planner

type Allocation struct {
	CPUMillis   int
	MemoryBytes int64
	DiskBytes   int64

	// LogBytes is the sum of every app's log cap on this runtime (R-224).
	//
	// Committed, not measured. O-16 resolved to bounding what an install
	// promises rather than watching what accumulates: if every app's logs are
	// capped and the caps sum under the budget, the total cannot exceed it.
	// Measuring would mean acting after the disk was already filling, and the
	// only remedy then is recreating containers — which the reconciler may not
	// do because an unrelated app turned chatty.
	LogBytes int64
}

type Allocations interface {
	// AllocatedOn returns what is already committed on a runtime adapter,
	// excluding the app being planned — replanning an app must not count its
	// own current allocation against itself.
	AllocatedOn(ctx context.Context, adapterRef, excludeAppID string) (Allocation, error)
}

type ImageReader interface {
	Inspect(ctx context.Context, appID, reference string, want oci.Platform) (oci.Inspection, error)
}

type InstallRegistries interface {
	CurrentRegistry(ctx context.Context) (InstallRegistry, error)
}

type InstallRegistry interface {
	Configured() bool
	Always() bool
	Host() string
}

type Inventory interface {
	// LiveApps lists the live apps f admits. Every app a candidate policy
	// would block must be among them; others may be too.
	LiveApps(ctx context.Context, f InventoryFilter) ([]InventoryApp, error)
}

type InventoryApp struct {
	AppID string
	Name  string

	// Spec is the revision the app is pinned to — what its next deploy would
	// actually try to do, not its newest draft.
	Spec *spec.AppSpec

	// AnonymousGrant is whether anyone on the internet can reach this app
	// without signing in (R-075, R-077), and AnonymousPasscode whether they
	// need its passcode to (R-075a).
	AnonymousGrant    bool
	AnonymousPasscode bool
}

type InventoryFilter struct {
	// Every live app with a source: a source allowlist is in force.
	All bool

	// Apps shared with anyone on the internet; WithoutPasscode narrows that to
	// those shared without a passcode.
	Anonymous                bool
	AnonymousWithoutPasscode bool

	// EgressRuntimes are the runtimes that cannot enforce egress rules. An app
	// on one is named when the candidate restricts every app's egress
	// (EgressRestrictsAll), or when the app has egress settings of its own.
	EgressRuntimes     []string
	EgressRestrictsAll bool

	// OwnEgress names every app with egress settings of its own: the
	// candidate forbids loosening, and only an app's own settings loosen.
	OwnEgress bool

	// Runtimes and Builders are adapter isolation classes. An app is named
	// when its runtime's class is below the higher of its own runtime floor
	// and MinRuntime, or its builder's is below the higher of its own build
	// floor and MinBuild.
	Runtimes   map[string]spec.IsolationClass
	MinRuntime spec.IsolationClass
	Builders   map[string]spec.IsolationClass
	MinBuild   spec.IsolationClass
}

type Plan struct {
	AppID  string            `json:"app_id"`
	Bundle api.BundlePlan    `json:"-"`
	Notes  []string          `json:"notes,omitempty"`
	Checks map[string]string `json:"checks"`

	// Egress is the rules the app would run with, merged, with where each
	// part came from and what every loosening needs (R-188).
	Egress policy.EffectiveEgress `json:"egress"`
}

type Planner struct {
	// contains filtered or unexported fields
}

type PolicyViolation struct {
	AppID   string `json:"app_id"`
	AppName string `json:"app_name"`

	// Code is the error the app's next deploy would fail with, so the console
	// can show the same wording the developer will eventually see.
	Code    string `json:"code"`
	Message string `json:"message"`
	Remedy  string `json:"remedy,omitempty"`
}