remote

type AuthRecord struct {
	// ServerURL is the remote klaus-gateway root (normalized).
	ServerURL string `yaml:"server_url"`
	// Issuer is the OAuth authorization server issuer URL (from discovery).
	Issuer string `yaml:"issuer"`
	// AccessToken is the current access token.
	AccessToken string `yaml:"access_token"`
	// TokenType is the token type, typically "Bearer".
	TokenType string `yaml:"token_type,omitempty"`
	// RefreshToken is used to mint a new access token without re-login.
	RefreshToken string `yaml:"refresh_token,omitempty"`
	// ExpiresAt is the absolute expiry time of AccessToken.
	ExpiresAt time.Time `yaml:"expires_at,omitempty"`
	// Scope is the scope granted for the access token, if reported.
	Scope string `yaml:"scope,omitempty"`
	// TokenEndpoint is the OAuth token endpoint (cached so refresh can
	// proceed without repeating discovery).
	TokenEndpoint string `yaml:"token_endpoint,omitempty"`
	// ClientID is the OAuth client identifier used during the original
	// authorization (typically the CIMD URL).
	ClientID string `yaml:"client_id,omitempty"`
}

type AuthStore struct {
	// contains filtered or unexported fields
}

type ErrReloginRequired struct {
	ServerURL string
	Reason    string
}

type LoginOptions struct {
	// ClientID is the OAuth client identifier; defaults to the public
	// CIMD URL (oauth.DefaultClientIDMetadataURL).
	ClientID string
	// Scopes is the space-separated scope string to request. Defaults
	// to "openid profile email groups offline_access".
	Scopes string
	// HTTPClient is used for the token exchange; defaults to
	// http.DefaultClient when nil.
	HTTPClient *http.Client
	// BrowserOpener opens the authorize URL in the user's browser.
	// Defaults to oauth.OpenBrowser.
	BrowserOpener func(string) error
}

type Target struct {
	// BaseURL is the gateway root, for example "https://gw.example.com".
	BaseURL string

	// Instance is the klaus instance name — becomes the `{instance}` path
	// segment in completions/MCP URLs.
	Instance string

	// BearerToken is attached as `Authorization: Bearer <token>` when set.
	BearerToken string

	// ChannelID (hostname) identifies the caller's machine.
	ChannelID string

	// UserID identifies the authenticated user (JWT `sub` or $USER).
	UserID string

	// ThreadID identifies the conversation/session (defaults to a stable
	// hash of the working directory when the user does not set --session).
	ThreadID string
}