migrate

type CompleteFile struct {
	V0Path           string `json:"v0_path"`
	V0SHA256Manifest string `json:"v0_sha256_manifest"`
	V1SchemaVersion  int    `json:"v1_schema_version"`
	CompletedAt      int64  `json:"completed_at"`
	MigratorVersion  string `json:"migrator_version"`
}

type Importer interface {
	Domain() string
	Run(ctx context.Context, st *store.Store, opts Options) error
}

type LockFile struct {
	V0Path           string `json:"v0_path"`
	V0SHA256Manifest string `json:"v0_sha256_manifest"`
	StartedAt        int64  `json:"started_at"`
	MigratorVersion  string `json:"migrator_version"`
}

type Options struct {
	V0Dir             string
	V1Dir             string
	MigratorVersion   string // e.g. "v1.0.0"; written into complete.json
	MtimeSafetyWindow time.Duration

	// SkipMtimeCheck, when true, bypasses the v0 mtime safety window
	// (5.5 step 2). The window exists to catch the "v0 binary still
	// active" footgun where mid-write files would copy half-finished
	// state — but operators who have stopped v0 and just touched the
	// dir manually (e.g. extracting from backup, ls -la for inspection)
	// hit the window even though v0 is dead. Use sparingly: a
	// mid-write at migration time produces silent corruption with no
	// recovery. Wired at the cmd/ layer as --migrate-force-recent-mtime.
	SkipMtimeCheck bool

	// Restart, when true, deletes a partial v1 dir (without
	// migration_complete.json) before starting fresh. Refuses to touch a
	// completed v1 dir (5.6).
	Restart bool

	// MigrateExternalCLI controls 5.5.1 symlink/projects.json updates.
	// Default true at the cmd/ layer; this package treats nil-vs-set
	// equivalently and uses the field as-is.
	MigrateExternalCLI bool

	// HomePeer is stamped on every blob_refs row created by the blobs
	// importer. Empty falls back to os.Hostname() inside the importer;
	// tests pass a fixed value so source_checksum and the row stamp stay
	// deterministic. Phase 4 peer_registry will rewrite these columns
	// via a one-shot UPDATE once peer ids are real.
	HomePeer string

	// Now is injectable for tests. Defaults to time.Now.
	Now func() time.Time

	// SkipV1Acquire, when true, suppresses migrate.Run's own
	// configdir.Acquire on V1Dir. The caller MUST have already
	// acquired the lock and MUST keep it held for the entire
	// Run call. Reserved for callers that want to coordinate the
	// lock externally; the normal flow lets Run take the lock.
	SkipV1Acquire bool

	// PreCompleteHook fires AFTER importers + post-import
	// manifest verify but BEFORE migration_complete.json is
	// published. Used by the cmd/ layer to drop the v0
	// credentials carry-forward into v1 at the right phase —
	// after Run's own canResumeV1 / wipe gate has accepted the
	// state, and inside Run's advisory-lock critical section,
	// so the carry-forward never trips canResumeV1's "credentials
	// without sentinel = partial v1" branch on the next retry.
	// A non-nil error returned by the hook fails Run; the
	// migration lockfile stays so an operator can retry.
	PreCompleteHook func() error
}

type Result struct {
	V0Manifest      string
	DomainsImported []string
	Warnings        []string
	CompletedAt     time.Time
}