server

type APIServer struct {
	// contains filtered or unexported fields
}

type AuthInfo struct {
	SubjectID string
	// SubjectType is "user" | "service"; carried so authorization errors can
	// name the kind of identity that was denied (useful for debugging CI
	// service-account tokens).
	SubjectType string
}

type Option func(*Options)

type Options struct {
	// Server addresses
	GRPCAddr string
	HTTPAddr string

	// TLS configuration
	EnableTLS   bool
	TLSCertFile string
	TLSKeyFile  string

	// Authentication (token-only)
	EnableAuth bool

	// Logging
	Logger log.Logger

	// State store
	Store store.Store

	// Runner manager
	RunnerManager *manager.RunnerManager

	// Orchestrator
	Orchestrator orchestrator.Orchestrator

	// ExtraGRPCRegistrars are invoked during gRPC server startup to
	// register additional services beyond the built-in set. Used by
	// runed to plug in WatchService (RUNE-028) without forcing the
	// API server to depend on every networking-layer package.
	ExtraGRPCRegistrars []func(grpc.ServiceRegistrar)

	// NetworkStatusProvider, if set, is wired into AdminService so
	// the NetworkStatus RPC can report ClusterNetwork CIDR + VIP
	// allocations. Supplied by runed alongside the VIP allocator
	// (RUNE-040).
	NetworkStatusProvider service.NetworkStatusProvider

	// VIPAllocator, if set, is plugged into ServiceService so each
	// CreateService call assigns a stable VIP from the pool.
	// Supplied by runed at startup.
	VIPAllocator service.VIPAllocator

	// StorageDriverConfigs is the per-driver opaque configuration
	// map (driver name → key/value) passed to the orchestrator when
	// the server constructs one itself (i.e. when WithOrchestrator
	// was not used). Sourced from the runefile [storage.drivers]
	// table by runed. Nil-safe — drivers fall back to their own
	// defaults.
	StorageDriverConfigs map[string]map[string]any

	// StorageDefaultStorageClass mirrors the runefile [storage].
	// defaultStorageClass knob. *string so empty-string ("no cluster
	// default") is distinguishable from unset.
	StorageDefaultStorageClass *string

	// StorageSecretLookup resolves `secret:...` references inside
	// StorageClass / Volume parameters before they reach the storage
	// drivers. Wired by cmd/runed against the store-backed SecretRepo.
	// See RUNE-200 PR 3 / pkg/storage/driverparams.
	StorageSecretLookup driverparams.SecretLookup

	// StoragePreserveOnDelete mirrors the runefile [storage].
	// preserveOnDelete knob. When true the local driver treats
	// ReclaimPolicy:delete as retain.
	StoragePreserveOnDelete bool

	// InitialMountResolver, if set, is installed on the instance
	// controller before the orchestrator's first reconcile tick. Lets
	// cmd/runed pre-seed a never-ready stub so the production window
	// between orchestrator start and agent.volumes registering the
	// real resolver returns transient "not yet mounted" errors instead
	// of falling back to Volume.Handle.
	InitialMountResolver controllers.MountResolver

	// EventLog is the persisted resource event log (RUNE-126 Phase 2).
	// When set, the orchestrator wires it into the instance and volume
	// controllers so status transitions surface in `rune describe`.
	// Nil disables emission.
	EventLog events.EventLog

	// ObserveStore is the native observability (RuneSight) log store
	// selected by the runefile [observability] block. When set, the
	// ObserveService serves history queries and the agent forwarder's
	// in-process ingest path writes to it. Nil means observability is
	// disabled — ObserveService still registers but reports enabled=false
	// so `rune logs` falls back to the live ephemeral stream. Wired by
	// cmd/runed via WithObserveStore.
	ObserveStore observe.LogStore

	// UI configures the embedded dashboard and the HTTP serving layer it
	// rides on (RUNE-200). When UI.Enabled is false the HTTP server is not
	// started at all. Zero value disables the UI; runed populates this from
	// the runefile [ui] block via WithUI.
	UI UIOptions

	// Session tunes RUNE-201 refresh/access lifetimes. Zero fields fall back to
	// the session package defaults.
	Session SessionOptions
}

type SessionOptions struct {
	AccessTTL   time.Duration // short-lived access token lifetime (default 15m)
	RefreshTTL  time.Duration // sliding refresh idle window (default 30d)
	GraceWindow time.Duration // concurrent-refresh grace (default 30s)
}

type UIOptions struct {
	// Enabled starts the HTTP server (vanguard transcoder + /ui + handoff).
	Enabled bool
	// Path is the dashboard mount point (default "/ui").
	Path string
	// HandoffEnabled enables POST/GET /v1/ui/handoff/{code}.
	HandoffEnabled bool
	// HandoffTTL bounds a one-time handoff code's lifetime.
	HandoffTTL time.Duration
	// RequireTLS, when set with EnableTLS=false, binds the HTTP server to
	// loopback only and logs a warning instead of exposing bearer-token
	// traffic on the wire.
	RequireTLS bool
}