server

type Server struct {
	// contains filtered or unexported fields
}

type ServerConfig struct {
	Address string

	// ScriptFile is the path to the setup script to run before serving.
	// Ignored when ScriptSource is set.
	ScriptFile string

	// ScriptSource is the setup script's content, for callers that already
	// hold it and have no file to point at — a script fetched from a plugin
	// scheme source, say, or one generated by the host. It takes precedence
	// over ScriptFile, so nothing has to be written to a temporary file.
	ScriptSource []byte

	// ScriptName labels ScriptSource in error messages and __file__. Defaults
	// to "<script>" when ScriptSource is set without it.
	ScriptName string

	LibDirs         []string
	Packages        []string       // Package (.zip) paths or URLs
	Bundle          *pack.Bundle   // The single app bundle to serve; when set the server runs in app-bundle mode
	LibBundles      []*pack.Bundle // Pre-opened library bundles (module providers only, no app behavior)
	Insecure        bool           // Allow self-signed HTTPS for package URLs
	CacheDir        string         // Override default OS cache dir for remote packages
	BearerToken     string
	AllowedPaths    []string            // Filesystem path restrictions (empty = no restrictions)
	NetworkPolicy   *netsecurity.Config // Script outbound network policy (nil = no restrictions)
	DisabledLibs    []string            // Built-in libraries to disable (empty = all enabled)
	PluginDirs      []string
	PluginManager   *scriptlingplugin.Manager
	MCPToolsDir     string // Empty means MCP disabled
	MCPResourcesDir string // Folder of resource .toml/.py pairs (empty = none)
	MCPPromptsDir   string // Folder of prompt .toml/.py pairs (empty = none)
	MCPExecTool     bool   // Enable code execution tool
	JSONRPC         bool   // Mount JSON-RPC over HTTP at /json-rpc
	KVStoragePath   string // Empty means in-memory KV store
	WebRoot         string // Directory to serve static files from (empty = disabled)
	SecretRegistry  *secretprovider.Registry
	DockerSock      string
	PodmanSock      string
	TLSCert         string
	TLSKey          string
	TLSGenerate     bool

	// ExtraLibs, if set, registers additional libraries on every evaluator
	// after the standard library set — the setup script and every json-rpc,
	// http, mcp and websocket request handler. Host applications use this to
	// expose their own libraries to served scripts.
	ExtraLibs func(*scriptling.Scriptling)

	// Argv holds extra CLI arguments (after --) to expose via sys.argv in
	// every evaluator. Set from cmd.GetArgs() in the server dispatch paths.
	Argv []string
	// MaxRequestBodyBytes caps how many bytes a request body may carry
	// (applies to every route). Zero means the default, DefaultMaxRequestBody.
	MaxRequestBodyBytes int64

	// WebSocketOrigins restricts which browser origins may upgrade: an
	// origin allowlist, "*" to allow every origin, or empty for the
	// same-origin default. Non-browser clients send no Origin header and
	// are always allowed.
	WebSocketOrigins []string
}