connector

type Connector interface {
	// Provider returns the constant identifying this connector.
	Provider() Provider

	// Validate checks credentials without enumerating. Cheap —
	// should be a single auth call. Used by the tenant-admin UI
	// "Test Connection" button.
	Validate(ctx context.Context, creds Credentials) error

	// Discover enumerates assets for the tenant. Implementations
	// MUST honour ctx cancellation; partial results + errors are
	// acceptable and preferred over "all or nothing".
	Discover(ctx context.Context, tenantID shared.ID, creds Credentials) (*DiscoveryResult, error)
}

type Credentials struct {
	// AWS
	RoleARN    string
	ExternalID string
	Region     string

	// GCP
	ServiceAccountJSON string
	ProjectID          string

	// Azure
	TenantID       string
	ClientID       string
	ClientSecret   string
	SubscriptionID string

	// Kubernetes / git-host: provider-specific opaque tokens.
	Token     string
	APIURL    string
	Namespace string
}

type DiscoveredAsset struct {
	// ExternalID is the provider-native ID (EC2 instance id,
	// GCP resource name, k8s UID, etc). Used as the dedup key
	// alongside tenant + provider.
	ExternalID string
	Name       string
	Type       asset.AssetType
	// Properties carry everything provider-specific. Keys use
	// snake_case per the product's JSONB convention.
	Properties map[string]any
	// Tags from the provider (AWS tags, GCP labels, k8s labels).
	// Kept as a map so tag sources stay structured.
	Tags map[string]string
	// ObservedAt is the wall-clock time the connector read the
	// record. Used to compute inventory freshness.
	ObservedAt time.Time
}

type DiscoveryResult struct {
	Provider  Provider
	TenantID  shared.ID
	Assets    []DiscoveredAsset
	StartedAt time.Time
	EndedAt   time.Time
	Errors    []error // partial-success tolerated; each error names a specific SDK call site
}

type Provider string

type Registry struct {
	// contains filtered or unexported fields
}