store

const (
	AIChatRoleUser      = "user"
	AIChatRoleAssistant = "assistant"
	AIChatRoleTool      = "tool"
)

const (
	AIChatConfirmationPending  = "pending"
	AIChatConfirmationApproved = "approved"
	AIChatConfirmationRejected = "rejected"
)

const (
	AIControlModeOff     = "off"
	AIControlModeObserve = "observe"
	AIControlModeOperate = "operate"
	AIControlModeAdmin   = "admin"
)

const (
	AIProviderStatusUntested  = "untested"
	AIProviderStatusOK        = "ok"
	AIProviderStatusInvalid   = "invalid_key"
	AIProviderStatusUnreach   = "unreachable"
	AIProviderStatusExhausted = "quota_exhausted"
)

const (
	AppEventRestart      = "restart"
	AppEventEnvChange    = "env_change"
	AppEventSecretChange = "secret_change"
	AppEventConfigChange = "config_change"
	AppEventScale        = "scale"
	AppEventSuspend      = "suspend"
	AppEventResume       = "resume"
	// AppEventSlept and AppEventWoke mark sleep-when-idle stopping and starting an app.
	AppEventSlept          = "slept"
	AppEventWoke           = "woke"
	AppEventFreezeOverride = "freeze_override"
	// AppEventPublishLock, AppEventPublishUnlock and AppEventPublishHeld mark the publish lock being taken, lifted and a held build going live.
	AppEventPublishLock   = "publish_lock"
	AppEventPublishUnlock = "publish_unlock"
	AppEventPublishHeld   = "publish_held"
	// AppEventScanGateOverride marks an operator letting a scan-blocked release through.
	AppEventScanGateOverride = "scan_gate_override"
)

const (
	AppImportPlanned      = "planned"
	AppImportStaged       = "staged"
	AppImportBuilding     = "building"
	AppImportVerified     = "verified"
	AppImportVerifyFailed = "verify-failed"
	AppImportStageFailed  = "stage-failed"
	AppImportRouted       = "routed"
	AppImportRolledBack   = "rolled-back"
)

const (
	AppScheduleHistoryFired         = "fired"
	AppScheduleHistorySkippedFreeze = "skipped_freeze"
	AppScheduleHistoryFailed        = "failed"
	// AppScheduleHistorySkippedMissed marks a one-shot whose run_at passed
	// by more than the catch-up window while the control plane was down.
	AppScheduleHistorySkippedMissed = "skipped_missed"
)

const (
	AppliedFieldPort       = "port"
	AppliedFieldCommand    = "command"
	AppliedFieldEntrypoint = "entrypoint"
	AppliedFieldLabels     = "labels"
	AppliedFieldHostPort   = "host_port"
	AppliedFieldBindAddr   = "bind_address"
	// AppliedFieldDatabaseEnv hashes the database links: they resolve to env
	// at container create, so a new link is pending until a restart.
	AppliedFieldDatabaseEnv = "database_env"
	// AppliedFieldVolumes hashes the named volume mounts, which are fixed at
	// container create.
	AppliedFieldVolumes = "volumes"
	// AppliedFieldSecretKeys lists, comma-joined, which env keys were
	// secret-backed; informational, never diffed as a setting.
	AppliedFieldSecretKeys = "secret_keys"
)

const (
	AssetVisibilityPrivate = "private"
	AssetVisibilityPublic  = "public"

	AssetServingDirect  = "direct"
	AssetServingProxied = "proxied"
	AssetServingCDN     = "cdn"
)

const (
	BackupCopyPending   = "pending"
	BackupCopyCopying   = "copying"
	BackupCopySucceeded = "succeeded"
	BackupCopyFailed    = "failed"
)

const (
	BackupStatusRunning   = "running"
	BackupStatusSucceeded = "succeeded"
	BackupStatusFailed    = "failed"
)

const (
	BackupResourceKindDatabase = "database"
	BackupResourceKindVolume   = "volume"
)

const (
	DrillStatusRunning = "running"
	DrillStatusPassed  = "passed"
	DrillStatusFailed  = "failed"

	DrillTriggerManual    = "manual"
	DrillTriggerScheduled = "scheduled"
)

const (
	BackupProviderAWS    = "aws"
	BackupProviderR2     = "r2"
	BackupProviderCustom = "custom"
)

const (
	BackupVerificationStatusRunning = "running"
	BackupVerificationStatusPassed  = "passed"
	BackupVerificationStatusFailed  = "failed"
)

const (
	BranchDeployDeploying = PreviewStatusDeploying
	BranchDeployActive    = PreviewStatusActive
	BranchDeployFailed    = PreviewStatusFailed
)

const (
	BuildLimitMaxConcurrent  = "max_concurrent"
	BuildLimitTimeoutSeconds = "timeout_seconds"
	BuildLimitMemoryMB       = "memory_mb"
	BuildLimitCPUMillis      = "cpu_millis"
)

const (
	CanaryOutcomePromoted   = "promoted"
	CanaryOutcomeAborted    = "aborted"
	CanaryOutcomeRolledBack = "rolled_back"
)

const (
	AuditActionFamilyCLIPairing = "cli_pairing"
	AuditActionCLIPairCreated   = AuditActionFamilyCLIPairing + ".created"
	AuditActionCLIPaired        = AuditActionFamilyCLIPairing + ".paired"
	AuditActionCLIPairFailed    = AuditActionFamilyCLIPairing + ".failed"
	AuditActionCLIPairRevoked   = AuditActionFamilyCLIPairing + ".revoked"
)

const (
	AccessReviewOpen      = "open"
	AccessReviewCompleted = "completed"

	AccessDecisionKeep   = "keep"
	AccessDecisionRevoke = "revoke"

	AccessSubjectUser       = "user"
	AccessSubjectTeamMember = "team_member"
	AccessSubjectAPIToken   = "api_token"
	AccessSubjectEnvGrant   = "env_grant"

	EvidencePackRunning  = "running"
	EvidencePackComplete = "complete"
	EvidencePackFailed   = "failed"
)

const (
	ComposeRevisionSourceAPI      = "api"
	ComposeRevisionSourceTemplate = "template"
	ComposeRevisionSourceRollback = "rollback"
)

const (
	EnginePostgres    = "postgres"
	EngineRedis       = "redis"
	EngineMySQL       = "mysql"
	EngineMongoDB     = "mongodb"
	EngineMariaDB     = "mariadb"
	EngineKeyDB       = "keydb"
	EngineDragonfly   = "dragonfly"
	EngineClickHouse  = "clickhouse"
	EngineValkey      = "valkey"
	EngineMeilisearch = "meilisearch"
	EngineQdrant      = "qdrant"
	EngineTypesense   = "typesense"
	EngineMemcached   = "memcached"
)

const (
	PublicPortRangeStart = 20000
	PublicPortRangeEnd   = 20999
)

const (
	DatabaseAccessKindUser = "user"
	DatabaseAccessKindTemp = "temp"

	DatabaseAccessStateActive   = "active"
	DatabaseAccessStateRevoking = "revoking"
	DatabaseAccessStateRevoked  = "revoked"

	// DatabaseNetworkScopePlatform is the default scope.
	DatabaseNetworkScopePlatform = "platform"
)

const (
	DataImportCopying  = "copying"
	DataImportVerified = "verified"
	DataImportFailed   = "failed"
)

const (
	DBPasswordRotationIdle    = "idle"
	DBPasswordRotationPending = "pending"
	DBPasswordRotationFailed  = "failed"
)

const (
	DatabaseTLSModeDefault = "default"
	DatabaseTLSModeOn      = "on"
	DatabaseTLSModeOff     = "off"
)

const (
	DBUpgradeStatePending   = "pending"
	DBUpgradeStateBackingUp = "backing_up"
	DBUpgradeStateUpgrading = "upgrading"
	DBUpgradeStateVerifying = "verifying"
	DBUpgradeStateSucceeded = "succeeded"
	DBUpgradeStateReverted  = "reverted"
	DBUpgradeStateFailed    = "failed"
)

const (
	DBUpgradeSourceAuto   = "auto"
	DBUpgradeSourceManual = "manual"
)

const (
	DBAutoUpgradeOff   = "off"
	DBAutoUpgradePatch = "patch"
	DBAutoUpgradeMinor = "minor"
)

const (
	DeployApprovalActionDeploy  = "deploy"
	DeployApprovalActionPromote = "promote"
	// DeployApprovalActionMoveApp and DeployApprovalActionMoveDatabase gate
	// retagging a resource into or out of a protected environment; Image
	// then carries the target environment id.
	DeployApprovalActionMoveApp      = "move_app_environment"
	DeployApprovalActionMoveDatabase = "move_database_environment"
)

const (
	DeployApprovalStatusPending  = "pending"
	DeployApprovalStatusApproved = "approved"
	DeployApprovalStatusRejected = "rejected"
	DeployApprovalStatusExpired  = "expired"
	// DeployApprovalStatusApproving is held by one approver while the change
	// applies, so a racing approve, reject or expiry cannot land on the row.
	DeployApprovalStatusApproving = "approving"
)

const (
	DeployAttemptStatusRunning   = "running"
	DeployAttemptStatusSucceeded = "succeeded"
	DeployAttemptStatusFailed    = "failed"
	// DeployAttemptStatusHeld is an automatic deploy parked by a freeze
	// window, replayed once the window ends.
	DeployAttemptStatusHeld = "held"
	// DeployAttemptStatusSuperseded is a deploy that never wrote desired
	// state because a newer one already had.
	DeployAttemptStatusSuperseded = "superseded"
	// DeployAttemptStatusQueued is a deploy waiting for another deploy of
	// the same app, a freeze window or build capacity.
	DeployAttemptStatusQueued = "queued"
	// DeployAttemptStatusCanceled is a deploy stopped by an operator before
	// it wrote desired state.
	DeployAttemptStatusCanceled = "canceled"
	// DeployAttemptStatusPending is a change accepted for an offline node on
	// the operator's say-so; the node applies it when it reconnects.
	DeployAttemptStatusPending = "pending"
)

const (
	DeployAttemptSourceWebhook      = "webhook"
	DeployAttemptSourceGitPush      = "git_push"
	DeployAttemptSourceManual       = "manual"
	DeployAttemptSourceImage        = "image"
	DeployAttemptSourceCompose      = "compose"
	DeployAttemptSourcePromote      = "promote"
	DeployAttemptSourceAutoRollback = "auto_rollback"
	// DeployAttemptSourceRestart marks a restart of the running release:
	// same image, fresh container. It has its own row so a failed restart
	// never rewrites the deploy it re-ran.
	DeployAttemptSourceRestart = "restart"
	// DeployAttemptSourceStart marks starting a stopped app: it gives a
	// waiter an attempt that turns healthy only once the new container serves.
	DeployAttemptSourceStart = "start"
	// DeployAttemptSourceStop marks a stop queued while the app's node was offline.
	DeployAttemptSourceStop = "stop"
	// DeployAttemptSourceClone marks the first deploy of an app created
	// by cloning a whole environment (internal/api/environment_clone.go's
	// handleCloneEnvironment): a fresh app, same shape as the plain
	// image-tag path, just recorded under its own source so deploy
	// history can tell "created by cloning environment X" apart from an
	// ordinary manual create.
	DeployAttemptSourceClone = "clone"
	// DeployAttemptSourceSchedule marks a redeploy internal/scheduledeploy.
	// Scheduler fired for a due store.AppSchedule: the latest commit on
	// its configured branch, deployed through the same
	// internal/api.deployFromGitSourceAs path a webhook push uses.
	DeployAttemptSourceSchedule = "schedule"
	// DeployAttemptSourcePoll marks a deploy the git source poller started because a webhook never arrived.
	DeployAttemptSourcePoll = "poll"
	// DeployAttemptSourceUpload marks a build from a directory uploaded by the CLI instead of a git checkout.
	DeployAttemptSourceUpload = "upload"
	// DeployAttemptSourcePRComment marks a deploy or rollback a write-access user ran with a /levelrail pull request comment.
	DeployAttemptSourcePRComment = "pr_comment"
)

const (
	// DigestReasonResolved: the registry answered for the tag at deploy time.
	DigestReasonResolved = "Resolved"
	// DigestReasonPinned: the requested reference already carried a digest.
	DigestReasonPinned = "AlreadyPinned"
	// DigestReasonLocalBuild: the image ID of the image this deploy built.
	DigestReasonLocalBuild = "LocalBuild"
	// DigestReasonPullFailedUsingCached: the registry could not be reached,
	// so the locally cached image for the tag was used instead.
	DigestReasonPullFailedUsingCached = "PullFailedUsingCached"
	// DigestReasonLocalImage: the image exists only locally, with no registry digest.
	DigestReasonLocalImage = "LocalImage"
	// DigestReasonStaticTree: the digest hashes the published file tree of a
	// container-less static site.
	DigestReasonStaticTree = "StaticTree"
	// DigestReasonUnresolved: neither the registry nor the local cache knew
	// the tag; the node resolves it when it creates the container.
	DigestReasonUnresolved = "Unresolved"
)

const (
	RolloutStateServing  = "serving"
	RolloutStateMismatch = "mismatch"
	RolloutStateFailed   = "failed"
	// RolloutStateSuperseded marks a once-serving attempt that a newer one replaced.
	RolloutStateSuperseded = "superseded"
)

const (
	DeployReasonFrozen     = "Frozen"
	DeployReasonSuperseded = "Superseded"
	DeployReasonStale      = "StaleCommit"
	// DeployReasonPolled marks a deploy the poller started for a missed webhook.
	DeployReasonPolled = "DetectedByPoll"
)

const (
	TraceStatusRunning = "running"
	TraceStatusDone    = "done"
	TraceStatusFailed  = "failed"
	TraceStatusSkipped = "skipped"
	// TraceStatusWarning is a step that finished but flagged something, such
	// as a probe attempt that failed while the container was still starting.
	TraceStatusWarning = "warning"
)

const (
	DeploymentHeld       = "held"
	DeploymentQueued     = "queued"
	DeploymentAwaiting   = "awaiting_approval"
	DeploymentBuilding   = "building"
	DeploymentReady      = "ready"
	DeploymentFailed     = "failed"
	DeploymentCanceled   = "canceled"
	DeploymentRolledBack = "rolled_back"
	DeploymentSuperseded = "superseded"
)

const (
	DeploymentTriggerGitPush  = "git push"
	DeploymentTriggerManual   = "manual"
	DeploymentTriggerRollback = "rollback"
	DeploymentTriggerAPI      = "api"
	DeploymentTriggerPreview  = "preview"
	DeploymentTriggerSchedule = "schedule"
	DeploymentTriggerRestart  = "restart"
)

const (
	AuditActionFamilyDeviceLogin    = "device_login"
	AuditActionDeviceLoginApproved  = AuditActionFamilyDeviceLogin + ".approved"
	AuditActionDeviceLoginDenied    = AuditActionFamilyDeviceLogin + ".denied"
	AuditActionDeviceLoginExpired   = AuditActionFamilyDeviceLogin + ".expired"
	AuditActionDeviceLoginDismissed = AuditActionFamilyDeviceLogin + ".dismissed"
)

const (
	DeviceLoginStateWaiting  = "waiting"
	DeviceLoginStateExpired  = "expired"
	DeviceLoginStateDenied   = "denied"
	DeviceLoginStateApproved = "approved"
)

const (
	GateProviderExternal = "external"
	GateProviderBuiltin  = "builtin"
)

const (
	AuditActionDNSRecordCreated = "dns_record.created"
	AuditActionDNSRecordUpdated = "dns_record.updated"
	AuditActionDNSRecordDeleted = "dns_record.deleted"
)

const (
	DomainConditionDropped  = "dropped"
	DomainConditionDegraded = "degraded"
)

const (
	DomainCondCustomCertUnresolved = "custom_cert_unresolved"
	DomainCondBasicAuthUnresolved  = "basic_auth_unresolved"
	DomainCondDNS01Unavailable     = "dns01_unavailable"
	DomainCondTargetUnavailable    = "target_unavailable"
)

const (
	DomainErrorPageNotFound           = 404
	DomainErrorPageServerError        = 500
	DomainErrorPageBadGateway         = 502
	DomainErrorPageServiceUnavailable = 503
)

const (
	DomainRedirectPermanent = 301
	DomainRedirectTemporary = 302
)

const (
	DomainTLSCertCertificateEnvKey = "certificate"
	DomainTLSCertPrivateKeyEnvKey  = "private_key"
)

const (
	DomainWAFModeDetect = "detect"
	DomainWAFModeBlock  = "block"
)

const (
	EmailDeliverySent    = "sent"
	EmailDeliveryFailed  = "failed"
	EmailDeliveryBounced = "bounced"
)

const (
	EmailRolePrimary = "primary"
	EmailRoleBackup  = "backup"
)

const (
	EmailBackendSMTP     = "smtp"
	EmailBackendSES      = "ses"
	EmailBackendSESSMTP  = "ses_smtp"
	EmailBackendResend   = "resend"
	EmailBackendPostmark = "postmark"
	EmailBackendSendGrid = "sendgrid"
	EmailBackendMailgun  = "mailgun"
)

const (
	EmailSecretSMTPPassword    = "smtp_password"         //nolint:gosec // an envKey name, not a credential value
	EmailSecretSESSecretKey    = "ses_secret_access_key" //nolint:gosec // an envKey name, not a credential value
	EmailSecretSESSMTPPassword = "ses_smtp_password"     //nolint:gosec // an envKey name, not a credential value
	EmailSecretResendAPIKey    = "resend_api_key"        //nolint:gosec // an envKey name, not a credential value
	EmailSecretPostmarkToken   = "postmark_server_token" //nolint:gosec // an envKey name, not a credential value
	EmailSecretSendGridAPIKey  = "sendgrid_api_key"      //nolint:gosec // an envKey name, not a credential value
	EmailSecretMailgunAPIKey   = "mailgun_api_key"       //nolint:gosec // an envKey name, not a credential value
)

const (
	EnvChangeAdded   = "added"
	EnvChangeChanged = "changed"
	EnvChangeRemoved = "removed"
)

const (
	EnvironmentKindDev        = "dev"
	EnvironmentKindTest       = "test"
	EnvironmentKindUAT        = "uat"
	EnvironmentKindProduction = "production"
	EnvironmentKindPreview    = "preview"
	EnvironmentKindCustom     = "custom"
)

const (
	EnvironmentScopeProject = "project"
	EnvironmentScopeGlobal  = "global"
)

const (
	EventDeliveryPending   = "pending"
	EventDeliveryDelivered = "delivered"
	EventDeliveryDead      = "dead"
)

const (
	ExternalHealthReachable   = "reachable"
	ExternalHealthSlow        = "slow"
	ExternalHealthAuthFailed  = "auth_failed"
	ExternalHealthTLSError    = "tls_error"
	ExternalHealthUnreachable = "unreachable"
	ExternalHealthUnknown     = "unknown"
)

const (
	FunctionInvocationQueued  = "queued"
	FunctionInvocationRunning = "running"
	FunctionInvocationDone    = "done"
	FunctionInvocationDead    = "dead"
)

const (
	GateRuleUser = "user"
	GateRuleTeam = "team"
	GateRuleRole = "role"
)

const (
	GateDecisionAllowed        = "allowed"
	GateDecisionDenied         = "denied"
	GateDecisionLoginRedirect  = "login_redirect"
	GateDecisionTokenIssued    = "token_issued"
	GateDecisionTokenExchange  = "token_exchange"
	GateDecisionSessionRevoked = "session_revoked"
)

const (
	GitConnOK               = "ok"
	GitConnNeedsReauthorize = "needs_reauthorize"
	GitConnRevoked          = "revoked"
	GitConnRateLimited      = "rate_limited"
)

const (
	GitProviderGitLab    = "gitlab"
	GitProviderBitbucket = "bitbucket"
	GitProviderGitea     = "gitea"

	// GitProviderForgejo is a Forgejo instance, reached through the Gitea-compatible API.
	GitProviderForgejo = "forgejo"
	// GitProviderBitbucketServer is Bitbucket Server or Data Center, authenticated with a personal access token.
	GitProviderBitbucketServer = "bitbucket_server"
)

const (
	GitWebhookRegistered = "registered"
	GitWebhookFailed     = "failed"
)

const (
	HookTypePreDeploy  = "pre_deploy"
	HookTypePostDeploy = "post_deploy"
)

const (
	PrincipalTypeUser  = "user"
	PrincipalTypeToken = "token"
)

const (
	EndpointAPIOpenAI = "openai"
	EndpointAPIOllama = "ollama"
)

const (
	EndpointUnknown     = "unknown"
	EndpointOnline      = "online"
	EndpointSlow        = "slow"
	EndpointUnreachable = "unreachable"
	EndpointAuthFailed  = "auth_failed"
	EndpointError       = "error"
)

const (
	LoginApprovalPending  = "pending"
	LoginApprovalApproved = "approved"
	LoginApprovalDenied   = "denied"
	LoginApprovalExpired  = "expired"
	LoginApprovalConsumed = "consumed"
	// LoginApprovalSuperseded marks a request retired by a newer one.
	LoginApprovalSuperseded = "superseded"
)

const (
	LoginCodePending  = "pending"
	LoginCodeRedeemed = "redeemed"
	LoginCodeLocked   = "locked"
	LoginCodeExpired  = "expired"
)

const (
	AuditActionFamilyLoginCode   = "login_code"
	AuditActionLoginCodeRequest  = AuditActionFamilyLoginCode + ".requested"
	AuditActionLoginCodeDeliver  = AuditActionFamilyLoginCode + ".delivered"
	AuditActionLoginCodeRedeem   = AuditActionFamilyLoginCode + ".redeemed"
	AuditActionLoginCodeFail     = AuditActionFamilyLoginCode + ".failed"
	AuditActionLoginCodeLockout  = AuditActionFamilyLoginCode + ".locked"
	AuditActionLoginCodeExpire   = AuditActionFamilyLoginCode + ".expired"
	AuditActionFamilyNewDevice   = "new_device"
	AuditActionNewDeviceRequest  = AuditActionFamilyNewDevice + ".requested"
	AuditActionNewDeviceApprove  = AuditActionFamilyNewDevice + ".approved"
	AuditActionNewDeviceDeny     = AuditActionFamilyNewDevice + ".denied"
	AuditActionNewDeviceExpire   = AuditActionFamilyNewDevice + ".expired"
	AuditActionNewDeviceReplace  = AuditActionFamilyNewDevice + ".superseded"
	AuditActionFirstLoginTrust   = AuditActionFamilyNewDevice + ".first_login_trusted"
	AuditActionTrustedDeviceDrop = AuditActionFamilyNewDevice + ".trust_revoked"
	AuditActionApproverRevoke    = AuditActionFamilyNewDevice + ".approver_tokens_revoked"
)

const (
	MailBroadcastScheduled = "scheduled"
	MailBroadcastSending   = "sending"
	MailBroadcastCompleted = "completed"
	MailBroadcastCancelled = "cancelled"
	MailBroadcastFailed    = "failed"
)

const (
	MailRecipientPending    = "pending"
	MailRecipientSent       = "sent"
	MailRecipientFailed     = "failed"
	MailRecipientSuppressed = "suppressed"
	MailRecipientCancelled  = "cancelled"
)

const (
	MaintenanceScopeAll     = "all"
	MaintenanceScopeProject = "project"
	MaintenanceScopeApp     = "app"
)

const (
	MigrationAgentPending   = "pending"
	MigrationAgentConnected = "connected"
	MigrationAgentLost      = "lost"
	MigrationAgentRevoked   = "revoked"
	MigrationAgentExpired   = "expired"
)

const (
	HubItemPending  = "pending"
	HubItemCopying  = "copying"
	HubItemVerified = "verified"
	HubItemFailed   = "failed"
)

const (
	AuditActionFamilyMobile     = "mobile"
	AuditActionMobilePairCode   = AuditActionFamilyMobile + ".pairing_created"
	AuditActionMobilePaired     = AuditActionFamilyMobile + ".paired"
	AuditActionMobileRevoked    = AuditActionFamilyMobile + ".revoked"
	AuditActionMobilePairFailed = AuditActionFamilyMobile + ".pair_failed"
)

const (
	ComputeGPU = "gpu"
	ComputeCPU = "cpu"
	// ComputeExternal marks a model served by a server Levelrail does not run.
	ComputeExternal = "external"
)

const (
	ResidencyAlways   = "always"
	ResidencyOnDemand = "on_demand"

	ResidencyAwake  = "awake"
	ResidencyAsleep = "asleep"
	ResidencyWaking = "waking"
)

const (
	NetworkShareProtocolNFS  = "nfs"
	NetworkShareProtocolCIFS = "cifs"
)

const (
	CertKeyOriginAgent            = "agent"
	CertKeyOriginReenrollRequired = "reenroll_required"
)

const (
	NodeFailureModeOff    = "off"
	NodeFailureModeNotify = "notify"
	NodeFailureModeAuto   = "auto"
)

const (
	NodeFailurePhaseUnreachable = "unreachable"
	NodeFailurePhaseRecovering  = "recovering"
	NodeFailurePhaseLost        = "lost"
)

const (
	NodeFailureClassReschedule = "reschedule"
	NodeFailureClassDecision   = "needs_decision"

	NodeFailureActionPending = "pending"
	NodeFailureActionMoving  = "moving"
	NodeFailureActionMoved   = "moved"
	NodeFailureActionFenced  = "fenced"
	NodeFailureActionWaiting = "waiting"
	NodeFailureActionFailed  = "failed"
)

const (
	NodeJoinTokenPurposeEnroll   = "enroll"
	NodeJoinTokenPurposeReenroll = "reenroll"
)

const (
	NodeMoveKindApp      = "app"
	NodeMoveKindDatabase = "database"

	NodeMoveStatusRunning    = "running"
	NodeMoveStatusSucceeded  = "succeeded"
	NodeMoveStatusFailed     = "failed"
	NodeMoveStatusRolledBack = "rolled_back"
)

const (
	NodeProvisionStatusCreating   = "creating"
	NodeProvisionStatusBooting    = "booting"
	NodeProvisionStatusInstalling = "installing"
	NodeProvisionStatusEnrolling  = "enrolling"
	NodeProvisionStatusReady      = "ready"
	NodeProvisionStatusFailed     = "failed"
)

const (
	SecurityKindEnroll       = "enroll"
	SecurityKindReenroll     = "reenroll"
	SecurityKindCAPin        = "ca_pin"
	SecurityKindConnect      = "connect"
	SecurityKindCertIssued   = "cert_issued"
	SecurityKindRenewFailed  = "renew_failed"
	SecurityKindRevoke       = "revoke"
	SecurityKindRenewRequest = "renew_requested"
)

const (
	SecurityOutcomeAccepted = "accepted"
	SecurityOutcomeRejected = "rejected"
	SecurityOutcomeWarning  = "warning"
	SecurityOutcomeFailed   = "failed"
	SecurityOutcomeInfo     = "info"
)

const (
	SecurityReasonVerified            = "mutual_tls_verified"
	SecurityReasonExpired             = "expired"
	SecurityReasonNotYetValid         = "not_yet_valid"
	SecurityReasonUnknownCA           = "unknown_ca"
	SecurityReasonInvalidCert         = "invalid_certificate"
	SecurityReasonRevoked             = "revoked"
	SecurityReasonFingerprintMismatch = "fingerprint_mismatch"
	SecurityReasonUnknownNode         = "unknown_node"
	SecurityReasonNoCertificate       = "no_certificate"
	SecurityReasonPinned              = "pinned_verified"
	SecurityReasonTrustedCA           = "trusted_ca"
	SecurityReasonNotPinned           = "not_pinned"
	SecurityReasonNotReported         = "not_reported"
	SecurityReasonEnrollRefused       = "enroll_refused"
	SecurityReasonSignFailed          = "sign_failed"
	SecurityReasonRenewConflict       = "renewal_conflict"
	SecurityReasonUpgradeRequired     = "agent_upgrade_required"
	SecurityReasonReenrollRequired    = "reenroll_required"
)

const (
	CAPinPinned    = "pinned"
	CAPinTrustedCA = "trusted_ca"
	CAPinUnpinned  = "unpinned"
)

const (
	OAuthProviderGoogle      = "google"
	OAuthProviderGitHub      = "github"
	OAuthProviderOIDC        = "oidc"
	OAuthProviderMicrosoft   = "microsoft"
	OAuthProviderGitLab      = "gitlab"
	OAuthProviderBitbucket   = "bitbucket"
	OAuthProviderDiscord     = "discord"
	OAuthProviderSlack       = "slack"
	OAuthProviderLinkedIn    = "linkedin"
	OAuthProviderTwitch      = "twitch"
	OAuthProviderFacebook    = "facebook"
	OAuthProviderLinear      = "linear"
	OAuthProviderVercel      = "vercel"
	OAuthProviderHuggingFace = "huggingface"
	OAuthProviderFigma       = "figma"
	OAuthProviderSalesforce  = "salesforce"
	OAuthProviderCodeberg    = "codeberg"
	OAuthProviderCognito     = "cognito"
	OAuthProviderDropbox     = "dropbox"
	OAuthProviderKakao       = "kakao"
	OAuthProviderPatreon     = "patreon"
)

const (
	HoldPending  = "pending"
	HoldApproved = "approved"
	HoldRejected = "rejected"
)

const (
	TriggerStarted = "started"
	TriggerHeld    = "held"
	TriggerSkipped = "skipped"
	TriggerFailed  = "failed"
)

const (
	WebhookOutcomeReceived = "received"
	WebhookOutcomeStarted  = "started"
	WebhookOutcomeRejected = "rejected"
	WebhookOutcomeFailed   = "failed"
)

const (
	PipelineStatusQueued          = "queued"
	PipelineStatusPending         = "pending"
	PipelineStatusRunning         = "running"
	PipelineStatusWaitingApproval = "waiting_approval"
	PipelineStatusSucceeded       = "succeeded"
	PipelineStatusFailed          = "failed"
	PipelineStatusCancelled       = "cancelled"
	PipelineStatusSkipped         = "skipped"
)

const (
	PredeployModeOff     = "off"
	PredeployModeOn      = "on"
	PredeployModeRequire = "require"
)

const (
	PredeploySnapshotSucceeded = "succeeded"
	PredeploySnapshotFailed    = "failed"
	PredeployRestoreRunning    = "running"
	PredeployRestoreSucceeded  = "succeeded"
	PredeployRestoreFailed     = "failed"
)

const (
	PreviewDatabaseIsolationStatusProvisioned    = "provisioned"
	PreviewDatabaseIsolationStatusTeardownFailed = "teardown_failed"
)

const (
	PreviewStatusDeploying = "deploying"
	PreviewStatusActive    = "active"
	PreviewStatusFailed    = "failed"
	// PreviewStatusAwaitingApproval marks a fork pull request held back
	// until an operator approves it; nothing is deployed in this state.
	PreviewStatusAwaitingApproval = "awaiting_approval"
	// PreviewStatusLimitReached marks a pull request rejected because the
	// preview cap was full and the app's policy is to reject.
	PreviewStatusLimitReached = "limit_reached"
)

const (
	PreviewEphemeralDatabaseStatusProvisioned    = "provisioned"
	PreviewEphemeralDatabaseStatusTeardownFailed = "teardown_failed"
	PreviewEphemeralDatabaseStatusSeedFailed     = "seed_failed"
)

const (
	PreviewOnLimitEvictOldest = "evict_oldest"
	PreviewOnLimitReject      = "reject"
)

const (
	PreviewDatabaseStrategyNone   = "none"
	PreviewDatabaseStrategyShared = "shared"
	PreviewDatabaseStrategyFresh  = "fresh"
	PreviewDatabaseStrategySeed   = "seed"
)

const (
	ProxyIntegrationOff         = "off"
	ProxyIntegrationTraefikFile = "traefik_file"
	ProxyIntegrationNginxFile   = "nginx_file"
)

const (
	ProxyLoadedUnknown = "unknown"
	ProxyLoadedYes     = "yes"
	ProxyLoadedNo      = "no"
)

const (
	AuditActionFamilyProxyRoute = "proxy_route"
	AuditActionProxyRouteWrite  = AuditActionFamilyProxyRoute + ".written"
	AuditActionProxyRouteRemove = AuditActionFamilyProxyRoute + ".removed"
)

const (
	AdvisorFindingDismissed = "dismissed"
	AdvisorFindingSnoozed   = "snoozed"
)

const (
	LabelKindApp      = "app"
	LabelKindDatabase = "database"
	LabelKindStack    = "stack"
)

const (
	ResourceKindApp      = "app"
	ResourceKindDatabase = "database"
	ResourceKindNode     = "node"
	ResourceKindDomain   = "domain"
	ResourceKindBucket   = "bucket"
	ResourceKindNetwork  = "network"
)

const (
	ResourceOpAdded    = "ADDED"
	ResourceOpModified = "MODIFIED"
	ResourceOpDeleted  = "DELETED"
)

const (
	EnvResourceChangesRetain       = "APP_RESOURCE_CHANGES_RETAIN"
	EnvResourceChangesMaxAge       = "APP_RESOURCE_CHANGES_MAX_AGE"
	EnvResourceChangesCompactEvery = "APP_RESOURCE_CHANGES_COMPACT_EVERY"
)

const (
	RoleVisibilityAll     = "all"
	RoleVisibilityGranted = "granted"
)

const (
	Route53DNSAccessKeyIDEnvKey     = "access_key_id"
	Route53DNSSecretAccessKeyEnvKey = "secret_access_key"
)

const (
	SavedLogQueryPrivate  = "private"
	SavedLogQueryInstance = "instance"
)

const (
	ScheduledDeployKindImage = "image"
	ScheduledDeployKindGit   = "git"

	ScheduledDeployPending         = "pending"
	ScheduledDeployRunning         = "running"
	ScheduledDeployFired           = "fired"
	ScheduledDeployPendingApproval = "pending_approval"
	ScheduledDeploySkippedFreeze   = "skipped_freeze"
	ScheduledDeployMissed          = "missed"
	ScheduledDeployCanceled        = "canceled"
	ScheduledDeployFailed          = "failed"
)

const (
	ScheduledTaskStatusSuccess             = "success"
	ScheduledTaskStatusFailed              = "failed"
	ScheduledTaskStatusTimeout             = "timeout"
	ScheduledTaskStatusContainerNotRunning = "container_not_running"
	// ScheduledTaskStatusSkippedConcurrency is recorded when
	// ConcurrencyPolicy is "forbid" and a previous run of the same task
	// was still in flight, so a skipped tick stays visible in run
	// history instead of silently vanishing.
	ScheduledTaskStatusSkippedConcurrency = "skipped_concurrency"
	// ScheduledTaskStatusReplaced is recorded on the run that
	// ConcurrencyPolicy "replace" cancelled to make room for a newer
	// invocation of the same task.
	ScheduledTaskStatusReplaced = "replaced"
	// ScheduledTaskStatusRunning is the in-flight state of a history row.
	ScheduledTaskStatusRunning = "running"
	// ScheduledTaskStatusMissed marks an occurrence the control plane did
	// not run (it was down, and catch-up did not cover it).
	ScheduledTaskStatusMissed = "missed"
	// ScheduledTaskStatusInterrupted marks a run whose control plane
	// restarted mid-flight; it is never re-run, to rule out a double run.
	ScheduledTaskStatusInterrupted = "interrupted"
)

const (
	ScheduledTaskModeExec        = "exec"
	ScheduledTaskModeFresh       = "fresh"
	ScheduledTaskCatchUpSkip     = "skip"
	ScheduledTaskCatchUpRunOnce  = "run_once"
	ScheduledTaskSourceAPI       = "api"
	ScheduledTaskSourceSpec      = "spec"
	ScheduledTaskTriggerSchedule = "schedule"
	ScheduledTaskTriggerManual   = "manual"
	ScheduledTaskTriggerAPI      = "api"
)

const (
	ScheduledTaskConcurrencyAllow   = "allow"
	ScheduledTaskConcurrencyForbid  = "forbid"
	ScheduledTaskConcurrencyReplace = "replace"
	// ScheduledTaskConcurrencyQueue waits for the in-flight run to finish
	// and then runs, so overlapping occurrences execute one after another.
	ScheduledTaskConcurrencyQueue = "queue"
)

const (
	SecretRotationIdle          = "idle"
	SecretRotationRestartFailed = "restart_failed"
	SecretRotationFailed        = "failed"
	SecretRotationPending       = "restart_pending"
)

const (
	AuditActionFamilySecurity        = "security"
	AuditActionSessionRevoke         = AuditActionFamilySecurity + ".session_revoked"
	AuditActionSessionRevokeOthers   = AuditActionFamilySecurity + ".sessions_revoked"
	AuditActionSecurityPolicyUpdate  = AuditActionFamilySecurity + ".policy_updated"
	AuditActionDeviceApprovalToggle  = AuditActionFamilySecurity + ".device_approval_changed"
	AuditActionNewBrowserSignIn      = AuditActionFamilySecurity + ".new_browser_sign_in"
	AuditActionSignInDisowned        = AuditActionFamilySecurity + ".sign_in_disowned"
	AuditActionTokenUnusedNotice     = AuditActionFamilySecurity + ".token_unused_notice"
	AuditActionTokenUnusedDisabled   = AuditActionFamilySecurity + ".token_unused_disabled"
	AuditActionFailedLoginsThreshold = AuditActionFamilySecurity + ".failed_logins"
)

const (
	ProbeKindHTTP = "http"
	ProbeKindTCP  = "tcp"
	ProbeKindExec = "exec"
)

const (
	PortProtocolTCP = spec.PortProtocolTCP
	PortProtocolUDP = spec.PortProtocolUDP
)

const (
	AutoRollbackSLOBurnOff           = "off"
	AutoRollbackSLOBurnAuto          = "auto"
	AutoRollbackSLOBurnDryRun        = "dry_run"
	AutoRollbackSLOBurnPauseForHuman = "pause_for_human"
)

const (
	DefaultDeployStrategy = "blue-green"
	DefaultReplicas       = 1
	// DefaultBindAddress mirrors internal/bindaddr.Default (same value,
	// same "define locally" reasoning above): loopback-only, the safe
	// default for a service whose caller never set BindAddress.
	DefaultBindAddress = "private"
)

const (
	RestartPolicyNo            = spec.RestartPolicyNo
	RestartPolicyOnFailure     = spec.RestartPolicyOnFailure
	RestartPolicyAlways        = spec.RestartPolicyAlways
	RestartPolicyUnlessStopped = spec.RestartPolicyUnlessStopped
)

const (
	SessionOnLimitEvictOldest = "evict_oldest"
	SessionOnLimitReject      = "reject"
)

const (
	SetupGuideOverrideSkipped = "skipped"
	SetupGuideOverrideDone    = "done"
)

const (
	SleepEventSlept      = "slept"
	SleepEventWoke       = "woke"
	SleepEventEnabled    = "enabled"
	SleepEventDisabled   = "disabled"
	SleepEventWakeFailed = "wake_failed"

	SleepReasonIdleTimeout = "idle_timeout"
	SleepReasonManual      = "manual"
	SleepReasonRequest     = "request"
	SleepReasonSchedule    = "schedule"
	SleepReasonDeploy      = "deploy"
	SleepReasonAPI         = "api"
	SleepReasonPort        = "port"

	EnvSleepEventsKeep = "APP_SLEEP_EVENTS_KEEP"
)

const (
	SplitStatusRunning = "running"
	SplitStatusStopped = "stopped"
)

const (
	SSHNodeProvisionStatusConnecting = "connecting"
	SSHNodeProvisionStatusDetecting  = "detecting"
	SSHNodeProvisionStatusInstalling = "installing"
	SSHNodeProvisionStatusEnrolling  = "enrolling"
	SSHNodeProvisionStatusReady      = "ready"
	SSHNodeProvisionStatusFailed     = "failed"
)

const (
	StackRevPendingApproval = "pending_approval"
	StackRevApplying        = "applying"
	StackRevApplied         = "applied"
	StackRevPartial         = "partial"
	StackRevFailed          = "failed"
	StackRevSuperseded      = "superseded"
)

const (
	StackDriftNone    = "none"
	StackDriftDrifted = "drifted"
)

const (
	StorageBucketPurposeApp    = "app"
	StorageBucketPurposeAssets = "assets"
)

const (
	StackVerbPlan  = "plan"
	StackVerbApply = "apply"
)

const (
	TeamRoleOwner     = "owner"
	TeamRoleAdmin     = "admin"
	TeamRoleDeveloper = "developer"
	TeamRoleViewer    = "viewer"
)

const (
	TrafficExportSaltService = "traffic-export"
	TrafficExportSaltKey     = "visitor_salt"
)

const (
	TrafficSinkPostHog = "posthog"
	TrafficSinkOTLP    = "otlp"
	TrafficSinkWebhook = "webhook"
)

const (
	UpgradeNotesPending     = "pending"
	UpgradeNotesFetched     = "fetched"
	UpgradeNotesUnavailable = "unavailable"
)

const (
	UpgradeSchedulePending   = "pending"
	UpgradeScheduleBlocked   = "blocked"
	UpgradeScheduleRunning   = "running"
	UpgradeScheduleApplied   = "applied"
	UpgradeScheduleFailed    = "failed"
	UpgradeScheduleCancelled = "cancelled"
	UpgradeScheduleMissed    = "missed"
)

const (
	UpgradeSourceManual = "manual"
	UpgradeSourceAuto   = "auto"
	UpgradeModeAt       = "at"
	UpgradeModeWindow   = "window"
)

const (
	VaultAuthMethodToken   = "token"
	VaultAuthMethodAppRole = "approle"
)

const AIProviderAnthropic = "anthropic"

const AgentEndpointScheme = "agent://"

const AppStreamProtocolTCP = "tcp"

const AppliedFieldFiles = "files"

const AuditActionDomainMaintenanceEnded = "domain_maintenance.ended"

const AuditActionEmailSecretRevealed = "email.secret.reveal"

const AuditActionEmailSecretsChanged = "email_provider.secrets_changed"

const AuditActionLegacyTokenMigrated = "api_token.legacy_migrated"

const AuditActionSSHProvisionHostKeySkipped = "node_ssh_provision.host_key_skipped"

const AuditActionTrafficExportSecretsChanged = "traffic_export.secrets_changed"

const CLIPairingLookupPrefix = "cli:"

const CanaryServiceSuffix = "--canary"

const CloudflareDNSTokenEnvKey = "token"

const CloudflareTunnelTokenEnvKey = "token"

const DBUpgradePlatformDefault = "*"

const DatabaseAccessTimeLayout = "2006-01-02T15:04:05Z"

const DefaultGitHubActionsEnvironment = "production"

const DefaultMaxKeyAgeDays = 90

const DefaultModelKeyName = "default"

const DefaultRemindEveryDays = 7

const DefaultTeamID = "org_default"

const DeployFreezeScopeGlobal = "global"

const DeployReasonCanceled = "Canceled"

const DeploymentSummaryDays = 14

const DomainBasicAuthPasswordEnvKey = "password"

const EgressModeAllowlist = "allowlist"

const EmailPrimaryProviderID = "prov_primary"

const EnvCachePurgeKeep = "APP_CACHE_PURGE_HISTORY_KEEP"

const (
	// EnvReadConns sizes the read-only connection pool. 0 sends reads to the writer connection.
	EnvReadConns = "APP_DB_READ_CONNS"
)

const ExternalDatabasePasswordKey = "password"

const GlobalProjectID = "proj_global"

const GoogleCloudDNSKeyEnvKey = "service_account_json"

const InstanceMarkerFile = "instance.marker"

const LocalEndpointScheme = "local://"

const LocalNodeGPUKey = "local"

const MailTemplateVersionsKept = 10

const MajorUpgradeStatusRolledBack = "rolled_back"

const MaxDNSTTLSeconds = 86400

const MaxPublicHTTPSPort = 65535

const MaxWebhookDeliveryPayloadBytes = 64 * 1024

const NodeProviderTokenEnvKey = "token"

const OAuthProviderSecretEnvKey = "client_secret"

const PackageRegistrySecretEnvKey = "secret"

const PipelineFilterHeld = "held"

const PipelineTriggerLogKeep = 200

const PullPolicyAlways = "always"

const RegistryPasswordEnvKey = "password"

const ScheduledTaskModeHTTP = "http"

const StandaloneDomainOwner = "standalone domain"

const TraceSummaryKey = "deploy_summary"

const VaultCredentialEnvKey = "credential"

const VolumeQuiescePause = "pause"

const WakeTimingSamples = 50