reconcile

type Action string

type Applier interface {
	CreateConfiguration(name, xml string, platforms []string) (id, updated string, err error)
	UpdateConfiguration(id, name, xml string) (updated string, err error)
	// FetchCustomSettingDetail re-reads one configuration *with its profile XML* so a
	// write can be confirmed against what Apple actually stored (see push). The name
	// and signature are *ab.Client's own, so the real client keeps satisfying Applier
	// with no adapter.
	FetchCustomSettingDetail(id string) (ab.LiveConfig, error)
	DeleteConfiguration(id string) error
	CreateBlueprint(name, description string, members map[string][]string) (*ab.Resource, error)
	AddBlueprintMembers(bpID, rel, memberType string, ids []string) error
	RemoveBlueprintMembers(bpID, rel, memberType string, ids []string) error
	// BlueprintRelationship re-reads one relationship so a membership write can be
	// confirmed against what Apple actually holds. The project's rule — a 2xx is not
	// proof — was enforced for configuration writes and nowhere for membership, which
	// left `attached` reported on the strength of the response code alone. Signature is
	// *ab.Client's own, so the real client keeps satisfying Applier with no adapter.
	BlueprintRelationship(bpID, rel string) ([]ab.Resource, error)
}

type Archiver interface {
	Archive(name, reason string, xml []byte, meta map[string]string) (path string, err error)
}

type BlueprintAction string

type BlueprintItem struct {
	Blueprint  string          `json:"blueprint"`
	BPID       string          `json:"bp_id,omitempty"` // empty for a git-only blueprint (filled by the create at apply time)
	Action     BlueprintAction `json:"action"`
	Collection string          `json:"collection,omitempty"` // member collection key (ab.Collection*); empty on blueprint-level rows and legacy items (= configurations)
	// Config / ConfigID carry the MEMBER display name and ABM id for every
	// collection — the JSON keys predate non-config membership and are kept
	// stable for existing consumers (abgui decodes them).
	Config      string `json:"config,omitempty"`
	ConfigID    string `json:"config_id,omitempty"`
	Description string `json:"description,omitempty"` // blueprint-new: the manifest description the create sends
	Detail      string `json:"detail"`
}

type BlueprintOutcome struct {
	Blueprint string          `json:"blueprint"`
	Config    string          `json:"config,omitempty"`
	Action    BlueprintAction `json:"action"`
	Status    string          `json:"status"` // "done" | "skipped" | "error"
	Detail    string          `json:"detail"`
}

type BlueprintPlan struct {
	Items []BlueprintItem `json:"items"`
}

type BlueprintResult struct {
	Outcomes []BlueprintOutcome `json:"outcomes"`
	Writes   int                `json:"writes"`
	Errors   int                `json:"errors"`
	Skipped  int                `json:"skipped"`
}

type Engine struct {
	Client   Applier
	Archiver Archiver
	Files    FileStore
}

type FileStore interface {
	WriteConfig(name string, content []byte) error
	RemoveConfig(name string) error
	LoadBlueprints() (map[string]gitops.BlueprintSpec, error)
	WriteBlueprintSpec(gitops.BlueprintSpec) error
}

type Item struct {
	Name   string `json:"name"`
	Action Action `json:"action"`
	Detail string `json:"detail"`
}

type MembershipMode int

type Opts struct {
	Prune       bool     // enable DeleteABM (off by default — never prune unasked)
	LimitWrites int      // circuit breaker: max tenant writes per run (0 = unlimited)
	Platforms   []string // configuredForPlatforms for newly-created configs
	Progress    func(string)
	// GitTime resolves the git-side timestamp of a config (last commit time, else
	// file mtime) for newest-wins conflict resolution. ok=false → the timestamp is
	// unknown, so the conflict is skipped rather than guessed (never clobber a side
	// on missing information).
	GitTime func(name string) (t time.Time, ok bool)
}

type Outcome struct {
	Name    string `json:"name"`
	Action  Action `json:"action"` // the effective action (a Conflict resolves to Update or Pull)
	Status  string `json:"status"` // "done" | "skipped" | "error"
	Detail  string `json:"detail"`
	Archive string `json:"archive,omitempty"` // archive path, when one was written
	// ABMID is the configuration id the write targeted (Update) or created (Create).
	// It is recorded on EVERY create/update outcome, including the ones whose baseline
	// entry is deliberately not written (see push) — a caller that wants to re-read an
	// unconfirmed write has no other source for the id, since the baseline only ever
	// describes a confirmed one.
	ABMID string `json:"abm_id,omitempty"`
	// Verified is the read-back verdict for a create/update (empty for everything
	// else). "done" + VerifyUnconfirmed is a real state: the write was made, the
	// confirmation was not obtained, and the baseline was deliberately left alone.
	Verified Verification `json:"verified,omitempty"`
}

type Plan struct {
	Items []Item `json:"items"`
}

type Result struct {
	Outcomes []Outcome `json:"outcomes"`
	Writes   int       `json:"writes"`  // tenant writes performed (POST/PATCH/DELETE)
	Errors   int       `json:"errors"`  // items that failed
	Skipped  int       `json:"skipped"` // items intentionally not applied (prune off / limit reached / unresolved)
}

type Verification string