server

type App struct {

	// Approval is the optional approval-gate backend. nil disables gating
	// (gates recorded AWAITING are never satisfied → action_required). Set after
	// construction (e.g. by the serve command), so New's signature is unchanged.
	Approval approval.Backend
	// Objects is the optional object store for completed-log offload. nil keeps
	// logs in the local buffer only. Set after construction, like Approval.
	Objects ObjectStore
	// PushVerifier verifies a Pub/Sub push OIDC bearer token, returning the
	// token's email claim. Set externally (like Approval/Objects); nil disables
	// the /pubsub/push endpoint (it returns 404).
	PushVerifier func(ctx context.Context, bearer string) (email string, err error)
	// contains filtered or unexported fields
}

type CheckRunUpdate struct {
	Title      string // check-run title (e.g. "Terraform plan" / "Terraform apply")
	Summary    string // GFM blast-radius headline + verdict chips + per-stack table (renders at the top)
	Text       string // the rendered plan report (renders below the summary)
	DetailsURL string // the live page for the full view
	Conclusion string // "" while running; otherwise success|failure|action_required|neutral
}

type Config struct {
	// WebhookSecret is the bearer token required on /api/* mutations. Empty
	// disables auth (local/dev only).
	WebhookSecret string
	// PublicBaseURL is the public origin used for check-run Details links. Empty
	// derives it from the inbound request (e.g. behind a TLS-terminating proxy).
	PublicBaseURL string
	// UseChecks true → drive a rich GitHub check run (needs checks:write);
	// false → link mode, posting a commit status (needs statuses:write).
	UseChecks bool
	// ReconcilerCore routes server-side gate/execution state transitions through
	// the pure reconcile core (internal/reconcile) instead of the legacy
	// handlers. Off by default; engaged only at quiescence (see Task 19).
	ReconcilerCore bool
	// ApplyLock enables the apply-serialization feature: at most one apply runs
	// at a time across all PRs. Off by default; inert when false.
	ApplyLock bool
	// LogsDir is where per-stack log buffers are written. Empty disables log
	// ingestion (the endpoints become no-ops).
	LogsDir string
	// GroupDepth controls the live DAG's grouping: stacks fold into groups by
	// their first GroupDepth path segments. 0 = unset → handlers default to 2.
	GroupDepth int
	// GroupPattern is a regexp whose first capture group is the group key;
	// overrides GroupDepth. Empty → fall back to GroupDepth grouping.
	GroupPattern string
	// PushServiceAccount is the allowed verified OIDC email for /pubsub/push.
	// Empty accepts any verified token.
	PushServiceAccount string
	// GitHubWebhookSecret is the HMAC-SHA256 secret GitHub sends on every webhook
	// delivery (X-Hub-Signature-256). Empty disables the /github/webhook endpoint.
	GitHubWebhookSecret string
}

type FSStore struct{ Root string }

type GitHub interface {
	// CreateCheckRun opens an in_progress check run with the given name whose
	// Details link is detailsURL; returns its id.
	CreateCheckRun(ctx context.Context, repo, sha, name, detailsURL string) (int64, error)
	// UpdateCheckRun patches an existing check run.
	UpdateCheckRun(ctx context.Context, repo string, checkRunID int64, u CheckRunUpdate) error
	// PostStatus sets a commit status (link-mode fallback).
	PostStatus(ctx context.Context, repo, sha, context_, state, description, targetURL string) error
	// PRHeadSHA returns the current head commit SHA of a pull request, so a
	// verdict is posted on the live head rather than a stale execution SHA.
	PRHeadSHA(ctx context.Context, repo string, pr int) (string, error)
	// PRAbandoned reports whether a pull request is closed WITHOUT having been
	// merged (i.e. abandoned). A merged PR returns false so its post-merge apply
	// keeps its grant. Returns (false, err) when the PR cannot be read.
	PRAbandoned(ctx context.Context, repo string, pr int) (bool, error)
	// MergeGroupPRs returns the PR numbers whose commits compose the merge group
	// at headSHA, via the commit→PRs association API.
	MergeGroupPRs(ctx context.Context, repo, headSHA string) ([]int, error)
}

type MockGitHub struct {
	CreateCheckRunFn func(ctx context.Context, repo, sha, name, detailsURL string) (int64, error)
	UpdateCheckRunFn func(ctx context.Context, repo string, checkRunID int64, u CheckRunUpdate) error
	PostStatusFn     func(ctx context.Context, repo, sha, context_, state, description, targetURL string) error
	PRHeadSHAFn      func(ctx context.Context, repo string, pr int) (string, error)
	PRAbandonedFn    func(ctx context.Context, repo string, pr int) (bool, error)
	MergeGroupPRsFn  func(ctx context.Context, repo, headSHA string) ([]int, error)
	// CreateCheckRunCalls counts CreateCheckRun invocations so tests can assert
	// the check run is created exactly once (idempotency).
	CreateCheckRunCalls int
}

type ObjectStore interface {
	Put(ctx context.Context, key string, r io.Reader) error
	Get(ctx context.Context, key string) (io.ReadCloser, error)
}

type RealClient struct {
	// contains filtered or unexported fields
}

type Shell struct {
	// contains filtered or unexported fields
}