docker

type ActionDetail struct {
	Requested     string `json:"requested"`
	Effective     string `json:"effective"`
	Allowed       bool   `json:"allowed"`
	BlockedReason string `json:"blocked_reason,omitempty"`
}

type AnomalyEntry struct {
	Type     string `json:"type"`
	Severity string `json:"severity"`
	Message  string `json:"message"`
}

type AnsibleInventory struct {
	Path string
}

type ComposeBackend struct {
	// contains filtered or unexported fields
}

type DeployResult struct {
	Host     string
	Stack    string
	Success  bool
	Duration time.Duration
	Message  string
}

type DiscoveryTrust struct {
	Level             TrustLevel
	Sentinel          bool                 // .stagefreight.yml exists
	IaCRootExists     bool                 // expected IaC directory exists
	ScanSucceeded     bool                 // scan completed without error
	RepoIdentityMatch bool                 // origin URL matches expected
	DeclaredTargets   bool                 // host resolution succeeded
	StackCount        int                  // stacks discovered
	Reasons           []TrustFailureReason // why trust failed
}

type DockerPlanMeta struct {
	Scope      string
	ScopeKind  string
	Stack      string
	Path       string
	BundleHash string
	StoredHash string
	DriftTier  int
	DeployKind string

	// Signals for truthful output (not inferred from action).
	DriftDetected   bool   // true if drift was found (independent of action taken)
	DriftReason     string // human-readable drift reason
	IsOrphan        bool   // true if this is an orphaned project
	RequestedAction string // what policy wanted (before trust/safety gates)
	BlockedReason   string // structured reason if action was degraded/blocked (empty = allowed)
}

type DriftDetail struct {
	Detected bool   `json:"detected"`
	Kind     string `json:"kind"` // tier1 | tier2 | none | unknown
	Reason   string `json:"reason"`
}

type DriftPolicy struct {
	Tier2Action               string `yaml:"tier2_action"`                // report | reconcile
	OrphanAction              string `yaml:"orphan_action"`               // report | down | prune
	OrphanThreshold           int    `yaml:"orphan_threshold"`            // block if more than N orphans
	PruneRequiresConfirmation bool   `yaml:"prune_requires_confirmation"` // require --force for prune
}

type DriftResult struct {
	Host       string
	Stack      string
	Drifted    bool
	Tier       int // 1 = bundle hash, 2 = container config hash
	Reason     string
	BundleHash string // current computed hash
	StoredHash string // last known hash
}

type EnvFile struct {
	Path      string // relative to stack dir
	FullPath  string // absolute path
	Encrypted bool   // SOPS-encrypted (detected by naming or content)
}

type ExecResult struct {
	Success  bool
	ExitCode int
	Stdout   string
	Stderr   string
	Duration time.Duration
}

type HashStamps struct {
	Stacks map[string]StackStamp `yaml:"stacks"` // key: "scope/stack"
}

type Hook struct {
	Phase string // "pre" | "post"
	Path  string // relative to BundleDir
}

type HostTarget struct {
	Name      string
	Address   string
	Groups    []string          // populated from inventory group membership
	Vars      map[string]string // host variables from inventory
	Transport HostTransport     // established during Prepare phase
}

type HostTransport interface {
	ExecuteAction(ctx context.Context, action StackAction) (ExecResult, error)
	// InspectStack queries runtime state for a compose project.
	// Read-only. Returns structured runtime facts, not CLI output.
	// Selects containers by Compose project label, not name.
	InspectStack(ctx context.Context, project string) (StackInspection, error)
	// ListProjects returns all compose project names running on this host.
	// Uses -a to include stopped containers (stopped = still logically exists).
	ListProjects(ctx context.Context) ([]string, error)
	Close() error
}

type InventorySource interface {
	Name() string
	Resolve(ctx context.Context, selector TargetSelector) ([]HostTarget, error)
}

type LocalTransport struct{}

type OrphanPlan struct {
	Project string       `json:"project"`
	Scope   string       `json:"scope"`
	Reason  string       `json:"reason"`
	Action  ActionDetail `json:"action"`
}

type PlanOutput struct {
	Mode      string       `json:"mode"`
	Backend   string       `json:"backend"`
	Generated time.Time    `json:"generated_at"`
	Summary   PlanSummary  `json:"summary"`
	Trust     TrustOutput  `json:"trust"`
	Targets   []TargetPlan `json:"targets"`
}

type PlanSummary struct {
	Total   int            `json:"total"`
	Drifted int            `json:"drifted"`
	Orphans int            `json:"orphans"`
	Blocked int            `json:"blocked"`
	Actions map[string]int `json:"actions"`
}

type SOPSProvider struct{}

type SSHTransport struct {
	Host    string
	User    string
	KeyPath string
}

type SecretsProvider interface {
	Name() string
	Decrypt(ctx context.Context, path string) ([]byte, error)
	Encrypt(ctx context.Context, path string, data []byte) error
	IsEncrypted(path string) bool
}

type ServiceRuntimeState struct {
	Service     string
	ConfigHash  string // com.docker.compose.config-hash label
	Image       string
	Running     bool
	State       string // running, exited, dead, etc.
	ContainerID string
}

type StackAction struct {
	Target      string // host identity
	Stack       string // scope/name
	Action      string // "up", "down", "restart"
	ProjectName string // docker compose -p flag
	WorkDir     string // working directory (relative to bundle or host-resolved)

	// Staged bundle: transport decides how to materialize this.
	// SSH copies it to remote tmpdir. Agent receives it as payload.
	BundleDir string // local staging root containing all needed files

	// Compose file and env files — relative to BundleDir.
	ComposeFile string   // e.g. "compose.yaml"
	EnvFiles    []string // e.g. [".env", "app_secret.env"]

	// Hooks as ordered execution steps, not raw paths.
	Hooks []Hook
}

type StackInfo struct {
	Scope          string // host name or group name
	ScopeKind      string // "host" or "group"
	Name           string // stack directory name
	Path           string // relative path from repo root
	ComposeFile    string // detected compose filename
	ComposeProject string // canonical compose project name (for container identity)
	EnvFiles       []EnvFile
	Scripts        []string // pre.sh, deploy.sh, post.sh
	DeployKind     string   // "compose", "script", "unmanaged"
}

type StackInspection struct {
	Project  string
	Services []ServiceRuntimeState
}

type StackPlan struct {
	Name    string       `json:"name"`
	Project string       `json:"project"`
	Scope   string       `json:"scope"`
	Status  string       `json:"status"` // in_sync | drift | blocked | unknown
	Drift   DriftDetail  `json:"drift"`
	Action  ActionDetail `json:"action"`
}

type StackStamp struct {
	BundleHash string    `yaml:"bundle_hash"`
	ConfigHash string    `yaml:"config_hash"` // runtime compose config hash from last apply
	DeployedAt time.Time `yaml:"deployed_at"`
}

type TargetPlan struct {
	Name      string         `json:"name"`
	Transport string         `json:"transport"`
	Stacks    []StackPlan    `json:"stacks"`
	Orphans   []OrphanPlan   `json:"orphans,omitempty"`
	Anomalies []AnomalyEntry `json:"anomalies,omitempty"`
}

type TargetSelector struct {
	Groups []string `yaml:"groups"`
}

type TrustChecks struct {
	Sentinel        bool `json:"sentinel"`
	IaCRoot         bool `json:"iac_root"`
	Scan            bool `json:"scan"`
	RepoIdentity    bool `json:"repo_identity"`
	DeclaredTargets bool `json:"declared_targets"`
}

type TrustFailureReason string

type TrustLevel string

type TrustOutput struct {
	Level   string      `json:"level"`
	Checks  TrustChecks `json:"checks"`
	Reasons []string    `json:"reasons,omitempty"`
}