server

type Config struct {
	Addr           string
	DevMode        bool
	Logger         *slog.Logger
	StaticFS       fs.FS // embedded web/dist files for production
	Version        string
	NotifyManager  *notify.Manager
	AgentManager   *agent.Manager
	GroupDMManager *agent.GroupDMManager
	// BlobStore is optional; when nil, /api/v1/blob/... routes are not
	// registered. Phase 3 wires it in cmd/kojo/main.go.
	BlobStore *blob.Store
	// MaxBlobPutBytes overrides the per-PUT body cap. 0 = use the
	// package default (256MB). Tests pass a small cap so they can
	// exercise the 413 path without allocating hundreds of megabytes.
	MaxBlobPutBytes int64
	// EventBus is the invalidation broadcaster. When non-nil, the server
	// registers `GET /api/v1/events` (WebSocket) and exposes
	// Server.PublishEvent for write handlers. When nil, both the route
	// and PublishEvent become no-ops.
	EventBus *eventbus.Bus
	// Store is the kv-backed handle the session.Manager uses for
	// runtime persistence (Phase 2c-2 slice 28). Pass nil to disable
	// session persistence — tests that exercise non-session routes
	// can leave it nil; the production wiring in cmd/kojo/main.go
	// always passes the AgentManager's *store.Store handle.
	Store *store.Store
	// PeerIdentity is the local peer's stable {device_id, pubkey,
	// privkey} (Phase G). When non-nil the server registers
	// /api/v1/peers and uses DeviceID to flag the "self" row in list
	// responses + reject self-deletion. Nil disables the entire peers
	// API (test wiring + builds where peer identity load failed).
	PeerIdentity *peer.Identity
	// RequireIfMatch enables the docs §3.5 transition: every write
	// path that supports optimistic concurrency refuses requests
	// without an If-Match header (428 Precondition Required) instead
	// of allowing the legacy "best-effort" pass-through. Off by
	// default — operators flip it once their clients have all caught
	// up. cmd/kojo/main.go reads $KOJO_REQUIRE_IF_MATCH=1 to set this.
	RequireIfMatch bool
	// PeerEvents is the in-memory pub/sub for peer_registry
	// status mutations (docs §3.10). When non-nil the server
	// registers /api/v1/peers/events and the registrar /
	// OfflineSweeper publish to it on every status change.
	// Nil disables the cross-peer push surface.
	PeerEvents *peer.EventBus
	// PeerPresence is the in-memory active-connection set the events
	// WS handler maintains and the OfflineSweeper consults. Optional;
	// when nil the handler still touches last_seen periodically (so
	// the sample-based aging path keeps working) but the sweeper has
	// no way to skip an active connection on a flaky uplink.
	PeerPresence *peer.Presence
	// PeerOnly switches the server into the daemon-mode shape used
	// by `kojo --peer`. The §3.7 device-switch slice promoted this
	// from "minimal peer surface" to a full peer: agent runtime,
	// agent-facing routes, sessions, files, git, the inter-peer
	// surface — all registered — that's how a switch
	// can land the agent CLI on this host. What stays Hub-only
	// and 404s on a peer:
	//   - peer-registry mutation (POST/PATCH/DELETE on
	//     /api/v1/peers): pairing is an operator workflow, not
	//     something an agent or peer drives.
	//   - static SPA / dev proxy: peer hosts have no Web UI.
	// The auth middleware chain stays the same — RolePeer requests
	// arriving over tsnet get stamped by TailnetIdentityMiddleware
	// (peer_registry hit) via ServeAuthTsnet, and the agent
	// loopback listener keeps its Bearer-based AuthMiddleware.
	PeerOnly bool

	// V0LegacyDir, when non-empty, enables the session store's v0
	// fallback: on kv miss + no v1-dir sessions.json, Load() reads
	// <V0LegacyDir>/sessions.json and mirrors it into kv so the v0
	// → v1 cutover can reattach live tmux panes. The v0 file is
	// never unlinked from this path (rollback + `kojo --clean v0`
	// territory). Empty disables v0 fallback — supply "" on --fresh
	// / pure new-install paths where v0 data must not leak in.
	// cmd/kojo/main.go fills this from configdir.V0Path() iff the
	// startup gate observed v1Complete=true (migration done).
	V0LegacyDir string
	// PendingSyncKEK is the 32-byte envelope key used to seal
	// per-op state in pendingAgentSyncs into kv so the raw
	// $KOJO_AGENT_TOKEN survives a daemon restart between
	// agent-sync and finalize. main.go threads in the same KEK
	// it loaded via secretcrypto.LoadOrCreateKEK for the peer
	// identity row. Nil disables persistence (in-memory map
	// only); a restart with a pending op forces the
	// orchestrator to re-run the whole switch.
	PendingSyncKEK []byte
	// Unsafe disables Tailscale identity verification. Every caller
	// is admitted as RolePeer on a peer daemon, or as RoleOwner on
	// the public Hub listener. Intended for LAN dev / docker / CI
	// deployments. cmd/kojo gates this on the --unsafe flag and
	// refuses to start when --unsafe is OFF but no NodeKeyResolver
	// is available (i.e. the operator forgot to opt in).
	Unsafe bool

	// RepoDir is the source checkout POST /api/v1/system/rebuild runs
	// `make build` in, then copies the built binary over
	// os.Executable() (in-place deploy). Empty disables the endpoint
	// (returns 409). cmd/kojo reads $KOJO_REPO_DIR to set this.
	RepoDir string
}

type Server struct {
	// contains filtered or unexported fields
}

type WSAttachmentMsg struct {
	Type        string                `json:"type"`
	Attachments []*session.Attachment `json:"attachments"`
}

type WSExitMsg struct {
	Type     string `json:"type"`
	ExitCode int    `json:"exitCode"`
	Live     bool   `json:"live"`
}

type WSInputMsg struct {
	Type string `json:"type"`
	Data string `json:"data"` // base64
}

type WSMessage struct {
	Type string          `json:"type"`
	Data json.RawMessage `json:"data,omitempty"`
}

type WSOutputMsg struct {
	Type string `json:"type"`
	Data string `json:"data"` // base64
}

type WSResizeMsg struct {
	Type string `json:"type"`
	Cols int    `json:"cols"`
	Rows int    `json:"rows"`
}

type WSScrollbackMsg struct {
	Type string `json:"type"`
	Data string `json:"data"` // base64
}

type WSYoloDebugMsg struct {
	Type string `json:"type"`
	Tail string `json:"tail"`
}