store

type Backend = legacy.Backend

type Config struct {
	Adapter string
	// Release prefixes the objects' names and the Valkey keys.
	Release string
	Kube    KubeNeed
	// Blob replaces the port of the same name; nil keeps what Adapter brings.
	Blob *config.PortsBlob
	// DynamoDB is the table of the `dynamodb` adapter: Table on layout v4,
	// Tables (one per module) on layout v5.
	DynamoDB dynamoport.Config

	// Module is the module this process runs, and Peers the modules whose
	// tables it may read (ADR 0072). They matter on layout v5 only: the State
	// is then Module's own table, a write of another module's key is refused,
	// and each peer is a read-only view. The composition root of each binary
	// sets them; an empty Module on layout v5 is the whole-estate view of the
	// migration and the backup (the router over every table).
	Module port.Module
	Peers  []port.Module

	// NoTrigger is set by a module that never notifies a controller (the backup
	// and the restore): the plan's `trigger` adapter is not built for it. The
	// aws-serverless preset names `invoke`, which needs the controller functions
	// only the issuer's document names, and would stop such a module at start.
	NoTrigger bool

	// Secrets delivers the secrets the document names (the Valkey password):
	// the composition root sets it after FromServe. Nil delivers none.
	Secrets secrets.Source
	// SecretsRoot is the serve document's `secrets.root` when its source is
	// ssm: the root the `ssm` Secrets adapter takes.
	SecretsRoot string
	// SecretsKMSKey is the serve document's `secrets.kmsKeyId` when its source
	// is ssm: the key the `ssm` Secrets adapter encrypts what it writes with.
	SecretsKMSKey string
	// Secrets layout (ADR 0041): the serve document's `secrets.layout`,
	// `.region`, `.endpoint` and `.grace` when its source is ssm. The layout
	// is v4 (the Secrets port is over it, internal/secretstore) or v5 (ADR
	// 0072, [Stores.V5]); the two do not mix with the other layout's tables.
	SecretsLayout   string
	SecretsSSM      bool
	SecretsRegion   string
	SecretsEndpoint string
	SecretsGrace    time.Duration
	// SecretsReadCache is `secrets.readCache`; nil is not set.
	SecretsReadCache *time.Duration
	// OpenState opens the backend of the v4 stores (storage/state/ssm over the
	// service's retryer, openSSMState).
	// Nil is that backend.
	OpenState secretstore.Opener

	// Cloudflare and Instance are the service document's `cloudflare` section
	// and the instance name; the Blob mints its own R2 credentials from a
	// preset of it (`ports.blob.s3.credentials.preset`). Nil when the blob uses
	// a static document, which needs neither.
	Cloudflare *config.Cloudflare
	Instance   string
	// CloudflareDial opens a Cloudflare account; nil is the real client.
	CloudflareDial minter.Dialer
	// contains filtered or unexported fields
}

type FlagTable struct {
	// Module names the table's module; empty for the one table of layout v4.
	Module port.Module
	State  port.State
}

type KubeNeed int

type Stores struct {
	// Ports is every port, over the chosen adapter.
	Ports port.Set
	// Backend is today's storage as it was opened: what the `legacy` adapter
	// is made of, and, with any adapter, the cluster's own objects that stay the
	// cluster's (the token review, the declared OAuth client). The domain stores
	// (a connected workspace and its credential, an organisation, a person's
	// link, the Slack records) are on Ports for every adapter but `legacy`
	// (internal/portstore), and in the ConfigMaps and Secrets this reaches for
	// `legacy`. It is nil with the memory adapter, which has none.
	Backend *Backend
	// Adapter is the state adapter's name.
	Adapter string
	// Plan is the resolved adapter per concern, for the packages that wire a
	// concern this package does not.
	Plan port.Table
	// SecretsRoot is the root the secrets are kept under when the source is
	// ssm (/sluis/<instance>), and empty for another source.
	SecretsRoot string
	// Secrets delivers the secrets the document names, by name: what the
	// composition root put in Config.Secrets. Nil delivers none.
	Secrets secrets.Source
	// V4 is the installation's secrets on layout v4: Internal and External
	// over one state store. Nil when the secrets are not the ssm source's.
	V4 *secretstore.Stores
	// V5 is the installation's secrets on layout v5: module first (ADR 0072).
	// Nil unless `secrets.layout: v5`; V4 is then nil, and the Secrets port
	// is not set: a caller reads its module's names from V5. The callers move
	// to it module by module.
	V5 *secretstore.StoresV5
	// ClientSecrets is the Secrets port of the generated clients' records
	// (external/oidc/<id>) on layout v5, where Ports.Secrets is not set. Nil on
	// layout v4; [Stores.ClientSecretPort] picks the one in force.
	ClientSecrets port.Secrets
	// Tables is the table of each module on layout v5, nil on layout v4 and
	// with any other adapter. Router, on it, is the one State over all of them
	// that the migration and the backup use.
	Tables *dynamoport.Tables
	// Shared is true when the state is one every replica sees: a Valkey.
	Shared bool
	// Usable is whether the State, Index and snapshot Blob ports work at all:
	// the memory adapter, and the legacy one with a Valkey. Without them a
	// caller keeps its own process-local store, as it always has.
	Usable bool
	// contains filtered or unexported fields
}