ports

type CapabilityAnalyzer interface {
	ExtractCapabilities(profile entities.ProfileReader) map[string][]capabilities.Capability
}

type CapabilityCollector interface {
	CollectRequiredCapabilities(ctx context.Context, profile entities.ProfileReader, runtime PluginRuntime, pluginDir string) (map[string][]capabilities.Capability, error)
}

type CapabilityGatekeeperPort interface {
	GrantCapabilities(
		required capabilities.Grant,
		capabilityInfo map[string]CapabilityInfo,
		trustAll bool,
	) (capabilities.Grant, error)
}

type CapabilityGranter interface {
	GrantCapabilities(ctx context.Context, required map[string][]capabilities.Capability, trustAll bool) (map[string][]capabilities.Capability, error)
}

type CapabilityInfo struct {
	ProfileSpecific *capabilities.Capability
	Capability      capabilities.Capability
	PluginName      string
	IsProfileBased  bool
	IsBroad         bool
}

type Closer interface {
	io.Closer
}

type EngineFactory interface {
	CreateEngine(ctx context.Context, profile entities.ProfileReader, grantedCaps map[string][]capabilities.Capability, pluginDir string, filters dto.FilterOptions, execution dto.ExecutionOptions, skipSchemaValidation bool) (ExecutionEngine, error)
}

type ExecutionEngine interface {
	Execute(ctx context.Context, profile entities.ProfileReader) (*execution.ExecutionResult, error)
	Close(ctx context.Context) error
}

type FormatterOptions struct {
	ProfilePath string // For SARIF: reference to profile location
	Indent      bool   // For JSON: pretty-print with indentation
}

type LockfileRepository interface {
	// Load reads a lockfile from the given path.
	// Returns nil, nil if lockfile doesn't exist.
	Load(ctx context.Context, path string) (*entities.Lockfile, error)

	// Save writes a lockfile to the given path.
	Save(ctx context.Context, lockfile *entities.Lockfile, path string) error

	// Exists checks if a lockfile exists at the given path.
	Exists(ctx context.Context, path string) (bool, error)
}

type OutputFormatter interface {
	Format(result *execution.ExecutionResult) error
}

type OutputFormatterFactory interface {
	// Create returns a formatter for the given format name.
	// Returns error if format is unknown.
	Create(format string, writer io.Writer, options FormatterOptions) (OutputFormatter, error)

	// SupportedFormats returns list of available format names.
	SupportedFormats() []string
}

type OutputWriter interface {
	Write(ctx context.Context, data []byte, dest string) error
}

type Plugin interface {
	// Describe returns plugin metadata including declared capabilities.
	Describe(ctx context.Context) (*PluginInfo, error)
}

type PluginDigester interface {
	// DigestBytes computes SHA-256 of raw bytes.
	DigestBytes(data []byte) string

	// DigestFile computes SHA-256 of a file.
	DigestFile(ctx context.Context, path string) (string, error)
}

type PluginDirectoryResolver interface {
	ResolvePluginDir(ctx context.Context) (string, error)
}

type PluginInfo struct {
	Name         string
	Version      string
	Description  string
	Capabilities []capabilities.Capability
}

type PluginRuntime interface {
	// LoadPlugin compiles and caches a plugin from WASM bytes.
	LoadPlugin(ctx context.Context, name string, wasmBytes []byte) (Plugin, error)

	// Close releases runtime resources.
	Close(ctx context.Context) error
}

type PluginRuntimeFactory interface {
	// NewRuntime creates a new plugin runtime for capability collection.
	NewRuntime(ctx context.Context) (PluginRuntime, error)

	// NewRuntimeWithCapabilities creates a runtime with granted capabilities.
	NewRuntimeWithCapabilities(
		ctx context.Context,
		caps map[string][]capabilities.Capability,
		memoryLimitMB int,
	) (PluginRuntime, error)
}

type ProfileLoader interface {
	LoadProfile(path string) (*entities.Profile, error)
}

type ProfileValidator interface {
	Validate(profile *entities.Profile) error
	ValidateWithSchemas(ctx context.Context, profile *entities.Profile, runtime PluginRuntime) error
}

type SecretResolver interface {
	// Resolve returns the secret value by name.
	// The resolved value is automatically tracked for redaction.
	Resolve(name string) (string, error)
}

type SensitiveValueProvider interface {
	// Track registers a sensitive value to be protected (redacted).
	Track(value string)

	// AllValues returns all tracked sensitive values.
	AllValues() []string
}

type SystemConfigProvider interface {
	LoadConfig(ctx context.Context, path string) (*system.Config, error)
}

type VersionResolver interface {
	// Resolve converts a version constraint to an exact version.
	// Examples:
	//   "@1.0"   -> "1.0.x" (latest 1.0.x)
	//   "^1.2.0" -> "1.x.x >= 1.2.0"
	//   "~1.2.3" -> "1.2.x >= 1.2.3"
	Resolve(constraint string, available []string) (string, error)
}