iac

type Action string

type ApplyResult struct {
	Plan    Plan         `json:"plan"`
	Results []ItemResult `json:"results"`
	Applied int          `json:"applied"`
	Failed  int          `json:"failed"`
	Skipped int          `json:"skipped"`
}

type Change struct {
	Kind     Kind          `json:"kind"`
	Name     string        `json:"name"`
	Scope    string        `json:"scope,omitempty"`
	Action   Action        `json:"action"`
	Fields   []FieldChange `json:"fields,omitempty"`
	Kept     []FieldChange `json:"kept,omitempty"`
	Warnings []string      `json:"warnings,omitempty"`
	// Services are display only compose preview rows; the plan hash never reads them.
	Services []ComposeServiceRow `json:"services,omitempty"`
	Reason   string              `json:"reason,omitempty"`
	// Code is the frozen machine code of a failed item; empty otherwise.
	Code string `json:"code,omitempty"`
	// DependsOn lists the resources this item reads from, applied first.
	DependsOn []string `json:"dependsOn,omitempty"`
	Denied    bool     `json:"denied,omitempty"`
	// LiveID is the live identifier a ledger records; it never leaves the process.
	LiveID string `json:"-"`
	File   string `json:"file,omitempty"`
	Line   int    `json:"line,omitempty"`
	// CloudPlanHash names the sealed engine plan a cloud item runs; approval binds to it.
	CloudPlanHash string `json:"cloudPlanHash,omitempty"`
	// ComposeDigest covers a compose App's file bytes and inputs; it never leaves the process.
	ComposeDigest string `json:"-"`
}

type CloudApplier interface {
	ApplyCloud(ctx context.Context, req CloudApplyRequest) (CloudApplyResult, error)
}

type CloudApplyRequest struct {
	Stack    string
	Target   CloudResource
	Group    []CloudResource
	PlanHash string
	Destroy  bool
}

type CloudApplyResult struct {
	Diverged     bool
	QuarantineID int64
}

type CloudApproval struct {
	Pins           map[string]Change
	ConfirmDestroy bool
}

type CloudAttr struct {
	Path      string
	Old, New  string
	Sensitive bool
}

type CloudChange struct {
	Address string
	Type    string
	Action  string
}

type CloudDiff struct {
	Action string
	// Type is the provider resource type, used by policy checks only.
	Type  string
	Attrs []CloudAttr
	// PlanHash is the sealed engine plan this diff came from.
	PlanHash string
}

type CloudOutcome struct {
	Diff CloudDiff
	Err  error
}

type CloudPlanner interface {
	PlanCloud(ctx context.Context, r CloudResource) (CloudDiff, error)
}

type CloudReadiness interface {
	CloudReady() bool
}

type CloudRefusal struct {
	Code    string
	Address string
	Message string
}

type CloudReport struct {
	// contains filtered or unexported fields
}

type CloudResource struct {
	Kind Kind
	Name string
	Spec map[string]any
}

type CloudRun struct {
	PlanHash     string
	Items        []string
	Diverged     bool
	QuarantineID int64
	Failed       bool
}

type CloudStackPlanner interface {
	PlanCloudStack(ctx context.Context, stack string, rs []CloudResource) []CloudOutcome
}

type ComposeBody struct {
	Data []byte
	Env  map[string]string
}

type ComposeLimits struct {
	Enabled       bool
	MaxFileBytes  int
	MaxFiles      int
	MaxTotalBytes int
}

type ComposeServiceRow struct {
	Service string `json:"service"`
	Action  Action `json:"action"`
	Image   string `json:"image,omitempty"`
}

type CoverageRow struct {
	Kind    Kind
	Feature string
	Status  CoverageStatus
	// Code is the frozen machine code of the rejection, empty when the
	// rejection is a plain builder message identified by Reason.
	Code string
	// Reason is the rejection text a user sees (a substring of it).
	Reason string
	Probe  string
}

type CoverageStatus string

type Document struct {
	File     string
	Line     int
	Kind     Kind
	Name     string
	Labels   map[string]string
	Root     *yaml.Node
	SpecNode *yaml.Node
}

type Doer interface {
	Do(ctx context.Context, method, path string, body, out any) error
}

type DriftPolicy string

type ExportFile struct {
	Name    string `json:"name"`
	Kind    Kind   `json:"kind"`
	Content string `json:"content"`
}

type ExportOptions struct {
	Project string
	App     string
	// Database and Node each export that one resource alone.
	Database string
	Node     string
	// Settings exports only the saved, non-sensitive runtime settings.
	Settings bool
	// IncludeEnvValues writes literal env values; when false every value
	// becomes a ${{ env.NAME }} placeholder.
	IncludeEnvValues bool
}

type ExportResult struct {
	Files    []ExportFile `json:"files"`
	Warnings []string     `json:"warnings,omitempty"`
}

type FieldChange struct {
	Path string `json:"path"`
	Op   string `json:"op"`
	Old  string `json:"old,omitempty"`
	New  string `json:"new,omitempty"`
}

type GitMeta struct {
	Repo     string `json:"git_repo,omitempty"`
	Ref      string `json:"git_ref,omitempty"`
	SHA      string `json:"git_sha,omitempty"`
	CIRunURL string `json:"ci_run_url,omitempty"`
}

type Issue struct {
	File    string `json:"file,omitempty"`
	Path    string `json:"path,omitempty"`
	Line    int    `json:"line"`
	Message string `json:"message"`
	// Code is a frozen machine code when the issue has one.
	Code string `json:"code,omitempty"`
}

type ItemResult struct {
	Change
	Status string `json:"status"`
	Error  string `json:"error,omitempty"`
}

type Kind string

type Ledger struct {
	StackID   string
	StackName string
	// Scope is the stack scope; empty means project.
	Scope StackLevel
	// ScopeProject is the stack's own project; an admin bound it to the stack,
	// so declaring it claims it without an explicit adopt.
	ScopeProject string
	// Owned maps resource keys this stack owns to their entries.
	Owned map[string]LedgerEntry
	// Foreign maps keys owned by some other stack to that stack's id.
	Foreign map[string]string
	// Adopt lets the stack claim existing resources no stack owns.
	Adopt bool
	// AllowMassPrune confirms a prune above the guard thresholds.
	AllowMassPrune bool
	Guard          PruneGuard
}

type LedgerEntry struct {
	StackID       string `json:"stack_id"`
	Kind          Kind   `json:"kind"`
	Key           string `json:"key"`
	LiveID        string `json:"live_id"`
	SinceRevision int    `json:"since_revision"`
}

type LedgerRef struct {
	Kind Kind
	Key  string
}

type LedgerUpdate struct {
	Claim   []LedgerEntry
	Release []LedgerEntry
}

type Options struct {
	// Vars resolve ${{ env.NAME }} placeholders.
	Vars map[string]string
	// Source names this apply source; apps it creates carry a managed-by
	// tag and only those are ever pruned.
	Source string
	// Secrets maps "NAME" or "app/NAME" to a value to store at apply time.
	// Values never appear in a plan, result or export.
	Secrets map[string]string
	// Project limits prune to managed apps of this project, matching the
	// project filter applied to the files.
	Project string
	// BelowRoot is set by a caller whose token is under the root tier; job
	// writes then fail the plan instead of stopping partway.
	BelowRoot bool
	// Prune deletes managed resources absent from the files.
	Prune bool
	// NoDeploy skips the restart that applies an env change to a running app.
	NoDeploy bool
	// ContinueOnError keeps applying after an item fails.
	ContinueOnError bool
	// Cloud is the approved cloud plan; without it every cloud write is refused.
	Cloud *CloudApproval
	// Attachments holds referenced compose files by cleaned relative path.
	Attachments map[string][]byte
	// ComposeEnvApplied maps a compose App to the env digest its stack last
	// applied, since a compose revision never stores env values.
	ComposeEnvApplied map[string]string
	// ConfirmDestroy is set server side when the caller typed the stack name;
	// a prune never removes a compose App without it.
	ConfirmDestroy bool
}

type Plan struct {
	Source  string   `json:"source,omitempty"`
	Prune   bool     `json:"prune,omitempty"`
	Changes []Change `json:"changes"`
	Summary Summary  `json:"summary"`
	Hash    string   `json:"hash"`
	// Warnings are plan-wide notes; the hash never reads them.
	Warnings []string `json:"warnings,omitempty"`
}

type PolicyChecker interface {
	CheckCloud(changes []CloudChange) []CloudRefusal
}

type PruneGuard struct {
	MaxPercent int
	MaxCount   int
}

type Resource struct {
	Kind   Kind
	Name   string
	Scope  string
	Doc    *Document
	Fields map[string]any
	// SecretRefs are app env names backed by the secrets store.
	SecretRefs []string
	// ExistingSecrets are SecretRefs that must already be in the store.
	ExistingSecrets []string
	Warnings        []string
	// ComposeDigest is set for compose Apps and feeds the plan hash.
	ComposeDigest string
	// contains filtered or unexported fields
}

type Revision struct {
	StackID        string         `json:"stack_id"`
	Number         int            `json:"number"`
	Status         RevisionStatus `json:"status"`
	PlanHash       string         `json:"plan_hash"`
	PlanJSON       []byte         `json:"plan,omitempty"`
	RenderedDocs   []byte         `json:"rendered_docs,omitempty"`
	RollbackOf     int            `json:"rollback_of,omitempty"`
	IdempotencyKey string         `json:"idempotency_key,omitempty"`
	Actor          string         `json:"actor"`
	TokenID        string         `json:"token_id,omitempty"`
	Git            GitMeta        `json:"git"`
	CreatedAt      time.Time      `json:"created_at"`
	FinishedAt     *time.Time     `json:"finished_at,omitempty"`
	ResultJSON     []byte         `json:"result,omitempty"`
}

type RevisionStatus string

type Source struct {
	Name string
	Data []byte
}

type Stack struct {
	ID              string      `json:"id"`
	Name            string      `json:"name"`
	ProjectID       string      `json:"project_id"`
	EnvironmentID   string      `json:"environment_id,omitempty"`
	Scope           StackLevel  `json:"scope,omitempty"`
	AllowPrune      bool        `json:"allow_prune"`
	DriftPolicy     DriftPolicy `json:"drift_policy"`
	PinnedRevision  int         `json:"pinned_revision,omitempty"` // 0 means not pinned
	RequireApproval bool        `json:"require_approval"`
	CreatedAt       time.Time   `json:"created_at"`
	CreatedBy       string      `json:"created_by"`
}

type StackDeleteMode string

type StackLevel string

type StackLock struct {
	StackID   string    `json:"stack_id"`
	Holder    string    `json:"holder"`
	Revision  int       `json:"revision"`
	ExpiresAt time.Time `json:"expires_at"`
}

type StackScope struct {
	StackID   string
	StackName string
	Revision  int
}

type StackSpec struct {
	Scope       StackLevel  `json:"scope,omitempty" yaml:"scope,omitempty"`
	Project     string      `json:"project,omitempty" yaml:"project,omitempty"`
	Environment string      `json:"environment,omitempty" yaml:"environment,omitempty"`
	Prune       bool        `json:"prune,omitempty" yaml:"prune,omitempty"`
	Drift       DriftPolicy `json:"drift,omitempty" yaml:"drift,omitempty"`
}

type StackSync struct {
	RepoURL string `json:"repo_url"`
	Branch  string `json:"branch"`
	Path    string `json:"path,omitempty"`
	// CredentialRef names a stored credential ("app:<name>"), never a secret value.
	CredentialRef   string `json:"credential_ref,omitempty"`
	IntervalSeconds int    `json:"interval_seconds,omitempty"`
	WebhookOnly     bool   `json:"webhook_only,omitempty"`
	Enabled         bool   `json:"enabled"`
	Apply           bool   `json:"apply"`
	Prune           bool   `json:"prune"`
	Deploy          bool   `json:"deploy"`
}

type State struct {
	// contains filtered or unexported fields
}

type StatusError struct {
	Status  int
	Message string
}

type Summary struct {
	Create int `json:"create"`
	Update int `json:"update"`
	Delete int `json:"delete"`
	Noop   int `json:"noop"`
	Error  int `json:"error"`
}