consts

const (
	CgroupFilesystemPath = "/sys/fs/cgroup"

	KukeonMetadataFile = "metadata.json"

	// KukeonMetadataSubdir is the basename of the subdirectory under the
	// daemon's RunPath that owns kukeon's realm/space/stack/cell metadata
	// tree. Walkers (ListRealms, the subnet allocator, daemon reset
	// --purge-system) scope themselves to this subtree so non-metadata
	// siblings of the RunPath — e.g. <RunPath>/bin staging kuketty, or the
	// .kukeon-instance.json file — are not mistaken for realm directories.
	KukeonMetadataSubdir = "data"

	// KukeonSecretsSubdir is the basename of the per-scope subdirectory that
	// owns daemon-managed `kind: Secret` bytes (issue #619). It lives inside
	// the scope's metadata directory (e.g. <RunPath>/data/<realm>/secrets/) so
	// the same os.RemoveAll that purge/delete already runs on a scope's
	// metadata dir reclaims its secrets too. Unlike the 0o2750 setgid
	// metadata directories the kuke group can traverse, the secrets directory
	// and the files in it are root-only (0o700 / 0o600).
	KukeonSecretsSubdir = "secrets"

	// KukeonBlueprintsSubdir is the basename of the per-scope subdirectory that
	// owns daemon-managed `kind: CellBlueprint` documents (issue #620). Like
	// the secrets subdir it lives inside the scope's metadata directory (e.g.
	// <RunPath>/data/<realm>/blueprints/) so a scope teardown reclaims it.
	// Unlike secrets, a blueprint carries no credential bytes — only template
	// references — so the directory and files are root-owned but world-readable
	// (0o755 / 0o644).
	KukeonBlueprintsSubdir = "blueprints"

	// KukeonConfigsSubdir is the basename of the per-scope subdirectory that
	// owns daemon-managed `kind: CellConfig` documents (issue #624). Like the
	// blueprints subdir it lives inside the scope's metadata directory (e.g.
	// <RunPath>/data/<realm>/configs/) so a scope teardown reclaims it, and like
	// a blueprint a config carries only references (a blueprint name, repo URLs,
	// secretRefs) — no credential bytes — so the directory and files are
	// root-owned but world-readable (0o755 / 0o644).
	KukeonConfigsSubdir = "configs"

	// KukeonContainerTTYDir is the basename of the per-container directory
	// that owns the sbsh terminal socket plus its capture and log siblings.
	// kukeon bind-mounts this directory (not a single file) into the
	// container so sbsh's unlink-and-recreate of the socket inode stays
	// host-visible.
	KukeonContainerTTYDir = "tty"

	// KukeonContainerSocketFile is the basename of the per-container sbsh
	// terminal socket inside KukeonContainerTTYDir. The container sees the
	// same inode at /run/kukeon/tty/socket via the directory bind mount
	// injected by Attachable=true specs.
	KukeonContainerSocketFile = "socket"

	// KukeonSocketSymlinkSubdir is the basename of the per-RunPath directory
	// that holds SUN_PATH-safe symlinks to the deep per-container kuketty
	// sockets (`<RunPath>/data/<realm>/<space>/<stack>/<cell>/<container>/
	// tty/socket`). Linux `connect(2)` caps the path passed in
	// sockaddr_un.sun_path at 108 bytes including the terminator (issue #521),
	// and the deep metadata-rooted path overflows on long RunPaths or
	// long realm/space/stack/cell IDs. The daemon stages a short symlink at
	// `<RunPath>/s/<short>` at provision time; `kuke attach` connects via
	// the symlink so the literal sun_path stays SUN_PATH-safe regardless of
	// how deep the resolved target lives. Single-letter basename to spend
	// the budget on the per-container short id, not the directory.
	KukeonSocketSymlinkSubdir = "s"

	// KukeonMaxSocketPath is Linux's UNIX_PATH_MAX minus the terminating
	// NUL — the maximum number of bytes a path passed to `connect(2)` on a
	// unix socket may occupy in sockaddr_un.sun_path. The daemon refuses to
	// provision an Attachable container whose resolved host-side socket
	// path would exceed this so the failure surfaces at provision time
	// rather than at first `kuke attach` (issue #521).
	KukeonMaxSocketPath = 107

	// KukeonContainerCaptureFile is the basename of the per-container sbsh
	// capture file inside KukeonContainerTTYDir. sbsh writes the full tty
	// byte stream — every byte the workload produced and every byte typed
	// by an attached operator — into this file. `kuke log` tails the host
	// path that resolves to the same inode as the in-container path
	// /run/kukeon/tty/capture (see ctr.AttachableCapturePath).
	KukeonContainerCaptureFile = "capture"

	// KukeonContainerLogFile is the basename of the per-container stdout/
	// stderr log file written by the containerd runtime shim via cio.LogFile
	// for non-Attachable containers (Attachable containers route output
	// through sbsh's capture file instead). The shim is the writer; kuke
	// only reads it. `kuke log` tails this file when targeting a non-
	// Attachable container.
	KukeonContainerLogFile = "log"

	// KukeonContainerKukettyLogFile is the basename of the per-Attachable-
	// container kuketty wrapper's own slog output, inside KukeonContainerTTYDir
	// (peer to the socket and capture files, same bind-mount visibility). The
	// path is daemon-controlled — operators do not pick it, the same way they
	// do not pick where `capture` lands — so kuketty always writes here and an
	// operator who needs to debug an attach session knows exactly where to
	// look. Distinct from the workload-capture file (KukeonContainerCaptureFile,
	// "capture"), which carries the workload's tty byte stream and stays
	// opt-in for the workload side. Issue #599.
	KukeonContainerKukettyLogFile = "kuketty.log"

	// Label keys shared across the user default hierarchy and the system hierarchy.
	KukeonRealmLabelKey     = "realm.kukeon.io"
	KukeonSpaceLabelKey     = "space.kukeon.io"
	KukeonStackLabelKey     = "stack.kukeon.io"
	KukeonCellLabelKey      = "cell.kukeon.io"
	KukeonContainerLabelKey = "container.kukeon.io"

	// Default user hierarchy created by `kuke init` for user workloads.
	KukeonDefaultRealmName = "default"
	KukeonDefaultSpaceName = "default"
	KukeonDefaultStackName = "default"

	// System hierarchy created by `kuke init` for the kukeond daemon.
	KukeSystemRealmName     = "kuke-system"
	KukeSystemSpaceName     = "kukeon"
	KukeSystemStackName     = "kukeon"
	KukeSystemCellName      = "kukeond"
	KukeSystemContainerName = "kukeond"

	// KukeonSystemUser and KukeonSystemGroup name the system identity created
	// by `kuke init` so a non-root operator added to the kukeon group can
	// dial the kukeond socket without sudo. Writes under /opt/kukeon still
	// require root; they go through the daemon.
	KukeonSystemUser  = "kukeon"
	KukeonSystemGroup = "kukeon"

	// KukeonRunDirMode is the mode applied to the kukeond socket's parent
	// directory (the /run/kukeon bind-mount source) by `kuke init` and
	// re-asserted by `kuke daemon start`/`restart` so the directory survives
	// a tmpfs clear (host reboot). The SGID bit makes files the daemon later
	// writes there inherit the kukeon group instead of root:root; 0o750 lets
	// the kukeon group traverse without world access. Single source of truth
	// shared by the init bootstrap and the daemon start/restart recreate path
	// so the two cannot drift on what `kuke init` produces.
	KukeonRunDirMode os.FileMode = os.ModeSetgid | 0o750

	// DefaultRealmNamespaceSuffix is the in-binary default for the
	// containerd namespace suffix appended to every realm name (without a
	// leading dot — RealmNamespace adds the dot when joining). Operators
	// override it via ServerConfiguration.spec.containerdNamespaceSuffix to
	// run a parallel kukeon instance under a disjoint namespace.
	DefaultRealmNamespaceSuffix = "kukeon.io"

	// DefaultKukeonCgroupRoot is the in-binary default for the cgroup root
	// under which all realms / spaces / stacks / cells live. Operators
	// override it via ServerConfiguration.spec.cgroupRoot.
	DefaultKukeonCgroupRoot = "/kukeon"

	// KukebuildBaseDir is the directory under which `kukebuild` keeps its
	// per-namespace BuildKit state (`cache.db`, `history.db`, snapshot
	// metadata) — one subdirectory per containerd namespace it has built
	// into, at <KukebuildBaseDir>/<namespace>. `kuke uninstall` removes the
	// matching subdir for every realm it successfully purges; the BuildKit
	// cache references containerd by snapshot ID and content digest, so a
	// purged namespace whose cache survives strands the next `kuke build`
	// with "parent snapshot does not exist" or "content digest ... not
	// found" (issue #904).
	//
	// Must mirror the `defaultBuildRoot` constant in cmd/kukebuild/main.go;
	// the two cannot be a single source of truth because cmd/kukebuild is a
	// separate Go module (its go-1.25 BuildKit closure is deliberately
	// disjoint from the root module's graph). On change, update both.
	KukebuildBaseDir = "/var/lib/kukebuild"

	// InternalImageRegistry is the reserved, non-routable "host" every
	// locally-built `kuke team init --build` image is tagged under. It is
	// ICANN's `.internal` private-use TLD, so a pull against it can never
	// accidentally reach a real registry. Three subsystems key off this one
	// definition so they cannot drift:
	//   - the build path (internal/teambuild) tags each built image
	//     <InternalImageRegistry>/<name>:<version> and threads it as the
	//     `--build-arg REGISTRY=…` so leaf FROMs resolve to the in-realm base;
	//   - the bind path (internal/teamrender) binds the cell blueprint's image
	//     to the same ref in `--build` mode (vs the catalog's published image);
	//   - the runtime resolver (internal/ctr) treats refs hosted here as
	//     local-only — never pulled, with a clear "build it" error on a miss.
	InternalImageRegistry = "kukeon.internal"
)

const BuildKitHistoryNamespaceSuffix = "_history"