platform

type AuditLogger interface {
	// JobStarted logs a job start event.
	JobStarted(jobID, jobType string, details map[string]interface{})

	// JobCompleted logs a job completion event.
	JobCompleted(jobID string, duration time.Duration, details map[string]interface{})

	// JobFailed logs a job failure event.
	JobFailed(jobID string, err error, details map[string]interface{})

	// ResourceThrottle logs a resource throttle event.
	ResourceThrottle(reason string, metrics map[string]interface{})
}

type BootstrapConfig struct {
	// Timeout for the registration request.
	Timeout time.Duration

	// RetryAttempts is the number of times to retry on failure.
	RetryAttempts int

	// RetryDelay is the delay between retry attempts.
	RetryDelay time.Duration

	// Verbose enables debug logging.
	Verbose bool
}

type Bootstrapper struct {
	// contains filtered or unexported fields
}

type ClientConfig struct {
	// BaseURL is the API base URL.
	BaseURL string

	// APIKey is the sensor's API key.
	APIKey string

	// SensorID is the sensor's ID.
	SensorID string

	// PollTimeout is the long-poll timeout for job polling.
	PollTimeout time.Duration

	// Verbose enables debug logging.
	Verbose bool
}

type CredentialStore interface {
	Save(creds *SensorCredentials) error
	Load() (*SensorCredentials, error)
	Exists() bool
}

type EnsureRegisteredConfig struct {
	// BaseURL is the API base URL.
	BaseURL string

	// BootstrapToken is the bootstrap token for registration.
	// Only needed if credentials don't exist.
	BootstrapToken string

	// CredentialsFile is the path to store/load credentials. Empty means
	// DefaultCredentialsFile (with the pre-rename file migrated); on return
	// EnsureRegistered has set it to the path actually used.
	CredentialsFile string

	// Registration is the registration request.
	// Only needed if credentials don't exist.
	Registration *RegistrationRequest

	// Verbose enables debug logging.
	Verbose bool
}

type FileCredentialStore struct {
	Path string
}

type JobClient interface {
	// Poll polls for new jobs using long-polling.
	Poll(ctx context.Context, req *PollRequest) (*PollResponse, error)

	// AcknowledgeJob acknowledges receipt of a job.
	AcknowledgeJob(ctx context.Context, jobID string) error

	// ReportJobResult reports the result of a completed job.
	ReportJobResult(ctx context.Context, result *JobResult) error

	// ReportJobProgress reports progress on a running job.
	ReportJobProgress(ctx context.Context, jobID string, progress int, message string) error
}

type JobExecutor interface {
	Execute(ctx context.Context, job *JobInfo) (*JobResult, error)
}

type JobInfo struct {
	ID         string                 `json:"id"`
	Type       string                 `json:"type"`
	Priority   int                    `json:"priority"`
	TenantID   string                 `json:"tenant_id"`
	Payload    map[string]interface{} `json:"payload"`
	AuthToken  string                 `json:"auth_token"` // JWT for tenant data access
	CreatedAt  time.Time              `json:"created_at"`
	TimeoutSec int                    `json:"timeout_seconds"`

	// WorkflowContext is set when the job was triggered by a workflow.
	// It allows correlating job execution with workflow runs.
	WorkflowContext *WorkflowContext `json:"workflow_context,omitempty"`
}

type JobPoller struct {
	// contains filtered or unexported fields
}

type JobResult struct {
	JobID         string                 `json:"job_id"`
	Status        string                 `json:"status"` // completed, failed, canceled
	CompletedAt   time.Time              `json:"completed_at"`
	DurationMs    int64                  `json:"duration_ms"`
	FindingsCount int                    `json:"findings_count"`
	Error         string                 `json:"error,omitempty"`
	Metadata      map[string]interface{} `json:"metadata,omitempty"`

	// WorkflowContext is echoed back if the job was triggered by a workflow.
	// This allows the Workflow Executor to correlate results with workflow runs.
	WorkflowContext *WorkflowContext `json:"workflow_context,omitempty"`
}

type JobValidationError struct {
	JobID  string
	Reason string
}

type KeyChoice struct {
	// APIKey is the key to use.
	APIKey string
	// ExpiresAt is its expiry when known (pass it to
	// KeyRenewConfig.CurrentKeyExpiresAt).
	ExpiresAt *time.Time
	// NeverExpires is true when the server said the key has no expiry (pass
	// it to KeyRenewConfig.CurrentKeyNeverExpires). False when unknown.
	NeverExpires bool
	// FromStateFile is true when the key is a renewed key read from the
	// credentials file rather than the configured one.
	FromStateFile bool
	// Reason explains the choice, for the sensor's log.
	Reason string
}

type KeyRenewConfig struct {
	// RenewFraction is the fraction of the key lifetime at which to renew
	// (0 < f < 1). Default 0.5.
	RenewFraction float64

	// MinInterval floors the computed schedule. Default 1m.
	MinInterval time.Duration

	// RetryInterval is the wait before retrying a failed renewal. Default 30s.
	RetryInterval time.Duration

	// OnRotated is called after a successful key swap so the caller can persist
	// the new key (e.g. FileCredentialStore.Save) for the next restart.
	//
	// A non-nil error is treated as a failure, not a warning: the server has
	// already invalidated the previous key, so an unpersisted new key means
	// the next restart comes up with a dead credential. The manager reports
	// the error (stderr + OnPersistError), keeps the running client on the new
	// key, and retries the persist every RetryInterval. It does NOT rotate
	// again until the persist succeeds — rotating on top of an unsaved key
	// would only widen the gap.
	OnRotated func(newKey string, expiresAt *time.Time) error

	// OnPersistError, if set, is called each time OnRotated fails. Use it to
	// surface the condition (metrics, health check, alert).
	OnPersistError func(err error)

	// CurrentKeyExpiresAt is the expiry of the key the client starts with,
	// when the caller knows it (e.g. stored next to the key). When set, the
	// first renewal is scheduled from it instead of rotating immediately.
	CurrentKeyExpiresAt *time.Time

	// CurrentKeyNeverExpires tells the manager the server issued the current
	// key without a TTL. The manager then does nothing: there is nothing to
	// renew, and the discovery rotation would replace a working key for no
	// benefit. Leave false when unknown — the manager then performs one
	// discovery renewal to learn the server's TTL posture.
	CurrentKeyNeverExpires bool

	// Verbose enables debug logging.
	Verbose bool
}

type KeyRenewManager struct {
	// contains filtered or unexported fields
}

type KeyRenewer interface {
	RenewKey(ctx context.Context) (*RenewKeyResponse, error)
	SetAPIKey(key string)
}

type LeaseClient interface {
	RenewLease(ctx context.Context, req *LeaseRenewRequest) (*LeaseRenewResponse, error)
	ReleaseLease(ctx context.Context) error
}

type LeaseConfig struct {
	// LeaseDuration is how long the lease is valid for.
	// Default: 60 seconds.
	LeaseDuration time.Duration

	// RenewInterval is how often to renew the lease.
	// Should be less than LeaseDuration (typically 1/3).
	// Default: 20 seconds.
	RenewInterval time.Duration

	// GracePeriod is how long to wait after lease expiry before considering sensor dead.
	// Default: 15 seconds.
	GracePeriod time.Duration

	// MaxJobs is the maximum concurrent jobs this sensor can handle.
	MaxJobs int

	// MetricsCollector provides system metrics for lease renewal.
	// If nil, metrics are not reported.
	MetricsCollector MetricsCollector

	// OnLeaseExpired is called when the lease expires (sensor should shutdown).
	OnLeaseExpired func()

	// Verbose enables debug logging.
	Verbose bool

	// UseSecureIdentity enables cryptographically secure holder identity.
	// When true, the holder identity includes a random nonce that cannot be guessed.
	// Default: true (should only be false for testing).
	UseSecureIdentity *bool

	// IdentityPrefix is an optional prefix for the holder identity.
	// Useful for identifying sensor type (e.g., "scanner", "collector").
	IdentityPrefix string
}

type LeaseInfo struct {
	SensorID         string    `json:"agent_id"`
	HolderIdentity   string    `json:"holder_identity"`
	LeaseDurationSec int       `json:"lease_duration_seconds"`
	AcquireTime      time.Time `json:"acquire_time"`
	RenewTime        time.Time `json:"renew_time"`
	ResourceVersion  int       `json:"resource_version"`
}

type LeaseManager struct {
	// contains filtered or unexported fields
}

type LeaseRenewRequest struct {
	HolderIdentity       string   `json:"holder_identity"`
	LeaseDurationSeconds int      `json:"lease_duration_seconds"`
	CurrentJobs          int      `json:"current_jobs"`
	MaxJobs              int      `json:"max_jobs"`
	CPUPercent           *float64 `json:"cpu_percent,omitempty"`
	MemoryPercent        *float64 `json:"memory_percent,omitempty"`
	DiskPercent          *float64 `json:"disk_percent,omitempty"`
	JobsCompletedTotal   int      `json:"jobs_completed_total,omitempty"`
	JobsFailedTotal      int      `json:"jobs_failed_total,omitempty"`
}

type LeaseRenewResponse struct {
	Success         bool      `json:"success"`
	Message         string    `json:"message,omitempty"`
	ResourceVersion int       `json:"resource_version"`
	RenewTime       time.Time `json:"renew_time"`
}

type LeaseStatus struct {
	Running         bool
	Healthy         bool
	LastRenewTime   time.Time
	ResourceVersion int
	CurrentJobs     int
	LastError       error
}

type MetricsCollector interface {
	Collect() (*SystemMetrics, error)
}

type PlatformClient struct {
	// contains filtered or unexported fields
}

type PlatformSensor struct {
	// contains filtered or unexported fields
}

type PollRequest struct {
	MaxJobs        int      `json:"max_jobs"`
	Capabilities   []string `json:"capabilities,omitempty"`
	TimeoutSeconds int      `json:"timeout_seconds,omitempty"`
}

type PollResponse struct {
	Jobs             []*JobInfo `json:"jobs"`
	PollIntervalHint int        `json:"poll_interval_hint,omitempty"` // Suggested wait before next poll
	QueueDepth       int        `json:"queue_depth,omitempty"`        // Total pending jobs
}

type PollerConfig struct {
	// MaxConcurrentJobs is the maximum number of concurrent jobs.
	MaxConcurrentJobs int

	// PollTimeout is the long-poll timeout (how long to wait for jobs).
	PollTimeout time.Duration

	// RetryDelay is the delay between poll attempts on error.
	RetryDelay time.Duration

	// Capabilities to advertise when polling.
	Capabilities []string

	// OnJobStarted is called when a job starts executing.
	OnJobStarted func(job *JobInfo)

	// OnJobCompleted is called when a job completes (success or failure).
	OnJobCompleted func(job *JobInfo, result *JobResult)

	// Verbose enables debug logging.
	Verbose bool

	// AllowedJobTypes restricts which job types can be executed.
	// If empty, all job types are allowed.
	AllowedJobTypes []string

	// MaxPayloadSize limits the maximum payload size for jobs (default: 10MB).
	MaxPayloadSize int

	// RequireAuthToken requires jobs to have a valid auth token.
	// When true, jobs without AuthToken will be rejected.
	RequireAuthToken bool

	// ValidateTokenClaims enables JWT claims validation.
	// When true, the AuthToken's tenant_id claim must match job's TenantID.
	ValidateTokenClaims bool
}

type RegistrationRequest struct {
	// Name is the sensor's display name.
	Name string `json:"name"`

	// Capabilities are the scanner/collector capabilities (e.g., "sast", "sca", "dast").
	Capabilities []string `json:"capabilities"`

	// Tools are the specific tools available (e.g., "semgrep", "trivy", "nuclei").
	Tools []string `json:"tools,omitempty"`

	// Region is the deployment region (e.g., "us-east-1", "ap-southeast-1").
	Region string `json:"region,omitempty"`

	// Labels are optional key-value labels for filtering.
	Labels map[string]string `json:"labels,omitempty"`

	// MaxConcurrentJobs is the maximum number of concurrent jobs.
	MaxConcurrentJobs int `json:"max_concurrent_jobs,omitempty"`
}

type RegistrationResponse struct {
	// SensorID is the pre-rename "agent_id" key (legacyv1.FieldSensorID).
	SensorID  string `json:"agent_id"`
	APIKey    string `json:"api_key"`    // Only returned once - store securely!
	APIPrefix string `json:"api_prefix"` // Prefix for display/logging (safe to log)
	Message   string `json:"message,omitempty"`
}

type RenewError struct{ StatusCode int }

type RenewKeyResponse struct {
	APIKey    string     `json:"api_key"`
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
}

type ResourceController interface {
	// AcquireSlot attempts to acquire a job execution slot.
	// Returns true if acquired, false if throttled or at capacity.
	AcquireSlot(ctx context.Context) bool

	// ReleaseSlot releases a previously acquired slot.
	ReleaseSlot()

	// IsThrottled returns true if resource limits are exceeded.
	IsThrottled() bool
}

type SensorBuilder struct {
	// contains filtered or unexported fields
}

type SensorCredentials struct {
	SensorID  string `json:"sensor_id"`
	APIKey    string `json:"api_key"`
	APIPrefix string `json:"api_prefix"`
	// ExpiresAt is the key's expiry when known (from a key renewal). Pass it
	// to KeyRenewConfig.CurrentKeyExpiresAt on startup so the renewer does
	// not rotate a still-valid key immediately.
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
	// ConfiguredKeyFingerprint is the salted PBKDF2 fingerprint
	// (KeyFingerprint) of the configured key APIKey was renewed from. When
	// the configured key no longer matches it, an administrator issued a new
	// key and the operator configured it: ChooseAPIKey then uses the
	// configured key. Empty in files written before it existed.
	ConfiguredKeyFingerprint string `json:"configured_key_fingerprint,omitempty"`
	// NeverExpires records that the server issued APIKey without an expiry
	// (its key TTL is off), as opposed to an expiry that is not known. Pass it
	// to KeyRenewConfig.CurrentKeyNeverExpires so a restart does not rotate
	// the key again just to learn that.
	NeverExpires bool `json:"never_expires,omitempty"`
}

type SensorInfo struct {
	ID           string    `json:"id"`
	Name         string    `json:"name"`
	Capabilities []string  `json:"capabilities"`
	Region       string    `json:"region"`
	Status       string    `json:"status"`
	CreatedAt    time.Time `json:"created_at"`
}

type SensorStatus struct {
	SensorID    string
	Running     bool
	Healthy     bool
	CurrentJobs int
	LastRenew   time.Time
	LastError   error

	// Resource status (if controller is enabled)
	ResourceStatus *resource.ControllerStatus
}

type SimpleMetricsCollector struct{}

type StatePersistence struct {
	Persistent bool
	// Reason explains the verdict, for the sensor's log.
	Reason string
}

type SystemMetrics struct {
	CPUPercent    float64 `json:"cpu_percent"`
	MemoryPercent float64 `json:"memory_percent"`
	DiskPercent   float64 `json:"disk_percent"`
	CurrentJobs   int     `json:"current_jobs"`
	MaxJobs       int     `json:"max_jobs"`
}

type WorkflowContext struct {
	// WorkflowID is the UUID of the workflow definition.
	WorkflowID string `json:"workflow_id"`

	// WorkflowRunID is the UUID of the specific workflow execution.
	WorkflowRunID string `json:"workflow_run_id"`

	// TriggerType indicates what triggered the workflow (e.g., "finding_created", "schedule", "manual").
	TriggerType string `json:"trigger_type"`

	// ActionNodeID is the UUID of the action node that triggered this job.
	ActionNodeID string `json:"action_node_id"`

	// ActionNodeKey is the node_key of the action node (e.g., "run_scan_1").
	ActionNodeKey string `json:"action_node_key"`
}