upgrade

type Asset struct {
	Name               string `json:"name"`
	BrowserDownloadURL string `json:"browser_download_url"`
	Size               int64  `json:"size"`
}

type CheckResult struct {
	Current         string
	Latest          string
	UpdateAvailable bool
	Release         *Release
}

type EdgeBuild struct {
	// Version is the build that was asked about, e.g. "dev+g8b418e2".
	Version string
	// Short is the commit prefix Version names; Commit the full id, once
	// GitHub has resolved it.
	Short, Commit string
	Status        EdgeStatus
	// Manifest is the published build's manifest when Status is
	// EdgePublished. Read, not verified: see FetchEdgeManifest.
	Manifest EdgeManifest
	// RunURL is the workflow run the reason refers to, when there is one.
	RunURL string
	// Err is the failure behind EdgeUnknown.
	Err error
}

type EdgeManifest struct {
	// Schema is EdgeManifestSchema.
	Schema int `json:"schema"`
	// Commit is the full commit id that was built.
	Commit string `json:"commit"`
	// Version is what the binaries report: dev+g<short commit>, the stamp the
	// hub's own deploy gives the same commit.
	Version string `json:"version"`
	// Protocol is the newest executor protocol the binaries speak, read from
	// the built binary itself (`cloop version --json`). The hub offers a
	// device this build only if it does not lower the device's protocol.
	Protocol int `json:"protocol"`
	// Sequence is the commit's first-parent position on main (schema 2), the
	// same number stamped into the binaries; zero in a schema-1 manifest,
	// whose builds carry none. A device refuses a build whose sequence is
	// lower than its own, and the hub never offers one.
	Sequence int `json:"sequence,omitempty"`
	// Archives maps each archive's asset name to its SHA-256.
	Archives map[string]string `json:"archives"`
	// BuiltAt and Run say when and by which workflow run, for a human.
	BuiltAt string `json:"built_at,omitempty"`
	Run     string `json:"run,omitempty"`
}

type EdgeStatus string

type Options struct {
	// SkipVerify installs without proving the archive's provenance.
	//
	// It exists for air-gapped mirrors that cannot reach Sigstore, and for
	// nothing else. It does not disable the checksum: that still runs, and
	// still proves only that the download arrived intact — checksums.txt is
	// served from the same release as the archive, so an attacker who can
	// replace one replaces the other.
	SkipVerify bool

	// Verifier overrides the provenance verifier. Tests set it. An edge build
	// is verified with Verifier.ForChannel(provenance.ChannelEdge), so the
	// release identity configured here never vouches for one.
	Verifier *provenance.Verifier

	// EdgeBaseURL overrides where edge assets are downloaded from, for tests
	// and for a site that mirrors the edge release. Every asset is still
	// verified against the edge identity, so a mirror can withhold builds but
	// not substitute them. Set only in-process: nothing that crosses the wire
	// reaches Options (pkg/executor/remote/upgradeproto.go).
	EdgeBaseURL string
}

type Release struct {
	TagName string  `json:"tag_name"`
	Name    string  `json:"name"`
	Assets  []Asset `json:"assets"`
}

type Staged struct {
	// Tag is the release this came from, resolved — so a caller that asked
	// for "latest" learns what latest meant.
	Tag string
	// BinaryPath is the extracted cloop executable.
	BinaryPath string
	// AssetName is the release archive the binary came out of.
	AssetName string
	// ProvenanceVerified records that the archive's signature was checked
	// against cloop's pinned identity for its channel. False only when the
	// caller passed Options.SkipVerify to StageRelease.
	ProvenanceVerified bool

	// Channel is the channel the build came from, and so the identity it was
	// verified against.
	Channel provenance.Channel
	// Version is what the staged binary must report when it is run, when the
	// channel says so: an edge build's signed manifest names it, and the
	// installer refuses a binary that disagrees (Task 20376). Empty for a
	// release, which is bound by its tag's signature alone.
	Version string
	// Protocol is the executor protocol an edge build's manifest claims; 0
	// for a release. The installer reads the real one from the binary.
	Protocol int
	// Commit is the full commit an edge build was made from.
	Commit string
	// Sequence is the place on main an edge build's signed manifest names
	// (Task 20380), zero for a schema-1 manifest and for a release. The
	// installer requires the binary to report it, and orders the install by
	// the binary's own stamp.
	Sequence int
}