remote

type BlobStore interface {
	// Get retrieves the object. If not found, returns ErrObjectNotFound.
	Get(ctx context.Context, key string) (data []byte, rev string, err error)

	// Put uploads the object. baseRev is the expected current revision.
	// If baseRev is CreateIfAbsentRevision, the object must not exist.
	// If baseRev is not empty and doesn't match, returns ErrConflict.
	// Returns the new revision string.
	Put(ctx context.Context, key string, data []byte, baseRev string) (newRev string, err error)

	// Stat retrieves the revision of the object. If not found, returns ErrObjectNotFound.
	Stat(ctx context.Context, key string) (rev string, err error)

	// Delete removes the object.
	Delete(ctx context.Context, key string) error
}

type CachedBlobStore struct {
	// contains filtered or unexported fields
}

type CompileRequest struct {
	Declaration     SyncConfig
	ResolvedSecret  string // device-local secret ref resolved from credential identity
	ResolvedEncrypt string // device-local encryption secret ref resolved from key identity
	DeviceID        string
	Now             time.Time
}

type CompileResult struct {
	RuntimeConfig     Config
	SourceMarker      SourceMarker
	DeclarationDigest string
}

type ConditionalWriteCapability interface {
	SupportsConditionalWrites() bool
}

type Config struct {
	SchemaVersion       string    `json:"schema_version" yaml:"schema_version"`
	BackendKind         string    `json:"backend_kind,omitempty" yaml:"backend_kind,omitempty"`
	Endpoint            string    `json:"endpoint,omitempty" yaml:"endpoint,omitempty"`
	WorkspaceID         string    `json:"workspace_id" yaml:"workspace_id"`
	DeviceID            string    `json:"device_id" yaml:"device_id"`
	SecretRef           string    `json:"secret_ref,omitempty" yaml:"secret_ref,omitempty"`
	EncryptionSecretRef string    `json:"encryption_secret_ref,omitempty" yaml:"encryption_secret_ref,omitempty"`
	S3                  *S3Config `json:"s3,omitempty" yaml:"s3,omitempty"`
	CreatedAt           string    `json:"created_at" yaml:"created_at"`
	UpdatedAt           string    `json:"updated_at" yaml:"updated_at"`
}

type CryptoKey = capsa.CryptoKey

type DeviceSession struct {
	SchemaVersion string `json:"schema_version"`
	SessionID     string `json:"session_id"`
	DeviceID      string `json:"device_id"`
	Status        string `json:"status"`
	IssuedAt      string `json:"issued_at"`
	UpdatedAt     string `json:"updated_at"`
}

type DoctorResult struct {
	Configured   bool   `json:"configured"`
	Status       string `json:"status"`
	Code         string `json:"code,omitempty"`
	Message      string `json:"message"`
	BackendKind  string `json:"backend_kind,omitempty"`
	AuthBoundary string `json:"auth_boundary,omitempty"`
	ServerAudit  bool   `json:"server_audit"`
	Endpoint     string `json:"endpoint,omitempty"`
	Workspace    string `json:"workspace_id,omitempty"`
	DeviceID     string `json:"device_id,omitempty"`
}

type DotenvError struct {
	Code    string
	Line    int
	Key     string
	Message string
}

type DriftItem struct {
	Field  string `json:"field" yaml:"field"`
	Reason string `json:"reason" yaml:"reason"`
}

type DriftReport struct {
	InDrift bool        `json:"in_drift" yaml:"in_drift"`
	Reasons []DriftItem `json:"reasons,omitempty" yaml:"reasons,omitempty"`
}

type EncryptedEnvelope = capsa.EncryptedEnvelope

type EnvAsset struct {
	SchemaVersion string `json:"schema_version" yaml:"schema_version"`
	Provider      string `json:"provider" yaml:"provider"`
	// Ciphertext is provider-specific opaque encrypted material for the whole
	// dotenv document (not per-key). Keeping one ciphertext preserves key
	// ordering and avoids leaking key names into the asset metadata.
	Ciphertext string `json:"ciphertext" yaml:"ciphertext"`
	// Digest is a short stable hex digest of the plaintext document, used for
	// daemon reload identity checks. It does NOT reveal plaintext contents.
	Digest string `json:"digest,omitempty" yaml:"digest,omitempty"`
	// KeyNames is the redacted list of declared keys (no values) so list/doctor
	// can report what is present without unlocking.
	KeyNames []string `json:"key_names,omitempty" yaml:"key_names,omitempty"`
}

type EnvAssetError struct {
	Code    string
	Message string
}

type EnvReloader struct {
	// contains filtered or unexported fields
}

type EnvSnapshot struct {
	// contains filtered or unexported fields
}

type EnvUnlockProvider struct{}

type ExtendedBlobStore interface {
	BlobStore
	List(ctx context.Context, prefix string) ([]ObjectInfo, error)
	Exists(ctx context.Context, key string) (bool, error)
	BatchStat(ctx context.Context, keys []string) (map[string]string, error)
}

type FakeBlobCheckRequest struct {
	BlobIDs []string `json:"blob_ids"`
}

type FakeBlobCheckResponse struct {
	MissingBlobIDs []string `json:"missing_blob_ids"`
}

type FakeContractError struct {
	Code      string `json:"code"`
	Message   string `json:"message"`
	Retryable bool   `json:"retryable"`
}

type FakeContractErrorResponse struct {
	Error FakeContractError `json:"error"`
}

type FakeErrorResponse struct {
	Code            string `json:"code"`
	Message         string `json:"message"`
	CurrentRevision string `json:"current_revision,omitempty"`
}

type FakeManifestPutRequest struct {
	BaseRevision string         `json:"base_revision"`
	Manifest     map[string]any `json:"manifest"`
}

type FakeManifestResponse struct {
	Revision string         `json:"revision"`
	Manifest map[string]any `json:"manifest,omitempty"`
}

type FakeRevisionCommitRequest struct {
	BaseRevision   string   `json:"base_revision"`
	RevisionID     string   `json:"revision_id,omitempty"`
	ManifestBlobID string   `json:"manifest_blob_id"`
	BlobIDs        []string `json:"blob_ids,omitempty"`
	DeviceID       string   `json:"device_id,omitempty"`
}

type FakeRevisionCommitResponse struct {
	RevisionID     string `json:"revision_id"`
	ManifestBlobID string `json:"manifest_blob_id"`
}

type FakeRevisionResponse struct {
	RevisionID     string `json:"revision_id"`
	ManifestBlobID string `json:"manifest_blob_id"`
}

type FakeServer struct {
	URL string
	// contains filtered or unexported fields
}

type FakeUnlockProvider struct {
	KeyResolver func() (string, error)
}

type FileBackend struct {
	// contains filtered or unexported fields
}

type LoginRequest struct {
	Endpoint            string
	WorkspaceID         string
	DeviceID            string
	SecretRef           string
	EncryptionSecretRef string
	BackendKind         string
	S3                  *S3Config
	Now                 time.Time
}

type Manifest struct {
	SchemaVersion string           `json:"schema_version"`
	GeneratedAt   string           `json:"generated_at"`
	EntryCount    int              `json:"entry_count"`
	Entries       []ManifestEntry  `json:"entries"`
	Deletes       []ManifestDelete `json:"deletes,omitempty"`
}

type ManifestDelete struct {
	PathHash    string `json:"path_hash"`
	ObjectKind  string `json:"object_kind"`
	ObjectID    string `json:"object_id,omitempty"`
	TombstoneID string `json:"tombstone_id"`
	DeletedAt   string `json:"deleted_at,omitempty"`
	TrashBlobID string `json:"trash_blob_id,omitempty"`
	RevisionID  string `json:"revision_id,omitempty"`
	DeviceID    string `json:"device_id,omitempty"`
}

type ManifestEntry struct {
	ObjectID   string `json:"object_id,omitempty"`
	RevisionID string `json:"revision_id,omitempty"`
	DeviceID   string `json:"device_id,omitempty"`
	Path       string `json:"path"`
	PathHash   string `json:"path_hash"`
	BlobID     string `json:"blob_id"`
	Size       int64  `json:"size"`
	SHA256     string `json:"sha256"`
	ObjectKind string `json:"object_kind,omitempty"`
	Mode       uint32 `json:"mode,omitempty"`
	MediaType  string `json:"media_type,omitempty"`
	UpdatedAt  string `json:"updated_at"`
}

type ManifestFileTooLargeError struct {
	Path  string
	Size  int64
	Limit int64
}

type ManifestIdentity struct {
	ObjectID   string
	ObjectKind string
}

type ManifestUnsafePathError struct{ Path string }

type ObjectInfo struct {
	Key          string
	Size         int64
	Revision     string
	LastModified time.Time
}

type RcloneBackend struct {
	// contains filtered or unexported fields
}

type ReloadStatus struct {
	Changed  bool
	Loaded   bool
	Degraded bool
	Code     string
}

type S3Backend struct {
	// contains filtered or unexported fields
}

type S3BackendOptions struct {
	EndpointURL string
	Region      string
	Profile     string
	PathStyle   bool
	PathMode    string
	API         string
}

type S3Config struct {
	Bucket          string `json:"bucket" yaml:"bucket"`
	Prefix          string `json:"prefix,omitempty" yaml:"prefix,omitempty"`
	Endpoint        string `json:"endpoint,omitempty" yaml:"endpoint,omitempty"`
	Region          string `json:"region,omitempty" yaml:"region,omitempty"`
	Profile         string `json:"profile,omitempty" yaml:"profile,omitempty"`
	AddressingStyle string `json:"addressing_style,omitempty" yaml:"addressing_style,omitempty"`
	PathStyle       bool   `json:"path_style,omitempty" yaml:"path_style,omitempty"`
}

type SecretEntry struct {
	Identity   string `json:"identity" yaml:"identity"`
	Ciphertext string `json:"ciphertext" yaml:"ciphertext"`
}

type SecretEntryKind string

type SecretEnvelope struct {
	SchemaVersion string                 `json:"schema_version" yaml:"schema_version"`
	Provider      string                 `json:"provider" yaml:"provider"`
	Secrets       map[string]SecretEntry `json:"secrets,omitempty" yaml:"secrets,omitempty"`
}

type SecretEnvelopeError struct {
	Code    string
	Message string
}

type SecretMetadata struct {
	Name     string `json:"name" yaml:"name"`
	Kind     string `json:"kind" yaml:"kind"`
	Identity string `json:"identity" yaml:"identity"`
	Provider string `json:"provider" yaml:"provider"`
}

type SourceMarker struct {
	SchemaVersion     string `json:"schema_version" yaml:"schema_version"`
	DeclarationDigest string `json:"declaration_digest,omitempty" yaml:"declaration_digest,omitempty"`
	GeneratedAt       string `json:"generated_at" yaml:"generated_at"`
	DeviceID          string `json:"device_id" yaml:"device_id"`
}

type State struct {
	Config  Config        `json:"config"`
	Session DeviceSession `json:"session"`
}

type StoreFactory func(ctx context.Context, endpoint string) (BlobStore, error)

type SyncBackend struct {
	Kind     string    `json:"kind" yaml:"kind"` // s3-direct, rclone-direct, server, embedded
	Endpoint string    `json:"endpoint,omitempty" yaml:"endpoint,omitempty"`
	S3       *S3Config `json:"s3,omitempty" yaml:"s3,omitempty"`
}

type SyncConfig struct {
	SchemaVersion string         `json:"schema_version" yaml:"schema_version"`
	Backend       SyncBackend    `json:"backend" yaml:"backend"`
	Workspace     SyncWorkspace  `json:"workspace" yaml:"workspace"`
	Secrets       SyncSecretRefs `json:"secrets" yaml:"secrets"`
	Policy        SyncPolicy     `json:"policy,omitempty" yaml:"policy,omitempty"`
}

type SyncConfigError struct {
	Code    string
	Field   string
	Message string
}

type SyncPolicy struct {
	// RemoteDeletePolicy controls whether local deletions may propagate to the
	// remote. "deny" (default) refuses; "require-approval" needs explicit --yes.
	RemoteDeletePolicy string `json:"remote_delete_policy,omitempty" yaml:"remote_delete_policy,omitempty"`
	// NewDeviceMode defaults to "pull-only": a device with no local sync receipt
	// must not upload local deletions or replace remote state on first bootstrap.
	NewDeviceMode string `json:"new_device_mode,omitempty" yaml:"new_device_mode,omitempty"`
}

type SyncSecretRefs struct {
	CredentialID    string `json:"credential_id,omitempty" yaml:"credential_id,omitempty"`
	EncryptionKeyID string `json:"encryption_key_id" yaml:"encryption_key_id"`
}

type SyncWorkspace struct {
	TenantID    string `json:"tenant_id,omitempty" yaml:"tenant_id,omitempty"`
	AppID       string `json:"app_id,omitempty" yaml:"app_id,omitempty"`
	WorkspaceID string `json:"workspace_id" yaml:"workspace_id"`
}

type UnlockProvider interface {
	// Name is the stable provider identifier written into the envelope.
	Name() string
	// Unlock decrypts the envelope into plaintext values. Plaintext MUST NOT
	// escape the caller; it lives only in the unlocking runtime.
	Unlock(env SecretEnvelope) (map[string]string, error)
	// Lock encrypts a single plaintext value under the given identity, returning
	// an entry suitable for SecretEnvelope.Secrets.
	Lock(name string, plaintext string, identity string, kind SecretEntryKind) (SecretEntry, error)
}