panel

type AutoSpeedLimitConfig struct {
	Limit         int `mapstructure:"Limit"`
	WarnTimes     int `mapstructure:"WarnTimes"`
	LimitSpeed    int `mapstructure:"LimitSpeed"`
	LimitDuration int `mapstructure:"LimitDuration"`
}

type CertConfig struct {
	CertMode   string            `mapstructure:"CertMode"`
	CertDomain string            `mapstructure:"CertDomain"`
	CertFile   string            `mapstructure:"CertFile"`
	KeyFile    string            `mapstructure:"KeyFile"`
	Provider   string            `mapstructure:"Provider"`
	Email      string            `mapstructure:"Email"`
	DNSEnv     map[string]string `mapstructure:"DNSEnv"`
}

type Config struct {
	Log   LogConfig    `mapstructure:"Log"`
	Nodes []NodeConfig `mapstructure:"Nodes"`

	// --- sing-box passthrough blocks (doc/09 §6.1, §6.2) ---
	//
	// These are NOT parsed by viper: they carry literal sing-box config, which
	// the base decodes itself (core/singbox/passthrough.go). They are held as raw
	// JSON because viper LOWERCASES every map key it reads — harmless for
	// sing-box's own snake_case keys, but it would silently mangle case-sensitive
	// values such as a transport's `headers: {Host: ...}`. loadPassthrough reads
	// them straight from the YAML instead, preserving case exactly.
	//
	// Empty means "not configured": DNS falls back to the Box default, outbounds
	// fall back to a lone direct, and routing is absent (everything egresses via
	// the default outbound).
	DNSRaw      json.RawMessage `mapstructure:"-"`
	OutboundRaw json.RawMessage `mapstructure:"-"`
	RouteRaw    json.RawMessage `mapstructure:"-"`
	// AccessLog is the process-level access-log reporting policy (doc/09 §4.3,
	// doc/11 §13.1). It is the billing/accesslog.Config directly; the Manager's
	// normalize() fills defaults. Enable=false (the zero value) leaves access
	// logging off, so existing configs without an AccessLog block load cleanly.
	AccessLog accesslog.Config `mapstructure:"AccessLog"`
	// ConnectionConfig is node-local connection tuning, applied to every
	// inbound. Absent means "leave every base default alone".
	ConnectionConfig *ConnectionConfig `mapstructure:"ConnectionConfig"`
}

type ConnLimitConfig struct {
	Enable         bool `mapstructure:"Enable"`
	MaxConnPerUser int  `mapstructure:"MaxConnPerUser"`
}

type ConnectionConfig struct {
	UDPTimeout           int  `mapstructure:"UDPTimeout"`           // seconds; base default ~5min
	TCPKeepAlive         int  `mapstructure:"TCPKeepAlive"`         // seconds; idle before first probe
	TCPKeepAliveInterval int  `mapstructure:"TCPKeepAliveInterval"` // seconds; gap between probes
	DisableTCPKeepAlive  bool `mapstructure:"DisableTCPKeepAlive"`

	// --- XrayR compatibility: parsed, warned about, never applied ---
	Handshake    int `mapstructure:"Handshake"`
	ConnIdle     int `mapstructure:"ConnIdle"`
	UplinkOnly   int `mapstructure:"UplinkOnly"`
	DownlinkOnly int `mapstructure:"DownlinkOnly"`
	BufferSize   int `mapstructure:"BufferSize"`
}

type Controller struct {
	// contains filtered or unexported fields
}

type ControllerConfig struct {
	ListenIP       string `mapstructure:"ListenIP"`
	SendIP         string `mapstructure:"SendIP"`
	UpdatePeriodic int    `mapstructure:"UpdatePeriodic"`
	EnableDNS      bool   `mapstructure:"EnableDNS"`
	DNSType        string `mapstructure:"DNSType"`
	// EnableProxyProtocol makes Sing2 own the public listener and accept a
	// PROXY header on it (core/singbox/proxyproto.go), so a node behind
	// haproxy's send-proxy still sees real client addresses. Any sender is
	// believed — keep the port reachable only from the load balancer.
	EnableProxyProtocol bool `mapstructure:"EnableProxyProtocol"`
	EnableFallback      bool `mapstructure:"EnableFallback"`

	// Node-local REALITY: legacy panels keep the private key node-side and do not
	// deliver reality-opts, so the Controller injects REALITYConfigs into the
	// NodeInfo before AddNode when EnableREALITY is set (unless the operator forces
	// the panel copy via DisableLocalREALITYConfig). doc/09 §5.3.
	EnableREALITY             bool          `mapstructure:"EnableREALITY"`
	DisableLocalREALITYConfig bool          `mapstructure:"DisableLocalREALITYConfig"`
	REALITYConfigs            RealityConfig `mapstructure:"REALITYConfigs"`

	// MieruUserHintIsMandatory forces mieru's per-connection user hint on or off
	// for this node, overriding whatever the panel says.
	//
	// Node-local authority is correct here, unlike the panel-wins rule that
	// governs protocol identity (enable_vless and friends): this flag changes
	// nothing about what a subscription contains or how a client is configured
	// — mieru clients ALWAYS emit the hint (mieru pkg/protocol/mux.go:646,661 →
	// addUserHintToNonce, skipped only when the username is empty). It only
	// decides whether the SERVER still falls back to trying every user when the
	// hint misses. That fallback is the node's CPU bill, so the node's operator
	// gets to decide. Same category as the REALITY private key being node-local.
	//
	// nil = defer to the panel. true = require the hint, which removes the
	// try-every-user path entirely (~10x cheaper on junk traffic; see
	// protocol/mieru/metrics.go and upstream enfein/mieru#273) at the cost of
	// locking out mieru clients older than v3.31.0. false = force the fallback
	// back on, the escape hatch when that lockout bites.
	MieruUserHintIsMandatory *bool `mapstructure:"MieruUserHintIsMandatory"`

	// Local control sub-blocks, all consumed by the Controller: AutoSpeedLimit
	// drives the T7 dynamic throttle; GlobalDeviceLimit / ConnLimit are pushed to
	// the shared limiter before AddNode; Cert feeds the T10 inbound TLS build.
	AutoSpeedLimitConfig AutoSpeedLimitConfig `mapstructure:"AutoSpeedLimitConfig"` // T7 dynamic speed limit
	ConnLimitConfig      ConnLimitConfig      `mapstructure:"ConnLimitConfig"`      // per-user concurrent conns
	CertConfig           CertConfig           `mapstructure:"CertConfig"`           // T10 cert automation
}

type LogConfig struct {
	Level      string `mapstructure:"Level"`
	AccessPath string `mapstructure:"AccessPath"`
	ErrorPath  string `mapstructure:"ErrorPath"`
	// Timezone stamps the access log. Empty = the machine's local time.
	// Accepts a fixed offset ("+08:00") or an IANA name ("Asia/Shanghai");
	// the offset form always works, the name needs system tzdata.
	Timezone string `mapstructure:"Timezone"`
}

type NodeConfig struct {
	PanelType        string           `mapstructure:"PanelType"`
	ApiConfig        api.Config       `mapstructure:"ApiConfig"`
	ControllerConfig ControllerConfig `mapstructure:"ControllerConfig"`
}

type Panel struct {
	// contains filtered or unexported fields
}

type RealityConfig struct {
	Show             bool     `mapstructure:"Show"`
	Dest             string   `mapstructure:"Dest"`
	ProxyProtocolVer uint64   `mapstructure:"ProxyProtocolVer"`
	ServerNames      []string `mapstructure:"ServerNames"`
	PrivateKey       string   `mapstructure:"PrivateKey"`
	MinClientVer     string   `mapstructure:"MinClientVer"`
	MaxClientVer     string   `mapstructure:"MaxClientVer"`
	MaxTimeDiff      uint64   `mapstructure:"MaxTimeDiff"`
	ShortIds         []string `mapstructure:"ShortIds"`
}

type Service interface {
	Start() error
	Close() error
}