data

type ApplyEntryResult struct {
	Name      string
	Namespace string
	// Status is "created" / "updated" / "deleted" / "failed".
	Status string
	// Error is the cloud-write failure (empty on success).
	Error string
	// UnstageError is set when the cloud write succeeded but the entry could not
	// be cleared from staging afterwards — the page must always surface it.
	UnstageError string
}

type ApplyTagResult struct {
	Name         string
	Namespace    string
	Adds         []Tag
	Removes      []string
	Error        string
	UnstageError string
}

type Detail struct {
	Name  string
	Value string
	// Secret reports whether Value must be masked by default.
	Secret bool
	// Meta are the capability-gated metadata rows (version/type/dates/etc.),
	// pre-built so the pane renders them verbatim.
	Meta []MetaRow
	// State is the per-version lifecycle state (Google Cloud / Azure Key Vault),
	// empty when the version carries staging labels instead.
	State string
	// StagingLabels are the AWS staging labels of the current version, empty when
	// the version carries a State instead. Never infer one from the other (#419).
	StagingLabels []string
	Description   string
	Tags          []Tag
	Namespace     string
	// TypeLabel is the entry's display value type (e.g. "SecureString"), so the
	// edit dialog can preserve the type on an update. Empty for services with no
	// value type (secret, App Configuration).
	TypeLabel string
	// ARN is the Secrets Manager ARN surfaced from the entry's Extra metadata,
	// empty for providers that expose none.
	ARN string
}

type DiffContent struct {
	OldLabel string
	NewLabel string
	OldValue string
	NewValue string
	// Secret reports whether the two values are secrets and must be masked before
	// diffing, so a secret diff never renders a revealed value. The source is the
	// authority on secret-ness (the browser's OpenDiff carries no such flag).
	Secret bool
}

type HistoryRow struct {
	// Version is the raw provider version identifier used to re-fetch/diff (a
	// numeric string for param, a version id for secret).
	Version string
	// Label is the display form ("#14" for param, a shortened id for secret).
	Label string
	// Date is the pre-formatted creation/modification date, empty when unknown.
	Date          string
	IsCurrent     bool
	State         string
	StagingLabels []string
	// Value is this version's raw value, fetched alongside the metadata so the
	// history can show what the value was at each revision (GUI parity). Empty when
	// the value could not be fetched. It is masked in the UI when Secret is set.
	Value string
	// Secret reports whether Value is secret material and must be masked by default
	// (a secret-service value, or a SecureString param value).
	Secret bool
	// Tags are this version's tags (Azure Key Vault per-version tags only).
	Tags []Tag
}

type Item struct {
	Name string
	// Value is the entry's value when the list was loaded WithValue; nil otherwise.
	Value *string
	// TypeLabel is the display value type (e.g. "SecureString"); empty when the
	// provider has no value type or the value was not fetched.
	TypeLabel string
	// Secret reports whether the value must be masked in the UI.
	Secret bool
	// Namespace is the entry's Azure App Configuration namespace (empty for the
	// null namespace and every other provider).
	Namespace string
}

type ListParams struct {
	Prefix    string
	Filter    string
	Recursive bool
	WithValue bool
	// Namespace filters an Azure App Configuration listing. Empty means the null
	// namespace, aznamespace.AllNamespacesFilter ("*") means every namespace, and
	// any other value is a single concrete namespace. Ignored for other providers.
	Namespace string
}

type ListResult struct {
	Items []Item
	// NextToken is the secret-service paging cursor; empty when there are no more
	// pages (every provider today lists all names, so it is always empty, but the
	// field keeps the load-more wiring honest).
	NextToken string
}

type MetaRow struct {
	Label string
	Value string
}

type Mutator interface {
	// Capability returns the service capability so a dialog can gate its controls
	// (mode toggle, type select, force/recovery rows, restore).
	Capability() capability.ServiceCapability
	// Create stages or applies a create for a new entry. typeLabel is the SSM type
	// display name for a typed param service (ignored elsewhere).
	Create(ctx context.Context, key StagedKey, value, typeLabel, description string, staged bool) (WriteOutcome, error)
	// Update stages or applies an update to an existing entry.
	Update(ctx context.Context, key StagedKey, value, typeLabel, description string, staged bool) (WriteOutcome, error)
	// Delete stages or applies a delete. force/recoveryWindow apply only to a
	// service with HasForceDelete/HasRecoveryWindow (AWS secret).
	Delete(ctx context.Context, key StagedKey, force bool, recoveryWindow int, staged bool) (WriteOutcome, error)
	// AddTag stages or applies a tag add/update.
	AddTag(ctx context.Context, key StagedKey, tagKey, tagValue string, staged bool) (WriteOutcome, error)
	// RemoveTag stages or applies a tag removal.
	RemoveTag(ctx context.Context, key StagedKey, tagKey string, staged bool) (WriteOutcome, error)
	// Restore applies an immediate restore of a soft-deleted entry (there is no
	// staged restore); it errors when the provider offers none.
	Restore(ctx context.Context, name string) (WriteOutcome, error)
}

type Source interface {
	// Capability returns the service's capability descriptor so a page can gate
	// its controls (history, namespaces, tags-per-version, …).
	Capability() capability.ServiceCapability
	// List returns the entries matching params.
	List(ctx context.Context, params ListParams) (ListResult, error)
	// Show returns the current-version detail of name (namespace applies only to
	// Azure App Configuration).
	Show(ctx context.Context, name, namespace string) (Detail, error)
	// History returns name's version history (empty when the service is
	// unversioned).
	History(ctx context.Context, name, namespace string) ([]HistoryRow, error)
	// VersionContents fetches the two versions' raw values for a diff.
	VersionContents(ctx context.Context, name, oldVersion, newVersion, namespace string) (DiffContent, error)
	// Namespaces lists the discovered Azure App Configuration namespaces (nil for
	// every other provider), so the header can offer them in its filter.
	Namespaces(ctx context.Context) ([]string, error)
}

type StagedDiffRow struct {
	Name        string
	Namespace   string
	Type        StagedDiffType
	Operation   string // "create" / "update" / "delete"
	RemoteValue string
	StagedValue string
	Warning     string
	// Secret reports whether this row's values are secret material (a secret
	// service, or a SecureString param), so the page masks them per-row rather
	// than keying off the section's service axis alone (#677).
	Secret bool
}

type StagedDiffType int

type StagedKey struct {
	Name      string
	Namespace string
}

type StagedTagRow struct {
	Name      string
	Namespace string
	// Adds are the staged tag adds/updates (key=value).
	Adds []Tag
	// Removes are the staged tag removals: the tag key plus the current remote
	// value (empty when unknown), so the row reads "−key (was value)".
	Removes []TagRemoval
}

type StagingApplyResult struct {
	// ServiceLabel is the service's display name for the results header.
	ServiceLabel string
	Entries      []ApplyEntryResult
	Tags         []ApplyTagResult
	// Conflicts are the labels of entries rejected because remote changed after
	// staging (empty unless conflict detection tripped).
	Conflicts []string
}

type StagingProbe interface {
	// Staged returns the staged snapshot (badge keys, delete-staged subset, and
	// entry/tag counts) for the service.
	Staged(ctx context.Context) (StagingSnapshot, error)
}

type StagingResetResult struct {
	Type         StagingResetType
	Count        int
	ServiceLabel string
}

type StagingResetType int

type StagingResolver func(ctx context.Context) (StagingResources, error)

type StagingResources struct {
	Store    store.ReadWriteOperator
	Strategy staging.FullStrategy
	// StrategyFor resolves a per-namespace strategy for Azure App Configuration,
	// whose settings share one staging store across namespaces; nil for every
	// other provider/service (the single Strategy handles all).
	StrategyFor func(namespace string) (staging.FullStrategy, error)
}

type StagingReview struct {
	Entries []StagedDiffRow
	Tags    []StagedTagRow
}

type StagingService interface {
	// Service is the internal key ("param" / "secret").
	Service() string
	// Label is the display name for the section/results header (e.g. "Key Vault").
	Label() string
	// Capability gates the section's controls.
	Capability() capability.ServiceCapability
	// Review returns the staged entries (as diffs) and tag changes; it may
	// auto-unstage entries whose staged value now equals remote.
	Review(ctx context.Context) (StagingReview, error)
	// Apply applies the service's staged changes. A conflict rejection or a
	// per-entry failure returns a POPULATED result (the detail is in its fields),
	// not an error; only a hard store failure returns a non-nil error.
	Apply(ctx context.Context, ignoreConflicts bool) (StagingApplyResult, error)
	// Reset unstages every staged change for the service.
	Reset(ctx context.Context) (StagingResetResult, error)
	// Unstage removes one item's staged entry and its staged tags.
	Unstage(ctx context.Context, key StagedKey) error
	// CancelAddTag drops one staged tag add.
	CancelAddTag(ctx context.Context, key StagedKey, tagKey string) error
	// CancelRemoveTag drops one staged tag removal.
	CancelRemoveTag(ctx context.Context, key StagedKey, tagKey string) error
}

type StagingSnapshot struct {
	Keys       map[StagedKey]struct{}
	DeleteKeys map[StagedKey]struct{}
	EntryKeys  map[StagedKey]struct{}
	TagKeys    map[StagedKey]struct{}
	EntryCount int
	TagCount   int
}

type StagingStoreResolver func() (store.ReadWriteOperator, error)

type StoreResolver func(ctx context.Context, namespace string) (provider.Store, error)

type StoreUnavailableError struct{ Err error }

type StrategyBuilder func(store provider.Store) staging.FullStrategy

type Tag struct {
	Key   string
	Value string
}

type TagRemoval struct {
	Key   string
	Value string
}

type WriteOutcome struct {
	Skipped  bool
	Unstaged bool
	Updated  bool
}