server

type CORSOptions struct {
	// AllowedOrigins is the explicit list of origin strings allowed to
	// access the API. Special values:
	//   "*"     — allow any origin (NOT recommended with bearer auth).
	//   "null"  — allow Electron / file-based webviews that send Origin: null.
	AllowedOrigins []string
	// AllowedHeaders extends the default header allowlist; defaults already
	// include Authorization, Content-Type, Accept.
	AllowedHeaders []string
	// AllowedMethods extends the default method allowlist; defaults already
	// include GET, POST, OPTIONS.
	AllowedMethods []string
}

type Handler struct {
	// contains filtered or unexported fields
}

type Options struct {
	// Token, when non-empty, enables bearer-token authentication for all
	// routes except those in SkipAuthPaths.
	Token string
	// SkipAuthPaths is the set of request paths that bypass the bearer
	// check. When nil, defaults to ["/healthz"]; pass an explicit slice
	// (possibly empty) to override.
	SkipAuthPaths []string
	// CORS configures Cross-Origin Resource Sharing for Electron / webview
	// callers. Empty AllowedOrigins disables CORS handling entirely.
	CORS CORSOptions
	// Info supplies metadata returned by GET /v1/info. The AuthEnabled,
	// CORSEnabled and CORSOrigins fields are derived automatically from
	// the other Options fields; callers should leave them blank. Version,
	// ListenAddr, and StartedAt are caller-supplied.
	Info ServerInfo
	// ErrorLog receives full internal / upstream errors together with the
	// request_id returned to the client. Nil disables handler-level logging.
	ErrorLog io.Writer
	// DefaultMaxContextTokens fills enhancer.Request.Options.MaxContextTokens
	// when the request leaves it unset, so the operator-level budget
	// (OPENPE_MAX_CONTEXT_TOKENS) governs HTTP callers exactly like it
	// governs every hook path. Zero keeps the historical no-budget default.
	DefaultMaxContextTokens int
	// PromptTimeout limits the whole /v1/prompt-enhance handler. It sits
	// inside CORS/auth so synthesized timeout responses retain CORS headers.
	PromptTimeout time.Duration
}

type ServerInfo struct {
	Version     string    `json:"version,omitempty"`
	StartedAt   time.Time `json:"started_at"`
	ListenAddr  string    `json:"listen_addr,omitempty"`
	AuthEnabled bool      `json:"auth_enabled"`
	CORSEnabled bool      `json:"cors_enabled"`
	CORSOrigins []string  `json:"cors_origins,omitempty"`
}