pipeline

type ArtifactInfo struct {
	Kind        string    `json:"kind"` // bundle | meta | sha256
	Key         string    `json:"key"`
	Size        int64     `json:"size"`
	SHA256      string    `json:"sha256"`
	RetainUntil time.Time `json:"retainUntil"`
}

type BackupDeps struct {
	Config        *config.Config
	Source        source.Source
	Dest          dest.Destination
	Git           *gitexec.Git
	SigningKey    ed25519.PrivateKey
	EncryptionKey []byte // optional client-side envelope key; nil = off
	ToolVersion   string
	Logger        *slog.Logger
	Now           func() time.Time
	RequireWORM   bool // --require-worm / worm.require: fail closed if not immutable
}

type BackupResult struct {
	Manifest    *Manifest
	ManifestKey string
}

type DestInfo struct {
	Type          string `json:"type"`
	Bucket        string `json:"bucket"`
	WormMode      string `json:"wormMode,omitempty"`    // configured retention mode
	WormImmutable bool   `json:"wormImmutable"`         // WORM check confirmed immutable
	WormDetails   string `json:"wormDetails,omitempty"` // observed immutability detail
}

type Manifest struct {
	Schema      string      `json:"schema"`
	RunID       string      `json:"runId"`
	Tool        ToolInfo    `json:"tool"`
	Source      SourceInfo  `json:"source"`
	Destination DestInfo    `json:"destination"`
	StartedAt   time.Time   `json:"startedAt"`
	FinishedAt  time.Time   `json:"finishedAt"`
	Status      string      `json:"status"` // success | failed
	Repos       []RepoEntry `json:"repos"`
}

type RepoEntry struct {
	Slug   string `json:"slug"`
	Status string `json:"status"` // success | failed | skipped
	Error  string `json:"error,omitempty"`
	// Why a repository was skipped, in plain words. Additive to the manifest schema rather
	// than a new status value, because a consumer switching on `status` would break on an
	// unknown one and there is more than one reason to skip.
	Reason    string         `json:"reason,omitempty"`
	Artifacts []ArtifactInfo `json:"artifacts,omitempty"`
}

type RestoreDeps struct {
	Dest          dest.Destination
	Git           *gitexec.Git
	EncryptionKey []byte // optional; must match the backup's key
	// PublicKey is optional. When set, restore locates the signed run-manifest for the
	// requested date, verifies its signature, and checks every artifact it downloads
	// against the checksums the manifest records. The unsigned .sha256 sidecar catches
	// corruption but not tampering; the manifest catches both. Without a key restore
	// keeps the sidecar-only check and says so in RestoreResult.Verification.
	PublicKey ed25519.PublicKey
	Logger    *slog.Logger
}

type RestoreRequest struct {
	Host   string // e.g. github.com
	Owner  string
	Name   string
	Date   string // YYYY-MM-DD
	OutDir string
}

type RestoreResult struct {
	BundleKey string `json:"bundleKey"`
	SHA256    string `json:"sha256"`
	OutDir    string `json:"outDir"`
	Verified  bool   `json:"verified"`
	// Verification says in plain words which integrity checks this restore ran, so a
	// restore that was not checked against the signed manifest announces itself
	// instead of looking identical to one that was. Deliberately kept out of the JSON:
	// the --output json shape is a versioned public contract (SPEC §11), and widening
	// it is its own change, made on purpose, not as a side effect of a read-side fix.
	Verification string `json:"-"`
}

type SourceInfo struct {
	Type string `json:"type"`
	Host string `json:"host"`
}

type ToolInfo struct {
	Name    string `json:"name"`
	Version string `json:"version"`
}

type VerifyDeps struct {
	Dest      dest.Destination
	PublicKey ed25519.PublicKey
	Logger    *slog.Logger
}

type VerifyResult struct {
	ManifestKey      string   `json:"manifestKey"`
	SignatureValid   bool     `json:"signatureValid"`
	ArtifactsChecked int      `json:"artifactsChecked"`
	ArtifactsOK      int      `json:"artifactsOk"`
	Failures         []string `json:"failures,omitempty"`
}