config

type AccountLimits struct {
	RequestsPerMinute int   `toml:"requests_per_minute"`
	QueuedJobs        int64 `toml:"queued_jobs"`
	ActiveJobs        int64 `toml:"active_jobs"`
	QueuedBytes       int64 `toml:"queued_bytes"`
}

type AdmissionConfig struct {
	Account AccountLimits `toml:"account"`
	// Operator applies to authenticated operator accounts and the explicitly
	// enabled local-development bucket. Neither bypasses admission accounting.
	Operator AccountLimits `toml:"operator"`
}

type AllowanceConfig struct {
	Enabled bool `toml:"enabled"`
	// DefaultGrant is the amount, in TEST units, of a grant whose request names
	// none. Omitted or 0 means DefaultAllowanceGrant.
	DefaultGrant int64 `toml:"default_grant"`
}

type AttributionConfig struct {
	// RetentionDays is how long the history is kept. Older records are pruned
	// periodically, and GET /attribution/candidates reports the resulting
	// retained_from. Omitted or 0 means DefaultAttributionRetentionDays, so
	// a configuration built in code without it keeps the documented default.
	RetentionDays int `toml:"retention_days"`
	// TrustedProxies lists the addresses or CIDR prefixes of reverse proxies
	// in front of the HTTP API that set X-Forwarded-For. The attribution
	// routes are rate-limited per client address; for a request whose TCP
	// peer is one of these, the client address is the right-most
	// X-Forwarded-For entry that is not itself a trusted proxy. Empty, the
	// default, trusts no forwarding header, so every client behind a proxy
	// shares the proxy's allowance.
	TrustedProxies []string `toml:"trusted_proxies"`
	// ReceiptKeyPath is the PEM file holding the Ed25519 private key that
	// signs the receipts of POST /attribution/verify. It is created, owner
	// readable only, when absent. Empty means DefaultReceiptKeyFile in the
	// directory of the database.
	ReceiptKeyPath string `toml:"receipt_key_path"`
}

type AuthenticationConfig struct {
	PublicURL             string `toml:"public_url"`
	DeviceVerificationURL string `toml:"device_verification_url"`
}

type CILogonConfig struct {
	Enabled     bool   `toml:"enabled"`
	Issuer      string `toml:"issuer"`
	CallbackURL string `toml:"callback_url"`
	SuccessURL  string `toml:"success_url"`
}

type CORSConfig struct {
	// AllowedOrigins is the list of origins allowed to make credentialed
	// (cookie-based) requests to the API. Cookie auth (session_token) only
	// works cross-origin for origins listed here — an empty list leaves CORS
	// wide open ("*") but without credentials, so browser clients can't send
	// the session cookie at all.
	AllowedOrigins []string `toml:"allowed_origins"`
}

type ConfiguredFile struct {
	Field, Path string
}

type DatabaseConfig struct {
	Path string `toml:"path"`
}

type DispatcherConfig struct {
	Server             ServerConfig             `toml:"server"`
	Logging            LoggingConfig            `toml:"logging"`
	Scheduler          SchedulerConfig          `toml:"scheduler"`
	TLS                TLSConfig                `toml:"tls"`
	Database           DatabaseConfig           `toml:"database"`
	Sui                SuiConfig                `toml:"sui"`
	CORS               CORSConfig               `toml:"cors"`
	GitHubOAuth        GitHubOAuthConfig        `toml:"github_oauth"`
	CILogonOIDC        CILogonConfig            `toml:"cilogon_oidc"`
	Authentication     AuthenticationConfig     `toml:"authentication"`
	Output             OutputConfig             `toml:"output"`
	Egress             EgressConfig             `toml:"egress"`
	Admission          AdmissionConfig          `toml:"admission"`
	Retention          RetentionConfig          `toml:"retention"`
	ExecutorOnboarding ExecutorOnboardingConfig `toml:"executor_onboarding"`
	Attribution        AttributionConfig        `toml:"attribution"`
	Allowance          AllowanceConfig          `toml:"allowance"`
	// Executors holds optional operator display metadata by executor ID.
	Executors map[string]ExecutorDisplay `toml:"executors"`
	Metadata  MetadataConfig             `toml:"metadata"`
}

type EgressConfig struct {
	Enabled       bool          `toml:"enabled"`
	WindowSeconds int64         `toml:"window_seconds"`
	Run           EgressLimits  `toml:"run"`
	Account       EgressLimits  `toml:"account"`
	Node          EgressLimits  `toml:"node"`
	Groups        []EgressGroup `toml:"groups"`
}

type EgressGroup struct {
	Name     string       `toml:"name"`
	Prefixes []string     `toml:"prefixes"`
	Names    []string     `toml:"names"`
	Limits   EgressLimits `toml:"limits"`
}

type EgressLimits struct {
	BitsPerSecond     int64 `toml:"bits_per_second"`
	BurstBytes        int64 `toml:"burst_bytes"`
	Bytes             int64 `toml:"bytes"`
	AttemptsPerSecond int64 `toml:"attempts_per_second"`
	AttemptBurst      int64 `toml:"attempt_burst"`
	Attempts          int64 `toml:"attempts"`
	Targets           int64 `toml:"targets"`
}

type ExecutorDisplay struct {
	DisplayName string `toml:"display_name" json:"display_name"`
	City        string `toml:"city" json:"city"`
	Country     string `toml:"country" json:"country"` // ISO 3166-1 alpha-2, upper case.
	Network     string `toml:"network" json:"network"`
	// Only this locally approved literal host and pool may receive connect-back
	// challenges for this executor. Neither hello nor a measurement selects it.
	ConnectivityHost  string `toml:"connectivity_host" json:"-"`
	ConnectivityPorts string `toml:"connectivity_ports" json:"-"`
}

type ExecutorOnboardingConfig struct {
	Enabled       bool   `toml:"enabled"`
	CACert        string `toml:"ca_cert"`
	CAKey         string `toml:"ca_key"`
	DispatcherURL string `toml:"dispatcher_url"`
	GRPCAddress   string `toml:"grpc_address"`
	YamuxAddress  string `toml:"yamux_address"`
}

type GitHubOAuthConfig struct {
	Enabled     bool   `toml:"enabled"`
	CallbackURL string `toml:"callback_url"`
	SuccessURL  string `toml:"success_url"`
}

type LoggingConfig struct {
	LogLevel string `toml:"log_level"`
	JSONLogs bool   `toml:"json_logs"`
}

type MetadataConfig struct {
	ASNDatabase  string `toml:"asn_database"`
	CityDatabase string `toml:"city_database"`
}

type OutputConfig struct {
	ControlReserveBytes int64 `toml:"control_reserve_bytes"`
	RunBytes            int64 `toml:"run_bytes"`
	RunFrames           int64 `toml:"run_frames"`
	AccountBytes        int64 `toml:"account_bytes"`
	NodeBytes           int64 `toml:"node_bytes"`
}

type RetentionConfig struct {
	PayloadMaxAgeSeconds int64 `toml:"payload_max_age_seconds"`
}

type SchedulerConfig struct {
	// ExecutorTimeout is the negotiated control lease in seconds, from 1 to 300.
	// Heartbeat telemetry is separate from lease renewal.
	ExecutorTimeout int `toml:"executor_timeout"`
	// SchedulerGranularityMs is the scheduler granularity in milliseconds for time-range capacity tracking.
	SchedulerGranularityMs int64 `toml:"scheduler_granularity_ms"`
}

type ServerConfig struct {
	BindHost string `toml:"bind_host"`
	Version  string `toml:"version"`
	GRPCPort int    `toml:"grpc_port"`
	HTTPPort int    `toml:"http_port"`
	// LocalDevelopment asks the HTTP API for its local development profile, in
	// which a request that presents no credential at all is served as the
	// dispatcher's own local operator. It is an explicit opt-in and is never
	// inferred: the daemon additionally requires the environment it describes
	// (blockchain payments off, TLS listener off, both listeners on loopback)
	// and refuses to start when the key is set without it. Omitted or false
	// keeps authentication and authorization enforced.
	LocalDevelopment bool `toml:"local_development"`
	// BehindTLSTerminator states that a TLS terminator stands in front of this
	// dispatcher, so the session cookie is marked Secure although the daemon
	// itself serves cleartext. It is configuration because a request cannot be
	// trusted to describe its own scheme: X-Forwarded-Proto and its relatives
	// are set by whoever sent the request.
	BehindTLSTerminator bool `toml:"behind_tls_terminator"`
}

type ServerTLS struct {
	Combined *tls.Config
	Direct   *tls.Config
	// RequireClientIdentity reports whether an executor must present a
	// certificate issued by tls.ca_file on both control channels.
	RequireClientIdentity bool
}

type SuiConfig struct {
	Network           string `toml:"network"`       //testnet or mainnet
	GRPCEndpoint      string `toml:"grpc_endpoint"` // host:port, e.g. fullnode.testnet.sui.io:443
	GraphQLURL        string `toml:"graphql_url"`   // Sui GraphQL RPC, used to catch up on PaymentReceipt events by type
	Address           string `toml:"address"`
	PaymentRegistryId string `toml:"payment_registry_id"`
	PaymentKitPackage string `toml:"payment_kit_package"`
	KeystorePath      string `toml:"keystore_path"`
	// Disabled switches blockchain payments off explicitly. When true, the
	// dispatcher constructs neither the Sui client/listener nor the payout
	// ticker and rejects USDC/SUI payment actions; TEST payments keep working.
	// The other Sui fields are ignored in that mode. Omitted or false keeps
	// the enabled semantics unchanged; nothing is inferred from empty fields.
	Disabled bool `toml:"disabled"`
}

type TLSConfig struct {
	Disable  bool   `toml:"disable"`
	CertFile string `toml:"cert_file"`
	KeyFile  string `toml:"key_file"`
	CAFile   string `toml:"ca_file,omitempty"` // optional for client cert validation
	// RequireClientCert makes an executor present a certificate issued by
	// CAFile on both control channels: the direct gRPC listener refuses a
	// missing identity during the handshake, and the reverse control stream
	// on the combined listener is refused after it. The HTTP API shares that
	// listener and keeps working without a client certificate.
	RequireClientCert bool `toml:"require_client_cert"`
}