devidentity

type Input struct {
	// Project is the Bundle's project, the identity project's name unless the
	// declaration sets project_name.
	Project string
	// Identity is the rendered declaration. Its runtime must be "host".
	Identity *release.ShapeIdentity

	// BaseURL is the origin the dev IdP is dialled (and registered) at, e.g.
	// http://localhost:8080. It is also the issuer.
	BaseURL string
	// PATPath is the bootstrap service account's personal access token file.
	PATPath string

	// FrontendOrigin is the browser-facing origin (http://localhost:3000 plus
	// the frontend's base path). The sign-in and callback routes are derived
	// from it. Empty falls back to WorkloadOrigins.
	FrontendOrigin string
	// WorkloadOrigins maps a workload to the origin it listens on, for an
	// application whose sign-in route has no frontend to live on.
	WorkloadOrigins map[string]string

	// Refs are the identity-backed env vars of the env's host workloads.
	Refs []Ref
	// Secret resolves a value from the env's secret store by name (seed-user
	// and SMTP passwords).
	Secret func(name string) (string, bool)

	// StorePath is the local secret store credentials are written to.
	StorePath string
	// OutputsPath is the non-secret outputs file, .forge/identity/<name>.json.
	OutputsPath string
	// KeysDir is the library's own memory of the credentials it issued.
	KeysDir string

	Logger *slog.Logger
}

type Ref struct {
	// EnvName is the variable the process reads, and so the secret-store key.
	EnvName string
	// SecretName and SecretKey are what the render lowered the reference to:
	// Secret forge-identity-<name>, key ISSUER, DEV_API_CLIENT_ID, ...
	SecretName string
	SecretKey  string
}

type Result struct {
	Report *identity.Report
	// StoreKeys are the secret-store keys written or refreshed this pass.
	StoreKeys []string
	// Warnings are things the pass left alone on purpose.
	Warnings []string
}