profile

type ParseOptions struct {
	// Verify is applied when the data is CMS-signed. Roots nil means any
	// embedded chain is accepted; see cms.VerifyOptions.
	Verify cms.VerifyOptions
	// RequireSignature rejects unsigned input.
	RequireSignature bool
	// Resolve overrides the registry lookup. The default resolves payload
	// types with exactly one generated type and keeps the rest raw.
	Resolve Resolver
	// MaxBytes bounds the plist (default plist.Decoder default).
	MaxBytes int
}

type Parsed struct {
	Profile *Profile
	// Signer is the certificate that signed the profile, nil when unsigned.
	Signer *x509.Certificate
	// Plist is the decoded (unsigned) plist bytes.
	Plist []byte
}

type Payload struct {
	Identifier   string
	UUID         string
	Version      int64 // default 1
	DisplayName  string
	Description  string
	Organization string
	// Content is the payload body, a type from schema/profiles or a Raw.
	Content profiles.Payload
}

type Profile struct {
	Identifier        string
	UUID              string
	Version           int64 // default 1
	DisplayName       string
	Description       string
	Organization      string
	Scope             string
	RemovalDisallowed bool
	Payloads          []Payload
	// Extra top-level keys emitted verbatim (ConsentText, RemovalDate...).
	// Reserved keys set by the builder are ignored here.
	Extra map[string]any
}

type Raw struct {
	Type string
	Keys map[string]any
}

type Resolver func(payloadType string, keys map[string]any) profiles.Payload