api

type ResolvedAccessProfile struct {
	PrivateKey []byte
}

type ResolvedBackupCredential struct {
	AccessKeyID        string
	SecretAccessKey    string
	RepositoryPassword string
}

type ResolvedNodeOnboarding struct {
	OnboardingKey string
}

type ResponseMeta struct {
	RequestID string `json:"request_id,omitempty"`
	Timestamp string `json:"timestamp,omitempty"`
}

type Server struct {
	// contains filtered or unexported fields
}

type ServerConfig struct {
	OwnerStepUpOrigin                 string // Explicit HTTPS origin of this server for local PocketID approval callbacks.
	Port                              int
	BaseDir                           string
	Version                           string
	GitCommit                         string
	APIKey                            string   // If set, all non-health endpoints require X-API-Key header
	CORSOrigins                       []string // Allowed CORS origins; empty disables browser CORS, "*" allows wildcard
	RateLimit                         int      // Max requests per IP per minute; 0 = no limit
	LogDir                            string   // Directory containing deploy log files (.stackkit/logs/)
	ServiceAuthSecret                 string
	ServiceAuthSecretNext             string
	StackActionMode                   string
	StackActionRestoreVerifierCommand string
	SetupActionMode                   string
	SetupAdminEmail                   string
	SetupAdminPassword                string
	SetupImmichURL                    string
	SetupHomeAssistantURL             string
	SetupPocketIDURL                  string
	SetupVaultwardenURL               string
	SetupCloudreveURL                 string
	FilesSessionBridgeToken           string
	MCPToken                          string
	MCPAllowWrite                     bool
	// ArchitectureV2ResolveConcurrency limits concurrent governed CUE
	// resolutions per server. Values <= 0 use the fail-safe default.
	ArchitectureV2ResolveConcurrency int
	StackActionReferenceResolver     StackActionReferenceResolver
	// TrustedProxies may provide X-Forwarded-For for rate-limit identity.
	// Empty means X-Forwarded-For is ignored.
	TrustedProxies []string
}

type StackActionReferenceResolver interface {
	ResolveAccessProfile(context.Context, stackaction.ScopedReference) (ResolvedAccessProfile, error)
	ResolveNodeOnboarding(context.Context, stackaction.ScopedReference) (ResolvedNodeOnboarding, error)
	ResolveBackupCredential(context.Context, stackaction.ScopedReference) (ResolvedBackupCredential, error)
}