rpc

type ActorCall struct {
	// contains filtered or unexported fields
}

type ActorClient struct {
	// contains filtered or unexported fields
}

type ActorRegistry interface {
	Register(ctx context.Context, name string, iface *Interface) error
	Client(ctx context.Context, name string) (Client, error)
	Close(ctx context.Context) error
}

type ActorResolver interface {
	Resolve(ctx context.Context, name string) (string, error)
}

type AuthMethod string

type Authenticator interface {
	// Authenticate validates the request's credentials and returns the caller's identity.
	// Returns:
	//   - (*Identity, nil) if credentials are valid
	//   - (nil, nil) if no credentials present or credentials are invalid
	//   - (nil, error) if an error occurred during authentication
	Authenticate(ctx context.Context, r *http.Request) (*Identity, error)
}

type Authorizer interface {
	// Authorize checks if the identity is allowed to perform the action on the resource.
	// For RPC methods, resource is typically the interface name (lowercase) and
	// action is the method name (lowercase).
	// Returns nil if allowed, or an error describing why access was denied.
	Authorize(ctx context.Context, identity *Identity, resource, action string) error
}

type Call interface {
	NewClient(capa *Capability) Client
	Args(v any)
	Results(v any)
	NewCapability(i *Interface) *Capability
	// IsAuthenticated returns true if the caller presented a valid TLS client certificate.
	// This is used by methods that need to distinguish between authenticated and
	// unauthenticated callers (e.g., runner registration allows unauthenticated Join
	// but requires authentication for admin operations like CreateInvite).
	IsAuthenticated() bool
}

type Capability struct {
	OID     OID    `cbor:"0,keyasint" json:"oid"`
	Address string `cbor:"1,keyasint" json:"address"`
	User    []byte `cbor:"2,keyasint" json:"owner"`
	Issuer  []byte `cbor:"3,keyasint" json:"issue"`

	RestoreState *InterfaceState `cbor:"4,keyasint" json:"restore-state"`

	Inline bool `cbor:"5,keyasint" json:"inline"`
}

type Client interface {
	CallWithCaps(ctx context.Context, method string, args, result any, caps map[OID]*InlineCapability) error
	Call(ctx context.Context, method string, args, result any) error
	NewInlineCapability(i *Interface, lower any) (*InlineCapability, OID, *Capability)
	NewClient(capa *Capability) Client
	Close() error
}

type CurrentConnectionInfo struct {
	PeerSubject string
	// PeerCertificate is the client certificate presented during the mTLS
	// handshake, if any. When a CA is configured the server uses
	// tls.VerifyClientCertIfGiven, so any cert present here has already been
	// verified to chain to the cluster CA (r.TLS.VerifiedChains is non-empty).
	PeerCertificate *x509.Certificate
}

type DebugAuthResponse struct {
	Success       bool              `json:"success"`
	ServerVersion string            `json:"server_version,omitempty"`
	AuthMethod    string            `json:"auth_method,omitempty"`
	Identity      string            `json:"identity,omitempty"`
	UserInfo      map[string]string `json:"user_info,omitempty"`
	Message       string            `json:"message,omitempty"`
}

type DescField struct {
	Name  string `yaml:"name"`
	Type  string `yaml:"type"`
	Index int    `yaml:"index"`

	Element string       `yaml:"element"`
	Union   []UnionField `yaml:"union,omitempty"`
	Key     string       `yaml:"key,omitempty"`
	Value   string       `yaml:"value,omitempty"`
	// contains filtered or unexported fields
}

type DescFile struct {
	Imports    map[string]Import `yaml:"imports"`
	Types      []*DescType       `yaml:"types"`
	Interfaces []*DescInterface  `yaml:"interfaces"`
}

type DescInterface struct {
	Name        string         `yaml:"name"`
	Method      []*DescMethods `yaml:"methods"`
	Generic     []string       `yaml:"generic,omitempty"`
	Constraints []string       `yaml:"constraints,omitempty"`
}

type DescMethods struct {
	Name       string           `yaml:"name"`
	Index      int              `yaml:"index"`
	Parameters []*DescParamater `yaml:"parameters"`
	Results    []*DescParamater `yaml:"results"`
	// Public marks this method as accessible without TLS client certificate authentication.
	// Public methods still require capability-level auth (Ed25519 signatures) but allow
	// unauthenticated callers (e.g., for registration flows where the client doesn't have certs yet).
	Public bool `yaml:"public,omitempty"`
}

type DescParamater struct {
	Name    string `yaml:"name"`
	Type    string `yaml:"type"`
	Element string `yaml:"element,omitempty"`
	Key     string `yaml:"key,omitempty"`
	Value   string `yaml:"value,omitempty"`
}

type DescType struct {
	Type        string       `yaml:"type"`
	Fields      []*DescField `yaml:"fields"`
	Compact     bool         `yaml:"compact,omitempty"`
	Generic     []string     `yaml:"generic,omitempty"`
	Constraints []string     `yaml:"constraints,omitempty"`
	// contains filtered or unexported fields
}

type Dispatcher interface {
	Dispatch(ctx context.Context, oid OID, method string, call Call) error
	Bind(oid OID, iface *Interface) error
}

type ErrorCategory interface {
	ErrorCategory() string
}

type ErrorCode interface {
	ErrorCode() string
}

type ErrorMessage interface {
	ErrorMessage() string
}

type ForbidRestore interface {
	// contains filtered or unexported methods
}

type Generator struct {
	Imports    map[string]Import
	Types      []*DescType
	Interfaces []*DescInterface
	// contains filtered or unexported fields
}

type HasReconstructFromState interface {
	ReconstructFromState(is *InterfaceState) (*Interface, error)
}

type HasRestoreState interface {
	RestoreState(iface any) (any, error)
}

type Identity struct {
	// Subject is the primary identifier (cert CN, JWT subject, etc.)
	Subject string

	// Groups contains group memberships (from JWT claims, etc.)
	Groups []string

	// Method indicates how the caller was authenticated
	Method AuthMethod

	// Metadata holds auth-method-specific data (e.g., OrganizationID for cloud auth)
	Metadata map[string]any
}

type IfaceReg struct {
	// contains filtered or unexported fields
}

type Import struct {
	Path   string   `yaml:"path"`
	Import string   `yaml:"import"`
	Types  []string `yaml:"types"`
}

type InlineCapability struct {
	*Capability
	*Interface
}

type Interface struct {
	// contains filtered or unexported fields
}

type InterfaceCreators struct {
	// contains filtered or unexported fields
}

type InterfaceDescriptor struct {
}

type InterfaceState struct {
	Category  string `cbor:"0,keyasint" json:"category"`
	Interface string `cbor:"1,keyasint" json:"interface"`
	Data      any    `cbor:"2,keyasint" json:"data"`
}

type LocalActorRegistry struct {
	// contains filtered or unexported fields
}

type LocalOnlyAuthenticator struct{}

type Method struct {
	Name          string
	InterfaceName string
	Index         int
	Handler       func(ctx context.Context, call Call) error
	// Public marks this method as accessible without TLS client certificate authentication.
	// The RPC layer will reject unauthenticated calls to non-public methods automatically.
	Public bool
	// Params lists the method's parameter names in schema order. It powers
	// parameter-level capability detection: a client can ask whether a server
	// understands a specific parameter (e.g. one added after the method first
	// shipped) instead of only whether the method exists. See HasMethodParam.
	Params []string
}

type NetworkCall struct {
	// contains filtered or unexported fields
}

type NetworkClient struct {
	State *State
	// contains filtered or unexported fields
}

type NoOpAuthenticator struct{}

type NoRestore struct{}

type OID string

type ResolveError struct {
	Kind       ResolveErrorKind
	Err        error
	Msg        string
	StatusCode int // HTTP status code for ResolveStatusError
}

type ResolveErrorKind int

type ResolverFunc func(ctx context.Context, name string) (string, error)

type Server struct {
	// contains filtered or unexported fields
}

type ServiceID = string

type State struct {
	*StateCommon
	// contains filtered or unexported fields
}

type StateCommon struct {
	// contains filtered or unexported fields
}

type StateOption func(*stateOptions)

type UnionField struct {
	Name    string `yaml:"name"`
	Index   int    `yaml:"index"`
	Type    string `yaml:"type"`
	Element string `yaml:"element,omitempty"`
}