controlevent

const (
	// ControlModelVersion is the version of the event/contract shape.
	ControlModelVersion = 1
	// CacheSchemaVersion is the version of the materialised local cache
	// shape an artifact restores into.
	CacheSchemaVersion = 1
)

const (
	TypeStackActivated     = "stack.activated"
	TypeTenantCreated      = "tenant.created"
	TypeHostnameBound      = "hostname.bound"
	TypeHostnameVerified   = "hostname.verified"
	TypeHostnameRevoked    = "hostname.revoked"
	TypeActorChanged       = "actor.changed"
	TypeKeyChanged         = "key.changed"
	TypeMembershipChanged  = "membership.changed"
	TypeEntitlementUpdated = "entitlement.updated"
	TypeSystemOpstack      = "system.opstack.updated"
	// TypeDNSZoneUpserted carries a dns_zones row (RowsArtifact, op=upsert;
	// revocation is an upsert with revoked_at set). Lets a data-plane node hold
	// the delegated-zone state so it re-derives `<label>.<origin>` routing hosts
	// itself and (with the dns personality) can serve the zone — see
	// internal docs/todo-dns-authority.md §9 fleet note.
	TypeDNSZoneUpserted = "dns.zone.upserted"
	// TypeDNSRecordUpserted carries a dns_records row (RowsArtifact, op=upsert;
	// revocation is an upsert with revoked_at set, mirroring dns.zone.upserted).
	// Without it an override-record write is admin-local: a SQLite data-plane
	// node only sees dns_records via snapshot re-bootstrap, and a shared-PG node
	// only on the next unrelated event's mirror reload — so a dns head can serve
	// a zone whose records lag the control plane indefinitely.
	TypeDNSRecordUpserted = "dns.record.upserted"
	// TypeCronSettingsUpserted carries a cron_settings row (RowsArtifact,
	// op=upsert; clearing a timezone is an upsert with timezone=”). Lets every
	// node localize a tenant's @cron.* wall-clock fields consistently.
	TypeCronSettingsUpserted = "cron.settings.upserted"
	// TypeDNSSettingsUpserted carries the singleton dns_settings row
	// (RowsArtifact, op=upsert). Chassis-global synthesis config (NS/edge/MX/
	// TTL): without it a `dns config set` was admin-local and every dns head
	// kept synthesizing from its own boot flags until an unrelated event
	// nudged a reload — the same silent gap dns.record.upserted closed.
	TypeDNSSettingsUpserted = "dns.settings.upserted"
	// TypeSecretChanged carries a tenant_secrets OR tenant_secret_versions row
	// (RowsArtifact, op=upsert). A create/rotate emits two of these — the
	// version row first, then the parent — so a consumer never briefly sees a
	// parent pointing at an absent version. Decryptable fleet-wide only when the
	// master key is shared (TXCO_SECRET_MASTER_KEY_B64). The blob columns travel
	// base64-wrapped ({"$b64":…}); see controlapply.coerce.
	TypeSecretChanged = "secret.changed"
	// TypeSecretRevoked carries a tenant_secrets row with revoked_at set
	// (RowsArtifact, op=upsert — the consumer's INSERT OR REPLACE flips it
	// inactive, mirroring dns.zone revocation). No version row travels.
	TypeSecretRevoked = "secret.revoked"
	// TypeRunAbort carries a RunAbortArtifact: end a run in flight — one, by
	// rid, or every run of a stack — wherever it is. The admin plane cannot
	// know which node holds a run (nodes do not report their live runs), so
	// every node applies the event to its own live-run registry; on all but
	// one it ends nothing, which is the expected outcome, not an error. Not
	// a row: nothing is stored, and a node that first sees the event after
	// the run ended has nothing to do.
	TypeRunAbort = "run.abort"
)