function

type ArtifactResolver interface {
	Resolve(ctx context.Context, uri string) (digest string, err error)
}

type CatalogProxies interface {
	ProxyURL(ns v1.NamespaceName, name v1.ObjectName) (string, bool)
}

type Deps struct {
	Store     store.Store
	Runtime   runtime.Runtime
	Scheduler scheduler.Scheduler
	Gateway   gateway.Gateway
	Validator ShapeValidator
	Logger    *slog.Logger
	// LogMaxRecordBytes is FUNCD_FUNCLOG_MAX_RECORD_BYTES for every shim and pool host (ADR-0168); 0 sets none.
	LogMaxRecordBytes int
	// Materializer + ShimCommand enable real function execution (ADR-0030): the
	// reconciler materializes the artifact and launches the runtime shim, and gates
	// readiness on the shim's /health/readiness. When Materializer is nil the reconciler
	// runs the legacy long-lived placeholder (ADR-0020) — used by the runtime-port tests.
	Materializer Materializer
	ShimCommand  []string // launch prefix for the DEFAULT shim, e.g. ["node", "/.../shim.mjs"]
	// ShimCommandsByFamily maps a runtime-family prefix → its shim launch prefix (ADR-0049): a
	// function whose spec.runtime starts with the key (e.g. "python") is launched with that
	// command instead of ShimCommand. Empty ⇒ every runtime uses the default ShimCommand (node).
	ShimCommandsByFamily map[string][]string

	// Resolver (ADR-0035) resolves an OCI artifact ref → digest at Revision-stamp time, so
	// the user need not pin the digest. nil → no resolution (file:// dev / legacy mode).
	Resolver ArtifactResolver
	// Platforms (ADR-0145) lists an artifact digest's platforms for the placement gate. nil → no gate.
	Platforms PlatformResolver

	// EndpointMode + ImageFor select container execution (ADR-0032). EndpointLoopback
	// (default) is the process driver: ShimCommand launches the shim, loopback+portfile.
	// EndpointNetnsFixedPort is the containerd driver: the shim is the curated IMAGE's
	// entrypoint (Command empty), the artifact is bind-mounted, and it binds a fixed port
	// on the netns IP. ImageFor maps fn.Spec.Runtime → the curated image ref.
	EndpointMode EndpointMode
	ImageFor     func(runtime string) string

	// PoolShimCommand enables worker pooling (ADR-0046): the launch prefix for the pooled
	// worker_threads host (e.g. ["node", "/.../pool.mjs"]). When set, a function declaring
	// spec.pooling.worker co-locates with same-key peers in one pool worker launched with
	// this command + FUNCD_POOL_MANIFEST. Empty ⇒ pooling is off (every function is solo).
	PoolShimCommand []string
	// PoolShimsByFamily maps a runtime-family prefix → its pool-host launch prefix (ADR-0050): a
	// python* function that opts in co-pools via this host (the subinterpreter pool.py) instead of
	// staying solo. Empty ⇒ only PoolShimCommand (node) pools; a family with no host runs solo.
	PoolShimsByFamily map[string][]string
	// PoolLimit caps handlers per pool worker (ADR-0046 Decision 3); 0 ⇒ the default (16).
	PoolLimit int
	// PoolManifestDir holds the pool workers' manifests, which carry member credentials: a 0700 dir funcd owns,
	// emptied by NewReconciler. Empty ⇒ a private temp dir NewReconciler creates and Close removes.
	PoolManifestDir string

	// Secrets resolves a function's bound Secret names → an env-var map injected into the
	// worker (ADR-0057, F15 last mile). nil ⇒ secret injection disabled: a function declaring
	// spec.secrets fails closed (SecretResolveFailed). Satisfied by *secrets.Resolver.
	Secrets SecretResolver
	// DeveloperFor returns the identity the PDP authorizes for a namespace's secret reads
	// (ADR-0057 Decision 4). Defaulted to the namespace-scoped developer identity when Secrets
	// is set and this is nil; ignored when Secrets is nil.
	DeveloperFor func(ns v1.NamespaceName) auth.Identity

	// InvokeSockets provisions the per-function worker-node local API (ADR-0064) and yields the
	// socket path the reconciler sets as FUNCD_INVOKE_SOCKET. nil ⇒ fn-to-fn links off.
	InvokeSockets InvokeSocketProvider

	// S3Gateway, when Enabled, injects a per-function SigV4 keypair + endpoint into the worker
	// env (ADR-0085) for a function that declares spec.blob — AWS_ACCESS_KEY_ID/
	// AWS_SECRET_ACCESS_KEY (DeriveKeypair over Master), AWS_REGION, AWS_ENDPOINT_URL_S3
	// (ListenAddr). A function without spec.blob, or a disabled gateway, gets nothing.
	S3Gateway S3GatewayInjection

	// CatalogMaster is the node master secret the per-function catalog token is derived from (ADR-0137):
	// resolveCatalogEnv injects FUNCD_CATALOG_<ALIAS>_TOKEN = DeriveCatalogToken(master, ns, fn), a
	// MAC-authenticated bearer the catalog PEP proxy verifies (was the shared QUACK_TOKEN). It is the
	// SAME master the S3 gateway derives keypairs from (loaded once at the compose root). nil/empty ⇒ a
	// still-derivable but unverifiable token (the proxy holds the real master); the master is never logged.
	CatalogMaster []byte

	// CatalogProxies reports the catalog listeners bound in this daemon run (ADR-0137, ADR-0162): a consumer is
	// injected its catalog's bound listener URL, and waits while none is bound. nil ⇒ the catalog's status.endpoint,
	// for harnesses without a Manager.
	CatalogProxies CatalogProxies

	// CatalogExtensionDir, when non-empty, is injected as DUCKDB_EXTENSION_DIRECTORY into a
	// catalog-consumer function's worker env (a function declaring spec.catalogs) so its handler's
	// `LOAD quack`/`ducklake` resolves the curated DuckDB extensions from this dir. It is the dev
	// analogue of the prod bundle's duckdb-ext (ADR-0089): `funcdctl dev` extracts the embedded
	// catalog engine's extensions once and points consumers at them; prod leaves it empty (the
	// bundle carries duckdb-ext under FUNCD_BUNDLE_DIR instead). Empty ⇒ no injection.
	CatalogExtensionDir string

	// SupervisionPeriod is the requeue of a Ready function (ADR-0142); 0 ⇒ controller.SupervisionPeriod.
	SupervisionPeriod time.Duration
	// BootBackoffInitial and BootBackoffMax bound the wait before a replica that crashed while booting is created
	// again (ADR-0160); 0 ⇒ 10 s and max(5 min, initial). Negative, or a set max below initial, is fault.Invalid.
	BootBackoffInitial time.Duration
	BootBackoffMax     time.Duration

	// Calls counts the calls made to each worker (ADR-0143): the resolver records each hand-out and the drain asks
	// whether a demoted revision's worker is idle. nil ⇒ every worker is idle.
	Calls *activator.CallTracker
	// DrainGrace bounds how long a demoted revision's workers drain; 0 ⇒ 30 s (ADR-0143).
	DrainGrace time.Duration
	// HandOutSettle is how long after a hand-out, or after the switch, a worker may still receive a call; 0 ⇒ 2 s.
	HandOutSettle time.Duration
	// DrainPollInterval is the longest gap between drain passes (runtime.drainPollInterval, ADR-0163); 0 ⇒ 1 s.
	DrainPollInterval time.Duration
	// BootTimeout stops a replica not ready this long after its last successful Start (runtime.bootTimeout, ADR-0163,
	// ADR-0183); 0 ⇒ 1 min.
	BootTimeout time.Duration
	// LivenessTimeout is how long a listening replica or pool host may stay silent on /health/liveness before it is
	// restarted (runtime.livenessTimeout, ADR-0215); 0 ⇒ max(30 s, three supervision periods).
	LivenessTimeout time.Duration
	// ReferentPollInterval re-checks a function waiting for a referent (controller.referentPollInterval, ADR-0163),
	// bounded by the supervision period (ADR-0142 Decision 9); 0 ⇒ 2 s.
	ReferentPollInterval time.Duration
	// Clock times the drain from drainingSince; nil ⇒ clock.System().
	Clock clock.Clock
}

type EndpointMode int

type FileMaterializer struct{}

type InvokeSocketProvider interface {
	SocketFor(ns v1.NamespaceName, name v1.ObjectName) (string, error)
	// PoolSocketFor provisions the one local API socket of pool worker `pool`, on which each call names its member;
	// members is the set it serves, replaced on every call.
	PoolSocketFor(ns v1.NamespaceName, pool v1.ObjectName, members []v1.ObjectName) (string, error)
	// Remove stops + deletes the function's local API listener (called from teardown on delete, so
	// the socket lifecycle tracks the Function resource — controller-driven, not leaked).
	Remove(ns v1.NamespaceName, name v1.ObjectName)
}

type Materializer interface {
	Materialize(ctx context.Context, fn *v1.Function) (localPath string, err error)
}

type PlatformResolver interface {
	Platforms(ctx context.Context, uri, digest string) ([]v1.OCIPlatform, error)
}

type Reconciler struct {
	// contains filtered or unexported fields
}

type S3GatewayInjection struct {
	Enabled    bool
	ListenAddr string
	// Endpoint is the sandbox-facing S3 URL (ADR-0085): the node address a netns'd worker can reach —
	// the CNI bridge gateway IP under containerd. Empty ⇒ derived as http://<ListenAddr> (loopback dev).
	Endpoint string
	// Derive returns the deterministic per-(kind, ns, name) SigV4 keypair (s3gateway.DeriveKeypair,
	// bound to the node master secret; ADR-0175). Required when Enabled.
	Derive func(kind v1.Kind, ns, name string) (access, secret string)
}

type SecretResolver interface {
	ResolveEnv(ctx context.Context, id auth.Identity, ns v1.NamespaceName, names []string) (map[string]string, error)
}

type ShapeValidator interface {
	Validate(ctx context.Context, fn *v1.Function) error
}