serverx

type App struct {
	// contains filtered or unexported fields
}

type AuditConfig struct {
	Enabled  bool
	Provider string
}

type BuildOption func(*buildOptions)

type Config struct {
	Name       string
	Version    string
	Deployment bootx.Deployment

	HTTP HTTPConfig
	GRPC GRPCConfig

	SystemRoutes SystemRoutesConfig
	Governance   bootx.GovernanceConfig

	// Downstreams are caller-side governance contracts. They are validated at
	// startup and should later be used by Kernel client factories.
	Downstreams []clientpolicyx.DownstreamPolicy

	Security SecurityConfig

	Database DatabaseConfig
}

type DatabaseConfig struct {
	Enabled   bool
	DBX       dbx.Config
	Migration migrationx.Config
}

type FileConfig struct {
	App struct {
		Name    string `json:"name" yaml:"name"`
		Version string `json:"version" yaml:"version"`
	} `json:"app" yaml:"app"`

	Deployment struct {
		Replicas int `json:"replicas" yaml:"replicas"`
	} `json:"deployment" yaml:"deployment"`

	Server struct {
		HTTP struct {
			Enabled bool   `json:"enabled" yaml:"enabled"`
			Address string `json:"address" yaml:"address"`
			Timeout string `json:"timeout" yaml:"timeout"`
		} `json:"http" yaml:"http"`
		GRPC struct {
			Enabled bool   `json:"enabled" yaml:"enabled"`
			Address string `json:"address" yaml:"address"`
			Timeout string `json:"timeout" yaml:"timeout"`
		} `json:"grpc" yaml:"grpc"`
	} `json:"server" yaml:"server"`

	SystemRoutes SystemRoutesFileConfig `json:"system_routes" yaml:"system_routes"`

	Database struct {
		Enabled            bool              `json:"enabled" yaml:"enabled"`
		Driver             string            `json:"driver" yaml:"driver"`
		DSN                string            `json:"dsn" yaml:"dsn"`
		AutoCreateDatabase bool              `json:"auto_create_database" yaml:"auto_create_database"`
		MaxOpenConns       int               `json:"max_open_conns" yaml:"max_open_conns"`
		MaxIdleConns       int               `json:"max_idle_conns" yaml:"max_idle_conns"`
		QueryTimeout       string            `json:"query_timeout" yaml:"query_timeout"`
		SlowQueryThreshold string            `json:"slow_query_threshold" yaml:"slow_query_threshold"`
		Debug              bool              `json:"debug" yaml:"debug"`
		DryRun             bool              `json:"dry_run" yaml:"dry_run"`
		Migration          migrationx.Config `json:"migration" yaml:"migration"`
	} `json:"database" yaml:"database"`

	Security struct {
		Authn struct {
			Provider string `json:"provider" yaml:"provider"`
			Required bool   `json:"required" yaml:"required"`
		} `json:"authn" yaml:"authn"`
		Authz struct {
			Provider string `json:"provider" yaml:"provider"`
			Required bool   `json:"required" yaml:"required"`
		} `json:"authz" yaml:"authz"`
		Audit struct {
			Enabled  bool   `json:"enabled" yaml:"enabled"`
			Provider string `json:"provider" yaml:"provider"`
		} `json:"audit" yaml:"audit"`
	} `json:"security" yaml:"security"`
}

type GRPCConfig struct {
	Enabled bool
	Address string
	Timeout time.Duration
}

type GatewayBinding struct {
	Module ServiceModule
	Client any
}

type HTTPConfig struct {
	Enabled bool
	Address string
	Timeout time.Duration
}

type Option func(*options)

type ProviderFactory interface {
	BuildAccessProviders(ctx context.Context, cfg Config) (accessx.Providers, error)
}

type ProviderRefConfig struct {
	Provider string
	Required bool
}

type RuntimeProviders struct {
	// Security is the preferred config-derived runtime produced by
	// securityx.NewRuntime. It supplies AuthnBoundary and SkipPolicyResolver while
	// leaving middleware order to serverx/autowire.
	Security *securityx.Runtime

	Access accessx.Providers

	// AccessGuard allows existing services that already own an accessx.Guard to
	// join the unified serverx/autowire path without rebuilding Providers.
	// Prefer Access for new code.
	AccessGuard *accessx.Guard

	// AccessResolver is normally generated from proto access policy. It maps a
	// request operation to an accessx.Check consumed by accessx.Guard.
	AccessResolver accessmw.Resolver

	// SkipPolicyResolver is an optional config-driven skip policy resolver.
	// securityx.Runtime normally supplies this from security.access. This field
	// is kept for tests and advanced overrides.
	SkipPolicyResolver accessmw.SkipPolicyResolver

	// RequestInfoResolver is normally generated from proto metadata. It fills
	// requestx.Info before authn/authz/audit/metrics run.
	RequestInfoResolver requestx.Resolver

	// Admission contains Kubernetes-apiserver-style mutating/validating hooks.
	Admission admissionx.Chain

	// CredentialExtractor allows gateways and services to choose bearer,
	// token, API key, or other extraction strategies.
	CredentialExtractor authnmw.CredentialExtractor
	AllowAnonymous      bool

	// AuthnBoundary is the explicit automatic authn wiring object. Prefer setting
	// Security to the result of securityx.NewRuntime so authn and access skip
	// policy come from the same config subtree.
	AuthnBoundary *securityx.AuthnBoundaryRuntime
}

type SecurityConfig struct {
	Authn ProviderRefConfig
	Authz ProviderRefConfig
	Audit AuditConfig
}

type ServiceBinding struct {
	Module         ServiceModule
	Implementation any
}

type ServiceCatalog struct {
	// contains filtered or unexported fields
}

type ServiceDeps struct {
	Config    Config
	DB        dbx.DB
	Data      any
	Providers accessx.Providers
}

type ServiceFactory func(ctx context.Context, deps ServiceDeps) (any, error)

type ServiceModule struct {
	Name string

	// GatewayManifest is generated from google.api.http + aisphere.access.v1.policy.
	GatewayManifest gatewayx.Manifest

	// RequestInfoResolver and AccessResolver are generated from proto service/RPC
	// metadata and access policy. Runtime code must not re-derive this from raw
	// path/method strings.
	RequestInfoResolver requestx.Resolver
	AccessResolver      accessmw.Resolver

	// RegisterGRPC registers the generated gRPC server against Kernel's managed
	// gRPC transport. The service implementation is passed as any because
	// generated code owns the concrete interface assertion.
	RegisterGRPC func(*transportgrpc.Server, any) error

	// RegisterHTTP registers generated HTTP/JSON routes against Kernel's managed
	// HTTP transport. Optional for services that only expose gRPC internally.
	RegisterHTTP func(*transporthttp.Server, any) error

	// RegisterGatewayInvokers registers generated Gateway -> gRPC operation
	// invokers. Gateways use this when linking compiled service clients.
	RegisterGatewayInvokers func(*gatewayx.InvokerRegistry, any) error

	// RegisterData is optional. Generated or hand-written data modules can use it
	// to construct repositories from Kernel-managed dbx.DB. Migrations remain SQL
	// files under migrations/; this hook is only for safe repo construction.
	RegisterData func(dbx.DB) (any, error)
}

type SystemRoutesConfig struct {
	Enabled bool
	Healthz bool
	Readyz  bool
	Version bool
	Metrics bool
}

type SystemRoutesFileConfig struct {
	Enabled bool `json:"enabled" yaml:"enabled"`
	Healthz bool `json:"healthz" yaml:"healthz"`
	Readyz  bool `json:"readyz" yaml:"readyz"`
	Version bool `json:"version" yaml:"version"`
	Metrics bool `json:"metrics" yaml:"metrics"`
}