gateway

type Authenticator interface {
	AuthenticateRequest(*http.Request) (Principal, error)
}

type AuthenticatorFunc func(*http.Request) (Principal, error)

type CapabilityTier string

type Config struct {
	DatabasePath string
	Models       []string

	QueueCapacity         int
	MaxBodyBytes          int64
	MaxWorkerMessageBytes int64
	HeartbeatInterval     time.Duration
	// StreamWriteTimeout bounds one SSE write plus flush. It is reset after
	// every successful emission and never acts as a whole-stream timeout.
	StreamWriteTimeout     time.Duration
	MaxPending             time.Duration
	RateLimit              RateLimitConfig
	Worker                 WorkerTransportConfig
	AuditPayload           bool
	AuditPayloadTTL        time.Duration
	ReplayPayloadGrace     time.Duration
	RetentionSweepInterval time.Duration

	DisableCodexAutoIdempotency bool

	// Authenticator replaces built-in bearer/X-Api-Key authentication. When
	// set, Issue and Revoke return ErrBuiltInAuthDisabled.
	Authenticator Authenticator
	// WorkerRouter binds each new task to an exact worker subject using the
	// embedding application's tenant and authorization policy. The chosen
	// subject is durable task affinity across continuations and recovery.
	WorkerRouter WorkerRouter
	Logger       *slog.Logger
}

type IssuedToken struct {
	KeyID  string
	Secret string
}

type PreparedToken struct {
	KeyID     string
	Secret    string
	Type      PrincipalType
	SubjectID string
}

type Principal struct {
	Type      PrincipalType
	SubjectID string
	KeyID     string
}

type PrincipalType string

type RateLimitConfig struct {
	RatePerSecond float64
	Burst         int
	IdleTTL       time.Duration
}

type Server struct {
	// contains filtered or unexported fields
}

type WorkerRouteRequest struct {
	Request          *http.Request
	Caller           Principal
	Model            string
	CapabilityTier   CapabilityTier
	WorkspaceKey     string
	TaskID           string
	IdempotencyKey   string
	HarnessID        string
	HarnessVersion   string
	HarnessSessionID string
	WorkspaceRoot    string
	ExecAllowed      bool
}

type WorkerRouter interface {
	RouteWorker(context.Context, WorkerRouteRequest) (string, error)
}

type WorkerRouterFunc func(context.Context, WorkerRouteRequest) (string, error)

type WorkerTransportConfig struct {
	ReadLimit    int64
	WriteTimeout time.Duration
	PingInterval time.Duration
	PingTimeout  time.Duration
}