provider

type ArgoApplyRequest struct {
	InstanceID id.ID             `json:"instance_id"`
	TenantID   string            `json:"tenant_id"`
	App        ArgoCDSource      `json:"app"`
	Labels     map[string]string `json:"labels,omitempty"`
}

type ArgoCDSource struct {
	Project        string         `json:"project,omitempty"`
	RepoURL        string         `json:"repo_url"                  validate:"required"`
	Path           string         `json:"path,omitempty"`
	TargetRevision string         `json:"target_revision,omitempty"`
	DestServer     string         `json:"dest_server,omitempty"`
	DestNamespace  string         `json:"dest_namespace,omitempty"`
	Helm           *ArgoHelm      `json:"helm,omitempty"`
	SyncPolicy     ArgoSyncPolicy `json:"sync_policy,omitzero"`
}

type ArgoEngine interface {
	// ArgoApply creates or updates the instance's Application resource.
	ArgoApply(ctx context.Context, req ArgoApplyRequest) (*ProvisionResult, error)

	// ArgoDelete removes the instance's Application resource.
	ArgoDelete(ctx context.Context, instanceID id.ID) error

	// ArgoStatus reports the Application's sync/health as an instance state.
	ArgoStatus(ctx context.Context, instanceID id.ID) (*InstanceStatus, error)
}

type ArgoHelm struct {
	ValueFiles []string          `json:"value_files,omitempty"`
	Parameters map[string]string `json:"parameters,omitempty"`
}

type ArgoSyncPolicy struct {
	Automated bool `json:"automated,omitempty"`
	SelfHeal  bool `json:"self_heal,omitempty"`
	Prune     bool `json:"prune,omitempty"`
}

type Capability string

type ConfigFile struct {
	Name    string `db:"name"    json:"name"`    // e.g. "app-config"
	Path    string `db:"path"    json:"path"`    // mount path, e.g. "/etc/app/config.yaml"
	Format  string `db:"format"  json:"format"`  // "json", "yaml", "env", "text"
	Content string `db:"content" json:"content"` // file content (stored in vault at deploy time)
}

type Credentials struct {
	Values    map[string]string `json:"-"`
	Raw       any               `json:"-"`
	ExpiresAt time.Time         `json:"-"`
}

type CredentialsResolver interface {
	ResolveCredentials(ctx context.Context, providerKey string) (*Credentials, error)
}

type CredentialsResolverFunc func(ctx context.Context, providerKey string) (*Credentials, error)

type DeployRequest struct {
	InstanceID id.ID               `json:"instance_id"`
	ReleaseID  id.ID               `json:"release_id"`
	Services   []ServiceDeploySpec `json:"services"`
	Strategy   string              `json:"strategy"`
}

type DeployResult struct {
	ProviderRef string     `json:"provider_ref"`
	Status      string     `json:"status"`
	Endpoints   []Endpoint `json:"endpoints,omitempty"`
}

type DeploymentSource struct {
	Type      SourceType      `json:"type"                validate:"required"`
	Services  []ServiceSpec   `json:"services,omitempty"`
	Helm      *HelmSource     `json:"helm,omitempty"`
	Manifests *ManifestSource `json:"manifests,omitempty"`
	ArgoCD    *ArgoCDSource   `json:"argocd,omitempty"`
}

type Endpoint struct {
	ServiceName string `json:"service_name,omitempty"`
	URL         string `json:"url"`
	Port        int    `json:"port"`
	Protocol    string `json:"protocol"`
	Public      bool   `json:"public"`
}

type ExecRequest struct {
	Command []string  `json:"command"`
	Stdin   io.Reader `json:"-"`
	TTY     bool      `json:"tty"`
}

type ExecResult struct {
	ExitCode int    `json:"exit_code"`
	Stdout   []byte `json:"stdout"`
	Stderr   []byte `json:"stderr"`
}

type HealthCheckSpec struct {
	Path     string        `json:"path,omitempty"`
	Port     int           `json:"port"`
	Interval time.Duration `json:"interval"`
	Timeout  time.Duration `json:"timeout"`
	Retries  int           `json:"retries"`
}

type HealthChecker interface {
	// HealthCheck tests connectivity and returns a health status.
	HealthCheck(ctx context.Context) (*HealthStatus, error)
}

type HealthStatus struct {
	Healthy   bool          `db:"healthy"    json:"healthy"`
	Message   string        `db:"message"    json:"message"`
	Latency   time.Duration `db:"latency"    json:"latency"`
	CheckedAt time.Time     `db:"checked_at" json:"checked_at"`
}

type HelmEngine interface {
	// HelmInstall installs the chart as a new release for the instance.
	HelmInstall(ctx context.Context, req HelmInstallRequest) (*ProvisionResult, error)

	// HelmUpgrade upgrades the instance's existing release.
	HelmUpgrade(ctx context.Context, req HelmUpgradeRequest) (*DeployResult, error)

	// HelmUninstall removes the instance's release.
	HelmUninstall(ctx context.Context, instanceID id.ID) error

	// HelmStatus reports the release's state.
	HelmStatus(ctx context.Context, instanceID id.ID) (*InstanceStatus, error)
}

type HelmInstallRequest struct {
	InstanceID id.ID        `json:"instance_id"`
	TenantID   string       `json:"tenant_id"`
	Namespace  string       `json:"namespace,omitempty"`
	Chart      RenderedHelm `json:"chart"`
}

type HelmSource struct {
	Repo        string         `json:"repo,omitempty"` // oci:// or https chart repo
	Chart       string         `json:"chart"                  validate:"required"`
	Version     string         `json:"version,omitempty"`
	ReleaseName string         `json:"release_name,omitempty"` // defaulted from the instance
	Namespace   string         `json:"namespace,omitempty"`
	Values      map[string]any `json:"values,omitempty"`
	ValuesFiles []string       `json:"values_files,omitempty"`
}

type HelmUpgradeRequest struct {
	InstanceID id.ID        `json:"instance_id"`
	Namespace  string       `json:"namespace,omitempty"`
	Chart      RenderedHelm `json:"chart"`
}

type InstanceState string

type InstanceStatus struct {
	State     InstanceState            `json:"state"`
	Ready     bool                     `json:"ready"`
	Restarts  int                      `json:"restarts"` // sum across services
	StartedAt *time.Time               `json:"started_at,omitempty"`
	Message   string                   `json:"message,omitempty"`
	Endpoints []Endpoint               `json:"endpoints"`
	Services  map[string]ServiceStatus `json:"services,omitempty"`
	Metadata  map[string]string        `json:"metadata,omitempty"`
}

type KustomizeSource struct {
	Files map[string]string `json:"files"`
	Root  string            `json:"root,omitempty"`
}

type Location struct {
	Latitude  float64 `json:"latitude,omitempty"`
	Longitude float64 `json:"longitude,omitempty"`
	Country   string  `json:"country,omitempty"`
	City      string  `json:"city,omitempty"`
}

type LogOptions struct {
	ServiceName string    `json:"service_name,omitempty"`
	Follow      bool      `json:"follow"`
	Since       time.Time `json:"since,omitzero"`
	Tail        int       `json:"tail,omitempty"`
}

type ManifestApplyRequest struct {
	InstanceID id.ID             `json:"instance_id"`
	TenantID   string            `json:"tenant_id"`
	Namespace  string            `json:"namespace,omitempty"`
	Manifests  RenderedManifests `json:"manifests"`
	Labels     map[string]string `json:"labels,omitempty"`
}

type ManifestEngine interface {
	// ApplyManifests applies every rendered document, labeling each object
	// for the instance, and records what it applied so the set can later be
	// deleted or inspected.
	ApplyManifests(ctx context.Context, req ManifestApplyRequest) (*ProvisionResult, error)

	// DeleteManifests removes every object previously applied for the
	// instance. Deleting an already-absent set is not an error.
	DeleteManifests(ctx context.Context, instanceID id.ID) error

	// ManifestStatus reports the aggregate state of the applied objects.
	ManifestStatus(ctx context.Context, instanceID id.ID) (*InstanceStatus, error)
}

type ManifestSource struct {
	Inline    string           `json:"inline,omitempty"`
	Kustomize *KustomizeSource `json:"kustomize,omitempty"`
}

type PortSpec struct {
	Container int    `json:"container"`
	Host      int    `json:"host,omitempty"`
	Protocol  string `json:"protocol"`
}

type Provider interface {
	// Info returns metadata about this provider.
	Info() ProviderInfo

	// Capabilities returns what this provider supports.
	Capabilities() []Capability

	// Provision creates infrastructure resources for an instance.
	Provision(ctx context.Context, req ProvisionRequest) (*ProvisionResult, error)

	// Deprovision tears down all resources for an instance.
	Deprovision(ctx context.Context, instanceID id.ID) error

	// Start starts a stopped instance.
	Start(ctx context.Context, instanceID id.ID) error

	// Stop gracefully stops a running instance.
	Stop(ctx context.Context, instanceID id.ID) error

	// Restart performs a stop+start cycle.
	Restart(ctx context.Context, instanceID id.ID) error

	// Status returns the current runtime status.
	Status(ctx context.Context, instanceID id.ID) (*InstanceStatus, error)

	// Deploy pushes a new release to the instance.
	Deploy(ctx context.Context, req DeployRequest) (*DeployResult, error)

	// Rollback reverts to a previous release.
	Rollback(ctx context.Context, instanceID id.ID, releaseID id.ID) error

	// Scale adjusts the instance's resource allocation.
	Scale(ctx context.Context, instanceID id.ID, spec ResourceSpec) error

	// Resources returns current resource utilization.
	Resources(ctx context.Context, instanceID id.ID) (*ResourceUsage, error)

	// Logs streams logs for the instance.
	Logs(ctx context.Context, instanceID id.ID, opts LogOptions) (io.ReadCloser, error)

	// Exec runs a command inside the instance.
	Exec(ctx context.Context, instanceID id.ID, cmd ExecRequest) (*ExecResult, error)
}

type ProviderInfo struct {
	Name     string    `json:"name"`
	Version  string    `json:"version"`
	Region   string    `json:"region"`
	Location *Location `json:"location,omitempty"`
}

type ProvisionRequest struct {
	InstanceID id.ID             `json:"instance_id"`
	TenantID   string            `json:"tenant_id"`
	Name       string            `json:"name"`
	Kind       WorkloadKind      `json:"kind"` // deployment | stateful_set
	Services   []ServiceSpec     `json:"services"`
	Labels     map[string]string `json:"labels,omitempty"` // workload-level, applied to all services
}

type ProvisionResult struct {
	// ProviderRef is the workload-level handle (Pod name on k8s,
	// Job ID on Nomad, Compose project name on Docker).
	ProviderRef string `json:"provider_ref"`

	// ServiceRefs maps a service's Name to the provider-specific
	// per-container/task ref (container ID on Docker, container name
	// within the Pod on k8s, Task name on Nomad). Used for per-service
	// log/exec/restart operations.
	ServiceRefs map[string]string `json:"service_refs,omitempty"`

	Endpoints []Endpoint        `json:"endpoints"`
	Metadata  map[string]string `json:"metadata,omitempty"`
}

type ReadinessPolicy struct {
	Timeout  time.Duration `json:"timeout"`
	Interval time.Duration `json:"interval"`
}

type ReadinessWaiter interface {
	ReadinessPolicy() ReadinessPolicy
}

type Registry struct {
	// contains filtered or unexported fields
}

type RenderedHelm struct {
	Repo        string         `json:"repo,omitempty"`
	Chart       string         `json:"chart"`
	Version     string         `json:"version,omitempty"`
	ReleaseName string         `json:"release_name,omitempty"`
	Namespace   string         `json:"namespace,omitempty"`
	Values      map[string]any `json:"values,omitempty"`
}

type RenderedManifests struct {
	Docs []string `json:"docs"`
}

type RenderedSource struct {
	Type      SourceType         `json:"type"`
	Services  []ServiceSpec      `json:"services,omitempty"`
	Helm      *RenderedHelm      `json:"helm,omitempty"`
	Manifests *RenderedManifests `json:"manifests,omitempty"`
	ArgoCD    *ArgoCDSource      `json:"argocd,omitempty"` // templated in place
}

type ResourceSpec struct {
	CPUMillis int    `json:"cpu_millis"`
	MemoryMB  int    `json:"memory_mb"`
	DiskMB    int    `json:"disk_mb,omitempty"`
	Replicas  int    `json:"replicas"`
	GPU       string `json:"gpu,omitempty"`
}

type ResourceUsage struct {
	CPUPercent    float64 `json:"cpu_percent"`
	MemoryUsedMB  int     `json:"memory_used_mb"`
	MemoryLimitMB int     `json:"memory_limit_mb"`
	DiskUsedMB    int     `json:"disk_used_mb,omitempty"`
	NetworkInMB   float64 `json:"network_in_mb"`
	NetworkOutMB  float64 `json:"network_out_mb"`
}

type SecretBinding struct {
	// VarName is the logical variable name the binding was resolved from.
	VarName string `json:"var_name"`

	// EnvKey is the environment-variable name the workload sees. Defaults
	// to UPPER_SNAKE(VarName) when the variable does not specify one.
	EnvKey string `json:"env_key"`

	// Ref locates the secret value in the vault, resolved at apply time.
	Ref SecretRef `json:"ref"`
}

type SecretRef struct {
	Key  string             `db:"key"  json:"key"`
	Type secrets.SecretType `db:"type" json:"type"`
}

type ServiceDeploySpec struct {
	Name        string            `json:"name"                   validate:"required"`
	Image       string            `json:"image"                  validate:"required"`
	Env         map[string]string `json:"env,omitempty"`
	HealthCheck *HealthCheckSpec  `json:"health_check,omitempty"`

	// Command and Args override the image's ENTRYPOINT and CMD.
	Command []string `json:"command,omitempty"`
	Args    []string `json:"args,omitempty"`

	// Ports replaces the ports the service listens on.
	Ports []PortSpec `json:"ports,omitempty"`

	// Resources replaces the service's CPU, memory and replica size.
	Resources *ResourceSpec `json:"resources,omitempty"`
}

type ServiceRole string

type ServiceSnapshot struct {
	Name      string            `json:"name"`
	Image     string            `json:"image"`
	Env       map[string]string `json:"env,omitempty"`
	Command   []string          `json:"command,omitempty"`
	Args      []string          `json:"args,omitempty"`
	Ports     []PortSpec        `json:"ports,omitempty"`
	Resources *ResourceSpec     `json:"resources,omitempty"`
}

type ServiceSpec struct {
	// Name is the service's identifier within the workload. Must be
	// unique among the workload's services and DNS-safe (lowercase
	// alphanumerics + hyphens) so providers can use it as a network
	// alias for service-to-service discovery.
	Name string `json:"name" validate:"required"`

	// Image is the container image reference, e.g. "nginx:1.25".
	Image string `json:"image" validate:"required"`

	// Role determines lifecycle (Main / Sidecar / Init). Defaults to
	// Main when empty; validation enforces exactly one Main per workload.
	Role ServiceRole `json:"role,omitempty"`

	// DependsOn lists service names that must reach Running before this
	// service starts. Used for ordering Sidecars relative to Main and
	// for chaining Inits. A cycle is a validation error.
	DependsOn []string `json:"depends_on,omitempty"`

	// Resources / Env / Ports / Volumes / HealthCheck are per-service.
	// Two services in the same workload can request different CPU/memory
	// or expose different ports.
	Resources   ResourceSpec      `json:"resources"`
	Env         map[string]string `json:"env,omitempty"`
	Ports       []PortSpec        `json:"ports,omitempty"`
	Volumes     []VolumeSpec      `json:"volumes,omitempty"`
	HealthCheck *HealthCheckSpec  `json:"health_check,omitempty"`

	// Secrets references env-injected secrets resolved against the
	// vault at deploy time. Per-service so a sidecar can have its own
	// credentials without leaking them to the main container.
	Secrets []SecretRef `json:"secrets,omitempty"`

	// ConfigFiles describes vault-backed files mounted into this
	// service's filesystem at deploy time.
	ConfigFiles []ConfigFile `json:"config_files,omitempty"`

	// Annotations is per-service free-form metadata (e.g. k8s
	// container annotations). Workload-level metadata lives on the
	// Workload's Labels map.
	Annotations map[string]string `json:"annotations,omitempty"`

	// Command and Args optionally override the container image's
	// ENTRYPOINT and CMD respectively. Empty leaves the image
	// defaults in place.
	Command []string `json:"command,omitempty"`
	Args    []string `json:"args,omitempty"`
}

type ServiceStatus struct {
	State       InstanceState `json:"state"`
	Ready       bool          `json:"ready"`
	Restarts    int           `json:"restarts"`
	ProviderRef string        `json:"provider_ref,omitempty"`
	Message     string        `json:"message,omitempty"`
}

type SourceType string

type StatusFunc func(ctx context.Context) (*InstanceStatus, error)

type VolumeSpec struct {
	Name      string `json:"name"`
	MountPath string `json:"mount_path"`
	SizeMB    int    `json:"size_mb"`
	Type      string `json:"type"`
}

type WorkloadKind string