app

type App struct {
	// contains filtered or unexported fields
}

type Config struct {
	// AppConfig holds the loaded application configuration and raw provider data
	// produced by config.Load.
	AppConfig *config.LoadResult

	// Factory provides the ProviderFactory used to construct provider instances.
	Factory *providers.ProviderFactory

	// Extensions optionally carries registered gateway extensions (request
	// rewriters, middleware, routes). The registry is snapshotted here; later
	// registrations have no effect.
	Extensions *ext.Registry

	// DemoMode exposes a prominent dashboard warning for public demo instances.
	// It does not change persistence or security behavior.
	DemoMode bool

	// ProductName names the running distribution (for example "gomodel-pro")
	// and becomes the default OpenTelemetry service.name. Empty means
	// "gomodel".
	ProductName string

	// RequestReload asks the process to replace this generation with one built
	// from the configuration as it stands now, the reload SIGHUP triggers. It
	// must not block. The app calls it when a referenced secret other than a
	// provider API key rotates. Nil leaves such a change to a manual reload.
	RequestReload func(reason string)

	// Replaces is the serving generation a reload builds this one to replace,
	// nil at startup. A provider credential or MCP server it runs whose
	// stored secret references no longer resolve fails the build, so the
	// serving generation keeps running it instead of the reload dropping it.
	Replaces *App
}

type ReencryptOptions struct {
	// Config is the loaded configuration; its storage section and key
	// wrapper select the database and the key-encryption key.
	Config *config.LoadResult
	// Extensions supplies compiled-in plugins, whose schemas say which
	// guardrail config values are secret.
	Extensions *ext.Registry
	// RotateDataKey creates and activates a new data key first, so the pass
	// moves every value to it.
	RotateDataKey bool
}

type ReencryptResult struct {
	// ActiveKeyID is the data key every secret is now sealed with.
	ActiveKeyID string
	Reports     []encryption.Report
}