repos

type BatchInstallConfig struct {
	Manifest       *Manifest
	DryRun         bool
	RepoFilter     []string
	MaxConcurrency int
	SkipMintCheck  bool

	// Roles is the list of agent roles to install (e.g., "triage", "coder").
	Roles []string

	// UpstreamRef is the git ref (SHA) used to pin scaffold workflow refs.
	UpstreamRef string
	// UpstreamTag is the version tag corresponding to UpstreamRef.
	UpstreamTag string

	// Direct controls scaffold delivery: true pushes directly to the default
	// branch; false creates a PR.
	Direct bool
}

type BatchInstallResult struct {
	Installed []InstallResult
	Skipped   []InstallResult
	Failed    []InstallResult
}

type Change struct {
	Owner    string `json:"owner"`
	Repo     string `json:"repo"`
	Field    string `json:"field"`
	Type     string `json:"type"`                // "variable" or "secret"
	Action   string `json:"action"`              // "create" or "update"
	OldValue string `json:"old_value,omitempty"` // empty for secrets (not readable)
	NewValue string `json:"new_value,omitempty"` // empty for secrets
}

type DefaultsConfig struct {
	InferenceProject       string   `yaml:"inference_project"`
	InferenceRegion        string   `yaml:"inference_region"`
	FullsendRef            string   `yaml:"fullsend_ref"`
	BaseHarness            string   `yaml:"base_harness"`
	AllowedRemoteResources []string `yaml:"allowed_remote_resources"`
}

type DiffResult struct {
	Changes  []Change `json:"changes"`
	Warnings []string `json:"warnings,omitempty"`
}

type DiscoveredRepo struct {
	Owner           string
	Repo            string
	Source          string // "per-repo", "per-org", or "new"
	MintURL         string
	InferenceRegion string
	FullsendRef     string
}

type Drift struct {
	Field    string `json:"field"`
	Expected string `json:"expected"`
	Actual   string `json:"actual"`
}

type InitConfig struct {
	Target           string
	Repos            []string
	All              bool
	MintProject      string
	MintRegion       string
	InferenceProject string
	MaxConcurrency   int
	CLIVersion       string
}

type InitResult struct {
	Manifest     *Manifest
	PerRepoCount int
	PerOrgCount  int
	NewCount     int
	TODOs        []string
	Errors       []string
}

type InstallConfig struct {
	Owner string
	Repo  string

	// Roles is the list of agent roles to install (e.g., "triage", "code").
	Roles []string

	MintURL string

	InferenceProject string
	InferenceRegion  string

	// UpstreamRef is the git ref (SHA) used to pin scaffold workflow refs.
	// Empty for dev builds (falls back to config.DefaultUpstreamRef).
	UpstreamRef string
	// UpstreamTag is the version tag corresponding to UpstreamRef (e.g., "v0.42.0").
	UpstreamTag string

	// Skip flags control which install steps are executed. Set by callers
	// that handle specific steps externally (e.g., admin.go handles guard
	// checks and mint setup before calling Install).
	SkipAppSetup   bool
	SkipMintCheck  bool
	SkipWIF        bool
	SkipGuardCheck bool

	// SkipScaffoldAndConfig skips scaffold file delivery and variable/secret
	// writes. The caller handles these steps externally (e.g., vendor mode
	// commits scaffold and vendor files together atomically).
	SkipScaffoldAndConfig bool

	// WIFProvider is a pre-provisioned WIF provider resource name. When set
	// and SkipWIF is true, the install skips WIF provisioning and uses this
	// value directly.
	WIFProvider string

	VendorBinary bool

	// Direct controls scaffold delivery: true pushes directly to the default
	// branch; false creates a PR.
	Direct bool
}

type InstallResult struct {
	Owner string
	Repo  string

	Success          bool
	Error            error
	AlreadyInstalled bool

	// WIFProvider is the WIF provider resource name, either pre-existing
	// (from InstallConfig) or newly provisioned.
	WIFProvider string
}

type Manifest struct {
	Version  int            `yaml:"version"`
	Mint     MintConfig     `yaml:"mint"`
	Defaults DefaultsConfig `yaml:"defaults"`
	Repos    []RepoEntry    `yaml:"repos"`
}

type ManifestAddResult struct {
	Added   []string
	Skipped []string
}

type ManifestEditConfig struct {
	Manifest     *Manifest
	ManifestPath string
	DryRun       bool
}

type ManifestRemoveResult struct {
	Removed []string
	Skipped []string
}

type MintConfig struct {
	URL     string `yaml:"url"`
	Project string `yaml:"project"`
	Region  string `yaml:"region"`
}

type MintDiscovery struct {
	URL             string
	RoleAppIDs      map[string]string
	PerRepoWIFRepos []string
}

type NullableString struct {
	Value string
	Set   bool
	Null  bool
}

type ProgressFunc func(repo, phase, message string)

type ProvisionerFactory func(cfg ResolvedConfig) WIFProvisioner

type RepoCandidate struct {
	Owner  string
	Repo   string
	Status string // "per-repo", "per-org", "new"
	Ref    string
}

type RepoEntry struct {
	Repo             string         `yaml:"repo"`
	InferenceProject NullableString `yaml:"inference_project,omitempty"`
	InferenceRegion  NullableString `yaml:"inference_region,omitempty"`
	FullsendRef      NullableString `yaml:"fullsend_ref,omitempty"`
	BaseHarness      NullableString `yaml:"base_harness,omitempty"`
}

type RepoSelectFunc func(candidates []RepoCandidate) ([]string, error)

type RepoState struct {
	Installed       bool
	MintURL         string
	InferenceRegion string
	FullsendRef     string
}

type RepoStatus struct {
	Owner           string  `json:"owner"`
	Repo            string  `json:"repo"`
	Installed       bool    `json:"installed"`
	CurrentRef      string  `json:"current_ref,omitempty"`
	ExpectedRef     string  `json:"expected_ref,omitempty"`
	MintURL         string  `json:"mint_url,omitempty"`
	ExpectedMintURL string  `json:"expected_mint_url,omitempty"`
	Region          string  `json:"region,omitempty"`
	ExpectedRegion  string  `json:"expected_region,omitempty"`
	Drifts          []Drift `json:"drifts,omitempty"`
	Error           string  `json:"error,omitempty"`
}

type ResolvedConfig struct {
	Owner                  string
	Repo                   string
	MintURL                string
	MintProject            string
	MintRegion             string
	InferenceProject       string
	InferenceRegion        string
	FullsendRef            string
	BaseHarness            string
	AllowedRemoteResources []string
}

type ResolvedRepo struct {
	Owner string
	Repo  string
	Entry RepoEntry
}

type ScaffoldCommitFunc func(ctx context.Context, owner, repo string,
	files []forge.TreeFile, direct bool) error

type StatusResult struct {
	Repos   []RepoStatus  `json:"repos"`
	Summary StatusSummary `json:"summary"`
}

type StatusSummary struct {
	Total        int `json:"total"`
	Installed    int `json:"installed"`
	NotInstalled int `json:"not_installed"`
	Drifted      int `json:"drifted"`
	Errored      int `json:"errored"`
}

type SyncResult struct {
	Applied  []Change `json:"applied"`
	Failed   int      `json:"failed,omitempty"`
	Warnings []string `json:"warnings,omitempty"`
}

type UninstallConfig struct {
	Manifest       *Manifest
	Repos          []string
	DryRun         bool
	SkipWIFCleanup bool
	MaxConcurrency int
}

type UninstallResult struct {
	Owner           string
	Repo            string
	Success         bool
	Error           error
	WorkflowDeleted bool
	VarsDeleted     int
	SecretsDeleted  int
	WIFDeregistered bool
}

type UpgradeConfig struct {
	Manifest       *Manifest
	RefOverride    string
	RepoFilter     []string
	DryRun         bool
	Force          bool
	Direct         bool
	MaxConcurrency int
}

type UpgradeResult struct {
	Owner      string
	Repo       string
	OldRef     string
	NewRef     string
	Upgraded   bool
	Skipped    bool
	SkipReason string
	Error      error
}

type WIFProvisioner interface {
	// DiscoverMint fetches mint infrastructure info (URL, role-to-app-ID
	// mappings, per-repo WIF repos). Returns an error wrapping
	// ErrMintNotFound if the mint function does not exist.
	DiscoverMint(ctx context.Context) (*MintDiscovery, error)

	// ProvisionWIF creates WIF infrastructure (service account, pool,
	// provider, principal binding) and returns the full WIF provider
	// resource name.
	ProvisionWIF(ctx context.Context) (string, error)

	// RegisterPerRepoWIF adds a repo to the mint's PER_REPO_WIF_REPOS
	// env var so the mint routes OIDC tokens for that repo to a dedicated
	// WIF provider.
	RegisterPerRepoWIF(ctx context.Context, repo string) error

	// EnsureOrgInMint validates that a mint function exists at expectedURL
	// and that the given org is registered in ALLOWED_ORGS.
	EnsureOrgInMint(ctx context.Context, expectedURL string, org string) error

	// DeletePerRepoWIF removes a repo from per-repo WIF registration.
	DeletePerRepoWIF(ctx context.Context, repo string) error

	// DeleteWIFProvider deletes the WIF provider for a repo from the
	// GCP project (used during uninstall to clean up IAM resources).
	DeleteWIFProvider(ctx context.Context, repo string) error
}