spec

type BindingEntry struct {
	Source     string         `yaml:"source"`
	SlotParams map[string]any `yaml:"slot_params"`
}

type CIConfig struct {
	FailOnViolation *bool         `yaml:"fail_on_violation"`
	FailSeverity    core.Severity `yaml:"fail_severity"`
}

type CloudConfig struct {
	Enabled *bool  `yaml:"enabled"`
	BaseURL string `yaml:"base_url"`
}

type ControlConfig struct {
	Applicability string `yaml:"applicability"` // "" | applicable | not_applicable
	Reason        string `yaml:"reason"`
	ApprovedBy    string `yaml:"approved_by"`
}

type ControlSpec struct {
	ID               string        `yaml:"id"`
	Name             string        `yaml:"name"`
	Description      string        `yaml:"description"`
	Category         string        `yaml:"category"`
	BaselineSeverity core.Severity `yaml:"baseline_severity"`
}

type CustomPeriod struct {
	ID    string `yaml:"id"`
	Start string `yaml:"start"`
	End   string `yaml:"end"`
}

type ExceptionScope struct {
	ResourceID      string `yaml:"resource_id"`
	ResourcePattern string `yaml:"resource_pattern"`
}

type ExtensionsConfig struct {
	Path string `yaml:"path"`
}

type FiscalCalendarConfig struct {
	Type    string         `yaml:"type"`
	Starts  string         `yaml:"starts"`
	Periods []CustomPeriod `yaml:"periods"`
}

type FrameworkSpec struct {
	SchemaVersion string          `yaml:"schema_version"`
	IDValue       string          `yaml:"id"`
	VersionValue  string          `yaml:"version"`
	DisplayName   string          `yaml:"display_name"`
	Description   string          `yaml:"description"`
	ControlsList  []ControlSpec   `yaml:"controls"`
	PoliciesList  []PolicyRefSpec `yaml:"policies"`
}

type OutputConfig struct {
	Format   string `yaml:"format"`
	JSONPath string `yaml:"json_path"`
	Verbose  bool   `yaml:"verbose"`
}

type PeriodConfig struct {
	FiscalCalendar FiscalCalendarConfig `yaml:"fiscal_calendar"`
	TimeBasis      string               `yaml:"time_basis"`
}

type PluginConfigField struct {
	Type        string `yaml:"type"`
	Required    bool   `yaml:"required"`
	Default     any    `yaml:"default"`
	Enum        []any  `yaml:"enum"`
	Description string `yaml:"description"`
}

type PluginCredentialRequirement struct {
	Source string `yaml:"source"`
	EnvVar string `yaml:"env_var,omitempty"`
}

type PluginManifest struct {
	SchemaVersion       string                        `yaml:"schema_version"`
	ID                  string                        `yaml:"id"`
	DisplayName         string                        `yaml:"display_name"`
	Version             string                        `yaml:"version"`
	Description         string                        `yaml:"description"`
	Emits               []string                      `yaml:"emits"`
	Singleton           bool                          `yaml:"singleton"`
	ConfigSchema        map[string]PluginConfigField  `yaml:"config_schema"`
	RequiresCredentials []PluginCredentialRequirement `yaml:"requires_credentials"`
}

type PolicyConfig struct {
	Bindings     map[string][]BindingEntry `yaml:"bindings"`
	Parameters   map[string]any            `yaml:"parameters"`
	Cadence      string                    `yaml:"cadence"`
	EvidenceMode string                    `yaml:"evidence_mode"`
	CatalogEntry string                    `yaml:"catalog_entry"`
	Exceptions   []PolicyException         `yaml:"exceptions"`
}

type PolicyException struct {
	Scope      ExceptionScope `yaml:"scope"`
	State      string         `yaml:"state"`
	Reason     string         `yaml:"reason"`
	ApprovedBy string         `yaml:"approved_by"`
	ApprovedAt string         `yaml:"approved_at"`
	ExpiresAt  string         `yaml:"expires_at"`
}

type PolicyRefSpec struct {
	ID string `yaml:"id"`
}

type ProjectConfig struct {
	SchemaVersion string                    `yaml:"schema_version"`
	Framework     string                    `yaml:"framework"`
	Period        PeriodConfig              `yaml:"period"`
	Vault         VaultConfig               `yaml:"vault"`
	Sources       map[string]map[string]any `yaml:"sources"`

	// Policies holds all per-policy configuration as one object per
	// policy ID — bindings, parameter overrides, cadence override,
	// evidence_mode override, and scoped exceptions co-located in a single
	// place. This replaces the former family of parallel policy-ID-keyed
	// maps (bindings/policy_parameters/policy_cadences/policy_overrides/
	// exceptions). The shape is what makes the config extensible without a
	// schema bump: a new per-policy dimension (severity, scope, owner) is a
	// new optional field on PolicyConfig — additive, never a new top-level
	// section. See docs/architecture/08-project-config.md §The binding model.
	Policies map[string]PolicyConfig `yaml:"policies"`

	// Controls holds control-level decisions — the coarse, governance
	// axis that is naturally per-control, not per-check: applicability
	// (the ISO Statement of Applicability), and room for ownership and
	// inheritance. A control marked not_applicable cascades to every
	// policy that maps to it (planner sets status=na). Fine-grained,
	// resource-scoped waivers stay under Policies[id].exceptions.
	Controls map[string]ControlConfig `yaml:"controls"`

	Cloud         CloudConfig      `yaml:"cloud"`
	CIEnvironment map[string]any   `yaml:"ci_environment"`
	Output        OutputConfig     `yaml:"output"`
	CI            CIConfig         `yaml:"ci"`
	Extensions    ExtensionsConfig `yaml:"extensions"`

	// Experimental is the forward-compatibility escape hatch. The loader
	// runs with KnownFields(true) so a typo in a recognized key is a loud
	// error — but that strictness would also make any *new* top-level key
	// break older CLIs that predate it. New, not-yet-stable fields are
	// introduced under `experimental:` first: every CLI version that has
	// this field tolerates (and ignores) experimental subkeys it does not
	// understand, so a newer config never hard-fails an older pinned CLI.
	// A field graduates from `experimental.<name>` to a first-class
	// top-level key in a later release. The loader does not interpret
	// anything in here; individual features opt in by reading their own
	// key. See docs/architecture/08-project-config.md §Config evolution.
	Experimental map[string]any `yaml:"experimental"`

	// ProjectLocalPolicies are PolicyRefs for policies discovered under
	// .sigcomply/policies/*/policy.yaml at bootstrap and registered into
	// the policy registry. The planner unions these with the active
	// framework's own Policies() so a customer-authored YAML policy is
	// actually planned and evaluated. yaml:"-" — populated by the
	// orchestrator's project-local loader, never decoded from the file.
	ProjectLocalPolicies []core.PolicyRef `yaml:"-"`
}

type RosterConfig struct {
	// Source is the designated roster source ID. Required when the
	// block is present. Bracketed multi-instance IDs are not supported.
	Source string

	// Aliases maps source ID → lowercased account name → roster email,
	// for accounts whose own email is absent or differs from the
	// roster's. Account names match a record's id or payload.username,
	// case-insensitively.
	Aliases map[string]map[string]string

	// NonHuman maps source ID → lowercased account names that are not
	// people (CI bots, deploy users). Sorted and de-duplicated.
	NonHuman map[string][]string

	// UnknownKeys are subkeys of experimental.roster this CLI does not
	// understand — tolerated, never fatal, but surfaced as warnings.
	UnknownKeys []string
}

type ScopeConfig struct {
	// DeclaredBy and DeclaredAt are the audit trail for the assertion,
	// matching the approved_by/approved_at idiom used by exceptions and
	// control applicability. Both optional.
	DeclaredBy string
	DeclaredAt string

	// RequiredSources lists the source IDs this project asserts are in
	// scope. Sorted on load so the derived report is deterministic
	// (Core Principle #7 — auditors diff runs).
	RequiredSources []string

	// UnknownKeys are subkeys of experimental.scope this CLI does not
	// understand. They are tolerated, never fatal — that tolerance is
	// the whole point of the experimental: hatch — but they are
	// surfaced so a typo is loud without breaking the run.
	UnknownKeys []string
}

type VaultConfig struct {
	Backend string
	Config  map[string]any
}