guard

type BuildOptions struct {
	RunpackPath             string
	OutputPath              string
	CaseID                  string
	TemplateID              string
	InventoryPaths          []string
	TracePaths              []string
	RegressPaths            []string
	ApprovalAuditPaths      []string
	CredentialEvidencePaths []string
	ExtraEvidenceFiles      map[string][]byte
	RenderPDF               bool
	IncidentWindow          *schemaguard.Window
	AutoDiscoverV12         bool
	ProducerVersion         string
	SignKey                 ed25519.PrivateKey
}

type BuildRequest struct {
	RunID      string
	RunpackZip string
	CaseID     string
	OutputPath string
}

type BuildResult struct {
	PackPath string
	Manifest schemaguard.PackManifest
}

type Builder struct {
	ProducerVersion string
}

type DecryptOptions struct {
	InputPath      string
	OutputPath     string
	KeyEnv         string
	KeyCommand     string
	KeyCommandArgs []string
}

type DecryptResult struct {
	Path        string `json:"path"`
	PlainSHA256 string `json:"plain_sha256"`
	PlainSize   int    `json:"plain_size"`
}

type EncryptOptions struct {
	InputPath       string
	OutputPath      string
	KeyEnv          string
	KeyCommand      string
	KeyCommandArgs  []string
	ProducerVersion string
}

type EncryptResult struct {
	Path      string               `json:"path"`
	Artifact  EncryptedArtifact    `json:"artifact"`
	KeySource EncryptedArtifactKey `json:"key_source"`
}

type EncryptedArtifact struct {
	SchemaID        string               `json:"schema_id"`
	SchemaVersion   string               `json:"schema_version"`
	CreatedAt       time.Time            `json:"created_at"`
	ProducerVersion string               `json:"producer_version"`
	Algorithm       string               `json:"algorithm"`
	KeySource       EncryptedArtifactKey `json:"key_source"`
	Nonce           string               `json:"nonce"`
	Ciphertext      string               `json:"ciphertext"`
	PlainSHA256     string               `json:"plain_sha256"`
	PlainSize       int                  `json:"plain_size"`
}

type EncryptedArtifactKey struct {
	Mode    string `json:"mode"`
	Ref     string `json:"ref,omitempty"`
	Command string `json:"command,omitempty"`
}

type EvidencePackBuilder interface {
	Build(context.Context, BuildRequest) (schemaguard.PackManifest, error)
}

type HashMismatch struct {
	Path     string `json:"path"`
	Expected string `json:"expected"`
	Actual   string `json:"actual"`
}

type IncidentPackOptions struct {
	RunpackPath     string
	OutputPath      string
	CaseID          string
	Window          time.Duration
	TemplateID      string
	RenderPDF       bool
	ProducerVersion string
}

type IncidentPackResult struct {
	BuildResult             BuildResult `json:"build_result"`
	WindowFrom              time.Time   `json:"window_from"`
	WindowTo                time.Time   `json:"window_to"`
	TraceCount              int         `json:"trace_count"`
	RegressCount            int         `json:"regress_count"`
	ApprovalAuditCount      int         `json:"approval_audit_count"`
	CredentialEvidenceCount int         `json:"credential_evidence_count"`
	PolicyDigests           []string    `json:"policy_digests"`
}

type RetentionFileEvent struct {
	Path       string    `json:"path"`
	Kind       string    `json:"kind"`
	ModifiedAt time.Time `json:"modified_at"`
	AgeSeconds int64     `json:"age_seconds"`
	Action     string    `json:"action"`
}

type RetentionOptions struct {
	RootPath        string
	TraceTTL        time.Duration
	PackTTL         time.Duration
	DryRun          bool
	ReportOutput    string
	Now             time.Time
	ProducerVersion string
}

type RetentionResult struct {
	SchemaID        string               `json:"schema_id"`
	SchemaVersion   string               `json:"schema_version"`
	CreatedAt       time.Time            `json:"created_at"`
	ProducerVersion string               `json:"producer_version"`
	RootPath        string               `json:"root_path"`
	DryRun          bool                 `json:"dry_run"`
	TraceTTLSeconds int64                `json:"trace_ttl_seconds"`
	PackTTLSeconds  int64                `json:"pack_ttl_seconds"`
	ScannedFiles    int                  `json:"scanned_files"`
	DeletedFiles    []RetentionFileEvent `json:"deleted_files"`
	KeptFiles       []RetentionFileEvent `json:"kept_files"`
}

type VerifyOptions struct {
	PublicKey        ed25519.PublicKey
	RequireSignature bool
}

type VerifyResult struct {
	PackID          string         `json:"pack_id,omitempty"`
	RunID           string         `json:"run_id,omitempty"`
	FilesChecked    int            `json:"files_checked"`
	MissingFiles    []string       `json:"missing_files,omitempty"`
	HashMismatches  []HashMismatch `json:"hash_mismatches,omitempty"`
	SignatureStatus string         `json:"signature_status,omitempty"`
	SignatureErrors []string       `json:"signature_errors,omitempty"`
	SignaturesTotal int            `json:"signatures_total"`
	SignaturesValid int            `json:"signatures_valid"`
}