supervisor

type ApplyOpts struct {
	File    string // the binary
	Record  string // release record (signed bytes)
	Sig     string // "<key_id>:<base64>" file; default Record + ".sig"
	Release release.Options
	// Platform overrides runtime.GOOS-runtime.GOARCH (tests).
	Platform string
}

type BadEntry struct {
	Version string    `json:"version"`
	Reason  string    `json:"reason"`
	At      time.Time `json:"when"`
}

type Child struct {
	// contains filtered or unexported fields
}

type Choice struct {
	Bootstrap bool
	Name      string
	Reason    string
}

type ChooseInput struct {
	WritableErr      error  // non-nil: releases dir not usable
	BootstrapSHA     string // sha256 of the bootstrap binary on disk now
	BootstrapVersion string
	Current          string // what releases/current points at ("" if none)
	CurrentOK        bool   // Current names a valid executable release
}

type Config struct {
	Data             string // absolute data dir; releases live in Data/releases
	Bootstrap        string // path of the binary the supervisor itself runs from
	BootstrapVersion string // its version stamp (may be a non-semver build string)
	ReadyURL         string // the child's /ready, e.g. http://127.0.0.1:8080/ready

	StopGrace     time.Duration // SIGTERM to SIGKILL; must exceed the child's own shutdown (default 40s)
	ReadyTimeout  time.Duration // default 120s
	ObserveWindow time.Duration // default 60s
	SmokePoll     time.Duration // default 5s
	BootWindow    time.Duration // a child that lives this long is not crash-looping (default 120s)
	BackoffBase   time.Duration // restart delay base, doubled per crash up to 30s (default 500ms)

	// Release is the trust used to re-verify staged releases before they run
	// (zero value: the keys built into this binary).
	Release release.Options

	Force bool // CLI: let `update rollback` target a bad-listed release

	Env []string // base environment for the child (default os.Environ())
	Log *slog.Logger
	// contains filtered or unexported fields
}

type CorruptStateError struct{ Err error }

type Event struct {
	ID         string    `json:"id"`
	From       string    `json:"from"`
	To         string    `json:"to"`
	Phase      string    `json:"phase"`
	Error      string    `json:"error"`
	StartedAt  time.Time `json:"started_at"`
	FinishedAt time.Time `json:"finished_at"`
}

type GateConfig struct {
	ReadyURL  string // child's /ready
	SmokeAddr string // child's loopback smoke listener, host:port
	Token     string

	Started       time.Time // child start; the observation window runs from here (default: now)
	ReadyTimeout  time.Duration
	ReadyPoll     time.Duration // default 500ms
	ObserveWindow time.Duration
	SmokePoll     time.Duration

	// KnownPluginErrors are the plugins that already failed in the last good
	// run; only errors outside this list fail the gate.
	KnownPluginErrors []string

	// Baseline is the per-check status of the last good run (see
	// BaselineOf). Nil means there is no record yet: the gate then only
	// demands no 5xx anywhere and "GET /" at 200 or 404.
	Baseline map[string]int

	// StaleBaseline marks a Baseline older than baselineMaxAge that could not
	// be refreshed (an offline apply has no running child to probe). Editors
	// can unpublish the home page or the sampled page in a day, so a 404 on
	// "GET /" or "published page" is not held against the release. Every other
	// check stays strict, as do boot faults, plugin errors and render errors.
	StaleBaseline bool

	// RenderBaseline is FirstRender of the last good run. Render errors fail
	// the gate only when a smoke call adds more than this.
	RenderBaseline int

	// BootFaultBaseline is the boot fault identifiers of the last good run.
	// Any fault outside it fails the gate: the release broke something at
	// boot that the last one did not.
	BootFaultBaseline []string

	// Initial marks the first smoke of a child that was not switched to: it
	// only decides whether the result is fit to become the baseline, so
	// render errors and plugin errors do not fail it.
	Initial bool
}

type Layout struct{ Data, Releases string }

type LinkSnapshot struct {
	Current             string `json:"current"`
	Previous            string `json:"previous"`
	PreviousIsBootstrap bool   `json:"previous_is_bootstrap"`
	Run                 string `json:"run"`
	CurrentSeen         string `json:"current_seen"`
}

type Pending struct {
	Kind       string `json:"kind"` // apply | rollback
	Version    string `json:"version"`
	From       string `json:"from"`
	PrevBefore string `json:"prev_before"`
	// Before is taken by the first pass of the switch and is what a rollback
	// restores; a replay after a restart reuses it.
	Before      *LinkSnapshot `json:"before,omitempty"`
	RequestedAt time.Time     `json:"requested_at"`
	StartedAt   time.Time     `json:"started_at,omitempty"`
}

type Result struct {
	Version  string
	Notified bool // the running supervisor was asked to do the gated switch
	Message  string
}

type SmokeCheck struct {
	Name   string `json:"name"`
	OK     bool   `json:"ok"`
	Status int    `json:"status"` // HTTP status of the check; 0 when it was skipped
	Detail string `json:"detail"`
}

type SmokeResult struct {
	Pass         bool         `json:"pass"`
	Checks       []SmokeCheck `json:"checks"`
	RenderErrors int          `json:"render_errors"` // caused by this pass's own requests
	PluginErrors []string     `json:"plugin_errors"`
	// BootFaults are release-level render faults the child logged outside any
	// request: its theme fell back to the default, a rebuild failed, plugin
	// templates were rejected.
	BootFaults []string `json:"boot_faults"`

	// FirstRender is RenderErrors at the first smoke call of a gated child
	// (set by RunGate, not by the child): what one boot plus one smoke pass
	// costs, the figure later runs are compared with.
	FirstRender int `json:"-"`
}

type State struct {
	V                   int        `json:"v"`
	Phase               string     `json:"phase"` // idle | probation
	Run                 string     `json:"run"`   // bootstrap | release
	CurrentSeen         string     `json:"current_seen"`
	PreviousIsBootstrap bool       `json:"previous_is_bootstrap"`
	Attempts            int        `json:"attempts"`
	LastError           string     `json:"last_error"`
	Bad                 []BadEntry `json:"bad"`
	BootstrapSHA256     string     `json:"bootstrap_sha256"`
	// BootstrapVersion is the version stamp of the supervisor's own binary,
	// recorded by the supervisor so a child that runs a release (whose own
	// stamp is the release's) can still tell what a rollback would return to.
	BootstrapVersion string   `json:"bootstrap_version,omitempty"`
	SmokeToken       string   `json:"smoke_token"`
	PluginErrors     []string `json:"plugin_errors"`
	// SmokeBaseline is the per-check HTTP status of the last good child (one
	// that passed its gate, or was running without a switch). Nil: no record.
	SmokeBaseline map[string]int `json:"smoke_baseline,omitempty"`
	// BaselineAt is when SmokeBaseline was recorded.
	BaselineAt time.Time `json:"baseline_at,omitempty"`
	// RenderBaseline is the render errors the last good run logged by its
	// first smoke call; a later gate fails only on an increase.
	RenderBaseline int `json:"render_baseline,omitempty"`
	// BootFaultBaseline is the boot fault identifiers (theme fallback and the
	// like) the last good run reported; a later gate fails on any other.
	BootFaultBaseline []string `json:"known_boot_faults,omitempty"`
	Pending           *Pending `json:"pending,omitempty"`
	// Unproven is a release switched to that has not yet both passed its
	// gate and lived a full boot window. Only an unproven release's crash loop
	// may roll back; any other crash loop just restarts with backoff.
	Unproven string `json:"unproven,omitempty"`
	// OfflineRollback is the target of a rollback made with no supervisor
	// running. The startup gate logs its outcome, then clears this.
	OfflineRollback string `json:"offline_rollback,omitempty"`
	// Ungated is a release applied while no supervisor was running. The
	// supervisor runs the normal health gate on it at its next start, using
	// Before to roll back if it fails.
	Ungated *Pending `json:"ungated,omitempty"`
}