server

type AuthConfig struct {
	JWTSecret   string // Required for login when UserStore is set
	AllowSignup bool   // Open POST /api/otp/request to self-registration; closed by default
	CORSOrigin  string // If set, enable CORS with this origin (e.g. "http://localhost:5173")
	// PublicBaseURL is the externally reachable origin at which people open
	// BuildMax. Artifact share links are rendered against it; empty refuses
	// share creation rather than emitting an unreachable link.
	PublicBaseURL    string
	QuotaService     *quota.Service // Optional; when set, create chat/run enforce quota and return 429 when exceeded
	DefaultQuotaTier string         // Default quota tier for new users (e.g. signup); used when calling CreateUser
	// Token lifetimes; zero means the default in internal/core/identity.
	AccessTokenTTL       time.Duration
	RefreshTokenTTL      time.Duration
	RefreshRotationGrace time.Duration
}

type Config struct {
	Addr string // Public listen address (e.g. ":5678")
	// WorkerAddr is the internal worker-control listener address (e.g.
	// "127.0.0.1:5679"). Empty leaves the worker listener off, which is what a
	// test that only builds the public handler wants; the server binary always
	// sets it. The worker routes are registered on their own mux regardless, so
	// WorkerHandler is testable without opening a second socket. See
	// docs/design/worker-api-network-boundary.md.
	WorkerAddr string
	// WorkerTLS is the worker listener's TLS configuration. Nil serves plain
	// HTTP, which is a development-only mode; production sets the server
	// certificate and, for native mTLS, the client CA. The public listener has
	// no TLS field because TLS terminates at the Ingress in front of it.
	WorkerTLS *tls.Config
	Auth      AuthConfig
	Stores    StoresConfig
	Services  ServicesConfig
	Storage   StorageConfig
	Worker    WorkerConfig
	Conv      ConversationConfig
	Webhook   WebhookConfig
	// Audit records sensitive actions. Nil discards them.
	Audit *audit.Recorder
	// Deployment describes this deployment for the admin system status.
	Deployment admin.DeploymentInfo
	// RedactedConfig is the operator-facing view of server.yaml. Nil means the
	// admin configuration route answers 503.
	RedactedConfig any
	// Readiness lists the dependency probes GET /readyz runs. Empty means the
	// endpoint reports ready without verifying anything, and says so by
	// returning an empty check list.
	Readiness []ReadinessCheck
}

type ConversationConfig struct {
	TitleGenerator           llm.TitleGenerator
	ConversationStore        coreconv.Store
	ConversationMessageStore coreconv.MessageStore
	ConversationLLMClient    llm.LLMClient
	// LLMGateway serves managed inference to authenticated clients. Nil leaves
	// the /llm routes answering 503.
	LLMGateway *llmgateway.Service
}

type ReadinessCheck struct {
	// Name appears in the response, so it must be safe to show an
	// unauthenticated caller: "database", not a DSN.
	Name  string
	Probe func(ctx context.Context) error
}

type Server struct {
	// contains filtered or unexported fields
}

type ServicesConfig struct {
	// Plugin publishes Marketplace releases and manages catalog entries. Nil
	// is a deployment with no Marketplace, which those routes report rather
	// than serving an empty catalog.
	Plugin *pluginsvc.Service
	// Secret backs the Space Secret management routes. Nil when no KEK file is
	// configured; those routes then report the feature off.
	Secret *secretsvc.Service
}

type ShutdownBudget struct {
	// Workers is how long in-flight runs have to stop and report. It is the
	// largest share because it is the only phase that waits on another process.
	Workers time.Duration
	// Streams is how long watcher streams have to notice the drain and return.
	// They are selecting on a closed channel, so this is generous already.
	Streams time.Duration
	// Requests is how long ordinary in-flight requests have to finish.
	Requests time.Duration
	// Background is how long the background loops have to end their current
	// pass.
	Background time.Duration
}

type StorageConfig struct {
	PersistStorage   blob.PersistStorage
	RunOutputStorage blob.RunOutputStorage
	// ArtifactStorage holds artifact content. It is separate from
	// RunOutputStorage because they are different key spaces with different
	// lifetimes, not two names for one bucket.
	ArtifactStorage artifactsvc.ContentStore
	// MaxArtifactBytes caps one artifact. Zero uses the service default.
	MaxArtifactBytes int64
	// ArtifactShareTTL bounds a public share link's lifetime. Zero uses the
	// service default.
	ArtifactShareTTL time.Duration
	WorkspacesDir    string // Overrides config.WorkspacesDir() for workspace file operations
}

type StoresConfig struct {
	UserStore           coreidentity.UserStore
	LoginCodeStore      coreidentity.LoginCodeStore
	PasswordStore       coreidentity.PasswordStore
	RefreshTokenStore   coreidentity.RefreshTokenStore
	SpaceStore          corespace.Store
	WorkflowStore       coreworkflow.Store
	AgentStore          agentdef.Store
	IssueStore          coreissue.Store
	IssueCommentStore   coreissue.CommentStore
	TaskStore           coretask.Store
	TaskRunStore        coretask.RunStore
	LLMCallStore        coregw.CallStore
	RunOutputLister     workroutes.RunOutputLister
	UserWebhookKeyStore coreidentity.UserWebhookKeyStore
	AuditStore          coreaudit.Store
	SystemGrantStore    coreidentity.SystemGrantStore
	SchemaStore         coreschema.Store
	LLMModelStore       coregw.ModelStore
	// ArtifactStore records durable files. Nil leaves the artifact routes
	// answering 503, which is what a deployment with no database has.
	ArtifactStore coreartifact.Store
	// ArtifactShareStore persists public share links. Nil leaves sharing off
	// while artifacts otherwise work.
	ArtifactShareStore coreartifact.ShareStore
	// SecretStore is the Space Secret store. Nil disables the secret feature.
	SecretStore coresecret.Store
}

type WebhookConfig struct {
	MessagePath string // JSON path for message in body (default "message")
	UserID      string // CreatedBy for webhook runs (default "webhook")
}

type WorkerConfig struct {
	// LLM tells a worker how to reach a model. Nil means direct.
	LLM *workerclient.TaskRunLLM
}