lifecycle

type AdoptionResult struct {
	ServiceName string `json:"service_name"`
	Matches     int    `json:"matches"`
	Written     bool   `json:"written"`
}

type Options struct {
	RegistryPath      string
	OwnershipPath     string
	OwnershipOverride *tsruntime.OwnershipLedger
	Now               time.Time
	DryRun            bool
	ManageACL         bool
	// CheckUnusedACL asks this run to report on the shared Funnel grant.
	// Local absence cannot authorize deletion of a tailnet-wide shared grant,
	// so the report is a skip with a warning, never a deletion.
	CheckUnusedACL bool
	// CleanLocalNodeState allows this run to delete the local tsnet state
	// directory of an orphan service whose remote nodes it proved are gone.
	//
	// It is off by default and set only by the daemon, because the daemon is
	// the process that can answer LocalNodeStateInUse. A separate `tslink
	// cleanup` process cannot see another process's tsnet servers, so it leaves
	// the directories alone rather than guessing.
	CleanLocalNodeState bool
	// LocalNodeStateInUse reports whether a tsnet server in this process still
	// holds the state directory for serviceName.
	//
	// It is required whenever CleanLocalNodeState is set, and a nil function
	// disables the cleanup instead of being read as "nothing holds any state".
	// "Nobody told me" and "nothing holds it" are different statements, and
	// only the caller can tell them apart.
	LocalNodeStateInUse func(serviceName string) bool
	// WithNodeStateLock serializes the final local deletion with this daemon's
	// service startup. The network cleanup runs outside this short lock.
	WithNodeStateLock func(func() error) error
	// TryWithNodeStateLock is the daemon's nonblocking startup gate. A false
	// result means cleanup must retain state and retry on a later tick.
	TryWithNodeStateLock func(context.Context, func() error) (bool, error)
}

type Result struct {
	DryRun                      bool            `json:"dry_run"`
	RegistryChanged             bool            `json:"registry_changed"`
	ExpiredFunnels              []string        `json:"expired_funnels"`
	DevicesMatched              []string        `json:"devices_matched"`
	DevicesWouldDelete          []string        `json:"devices_would_delete"`
	DevicesDeleted              []string        `json:"devices_deleted"`
	DevicesProtected            []string        `json:"devices_protected"`
	DevicesAdopted              []string        `json:"devices_adopted,omitempty"`
	Adoption                    *AdoptionResult `json:"adoption,omitempty"`
	DeviceCleanupSkipped        bool            `json:"device_cleanup_skipped"`
	DeviceSkipReason            string          `json:"device_skip_reason,omitempty"`
	DeviceSkipUnknownProvenance []string        `json:"device_skip_unknown_provenance,omitempty"`
	ACLAction                   string          `json:"acl_action"`
	Warnings                    []string        `json:"warnings,omitempty"`
	// ExpiredFunnelsNotWritten names services whose Funnel deadline has
	// passed while another registry entry has a problem of its own, so the
	// downgrade was not written to registry.json. A daemon withdraws them in
	// memory at every sync and must sync; the warning reports them.
	ExpiredFunnelsNotWritten []string `json:"-"`
}