capability

type ProviderCapability struct {
	// Provider is the internal key ("aws" | "googlecloud" | "azure").
	Provider string `json:"provider"`
	// DisplayName is the provider label (e.g. "Google Cloud").
	DisplayName string `json:"displayName"`
	// ScopeFields lists the scope inputs the frontend collects in its scope form
	// (["project"] for Google Cloud; the vault, store and namespace for Azure).
	// Empty for AWS, which reads its scope from the ambient config, so there is
	// no scope to change.
	ScopeFields []string `json:"scopeFields"`
	// Services are the param/secret services this provider offers, in stable
	// display order.
	Services []ServiceCapability `json:"services"`
}

type ServiceCapability struct {
	// Service is the internal key ("param" or "secret").
	Service string `json:"service"`
	// DisplayName is the label shown in the UI (e.g. "Key Vault"). It matches
	// the staging strategy's ServiceName, so the CLI staging output agrees.
	DisplayName string `json:"displayName"`
	// ItemNoun names one item of the service in prompts and titles
	// ("parameter", "setting", "secret"). It matches the staging strategy's
	// ItemName, so staged and direct wording agree.
	ItemNoun string `json:"itemNoun"`
	// HasVersionHistory is true when `log`/history is supported (false for the
	// unversioned Azure App Configuration).
	HasVersionHistory bool `json:"hasVersionHistory"`
	// HasVersionSpecifiers is true when #VERSION/~SHIFT specifiers apply.
	HasVersionSpecifiers bool `json:"hasVersionSpecifiers"`
	// HasTags is true when tag/label read+write is supported.
	HasTags bool `json:"hasTags"`
	// TagsPerVersion is true when tags are scoped to a specific version rather
	// than the resource (Azure Key Vault only): each version has its own tags,
	// so the frontend shows them per version in the history and writes target the
	// latest version. Every other provider keeps tags at the resource level.
	TagsPerVersion bool `json:"tagsPerVersion"`
	// HasRestore is true when a soft-deleted item can be restored (AWS Secrets
	// Manager and Azure Key Vault).
	HasRestore bool `json:"hasRestore"`
	// HasStaging is true when the frontend's staging workflow applies to this
	// service (every provider service today); the frontend hides the staging
	// tab/banner/checkbox when false.
	HasStaging bool `json:"hasStaging"`
	// HasNamespaces is true when the service partitions keys by a namespace (the
	// Azure App Configuration label axis, #431). The frontend shows the namespace
	// column/badge and the create-form namespace field only when true.
	HasNamespaces bool `json:"hasNamespaces"`
	// HasForceDelete is true when an immediate (no-recovery-window) delete is
	// offered (AWS Secrets Manager only). The frontend hides the force-delete
	// checkbox otherwise.
	HasForceDelete bool `json:"hasForceDelete"`
	// HasRecoveryWindow is true when a soft delete schedules a recovery window
	// whose end date can be surfaced (AWS Secrets Manager only). Other providers
	// delete immediately or govern retention by policy, so no "recoverable until"
	// date is shown.
	HasRecoveryWindow bool `json:"hasRecoveryWindow"`
	// HasDescription is true when a write carries a free-text description: AWS
	// Parameter Store + Secrets Manager (native) and Google Cloud Secret Manager
	// (stored as the "description" secret annotation). The Azure Key Vault and
	// App Configuration writers have no description concept (only tags), so the
	// frontend hides the description field for them and the staged CLI does not
	// register a --description flag.
	HasDescription bool `json:"hasDescription"`
	// HasValueType is true when a value carries a selectable type (AWS
	// Parameter Store's String/SecureString/StringList). The frontends show the
	// type selector only when true, and the GUI returns no type options otherwise.
	HasValueType bool `json:"hasValueType"`
	// HasRecursiveList is true when names form a '/'-separated hierarchy and a
	// list can switch between the immediate children of a prefix and its whole
	// subtree (AWS Parameter Store's --recursive). The frontends show the
	// recursive toggle only when true; elsewhere a list always matches the
	// whole subtree.
	HasRecursiveList bool `json:"hasRecursiveList"`
	// ScopeField names the provider scope field (one of the provider's
	// ScopeFields) that must be set for this service to be available, or ""
	// when the ambient scope always offers it (AWS). Google Cloud Secret
	// Manager needs "project". Azure's two services are separate resources:
	// App Configuration needs "store", Key Vault "vault". A scope is complete
	// when at least one of its provider's services is available.
	ScopeField string `json:"scopeField"`
	// NativeTagName is what the cloud itself calls suve's tags, shown as a
	// secondary hint next to "Tags" (Google Cloud Secret Manager: "labels").
	// Empty when the cloud also says tags.
	NativeTagName string `json:"nativeTagName"`
}