server

type APIRoute struct {
	Group       string
	Method      string
	Path        string
	Auth        string
	Description string
}

type AgentAdmin interface {
	ListAgents() []pool.AgentSummary
	Revoke(ctx context.Context, agentID, reason string, forceOrphanResources bool) error
	RequestAgentLogs(ctx context.Context, agentID string, since time.Time, limit int) (string, error)
	WaitForAgentLogs(ctx context.Context, requestID string) error
}

type CatalogPackage struct {
	Name              string
	Version           string
	Method            string
	Scopes            []string
	Events            []string
	MissingReferences []string
}

type CatalogPool struct {
	Name              string
	Template          string
	Type              string
	Provider          string
	Agent             string
	Source            string
	Packages          []string
	MissingReferences []string
}

type CatalogSnapshot struct {
	Templates []CatalogTemplate
	Packages  []CatalogPackage
	Sources   []CatalogSourceEntry
	Stores    []CatalogStore
	Pools     []CatalogPool
}

type CatalogSource interface {
	LoadCatalog(ctx context.Context) (CatalogSnapshot, error)
}

type CatalogSourceEntry struct {
	Name              string
	Store             string
	Path              string
	Digest            string
	Format            string
	OS                string
	Provider          string
	MissingReferences []string
}

type CatalogStore struct {
	Name     string
	Type     string
	Endpoint string
	Bucket   string
	Path     string
}

type CatalogTemplate struct {
	Name              string
	Extends           string
	Type              string
	Provider          string
	Agent             string
	Source            string
	Packages          []string
	MissingReferences []string
}

type OIDCOptions struct {
	// Issuer is the provider's issuer URL, exposed to the CLI (via
	// GET /auth/cli-config) so `boxy login --oidc` can run its own
	// discovery -- the CLI talks to the provider directly for the
	// device-code grant, it does not proxy through this server.
	Issuer string
	OAuth2 oauth2.Config
	// Verifier checks the audience against the confidential web client
	// (OAuth2.ClientID) -- used only by the browser callback.
	Verifier *oidc.IDTokenVerifier
	// RoleClaim names the ID token claim whose value(s) are looked up in
	// RoleMapping. May be a single string or an array of strings.
	RoleClaim string
	// RoleMapping maps a RoleClaim value to a Boxy role.
	RoleMapping map[string]string
	// DefaultRole is used when no RoleClaim value matches RoleMapping.
	// Empty fails closed (login rejected).
	DefaultRole model.APIKeyRole
	// CLIClientID, if set, is the public (no-secret) OAuth2 client ID
	// `boxy login --oidc` uses for the device-code grant. Empty means
	// CLI OIDC login is unavailable (GET /auth/cli-config 404s).
	CLIClientID string
	// CLIVerifier checks the audience against CLIClientID rather than the
	// web client -- an ID token minted for the CLI's own device-flow
	// client carries that audience, not the web client's, so reusing
	// Verifier here would always fail with an audience mismatch. Set
	// only when CLIClientID is.
	CLIVerifier *oidc.IDTokenVerifier
	// PersonalKeyMaxTTL bounds how long a self-service personal API key
	// minted via POST /api/v1/api-keys/oidc-exchange may live.
	PersonalKeyMaxTTL time.Duration
	// LoginLabel and LoginIcon customize the browser SSO login button.
	LoginLabel string
	LoginIcon  string
	// HideLocalLogin hides the local username/password form when true.
	HideLocalLogin bool
}

type PoolMaintenance interface {
	Drain(ctx context.Context, poolName model.PoolName) (model.Pool, error)
	Fill(ctx context.Context, poolName model.PoolName) (model.Pool, error)
}

type PoolResourceMaintenance interface {
	DestroyResource(context.Context, model.Resource) error
	RetryResource(context.Context, model.Resource) error
}

type ResourceCleanup interface {
	Purge(ctx context.Context, request pool.CleanupRequest) (pool.CleanupReport, error)
}

type SandboxExecutor interface {
	ExecuteSandbox(ctx context.Context, resource model.Resource, operation providersdk.ExecOperation, sink eventstream.Sink) (*providersdk.Result, error)
}

type Server struct {
	// contains filtered or unexported fields
}

type ServerOptions struct {
	AuthRequired    bool
	InsecureHTTP    bool
	TLSCertPEM      []byte
	TLSKeyPEM       []byte
	Executor        SandboxExecutor
	JobRunner       *jobs.Runner
	ResourceCleanup ResourceCleanup
	GuestSecrets    boxysecrets.Store
	// Catalog is an immutable, startup-time view of configured templates,
	// packages, sources, stores, and pool relationships for the UI.
	Catalog CatalogSource
	// Diagnostics is the bounded, redacted operational log store. When nil,
	// the diagnostics endpoint reports that diagnostics are unavailable.
	Diagnostics diagnostics.Store
	// DiagnosticsAudit receives safe metadata for every diagnostics query.
	DiagnosticsAudit diagnostics.AuditSink
	// OIDC enables provider login on the web UI's /login page. nil (the
	// default) means only the bootstrapped local admin account can log
	// in -- see docs/superpowers/specs/2026-08-28-oidc-ui-and-cli-auth-design.md.
	OIDC *OIDCOptions
	// SessionTTL bounds how long a web-UI login session lasts, regardless
	// of how it was established (OIDC or the local-admin account). Zero
	// defaults to 12h (see session.go's defaultSessionTTL).
	SessionTTL time.Duration
	// Version is displayed in the dashboard footer. Empty defaults to dev.
	Version string
}

type SessionSweeper struct {
	// contains filtered or unexported fields
}