addrresolver

type APIClient interface {
	BindSTCPR(ctx context.Context, port string) error
	BindQUIC(ctx context.Context, port string) error
	// BindWT registers this visor's WebTransport UDP port and the SHA-256 hex of
	// its self-signed cert (the hash dialing peers pin). Mirrors BindQUIC + the
	// cert hash.
	BindWT(ctx context.Context, port, certHash string) error
	Resolve(ctx context.Context, netType string, pk cipher.PubKey) (VisorData, error)
	Transports(ctx context.Context) (map[cipher.PubKey][]string, error)
	TransportsType(ctx context.Context, tpType types.Type) (map[cipher.PubKey][]string, error)
	Addresses(ctx context.Context) string
	LocalPublicIP() string
	// SetPublicIP records the visor's externally-reachable IPs once they have
	// been determined asynchronously (so the control plane need not wait on
	// the dmsg/STUN lookup). Passing empty strings signals "determination
	// finished, none available" and unblocks any pending bind.
	SetPublicIP(publicIP, publicIPv6 string)
	Close() error
}

type BindPublisher interface {
	// SetBindPublishHook installs fn (or clears it with nil). fn is called
	// with the canonical transport-type wire name ("stcpr", "sudph",
	// "squicr", "swtr") and the LocalAddresses the visor just registered.
	SetBindPublishHook(fn func(netType string, payload LocalAddresses))
	// SetCXOKeepaliveHealthyFunc installs fn (or clears it with nil). While fn
	// reports healthy on the epoch of the last accepted bind, an unchanged
	// re-bind skips the HTTP POST.
	SetCXOKeepaliveHealthyFunc(fn func() (healthy bool, epoch uint64))
}

type BindRequest struct {
	Port string `json:"port"`
}

type Error struct {
	Error string `json:"error"`
}

type Handshake func(net.Conn) (net.Conn, error)

type LocalAddresses struct {
	Port      string   `json:"port"`
	Addresses []string `json:"addresses"`
	// PublicIP is the visor's STUN- or dmsg-derived public IPv4 address,
	// if known. AR uses this to override the observed source IP when the
	// latter is non-public (e.g., a visor running on the same Docker host
	// as AR reaches it via hairpin SNAT, so AR's UDP socket sees the
	// docker bridge gateway IP — 172.x.y.z — instead of the visor's
	// actual public IP). Old visors that don't set this field leave AR's
	// behavior unchanged: AR falls back to the observed source IP, which
	// is correct for any visor whose path to AR is not NAT'd into a
	// private space. Empty string means "let AR decide."
	//
	// Historical note: pre-#1525 this field carried either v4 or v6
	// indiscriminately. With Phase 2c, the convention is v4-only here;
	// PublicIPv6 carries v6. AR still accepts v6 in this field for
	// backward-compat with pre-Phase-2c visors.
	PublicIP string `json:"public_ip,omitempty"`
	// PublicIPv6 is the visor's declared IPv6 public address. Added in
	// #1525 Phase 2c so visors reaching AR via the dmsg-routed default
	// path (where AR observes the dmsg-bridge's source, not the visor's
	// own family) can still register their v6 endpoint. The AR populates
	// VisorData.RemoteAddrV6 from this field when the observed remote
	// source isn't v6. Empty when the visor is v4-only — preserves the
	// pre-Phase-2c single-stack contract.
	PublicIPv6 string `json:"public_ip_v6,omitempty"`
	// CertHash is the lowercase SHA-256 hex of the visor's self-signed
	// WebTransport certificate. WT has no CA; a dialing peer pins this hash. Only
	// the WT bind sets it (it rides VisorData via the embedded LocalAddresses, so
	// /resolve/wt returns it); empty for every other transport type.
	CertHash string `json:"cert_hash,omitempty"`
}

type MockAPIClient struct {
	mock.Mock
}

type RemoteVisor struct {
	PK   cipher.PubKey
	Addr string
}

type SUDPHBinder interface {
	APIClient
	BindSUDPH(filter *pfilter.PacketFilter, handshake Handshake) (<-chan RemoteVisor, error)
}

type VisorData struct {
	RemoteAddr   string `json:"remote_addr"`
	RemoteAddrV6 string `json:"remote_addr_v6,omitempty"`
	IsLocal      bool   `json:"is_local,omitempty"`
	LocalAddresses
}