domain

type Entry struct {
	// Name is the entry's identifier within its provider namespace.
	Name string
	// Value is the entry's current value.
	Value string
	// Type classifies the value in a provider-neutral way.
	Type ValueType
	// Version identifies the retrieved version.
	Version Version
	// Description is an optional human-readable description.
	Description string
	// Tags are the labels attached to the entry.
	Tags []Tag
	// Modified is the last-modified time, if known.
	Modified *time.Time
	// Extra holds provider-populated, display-only metadata (e.g. an AWS
	// Secrets Manager ARN). Its SHAPE is provider-neutral: a list of neutral
	// Field values, never AWS types or an untyped any. Providers may leave it
	// empty when they have no extra metadata to surface.
	Extra []Field
}

type Field struct {
	// Label is the human-facing field name (e.g. "ARN").
	Label string
	// Value is the pre-formatted display value.
	Value string
}

type Tag struct{ Key, Value string }

type TagChange struct {
	// Add holds tags to create or update, keyed by tag key.
	Add map[string]string
	// Remove holds tag keys to delete.
	Remove []string
}

type ValueType string

type Version struct {
	// ID is the provider-internal version identifier. It is opaque to callers:
	// they display it and hand it back to the same provider, never parse it.
	ID string
	// State is the per-version lifecycle state: "enabled" / "disabled" /
	// "destroyed", or "" when the provider has no such concept. It is a
	// per-version switch controlling whether that version's value can be read
	// (Google Cloud + Azure Key Vault); it is orthogonal to which version is
	// latest. Empty for AWS Secrets Manager, AWS SSM and Azure App Config.
	State string
	// Labels are the movable version labels attached to this version (all of
	// them, e.g. the AWS Secrets Manager staging labels AWSCURRENT /
	// AWSPREVIOUS). A label is a pointer naming a version, not a per-version
	// state. nil/empty for providers without version labels.
	Labels []string
	// Current reports whether this is the version the provider serves as the
	// current value. Adapters set it on History results (exactly one version of
	// a non-empty history); it is not populated on Get.
	Current bool
	// Created is the version creation time, if known.
	Created *time.Time
	// Tags are the labels attached to THIS version. Only Azure Key Vault scopes
	// tags per version (each version has its own); every other provider keeps
	// tags at the resource level (see Entry.Tags) and leaves this nil.
	Tags []Tag
}