embedded

type BootError struct{ Err error }

type Options struct {
	// DataDir is the server's data root (Context.getFilesDir() on
	// Android, the app container on iOS). Required.
	DataDir string
	// ListenAddr is the loopback listen address; "127.0.0.1:0" lets the
	// OS pick a free port (read it back with Address()).
	ListenAddr string
	// NodeconfYAML is the any-sync network config contents (staging/prod
	// yml). Required — there is no filesystem fallback on this path.
	NodeconfYAML string
	// PushPeerId is the push node's peer id. The push node is a
	// direct out-of-band peer, deliberately NOT part of NodeconfYAML —
	// but it pairs with the nodeconf choice (staging vs prod), so the
	// host supplies both from the same place. Empty = push stays off
	// (every /v1/push endpoint returns 409 push.disabled).
	PushPeerId string
	// PushAddrs are the push node's dial addresses, comma-separated —
	// the same format ANY_PUSH_ADDRS parses, e.g.
	// "quic://host:port" or "host:port,host2:port2". Push activates only
	// when both PushPeerId and PushAddrs are non-empty.
	PushAddrs string
	// GlobalP2PEnabled overrides the internet-wide p2p layer: an iroh
	// UDP endpoint, a permanent relay session, and a dialable ticket
	// published into the records of every space this account holds.
	// nil takes the same default the CLI gets — on when the host
	// supplied no NodeconfYAML, i.e. the production network. A host
	// that does not want the endpoint sets this to false; there is no
	// config file or env on this path, so this struct is the only way
	// to say so. Publishing a ticket is one-way (docs/30-global-p2p.md
	// § Advertising is a one-way door), so a host that is unsure
	// should decide before the first boot, not after.
	GlobalP2PEnabled *bool

	// Mode is the server ownership mode: "" / "standalone" (the account
	// resolves from the wallet on disk) or "managed" (the host states
	// the account over POST /v1/auth on every boot, keys never touch
	// disk, and logout / switch / shutdown are allowed behind
	// ControlToken). Fixed for the server's lifetime.
	Mode string
	// LocalDiscovery is p2p.localDiscovery: whether mDNS announce and
	// browse start with the engine. nil resolves per platform and mode
	// (config.LocalDiscoveryEnabled). An embedded host that owns a
	// Local Network permission flow passes false here rather than over
	// HTTP: a standalone server with an account on disk boots before the
	// listener is up, so a PUT /v1/local-discovery could not precede it.
	LocalDiscovery *bool
	// ControlToken gates the managed control operations (POST/DELETE
	// /v1/auth, POST /v1/shutdown, PUT /v1/local-discovery). Required
	// when Mode is "managed":
	// an in-process host has no stdout handshake to receive a minted
	// one, and without a token any other process on the device could
	// switch the account. Ignored in standalone.
	ControlToken string
}