server

type ManagedAgentAPI struct {
	Client    client.Client
	Scheme    *runtime.Scheme
	Namespace string
	// Hands creates a SandboxEnv on a worker cluster when a create request asks
	// for one. Nil on a control plane without an admin key — a request that needs
	// it is then refused rather than silently creating an agent with no sandbox
	// supply. Shared with the ManagedAgent controller, which uses it for
	// hands.auto.
	Hands managedagent.HandsProvisioner

	// Gateway forwards the console's own requests to an agent's Brain, so a user
	// can talk to their agent from the platform. Nil leaves that surface off,
	// which is why every route below still works without it.
	//
	// It is the SAME proxy the public listener uses, deliberately: the alternative
	// is two forwarders that agree today and diverge on the next Brain endpoint —
	// and the one that diverges silently is whichever gets less traffic.
	Gateway *ManagedAgentGateway

	// Defaults is what this deployment supplies for an agent that names none. It
	// is served so a console can present the same agent the controller would
	// render — a form that asked for an image, an endpoint and an environment the
	// platform already has an answer for is a form the platform failed to fill in.
	Defaults PlatformDefaults
}

type ManagedAgentGateway struct {
	Client    client.Client
	Namespace string
	// contains filtered or unexported fields
}

type PlatformDefaults struct {
	BrainImage    agentsv1alpha1.ManagedAgentImage
	Hands         *agentsv1alpha1.ManagedAgentHands
	ModelProvider config.ModelProviderDefaults
}

type RouterDeps struct {
	SyncManager  *syncmgr.SyncManager
	AdminKeyMgr  *apikey.AdminKeyManager
	KeyStore     syncmgr.KeyStore
	JWTSecret    string
	ManagerToken string
	IAMService   service.IAMService

	// Notify serves the daily-report / idle-alert admin API. Nil when the
	// notification service is not configured (no Prometheus URL), in which
	// case those routes answer 503 rather than being unregistered.
	Notify *notify.Service

	// ManagedAgentAPI serves the console's ManagedAgent CRUD. Nil when the
	// ManagedAgent controller is not enabled, in which case the routes are not
	// registered at all rather than answering with an empty list — a console
	// pointed at a control plane without the feature should see a 404, not the
	// impression that the tenant simply owns no agents.
	ManagedAgentAPI *ManagedAgentAPI
}