replay

type BuildMode string

type BuildPlan struct {
	// Subjects is one SubjectBuildPlan per replay target.
	Subjects []SubjectBuildPlan `json:"subjects"`
}

type BuildPlanConfig struct {
	Frontend      string            `json:"frontend"`
	FrontendAttrs map[string]string `json:"frontendAttrs,omitempty"`
	Context       string            `json:"context,omitempty"`
	Filename      string            `json:"filename,omitempty"`
	Target        string            `json:"target,omitempty"`
	BuildArgs     map[string]string `json:"buildArgs,omitempty"`
	Labels        map[string]string `json:"labels,omitempty"`
	NoCache       bool              `json:"noCache,omitempty"`
	NoCacheFilter []string          `json:"noCacheFilter,omitempty"`
	Secrets       []PlanSecret      `json:"secrets,omitempty"`
	SSH           []string          `json:"ssh,omitempty"`
	NetworkMode   string            `json:"networkMode,omitempty"`
	Exports       []string          `json:"exports,omitempty"`
}

type BuildRequest struct {
	// Targets is the set of (subject, predicate) pairs to replay. For a
	// single-platform subject this is len 1; multi-platform inputs fan
	// out into multiple targets sharing the other fields below.
	Targets []Target

	// Mode selects a replay strategy. Empty defaults to BuildModeMaterials.
	Mode BuildMode

	// Materials resolves provenance materials to local content stores. May
	// be nil, in which case the default sentinel-only resolver is used.
	Materials *MaterialsResolver

	// NetworkMode controls the network mode for RUN instructions in the
	// replayed build (default | none). Empty uses the recorded mode.
	// Material resolution is NOT affected.
	NetworkMode string

	// Secrets / SSH hold the user-supplied specs for the replayed solve.
	// Cross-checked against each predicate via Secrets()/SSH() before any
	// solve begins.
	Secrets buildflags.Secrets
	SSH     []*buildflags.SSH

	// Exports are the buildflags-parsed --output specs.
	Exports []*buildflags.ExportEntry

	// Tags are "--tag" values to apply to image/oci/docker exports. Flow
	// matches `docker buildx build`: the tags become the `name=` attribute
	// on each eligible export via build/opt.go toSolveOpt.
	Tags []string

	// Progress controls the display mode for replay progress output.
	Progress progressui.DisplayMode
}

type CompareEvent struct {
	Type   string               `json:"type,omitempty"`
	Inputs [2]CompareEventInput `json:"inputs,omitempty"`
	Diff   string               `json:"diff,omitempty"`
}

type CompareEventInput struct {
	Descriptor *ocispecs.Descriptor `json:"descriptor,omitempty"`
	Index      *ocispecs.Index      `json:"index,omitempty"`
	Manifest   *ocispecs.Manifest   `json:"manifest,omitempty"`
}

type CompareMismatchError struct {
	// Report is typed as any so callers can surface either the basic compare
	// tree or a future richer report format without breaking the error type.
	Report any
	Reason string
}

type CompareReport struct {
	CompareEvent
	Context  string           `json:"context,omitempty"`
	Children []*CompareReport `json:"children,omitempty"`
}

type ExtraSSHError struct {
	IDs []string
}

type ExtraSecretError struct {
	IDs []string
}

type MaterialNotFoundError struct {
	URI    string
	Digest string
}

type MaterialsResolver struct {
	// contains filtered or unexported fields
}

type MinModeProvenanceError struct{}

type MissingSSHError struct {
	IDs []string
}

type MissingSecretError struct {
	IDs []string
}

type NoProvenanceError struct {
	Subject string
	// Manifest is set when the subject is an image manifest referenced
	// directly rather than through its image index.
	Manifest bool
}

type NotImplementedError struct {
	Feature string
}

type PinIndex struct {
	// contains filtered or unexported fields
}

type PlanMaterial struct {
	URI string `json:"uri,omitempty"`
	// Platform is populated for image materials only — either parsed
	// from the purl `?platform=` qualifier or, when the URI doesn't
	// carry one, from the predicate's builder platform.
	Platform *ocispecs.Platform `json:"platform,omitempty"`
	Digest   string             `json:"digest,omitempty"`
	// Kind is one of: "image", "image-blob" (container-blob), "http",
	// "git", or "unknown".
	Kind string `json:"kind"`
	// Included reports whether `replay snapshot` would copy this
	// material's bytes into the snapshot.
	Included bool `json:"included,omitempty"`
	// Size is the total byte size this material contributes to the
	// snapshot — the root index plus the platform-matched manifest
	// chain (config + all layer descriptor sizes). Only populated for
	// image materials during snapshot dry-run; computed from manifest
	// metadata alone (no layer bodies are fetched).
	Size int64 `json:"size,omitempty"`
}

type PlanSecret struct {
	ID       string `json:"id"`
	Optional bool   `json:"optional,omitempty"`
}

type Predicate provenancetypes.ProvenancePredicateSLSA1

type ResolveOption func(*resolveOptions)

type SignatureTimestamp struct {
	Type      string    `json:"type"`
	URI       string    `json:"uri,omitempty"`
	Timestamp time.Time `json:"timestamp"`
}

type SignatureVerification struct {
	Verified               bool                 `json:"verified"`
	Type                   string               `json:"type"`
	Identity               string               `json:"identity"`
	CertificateIssuer      string               `json:"certificateIssuer,omitempty"`
	SubjectAlternativeName string               `json:"subjectAlternativeName,omitempty"`
	Issuer                 string               `json:"issuer,omitempty"`
	SourceRepositoryURI    string               `json:"sourceRepositoryURI,omitempty"`
	SourceRepositoryRef    string               `json:"sourceRepositoryRef,omitempty"`
	BuildSignerURI         string               `json:"buildSignerURI,omitempty"`
	RunnerEnvironment      string               `json:"runnerEnvironment,omitempty"`
	Timestamps             []SignatureTimestamp `json:"timestamps,omitempty"`
	TrustRootLastUpdated   *time.Time           `json:"trustRootLastUpdated,omitempty"`
	TrustRootWarning       string               `json:"trustRootWarning,omitempty"`
}

type SignatureVerificationRequiredError struct {
	// Source is the user-visible input that carries the signed envelope
	// (file path for attestation-file inputs).
	Source string
	// Envelope describes the detected envelope shape ("dsse" or
	// "sigstore-bundle") so the user can tell what was rejected.
	Envelope string
}

type SnapshotPlan []SnapshotPlanTarget

type SnapshotPlanTarget struct {
	// Subject is the subject descriptor (already carries platform).
	Subject ocispecs.Descriptor `json:"subject"`
	// Materials lists each recorded material and whether the snapshot
	// would include its content.
	Materials []PlanMaterial `json:"materials"`
}

type SnapshotRequest struct {
	// Targets are the per-platform (subject, predicate) pairs to snapshot.
	// Each subject must carry a non-empty AttestationManifest descriptor
	// (image / oci-layout subjects only; attestation-file inputs are
	// rejected upstream).
	Targets []Target
	// IncludeMaterials controls whether material content is copied and the
	// materials artifact manifest is emitted.
	IncludeMaterials bool
	// Materials resolves image / http / container-blob materials to a local
	// (descriptor, provider) pair. Required when IncludeMaterials is true.
	Materials *MaterialsResolver
	// Output is the parsed --output spec. Exactly one form is allowed
	// (local / oci / registry).
	Output *buildflags.ExportEntry
	// Progress receives step events and non-fatal warnings. May be nil —
	// in that case events are silently dropped.
	Progress progress.Writer
}

type Subject struct {
	Descriptor ocispecs.Descriptor
	Provider   content.Provider
	// contains filtered or unexported fields
}

type SubjectBuildPlan struct {
	// Descriptor is the subject descriptor (digest + mediaType + size).
	Descriptor ocispecs.Descriptor `json:"descriptor"`
	// Signature describes the verified signer of a standalone Sigstore bundle
	// or image-attached provenance. It is absent for unsigned provenance.
	Signature *SignatureVerification `json:"signature,omitempty"`
	// BuildConfig summarises the solve parameters replay would use.
	BuildConfig BuildPlanConfig `json:"buildConfig"`
	// Materials lists the resolved provenance materials.
	Materials []PlanMaterial `json:"materials"`
}

type Target struct {
	Subject   *Subject
	Predicate *Predicate
}

type UnpinnedContextError struct {
	URI string
}

type UnreplayableLocalContextError struct {
	LocalSources []string
}

type UnsupportedPredicateError struct {
	PredicateType string
}

type UnsupportedSubjectError struct {
	Kind string
}

type VerifyRequest struct {
	// Subject is the loaded subject (exactly one — multi-platform subjects
	// are verified one at a time by the caller).
	Subject *Subject
	// Predicate is the subject's provenance predicate.
	Predicate *Predicate
	// Mode selects the comparison strategy: "digest" (default) or
	// "artifact" (descriptor tree walk).
	Mode string
	// Materials resolver, same semantics as BuildRequest.Materials.
	Materials *MaterialsResolver
	// Network controls the replayed build's RUN-network mode.
	Network string
	// Secrets / SSH mirror the BuildRequest shape for secret pass-through.
	Secrets buildflags.Secrets
	SSH     []*buildflags.SSH
	// Output is an optional type=local --output spec for the VSA and diff
	// report.
	Output *buildflags.ExportEntry
	// Progress is the progress display mode for the replayed build.
	Progress progressui.DisplayMode
}

type VerifyResult struct {
	Matched    bool
	DiffReport *CompareReport
	// VSABytes is the in-toto Statement bytes written when req.Output is
	// set; empty otherwise.
	VSABytes []byte
}