governance

type AssetFetcher func(repoURL, ref, path string) ([]byte, error)

type CapabilityResult struct {
	Domain     string // e.g., "build.docker", "build.binary", "package.helm"
	Detected   bool
	Confidence string   // "high", "medium", "low"
	Evidence   []string // filesystem signals that supported detection
}

type Cluster struct {
	ID      string         `yaml:"id"`
	Targets ClusterTargets `yaml:"targets"`
	Config  map[string]any `yaml:"stagefreight"` // raw StageFreight config
}

type ClusterTargets struct {
	Repos  []string      `yaml:"repos,omitempty"`  // shorthand: flat list, inherited forge
	Groups []TargetGroup `yaml:"groups,omitempty"` // explicit: per-group forge identity
}

type CommitResult struct {
	Repo    string
	Status  string // "committed", "unchanged", "dry-run", "skipped-identical", "error"
	SHA     string // commit SHA if committed
	Message string
	Drifted bool // true if managed file was drifted before replacement
	Error   error
}

type DetectionReport struct {
	Capabilities []CapabilityResult
}

type DistributedFile struct {
	Path    string // e.g., ".stagefreight/stagefreight-managed.yml"
	Content []byte
	Action  string // "create", "replace", "unchanged", "delete"
	Drifted bool   // true if existing file differs from governance intent
}

type DistributionPlan struct {
	Repo  string // "org/repo"
	Files []DistributedFile
}

type EnabledFeature struct {
	Domain string
	Reason string // "config enabled + capability detected"
}

type ExecutionPlan struct {
	Enabled []EnabledFeature
	Skipped []SkippedFeature
}

type FileCommit struct {
	Path    string
	Content []byte
	Action  string // "create", "update"
}

type ForgeClient interface {
	ForgeReader

	// CommitFiles commits multiple file changes to a repo's default branch.
	// Returns commit SHA on success.
	CommitFiles(repo, branch, message string, files []FileCommit) (string, error)

	// DefaultBranch returns the default branch name for a repo.
	DefaultBranch(repo string) (string, error)
}

type ForgeReader interface {
	GetFileContent(repo, path, ref string) ([]byte, error)
}

type GovernanceConfig struct {
	Clusters []Cluster `yaml:"clusters"`
}

type GovernanceSource struct {
	RepoURL       string `yaml:"repo_url"`       // policy repo URL
	Ref           string `yaml:"ref"`            // pinned tag or commit SHA (required)
	Path          string `yaml:"path"`           // path to governance config within repo
	AllowFloating bool   `yaml:"allow_floating"` // if true, branch refs allowed (dev/unsafe)
	LocalPath     string `yaml:"-"`              // if set, use local checkout instead of cloning
}

type MergeEntry struct {
	Path         string // dot-path (e.g., "security.sbom")
	Source       string // "managed", "local", "preset:preset/security.yml"
	SourceRef    string // "PrPlanIT/MaintenancePolicy@v1.0.0" for presets
	Layer        int    // resolution depth (0=innermost preset, N=outermost, N+1=managed, N+2=local)
	Operation    string // "set", "override", "merge", "replace"
	Value        any
	Overridden   bool
	OverriddenBy string
}

type MergeTrace struct {
	Entries []MergeEntry
}

type PlanViewConfig struct {
	Mode    string // "dry-run" or "apply"
	Source  string // e.g. "PrPlanIT/MaintenancePolicy"
	Ref     string // e.g. "dba5d2a" or "v1.0.0"
	Verbose bool   // expand preset-cache files individually
}

type PlanViewData struct {
	Config   PlanViewConfig
	Clusters []Cluster
	Plans    map[string]DistributionPlan // keyed by repo
	Results  map[string]CommitResult     // keyed by repo (nil for dry-run)
}

type PresetLoader interface {
	Load(path string) ([]byte, error)
}

type PresetRef struct {
	Path string
}

type PresetSourceInfo struct {
	Provider    string // "gitlab", "github", "gitea"
	ForgeURL    string // HTTPS base URL (e.g., "https://gitlab.prplanit.com")
	ProjectID   string // "org/repo" or "org/group/repo"
	Ref         string // pinned ref
	CachePolicy string // "authoritative" or "advisory"
}

type ResolvedPreset struct {
	Path        string         // source path within policy repo
	TopLevelKey string         // the single top-level key this preset declares
	Content     map[string]any // parsed YAML content under that key
}

type ResolvedRepo struct {
	ID       string // "org/repo" project identifier on the resolved forge
	ForgeURL string // forge base URL from group, or "" (inherit from governance sources.primary)
}

type SealMeta struct {
	SourceRepo string // e.g., "https://gitlab.prplanit.com/PrPlanIT/MaintenancePolicy"
	SourceRef  string // e.g., "v1.0.0" or commit SHA
	ClusterID  string // e.g., "docker-services"
}

type SkippedFeature struct {
	Domain string
	Reason string // "capability not detected" or "config disabled"
}

type TargetGroup struct {
	ID      string             `yaml:"id,omitempty"`
	Sources *TargetGroupSource `yaml:"sources,omitempty"` // nil = inherit governance sources.primary
	Repos   []string           `yaml:"repos"`             // project IDs on this forge
}

type TargetGroupPrimary struct {
	URL string `yaml:"url"` // forge base URL (e.g., "https://github.com")
}

type TargetGroupSource struct {
	Primary TargetGroupPrimary `yaml:"primary"`
}