wiring

type JITSource struct {
	Client *scaleset.Client
	Pool   poolRunnerStore
}

type NodeJIT struct{ Client *scaleset.Client }

type NodeWire struct {
	// Handler is the node wire's routes, with every option this deployment's
	// authority and policy imply already installed.
	Handler http.Handler
	// Bootstrap is the two routes a machine that has never enrolled needs, on a
	// handler of its own because they cannot require the certificate everything
	// else does — served on their own listener and budget. Nil on a loopback
	// wire, which has no certificates and so nothing to enroll into.
	Bootstrap http.Handler
	// TLS is the server side of the wire: what the control plane PRESENTS, and
	// which authorities a client certificate may come from. Nil on a loopback
	// wire, which has no certificates at all because the trust boundary there is
	// the machine.
	TLS *tls.Config

	// THE THREE BELOW ARE FOR THE SECOND LISTENER, and they come from this same
	// read for the reason the read exists. The two routes a machine with no
	// certificate needs are served on an address of their own, and what THAT
	// listener presents and what it hands an enrolling machine to trust have to
	// describe the same moment as this one — a `billet ca retire` landing between
	// two reads would admit a node against an authority the control plane has
	// stopped presenting. All three are zero on a loopback wire, which has no
	// certificates and so nothing to enroll into.
	//
	// Serving is the certificate BOTH listeners present, and IssuingExpiry below
	// is what the authority behind them expires. The handlers already carry the
	// rest of that read.
	Serving wirecert.Bundle
	// Rotating reports an overlap, and RotationAge how long ago it started, so
	// the caller can say so.
	Rotating    bool
	RotationAge time.Duration
	// IssuingExpiry is when the authority that signs node certificates stops
	// working, and Hosts what its certificate was minted for. Reported at
	// startup, because a CA is a slow cliff.
	IssuingExpiry time.Time
}

type NodeWireRequest struct {
	// StateDir and Deployment locate and name the authority.
	StateDir, Deployment string
	// Hosts are the names a node may dial this control plane by. Empty on a
	// loopback wire.
	Hosts []string
	// Loopback says the wire has no certificates at all: two processes on one
	// machine, where the trust boundary is the machine. Config validation refuses
	// node.tls against such a server for the same reason.
	Loopback bool

	// The collaborators the routes need.
	Log    *slog.Logger
	Plane  *nodeplane.Plane
	Leases nodeplane.LeaseStore
	// JIT serves every tier when TargetJIT is empty; TargetJIT is one source per
	// GitHub target, keyed by the target's config name, which is what
	// BuildTargets hands back.
	JIT         nodeplane.JITSource
	TargetJIT   map[string]nodeplane.JITSource
	Revocations nodeplane.Revocations
	Enrollments nodeplane.Enrollments
	CachePolicy nodeplane.CachePolicy
}

type Provisioner struct{ Client *scaleset.Client }

type Target struct {
	Config config.GitHubTarget
	Client *scaleset.Client
}