runtime

type AuthConfig struct {
	Type        string `json:"type" yaml:"type"`                                     // see Auth* constants
	TokenURL    string `json:"token_url,omitempty" yaml:"token_url,omitempty"`       // login / token endpoint
	RefreshURL  string `json:"refresh_url,omitempty" yaml:"refresh_url,omitempty"`   // defaults to TokenURL
	ContentType string `json:"content_type,omitempty" yaml:"content_type,omitempty"` // "form" | "json"

	// Secrets are ENV-VAR NAMES only — resolved from the environment at construction.
	UsernameEnv     string `json:"username_env,omitempty" yaml:"username_env,omitempty"`
	PasswordEnv     string `json:"password_env,omitempty" yaml:"password_env,omitempty"`
	ClientIDEnv     string `json:"client_id_env,omitempty" yaml:"client_id_env,omitempty"`
	ClientSecretEnv string `json:"client_secret_env,omitempty" yaml:"client_secret_env,omitempty"`
	AccessTokenEnv  string `json:"access_token_env,omitempty" yaml:"access_token_env,omitempty"`   // static
	RefreshTokenEnv string `json:"refresh_token_env,omitempty" yaml:"refresh_token_env,omitempty"` // static (optional)

	Scope string `json:"scope,omitempty" yaml:"scope,omitempty"`

	// Response field paths (dotted) for jwt_login / non-standard token responses.
	AccessTokenField  string `json:"access_token_field,omitempty" yaml:"access_token_field,omitempty"`
	RefreshTokenField string `json:"refresh_token_field,omitempty" yaml:"refresh_token_field,omitempty"`
	ExpiresInField    string `json:"expires_in_field,omitempty" yaml:"expires_in_field,omitempty"`

	// Injection target. Defaults: header "Authorization", scheme "Bearer".
	Header string `json:"header,omitempty" yaml:"header,omitempty"`
	Scheme string `json:"scheme,omitempty" yaml:"scheme,omitempty"`

	ExpiryMargin string `json:"expiry_margin,omitempty" yaml:"expiry_margin,omitempty"` // e.g. "30s"
}

type Credential struct {
	APIKey   string // apiKey value, or bearer token
	Username string // http basic
	Password string // http basic
}

type GraphQLExecutor struct {
	// contains filtered or unexported fields
}

type HTTPExecutor struct {
	// contains filtered or unexported fields
}

type Options struct {
	MaxRetries   int                 // retry count for 5xx/429 (default 2)
	Timeout      time.Duration       // per-request timeout (default 30s)
	Redact       func(string) string // applied to response text before return
	MaxBody      int64               // response read cap (default 4 MiB)
	ExtraHeaders map[string]string   // always-applied headers

	// Token auth (forged-API auth plan, Phase A). When TokenProvider is set, the
	// executor fetches a fresh bearer before each request and injects it
	// (superseding the static Credential bearer). On a 401, it calls
	// TokenRefresher once and retries the request a single extra time. Both come
	// from a runtime.TokenManager (TokenProvider=tm.Token, TokenRefresher=tm.Refresh).
	TokenProvider  func(context.Context) (string, error)
	TokenRefresher func(context.Context) (string, error)
	AuthHeader     string // injection header (default "Authorization")
	AuthScheme     string // injection scheme (default "Bearer"); "" ⇒ raw token
}

type PollResult struct {
	Frames  []string
	Dropped int    // frames lost to ring eviction since the previous poll
	Pending int    // frames still buffered after this poll (poll again now)
	Done    bool   // the stream has ended (after draining, stop the session)
	Reason  string // why it ended ("" while live)
}

type StreamInfo struct {
	ID        string
	Kind      string
	Label     string
	StartedAt time.Time
	Frames    uint64 // total frames received so far
	Pending   uint64 // frames buffered but not yet polled
	Done      bool
	EndReason string
}

type StreamManager struct {
	// contains filtered or unexported fields
}

type StreamOptions struct {
	IdleTTL       time.Duration
	MaxLifetime   time.Duration
	MaxSessions   int
	MaxFrames     int   // ring capacity in frames
	MaxBytes      int64 // ring capacity in bytes
	MaxFrameBytes int64 // per-frame cap; oversize frames are truncated with a marker (default: executor MaxBody default)
	Now           func() time.Time
	// NoSweeper disables the background sweeper goroutine (tests drive expiry
	// via Sweep with a fake clock instead).
	NoSweeper bool
}

type StreamSession struct {
	ID    string
	Kind  string // "grpc-stream" | "graphql-subscription"
	Label string // method id / subscription summary, for listings
	// contains filtered or unexported fields
}

type TokenManager interface {
	// Token returns a valid bearer, refreshing proactively if it is at/near expiry.
	Token(ctx context.Context) (string, error)
	// Refresh forces a refresh (used reactively on a 401) and returns the new bearer.
	Refresh(ctx context.Context) (string, error)
}