selfupgrade

type Attempt struct {
	ID          string       `json:"id"`
	FromVersion string       `json:"from_version"`
	ToVersion   string       `json:"to_version"`
	FromSchema  int          `json:"from_schema"`
	ToSchema    int          `json:"to_schema"`
	Initiator   string       `json:"initiator"`
	Outcome     string       `json:"outcome"`
	FailedStep  string       `json:"failed_step,omitempty"`
	Error       string       `json:"error,omitempty"`
	BackupName  string       `json:"backup_name,omitempty"`
	Acked       []string     `json:"acked,omitempty"`
	Steps       []StepRecord `json:"steps"`
	// Current is the step in flight, so a watcher sees it before it ends.
	Current string `json:"current_step,omitempty"`
	// Log is a bounded stream of step events for the live progress view.
	Log        []LogLine `json:"log,omitempty"`
	StartedAt  time.Time `json:"started_at"`
	FinishedAt time.Time `json:"finished_at,omitempty"`

	// DatabaseRestored is set when a rollback put the snapshot back, and
	// RolledBackMinutes is how long the discarded changes span.
	DatabaseRestored  bool      `json:"database_restored,omitempty"`
	RolledBackMinutes int       `json:"rolled_back_minutes,omitempty"`
	RestorePointID    string    `json:"restore_point_id,omitempty"`
	AgentsBefore      int       `json:"agents_before,omitempty"`
	SnapshotAt        time.Time `json:"snapshot_at,omitempty"`

	PrevBinary    string `json:"prev_binary,omitempty"`
	SnapshotPath  string `json:"snapshot_path,omitempty"`
	SwappedBinary bool   `json:"swapped_binary,omitempty"`
}

type AttemptStore interface {
	UpsertSelfUpgradeAttempt(ctx context.Context, a store.SelfUpgradeAttempt) error
}

type BackupInfo struct {
	Name         string
	SnapshotPath string
}

type Breaking struct {
	ID          string `json:"id"`
	Version     string `json:"version"`
	Summary     string `json:"summary"`
	RequiresAck bool   `json:"requires_ack"`
	Source      string `json:"source"`
}

type Deps struct {
	BinaryPath string
	WorkDir    string
	Asset      string
	Journal    *Journal
	Log        *slog.Logger
	Now        func() time.Time

	Fetch       func(ctx context.Context, tag, asset, dir string) (Fetched, error)
	VerifySig   func(ctx context.Context, checksumsPath, bundlePath string) (string, error)
	Probe       func(ctx context.Context, binary string) (ProbeInfo, error)
	DBSchema    func(ctx context.Context) (int, error)
	Backup      func(ctx context.Context) (BackupInfo, error)
	MigrateTest func(ctx context.Context, binary, snapshotPath string) (int, error)
	Stop        func(ctx context.Context) error
	Start       func(ctx context.Context) error
	WaitHealthy func(ctx context.Context, timeout time.Duration) error
	// RestorePoint keeps the snapshot, binary and unit file as a restore point
	// and returns its id. Optional.
	RestorePoint func(ctx context.Context, a Attempt, snapshotPath string) (string, error)
	// AgentsOnline counts connected agents before the stop, for Verify. Optional.
	AgentsOnline func(ctx context.Context) (int, error)
	// Verify judges the new release inside the health window. When nil,
	// WaitHealthy alone decides.
	Verify func(ctx context.Context, window time.Duration, want VerifyExpect) (string, error)
	// RestoreUnit puts a saved unit file back and reloads the service manager.
	RestoreUnit func(ctx context.Context, savedPath string) error
	// RestoreDB puts the snapshot in place of the live database and returns
	// where the replaced database was kept.
	RestoreDB   func(ctx context.Context, snapshotPath string) (string, error)
	WriteMarker func(ctx context.Context, a Attempt) error
	ClearMarker func()
	Audit       func(ctx context.Context, detail string) error
}

type Fetched struct {
	BinaryPath    string
	ChecksumsPath string
	BundlePath    string
}

type Fetcher struct {
	// BaseURL is the release download prefix with the tag as its last path
	// segment appended by Fetch, for example https://host/org/repo/releases/download.
	BaseURL string
	Client  *http.Client
	// AllowHTTP permits a plain-http BaseURL, for tests against a local server.
	AllowHTTP bool
	MaxBytes  int64
	// RedirectHosts, when set, limits redirects to these hosts and their
	// subdomains, so a release asset cannot bounce the server to an internal address.
	RedirectHosts []string
}

type GuardInput struct {
	BinaryVersion string
	BinarySchema  int
	DBSchema      int
	// DBVersion is the release that last ran on the database, "" if unknown.
	DBVersion string
	// Program is the executable's name, used in the recovery commands.
	Program string
	// InstallerCommand is the verified installer invocation prefix, for
	// example "curl -fsSL <url> | sudo".
	InstallerCommand string
}

type Journal struct {
	Dir string
}

type LogLine struct {
	At   time.Time `json:"at"`
	Step string    `json:"step,omitempty"`
	Line string    `json:"line"`
}

type Pin struct {
	Version    string
	VerifiedAt time.Time
}

type ProbeInfo struct {
	Version string
	Schema  int
}

type ReleaseNotes struct {
	Tag  string
	Body string
}

type Request struct {
	ID             string
	CurrentVersion string
	TargetVersion  string
	Initiator      string
	Breaking       []Breaking
	Acked          []string
	HealthTimeout  time.Duration
}

type RestorePoint struct {
	ID        string    `json:"id"`
	Version   string    `json:"version"`
	Schema    int       `json:"schema"`
	AttemptID string    `json:"attempt_id,omitempty"`
	CreatedAt time.Time `json:"created_at"`
	SizeBytes int64     `json:"size_bytes"`
	HasBinary bool      `json:"has_binary"`
	HasUnit   bool      `json:"has_unit"`
}

type RestorePointStore interface {
	ReplaceUpgradeRestorePoints(ctx context.Context, pts []store.UpgradeRestorePoint) error
}

type RestorePoints struct{ Dir string }

type SchemaResult struct {
	Version string
	Schema  int
	// Detail is the signature verification note.
	Detail string
}

type Signer struct {
	Mode           string
	CosignPath     string
	IdentityRegexp string
	Issuer         string
	// Pinned is set once this host has verified a release signature: from
	// then on a missing bundle or cosign is refused unless Mode is off.
	Pinned bool
	// OnVerified runs after a successful verification, to write the pin.
	OnVerified func()
	// TUFCacheDir keeps Sigstore trust metadata between runs; empty uses the default.
	TUFCacheDir string
	// Run executes an external cosign; when it and CosignPath are both unset
	// the signature is verified in process.
	Run func(ctx context.Context, name string, args ...string) ([]byte, error)
}

type StepFailure struct {
	Cause string `json:"cause"`
	// Primary is the one button to lead with: cleanup, retry, rollback or none.
	Primary string `json:"primary"`
	// FixID is the fixit fix behind a cleanup primary.
	FixID string `json:"fix_id,omitempty"`
	// Retryable and Rollbackable say which buttons make sense.
	Retryable    bool `json:"retryable"`
	Rollbackable bool `json:"rollbackable"`
	// CLI is the host-side equivalent, shown collapsed.
	CLI string `json:"cli,omitempty"`
}

type StepRecord struct {
	Name       string    `json:"name"`
	Status     string    `json:"status"`
	Detail     string    `json:"detail,omitempty"`
	At         time.Time `json:"at"`
	DurationMS int64     `json:"duration_ms"`
}

type TrustRoot struct {
	// contains filtered or unexported fields
}

type VerifyExpect struct {
	// Schema is the database schema head of the new release.
	Schema int
	// AgentsOnline is how many agents were connected before the upgrade.
	AgentsOnline int
}