServiceTokenSigning
+	if strings.TrimSpace(signing.PublicKeyDirectory) != "" || strings.TrimSpace(signing.PrivateKeyPath) != "" {
+		if !identityAccessTokenKeyIDPattern.MatchString(signing.KeyID) {
+			return fmt.Errorf("required config ONEX_IAM_SERVICE_TOKEN_SIGNING_KEY_ID is invalid")
+		}
+		if err := validateReferenceConfig("ONEX_IAM_SERVICE_TOKEN_PUBLIC_KEY_DIRECTORY", signing.PublicKeyDirectory); err != nil {
+			return err
+		}
+	}
+	if cfg.IsIAMServiceTokenIssuer() {
+		if err := validateReferenceConfig("ONEX_IAM_SERVICE_TOKEN_PRIVATE_KEY_PATH", signing.PrivateKeyPath); err != nil {
+			return err
+		}
+	}
+	for name, identity := range internal.OutboundIdentities {
+		if !internalServiceIdentityNamePattern.MatchString(name) {
+			return fmt.Errorf("internal_service.outbound_identities contains invalid name %q", name)
+		}
+		fieldPrefix := fmt.Sprintf("internal_service.outbound_identities[%q]", name)
+		if err := validateReferenceConfig(fieldPrefix+".credential_ref", identity.CredentialRef); err != nil {
+			return err
+		}
+		if cfg.IsProduction() && isLocalDevReference(identity.CredentialRef) {
+			return fmt.Errorf("required config %s.credential_ref must not use a localdev reference in production", fieldPrefix)
+		}
+		if len(identity.AllowedProductCodes) == 0 || len(identity.AllowedProductCodes) > 64 {
+			return fmt.Errorf("required config %s.allowed_product_codes is invalid", fieldPrefix)
+		}
+		seenProducts := make(map[string]struct{}, len(identity.AllowedProductCodes))
+		for _, productCode := range identity.AllowedProductCodes {
+			if !adminExperienceProductCodePattern.MatchString(productCode) {
+				return fmt.Errorf("required config %s.allowed_product_codes is invalid", fieldPrefix)
+			}
+			if _, duplicate := seenProducts[productCode]; duplicate {
+				return fmt.Errorf("required config %s.allowed_product_codes contains duplicate product", fieldPrefix)
+			}
+			seenProducts[productCode] = struct{}{}
+		}
+		if err := serviceidentity.ValidateAudience(identity.Audience); err != nil {
+			return fmt.Errorf("required config %s.audience is invalid", fieldPrefix)
+		}
+		if expected := strings.TrimSpace(identity.ExpectedServiceAccountCode); expected != identity.ExpectedServiceAccountCode ||
+			!serviceAccountCodePattern.MatchString(expected) {
+			return fmt.Errorf("config %s.expected_service_account_code is invalid", fieldPrefix)
+		}
+	}
+	return nil
+}
+
+func validateSecretConfig(name, value string, minLength int) error {
+	trimmed := strings.TrimSpace(value)
+	if trimmed == "" {
+		return fmt.Errorf("required config %s is not set", name)
+	}
+	if len(trimmed) < minLength {
+		return fmt.Errorf("required config %s must be at least %d characters", name, minLength)
+	}
+	if containsTemplateFragment(trimmed) {
+		return fmt.Errorf("required config %s must not use a template value", name)
+	}
+	return nil
+}
+
+func validateReferenceConfig(name, value string) error {
+	trimmed := strings.TrimSpace(value)
+	if trimmed == "" {
+		return fmt.Errorf("required config %s is not set", name)
+	}
+	if strings.ContainsFunc(trimmed, unicode.IsSpace) {
+		return fmt.Errorf("required config %s must not contain whitespace", name)
+	}
+	if containsTemplateFragment(trimmed) {
+		return fmt.Errorf("required config %s must not use a template value", name)
+	}
+	return nil
+}
+
+func containsTemplateFragment(value string) bool {
+	lower := strings.ToLower(strings.TrimSpace(value))
+	templateFragments := []string{"change-me", "your-", "replace-with", "example"}
+	for _, fragment := range templateFragments {
+		if strings.Contains(lower, fragment) {
+			return true
+		}
+	}
+	return false
+}
+
+func isLocalDevReference(value string) bool {
+	return strings.HasPrefix(strings.ToLower(strings.TrimSpace(value)), "localdev://")
+}
+
+func validateTemporalWorkerConfig(cfg TemporalWorkerConfig) error {
+	return validateTemporalWorkerConfigWithPrefix(cfg, "TEMPORAL_WORKER")
+}
+
+func validateTemporalWorkerConfigWithPrefix(cfg TemporalWorkerConfig, envPrefix string) error {
+	if cfg.MaxConcurrentActivities < 0 {
+		return fmt.Errorf("invalid %s_MAX_CONCURRENT_ACTIVITIES: %d, must be greater than or equal to 0", envPrefix, cfg.MaxConcurrentActivities)
+	}
+	if cfg.MaxConcurrentWorkflowTasks < 0 || cfg.MaxConcurrentWorkflowTasks == 1 {
+		return fmt.Errorf("invalid %s_MAX_CONCURRENT_WORKFLOW_TASKS: %d, must be 0 or greater than 1", envPrefix, cfg.MaxConcurrentWorkflowTasks)
+	}
+	if cfg.MaxConcurrentActivityTaskPollers < 0 {
+		return fmt.Errorf("invalid %s_MAX_CONCURRENT_ACTIVITY_TASK_POLLERS: %d, must be greater than or equal to 0", envPrefix, cfg.MaxConcurrentActivityTaskPollers)
+	}
+	if cfg.MaxConcurrentWorkflowTaskPollers < 0 || cfg.MaxConcurrentWorkflowTaskPollers == 1 {
+		return fmt.Errorf("invalid %s_MAX_CONCURRENT_WORKFLOW_TASK_POLLERS: %d, must be 0 or greater than 1", envPrefix, cfg.MaxConcurrentWorkflowTaskPollers)
+	}
+	return nil
+}