config

type APIServer struct {
	Server              *http.ServerConfig            `yaml:"server" validate:"required"`
	Database            *pgdb.DatabaseConfig          `yaml:"database" validate:"required"`
	Canton              *canton.Config                `yaml:"canton" validate:"required"`
	Token               *token.Config                 `yaml:"token" validate:"required"`
	TokenProvider       *TokenProviderConfig          `yaml:"token_provider" default:"-"` // omit → defaults to canton mode
	EthRPC              *ethrpc.Config                `yaml:"eth_rpc" validate:"required"`
	JWKS                *JWKS                         `yaml:"jwks" default:"-"`          // nil by default (feature disabled)
	AcceptWorker        *custodial.AcceptWorkerConfig `yaml:"accept_worker" default:"-"` // nil disables the worker
	Monitoring          *Monitoring                   `yaml:"monitoring" validate:"required"`
	Logging             *log.Config                   `yaml:"logging" validate:"required"`
	KeyManagement       *KeyManagement                `yaml:"key_management" validate:"required"`
	SkipCantonSigVerify bool                          `yaml:"skip_canton_sig_verify" default:"false"`
	SkipWhitelistCheck  bool                          `yaml:"skip_whitelist_check" default:"false"`
	CORSOrigins         []string                      `yaml:"cors" default:"[\"*\"]"`
}

type IndexerProviderConfig struct {
	// URL is the base URL of the indexer's HTTP admin API (e.g. "http://indexer:8082").
	URL string `yaml:"url" validate:"required"`
	// Instruments maps each supported token symbol (InstrumentID) to its Canton
	// instrument admin party.  The indexer keys tokens by {admin, id}, so this
	// mapping is required to translate from the Provider interface's symbol-only
	// calls to the indexer's composite key.
	//
	// Example:
	//   instruments:
	//     DEMO: "admin::abc123@domain"
	//     PROMPT: "issuer::xyz@domain"
	Instruments map[string]string `yaml:"instruments" validate:"required,min=1"`
}

type IndexerServer struct {
	Server *http.ServerConfig `yaml:"server" validate:"required"`
	// Database holds PostgreSQL connection settings for the indexer DB.
	Database *pgdb.DatabaseConfig `yaml:"database" validate:"required"`
	// CantonLedger holds the Canton participant connection settings. The indexer only
	// needs the ledger gRPC connection (for streaming) — Identity, Token, and
	// Bridge sub-clients are not required.
	CantonLedger *ledger.Config  `yaml:"canton_ledger" validate:"required"`
	Indexer      *indexer.Config `yaml:"indexer" validate:"required"`
	Monitoring   *Monitoring     `yaml:"monitoring" validate:"required"`
	Logging      *log.Config     `yaml:"logging" validate:"required"`
}

type JWKS struct {
	URL    string `yaml:"url" default:""`
	Issuer string `yaml:"issuer" default:""`
}

type KeyManagement struct {
	// MasterKeyEnv is the environment variable name containing the master encryption key (base64)
	MasterKeyEnv string `yaml:"master_key_env" validate:"required" default:"CANTON_MASTER_KEY"`
	// KeyDerivation specifies how to generate Canton keys: "generate" (random) or "derive" (from EVM + seed)
	KeyDerivation string `yaml:"key_derivation" default:"generate" validate:"required,oneof=generate derive"`
}

type Monitoring struct {
	Enabled        bool               `yaml:"enabled" default:"false"`
	Server         *http.ServerConfig `yaml:"server" validate:"required_if=Enabled true"`
	HealthCheckURL string             `yaml:"health_check_url" default:"/health"`
}

type RelayerServer struct {
	Server     *http.ServerConfig   `yaml:"server" validate:"required"`
	Database   *pgdb.DatabaseConfig `yaml:"database" validate:"required"`
	Ethereum   *ethereum.Config     `yaml:"ethereum" validate:"required"`
	Canton     *canton.Config       `yaml:"canton" validate:"required"`
	Bridge     *relayer.Config      `yaml:"bridge" validate:"required"`
	Monitoring *Monitoring          `yaml:"monitoring" validate:"required"`
	Logging    *log.Config          `yaml:"logging" validate:"required"`
}

type TokenProviderConfig struct {
	// Mode selects the provider backend.  Defaults to "canton".
	Mode TokenProviderMode `yaml:"mode" default:"canton" validate:"required,oneof=canton indexer"`
	// Indexer holds settings used when Mode is "indexer".  Must be set when
	// Mode is "indexer"; ignored otherwise.
	Indexer *IndexerProviderConfig `yaml:"indexer"`
}

type TokenProviderMode string