agentadapter

type Identity struct {
	HumanID   string
	AgentID   string
	TeamID    string
	SessionID string
}

type ProxyConfig struct {
	RuntimeURL *url.URL
	// Identity is optional local metadata. Runtime
	// governance identity is the TLS client certificate, not headers.
	Identity  Identity
	Transport *RuntimeTransport
	// CertificateIdentity confirms that Transport presents a TLS client
	// certificate. The CLI sets it only after loading or enrolling a usable
	// keypair. OAuth-enabled targets additionally require a bearer token.
	CertificateIdentity bool
	HostHeader          string
	ListenAddr          string
	ProtocolVersion     string
	LogLevel            string
	LogWriter           io.Writer
	DisableXForwarded   bool
	// MaxInboundBytes caps the size of JSON-RPC request bodies the proxy
	// buffers when capturing metadata. Zero (or negative) means use
	// DefaultMaxInboundBytes (16 MiB). Over-cap requests respond with 413.
	MaxInboundBytes int64
	// MetricsHandler, when set, is served at /metrics. Typical use: a
	// Prometheus exporter wired to the OTel MeterProvider that backs
	// RuntimeTransport.Meter. Nil → /metrics returns 404.
	MetricsHandler http.Handler
}

type RuntimeTransport struct {
	// Base is the underlying round-tripper. nil means http.DefaultTransport.
	// Tests swap in a mock by setting this field.
	Base http.RoundTripper
	// Timeout is the per-request timeout applied to the *http.Client wrapper
	// returned by Client(). Zero means no timeout.
	Timeout time.Duration
	// AuthHeader is a static Authorization header value injected into every
	// outbound request (e.g. "Bearer <token>"). Empty means no header is set.
	AuthHeader string
	// Tracer is an optional OTel tracer. When non-nil, RoundTrip opens one
	// client span per RPC labelled with the JSON-RPC method name.
	Tracer trace.Tracer
	// Meter is an optional OTel meter. When non-nil, RoundTrip records a
	// latency histogram and a denial counter keyed by method name.
	Meter metric.Meter
	// contains filtered or unexported fields
}