pipeline

type AWSConfig struct {
	Region           string                 `mapstructure:"region" yaml:"region"`
	ExecutionContext ExecutionContextConfig `mapstructure:"execution_context" yaml:"execution_context"`
	ControlTower     ControlTowerConfig     `mapstructure:"control_tower" yaml:"control_tower"`
	Organizations    OrganizationsConfig    `mapstructure:"organizations" yaml:"organizations"`
	IdentityCenter   IdentityCenterConfig   `mapstructure:"identity_center" yaml:"identity_center"`

	// MaxRetries overrides the AWS SDK retry attempt count (0 = SDK default).
	MaxRetries int `mapstructure:"max_retries" yaml:"max_retries,omitempty"`
	// RetryMode selects the SDK retry strategy: "standard" or "adaptive".
	RetryMode string `mapstructure:"retry_mode" yaml:"retry_mode,omitempty"`
}

type AWSDetection struct {
	Available     bool
	Region        string
	AuthType      string // env, iam-role, profile, sso
	HasOrgsAccess bool   // Can we access Organizations API?
}

type AWSExecutionContext struct {
	Config           *AWSConfig
	BaseConfig       aws.Config
	CallerIdentity   *CallerIdentity
	OrganizationInfo *OrganizationInfo
	// contains filtered or unexported fields
}

type AWSRuntimeAuth struct {
	Region          string `json:"-" yaml:"-"`
	AccessKeyID     string `json:"-" yaml:"-"`
	SecretAccessKey string `json:"-" yaml:"-"`
	SessionToken    string `json:"-" yaml:"-"`
	RoleARN         string `json:"-" yaml:"-"`
	EndpointURL     string `json:"-" yaml:"-"`
}

type AWSSource struct {
	AccountID string            `mapstructure:"account_id" yaml:"account_id"`
	Region    string            `mapstructure:"region" yaml:"region"`
	Prefix    string            `mapstructure:"prefix" yaml:"prefix"`
	Tags      map[string]string `mapstructure:"tags" yaml:"tags"`
}

type AccountFactoryConfig struct {
	Enabled           bool `mapstructure:"enabled" yaml:"enabled"`
	OnAccountCreation bool `mapstructure:"on_account_creation" yaml:"on_account_creation"`
	AFTIntegration    bool `mapstructure:"aft_integration" yaml:"aft_integration"`
}

type AccountInfo struct {
	ID     string
	Name   string
	Email  string
	Status string
	Tags   map[string]string
}

type AccountNamePattern struct {
	// Pattern is a regex pattern to match against normalized account names
	Pattern string `mapstructure:"pattern" yaml:"pattern"`
	// Target is the target name to use when pattern matches
	Target string `mapstructure:"target" yaml:"target"`
}

type AccountsListDiscovery struct {
	Source string `mapstructure:"source" yaml:"source"`
}

type AppRoleAuth struct {
	Mount    string `mapstructure:"mount" yaml:"mount"`
	RoleID   string `mapstructure:"role_id" yaml:"role_id"`
	SecretID string `mapstructure:"secret_id" yaml:"secret_id"`
}

type AuditConfig struct {
	// File is a local path to append JSONL audit entries to.
	File string `mapstructure:"file" yaml:"file,omitempty"`
	// S3Bucket/S3Prefix write one immutable object per entry to S3.
	S3Bucket string `mapstructure:"s3_bucket" yaml:"s3_bucket,omitempty"`
	S3Prefix string `mapstructure:"s3_prefix" yaml:"s3_prefix,omitempty"`
	// CloudWatchGroup/CloudWatchStream write entries as CloudWatch log events.
	CloudWatchGroup  string `mapstructure:"cloudwatch_group" yaml:"cloudwatch_group,omitempty"`
	CloudWatchStream string `mapstructure:"cloudwatch_stream" yaml:"cloudwatch_stream,omitempty"`
}

type AuthProviders struct {
	VaultAvailable bool
	VaultMethod    string // token, approle, kubernetes
	AWSAvailable   bool
	AWSMethod      string // env, iam_role, profile
}

type CallerIdentity struct {
	AccountID string
	ARN       string
	UserID    string
}

type Config struct {
	Log            LogConfig                `mapstructure:"log" yaml:"log"`
	Vault          VaultConfig              `mapstructure:"vault" yaml:"vault"`
	AWS            AWSConfig                `mapstructure:"aws" yaml:"aws"`
	Sources        map[string]Source        `mapstructure:"sources" yaml:"sources"`
	MergeStore     MergeStoreConfig         `mapstructure:"merge_store" yaml:"merge_store"`
	Targets        map[string]Target        `mapstructure:"targets" yaml:"targets"`
	DynamicTargets map[string]DynamicTarget `mapstructure:"dynamic_targets" yaml:"dynamic_targets"`
	Pipeline       PipelineSettings         `mapstructure:"pipeline" yaml:"pipeline"`
	Observability  ObservabilityConfig      `mapstructure:"observability" yaml:"observability,omitempty"`
	Policy         policy.Config            `mapstructure:"policy" yaml:"policy,omitempty"`
	Audit          AuditConfig              `mapstructure:"audit" yaml:"audit,omitempty"`
}

type ControlTowerConfig struct {
	Enabled        bool                 `mapstructure:"enabled" yaml:"enabled"`
	ExecutionRole  ExecutionRoleConfig  `mapstructure:"execution_role" yaml:"execution_role"`
	AccountFactory AccountFactoryConfig `mapstructure:"account_factory" yaml:"account_factory"`
}

type DelegationConfig struct {
	Services []string `mapstructure:"services" yaml:"services"`
}

type DetectedClients struct {
	// Vault client availability
	Vault VaultDetection
	// AWS client availability
	AWS AWSDetection
}

type DiscoveryConfig struct {
	IdentityCenter *IdentityCenterDiscovery `mapstructure:"identity_center" yaml:"identity_center"`
	Organizations  *OrganizationsDiscovery  `mapstructure:"organizations" yaml:"organizations"`
	AccountsList   *AccountsListDiscovery   `mapstructure:"accounts_list" yaml:"accounts_list"`
}

type DiscoveryService struct {
	// contains filtered or unexported fields
}

type DynamicTarget struct {
	Discovery DiscoveryConfig `mapstructure:"discovery" yaml:"discovery"`
	Imports   []string        `mapstructure:"imports" yaml:"imports"`
	Exclude   []string        `mapstructure:"exclude" yaml:"exclude"`

	// AccountNamePatterns maps discovered accounts to specific targets using regex
	AccountNamePatterns []AccountNamePattern `mapstructure:"account_name_patterns" yaml:"account_name_patterns"`

	Region       string `mapstructure:"region" yaml:"region"`
	SecretPrefix string `mapstructure:"secret_prefix" yaml:"secret_prefix"`
	RoleARN      string `mapstructure:"role_arn" yaml:"role_arn"`
}

type EncryptionConfig struct {
	Enabled bool `mapstructure:"enabled" yaml:"enabled"`
	// KMSKeyID enables KMS envelope encryption with the given key.
	KMSKeyID string `mapstructure:"kms_key_id" yaml:"kms_key_id,omitempty"`
	// KeyEnv names an environment variable holding a base64-encoded 32-byte
	// AES-256 key for user-supplied (static) key encryption.
	KeyEnv string `mapstructure:"key_env" yaml:"key_env,omitempty"`
	// PostQuantumSeedEnv names an environment variable holding a base64-encoded
	// ML-KEM-768 decapsulation-key seed for quantum-resistant encryption.
	PostQuantumSeedEnv string `mapstructure:"post_quantum_seed_env" yaml:"post_quantum_seed_env,omitempty"`
}

type ExecutionContextConfig struct {
	Type              ExecutionContextType `mapstructure:"type" yaml:"type"`
	AccountID         string               `mapstructure:"account_id" yaml:"account_id"`
	Delegation        *DelegationConfig    `mapstructure:"delegation" yaml:"delegation"`
	CustomRolePattern string               `mapstructure:"custom_role_pattern" yaml:"custom_role_pattern"`
}

type ExecutionContextType string

type ExecutionRoleConfig struct {
	Name string `mapstructure:"name" yaml:"name"`
	Path string `mapstructure:"path" yaml:"path"`
}

type Graph struct {
	Nodes map[string]*Node
}

type IdentityCenterConfig struct {
	Enabled         bool   `mapstructure:"enabled" yaml:"enabled"`
	AutoDiscover    bool   `mapstructure:"auto_discover" yaml:"auto_discover"`
	InstanceARN     string `mapstructure:"instance_arn" yaml:"instance_arn"`
	IdentityStoreID string `mapstructure:"identity_store_id" yaml:"identity_store_id"`
}

type IdentityCenterDiscovery struct {
	Group         string `mapstructure:"group" yaml:"group"`
	PermissionSet string `mapstructure:"permission_set" yaml:"permission_set"`
}

type KubernetesAuth struct {
	Role      string `mapstructure:"role" yaml:"role"`
	MountPath string `mapstructure:"mount_path" yaml:"mount_path"`
}

type LogConfig struct {
	Level  string `mapstructure:"level" yaml:"level"`
	Format string `mapstructure:"format" yaml:"format"`
}

type MatchConfidence string

type MergeRequest struct {
	// Sources in priority order (later sources override earlier on conflict)
	Sources []string

	// Target name (for organizational purposes)
	Target string

	// DryRun if true, don't actually write
	DryRun bool
}

type MergeSettings struct {
	Parallel int `mapstructure:"parallel" yaml:"parallel"`
}

type MergeStoreConfig struct {
	Vault *MergeStoreVault `mapstructure:"vault" yaml:"vault"`
	S3    *MergeStoreS3    `mapstructure:"s3" yaml:"s3"`
}

type MergeStoreS3 struct {
	Bucket   string `mapstructure:"bucket" yaml:"bucket"`
	Prefix   string `mapstructure:"prefix" yaml:"prefix"`
	KMSKeyID string `mapstructure:"kms_key_id" yaml:"kms_key_id"`

	// Encryption configures optional client-side envelope encryption of bundles
	// (zero-knowledge mode) — distinct from KMSKeyID's server-side SSE-KMS.
	Encryption *EncryptionConfig `mapstructure:"encryption" yaml:"encryption,omitempty"`

	// ReplicaRegions replicates every merged bundle to the same bucket name in
	// each listed region for cross-region durability and read-locality. A
	// regionally-named bucket per region is assumed (bucket + "-" + region) when
	// ReplicaBucketPattern is empty.
	ReplicaRegions []string `mapstructure:"replica_regions" yaml:"replica_regions,omitempty"`
	// RequireAllReplicas fails a write if any replica write fails (default:
	// best-effort, primary success is enough).
	RequireAllReplicas bool `mapstructure:"require_all_replicas" yaml:"require_all_replicas,omitempty"`

	// Version management
	Versioning *VersioningConfig `mapstructure:"versioning" yaml:"versioning"`
}

type MergeStoreVault struct {
	Mount string `mapstructure:"mount" yaml:"mount"`
}

type NameMatcher struct {
	// contains filtered or unexported fields
}

type NameMatchingConfig struct {
	// Strategy: "exact", "fuzzy", or "loose" (default: "exact")
	// - exact: names must match exactly (case-insensitive by default)
	// - fuzzy: partial substring matching with normalization
	// - loose: most permissive, applies all normalizations
	Strategy string `mapstructure:"strategy" yaml:"strategy"`

	// NormalizeKeys: apply JSON key normalization (default: false)
	// Converts underscores to hyphens, removes special chars
	NormalizeKeys bool `mapstructure:"normalize_keys" yaml:"normalize_keys"`

	// CaseInsensitive: case-insensitive matching (default: true)
	CaseInsensitive bool `mapstructure:"case_insensitive" yaml:"case_insensitive"`

	// StripPrefixes: prefixes to remove before matching
	// Common values: ["aws-", "fsc-", "org-"]
	StripPrefixes []string `mapstructure:"strip_prefixes" yaml:"strip_prefixes"`

	// StripSuffixes: suffixes to remove before matching
	// Common values: ["-account", "-acct"]
	StripSuffixes []string `mapstructure:"strip_suffixes" yaml:"strip_suffixes"`
}

type Node struct {
	Name       string
	Type       NodeType
	Level      int      // Dependency depth (0 = no dependencies)
	Deps       []string // Nodes this depends on
	DependedBy []string // Nodes that depend on this
}

type NodeType int

type OUConfig struct {
	ID       string              `mapstructure:"id" yaml:"id"`
	Accounts []string            `mapstructure:"accounts" yaml:"accounts"`
	Children map[string]OUConfig `mapstructure:"children" yaml:"children"`
}

type ObservabilityConfig struct {
	Tracing       observability.TracingConfig        `mapstructure:"tracing" yaml:"tracing,omitempty"`
	CustomMetrics []observability.CustomMetricConfig `mapstructure:"custom_metrics" yaml:"custom_metrics,omitempty"`
}

type Operation string

type Options struct {
	Operation       Operation
	Targets         []string
	DryRun          bool
	ContinueOnError bool
	Parallelism     int
	ComputeDiff     bool
	OutputFormat    diff.OutputFormat
}

type OrganizationInfo struct {
	ID                  string
	MasterAccountID     string
	MasterAccountARN    string
	IsManagementAccount bool
	IsDelegatedAdmin    bool
	DelegatedServices   []string
}

type OrganizationsConfig struct {
	AutoDiscover bool                `mapstructure:"auto_discover" yaml:"auto_discover"`
	RootID       string              `mapstructure:"root_id" yaml:"root_id"`
	OUs          map[string]OUConfig `mapstructure:"ous" yaml:"ous"`
}

type OrganizationsDiscovery struct {
	Tags         map[string][]string `mapstructure:"tags" yaml:"tags"`
	Recursive    bool                `mapstructure:"recursive" yaml:"recursive"`
	NameMatching *NameMatchingConfig `mapstructure:"name_matching" yaml:"name_matching"`

	OUs              []string    `mapstructure:"ous" yaml:"ous"`
	TagFilters       []TagFilter `mapstructure:"tag_filters" yaml:"tag_filters"`
	TagCombination   string      `mapstructure:"tag_combination" yaml:"tag_combination"`       // "AND" or "OR", default "AND"
	ExcludeStatuses  []string    `mapstructure:"exclude_statuses" yaml:"exclude_statuses"`     // e.g., ["SUSPENDED", "CLOSED"]
	CacheOUStructure bool        `mapstructure:"cache_ou_structure" yaml:"cache_ou_structure"` // Cache OU hierarchy
}

type Pipeline struct {
	// contains filtered or unexported fields
}

type PipelineRequest struct {
	// Sources in priority order for merge
	Sources []string

	// Targets to sync the merged bundle to
	Targets []string

	// DryRun if true, don't actually write
	DryRun bool
}

type PipelineSettings struct {
	Merge           MergeSettings  `mapstructure:"merge" yaml:"merge"`
	Sync            SyncSettings   `mapstructure:"sync" yaml:"sync"`
	Rollback        RollbackConfig `mapstructure:"rollback" yaml:"rollback,omitempty"`
	DryRun          bool           `mapstructure:"dry_run" yaml:"dry_run"`
	ContinueOnError bool           `mapstructure:"continue_on_error" yaml:"continue_on_error"`
}

type ReplicatingBundleStore struct {

	// RequireAllReplicas, when true, fails a write if any replica write fails.
	// When false (default), replica failures are logged and the write succeeds
	// as long as the primary write succeeds.
	RequireAllReplicas bool
	// contains filtered or unexported fields
}

type ResolvedResource struct {
	// OriginalName is the name as provided by the user
	OriginalName string
	// ResolvedName is the normalized/matched name
	ResolvedName string
	// Type indicates whether this is an AWS account or Vault mount
	Type ResourceType
	// AccountID is set if Type is ResourceTypeAWSAccount
	AccountID string
	// VaultMount is set if Type is ResourceTypeVaultMount
	VaultMount string
	// MatchConfidence indicates how the match was made
	MatchConfidence MatchConfidence
}

type ResourceResolver struct {
	// contains filtered or unexported fields
}

type ResourceType string

type Result struct {
	Target    string           `json:"target"`
	Phase     string           `json:"phase"`
	Operation string           `json:"operation"`
	Success   bool             `json:"success"`
	Error     error            `json:"error,omitempty"`
	Duration  time.Duration    `json:"duration"`
	Details   ResultDetails    `json:"details,omitempty"`
	Diff      *diff.TargetDiff `json:"diff,omitempty"`
}

type ResultDetails struct {
	SecretsProcessed int      `json:"secrets_processed,omitempty"`
	SecretsAdded     int      `json:"secrets_added,omitempty"`
	SecretsModified  int      `json:"secrets_modified,omitempty"`
	SecretsRemoved   int      `json:"secrets_removed,omitempty"`
	SecretsUnchanged int      `json:"secrets_unchanged,omitempty"`
	SourcePaths      []string `json:"source_paths,omitempty"`
	DestinationPath  string   `json:"destination_path,omitempty"`
	RoleARN          string   `json:"role_arn,omitempty"`
	FailedImports    []string `json:"failed_imports,omitempty"`
	Message          string   `json:"message,omitempty"`
}

type RollbackConfig struct {
	// Enabled turns on pre-sync snapshotting and post-failure restore.
	Enabled bool `mapstructure:"enabled" yaml:"enabled"`
	// MaxSecrets is a safety cap: rollback is skipped (and the failure left as-is
	// with a clear error) if the target holds more than this many secrets, to
	// avoid a large unintended restore. 0 means no cap.
	MaxSecrets int `mapstructure:"max_secrets" yaml:"max_secrets,omitempty"`
}

type RuntimeAuth struct {
	DelegateAuth bool              `json:"-" yaml:"-"`
	Vault        *VaultRuntimeAuth `json:"-" yaml:"-"`
	AWS          *AWSRuntimeAuth   `json:"-" yaml:"-"`
}

type S3MergeStore struct {
	Bucket   string
	Prefix   string
	KMSKeyID string
	Region   string

	// Version management
	VersioningEnabled bool
	RetainVersions    int

	// Cipher, when set, performs client-side envelope encryption of bundle
	// bodies before upload (zero-knowledge mode) — S3 never sees plaintext.
	// This is independent of the server-side KMSKeyID (SSE-KMS) field.
	Cipher crypto.Cipher
	// contains filtered or unexported fields
}

type SecretVersion struct {
	Path      string                 `json:"path"`
	Version   int                    `json:"version"`
	Data      map[string]interface{} `json:"data"`
	Timestamp time.Time              `json:"timestamp"`
	Hash      string                 `json:"hash,omitempty"`
}

type Source struct {
	Vault *VaultSource `mapstructure:"vault" yaml:"vault"`
	AWS   *AWSSource   `mapstructure:"aws" yaml:"aws"`
}

type SyncRequest struct {
	// BundlePath is the merge store path containing the merged secrets
	BundlePath string

	// Targets to sync to (account IDs or target names)
	Targets []string

	// DryRun if true, don't actually write
	DryRun bool
}

type SyncSettings struct {
	Parallel      int  `mapstructure:"parallel" yaml:"parallel"`
	DeleteOrphans bool `mapstructure:"delete_orphans" yaml:"delete_orphans"`
}

type TagFilter struct {
	Key      string   `mapstructure:"key" yaml:"key"`
	Values   []string `mapstructure:"values" yaml:"values"`
	Operator string   `mapstructure:"operator" yaml:"operator"` // "equals", "contains", "wildcard", default "equals"
}

type Target struct {
	AccountID    string   `mapstructure:"account_id" yaml:"account_id"`
	Imports      []string `mapstructure:"imports" yaml:"imports"`
	Region       string   `mapstructure:"region" yaml:"region"`
	SecretPrefix string   `mapstructure:"secret_prefix" yaml:"secret_prefix"`
	RoleARN      string   `mapstructure:"role_arn" yaml:"role_arn"`

	// Backend selects the sync destination driver. When unset it defaults to
	// AWS Secrets Manager, preserving the historical AWS-only behavior. Set it
	// to route a target to Azure, GCP, Kubernetes, HTTP, or Vault instead.
	Backend *TargetBackendConfig `mapstructure:"backend" yaml:"backend,omitempty"`

	// Tags are arbitrary key/value labels on the target, usable by conditional
	// sync rules.
	Tags map[string]string `mapstructure:"tags" yaml:"tags,omitempty"`

	// Conditions gate whether this target syncs (environment, tag, time-window).
	// When unset the target always syncs.
	Conditions *condition.Config `mapstructure:"conditions" yaml:"conditions,omitempty"`
}

type TargetBackendConfig struct {
	Driver  string         `mapstructure:"driver" yaml:"driver"`
	Path    string         `mapstructure:"path" yaml:"path,omitempty"`
	Options map[string]any `mapstructure:"options" yaml:"options,omitempty"`
}

type TokenAuth struct {
	Token string `mapstructure:"token" yaml:"token"`
}

type VaultAuthConfig struct {
	AppRole    *AppRoleAuth    `mapstructure:"approle" yaml:"approle"`
	Token      *TokenAuth      `mapstructure:"token" yaml:"token"`
	Kubernetes *KubernetesAuth `mapstructure:"kubernetes" yaml:"kubernetes"`
}

type VaultConfig struct {
	Address   string          `mapstructure:"address" yaml:"address"`
	Namespace string          `mapstructure:"namespace" yaml:"namespace"`
	Auth      VaultAuthConfig `mapstructure:"auth" yaml:"auth"`

	// Traversal configuration for recursive secret listing
	// These settings control memory usage and performance during large Vault traversals
	MaxTraversalDepth        int `mapstructure:"max_traversal_depth" yaml:"max_traversal_depth,omitempty"`
	MaxSecretsPerMount       int `mapstructure:"max_secrets_per_mount" yaml:"max_secrets_per_mount,omitempty"`
	QueueCompactionThreshold int `mapstructure:"queue_compaction_threshold" yaml:"queue_compaction_threshold,omitempty"`
}

type VaultDetection struct {
	Available bool
	Address   string
	AuthType  string // token, approle, kubernetes, aws-iam
}

type VaultRuntimeAuth struct {
	Address   string `json:"-" yaml:"-"`
	Namespace string `json:"-" yaml:"-"`
	Token     string `json:"-" yaml:"-"`
}

type VaultSource struct {
	Address   string   `mapstructure:"address" yaml:"address"`
	Namespace string   `mapstructure:"namespace" yaml:"namespace"`
	Mount     string   `mapstructure:"mount" yaml:"mount"`
	Paths     []string `mapstructure:"paths" yaml:"paths"`

	// Traversal configuration for recursive secret listing
	// These settings control memory usage and performance during large Vault traversals
	MaxTraversalDepth        int `mapstructure:"max_traversal_depth" yaml:"max_traversal_depth,omitempty"`
	MaxSecretsPerMount       int `mapstructure:"max_secrets_per_mount" yaml:"max_secrets_per_mount,omitempty"`
	QueueCompactionThreshold int `mapstructure:"queue_compaction_threshold" yaml:"queue_compaction_threshold,omitempty"`
}

type VersionStore interface {
	GetVersion(ctx context.Context, path string, version int) (*SecretVersion, error)
	ListVersions(ctx context.Context, path string) ([]SecretVersion, error)
	GetLatest(ctx context.Context, path string) (*SecretVersion, error)
	StoreVersion(ctx context.Context, secret *SecretVersion) error
}

type VersioningConfig struct {
	Enabled        bool `mapstructure:"enabled" yaml:"enabled"`
	RetainVersions int  `mapstructure:"retain_versions" yaml:"retain_versions"`
}