types

type BuildReason struct {
	// Message with the status reason, currently reporting only for error status
	Message string `json:"message"`

	// Step that failed
	Step *string `json:"step,omitempty"`
}

type BuildStatus string

type BuildStatusGroup string

type DBTX interface {
	Exec(ctx context.Context, sql string, args ...any) (pgconn.CommandTag, error)
	Query(ctx context.Context, sql string, args ...any) (pgx.Rows, error)
	QueryRow(ctx context.Context, sql string, args ...any) pgx.Row
}

type JSONBStringMap map[string]string

type PausedSandboxConfig struct {
	Version      string                      `json:"version"`
	Network      *SandboxNetworkConfig       `json:"network,omitempty"`
	AutoResume   *SandboxAutoResumeConfig    `json:"autoResume,omitempty"`
	VolumeMounts []*SandboxVolumeMountConfig `json:"volumeMounts,omitempty"`

	// FilesystemOnly marks a snapshot that persists only the rootfs (no memory
	// snapshot); resuming it cold-boots from disk. The orchestrator decides
	// reboot-vs-resume from the snapshot's own metadata.json; this flag lets the
	// API gate implicit-resume paths (auto-resume, /connect) without a round-trip.
	// Pre-existing rows omit the key and decode to false (a memory snapshot).
	FilesystemOnly bool `json:"filesystemOnly,omitempty"`

	// AutoPauseFilesystemOnly is the sandbox's policy for the *next* auto-pause:
	// when true, an auto-pause on timeout takes a filesystem-only snapshot rather
	// than a full memory one. It is restored on resume so the policy survives a
	// pause/resume cycle. Distinct from FilesystemOnly, which records the kind of
	// *this* snapshot. Pre-existing rows omit the key and decode to false.
	AutoPauseFilesystemOnly bool `json:"autoPauseFilesystemOnly,omitempty"`

	// Iam preserves the sandbox workload identity configuration across
	// pause/resume. A resumed sandbox gets a freshly generated execution ID, so
	// any workload identity is rederived from the current execution rather than a
	// stored subject. Pre-existing rows omit the key and decode to nil.
	Iam *SandboxIam `json:"iam,omitempty"`
}

type SandboxAutoResumeConfig struct {
	Policy  SandboxAutoResumePolicy `json:"policy"`
	Timeout uint64                  `json:"timeout,omitempty"`
}

type SandboxAutoResumePolicy string

type SandboxIam struct {
	// Tokens holds the named workload-token definitions, keyed by token name.
	Tokens map[string]SandboxIamToken `json:"tokens,omitempty"`
}

type SandboxIamToken struct {
	Audience  string `json:"audience"`
	TokenType string `json:"tokenType"`
}

type SandboxNetworkConfig struct {
	Egress  *SandboxNetworkEgressConfig  `json:"egress,omitempty"`
	Ingress *SandboxNetworkIngressConfig `json:"ingress,omitempty"`
}

type SandboxNetworkEgressConfig struct {
	AllowedAddresses []string                        `json:"allowedAddresses,omitempty"`
	DeniedAddresses  []string                        `json:"deniedAddresses,omitempty"`
	Rules            map[string][]SandboxNetworkRule `json:"rules,omitempty"`

	// SOCKS5 BYOP egress proxy configuration.
	EgressProxyAddress  string `json:"egressProxyAddress,omitempty"`
	EgressProxyUsername string `json:"egressProxyUsername,omitempty"`
	EgressProxyPassword string `json:"egressProxyPassword,omitempty"`
}

type SandboxNetworkIngressConfig struct {
	AllowPublicAccess *bool    `json:"allowPublicAccess,omitempty"`
	MaskRequestHost   *string  `json:"maskRequestHost,omitempty"`
	HTTPSPorts        []uint32 `json:"httpsPorts,omitempty"`
}

type SandboxNetworkRule struct {
	Transform *SandboxNetworkTransform `json:"transform,omitempty"`
}

type SandboxNetworkTransform struct {
	Headers map[string]string `json:"headers,omitempty"`
}

type SandboxVolumeMountConfig struct {
	ID   string `json:"id"`
	Type string `json:"type"`
	Name string `json:"name"`
	Path string `json:"path"`
}