multienv

type AttrDiff struct {
	ResourceType string            // e.g. "jamfpro_policy"
	Label        string            // e.g. "install_rosetta"
	AttrName     string            // e.g. "priority"
	Values       map[string]string // env name → attribute value expression
	VarName      string            // generated variable name
	VarType      string            // HCL variable type, e.g. "string", "list(string)"
}

type ClassifiedFile struct {
	// RelPath is the path relative to the support_files/<env>/ directory,
	// e.g. "scripts/install_agent.sh"
	RelPath string

	// Class indicates whether the file is shared or divergent.
	Class SupportFileClass
}

type EnvConfig struct {
	Name         string // e.g. "dev", "staging", "prod"
	URL          string // Jamf Pro instance URL, or Jamf Platform base_url
	AuthMethod   string // "basic" or "oauth2" (Jamf Platform is always "oauth2")
	Username     string
	Password     string
	ClientID     string
	ClientSecret string
	// EnvironmentID and TenantID are the two Jamf Platform scope identifiers,
	// mutually exclusive. Both empty is organization scope. Ignored by the
	// jamfpro provider, which has no notion of either.
	EnvironmentID string
	TenantID      string
}

type MatchedResource struct {
	ResourceType string
	Label        string
	Name         string            // human-readable Jamf name
	IDs          map[string]string // env name → Jamf ID
	Present      []string          // which envs have this resource
	AllEnvs      bool              // true if present in every environment
}

type ModuleVar struct {
	Name         string // variable name, e.g. "script_install_agent_contents"
	Description  string // human-readable description
	ResourceType string // e.g. "jamfpro_script"
	Label        string // e.g. "install_agent"
	AttrName     string // e.g. "script_contents"
	FilePath     string // relative path to the divergent file, e.g. "scripts/install_agent.sh"
	Sensitive    bool   // mark the declared variable sensitive (write-only secrets)
	Type         string // declared HCL type; empty means "string"
}

type Options struct {
	Provider             string // "jamfpro" (default) or "jamfplatform"
	Envs                 []EnvConfig
	SourceEnv            string // name of source-of-truth env (default: first in Envs)
	OutputDir            string
	SelectedResources    map[string]bool
	SkipReferences       bool
	SkipImportBlocks     bool
	SkipPackageDownloads bool
	ProviderVersion      string
	Quiet                bool
	Verbose              bool
	ResourcesFlag        string
	ExcludeFlag          string
	StatusFunc           func(string, int, int)
}

type PerEnvResult struct {
	EnvName   string
	Registry  *registry.Registry
	Resources []ResourceRef // flat list of discovered resources for matching
	OutputDir string        // temp working directory for this env

	// ProcessOptions is the provider-specific post-processing configuration
	// (TypeToFileMap, Rules, ExtractSpecs, provider schema, etc.) built during
	// discovery. The merge pipeline clones it and overrides SupportFilesPrefix
	// and SkipReferences per call.
	ProcessOptions *postprocess.ProcessOptions

	// TokenRefreshPeriod is the provider's token refresh buffer in seconds, or 0
	// if the provider has no such attribute. Written into the env-root provider
	// block when non-zero.
	TokenRefreshPeriod int
}

type Provider interface {
	// Name is the provider identifier ("jamfpro", "jamfplatform").
	Name() string

	// ProviderSource is the registry source used to read the resolved version
	// from .terraform.lock.hcl (e.g. "deploymenttheory/jamfpro").
	ProviderSource() string

	// DiscoverAndGenerate runs discovery + terraform plan/query for one
	// environment into a fresh temp directory and returns a populated
	// PerEnvResult (the caller owns cleanup of result.OutputDir).
	DiscoverAndGenerate(env EnvConfig, opts *Options) (*PerEnvResult, error)

	// TypeToFileMap maps TF resource type → output filename.
	TypeToFileMap() map[string]string

	// ModuleProvidersBlock returns the required_providers block written to
	// modules/jamf/providers.tf. versionLine is the formatted version constraint
	// (may be empty).
	ModuleProvidersBlock(versionLine string) string

	// EnvProviderHeader returns the terraform{} + provider{} blocks for an
	// environment root's main.tf — everything that precedes the module call.
	EnvProviderHeader(env EnvConfig, versionLine string, tokenRefreshPeriod int) string

	// EnvAuthVariables returns the connection variable declarations for an
	// environment root's variables.tf (URL/auth/credentials).
	EnvAuthVariables(env EnvConfig) string

	// UsesIdentityImports reports whether this provider's import blocks address
	// an object by resource identity (`identity = { id = ... }`) rather than by
	// the flat `id = ...`.
	//
	// It decides the form the environment roots write, so that they match the
	// single-env export rather than diverging from it. It matters most for the
	// settings singletons, whose import id is the fixed sentinel "singleton":
	// on the flat form a singleton the tenant has not configured reports a
	// framework-level "Missing Resource Identity After Read", which tells the
	// operator to file a provider bug for what is really just an absent
	// setting. The identity form leaves state null, which the provider's Read
	// recognises, and it reports plainly that there is nothing to import.
	UsesIdentityImports() bool
}

type ResourceRef struct {
	TFType string
	Label  string
	Name   string
	JamfID string
}

type SupportFileClass int