server

type APIKey struct {
	Name      string   `yaml:"name"`
	Hash      string   `yaml:"hash"`                // SHA-256 hex of the plaintext key
	Projects  []string `yaml:"projects"`            // empty = all projects
	Scope     string   `yaml:"scope,omitempty"`     // "admin", "worker", or "" (default = admin)
	WorkerID  string   `yaml:"worker_id,omitempty"` // required when scope=worker
	CreatedAt string   `yaml:"created_at"`          // RFC3339
}

type APIRegistrar interface {
	RegisterRoutes(mux *http.ServeMux)
}

type Config struct {
	Addr               string           // listen address, e.g. ":8080"
	AuthToken          string           //nolint:gosec // G117: config field, not a hardcoded secret
	KeyStore           *KeyStore        // YAML-backed API key store (may be nil)
	SessionFile        string           // optional path for persistent session storage (survive restarts)
	MCPHandler         http.Handler     // optional MCP protocol handler; nil keeps the 501 placeholder
	APIHandler         APIRegistrar     // optional REST API handler; nil keeps the 501 placeholder
	PressureProvider   PressureProvider // optional; /healthz omits pressure field when nil
	CFAccessTeamDomain string           // Cloudflare Access team domain; empty = CF auto-login disabled
}

type Hub struct {
	// contains filtered or unexported fields
}

type KeyStore struct {
	// contains filtered or unexported fields
}

type PressureProvider interface {
	Pressure() string
}

type Server struct {
	// contains filtered or unexported fields
}

type Session struct {
	ID        string    `json:"id"`
	CreatedAt time.Time `json:"created_at"`
	ExpiresAt time.Time `json:"expires_at"`
}

type SessionManager struct {
	// contains filtered or unexported fields
}