server

type AgentOptions struct {
	Hub *agentlink.Hub
	CA  *pki.CA
	// ListenPort is the port of the mTLS agent listener, used to build the connect URL.
	ListenPort string
	// ConnectURL overrides the URL agents connect to (wss://host:port/api/agent/v1/connect).
	ConnectURL string
	// PublicURL is the panel's public base URL, used in the join command shown to admins.
	PublicURL string
	// AgentVersion is the agent release used in the install command (default DefaultAgentVersion).
	AgentVersion string
}

type ConsoleMessage struct {
	Type    string          `json:"type"`
	Data    json.RawMessage `json:"data,omitempty"`
	Command string          `json:"command,omitempty"`
	Message string          `json:"message,omitempty"`
}

type ExtensionPolicy struct {
	AllowUnsigned bool         `json:"allow_unsigned"`
	TrustedKeys   []TrustedKey `json:"trusted_keys"`
}

type GatewayOptions struct {
	StripeBaseURL string
	PayPalBaseURL string
	Client        *http.Client
}

type JoinResponse struct {
	NodeID      string `json:"node_id"`
	Certificate string `json:"certificate"`
	CA          string `json:"ca"`
	ConnectURL  string `json:"connect_url"`
	ServerName  string `json:"server_name"`
}

type NewWebsiteInput struct {
	OwnerID      string `json:"owner_id"`
	OwnerEmail   string `json:"owner_email"`
	NodeID       string `json:"node_id"`
	Name         string `json:"name"`
	Domain       string `json:"domain"`
	TLS          string `json:"tls"`
	PHPVersion   string `json:"php_version"`
	DiskMB       int    `json:"disk_mb"`
	MemoryMB     int    `json:"memory_mb"`
	CPUPercent   int    `json:"cpu_percent"`
	Processes    int    `json:"processes"`
	MaxDomains   int    `json:"max_domains"`
	MaxDatabases int    `json:"max_databases"`
}

type Options struct {
	Version string
	// UI serves the embedded web app for every non-API path. Optional.
	UI http.Handler
	// Store is the database. When nil, database-backed routes (auth, blueprints) answer 503.
	Store  *store.Store
	Logger *slog.Logger
	// SecureCookies marks the session cookie Secure (HTTPS only). Disable only for local HTTP development.
	SecureCookies bool
	// Agent enables node management and agent joining. Requires Store.
	Agent *AgentOptions
	// EggHosts are the hosts eggs may be imported from by URL (default DefaultEggHosts).
	EggHosts []string
	// EggClient replaces the egg download client (tests).
	EggClient *http.Client
	// Gateways overrides payment provider endpoints (tests).
	Gateways GatewayOptions
	// ExtensionsAllowPrivate lets extension HTTP reach private addresses (tests only).
	ExtensionsAllowPrivate bool
	// Mailer replaces SMTP delivery (tests).
	Mailer mail.Sender
	// DNS replaces the configured DNS provider (tests).
	DNS dns.Provider
	// MailHost replaces the configured mail server (tests).
	MailHost mailhost.Server
	// TrustedProxies are reverse proxies whose X-Forwarded-For is believed (client IP for
	// rate limits and sessions). Empty: the TCP peer is the client.
	TrustedProxies []netip.Prefix
	// Jobs, when set, runs the River job queue (billing) until the context ends.
	// Without it, paid invoices are processed inline and the billing tick does not run.
	Jobs context.Context
	// JobsStopped, when set, is closed once the job queue has stopped (or never started),
	// so the caller can close the database pool after it.
	JobsStopped chan<- struct{}
}

type ThemeTokens struct {
	Light  map[string]string `json:"light"`
	Dark   map[string]string `json:"dark"`
	Fonts  map[string]string `json:"fonts"`  // sans, mono
	Radius map[string]int    `json:"radius"` // card, control (px)
}

type TrustedKey struct {
	Name string `json:"name"`
	Key  string `json:"key"` // base64 ed25519 public key
}