{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "ClientConfig",
  "description": "Struct for the client configuration.\nThis struct contains the endpoint, origin, compression type, rate limit,\nTLS settings, keepalive settings, proxy settings, timeout settings, buffer size settings,\nheaders, and auth settings.\nThe client configuration can be converted to a transport channel via\n[`ClientConfig::to_channel`].",
  "type": "object",
  "properties": {
    "auth": {
      "description": "Auth configuration for outgoing RPCs.",
      "$ref": "#/$defs/AuthenticationConfig",
      "default": {
        "type": "none"
      }
    },
    "backoff": {
      "description": "Backoff retry configuration.",
      "$ref": "#/$defs/BackoffConfig",
      "default": {
        "base": 100,
        "factor": 1,
        "jitter": true,
        "max_attempts": 18446744073709551615,
        "max_delay": "1s",
        "type": "exponential"
      }
    },
    "buffer_size": {
      "description": "ReadBufferSize.",
      "type": [
        "integer",
        "null"
      ],
      "format": "uint",
      "minimum": 0
    },
    "compression": {
      "description": "Compression type - TODO(msardara): not implemented yet.",
      "anyOf": [
        {
          "$ref": "#/$defs/CompressionType"
        },
        {
          "type": "null"
        }
      ]
    },
    "connect_timeout": {
      "description": "Timeout for the connection.",
      "type": "string",
      "default": "0y"
    },
    "endpoint": {
      "description": "The target the client will connect to.\n\nThe transport protocol is inferred from the endpoint scheme:\n* `ws://`, `wss://`  → WebSocket (TLS when `wss`)\n* `http://`, `https://`, `unix://`, bare `host:port` → gRPC",
      "type": "string"
    },
    "headers": {
      "description": "The headers associated with gRPC requests.",
      "type": "object",
      "additionalProperties": {
        "type": "string"
      },
      "default": {}
    },
    "keepalive": {
      "description": "Keepalive parameters.",
      "anyOf": [
        {
          "$ref": "#/$defs/KeepaliveConfig"
        },
        {
          "type": "null"
        }
      ]
    },
    "link_id": {
      "description": "Link identifier for this connection, used during link negotiation.\nDefaults to a randomly generated UUID v4.",
      "type": "string",
      "default": "5809da77-44e1-4b56-b221-de07c3b641e9"
    },
    "metadata": {
      "description": "Arbitrary user-provided metadata.",
      "anyOf": [
        {
          "$ref": "#/$defs/MetadataMap"
        },
        {
          "type": "null"
        }
      ]
    },
    "origin": {
      "description": "Origin (HTTP Host authority override) for the client.",
      "type": [
        "string",
        "null"
      ]
    },
    "proxy": {
      "description": "HTTP Proxy configuration.",
      "$ref": "#/$defs/ProxyConfig",
      "default": {
        "headers": {},
        "password": null,
        "tls": {
          "ca_source": {
            "type": "none"
          },
          "include_system_ca_certs_pool": true,
          "insecure": false,
          "insecure_skip_verify": false,
          "reload_interval": null,
          "source": {
            "type": "none"
          },
          "tls_version": "tls1.3"
        },
        "url": null,
        "username": null
      }
    },
    "rate_limit": {
      "description": "Rate Limits",
      "type": [
        "string",
        "null"
      ]
    },
    "request_timeout": {
      "description": "Timeout per request.",
      "type": "string",
      "default": "0y"
    },
    "server_name": {
      "description": "Optional TLS SNI server name override. If set, this value is used for TLS\nserver name verification (SNI) instead of the host extracted from endpoint/origin.",
      "type": [
        "string",
        "null"
      ]
    },
    "tls": {
      "description": "TLS client configuration.",
      "$ref": "#/$defs/TlsClientConfig",
      "default": {
        "ca_source": {
          "type": "none"
        },
        "include_system_ca_certs_pool": true,
        "insecure": false,
        "insecure_skip_verify": false,
        "reload_interval": null,
        "source": {
          "type": "none"
        },
        "tls_version": "tls1.3"
      }
    }
  },
  "required": [
    "endpoint"
  ],
  "$defs": {
    "AlgorithmRepr": {
      "description": "Local enum used only for JSON Schema generation of the `algorithm` field.\nRemote schema representation of jsonwebtoken::Algorithm",
      "type": "string",
      "enum": [
        "HS256",
        "HS384",
        "HS512",
        "ES256",
        "ES384",
        "RS256",
        "RS384",
        "RS512",
        "PS256",
        "PS384",
        "PS512",
        "EdDSA"
      ]
    },
    "AuthenticationConfig": {
      "description": "Enum holding one configuration for the client.",
      "oneOf": [
        {
          "description": "Basic authentication configuration.",
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "const": "basic"
            }
          },
          "$ref": "#/$defs/Config",
          "required": [
            "type"
          ]
        },
        {
          "description": "Bearer authentication configuration.",
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "const": "static_jwt"
            }
          },
          "$ref": "#/$defs/Config2",
          "required": [
            "type"
          ]
        },
        {
          "description": "JWT authentication configuration.",
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "const": "jwt"
            }
          },
          "$ref": "#/$defs/Config3",
          "required": [
            "type"
          ]
        },
        {
          "description": "SPIRE/SPIFFE authentication configuration.",
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "const": "spire"
            }
          },
          "$ref": "#/$defs/SpireConfig",
          "required": [
            "type"
          ]
        },
        {
          "description": "None",
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "const": "none"
            }
          },
          "required": [
            "type"
          ]
        }
      ]
    },
    "BackoffConfig": {
      "description": "Enum holding one configuration for the client.",
      "oneOf": [
        {
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "const": "exponential"
            }
          },
          "$ref": "#/$defs/Config4",
          "required": [
            "type"
          ]
        },
        {
          "description": "FixedInterval backoff retry config.",
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "const": "fixed_interval"
            }
          },
          "$ref": "#/$defs/Config5",
          "required": [
            "type"
          ]
        }
      ]
    },
    "CaSource": {
      "oneOf": [
        {
          "type": "object",
          "properties": {
            "path": {
              "type": "string"
            },
            "type": {
              "type": "string",
              "const": "file"
            }
          },
          "required": [
            "type",
            "path"
          ]
        },
        {
          "type": "object",
          "properties": {
            "data": {
              "type": "string"
            },
            "type": {
              "type": "string",
              "const": "pem"
            }
          },
          "required": [
            "type",
            "data"
          ]
        },
        {
          "description": "SPIRE authentication configuration",
          "type": "object",
          "properties": {
            "jwt_audiences": {
              "description": "Audiences to request / verify for JWT SVIDs",
              "type": "array",
              "default": [
                "slim"
              ],
              "items": {
                "type": "string"
              }
            },
            "socket_path": {
              "description": "Path to the SPIFFE Workload API socket (None => use SPIFFE_ENDPOINT_SOCKET env var)",
              "type": [
                "string",
                "null"
              ]
            },
            "target_spiffe_id": {
              "description": "Optional target SPIFFE ID when requesting JWT SVIDs",
              "type": [
                "string",
                "null"
              ]
            },
            "trust_domains": {
              "description": "Optional trust domains override for X.509 bundle retrieval. If set,\n`get_x509_bundle()` uses this instead of deriving from the current SVID.",
              "type": "array",
              "default": [],
              "items": {
                "type": "string"
              }
            },
            "type": {
              "type": "string",
              "const": "spire"
            }
          },
          "required": [
            "type"
          ]
        },
        {
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "const": "none"
            }
          },
          "required": [
            "type"
          ]
        }
      ]
    },
    "Claims": {
      "type": "object",
      "properties": {
        "audience": {
          "description": "JWT audience",
          "type": [
            "array",
            "null"
          ],
          "items": {
            "type": "string"
          }
        },
        "custom_claims": {
          "anyOf": [
            {
              "$ref": "#/$defs/MetadataMap"
            },
            {
              "type": "null"
            }
          ],
          "default": null
        },
        "issuer": {
          "description": "JWT Issuer",
          "type": [
            "string",
            "null"
          ]
        },
        "subject": {
          "description": "JWT Subject",
          "type": [
            "string",
            "null"
          ]
        }
      }
    },
    "CompressionType": {
      "description": "CompressionType represents the supported compression types for gRPC messages.\nThe supported types are: Gzip, Zlib, Deflate, Snappy, Zstd, Lz4, None, and Empty.\nThe default type is None.",
      "type": "string",
      "enum": [
        "Gzip",
        "Zlib",
        "Deflate",
        "Snappy",
        "Zstd",
        "Lz4",
        "None",
        "Empty"
      ]
    },
    "Config": {
      "type": "object",
      "properties": {
        "password": {
          "description": "The password for the username.",
          "$ref": "#/$defs/OpaqueString"
        },
        "username": {
          "description": "The username the client will use to authenticate.",
          "type": "string"
        }
      },
      "required": [
        "username",
        "password"
      ]
    },
    "Config2": {
      "description": "JWT auth configuration object.",
      "type": "object",
      "properties": {
        "duration": {
          "description": "Duration used by the AddJwtLayer cache for re-fetching the token.\nThis duration bounds the \"validity\" window before re-reading from file.",
          "type": "string",
          "default": "1h"
        },
        "file": {
          "description": "Path to a file containing the token (auto-reloaded on change)",
          "type": "string"
        }
      },
      "required": [
        "file"
      ]
    },
    "Config3": {
      "type": "object",
      "properties": {
        "claims": {
          "description": "Claims",
          "$ref": "#/$defs/Claims",
          "default": {
            "audience": null,
            "custom_claims": null,
            "issuer": null,
            "subject": null
          }
        },
        "duration": {
          "description": "JWT Duration (will become exp: now() + duration)",
          "type": "string",
          "default": "1h"
        },
        "key": {
          "description": "One of: `encoding`, `decoding`, or `autoresolve`\nEncoding key is used for signing JWTs (client-side).\nDecoding key is used for verifying JWTs (server-side).\nAutoresolve is used to automatically resolve the key based on the claims.",
          "$ref": "#/$defs/JwtKey"
        }
      },
      "required": [
        "key"
      ]
    },
    "Config4": {
      "type": "object",
      "properties": {
        "base": {
          "type": "integer",
          "format": "uint64",
          "default": 100,
          "minimum": 0
        },
        "factor": {
          "type": "integer",
          "format": "uint64",
          "default": 1,
          "minimum": 0
        },
        "jitter": {
          "type": "boolean",
          "default": false
        },
        "max_attempts": {
          "type": "integer",
          "format": "uint",
          "default": 18446744073709551615,
          "minimum": 0
        },
        "max_delay": {
          "type": "string",
          "default": "1s"
        }
      }
    },
    "Config5": {
      "type": "object",
      "properties": {
        "interval": {
          "type": "string",
          "default": "1s"
        },
        "max_attempts": {
          "type": "integer",
          "format": "uint",
          "default": 18446744073709551615,
          "minimum": 0
        }
      }
    },
    "Duration": {
      "type": "object",
      "properties": {
        "nanos": {
          "type": "integer",
          "format": "uint32",
          "minimum": 0
        },
        "secs": {
          "type": "integer",
          "format": "uint64",
          "minimum": 0
        }
      },
      "required": [
        "secs",
        "nanos"
      ]
    },
    "JwtKey": {
      "oneOf": [
        {
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "const": "encoding"
            }
          },
          "$ref": "#/$defs/Key",
          "required": [
            "type"
          ]
        },
        {
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "const": "decoding"
            }
          },
          "$ref": "#/$defs/Key",
          "required": [
            "type"
          ]
        },
        {
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "const": "autoresolve"
            }
          },
          "required": [
            "type"
          ]
        }
      ]
    },
    "KeepaliveConfig": {
      "description": "Keepalive configuration for the client.\nThis struct contains the keepalive time for TCP and HTTP2,\nthe timeout duration for the keepalive, and whether to permit\nkeepalive without an active stream.",
      "type": "object",
      "properties": {
        "http2_keepalive": {
          "description": "The duration of the keepalive time for HTTP2",
          "type": "string",
          "default": "1m"
        },
        "keep_alive_while_idle": {
          "description": "Whether to permit keepalive without an active stream",
          "type": "boolean",
          "default": false
        },
        "tcp_keepalive": {
          "description": "The duration of the keepalive time for TCP",
          "type": "string",
          "default": "1m"
        },
        "timeout": {
          "description": "The timeout duration for the keepalive",
          "type": "string",
          "default": "10s"
        }
      }
    },
    "Key": {
      "description": "Represents a key",
      "type": "object",
      "properties": {
        "algorithm": {
          "description": "Algorithm used for signing the JWT",
          "$ref": "#/$defs/AlgorithmRepr"
        },
        "format": {
          "description": "Key format - PEM, JWK or JWKS",
          "$ref": "#/$defs/KeyFormat"
        },
        "key": {
          "description": "Encoded key or file path",
          "$ref": "#/$defs/KeyData"
        }
      },
      "required": [
        "algorithm",
        "format",
        "key"
      ]
    },
    "KeyData": {
      "description": "Enum representing key data types",
      "oneOf": [
        {
          "description": "String with encoded key(s)",
          "type": "object",
          "properties": {
            "data": {
              "type": "string"
            }
          },
          "additionalProperties": false,
          "required": [
            "data"
          ]
        },
        {
          "description": "File path to the key(s)",
          "type": "object",
          "properties": {
            "file": {
              "type": "string"
            }
          },
          "additionalProperties": false,
          "required": [
            "file"
          ]
        }
      ]
    },
    "KeyFormat": {
      "type": "string",
      "enum": [
        "pem",
        "jwk",
        "jwks"
      ]
    },
    "MetadataMap": {
      "description": "A generic metadata map. Newtype with a flattened map so that serde encodes\njust a JSON/YAML object and not an inner field name.",
      "type": "object",
      "additionalProperties": {
        "$ref": "#/$defs/MetadataValue"
      }
    },
    "MetadataValue": {
      "description": "A generic metadata value.\n\nSupported variants:\n- String\n- Bool\n- Number (serde_json::Number – can represent integer & floating point)\n- List (Vec<MetadataValue>)\n- Map (nested MetadataMap)",
      "anyOf": [
        {
          "type": "string"
        },
        {
          "type": "boolean"
        },
        {
          "type": "number"
        },
        {
          "type": "array",
          "items": {
            "$ref": "#/$defs/MetadataValue"
          }
        },
        {
          "$ref": "#/$defs/MetadataMap"
        }
      ]
    },
    "OpaqueString": {
      "type": "string"
    },
    "ProxyConfig": {
      "type": "object",
      "properties": {
        "headers": {
          "description": "Headers to send with proxy requests",
          "type": "object",
          "additionalProperties": {
            "type": "string"
          },
          "default": {}
        },
        "password": {
          "description": "Optional password for proxy authentication",
          "type": [
            "string",
            "null"
          ]
        },
        "tls": {
          "description": "TLS client configuration.",
          "$ref": "#/$defs/TlsClientConfig",
          "default": {
            "ca_source": {
              "type": "none"
            },
            "include_system_ca_certs_pool": true,
            "insecure": false,
            "insecure_skip_verify": false,
            "reload_interval": null,
            "source": {
              "type": "none"
            },
            "tls_version": "tls1.3"
          }
        },
        "url": {
          "description": "The HTTP proxy URL (e.g., \"http://proxy.example.com:8080\")\nIf empty, the system proxy settings will be used.",
          "type": [
            "string",
            "null"
          ]
        },
        "username": {
          "description": "Optional username for proxy authentication",
          "type": [
            "string",
            "null"
          ]
        }
      }
    },
    "SpireConfig": {
      "description": "SPIRE authentication configuration",
      "type": "object",
      "properties": {
        "jwt_audiences": {
          "description": "Audiences to request / verify for JWT SVIDs",
          "type": "array",
          "default": [
            "slim"
          ],
          "items": {
            "type": "string"
          }
        },
        "socket_path": {
          "description": "Path to the SPIFFE Workload API socket (None => use SPIFFE_ENDPOINT_SOCKET env var)",
          "type": [
            "string",
            "null"
          ]
        },
        "target_spiffe_id": {
          "description": "Optional target SPIFFE ID when requesting JWT SVIDs",
          "type": [
            "string",
            "null"
          ]
        },
        "trust_domains": {
          "description": "Optional trust domains override for X.509 bundle retrieval. If set,\n`get_x509_bundle()` uses this instead of deriving from the current SVID.",
          "type": "array",
          "default": [],
          "items": {
            "type": "string"
          }
        }
      }
    },
    "TlsClientConfig": {
      "type": "object",
      "properties": {
        "ca_source": {
          "$ref": "#/$defs/CaSource",
          "default": {
            "type": "none"
          }
        },
        "include_system_ca_certs_pool": {
          "description": "If true, also load system root CA certificates",
          "type": "boolean",
          "default": true
        },
        "insecure": {
          "description": "In gRPC and HTTP when set to true, this is used to disable the client transport security.\n(optional, default false)",
          "type": "boolean",
          "default": false
        },
        "insecure_skip_verify": {
          "description": "InsecureSkipVerify will enable TLS but not verify the server certificate.",
          "type": "boolean",
          "default": false
        },
        "reload_interval": {
          "anyOf": [
            {
              "$ref": "#/$defs/Duration"
            },
            {
              "type": "null"
            }
          ]
        },
        "source": {
          "$ref": "#/$defs/TlsSource",
          "default": {
            "type": "none"
          }
        },
        "tls_version": {
          "type": "string",
          "default": "tls1.3"
        }
      }
    },
    "TlsSource": {
      "oneOf": [
        {
          "type": "object",
          "properties": {
            "cert": {
              "type": "string"
            },
            "key": {
              "type": "string"
            },
            "type": {
              "type": "string",
              "const": "pem"
            }
          },
          "required": [
            "type",
            "cert",
            "key"
          ]
        },
        {
          "type": "object",
          "properties": {
            "cert": {
              "type": "string"
            },
            "key": {
              "type": "string"
            },
            "type": {
              "type": "string",
              "const": "file"
            }
          },
          "required": [
            "type",
            "cert",
            "key"
          ]
        },
        {
          "description": "SPIRE authentication configuration",
          "type": "object",
          "properties": {
            "jwt_audiences": {
              "description": "Audiences to request / verify for JWT SVIDs",
              "type": "array",
              "default": [
                "slim"
              ],
              "items": {
                "type": "string"
              }
            },
            "socket_path": {
              "description": "Path to the SPIFFE Workload API socket (None => use SPIFFE_ENDPOINT_SOCKET env var)",
              "type": [
                "string",
                "null"
              ]
            },
            "target_spiffe_id": {
              "description": "Optional target SPIFFE ID when requesting JWT SVIDs",
              "type": [
                "string",
                "null"
              ]
            },
            "trust_domains": {
              "description": "Optional trust domains override for X.509 bundle retrieval. If set,\n`get_x509_bundle()` uses this instead of deriving from the current SVID.",
              "type": "array",
              "default": [],
              "items": {
                "type": "string"
              }
            },
            "type": {
              "type": "string",
              "const": "spire"
            }
          },
          "required": [
            "type"
          ]
        },
        {
          "type": "object",
          "properties": {
            "type": {
              "type": "string",
              "const": "none"
            }
          },
          "required": [
            "type"
          ]
        }
      ]
    }
  }
}