remote

type BlobStore interface {
	// Get retrieves the object. If not found, returns ErrObjectNotFound.
	Get(ctx context.Context, key string) (data []byte, rev string, err error)

	// Put uploads the object. baseRev is the expected current revision.
	// If baseRev is CreateIfAbsentRevision, the object must not exist.
	// If baseRev is not empty and doesn't match, returns ErrConflict.
	// Returns the new revision string.
	Put(ctx context.Context, key string, data []byte, baseRev string) (newRev string, err error)

	// Stat retrieves the revision of the object. If not found, returns ErrObjectNotFound.
	Stat(ctx context.Context, key string) (rev string, err error)

	// Delete removes the object.
	Delete(ctx context.Context, key string) error
}

type CompileRequest struct {
	Declaration     SyncConfig
	ResolvedSecret  string // device-local secret ref resolved from credential identity
	ResolvedEncrypt string // device-local encryption secret ref resolved from key identity
	DeviceID        string
	Now             time.Time
}

type CompileResult struct {
	RuntimeConfig     Config
	SourceMarker      SourceMarker
	DeclarationDigest string
}

type ConditionalWriteCapability interface {
	SupportsConditionalWrites() bool
}

type Config struct {
	SchemaVersion       string    `json:"schema_version" yaml:"schema_version"`
	BackendKind         string    `json:"backend_kind,omitempty" yaml:"backend_kind,omitempty"`
	Endpoint            string    `json:"endpoint,omitempty" yaml:"endpoint,omitempty"`
	WorkspaceID         string    `json:"workspace_id" yaml:"workspace_id"`
	DeviceID            string    `json:"device_id" yaml:"device_id"`
	SecretRef           string    `json:"secret_ref,omitempty" yaml:"secret_ref,omitempty"`
	EncryptionSecretRef string    `json:"encryption_secret_ref,omitempty" yaml:"encryption_secret_ref,omitempty"`
	S3                  *S3Config `json:"s3,omitempty" yaml:"s3,omitempty"`
	CreatedAt           string    `json:"created_at" yaml:"created_at"`
	UpdatedAt           string    `json:"updated_at" yaml:"updated_at"`
}

type CryptoKey struct {
	KeyID string
	// contains filtered or unexported fields
}

type CryptoKeys struct {
	Active CryptoKey
	Legacy []CryptoKey
}

type DeviceSession struct {
	SchemaVersion string `json:"schema_version"`
	SessionID     string `json:"session_id"`
	DeviceID      string `json:"device_id"`
	Status        string `json:"status"`
	IssuedAt      string `json:"issued_at"`
	UpdatedAt     string `json:"updated_at"`
}

type DoctorResult struct {
	Configured   bool   `json:"configured"`
	Status       string `json:"status"`
	Code         string `json:"code,omitempty"`
	Message      string `json:"message"`
	BackendKind  string `json:"backend_kind,omitempty"`
	AuthBoundary string `json:"auth_boundary,omitempty"`
	ServerAudit  bool   `json:"server_audit"`
	Endpoint     string `json:"endpoint,omitempty"`
	Workspace    string `json:"workspace_id,omitempty"`
	DeviceID     string `json:"device_id,omitempty"`
}

type DotenvError struct {
	Code    string
	Line    int
	Key     string
	Message string
}

type DriftItem struct {
	Field  string `json:"field" yaml:"field"`
	Reason string `json:"reason" yaml:"reason"`
}

type DriftReport struct {
	InDrift bool        `json:"in_drift" yaml:"in_drift"`
	Reasons []DriftItem `json:"reasons,omitempty" yaml:"reasons,omitempty"`
}

type EncryptedEnvelope = syncwire.Envelope

type EnvAsset struct {
	SchemaVersion string `json:"schema_version" yaml:"schema_version"`
	Provider      string `json:"provider" yaml:"provider"`
	// Ciphertext is provider-specific opaque encrypted material for the whole
	// dotenv document (not per-key). Keeping one ciphertext preserves key
	// ordering and avoids leaking key names into the asset metadata.
	Ciphertext string `json:"ciphertext" yaml:"ciphertext"`
	// Digest is a short stable hex digest of the plaintext document, used for
	// daemon reload identity checks. It does NOT reveal plaintext contents.
	Digest string `json:"digest,omitempty" yaml:"digest,omitempty"`
	// KeyNames is the redacted list of declared keys (no values) so list/doctor
	// can report what is present without unlocking.
	KeyNames []string `json:"key_names,omitempty" yaml:"key_names,omitempty"`
}

type EnvAssetError struct {
	Code    string
	Message string
}

type EnvReloader struct {
	// contains filtered or unexported fields
}

type EnvSnapshot struct {
	// contains filtered or unexported fields
}

type EnvUnlockProvider struct{}

type ExtendedBlobStore interface {
	BlobStore
	List(ctx context.Context, prefix string) ([]ObjectInfo, error)
	Exists(ctx context.Context, key string) (bool, error)
	BatchStat(ctx context.Context, keys []string) (map[string]string, error)
}

type FakeUnlockProvider struct {
	KeyResolver func() (string, error)
}

type FileBackend struct {
	// contains filtered or unexported fields
}

type LoginRequest struct {
	Endpoint            string
	WorkspaceID         string
	DeviceID            string
	SecretRef           string
	EncryptionSecretRef string
	BackendKind         string
	S3                  *S3Config
	Now                 time.Time
}

type Manifest = syncwire.Manifest

type ManifestDelete = syncwire.ManifestDelete

type ManifestEntry = syncwire.ManifestEntry

type ManifestFileTooLargeError struct {
	Path  string
	Size  int64
	Limit int64
}

type ManifestIdentity struct {
	ObjectID   string
	ObjectKind string
}

type ManifestUnsafePathError struct{ Path string }

type ObjectInfo struct {
	Key          string
	Size         int64
	Revision     string
	LastModified time.Time
}

type RcloneBackend struct {
	// contains filtered or unexported fields
}

type ReloadStatus struct {
	Changed  bool
	Loaded   bool
	Degraded bool
	Code     string
}

type S3Backend struct {
	// contains filtered or unexported fields
}

type S3BackendOptions struct {
	EndpointURL string
	Region      string
	Profile     string
	PathStyle   bool
	PathMode    string
	API         string
	// CredentialsProvider, when non-nil, is the explicit AWS SDK credentials
	// provider used to authenticate S3 requests (for example, a StaticCredentialsProvider
	// built from a repository-encrypted bundle). When nil, the SDK shared
	// profile / default credential chain is used (existing device-profile behavior).
	CredentialsProvider aws.CredentialsProvider
}

type S3Config struct {
	Bucket          string `json:"bucket" yaml:"bucket"`
	Prefix          string `json:"prefix,omitempty" yaml:"prefix,omitempty"`
	Endpoint        string `json:"endpoint,omitempty" yaml:"endpoint,omitempty"`
	Region          string `json:"region,omitempty" yaml:"region,omitempty"`
	Profile         string `json:"profile,omitempty" yaml:"profile,omitempty"`
	AddressingStyle string `json:"addressing_style,omitempty" yaml:"addressing_style,omitempty"`
	PathStyle       bool   `json:"path_style,omitempty" yaml:"path_style,omitempty"`
	// CredentialMode controls how S3 credentials resolve. "device-profile"
	// (default) keeps the existing behavior: endpoint/profile or the AWS default
	// credential chain. "repository-encrypted" requires resolving a typed
	// credential bundle from the repository envelope; it must NOT silently fall
	// back to a device-local AWS profile.
	CredentialMode string `json:"credential_mode,omitempty" yaml:"credential_mode,omitempty"`
}

type S3Credentials struct {
	AccessKeyID     string `json:"access_key_id"`
	SecretAccessKey string `json:"secret_access_key"`
	SessionToken    string `json:"session_token,omitempty"`
}

type SecretEntry struct {
	Identity   string `json:"identity" yaml:"identity"`
	Ciphertext string `json:"ciphertext" yaml:"ciphertext"`
}

type SecretEntryKind string

type SecretEnvelope struct {
	SchemaVersion string                 `json:"schema_version" yaml:"schema_version"`
	Provider      string                 `json:"provider" yaml:"provider"`
	Secrets       map[string]SecretEntry `json:"secrets,omitempty" yaml:"secrets,omitempty"`
}

type SecretEnvelopeError struct {
	Code    string
	Message string
}

type SecretMetadata struct {
	Name     string `json:"name" yaml:"name"`
	Kind     string `json:"kind" yaml:"kind"`
	Identity string `json:"identity" yaml:"identity"`
	Provider string `json:"provider" yaml:"provider"`
}

type SourceMarker struct {
	SchemaVersion     string `json:"schema_version" yaml:"schema_version"`
	DeclarationDigest string `json:"declaration_digest,omitempty" yaml:"declaration_digest,omitempty"`
	GeneratedAt       string `json:"generated_at" yaml:"generated_at"`
	DeviceID          string `json:"device_id" yaml:"device_id"`
}

type State struct {
	Config  Config        `json:"config"`
	Session DeviceSession `json:"session"`
}

type StoreFactory func(ctx context.Context, endpoint string) (BlobStore, error)

type SyncBackend struct {
	Kind     string    `json:"kind" yaml:"kind"` // s3-direct, rclone-direct, server, embedded
	Endpoint string    `json:"endpoint,omitempty" yaml:"endpoint,omitempty"`
	S3       *S3Config `json:"s3,omitempty" yaml:"s3,omitempty"`
}

type SyncConfig struct {
	SchemaVersion string         `json:"schema_version" yaml:"schema_version"`
	Backend       SyncBackend    `json:"backend" yaml:"backend"`
	Workspace     SyncWorkspace  `json:"workspace" yaml:"workspace"`
	Secrets       SyncSecretRefs `json:"secrets" yaml:"secrets"`
	Policy        SyncPolicy     `json:"policy,omitempty" yaml:"policy,omitempty"`
	// Requires declares additive capabilities a binary MUST support before
	// touching the remote (pinax-passphrase-s3-bootstrap task 6.8). A binary
	// missing a declared capability fails closed with sync_capability_unsupported
	// rather than silently producing a partial backup. The set is validated by
	// the capability gate, not by Validate (unknown capabilities are rejected at
	// gate time so an upgraded declaration does not break older validation).
	Requires SyncRequires `json:"requires,omitempty" yaml:"requires,omitempty"`
}

type SyncConfigError struct {
	Code    string
	Field   string
	Message string
}

type SyncPolicy struct {
	// RemoteDeletePolicy controls whether local deletions may propagate to the
	// remote. "deny" (default) refuses; "require-approval" needs explicit --yes.
	RemoteDeletePolicy string `json:"remote_delete_policy,omitempty" yaml:"remote_delete_policy,omitempty"`
	// NewDeviceMode defaults to "pull-only": a device with no local sync receipt
	// must not upload local deletions or replace remote state on first bootstrap.
	NewDeviceMode string `json:"new_device_mode,omitempty" yaml:"new_device_mode,omitempty"`
}

type SyncRequires struct {
	Capabilities []string `json:"capabilities,omitempty" yaml:"capabilities,omitempty"`
}

type SyncSecretRefs struct {
	CredentialID    string `json:"credential_id,omitempty" yaml:"credential_id,omitempty"`
	EncryptionKeyID string `json:"encryption_key_id" yaml:"encryption_key_id"`
}

type SyncWorkspace struct {
	TenantID    string `json:"tenant_id,omitempty" yaml:"tenant_id,omitempty"`
	AppID       string `json:"app_id,omitempty" yaml:"app_id,omitempty"`
	WorkspaceID string `json:"workspace_id" yaml:"workspace_id"`
}

type UnlockProvider interface {
	// Name is the stable provider identifier written into the envelope.
	Name() string
	// Unlock decrypts the envelope into plaintext values. Plaintext MUST NOT
	// escape the caller; it lives only in the unlocking runtime.
	Unlock(env SecretEnvelope) (map[string]string, error)
	// Lock encrypts a single plaintext value under the given identity, returning
	// an entry suitable for SecretEnvelope.Secrets.
	Lock(name string, plaintext string, identity string, kind SecretEntryKind) (SecretEntry, error)
}