sambox

type AgentBundle struct {
	Version string        `yaml:"version"`
	Agent   AgentIdentity `yaml:"agent"`
	Egress  BundleEgress  `yaml:"egress"`

	// Serves is the one mesh service this agent provides: itself, as an A2A
	// agent. The name is the platform's grant and the port is its contract
	// with the agent (like $PORT on a serverless runtime); the agent binds it
	// when ready, and everything else about serving -- capabilities, skills,
	// negotiation -- lives on the agent's own card, inside the A2A protocol.
	// Tools (mcp://) and models (inference://) are operator workloads declared
	// in a node's configuration, never agent ingress.
	Serves *BundleServes `yaml:"serves,omitempty"`
	// contains filtered or unexported fields
}

type AgentDialer struct {
	// Router classifies destinations. Required.
	Router *Router

	// SidecarSocket is the Unix socket of the sam-node this sandbox is attached
	// to. sam-box is the node's only consumer here: an agent never reaches the
	// socket, only the curated surface built on top of it (entrypoint.go).
	SidecarSocket string

	// AgentID is the principal this boundary serves, asserted to the node on
	// every request (api.HeaderSamAgent). Empty means the sandbox is
	// unidentified, and mesh policy sees only the node it came through.
	AgentID string

	// DialContext opens external destinations. Nil uses a plain net.Dialer;
	// tests and future egress interception replace it.
	DialContext func(ctx context.Context, network, address string) (net.Conn, error)
}

type AgentIdentity struct {
	// ID is the canonical mesh identifier, without the "agent:" prefix.
	ID string `yaml:"id"`

	// ExternalID is the platform's own identifier, kept verbatim: the
	// translation into ID is not always reversible, and an auditor needs the
	// value the platform actually issued. When credentials are verified, it is
	// also the subject the credential has to attest.
	ExternalID string `yaml:"external_id"`

	// Credential is the path to the credential the platform issued this
	// workload, such as a projected Kubernetes service-account token. It backs
	// the claim the rest of this file makes; see credential.go.
	Credential string `yaml:"credential"`
}

type BundleEgress struct {
	Allow []string `yaml:"allow"`
}

type BundleServes struct {
	Name string `yaml:"name"`
	Port int    `yaml:"port"`
}

type CA struct {
	CertBytes   []byte
	Certificate *x509.Certificate
	PrivateKey  *rsa.PrivateKey
}

type CapsuleStream struct {
	// contains filtered or unexported fields
}

type CertCache struct {
	// contains filtered or unexported fields
}

type ConnectServer struct {
	// Dialer is required.
	Dialer Dialer

	// Authenticate, when set, makes Proxy-Authorization Basic credentials the
	// only acceptable greeting: a client that offers none is answered 407
	// rather than silently downgraded to an anonymous flow.
	Authenticate func(Credentials) error
}

type Credentials struct {
	Username string
	Password string
}

type Destination struct {
	Name   string
	Port   uint16
	IsName bool

	// Network is "tcp" for a CONNECT tunnel and "udp" for a connect-udp
	// session. Empty means "tcp", so the zero value stays the common case.
	Network string
}

type Dialer interface {
	DialDestination(ctx context.Context, creds *Credentials, dst Destination) (net.Conn, error)
}

type DialerFunc func(ctx context.Context, creds *Credentials, dst Destination) (net.Conn, error)

type EgressPolicy struct {
	// contains filtered or unexported fields
}

type Gateway struct {
	CA              *CA
	CertCache       *CertCache
	SecretStore     map[string]SecretConfig
	Transport       http.RoundTripper
	InterceptorsDir string
	// contains filtered or unexported fields
}

type IngressManager struct {
	// ListenAddr is where this gateway's ingress listens, e.g.
	// "127.0.0.1:7080". It must be stable: the node's configuration names it
	// as the declared services' backend. Empty picks an ephemeral port,
	// which only tests can meaningfully consume via Addr.
	ListenAddr string

	// Serves is the bundle's contract: the agent's a2a service name and the
	// sandbox port it binds. An agent serves at most itself; tools and models
	// are operator workloads, not agent ingress.
	Serves BundleServes

	// AgentSocket is the sandbox's reverse channel: a Unix socket nano-init
	// listens on from inside the sandbox. It is how an isolated agent is
	// reached at all, because every sandbox has a network namespace of its own
	// and the gateway's 127.0.0.1 is therefore not the agent's. A pathname
	// socket crosses that boundary for the same reason the egress one does: it
	// is a filesystem object, and network namespaces do not apply to it.
	//
	// Empty means the agent shares this process's network namespace and can be
	// dialled directly, which is true of no sandboxed profile.
	AgentSocket string

	// AgentAddr resolves where the agent listens inside its sandbox. Setting it
	// overrides both of the above, which is how tests point the forwarder at a
	// server of their own.
	AgentAddr func(port int) string
	// contains filtered or unexported fields
}

type Route struct {
	Kind RouteKind

	// ServiceURI is the canonical mesh identity for RouteMeshService, e.g.
	// "inference://openrouter". It is the same string policy is written
	// against, so a routing decision and an authorization decision can never
	// disagree about what was asked for.
	ServiceURI string

	Destination Destination
}

type RouteKind int

type Router struct {
	// Egress is the allowlist for destinations outside the mesh. Nil denies
	// every external destination.
	Egress *EgressPolicy
}

type SecretConfig struct {
	Kind       SecretKind `yaml:"kind" json:"kind"`
	HeaderName string     `yaml:"header_name" json:"header_name"`
	Value      string     `yaml:"value" json:"value"`
}

type SecretKind string

type WorkloadVerifier struct {
	// contains filtered or unexported fields
}