governance

type AssetFetcher func(repoURL, ref, path string) ([]byte, error)

type CapabilityResult struct {
	Domain     string // e.g., "build.docker", "build.binary", "package.helm"
	Detected   bool
	Confidence string   // "high", "medium", "low"
	Evidence   []string // filesystem signals that supported detection
}

type CatalogEntry struct {
	ID       string         // the repos: map key (a label)
	Forge    string         // forge id from a "<forge>:" location prefix, or "" (inherit)
	At       string         // the repo project path ("<group>/<repo>")
	Metadata map[string]any // governed branding (nil for a bare-string / location-only entry)
	Config   map[string]any // optional per-repo config override
}

type CommitResult struct {
	Repo    string
	Status  string // "committed", "unchanged", "dry-run", "skipped-identical", "error"
	SHA     string // commit SHA if committed
	Message string
	Drifted bool // true if managed file was drifted before replacement
	Error   error
}

type DetectionReport struct {
	Capabilities []CapabilityResult
}

type DistributedFile struct {
	Path    string // e.g., ".stagefreight/stagefreight-managed.yml"
	Content []byte
	Action  string // "create", "replace", "unchanged", "delete"
	Drifted bool   // true if existing file differs from governance intent
}

type DistributionPlan struct {
	Repo        string // "org/repo"
	Credentials string // env var prefix for forge auth (from cluster targets)
	Files       []DistributedFile
}

type EnabledFeature struct {
	Domain string
	Reason string // "config enabled + capability detected"
}

type ExecutionPlan struct {
	Enabled []EnabledFeature
	Skipped []SkippedFeature
}

type FileCommit struct {
	Path    string
	Content []byte
	Action  string // "create", "update"
}

type ForgeClient interface {
	ForgeReader

	// CommitFiles commits multiple file changes to a repo's default branch.
	// Returns commit SHA on success.
	CommitFiles(repo, branch, message string, files []FileCommit) (string, error)

	// DefaultBranch returns the default branch name for a repo.
	DefaultBranch(repo string) (string, error)
}

type ForgeReader interface {
	GetFileContent(repo, path, ref string) ([]byte, error)
	// DefaultBranch reports the repo's default branch — read from the forge so the
	// concretized repos section never assumes it.
	DefaultBranch(repo string) (string, error)
}

type GovernanceConfig struct {
	Profiles ProfileList `yaml:"profiles"`
}

type GovernanceSource struct {
	RepoURL   string `yaml:"repo_url"` // policy repo URL
	Ref       string `yaml:"ref"`      // "" = default branch (tracked); a ref pins
	Path      string `yaml:"path"`     // path to governance config within repo
	LocalPath string `yaml:"-"`        // if set, use local checkout instead of cloning
}

type MergeEntry = config.MergeEntry

type MergeTrace = config.MergeTrace

type PlanViewConfig struct {
	Mode    string // "dry-run" or "apply"
	Source  string // e.g. "PrPlanIT/MaintenancePolicy"
	Ref     string // e.g. "dba5d2a" or "v1.0.0"
	Forge   string // where satellites are read/written, e.g. "gitlab @ https://gitlab.example (cred: GITLAB_*)"
	Verbose bool   // expand preset-cache files individually
}

type PlanViewData struct {
	Config   PlanViewConfig
	Profiles []Profile
	Plans    map[string]DistributionPlan // keyed by repo
	Results  map[string]CommitResult     // keyed by repo (nil for dry-run)
}

type PresetLoader = config.PresetLoader

type PresetQualifier struct {
	Repo string // clonable source, e.g. "https://gitlab.example.com/Org/Policy"
}

type PresetRef struct {
	Path string
}

type PresetSourceInfo struct {
	Provider  string // "gitlab", "github", "gitea"
	ForgeURL  string // HTTPS base URL (e.g., "https://gitlab.prplanit.com")
	ProjectID string // "org/repo" or "org/group/repo"
}

type Profile struct {
	ID          string         `yaml:"-"`                     // from the profiles: map key
	Repos       ProfileCatalog `yaml:"repos"`                 // the location-anchored catalog
	Config      map[string]any `yaml:"config"`                // the profile's shared StageFreight config
	Credentials string         `yaml:"credentials,omitempty"` // env var prefix for the write token
}

type ProfileCatalog []CatalogEntry

type ProfileList []Profile

type ResolvedPreset struct {
	Path        string         // source path within policy repo
	TopLevelKey string         // the single top-level key this preset declares
	Content     map[string]any // parsed YAML content under that key
}

type SealMeta struct {
	SourceRepo string // e.g., "https://gitlab.prplanit.com/PrPlanIT/MaintenancePolicy"
	ProfileID  string // e.g., "docker-services"
}

type SkippedFeature struct {
	Domain string
	Reason string // "capability not detected" or "config disabled"
}