runtimebundle

type AccountingRecoveryStore interface {
	GetAccountingRecoverySnapshot(context.Context) (billing.AccountingRecoverySnapshot, error)
}

type AuthOptions struct {
	// HTTPAuthProviders runs in [internal/stdhttp] before frontend decode (R4).
	// When nil, empty, or every entry is nil, [Build] composes providers from
	// validated config instead of using the override (so an accidental
	// []Provider{nil} slice cannot disable authentication). When at least one
	// entry is non-nil, [Build] uses a clone of this slice only: no config-derived
	// auth is applied. Custom binaries must supply an equivalent policy chain;
	// [cmd/lipstd] does not set this field unless you intentionally replace
	// transport auth at the composition root.
	HTTPAuthProviders []httpauth.Provider
	// AuthEventSink implements [auth.EventSink] when auth.event_delivery is
	// "custom". If set for other delivery modes, [Build] returns
	// [ErrAuthEventSinkDisallowed]. For default/disabled delivery the dispatcher
	// uses an internal slog sink or nil per config.
	AuthEventSink auth.EventSink
	// RemoteDecider is required when the effective auth handler is remote or
	// required_level is api_key_sso. The OSS standard binary does not construct
	// remote transports; inject at the composition root.
	RemoteDecider auth.RemoteDecider
	// OSIdentity supplies OS principal material for local_noop. When nil, [Build]
	// uses the default infra
	// [github.com/matdev83/go-llm-interactive-proxy/internal/infra/osidentity]
	// provider.
	OSIdentity auth.OSIdentityProvider
	// AuthErrorRenderer is optional terminal HTTP mapping for auth failures; nil
	// uses stdhttp defaults.
	AuthErrorRenderer httpauth.AuthErrorRenderer
	// AuthErrorRenderersByFrontend optional per auth-wire-frontend-id renderers
	// (stdhttp/auth DefaultFrontendIDFromRequest vocabulary). Non-nil entries
	// override the same key from [PluginRegistry.AuthErrorRenderers] when [Build]
	// composes HTTP auth providers.
	AuthErrorRenderersByFrontend map[string]httpauth.AuthErrorRenderer
}

type BackendInstance struct {
	Backend execbackend.Backend
	// contains filtered or unexported fields
}

type BackendPreflightResult struct {
	Ready       bool
	Billable    bool
	Description string
}

type BackendStateIdentity struct {
	InstanceID   string
	FactoryKind  string
	ConfigDigest string
}

type BackgroundAuxScheduler = auxreq.BackgroundScheduler

type BootstrapApp = coreruntime.App

type BootstrapOptions = coreruntime.Options

type BuildHostInput struct {
	ConfigPath              string
	Mandatory               []lipsdk.Requirement
	LogWriter               io.Writer
	StreamRecoveryOverrides config.StreamRecoveryOverrides
	HandlerComposer         HandlerComposer
	Production              ProductionOptions
	EnforceMultiUserCLIGate bool
	MultiUser               *bool
	// RegistrySetup optionally configures plugins in reg before process services build.
	RegistrySetup func(reg *pluginreg.Registry) error
}

type BuildOptions struct {
	// PluginRegistry selects which bundled factories Build uses for backends.
	// Required; nil fails [Build]. Kept top-level because it is set by nearly
	// every call site.
	PluginRegistry *pluginreg.Registry
	// WireModel resolves default upstream model ids when computing the effective
	// default route selector. When nil, Build uses standardplugins.DefaultWireModel
	// (standard distribution).
	WireModel   config.WireModelForBackend
	Startup     StartupOptions
	Infra       InfraOptions
	Auth        AuthOptions
	Extensions  ExtensionsOptions
	Policy      PolicyOptions
	Diagnostics DiagnosticsOptions
	Testing     TestingOptions
	// Production holds first-class enterprise injection seams (requirement 12.4).
	// Unlike Testing, these are supported for closed modules via pkg/lipruntime.
	Production ProductionOptions
	// DiscoveredPlugins, when set, installs validated catalog exports onto
	// PluginRegistry before backend construction (Phase 4 discovery bridge).
	DiscoveredPlugins *DiscoveredPluginInstall
	// FeatureLifecycles are merged feature plugin lifecycles owned by the candidate
	// resource ledger in serve/compile paths (task 3.2). When non-empty, callers must
	// not also Start/Stop the same instances via runtime.App (singular ownership).
	// Inspect-only bootstrap may keep lifecycles on App instead.
	FeatureLifecycles []lipplugin.Lifecycle
	// FeaturePlanes carries the immutable frozen feature plane set compiled from
	// enabled feature bundles and host contributions.
	FeaturePlanes lipfeature.FrozenPlaneSet
	// ReplaceCandidateSurface, when true, replaces process FeatureLifecycles and
	// Extensions with this overlay's values even when nil/empty. Used by
	// [CompileGeneration] so a candidate that removes the last feature does not
	// reuse startup-merged lifecycles/extensions. Legacy [CompileCandidate]
	// callers leave this false (nil overlay fields mean "no override").
	// CorePorts carries minimal fixed consumer-owned core interfaces compiled by featurehost.
	CorePorts               featurehost.CorePorts
	ReplaceCandidateSurface bool
}

type CandidateFaultInject struct {
	After string // model|prepare|activate|handler|composer-clone|ledger-transfer
	Hook  func()
}

type CandidateHTTPCompile struct {
	// contains filtered or unexported fields
}

type CandidateOverlapSafe interface {
	SafeUnderCandidateOverlap() bool
}

type ClosePhase uint8

type ComposeBillingInput struct {
	Store                   billing.AuthoritativeBilling
	TerminalUsageSink       billing.TerminalUsageSink
	Catalog                 *billingcompose.SnapshotCatalog
	Identity                *runtimecore.BillingIdentity // nil => PrincipalSessionIdentity
	Currency                string
	ModelMaxOutput          billingadmission.ModelMaxOutput // required
	Strict                  bool
	ConservativeCeiling     *billing.Money
	ReportsPath             string
	MaintenanceAccounting   billing.ProviderMaintenanceUsageObserver
	PostTurnBatchSize       int
	MinPreRouteHeadroomNano int64
	// ObservationEconomicWorkBuilder optionally overrides the stock immutable
	// observation-to-work classifier. A nil value uses the catalog-bound stock
	// provider/customer builder.
	ObservationEconomicWorkBuilder billing.ObservationEconomicWorkBuilder
}

type DiagnosticsOptions struct {
	// SecureSessionStore is optional; when set on Built, stdhttp may mount
	// secure-session diagnostics.
	SecureSessionStore app.Store
}

type DialSessionFunc func(ctx context.Context, req DialSessionRequest) (ExecuteSession, backendplugin.ResolvedProfile, error)

type DialSessionRequest struct {
	Conn        net.Conn
	Peer        processhost.PeerIdentity
	Generation  uint64
	Secrets     backendplugin.SecretBundle
	ConfigYAML  []byte
	InstanceID  string
	FactoryKind string
	Policy      backendplugin.RuntimePolicy
}

type DiscoveredInstallOptions struct {
	DialSession   DialSessionFunc
	RuntimePolicy backendplugin.RuntimePolicy
}

type DiscoveredPluginInstall struct {
	Host    *processhost.Host
	Exports []ValidatedExport
	Options DiscoveredInstallOptions
	// Trusted holds every verified artifact bound to the shared staging root.
	// Exports reference the same pointers; the ownership holder must close all
	// of them before removing staging (Windows locks staged executables).
	Trusted []*trust.VerifiedArtifact
}

type ExecuteSession = adapter.ExecuteSession

type ExtensionsOptions struct{}

type FrozenRoutingView struct {
	DefaultRoute  string
	RoutePrefixes []string
}

type GenerationBundle struct {
	// contains filtered or unexported fields
}

type GenerationCompileInput struct {
	Process          *ProcessServices
	Bus              *hooks.Bus
	Candidate        *config.Config
	CandidateOpts    *BuildOptions
	Compose          HandlerComposer
	LiveFactoryKinds map[string]int
	FaultInject      CandidateFaultInject
	GenerationRunner *auxiliary.GenerationExecutorRunner
}

type GenerationCompiler struct {
	Process *ProcessServices
	Compose HandlerComposer
}

type GenerationRuntime interface {
	runtimehost.PublishedRequestPlane
	runtimehost.ExecutorProvider
	runtimehost.PublishedWorkStarter
	runtimehost.ModelViewBinder
	runtimehost.BackendFactoryKindCounter
	TerminalProviders() terminalworkapp.TerminalProviderView
	ReadinessReport() controlplane.ReadinessReportReader
}

type HandlerComposer func(ctx context.Context, cfg *config.Config, log *slog.Logger, in httpcontract.StandardHTTPInput) (http.Handler, error)

type Host struct {
	// contains filtered or unexported fields
}

type InfraOptions struct {
	// HTTPClient is the shared upstream HTTP client for backends that need
	// outbound HTTP (Bedrock, ACP). When nil, Build uses httpclient.Standard().
	HTTPClient *http.Client
	// OutboundTracing when true wraps the upstream transport with OpenTelemetry
	// HTTP propagation. When HTTPClient is non-nil, Build clones the client
	// before wrapping so caller-owned clients are not mutated.
	OutboundTracing bool
	// ProcessTracing carries an already-initialized process tracer shutdown handle
	// from BuildHost. ProcessServices retains it without owning Close (Host /
	// stdhttp remain the shutdown owners).
	ProcessTracing ProcessTracing
}

type InspectInput struct {
	ConfigPath              string
	Mandatory               []lipsdk.Requirement
	StreamRecoveryOverrides config.StreamRecoveryOverrides
}

type InspectPrepared struct {
	Config   *config.Config
	Registry *pluginreg.Registry
	// contains filtered or unexported fields
}

type OptionalBackendHooks struct {
	Start                 func(context.Context) error
	Stop                  func(context.Context) error
	CleanupIdleTransports func(context.Context) error
	PreflightCapability   func(context.Context) (BackendPreflightResult, error)
}

type PluginCatalogResolution struct {
	Discovered  []discovery.Descriptor
	TrustBySafe map[string]trust.VerifyResult
	Snapshot    catalog.Snapshot
	CatalogErr  error
	Installable []ValidatedExport
}

type PluginDoctorReport = diagnostics.DoctorReport

type PluginInspectReport = diagnostics.Report

type PolicyOptions struct {
	// PolicyObservers, when non-empty, are chained as the policy decision
	// evidence observer for the runtime snapshot. When nil/empty, the snapshot
	// uses a no-op observer so deployments without policy evidence keep current
	// request outcomes (requirements 7.6, 10.5).
	PolicyObservers []policydecision.Observer
	// PolicyTimeoutBudgetSource, when set, supplies decision-provider evaluation
	// budgets per stage/provider. When nil, the snapshot uses the default
	// zero-budget source so legacy extension behavior is unchanged
	// (requirements 6.3, 10.5).
	PolicyTimeoutBudgetSource extensions.TimeoutBudgetSource
	// PolicyDiagnosticsEnabled controls whether privileged-visibility policy
	// decision records may leave the core through the evidence emitter. Default
	// false withholds privileged records (requirement 7.4).
	PolicyDiagnosticsEnabled bool
}

type ProcessServices struct {
	Logger         *slog.Logger
	FactoryCatalog *pluginreg.Registry
	Tracing        ProcessTracing
	Metrics        *metrics.Bundle
	GeoIP          *geoip.Service
	// IngressDefense is the single process-lifetime bounded adaptive state for
	// ingress self-defense. It is sized once from the startup-fixed
	// max_entries/state_ttl, survives policy-only generation reloads, and is
	// disposed only with this ProcessServices. A generation borrows it and can
	// never close or resize it.
	IngressDefense     *ingressdefense.State
	DatabasePools      *db.PoolRegistry
	Continuity         b2bua.Store
	RouteOverrideStore routeoverride.Store
	SecureSessions     ssessionapp.Store
	DecodeAdmission    lipsdk.DecodeAdmission
	SpoolLedger        *largebody.SpoolLedger
	ALegLifecycle      *leglifecycle.Coordinator
	AffinityStore      affinity.Store
	CandidateHealth    policy.CandidateHealth
	ExtensionState     lipstate.Store
	MeteringRecorder   metering.Recorder
	UsageAuthority     *authorityapp.Service
	Concurrency        *concurrencyapp.Service
	SnapshotGeneration *snapshotgen.Publisher
	SnapshotController *SnapshotController
	MeteringQuerier    metering.Querier

	TerminalWorkProcessor *terminalworkapp.Processor
	TerminalWorkRegistry  *terminalworkapp.Registry
	TerminalWorkQueries   *terminalworkapp.QueryService
	TerminalWorkMetrics   *terminalworkapp.MetricsObserver
	BackgroundAux         *BackgroundAuxScheduler

	// StandardFeatures owns the single standard-distribution feature host handle (Task 2.3).
	StandardFeatures *featurehost.Runtime
	// contains filtered or unexported fields
}

type ProcessServicesInput struct {
	Cfg     *config.Config
	Log     *slog.Logger
	Opts    *BuildOptions
	Tracing ProcessTracing
	// HostEnv is a generic process-environment capability forwarded to the
	// standard feature host, which synthesizes the default env-derived host
	// binding from it when no explicit binding is registered. It names no
	// concrete feature and carries no feature semantics.
	HostEnv featurehost.HostEnvironment
	// PluginResourcePool, PluginHost, PluginArtifacts, and PluginStagingDir are
	// process-owned discovered-plugin resources. When set, NewProcessServices
	// takes sole ownership and disposes them once after generation retirement in
	// reverse acquisition order (pool → host → artifacts → staging), so pooled
	// physical cleanup can still use the live host and Windows releases staged
	// executable handles before staging removal.
	PluginResourcePool *backendResourcePool
	PluginHost         *processhost.Host
	PluginArtifacts    []*trust.VerifiedArtifact
	PluginStagingDir   string
	BackgroundAux      *BackgroundAuxScheduler // transferred and closed with process
}

type ProcessTracing struct {
	Shutdown func(context.Context) error
	Active   bool
}

type ProductionOptions struct {
	BillingTerminalUsageSink billing.TerminalUsageSink
	// BillingStore is the authoritative durable billing boundary used by runtime
	// and read-side report composition. It is intentionally a domain port.
	BillingStore       billing.AuthoritativeBilling
	BillingReports     billing.ReportingStore
	BillingReportsPath string
	BillingIdentity    runtimecore.BillingIdentity
	// BillingCallRatingResolver resolves immutable call/exposure snapshots and never consults authorization holds.
	BillingCallRatingResolver   billing.CallRatingResolver
	BillingProviderCostResolver billing.ProviderCostResolver
	// BillingEconomicRevisionRater drives pure revision valuation from the
	// durable evidence queue. It is intentionally separate from settlement and
	// provider-cost stores; nil keeps the optional worker disabled.
	BillingEconomicRevisionRater billing.PostUsageRater
	// BillingObservationEconomicWorkBuilder converts durable metering
	// observations into immutable customer/provider queue markers. It performs
	// no rating or money mutation; the process-owned relay invokes it after the
	// observation transaction commits.
	BillingObservationEconomicWorkBuilder billing.ObservationEconomicWorkBuilder
	BillingEconomicRevisionReconciler     billing.EconomicRevisionReconciler
	BillingCostPassThroughSettlementStore billing.CostPassThroughSettlementStore
	BillingCustomerUnitLedger             billing.CustomerUnitLedger
	// MaintenanceAccounting receives provider-authoritative maintenance usage on
	// behalf of background maintenance operations (such as prompt cache keepwarm).
	MaintenanceAccounting    billing.ProviderMaintenanceUsageObserver
	BillingPostTurnBatchSize int
	// BillingCreditGate is the required pre-route settled-credit screen for
	// authoritative billing. It is intentionally separate from detailed post-route
	// exposure admission.
	BillingCreditGate runtimecore.BillingCreditGate
	// BillingExposureAdmission is the authoritative post-route operational
	// exposure seam, normally constructed by ComposeBilling from BillingStore.
	BillingExposureAdmission runtimecore.BillingExposureAdmission
	MeteringRecorder         metering.Recorder
	// MeteringAccountWindowStore is the optional nonfinancial gauge query port
	// used by an explicitly configured provider quota policy. It is separate
	// from all billing and customer-unit seams.
	MeteringAccountWindowStore coremetering.AccountWindowStore
	RequestRegistrations       []authority.RequestRegistration
	AttemptRegistrations       []authority.AttemptRegistration
	ConcurrencyRegistration    *authority.ConcurrencyRegistration
	UsageSnapshotSource        economics.RuleSnapshotSource
	ConcurrencySnapshotSource  economics.RuleSnapshotSource
	RatingSnapshotSource       economics.RatingSnapshotSource
	EvidenceSink               authority.EvidenceSink
	MeteringQuerier            metering.Querier
	TrafficObservers           []traffic.Observer
	UsageObservers             []usage.Observer
	PolicyObservers            []policydecision.Observer
	// Terminal-work processor ownership (tasks 4.4–4.5). When TerminalWorkStore is
	// set, Build constructs processor/registry/intents, starts the processor, and
	// injects IntentService into the executor.
	//
	// EffectProviders are composed as: RequestRegistrations -> AuthorityRequestEffectProvider
	// adapters (by descriptor ID), then TerminalWorkProviders merged by ProviderID with
	// explicit entries overriding derived adapters for the same ID.
	TerminalWorkStore          terminalworkapp.RecoveryStore
	TerminalWorkProviders      []terminalworkapp.EffectProvider
	TerminalWorkOwnerID        string
	TerminalWorkClaimTTL       time.Duration
	TerminalWorkClaimLimit     int
	TerminalWorkGlobalMax      int
	TerminalWorkPerProviderMax int
	TerminalWorkTickInterval   time.Duration
	TerminalWorkRenewInterval  time.Duration
	// FeatureHostRegistrations carries startup-only host-feature bindings
	// (Task 8.3/8.4, Requirements 9.3-9.6).
	FeatureHostRegistrations []featurehost.Registration
}

type QuiescePhaseLifecycles interface {
	lipplugin.Lifecycle
	QuiescePhase() bool
}

type QuiescedStrictAdmission struct {
	// contains filtered or unexported fields
}

type ResourceLedger struct {
	// contains filtered or unexported fields
}

type RouteAlias struct {
	Pattern     string `json:"pattern"`
	Replacement string `json:"replacement"`
}

type RouteBackend struct {
	ID      string `json:"id"`
	Kind    string `json:"kind"`
	Enabled bool   `json:"enabled"`
}

type RoutesSnapshot struct {
	EffectiveDefaultRoute  string                      `json:"effective_default_route"`
	Backends               []RouteBackend              `json:"backends"`
	CompatibleBackends     []diag.CompatibleBackendRow `json:"compatible_backends,omitempty"`
	InstanceDiagnostics    []diag.InstanceDiagnostic   `json:"instance_diagnostics,omitempty"`
	OpenResponsesFrontends []diag.InstanceDiagnostic   `json:"openresponses_frontends,omitempty"`
	ModelAliases           []RouteAlias                `json:"model_aliases"`
	// CredentialPosture is derived from enabled backend factory ids only: all_local_stub when every
	// enabled backend uses factory kind local-stub; live_provider when any enabled backend is not
	// local-stub; no_enabled_backends when there are no enabled backend rows.
	CredentialPosture string `json:"credential_posture"`
}

type ShadowV2CaptureInput struct {
	StoreID             string
	MaxObservations     int
	EvidenceSink        billing.ShadowEvidenceSink
	WorkAppender        billing.EconomicRevisionWorkAppender
	ResultStore         billing.EconomicRevisionResultStore
	ReconciliationStore billing.EconomicRevisionReconciliationStore
	Rater               billing.PostUsageRater
	V1Settlement        billing.CallSettlementStore
}

type ShadowV2Handle struct {
	// contains filtered or unexported fields
}

type SnapshotController struct {
	// contains filtered or unexported fields
}

type StartupOptions struct {
	// StartupContext, when non-nil, is the parent context for bounded startup I/O
	// (e.g. Postgres open and schema migrate for continuity and secure-session
	// stores). When nil, Build uses [context.Background] as the parent. It is not
	// stored or used for per-request paths.
	StartupContext context.Context
}

type TerminalWorkReadiness struct {
	Configured            bool
	Running               bool
	UnresolvedProviderIDs []string
	StoreReady            bool
	// StoreError is deprecated and always empty; use ErrorCode.
	StoreError string
	// BacklogKnown is true only when MetricsObserver.Snapshot succeeded.
	BacklogKnown bool
	// Backlog is outstanding terminal-work count from MetricsObserver.
	Backlog int
	// ReconcilerPending is unique WorkIDs owned by the ambiguous-append reconciler.
	ReconcilerPending int
	// ErrorCode is an operator-safe code (never raw store/snapshot error text).
	ErrorCode string
}

type TestingOptions struct {
	// Clock overrides time sources for the executor and routing-health circuit
	// breaker. Tests only.
	Clock func() time.Time
	// ControlPlaneStoreOverride, when non-nil, replaces the configured
	// control-plane store. When the override implements interface{ Close() error },
	// that Close is used as the closer and is disposed by Build on every error
	// path exactly like the production store closer. Tests only; production
	// leaves this nil so the store is built from config.
	ControlPlaneStoreOverride controlplane.Store
	// AuthorityStoreOverride, when non-nil, replaces the configured usage-
	// authority store. Tests only; production leaves this nil.
	AuthorityStoreOverride authorityapp.StateStore
	// ConcurrencyLeaseStoreOverride, when non-nil, replaces the configured
	// concurrency lease store. Tests only; production leaves this nil.
	ConcurrencyLeaseStoreOverride concurrencyapp.LeaseStore
	// PostgresPoolOpener, when non-nil, is used by Build's PoolRegistry instead
	// of the default Postgres opener. Tests only; production leaves this nil.
	PostgresPoolOpener db.PoolOpener
	// SnapshotPublisherOverride, when non-nil, replaces the Build-constructed
	// policy/rating generation publisher (Phase 9.3). Tests only.
	SnapshotPublisherOverride *snapshotgen.Publisher
	// FeatureHostRegistrations carries startup-only host-feature bindings for tests.
	FeatureHostRegistrations []sdkfeaturehost.Registration
}

type ValidateDistributionInput struct {
	ConfigPath              string
	Mandatory               []lipsdk.Requirement
	StreamRecoveryOverrides config.StreamRecoveryOverrides
	Production              ProductionOptions
	HandlerComposer         HandlerComposer
}

type ValidateStructuralInput struct {
	ConfigPath              string
	Mandatory               []lipsdk.Requirement
	StreamRecoveryOverrides config.StreamRecoveryOverrides
}

type ValidatedExport struct {
	Kind        string
	Profile     pluginreg.BackendSecurityProfile
	ExecProfile lipsdk.BackendExecutionProfile
	Artifact    *trust.VerifiedArtifact
	Model       processhost.ProcessModel
	Sharing     processhost.SharingOptions
}