apply

type OwnerBootstrapInput struct {
	// NodeName is the homelab firstnode identifier (used for synthetic
	// break-glass usernames and bundle filenames). Required.
	NodeName string

	// Hostname is the node's network hostname. Documentation-only field
	// embedded into the bundle so the recovery operator can match the
	// artifact to physical hardware. Defaults to NodeName when empty.
	Hostname string

	// PocketIDURL is the public origin of the PocketID instance, e.g.
	// "https://id.example.com". No trailing slash. Required.
	PocketIDURL string

	// PocketIDStaticAPIKey is the value rendered into the PocketID
	// container as STATIC_API_KEY (Task 12 will provision this via tfvars;
	// for now Run reads it from the caller). Required.
	PocketIDStaticAPIKey string

	// Owner is the daily-admin owner spec. Required.
	Owner identity.OwnerSpec

	// RecoveryPassphraseHash is the argon2id-PHC hash the operator chose
	// during init. Required. Run uses it to verify the operator types the
	// matching plaintext at bundle-encryption time (third factor).
	RecoveryPassphraseHash string

	// RecoveryPassphrasePlain is the plaintext passphrase, optional. When
	// set, Run skips the terminal prompt and verifies the value against
	// the hash directly. Empty value triggers the prompt.
	RecoveryPassphrasePlain string

	// BundleDir is where the .age and .txt bundle files get written.
	// Defaults to defaultBundleDir when empty.
	BundleDir string

	// TinyAuthEnvPath is the file the TinyAuth users env line is written
	// to. Defaults to defaultTinyAuthEnvPath when empty.
	TinyAuthEnvPath string

	// ClusterRole is mirrored into the bundle so the recovery operator
	// knows which role this node played. Defaults to "main" when empty.
	ClusterRole string

	// PocketIDClient is the optional injection point for tests. When nil,
	// Run constructs a real *pocketid.Client from PocketIDURL +
	// PocketIDStaticAPIKey.
	PocketIDClient pocketIDClientForBootstrap

	// TerminalPrompter overrides the third-factor passphrase prompt.
	// Production sets this to nil (uses ttyPassphrasePrompter); tests inject
	// a fake.
	TerminalPrompter PassphrasePrompter

	// Now is injectable for deterministic tests. Defaults to time.Now in
	// the bundle builder.
	Now func() time.Time
}

type OwnerBootstrapResult struct {
	// OwnerUserID is the PocketID-assigned UUID for the owner record.
	OwnerUserID string

	// OwnerSetupURL is the one-time-access link the owner clicks to enroll
	// a WebAuthn credential. Single-use; expires per identity.setupTokenTTL.
	OwnerSetupURL string

	// BreakGlass is the materialized Layer-1 recovery credential.
	BreakGlass *identity.BreakGlassCredential

	// TinyAuthStatic is the materialized Layer-2 recovery credential.
	TinyAuthStatic *identity.TinyAuthStaticCredential

	// BundlePaths are the on-disk locations of the encrypted (.age) and
	// plaintext (.txt) recovery files.
	BundlePaths *identity.BundlePaths
}

type PassphrasePrompter interface {
	// PromptAndVerify reads the recovery passphrase from the operator,
	// compares it against expectedHash via crypto.VerifyPassphrase, and
	// returns the raw plaintext on success. It must give the operator at
	// most attempts tries before erroring out — empty plaintext on success
	// is not allowed.
	PromptAndVerify(expectedHash string, attempts int) (plaintext string, err error)
}