pkg

type ClaudeProber interface {
	// Probe returns nil when claude is authenticated and reachable, or an
	// error describing the failure otherwise.
	Probe(ctx context.Context) error
}

type GateRunner interface {
	// RunTarget runs `make <target>` in workdir. Returns the bounded
	// combined-output tail, the process exit code (0 on success), and a
	// non-nil error when the target failed or could not be started.
	RunTarget(ctx context.Context, workdir, target string) (tail string, exitCode int, err error)
}

type GhCli interface {
	// CreateDraftPR opens a DRAFT pull request from head against base,
	// running gh inside workdir so the repo is inferred from the git
	// remote. Returns the PR URL.
	CreateDraftPR(ctx context.Context, workdir, base, head, title, body string) (string, error)

	// FindOpenPRByHead returns the URL of an open PR whose head is the
	// given branch, or "" when none exists. repo is "owner/name".
	FindOpenPRByHead(ctx context.Context, repo, head string) (string, error)

	// ViewPR returns the state (e.g. "OPEN", "MERGED", "CLOSED") and
	// draft flag of the PR identified by URL.
	ViewPR(ctx context.Context, prURL string) (state string, isDraft bool, err error)
}

type GoBump struct {
	From string `json:"from"`
	To   string `json:"to"`
}

type InstallationScope interface {
	// Allows reports whether repo ("owner/name") is covered by the token's
	// installation. Unknown means the check itself was impossible — never
	// treat that as denial.
	Allows(ctx context.Context, repo string) ScopeVerdict
}

type PlanOutput struct {
	Outcome string `json:"outcome"`

	// HasWork is true when the execution phase has anything to do.
	// omitempty is deliberately NOT applied so a `false` decision is
	// always written explicitly.
	HasWork bool `json:"has_work"`

	// GoBump records the go-directive bump (from current directive to the
	// image toolchain per design D5). Nil when the directive is already
	// current.
	GoBump *GoBump `json:"go_bump,omitempty"`

	// DepUpdatesExpected is true when `go list -u -m` style inspection
	// found outdated direct dependencies.
	DepUpdatesExpected bool `json:"dep_updates_expected"`

	// GateTargets are the Makefile targets forming the repo's own gate
	// (e.g. precommit, check, vulncheck). Execution and ai_review re-run
	// exactly these to exit 0 — never a hardcoded scanner.
	GateTargets []string `json:"gate_targets,omitempty"`

	// Vulns holds every scanner finding with its fix-vs-park classification.
	Vulns []PlanVuln `json:"vulns,omitempty"`

	// Reason carries the human-readable explanation on the
	// needs_input / no_update_needed paths.
	Reason string `json:"reason,omitempty"`
}

type PlanVuln struct {
	// ID is the finding identifier (GO-*, CVE-*, GHSA-*).
	ID string `json:"id"`
	// Package is the vulnerable module path.
	Package string `json:"package,omitempty"`
	// FixedVersion is the patched version the scanner reported; empty when
	// no fix exists (the park case).
	FixedVersion string `json:"fixed_version,omitempty"`
	// Scanner names which gate scanner flagged the finding
	// (govulncheck | osv-scanner | trivy).
	Scanner string `json:"scanner,omitempty"`
	// Action is "fix" (patched version exists — bump it) or "park"
	// (no fix / out-of-scope major — task parks per design D4).
	Action string `json:"action"`
	// Reason is the one-line classification justification.
	Reason string `json:"reason,omitempty"`
}

type ResultOutput struct {
	Outcome string `json:"outcome"`
	Branch  string `json:"branch,omitempty"`
	PRURL   string `json:"pr_url,omitempty"`

	// GateExit is the exit code of the last gate target run (0 = green).
	// omitempty is deliberately NOT applied — an explicit 0 documents the
	// green gate.
	GateExit int `json:"gate_exit"`

	// DepsUpdated counts the module bumps the update sequence applied.
	DepsUpdated int `json:"deps_updated"`

	// VulnsFixed lists the finding IDs resolved by the update — always a
	// subset of the plan's fix-action vulns.
	VulnsFixed []string `json:"vulns_fixed,omitempty"`

	// FailedTarget names the gate target that stayed red (failure path only).
	FailedTarget string `json:"failed_target,omitempty"`

	ErrorCategory git.ErrorCategory `json:"error_category,omitempty"`
	Error         string            `json:"error,omitempty"`
}

type ReviewChecks struct {
	// PROpen — `gh pr view` reports state OPEN.
	PROpen bool `json:"pr_open"`
	// PRDraft — `gh pr view` reports isDraft true (the agent never readies).
	PRDraft bool `json:"pr_draft"`
	// GateGreen — every planned gate target re-ran to exit 0 on a fresh
	// worktree at the branch.
	GateGreen bool `json:"gate_green"`
	// VulnsClear — the scanner-bearing gate targets came back green on the
	// re-run (the gate IS the vuln verdict, per design § 7.3 the repo's
	// gate wraps govulncheck/osv-scanner/trivy).
	VulnsClear bool `json:"vulns_clear"`
	// ChangelogUnreleased — CHANGELOG.md carries a bullet under
	// ## Unreleased and introduces no new version header vs master.
	ChangelogUnreleased bool `json:"changelog_unreleased"`
	// NoNewTag — `git ls-remote --tags` shows no tag pointing at any
	// branch commit.
	NoNewTag bool `json:"no_new_tag"`
}

type ReviewOutput struct {
	Approved bool         `json:"approved"`
	Checks   ReviewChecks `json:"checks"`
	Notes    string       `json:"notes"`
}

type ScopeVerdict string