profiles

type AuthRule struct {
	// Pattern is a URL prefix to match (e.g., "https://example.com/").
	// More specific patterns take precedence.
	Pattern string

	// AuthType is the type of authentication: "bearer", "basic", or "header".
	AuthType string

	// Token is used for bearer auth.
	Token string

	// Username and Password are used for basic auth.
	Username string
	Password string

	// HeaderValue is the raw Authorization header value for "header" type.
	HeaderValue string
}

type ChainAuthProvider struct {
	Providers []interface {
		GetAuthHeader(context.Context, string) (string, error)
	}
}

type FSProfileCacheRepository struct {
	// Root is the base directory for the cache.
	// Default: ~/.reglet/profiles
	Root string
}

type HTTPError struct {
	Status     string
	URL        string
	StatusCode int
}

type HTTPProfileFetcher struct {
	// OnRedirect is called when a redirect is followed.
	// Returns an error to abort the redirect.
	OnRedirect func(req *http.Request, via []*http.Request) error

	// OnPrivateIPWarning is called when SSRF protection blocks a private IP.
	OnPrivateIPWarning func(ip string)

	// OnDNSPinning is called when DNS is resolved and pinned.
	OnDNSPinning func(host string, ip string)

	// OnContentTypeWarning is called when Content-Type is unexpected.
	OnContentTypeWarning func(contentType string)

	// OnRetry is called before each retry attempt.
	OnRetry func(attempt int, statusCode int)

	// OnSecretDetected is called when potential secrets are found in fetched content.
	// This implements Constitution II: Credential Hygiene - Secret Detection.
	OnSecretDetected func(findings []sensitivedata.SecretFinding)

	// UserAgent is the User-Agent header sent with requests.
	UserAgent string
}

type HeaderAuthProvider struct {
	// Rules maps URL patterns to auth configurations.
	// Patterns are matched from most specific to least specific.
	Rules []AuthRule
}

type NoAuthProvider struct{}

type StaticHeaderAuthProvider struct {
	Header string
}

type UpdateCheckResult struct {
	// CurrentETag is the ETag of the cached version.
	CurrentETag string
	// RemoteETag is the ETag of the remote version.
	RemoteETag string
	// LastModified is the Last-Modified header from the remote.
	LastModified string
	// HasUpdate indicates whether the remote content has changed.
	HasUpdate bool
}