server

type GitBackend struct {
	// contains filtered or unexported fields
}

type GitConfig struct {
	// Repos are the board's domains, primary first. Only the primary is
	// served for now.
	Repos []RepoSpec
	// Token is the push/fetch credential (HTTPS basic auth) for the
	// repositories that name none of their own; empty means an
	// unauthenticated transport (local file remotes, tests).
	Token string
	// App mints the server credential per repository from a GitHub App
	// installation instead of a static token: nothing to issue by hand,
	// nothing that quietly expires in a .env file. A repository that names
	// its own Token keeps it; the App covers the rest. GitHub only.
	App *forge.GitHubApp
	// Forge is the code host the repositories live on: it says how the
	// token travels over HTTPS (the basic-auth username differs per forge).
	// GitHub when nil.
	Forge forge.Forge
	// DataDir holds the clones (<DataDir>/repos/<name>).
	DataDir string
	// History is the background deepening horizon; zero disables it.
	History time.Duration
	// HistoryMax caps on-demand deepening — a card's log cut by the horizon
	// fetches back to the card's creation, but never further than this.
	// Zero means no on-demand deepening.
	HistoryMax time.Duration
	// SyncInterval is the fetch cadence; zero disables the ticker.
	SyncInterval time.Duration
	// UnpushedWarn is the age of the oldest unpushed commit that turns
	// health red; zero means 5 minutes.
	UnpushedWarn time.Duration
	Committer    gitstore.Identity
	// AuthorEmail is the author email template ("{login}" substituted);
	// empty means <login>@aeman.
	AuthorEmail string
}

type OAuthConfig struct {
	ClientID     string
	ClientSecret string
	// BaseURL is the public origin (e.g. https://aeman.example.com) used to
	// build the OAuth redirect URI.
	BaseURL string
	// Scopes is a space-separated OAuth scope list (defaults to the forge's).
	Scopes string
	// SessionFile, when set, persists the dynamic MCP client registry to this
	// path so registered clients survive restarts. GitHub tokens (sessions) are
	// written here only when SessionKey is set — encrypted — so without a key a
	// restart signs users out but leaks no credentials to disk.
	SessionFile string
	// SessionKey, when set, is a secret that encrypts the persisted sessions at
	// rest (AES-256-GCM, key = SHA-256 of this value). With it, sessions and
	// MCP tokens survive a restart; the on-disk file holds only ciphertext, so
	// a leak of the file alone (backup, stray volume) exposes no token. Empty =
	// sessions stay in memory only (signed out on restart).
	SessionKey string
}

type Options struct {
	// Addr is the listen address, e.g. "127.0.0.1:8765".
	Addr string
	// Version is reported to the frontend via /api/config.
	Version string
	// Logger receives structured logs; slog.Default() is used when nil.
	Logger *slog.Logger
	// Auth, when non-nil, enables OAuth multi-user mode: each visitor signs
	// in with the forge, and their own token decides which of the board's
	// repositories they may read and write.
	Auth *OAuthConfig
	// Git is the board's storage — its repositories (see gitmode.go). A
	// server without it serves no board; tests inject a service instead.
	Git *GitConfig
	// Forge is the code host behind the board — the identity provider,
	// the authority on repository access, the directory of names and
	// avatars, the git credential's dialect. GitHub when nil.
	Forge forge.Forge
	// CLI is where a single-user server reads its credential and the
	// person it belongs to — the environment, the OS keychain, or the
	// forge's own tool; the gh CLI when nil. Unused in OAuth mode.
	CLI forge.CLI
}

type RepoSpec struct {
	Name string
	URL  string
	// Token is this repository's own credential — a board may span two
	// organisations, and one token narrow enough for either cannot reach
	// both. Empty falls back to GitConfig.Token.
	Token string
}

type Server struct {
	// contains filtered or unexported fields
}