credential

type Entry struct {
	EnvVar   string // e.g., "GITHUB_TOKEN"
	Provider string // e.g., "github"
	Resource string // e.g., "readonly" (optional, after /)
	Raw      string // e.g., "{{kontext:github}}"
}

type InvalidPlaceholder struct {
	EnvVar string
	Value  string
}

type ManagedProvider struct {
	EnvVar         string
	Placeholder    string
	SeedOnFirstRun bool
}

type NoopProvider struct{}

type Provider interface {
	ResolveCredential(context.Context, Entry) (Resolved, error)
}

type ProviderFunc func(context.Context, Entry) (Resolved, error)

type Resolved struct {
	Entry
	Value string // The resolved credential value
}

type SyncResult struct {
	Created          bool
	Updated          bool
	Added            []ManagedProvider
	CollisionSkipped []ManagedProvider
	Template         *TemplateFile
}

type TemplateFile struct {
	Entries              []Entry
	ExistingValues       map[string]string
	InvalidPlaceholders  []InvalidPlaceholder
	SafeToMutate         bool
	MutationWarning      string
	HasManagedPlaceholds bool
}