http

type APIKey struct {
	URI, Header, Value string
	Secret             *scy.Resource
}

type APIKeys []APIKey

type AsyncAdmission interface {
	Begin(context.Context) (context.Context, AsyncService, func(), error)
}

type AsyncInspect struct {
	Result bool
	JobID  string
	Target spec.RouteRef
}

type AsyncRoute struct {
	Route    spec.RouteRef
	MatchKey string
	SyncFlag string
	// Inspect configures a separate authored route to inspect exact stored IDs.
	// Its input contract still verifies any declared JWT before status authorization.
	Inspect *AsyncInspect
}

type AsyncService interface {
	Exchange(context.Context, jobs.Submission) (*jobs.Exchange, error)
}

type CacheInvalidationConfig struct {
	Timeout   time.Duration
	Authorize func(context.Context, *stdhttp.Request, dexec.ComponentTarget) error
}

type Config struct {
	// Metrics opts into diagnostic response headers. Nil disables them.
	Metrics *MetricsConfig `json:"Metrics,omitempty" yaml:"Metrics,omitempty"`
	Async   []AsyncRoute   `json:"Async,omitempty" yaml:"Async,omitempty"`
	// StaticLocalRoot is an optional caller-owned local filesystem authority.
	// Configured ContentURL paths beneath it must be relative and symlink-free.
	// Keep it open until all reloads finish. JSON configuration cannot grant it.
	StaticLocalRoot   *os.Root `json:"-"`
	StaticContent     []*spec.StaticContent
	ContentURL        string
	APIKeys           APIKeys                  `json:"APIKeys,omitempty" yaml:"APIKeys,omitempty"`
	DisableCors       bool                     `json:"DisableCors,omitempty" yaml:"DisableCors,omitempty"`
	CORS              *spec.CORS               `json:"CORS,omitempty" yaml:"CORS,omitempty"`
	APIPrefix         string                   `json:"APIPrefix,omitempty" yaml:"APIPrefix,omitempty"`
	Meta              Meta                     `json:"Meta,omitempty" yaml:"Meta,omitempty"`
	OpenAPI           *OpenAPIConfig           `json:"OpenAPI,omitempty" yaml:"OpenAPI,omitempty"`
	Warmup            *WarmupConfig            `json:"-" yaml:"-"`
	CacheInvalidation *CacheInvalidationConfig `json:"-" yaml:"-"`
	// Authorize applies application policy to every resolved component target
	// after route/API-key checks and before request binding or execution.
	Authorize func(context.Context, *stdhttp.Request, dexec.ComponentTarget) error `json:"-" yaml:"-"`
}

type DocumentAccess struct {
	APIKeyHeader string `json:"APIKeyHeader" yaml:"APIKeyHeader"`
	APIKeyValue  string `json:"APIKeyValue" yaml:"APIKeyValue"`
}

type DocumentExport struct {
	URL    string
	Path   string
	Format string
}

type Handler struct {
	// contains filtered or unexported fields
}

type HandlerInput struct {
	Async      AsyncAdmission
	Runtime    *druntime.Runtime
	Components []*registry.RegisteredComponent
	Logger     xlogger.Logger
	Version    string
}

type Meta struct {
	// AllowedSubnet retains original RemoteAddr prefix matching (not CIDR parsing).
	AllowedSubnet      []string `json:"AllowedSubnet,omitempty" yaml:"AllowedSubnet,omitempty"`
	OpenApiURI         string   `json:"OpenApiURI,omitempty" yaml:"OpenApiURI,omitempty"`
	DocURI             string   `json:"DocURI,omitempty" yaml:"DocURI,omitempty"`
	CacheWarmURI       string   `json:"CacheWarmURI,omitempty" yaml:"CacheWarmURI,omitempty"`
	CacheInvalidateURI string   `json:"CacheInvalidateURI,omitempty" yaml:"CacheInvalidateURI,omitempty"`
}

type MetricsConfig struct {
	AllowSQL  bool                      `json:"AllowSQL,omitempty" yaml:"AllowSQL,omitempty"`
	Authorize func(*http.Request) error `json:"-" yaml:"-"`
}

type OpenAPIConfig struct {
	Info            openapi3.Info   `json:"Info" yaml:"Info"`
	AggregateAccess *DocumentAccess `json:"AggregateAccess,omitempty" yaml:"AggregateAccess,omitempty"`
	RouteAccess     *DocumentAccess `json:"RouteAccess,omitempty" yaml:"RouteAccess,omitempty"`
	// StartupExports is consumed by standalone after initial publication, before
	// listener admission. Rendering remains owned by Manager.ExportOpenAPI.
	StartupExports []DocumentExport `json:"StartupExports,omitempty" yaml:"StartupExports,omitempty"`
}

type WarmupConfig struct {
	Lifetime  *WarmupLifetime
	Timeout   time.Duration
	Authorize func(context.Context, *stdhttp.Request, dexec.ComponentTarget) error
	// AdminHeaders are the extra request headers available to Authorize. API-key
	// and canonical JWT headers are copied automatically; bodies are never retained.
	AdminHeaders []string
	// Completed receives preparation failures and every dispatched operation outcome,
	// even after client cancellation. Callbacks must support concurrent requests.
	Completed func(WarmupResult, error)
}

type WarmupLifetime struct {
	// contains filtered or unexported fields
}

type WarmupResult struct {
	Target string `json:"target"`
	Groups int    `json:"groups"`
	Status string `json:"status"`
}