format

const (
	// InsecureCacheWriteBits identifies group and world write permission bits that are forbidden on cache directories.
	InsecureCacheWriteBits = 0o022

	// PermissionMask extracts standard Unix permission bits (0777).
	PermissionMask = 0o777
)

const (
	StageMemfdCreate     = "memfd_create"
	StageMemfdSeal       = "memfd_seal"
	StageMemfdExtract    = "extract_memfd"
	StageMemfdExec       = "execve_memfd"
	StageCacheDirInit    = "cache_dir_init"
	StageCacheCreateTemp = "cache_create_temp"
	StageCacheExtract    = "cache_extract"
	StageCacheExec       = "execve_cache"
	StageCodecLookup     = "codec_lookup"
	StageDecompress      = "decompress"
	StageLauncherMain    = "launcher_main"
)

const (
	HintMemfdEPERM = "memfd_create failed with EPERM. " +
		"Possible causes include host security policy, seccomp filters, or container profile restrictions. " +
		"If disk cache execution is permitted, run with MICROFAT_EXEC_MODE=cache."
	HintMemfdEACCES = "memfd_create failed with EACCES. " +
		"Possible causes include permission restrictions or kernel memfd policy limits. " +
		"If disk cache execution is permitted, run with MICROFAT_EXEC_MODE=cache."
	HintMemfdSeal = "memfd sealing (F_ADD_SEALS) failed or was restricted by kernel security policy. " +
		"If disk cache execution is permitted, run with MICROFAT_EXEC_MODE=cache, or adjust kernel sealing permissions."
	HintMemfdKernelUnsupported = "memfd_create is unsupported on this Linux kernel or disabled (ENOSYS). " +
		"If disk cache execution is permitted, run with MICROFAT_EXEC_MODE=cache."
	HintFileDescriptorLimit = "File descriptor limit reached. " +
		"Increase nofile limits (ulimit -n) or free open file descriptors."
	HintReadOnlyFS = "Read-only filesystem detected. " +
		"Set $MICROFAT_CACHE_DIR or $TMPDIR to a writable tmpfs/volume."
	HintCacheUnwritable = "Unable to write cached binary. " +
		"Ensure $XDG_CACHE_HOME or $TMPDIR is writable, or mount a writable tmpfs."
	HintDiskFull = "No space left on device. " +
		"Free disk space in cache directory or set $MICROFAT_CACHE_DIR to a volume with available space."
	HintExecEACCES = "execve failed with EACCES. " +
		"Possible causes include missing execute permissions, a 'noexec' filesystem mount, or security policy restrictions."
	HintExecEPERM = "execve failed with EPERM. " +
		"Possible causes include security policy (seccomp, LSM/AppArmor/SELinux), or container execution restrictions."
	HintTextBusy = "Binary is currently open for writing by another process (ETXTBSY). " +
		"Retrying or prewarming with --microfat:prewarm avoids concurrency contention."
	HintExecFormat       = "Binary format is invalid or incompatible with host kernel/architecture."
	HintUnsupportedCodec = "Binary variant uses an unsupported compression algorithm. " +
		"Update microfat launcher stub or re-package with a supported codec (e.g. zstd, lz4, none)."
	HintDecompressFailed = "Payload decompression failed or corrupted. " +
		"Re-package the binary with 'microfat pack' or verify integrity with 'microfat verify'."
	HintInsecureCacheDir = "Cache directory has insecure permissions, is a symlink, or is owned by another user. " +
		"Use a private directory owned by your UID with mode 0700 or set MICROFAT_CACHE_DIR."

	// Deprecated compatibility aliases:
	HintMemfdSeccomp = HintMemfdEPERM
	HintExecNoExec   = HintExecEACCES
)

const (
	// MagicString identifies a microfat-enabled fat executable.
	MagicString = "\x00\xFA\x7FMICRO"

	// TrailerSize is the fixed size of the trailer at EOF:
	// 8 bytes IndexOffset + 8 bytes IndexSize + 32 bytes IndexSHA256 + 8 bytes Magic.
	TrailerSize = 56

	// OffsetLen is length in bytes of uint64 fields in trailer.
	OffsetLen = 8

	// SizeLen is length in bytes of uint64 size fields in trailer.
	SizeLen = 8

	// HashLen is the byte length of SHA-256 checksums.
	HashLen = 32

	// MagicLen is the length of magic string in bytes.
	MagicLen = 8

	// IndexMagicV2 is the 4-byte magic signature at the start of Format v2 binary indices.
	IndexMagicV2 = "\x00\xFAM2"

	// FormatVersion1 is the legacy JSON manifest format.
	FormatVersion1 = 1

	// FormatVersion2 is the reflection-free compact binary index table format.
	FormatVersion2 = 2

	// FormatVersionCurrent is the default format version used for new fat binaries.
	FormatVersionCurrent = FormatVersion2

	// MaxIndexSize is the maximum allowable index table size (1 MB).
	MaxIndexSize = 1024 * 1024

	// MaxPayloadSize is the maximum allowable single payload uncompressed size (1 GB).
	MaxPayloadSize = 1024 * 1024 * 1024

	// MaxDictionarySize is the maximum allowable shared dictionary size (1 MB).
	MaxDictionarySize = 1024 * 1024

	// Environment variable names for telemetry and control.
	EnvSelectedVariant           = "MICROFAT_SELECTED_VARIANT"
	EnvHostArch                  = "MICROFAT_HOST_ARCH"
	EnvHostLevel                 = "MICROFAT_HOST_LEVEL"
	EnvExecMode                  = "MICROFAT_EXEC_MODE"
	EnvDispatchMode              = "MICROFAT_DISPATCH_MODE"
	EnvSelectedSHA256            = "MICROFAT_SELECTED_SHA256"
	EnvSelectedSize              = "MICROFAT_SELECTED_SIZE"
	EnvCgroupVersion             = "MICROFAT_CGROUP_VERSION"
	EnvCgroupGOMEMLIMIT          = "MICROFAT_CGROUP_GOMEMLIMIT"
	EnvCgroupGOMAXPROCS          = "MICROFAT_CGROUP_GOMAXPROCS"
	EnvCgroupLimitBytes          = "MICROFAT_CGROUP_LIMIT_BYTES"
	EnvCgroupHighBytes           = "MICROFAT_CGROUP_HIGH_BYTES"
	EnvCgroupEffectiveLimitBytes = "MICROFAT_CGROUP_EFFECTIVE_LIMIT_BYTES"
	EnvCgroupCPUs                = "MICROFAT_CGROUP_CPUS"
	EnvCgroupGOGC                = "MICROFAT_CGROUP_GOGC"
	EnvCgroupGOGCSkippedReason   = "MICROFAT_CGROUP_GOGC_SKIPPED_REASON"
	EnvCgroupGCProfile           = "MICROFAT_CGROUP_GC_PROFILE"
	EnvDebug                     = "MICROFAT_DEBUG"
	EnvLog                       = "MICROFAT_LOG"
	EnvAutotune                  = "MICROFAT_AUTOTUNE"
	EnvCPUPolicy                 = "MICROFAT_CPU_POLICY"
	EnvDryRun                    = "MICROFAT_DRY_RUN"
	EnvMemRatio                  = "MICROFAT_MEM_RATIO"
	EnvGCProfile                 = "MICROFAT_GC_PROFILE"
	EnvLiveHeapEstimate          = "MICROFAT_LIVE_HEAP_ESTIMATE"
	EnvForceLevel                = "MICROFAT_FORCE_LEVEL"
	EnvMaxLevel                  = "MICROFAT_MAX_LEVEL"
	EnvDisableVariants           = "MICROFAT_DISABLE_VARIANTS"
	EnvPolicy                    = "MICROFAT_POLICY"
	EnvAVX512DownclockProtection = "MICROFAT_AVX512_DOWNCLOCK_PROTECTION"
	EnvCacheDir                  = "MICROFAT_CACHE_DIR"
	EnvVerifyCache               = "MICROFAT_VERIFY_CACHE"
	EnvPolicyApplied             = "MICROFAT_POLICY_APPLIED"
	EnvOverrideReason            = "MICROFAT_OVERRIDE_REASON"

	// EnvOriginalExe specifies the informational asset-resolution hint indicating the
	// original fat binary path prior to memfd/cache execution.
	//
	// Security boundary: This variable is strictly an informational asset-resolution hint
	// for locating neighboring filesystem resources (configurations, plugins, static assets,
	// sibling CLI binaries). It is propagated via the process environment and must NOT be used
	// by applications or libraries as a cryptographic identity, access-control token, or
	// trusted binary origin.
	EnvOriginalExe = "MICROFAT_ORIGINAL_EXE"

	// Execution modes.
	ExecModeAuto  = "auto"
	ExecModeMemfd = "memfd"
	ExecModeCache = "cache"

	// Telemetry event types.
	EventDispatch = "dispatch"
	EventError    = "dispatch_error"
	EventPrewarm  = "prewarm"

	// File permissions.
	PrivateCacheDirMode = 0o700
	PrivateExecMode     = 0o700
)

const (
	PrewarmStatusExtracted     = "extracted"
	PrewarmStatusAlreadyCached = "already_cached"
	PrewarmStatusValid         = "valid"
	PrewarmStatusMissing       = "missing"
	PrewarmStatusCorrupted     = "corrupted"
)

const MaxJSONDepth = 128