fleet

type AppSpec struct {
	// Name identifies the app (lowercase, ^[a-z][a-z0-9_-]*$, unique).
	Name string `json:"name"`
	// Schema is the path to the app's schema JSON (the engine's --schema).
	// Relative paths resolve against the manifest file's directory.
	Schema string `json:"schema"`
	// Domains are the public hostnames of this app. A request whose Host is a
	// domain OR any subdomain of it routes here — subdomains stay free for the
	// engine's tenant resolution (acme.crm.example.com → app crm, tenant acme).
	Domains []string `json:"domains"`
	// Port / ControlPort pin the app's internal data/control ports; 0 (the
	// default) auto-allocates a free port. Internal only — the proxy is the
	// public face.
	Port        int `json:"port,omitempty"`
	ControlPort int `json:"control_port,omitempty"`
	// EnvFile is an optional KEY=VALUE file (e.g. the app's secrets) loaded
	// first; Env entries override it. Relative to the manifest directory.
	EnvFile string `json:"env_file,omitempty"`
	// Env is the app's environment: DATABASE_URL, JWT_SECRET, ADMIN_KEY are
	// REQUIRED (the engine refuses to boot without them); anything else the
	// engine reads (APPXIMO_*, RATE_LIMIT_*, …) may be set per app.
	Env map[string]string `json:"env,omitempty"`
	// contains filtered or unexported fields
}

type AppStatus struct {
	Name        string   `json:"name"`
	Domains     []string `json:"domains"`
	Schema      string   `json:"schema"`
	Port        int      `json:"port"`
	ControlPort int      `json:"control_port"`
	PID         int      `json:"pid"`
	Running     bool     `json:"running"`
	Healthy     bool     `json:"healthy"`
	Health      string   `json:"health"` // ready | draining_or_down | unreachable | stopped
	Restarts    int      `json:"restarts"`
	UptimeS     int64    `json:"uptime_s"`
	LastExit    string   `json:"last_exit,omitempty"`
	Log         string   `json:"log"`
}

type DBInstance struct {
	// Name identifies the instance (^[a-z][a-z0-9_-]*$, unique). Referenced by
	// the console when it asks the server to suggest/test/create — the DSN
	// itself never travels to the browser.
	Name string `json:"name"`
	// Label is the human-friendly text shown in the console's instance picker.
	Label string `json:"label,omitempty"`
	// AdminDSNEnv is the NAME of the env var holding the privileged DSN. The
	// secret is never a manifest key (committable-safe). Required and must be
	// set — a declared-but-unwired instance fails the load loudly.
	AdminDSNEnv string `json:"admin_dsn_env"`
	// contains filtered or unexported fields
}

type DBTestResult struct {
	OK            bool   `json:"ok"`            // connected AND the target database exists
	DBExists      bool   `json:"db_exists"`     // the DSN's database exists (false ⇒ needs creating)
	CanCreateDB   bool   `json:"can_create_db"` // the connected role may CREATE DATABASE
	ServerVersion string `json:"server_version,omitempty"`
	Code          string `json:"code,omitempty"`  // pg SQLSTATE (or "" for a network error)
	Error         string `json:"error,omitempty"` // actionable, client-safe message
}

type Manifest struct {
	// Listen is the proxy's public address (default ":8080").
	Listen string `json:"listen,omitempty"`
	// StatusAddr serves the fleet status/control API (default "127.0.0.1:9601").
	// Internal-only, like the engine control plane — keep it off the internet.
	StatusAddr string `json:"status_addr,omitempty"`
	// DataDir roots per-app state the fleet assigns when the app's env does not
	// set it: <DataDir>/<app>/obs.db, <DataDir>/<app>/files, logs. Default
	// "/var/lib/appximo/fleet".
	DataDir string `json:"data_dir,omitempty"`
	// OperatorKey is the FLEET-OPERATOR credential (MT-STRUCT-S5): it gates the
	// unified fleet console (`/fleet` on the in-process runtime's process-level
	// handler) — the server owner's view over ALL apps. It is a level ABOVE the
	// per-app credentials and is deliberately DISTINCT from every app's
	// ADMIN_KEY/JWT_SECRET: holding one app's keys never reveals the fleet, and
	// the fleet key opens NO app API (per-app JWT/RBAC/admin auth still applies
	// underneath — the S3 isolation is not bypassable from the console). Empty
	// falls back to APPXIMO_FLEET_OPERATOR_KEY; still empty ⇒ the console is
	// DISABLED (safe by default).
	OperatorKey string `json:"operator_key,omitempty"`
	// OperatorAdminEmail enables the UNIFIED OPERATOR IDENTITY
	// (FLEET-CONSOLE-S2): the in-process runtime ensures a platform
	// super-admin with this email exists in EVERY app's database (idempotent,
	// never overwriting an existing account), so ONE login works on every
	// app's /admin — without weakening the S3 isolation (each app keeps its
	// own admin row, DB and tokens). The PASSWORD is deliberately NOT a
	// manifest key: it comes from the APPXIMO_FLEET_ADMIN_PASSWORD env var
	// (an env-file, like the app secrets), so the manifest stays committable.
	// Empty email falls back to APPXIMO_FLEET_ADMIN_EMAIL; both empty ⇒
	// feature off (each app manages its own admins, the pre-S2 behavior).
	OperatorAdminEmail string `json:"operator_admin_email,omitempty"`
	// DBInstances declares the Postgres servers the console's Add-app form may
	// suggest DSNs from and create databases on (FLEET-DB-ASSIST). The engine
	// NEVER discovers Postgres on its own — this list, and only this list, is
	// what the console offers. Committable: it holds no credentials, only each
	// instance's name/label and the NAME of the env var carrying its privileged
	// DSN (the secret lives in the env-file). Absent/empty ⇒ the form is
	// manual-DSN + test-connection only (no create power). See DBInstance.
	DBInstances []DBInstance `json:"db_instances,omitempty"`
	// Apps are the fleet's apps (≥1).
	Apps []AppSpec `json:"apps"`
	// contains filtered or unexported fields
}

type Proxy struct {
	// contains filtered or unexported fields
}

type SafeDBInstance struct {
	Name        string `json:"name"`
	Label       string `json:"label"`
	CanCreateDB bool   `json:"can_create_db"`
}

type Supervisor struct {
	// contains filtered or unexported fields
}