coord

type Client struct {
	// contains filtered or unexported fields
}

type ClientOption func(*Client)

type MetricsHooks struct {
	// OnPullIntentServed fires once per pull_intent_query handled.
	OnPullIntentServed func()
	// OnPullIntentStorageUnavailable fires once per pull_intent_query
	// (wire or local) whose has_cached=false answer was caused by the
	// primary or secondary storage backend returning ifaces.ErrUnavailable
	// rather than a definitive miss. Operators use this to distinguish
	// "DHT routes around us because we genuinely lack the blob" from
	// "DHT routes around us because containerd is unreachable on this
	// node" - the latter should also be caught by readiness, but the
	// metric makes transient storage flaps observable independently of
	// the readyz signal.
	OnPullIntentStorageUnavailable func()
	// OnPleasePullServed fires once per please_pull *request* handled
	// (not per digest in the batch).
	OnPleasePullServed func()
	// OnPleasePullStarted is called once per digest the server
	// transitions into in_flight from a please_pull batch.
	OnPleasePullStarted func()
	// OnPleasePullDeclined fires once per digest the server declines to
	// start (PumpDeclined): the puller-pump refused the work because the
	// node is at its concurrent-pull ceiling or is shutting down. The
	// digest is reported to the requester as OUTCOME_UNSPECIFIED. This is
	// the load-shedding signal operators watch during large rollouts; a
	// sustained nonzero rate means designated pullers are saturated and
	// requesters are falling through to direct-origin fallback (NF5).
	OnPleasePullDeclined func()
	// OnStreamError fires once per inbound stream that is dropped without a
	// normal reply: a malformed or oversized envelope, read/decode/deadline
	// failures, the concurrent-stream limit, dispatch and serve errors, and
	// response marshal/write failures. Enforce-mode authz rejections are
	// deliberately NOT counted here (they are a policy decision, recorded by
	// reason in OnUnauthorizedPeer), so enabling peer authz does not inflate
	// the protocol-error signal.
	OnStreamError func()
	// OnUnauthorizedPeer fires once per inbound request whose remote
	// libp2p peer ID is not present in the current membership view. The
	// reason label distinguishes "unrecognized" (members have published
	// peer IDs but none match remote) from "unevaluable" (no member has
	// published a peer ID yet, so authorization cannot be evaluated - only
	// reported in enforce mode). It fires in both observe-only and enforce
	// mode so operators can size the false-positive rate before flipping
	// enforcement on.
	OnUnauthorizedPeer func(reason string)
}

type NegativeCache interface {
	Lookup(d digest.Digest) (entry NegativeEntry, ok bool)
}

type NegativeEntry struct {
	CooldownUntil time.Time
	Class         ifaces.FailureClass
}

type Option func(*Server)

type PullerPump func(ctx context.Context, registry, repository string, d digest.Digest, kind ifaces.OriginRefKind) PumpResult

type PumpResult struct {
	Status        PumpStatus
	StartedAt     time.Time
	CooldownUntil time.Time
	FailureClass  ifaces.FailureClass
}

type PumpStatus int

type Server struct {
	// contains filtered or unexported fields
}