remote

type Attestation interface {
	Verify(meta map[string]string) error
}

type Authenticator interface {
	Authenticate(token string) error
}

type Bridge struct {
	// contains filtered or unexported fields
}

type BridgeOptions struct {
	// Server is the local daemon to drive (required).
	Server *daemon.Server
	// Authenticator verifies bearer tokens (required).
	Authenticator Authenticator
	// Attestation is an optional post-token hook; nil => no-op.
	Attestation Attestation
	// MinVersion is the lowest control-protocol version accepted; 0 =>
	// daemon.ProtoVersion.
	MinVersion int
	// MaxConnections bounds concurrent remote connections; 0 => default.
	MaxConnections int
	// HandshakeTimeout bounds the auth handshake; 0 => default.
	HandshakeTimeout time.Duration
	// AuthFailDelay slows brute-force attempts; <0 => none, 0 => default.
	AuthFailDelay time.Duration
	// BundleDir is the directory under which uploaded git bundles are extracted
	// into per-link working trees. Empty disables bundle uploads entirely (a
	// bundle-mode connection is then refused — opt-in, fail closed).
	BundleDir string
	// MaxBundleBytes caps a single uploaded bundle; 0 => default.
	MaxBundleBytes int64
	Log            func(string)
}

type RemoteConfig struct {
	// Address is host:port of the remote bridge (required).
	Address string
	// Token is the bearer token (required).
	Token string
	// CACertFile, when set, is the only CA trusted for the server cert (use for a
	// self-signed bridge). Empty => system roots. InsecureSkipVerify is never used.
	CACertFile string
	// ServerName overrides the TLS/SNI verification name; empty => host of Address.
	ServerName string
	// Timeout bounds the dial + auth handshake; 0 => default.
	Timeout time.Duration
}

type SessionLink struct {
	// Address is host:port of the remote bridge.
	Address string `json:"address"`
	// ServerName overrides TLS/SNI verification; empty => host of Address.
	ServerName string `json:"server_name,omitempty"`
	// CACertFile is the CA trusted for the bridge cert (for a self-signed bridge).
	CACertFile string `json:"ca_cert_file,omitempty"`
	// LinkID is the per-link identifier (a single path component on the remote).
	LinkID string `json:"link_id"`
	// RemotePath is the extracted working tree on the remote; use it as --cwd for
	// a remote run/attach against the linked repo.
	RemotePath string `json:"remote_path"`
	// BundleSHA256 is the hex SHA-256 of the uploaded bundle, for verification.
	BundleSHA256 string `json:"bundle_sha256,omitempty"`
}

type TokenAuthenticator struct {
	// contains filtered or unexported fields
}