orchestrator

type Config struct {
	// Path is the directory to scan for Flux objects (the scan entry
	// point — a cluster's Flux entry, which may be a subdir of RepoRoot).
	Path string
	// RepoRoot is the source root that Kustomization spec.path values
	// resolve against. Supplied explicitly by SDK consumers rendering
	// extracted trees that have no .git; the CLI defaults it to the .git
	// ancestor of Path. Empty ⇒ the .git walk (FindRepoRoot) runs,
	// preserving local behavior.
	RepoRoot string
	// SelfURLs are the remote URL(s) this tree represents, for
	// self-referential GitRepository aliasing (a cluster pulling itself).
	// Supplied explicitly by SDK consumers rendering extracted trees with
	// no .git/config; empty ⇒ the working tree's .git remotes are read.
	SelfURLs []string
	// PathOrig, when non-empty, switches every command into
	// changed-only mode: only resources whose source files differ
	// (plus the sources they reference) get reconciled.
	PathOrig string

	// HelmOptions tunes templating (skip CRDs/secrets/tests, kube
	// version, etc.).
	HelmOptions helm.Options
	// WipeSecrets controls Secret cleartext placeholders.
	WipeSecrets bool
	// AllowMissingSecrets converts source auth-secret-not-found errors
	// into skips and omits HelmRelease valuesFrom Secret/ConfigMap refs
	// that cannot materialize in the offline tree. Skipped source
	// resources mark Ready with a "skipped:" reason; omitted valuesFrom
	// refs let HelmReleases render with the remaining values.
	AllowMissingSecrets bool

	// RestrictEgress is the untrusted-render switch. It (1) enables the SSRF
	// egress guard for ALL source fetches (kustomize remote resources/bases +
	// Git/OCI/Helm/Bucket sources) — outbound dials to loopback/RFC1918/link-
	// local/cloud-metadata addresses are refused — and (2) rejects GitRepository
	// URLs whose transport is not https/ssh (file://, git://, http://, bare
	// paths), so a fork-PR file:// source can't disclose an arbitrary in-pod
	// repo (#743). Off by default — flate normally renders TRUSTED repos that
	// legitimately reach private/LAN hosts and use local file:// self-sources;
	// a consumer rendering UNTRUSTED input (e.g. konflate fork mode) sets this.
	// The egress half is process-level (see pkg/source/ssrfguard): go-git
	// installs its HTTPS transport process-wide, so a per-render git egress
	// policy is impossible.
	RestrictEgress bool

	// RegistryConfig is the docker config.json used for OCI auth.
	RegistryConfig string

	// CacheDir overrides the default on-disk cache root. The default
	// follows os.UserCacheDir (XDG_CACHE_HOME on Linux, Library/Caches
	// on macOS, %LocalAppData% on Windows) with a "flate" subdir, so
	// the cache survives reboots and OS tmpfs cleanups. Falls back to
	// os.TempDir()/flate-cache only when UserCacheDir errors.
	CacheDir string
	// SourceCache, when non-nil, is shared across orchestrators. The
	// `flate diff` flow constructs two orchestrators that point at the
	// same on-disk source-cache root; they MUST share one *Cache so the
	// internal mutex serializes concurrent slot allocation. When nil a
	// per-orchestrator cache is constructed (fine for single-orchestrator
	// commands like `build` / `get`).
	SourceCache *source.Cache
	// ExternalChanges, when non-nil, supplies the file-level diff so
	// the orchestrator skips its built-in change.Detect step. The
	// filter is still built from this set + the loaded SourceFiles
	// during Bootstrap.
	ExternalChanges *change.Set

	// Concurrency caps the number of active reconcile bodies running
	// in parallel. <= 0 means unbounded (every Kustomization / HR
	// reconciles on its own goroutine). Background watch loops are
	// unaffected. Sensible default for I/O-bound work is
	// runtime.NumCPU() * 4.
	Concurrency int

	// SourceRetry tunes the bounded, classified retry applied to every
	// source fetch (Git/OCI/Bucket) on transient network failures —
	// connection resets, refused connections, dial/IO timeouts. Permanent
	// errors (bad path, missing secret, not-found) fail fast. Attempts
	// <= 1 disables retry; the CLI defaults it to 3. See
	// source.RetryConfig / source.WithRetry.
	SourceRetry source.RetryConfig

	// GitDepth caps the shallow-clone history depth for GitRepository
	// sources (both the bare mirror and the legacy clone). 0 clones full
	// history; the CLI defaults it to 1 (opt-out via --git-depth=0).
	// Commit-pinned refs always full-clone regardless. See
	// git.Fetcher.Depth.
	GitDepth int

	// HelmTemplateCacheBytes caps the in-memory helm template-output
	// cache. Repeat HRs with identical effective inputs (chart
	// fingerprint, resolved values, render options) hit the cache and
	// skip action.Install.RunWithContext — the single largest CPU +
	// allocation consumer in the codebase. <= 0 disables the cache.
	// The CLI flag `--helm-template-cache-mb` exposes this in MB
	// units; embedders pass bytes directly.
	HelmTemplateCacheBytes int64

	// HelmRenderCacheBytes caps the persistent on-disk helm template-
	// output cache (Phase 3.4a). Cross-process reuse: repeat `flate
	// build` / `flate diff` invocations against the same checkout
	// short-circuit the helm render entirely when the chart
	// fingerprint + resolved values + opts tuple hits the disk layer.
	// <= 0 disables disk caching; the in-memory layer (sized by
	// HelmTemplateCacheBytes) continues to operate independently.
	// The CLI flag `--helm-render-cache-mb` exposes this in MB
	// units; embedders pass bytes directly.
	HelmRenderCacheBytes int64

	// KustomizeRenderCacheBytes caps the persistent on-disk kustomize
	// render cache. Cross-process reuse: a Kustomization whose recorded
	// disk inputs are unchanged since a prior run skips krusty entirely
	// (see pkg/kustomize/render_cache.go). <= 0 disables it. The CLI flag
	// `--kustomize-render-cache-mb` exposes this in MB; embedders pass bytes.
	KustomizeRenderCacheBytes int64
}

type FailuresError struct{ Message string }

type Orchestrator struct {
	// contains filtered or unexported fields
}

type Rendered struct {
	*Orchestrator
	Result *Result
	Err    error
}

type Result struct {
	Manifests map[manifest.NamedResource][]map[string]any
	Failed    map[manifest.NamedResource]store.StatusInfo
	Orphans   map[manifest.NamedResource]string
	// DependsOn is the declared spec.dependsOn graph: each Kustomization or
	// HelmRelease that names dependencies maps to the sorted ids it depends on.
	// Same-kind only (KS→KS, HR→HR per the Flux spec); implicit coupling
	// (healthChecks, shared CRDs, service DNS) is not represented. Nodes with no
	// declared dependencies are omitted, and the map is nil (not empty) when
	// nothing declares a dependsOn. Consumers invert this into a dependents
	// adjacency list for impact / "blast radius" analysis.
	//
	// It is the declared graph verbatim: cycle members and self-edges (A → A) are
	// retained, not pruned (cycles also surface as render Failures) — a consumer
	// that walks it must tolerate them. It is also independent of the --skip-*
	// render filters, so an id here may have no entry in Manifests when its kind
	// was skipped.
	DependsOn map[manifest.NamedResource][]manifest.NamedResource
	// Blocked maps a failed resource to the immediate dependencies that blocked
	// it — present only for failures that are purely derived (the resource's own
	// reconcile never ran because a dependency failed or was missing), absent for
	// primary failures (a real render/template/build error). A consumer groups
	// derived failures under their root cause by walking these edges to a primary
	// failure or a missing id, instead of surfacing every cascaded failure.
	Blocked map[manifest.NamedResource][]manifest.NamedResource
	// Warnings are non-fatal render advisories — the render succeeded, but the
	// operator probably wants to look at these (e.g. a HelmRelease pinning
	// values the chart's schema no longer defines, an empty --path scan). Each
	// carries a stable Category code a consumer filters on rather than parsing
	// the message, an optional Resource (zero = render-global), and optional
	// structured Detail. Sorted deterministically; nil (not empty) when none.
	// Distinct from Failed (which blocks a resource) and from operational logs
	// (submodule skips, cache resets) which stay on stderr. A consumer like
	// konflate surfaces these alongside the diff.
	Warnings []manifest.Warning
}

type Tree struct {
	RepoRoot string
	Path     string
	SelfURLs []string
}