mcpbroker

type Attachment struct {
	// contains filtered or unexported fields
}

type AuthenticatedCapabilities struct {
	Backend string
	Tools   []ToolDefinition
}

type AuthorizedCaller func(context.Context, SessionRef, string, session.ToolCall, oauth2.TokenSource) (session.ToolResult, error)

type Caller func(context.Context, SessionRef, string, session.ToolCall) (session.ToolResult, error)

type Catalogue struct {
	// contains filtered or unexported fields
}

type HandlerBundle struct {
	Authorization     http.Handler
	Token             http.Handler
	UpstreamCallback  http.Handler
	Discovery         http.Handler
	JWKS              http.Handler
	ProtectedResource http.Handler
	VMCP              http.Handler
	Callback          http.Handler
}

type Option func(*Runtime)

type Process struct {
	Runtime  *Runtime
	Handlers HandlerBundle
	// contains filtered or unexported fields
}

type Runtime struct {
	// contains filtered or unexported fields
}

type SessionRef struct {
	// contains filtered or unexported fields
}

type StaticTool struct {
	Name, Description string
	Schema            json.RawMessage
	ReadOnly          bool
}

type ToolDefinition struct {
	Backend     string
	Name        string
	Description string
	Schema      json.RawMessage
	ReadOnly    bool
}

type ToolHiveConfig struct {
	CallbackURL string
	Profiles    []ToolHiveProfile
	Occupied    []string
	// AuthStorage backs the embedded auth server's pending-authorization,
	// token, grant, and DCR storage directly. Tests use this to inject a
	// fake/spy storage.Storage; composition (which cannot import the
	// vendored toolhive storage package — see
	// TestToolHiveImportsStayBehindApprovedAdapterLeaves) uses AuthRedisClient
	// instead. Precedence: AuthStorage wins if set, else AuthRedisClient
	// selects a Redis-backed store (under toolHiveAuthStoragePrefix), else
	// storage.NewMemoryStorage() — which does not survive a process restart,
	// so a pod bounce between a user starting and completing an OAuth
	// authorization loses the pending state (a genuine "pending authorization
	// not found" failure).
	AuthStorage storage.Storage
	// AuthRedisClient, when set (and AuthStorage is nil), backs the embedded
	// auth server with a Redis-backed storage.Storage sharing this managed
	// Redis instance with mecatl's own session store, under
	// toolHiveAuthStoragePrefix. The caller (composition) owns the client's
	// lifecycle — EmbeddedAuthServer.Close calls storage.Close, which closes
	// the client it was given, so no separate cleanup is needed beyond that.
	AuthRedisClient redis.UniversalClient
}

type ToolHiveOAuth struct {
	Issuer                string
	AuthorizationEndpoint string
	TokenEndpoint         string
	ClientID              string
	ClientSecretEnv       string
	Scopes                []string
	RequestRefreshToken   bool
}

type ToolHiveProfile struct {
	Name   string
	URL    string
	Auth   string
	OAuth  *ToolHiveOAuth
	Static []StaticTool
}