safety

type Confirmer struct {
	// In is the confirmation input stream (stdin).
	In io.Reader
	// Out receives prompts, the bulk match count and the irreversibility
	// warning. This is stderr — never stdout.
	Out io.Writer
	// TTY is true when both In and Out are a terminal. It is computed by the
	// caller (only app.go may look at the real file descriptors).
	TTY bool
	// AssumeYes is --yes or PAY_YES=1.
	AssumeYes bool
	// ConfirmWrites is defaults.confirm_writes: opt in to prompting on L1.
	ConfirmWrites bool
	// Quiet suppresses the informational lines. It never suppresses a prompt,
	// because a prompt with no question is unanswerable.
	Quiet bool
	// DryRun short-circuits every prompt: --dry-run performs the read half
	// only, so there is nothing to confirm (§12.2).
	DryRun bool
	// contains filtered or unexported fields
}

type DryRunRequest struct {
	Method string          `json:"method"`
	URL    string          `json:"url"`
	Body   json.RawMessage `json:"body"`
}

type DryRunResult struct {
	WouldAffect int           `json:"would_affect"`
	SampleIDs   []any         `json:"sample_ids"`
	Truncated   bool          `json:"truncated"`
	Request     DryRunRequest `json:"request"`
}

type Level int

type Op struct {
	// Command is one of the Cmd* constants.
	Command string
	// Selector says how many documents are addressed.
	Selector Selector
	// Permanent is --permanent on delete: the real DELETE rather than the
	// soft-delete PATCH.
	Permanent bool
	// TrashEnabled is the manifest's answer for the target collection. When it
	// is false a delete cannot be undone and is therefore one level riskier
	// (§12.4).
	TrashEnabled bool
	// HardDelete is set when the command puts a raw DELETE on the wire
	// regardless of what trash says — today only `delete --where
	// --unsafe-passthrough-where`, which hands the filter to the server and
	// cannot express a soft delete. Every safety signal has to describe the
	// request that is actually sent, so this makes the operation read as a
	// hard, irreversible delete even on a trash-enabled collection where
	// --permanent was never passed.
	HardDelete bool
	// Method is the HTTP method for `pay raw`, which has no fixed risk level.
	Method string
	// Global is true when the target is a global rather than a collection.
	Global bool
}

type Plan struct {
	// Command is the bulk verb, used in messages.
	Command string
	// Collection is the target slug.
	Collection string
	// Matched is N from `GET /{coll}/count?where=…`.
	Matched int
	// MaxDocs is the effective cap; 0 means --all was passed.
	MaxDocs int
	// All is true when --all lifted the cap.
	All bool
}

type Request struct {
	// Op is the operation being confirmed.
	Op Op
	// Target is the collection or global slug, used in the summary line.
	Target string
	// Affected is the resolved match count for a bulk verb, or 1 for a scoped
	// one. A negative value means "not resolved".
	Affected int
	// Summary overrides the generated one-line description. It must never
	// contain a credential; callers pass slugs and counts, not request bodies.
	Summary string
}

type Selector int