uplink

type AuthResult struct {
	PeerID       string
	RelayPeerID  string
	NetworkID    string
	SessionScope map[string]string
}

type Authenticator interface {
	ValidateClientHello(ctx context.Context, hello ClientHello) (*AuthResult, error)
}

type BackoffConfig struct {
	Initial time.Duration
	Max     time.Duration
	Factor  float64 // >= 1.0; multiplier applied after each failed attempt
}

type Client struct {
	// contains filtered or unexported fields
}

type ClientHello struct {
	Version     int    `json:"version"`
	NodeID      string `json:"node_id"`
	RelayPeerID string `json:"relay_peer_id"`
	NetworkID   string `json:"network_id,omitempty"`
	PublicKey   string `json:"public_key"` // client WireGuard public key (wgtypes base64)
	Timestamp   int64  `json:"timestamp"`
	Proof       string `json:"proof"` // base64 MAC proving possession of PublicKey's private key
}

type ClientOptions struct {
	// Addr is the uplink endpoint. Prefer a full URL:
	//   wss://gateway.example.com/uplink/v1
	// Legacy host:port is accepted and rewritten to wss://host:port/uplink/v1.
	Addr string
	// ServerName is TLS SNI (optional; derived from URL host when empty).
	ServerName string
	// TLSConfig configures TLS verification for wss:// dials.
	// Required for wss; ignored for plain ws:// (proxy-mode internal tests).
	TLSConfig        *tls.Config
	HelloFactory     func() (ClientHello, error)
	PacketHandler    func([]byte) error
	Logger           Logger
	Metrics          MetricsSink
	KeepAlivePeriod  time.Duration
	WriteTimeout     time.Duration
	ReconnectBackoff BackoffConfig
	MaxFrameSize     int
	PingInterval     time.Duration
	PongWait         time.Duration
	HandshakeTimeout time.Duration
}

type ClientState string

type Conn interface {
	// ReadFrame reads the next uplink protocol frame.
	ReadFrame(maxPayload uint32) (FrameHeader, []byte, error)
	// WriteFrame writes one uplink protocol frame.
	WriteFrame(h FrameHeader, payload []byte) error
	// Close closes the underlying transport.
	Close() error
	SetReadDeadline(t time.Time) error
	SetWriteDeadline(t time.Time) error
}

type FrameHeader struct {
	Version    uint8
	MsgType    uint8
	Flags      uint16
	SessionID  uint32
	PayloadLen uint32
}

type InMemoryRegistry struct {
	// contains filtered or unexported fields
}

type Logger interface {
	Debug(msg string, kv ...any)
	Info(msg string, kv ...any)
	Warn(msg string, kv ...any)
	Error(msg string, kv ...any)
}

type MetricsSink interface {
	IncCounter(name string, labels map[string]string)
	ObserveHistogram(name string, value float64, labels map[string]string)
	SetGauge(name string, value float64, labels map[string]string)
}

type PacketHandler interface {
	HandleInboundPacket(ctx context.Context, peerID string, pkt []byte) error
}

type Server struct {
	// contains filtered or unexported fields
}

type ServerOptions struct {
	ListenAddr string
	// TLSMode selects TLS termination. Empty defaults to TLSModeSelfSigned.
	TLSMode TLSMode
	// TLSConfig is required when TLSMode is selfsigned; ignored in proxy mode.
	TLSConfig       *tls.Config
	Authenticator   Authenticator
	PacketHandler   PacketHandler
	SessionRegistry SessionRegistry
	Logger          Logger
	Metrics         MetricsSink
	KeepAlivePeriod time.Duration // used for app MsgPing fallback / read idle
	WriteTimeout    time.Duration
	MaxFrameSize    int
	// PingInterval for WebSocket Ping control frames (default 25s).
	PingInterval time.Duration
	// PongWait is how long after a Ping to allow for a Pong / read idle slack
	// (default 60s). Effective read deadline is PingInterval+PongWait.
	PongWait time.Duration
}

type Session interface {
	PeerID() string
	State() SessionState
}

type SessionRegistry interface {
	Attach(peerID string, sess Session) error
	Get(peerID string) (Session, bool)
	Detach(peerID string)
}

type SessionState string

type TLSMode string

type WebSocketConn struct {
	// contains filtered or unexported fields
}