rotation

type AuditEntry struct {
	Timestamp time.Time              `json:"timestamp"`
	Action    string                 `json:"action"`
	Component string                 `json:"component"`
	Status    string                 `json:"status"`
	Message   string                 `json:"message,omitempty"`
	Details   map[string]interface{} `json:"details,omitempty"`
	Error     string                 `json:"error,omitempty"`
}

type CredentialConstraints struct {
	MaxActive        interface{} `json:"maxActive,omitempty"` // Can be int or "unlimited"
	TTL              string      `json:"ttl,omitempty"`
	Format           string      `json:"format,omitempty"`
	RotationRequired bool        `json:"rotationRequired,omitempty"`
	MaxKeys          int         `json:"maxKeys,omitempty"`
	Renewable        bool        `json:"renewable,omitempty"`
	Managed          bool        `json:"managed,omitempty"`
	RequiresMFA      bool        `json:"requiresMFA,omitempty"`
}

type DefaultRotationEngine struct {
	// contains filtered or unexported fields
}

type DefaultStrategySelector struct{}

type DeprecateRequest struct {
	Secret      SecretInfo      `json:"secret"`
	OldRef      SecretReference `json:"old_ref"`
	GracePeriod time.Duration   `json:"grace_period"`
	HardDelete  bool            `json:"hard_delete"`
}

type FileRotationStorage struct {
	// contains filtered or unexported fields
}

type ImmediateRotationStrategy struct {
	// contains filtered or unexported fields
}

type MemoryRotationStorage struct {
	// contains filtered or unexported fields
}

type NewSecretValue struct {
	Type   ValueType              `json:"type"`
	Config map[string]interface{} `json:"config,omitempty"`
	Value  string                 `json:"value,omitempty"` // For literal values
}

type OverlapRotationStrategy struct {
	// contains filtered or unexported fields
}

type PromoteRequest struct {
	Secret       SecretInfo      `json:"secret"`
	SecondaryRef SecretReference `json:"secondary_ref"`
	GracePeriod  time.Duration   `json:"grace_period"`
	VerifyFirst  bool            `json:"verify_first"`
}

type ProviderCapabilities struct {
	// MaxActiveKeys is the maximum number of active keys (-1 for unlimited)
	MaxActiveKeys int

	// SupportsVersioning indicates if provider maintains version history
	SupportsVersioning bool

	// SupportsExpiration indicates if secrets can have expiration dates
	SupportsExpiration bool

	// SupportsRevocation indicates if secrets can be revoked immediately
	SupportsRevocation bool

	// SupportsMetadata indicates if secrets can have associated metadata
	SupportsMetadata bool

	// MinRotationInterval is the minimum time between rotations
	MinRotationInterval time.Duration

	// RecommendedStrategies lists strategies that work well with this provider
	RecommendedStrategies []RotationStrategy
}

type RandomRotator struct {
	// contains filtered or unexported fields
}

type RollbackRequest struct {
	Secret       SecretInfo      `json:"secret"`
	OldSecretRef SecretReference `json:"old_secret_ref"`
	Reason       string          `json:"reason"`
}

type RotationConstraints struct {
	MinRotationInterval  time.Duration      `json:"min_rotation_interval,omitempty"`
	MaxValueLength       int                `json:"max_value_length,omitempty"`
	MinValueLength       int                `json:"min_value_length,omitempty"`
	AllowedCharsets      []string           `json:"allowed_charsets,omitempty"`
	RequiredTests        []VerificationTest `json:"required_tests,omitempty"`
	GracePeriod          time.Duration      `json:"grace_period,omitempty"`
	NotificationRequired bool               `json:"notification_required,omitempty"`
}

type RotationEngine interface {
	// RegisterStrategy adds a rotation strategy to the engine's registry.
	//
	// This method registers a new rotation strategy that can handle specific
	// types of secrets or services. The strategy's Name() method must return
	// a unique identifier that will be used to route rotation requests.
	//
	// Multiple strategies can be registered, and the engine will route requests
	// based on the strategy name specified in RotationRequest.
	//
	// Returns error if:
	//   - A strategy with the same name is already registered
	//   - The strategy is nil or invalid
	//
	// Example:
	//
	//	postgresRotator := &PostgreSQLRotator{}
	//	if err := engine.RegisterStrategy(postgresRotator); err != nil {
	//	    return fmt.Errorf("failed to register postgres rotator: %w", err)
	//	}
	RegisterStrategy(strategy SecretValueRotator) error

	// GetStrategy returns a registered rotation strategy by name.
	//
	// This method looks up a previously registered strategy by its name.
	// Used internally for request routing and can be used externally for
	// direct strategy access or introspection.
	//
	// Returns error if no strategy with the given name is registered.
	//
	// Example:
	//
	//	strategy, err := engine.GetStrategy("postgresql")
	//	if err != nil {
	//	    return fmt.Errorf("postgresql strategy not available: %w", err)
	//	}
	//	if strategy.SupportsSecret(ctx, secretInfo) {
	//	    // Use strategy for custom rotation logic
	//	}
	GetStrategy(name string) (SecretValueRotator, error)

	// ListStrategies returns names of all registered rotation strategies.
	//
	// This method provides discovery of available strategies for UI display,
	// configuration validation, and operational introspection.
	//
	// Returns empty slice if no strategies are registered.
	//
	// Example:
	//
	//	strategies := engine.ListStrategies()
	//	fmt.Printf("Available rotation strategies: %v\n", strategies)
	//	for _, name := range strategies {
	//	    strategy, _ := engine.GetStrategy(name)
	//	    caps := strategy.Capabilities() // If strategy implements capability interface
	//	}
	ListStrategies() []string

	// Rotate performs rotation using the appropriate strategy.
	//
	// This is the primary method for executing rotation operations. It:
	//   - Routes the request to the specified strategy
	//   - Validates the request and strategy compatibility
	//   - Executes the rotation with proper error handling
	//   - Records results in rotation history
	//   - Handles notifications if configured
	//
	// Returns RotationResult with detailed outcome information, including
	// success/failure status, timing, verification results, and audit trail.
	//
	// Example:
	//
	//	request := RotationRequest{
	//	    Secret: SecretInfo{
	//	        Key:        "database_password",
	//	        Provider:   "postgresql",
	//	        SecretType: SecretTypePassword,
	//	    },
	//	    Strategy:   "postgresql",
	//	    TwoSecret:  true, // Zero-downtime rotation
	//	}
	//
	//	result, err := engine.Rotate(ctx, request)
	//	if err != nil {
	//	    return fmt.Errorf("rotation failed: %w", err)
	//	}
	//	if result.Status != StatusCompleted {
	//	    return fmt.Errorf("rotation incomplete: %s", result.Error)
	//	}
	Rotate(ctx context.Context, request RotationRequest) (*RotationResult, error)

	// BatchRotate rotates multiple secrets efficiently.
	//
	// This method processes multiple rotation requests, potentially in parallel,
	// with proper error handling and coordination. It's more efficient than
	// calling Rotate() multiple times for bulk operations.
	//
	// The method handles:
	//   - Parallel execution where safe
	//   - Dependency ordering (rotate A before B)
	//   - Error isolation (failure of one doesn't stop others)
	//   - Progress reporting for long-running operations
	//
	// Returns slice of RotationResult corresponding to input requests.
	// Check individual results for per-secret success/failure status.
	//
	// Example:
	//
	//	requests := []RotationRequest{
	//	    {Secret: dbSecret, Strategy: "postgresql"},
	//	    {Secret: apiSecret, Strategy: "stripe"},
	//	    {Secret: certSecret, Strategy: "certificate"},
	//	}
	//
	//	results, err := engine.BatchRotate(ctx, requests)
	//	if err != nil {
	//	    return fmt.Errorf("batch rotation failed: %w", err)
	//	}
	//
	//	for i, result := range results {
	//	    if result.Status != StatusCompleted {
	//	        log.Errorf("Request %d failed: %s", i, result.Error)
	//	    }
	//	}
	BatchRotate(ctx context.Context, requests []RotationRequest) ([]RotationResult, error)

	// GetRotationHistory returns rotation history for a specific secret.
	//
	// This method retrieves historical rotation records for audit, monitoring,
	// and troubleshooting purposes. History includes successful rotations,
	// failures, and any rollback operations.
	//
	// The limit parameter controls how many historical records to return.
	// Use 0 for no limit, positive number for most recent N records.
	//
	// Returns records in reverse chronological order (newest first).
	//
	// Example:
	//
	//	// Get last 10 rotation attempts for this secret
	//	history, err := engine.GetRotationHistory(ctx, secretInfo, 10)
	//	if err != nil {
	//	    return fmt.Errorf("failed to get history: %w", err)
	//	}
	//
	//	for _, record := range history {
	//	    fmt.Printf("%s: %s (status: %s)\n",
	//	        record.RotatedAt.Format(time.RFC3339),
	//	        record.Secret.Key,
	//	        record.Status)
	//	}
	GetRotationHistory(ctx context.Context, secret SecretInfo, limit int) ([]RotationResult, error)

	// ScheduleRotation schedules a rotation for future execution.
	//
	// This method adds a rotation request to the scheduling system for execution
	// at a specified time. Useful for planned maintenance windows, regular
	// rotation cycles, and coordinated multi-secret rotations.
	//
	// The scheduling system should handle:
	//   - Persistent storage of scheduled operations
	//   - Reliable execution at the specified time
	//   - Retry logic for transient failures
	//   - Notification of schedule completion
	//
	// Example:
	//
	//	// Schedule rotation for next maintenance window
	//	maintenanceWindow := time.Date(2024, 1, 15, 2, 0, 0, 0, time.UTC)
	//	request := RotationRequest{
	//	    Secret:   criticalSecret,
	//	    Strategy: "postgresql",
	//	    TwoSecret: true, // Zero downtime
	//	}
	//
	//	if err := engine.ScheduleRotation(ctx, request, maintenanceWindow); err != nil {
	//	    return fmt.Errorf("failed to schedule rotation: %w", err)
	//	}
	ScheduleRotation(ctx context.Context, request RotationRequest, when time.Time) error
}

type RotationRequest struct {
	// Secret contains detailed information about what secret to rotate.
	Secret SecretInfo `json:"secret"`

	// Strategy specifies which rotation strategy/rotator to use.
	// Must match a registered rotator's Name() method.
	Strategy string `json:"strategy"`

	// NewValue specifies how to generate the new secret value.
	// If nil, the rotator will use its default value generation.
	NewValue *NewSecretValue `json:"new_value,omitempty"`

	// DryRun indicates this is a planning/validation run that should not
	// make any actual changes. Used for testing and verification.
	DryRun bool `json:"dry_run"`

	// Force bypasses safety checks and constraints (use with caution).
	// This can skip minimum rotation intervals, verification failures, etc.
	Force bool `json:"force"`

	// TwoSecret enables two-key rotation strategy if the rotator supports it.
	// This creates overlap periods for zero-downtime rotation.
	TwoSecret bool `json:"two_secret"`

	// Config provides additional configuration specific to the rotation
	// strategy. Contents depend on the specific rotator being used.
	Config map[string]interface{} `json:"config,omitempty"`

	// Notification specifies who should be notified about rotation events.
	// Format depends on notification system configuration.
	Notification []string `json:"notification,omitempty"`
}

type RotationResult struct {
	// Secret identifies which secret was rotated.
	Secret SecretInfo `json:"secret"`

	// Status indicates the final state of the rotation operation.
	Status RotationStatus `json:"status"`

	// NewSecretRef points to the newly created/rotated secret version.
	// Present for successful rotations.
	NewSecretRef *SecretReference `json:"new_secret_ref,omitempty"`

	// OldSecretRef points to the previous secret version that was replaced.
	// Used for rollback operations if needed.
	OldSecretRef *SecretReference `json:"old_secret_ref,omitempty"`

	// RotatedAt indicates when the rotation was successfully completed.
	// Nil for failed or incomplete rotations.
	RotatedAt *time.Time `json:"rotated_at,omitempty"`

	// ExpiresAt indicates when the rotated secret expires or should be rotated again.
	// Used for scheduling future rotations.
	ExpiresAt *time.Time `json:"expires_at,omitempty"`

	// VerificationResults contains outcomes of all verification tests performed
	// during the rotation to ensure the new secret works correctly.
	VerificationResults []VerificationResult `json:"verification_results,omitempty"`

	// Error contains error message if the rotation failed.
	// Empty string indicates successful rotation.
	Error string `json:"error,omitempty"`

	// Warnings contains non-fatal issues encountered during rotation.
	// These don't prevent success but should be reviewed.
	Warnings []string `json:"warnings,omitempty"`

	// AuditTrail provides detailed record of all actions taken during rotation.
	// Used for compliance, debugging, and operational monitoring.
	AuditTrail []AuditEntry `json:"audit_trail,omitempty"`
}

type RotationStatus string

type RotationStatusInfo struct {
	Status          RotationStatus `json:"status"`
	LastRotated     *time.Time     `json:"last_rotated,omitempty"`
	NextRotation    *time.Time     `json:"next_rotation,omitempty"`
	RotationVersion string         `json:"rotation_version,omitempty"`
	CanRotate       bool           `json:"can_rotate"`
	Reason          string         `json:"reason,omitempty"`
}

type RotationStorage interface {
	// StoreRotationResult saves a rotation result to persistent storage
	StoreRotationResult(ctx context.Context, result RotationResult) error

	// GetRotationHistory retrieves rotation history for a secret
	GetRotationHistory(ctx context.Context, secret SecretInfo, limit int) ([]RotationResult, error)

	// GetRotationStatus gets the current rotation status for a secret
	GetRotationStatus(ctx context.Context, secret SecretInfo) (*RotationStatusInfo, error)

	// UpdateRotationStatus updates the current rotation status for a secret
	UpdateRotationStatus(ctx context.Context, secret SecretInfo, status RotationStatusInfo) error

	// ListSecrets returns all secrets that have rotation metadata
	ListSecrets(ctx context.Context) ([]SecretInfo, error)

	// Close closes any resources used by the storage
	Close() error
}

type RotationStrategy string

type SchemaAwareRotator interface {
	// SetRepository sets the dsops-data repository for schema-aware rotation.
	//
	// This method provides access to the dsops-data repository containing
	// community-maintained service definitions. Rotators implementing this
	// interface can use these definitions to:
	//   - Determine supported credential types for services
	//   - Access rotation procedures and constraints
	//   - Use standardized verification tests
	//   - Follow service-specific best practices
	//
	// The repository is typically set once during rotator initialization
	// and remains available for all subsequent rotation operations.
	//
	// Example:
	//
	//	rotator := &GenericRotator{}
	//	repository, err := dsopsdata.LoadRepository("./dsops-data")
	//	if err != nil {
	//	    return err
	//	}
	//
	//	rotator.SetRepository(repository)
	//
	//	// Rotator can now use service definitions
	//	result, err := rotator.Rotate(ctx, rotationRequest)
	SetRepository(repository *dsopsdata.Repository)
}

type SchemaMetadata struct {
	ServiceType     string                 `json:"service_type,omitempty"`
	CredentialKind  string                 `json:"credential_kind,omitempty"`
	Capabilities    []string               `json:"capabilities,omitempty"`
	Constraints     *CredentialConstraints `json:"constraints,omitempty"`
	ServiceInstance *ServiceInstanceMeta   `json:"service_instance,omitempty"`
}

type ScriptInput struct {
	Action         string                 `json:"action"`
	SecretInfo     SecretInfo             `json:"secret_info"`
	DryRun         bool                   `json:"dry_run"`
	Force          bool                   `json:"force"`
	NewValue       *NewSecretValue        `json:"new_value,omitempty"`
	Config         map[string]interface{} `json:"config,omitempty"`
	Environment    map[string]string      `json:"environment,omitempty"`
	SchemaMetadata *SchemaMetadata        `json:"schema_metadata,omitempty"`
}

type ScriptOutput struct {
	Success      bool                   `json:"success"`
	Message      string                 `json:"message,omitempty"`
	NewSecretRef *SecretReference       `json:"new_secret_ref,omitempty"`
	Error        string                 `json:"error,omitempty"`
	Warnings     []string               `json:"warnings,omitempty"`
	Metadata     map[string]interface{} `json:"metadata,omitempty"`
}

type ScriptRotator struct {
	// contains filtered or unexported fields
}

type SecondarySecretRequest struct {
	Secret   SecretInfo             `json:"secret"`
	NewValue *NewSecretValue        `json:"new_value,omitempty"`
	Config   map[string]interface{} `json:"config,omitempty"`
}

type SecretInfo struct {
	// Key is the logical name/identifier for this secret in the configuration.
	// Used for logging, error messages, and referencing in rotation policies.
	Key string `json:"key"`

	// Provider identifies which secret store or service manages this secret.
	// Examples: "aws.secretsmanager", "onepassword", "postgresql", "stripe"
	Provider string `json:"provider"`

	// ProviderRef contains the specific reference information needed to
	// locate and retrieve this secret from the provider.
	ProviderRef provider.Reference `json:"provider_ref"`

	// SecretType categorizes what kind of secret this is, which determines
	// the appropriate rotation strategy and validation procedures.
	SecretType SecretType `json:"secret_type"`

	// Metadata contains additional context about the secret, its usage,
	// and rotation requirements. Common keys include:
	//   - "environment": deployment environment (prod, staging, dev)
	//   - "service": which service uses this secret
	//   - "owner": team or individual responsible
	//   - "criticality": importance level (high, medium, low)
	Metadata map[string]string `json:"metadata"`

	// Constraints define rotation policies, limits, and requirements
	// specific to this secret. Nil if no special constraints apply.
	Constraints *RotationConstraints `json:"constraints,omitempty"`
}

type SecretReference struct {
	Provider   string            `json:"provider"`
	Key        string            `json:"key"`
	Version    string            `json:"version,omitempty"`
	Identifier string            `json:"identifier,omitempty"` // DB user, API key ID, etc.
	Metadata   map[string]string `json:"metadata,omitempty"`
}

type SecretType string

type SecretValueRotator interface {
	// Name returns the unique strategy identifier.
	//
	// This should be a stable, lowercase identifier used to identify the rotator
	// in configuration files and CLI commands. Examples: "postgres", "stripe",
	// "github", "generic-api", "certificate".
	//
	// The name is used for:
	//   - Strategy registration and lookup
	//   - Configuration file references
	//   - Logging and audit trails
	//   - CLI command arguments
	Name() string

	// SupportsSecret determines if this rotator can handle the given secret.
	//
	// This method allows rotators to indicate which types of secrets they can
	// rotate based on the secret's type, provider, metadata, or other attributes.
	// The rotation engine uses this to select the appropriate rotator for each
	// secret.
	//
	// Common criteria for support:
	//   - Secret type (password, api_key, certificate, etc.)
	//   - Provider compatibility
	//   - Service-specific metadata
	//   - Required configuration presence
	//
	// Example:
	//
	//	func (r *PostgresRotator) SupportsSecret(ctx context.Context, secret SecretInfo) bool {
	//	    // Only handle password secrets
	//	    if secret.SecretType != SecretTypePassword {
	//	        return false
	//	    }
	//
	//	    // Check for required metadata
	//	    if secret.Metadata["database_type"] != "postgresql" {
	//	        return false
	//	    }
	//
	//	    return true
	//	}
	SupportsSecret(ctx context.Context, secret SecretInfo) bool

	// Rotate performs the complete secret rotation lifecycle.
	//
	// This is the core method that orchestrates the entire rotation process:
	//   1. Generate or retrieve new secret value
	//   2. Update the target service with new credentials
	//   3. Verify the new credentials work correctly
	//   4. Update secret storage with new value
	//   5. Clean up old credentials
	//   6. Generate audit trail
	//
	// The method should handle errors gracefully and provide detailed results
	// including timing information, verification results, and audit entries.
	//
	// For dry-run requests (request.DryRun = true), the method should:
	//   - Validate the rotation request
	//   - Check preconditions
	//   - Return what would be done without executing
	//
	// Example:
	//
	//	func (r *PostgresRotator) Rotate(ctx context.Context, req RotationRequest) (*RotationResult, error) {
	//	    if req.DryRun {
	//	        return r.planRotation(ctx, req)
	//	    }
	//
	//	    startTime := time.Now()
	//	    result := &RotationResult{
	//	        Secret: req.Secret,
	//	        Status: StatusRotating,
	//	    }
	//
	//	    // Generate new password
	//	    newPassword, err := r.generatePassword(req)
	//	    if err != nil {
	//	        result.Status = StatusFailed
	//	        result.Error = err.Error()
	//	        return result, err
	//	    }
	//
	//	    // Update database user
	//	    if err := r.updateDatabasePassword(ctx, newPassword); err != nil {
	//	        result.Status = StatusFailed
	//	        result.Error = err.Error()
	//	        return result, err
	//	    }
	//
	//	    // Verify connection works
	//	    if err := r.verifyConnection(ctx, newPassword); err != nil {
	//	        // Attempt rollback
	//	        r.rollbackPassword(ctx, req.Secret)
	//	        result.Status = StatusFailed
	//	        result.Error = err.Error()
	//	        return result, err
	//	    }
	//
	//	    // Update secret store
	//	    if err := r.updateSecretStore(ctx, req, newPassword); err != nil {
	//	        result.Status = StatusFailed
	//	        result.Error = err.Error()
	//	        return result, err
	//	    }
	//
	//	    now := time.Now()
	//	    result.Status = StatusCompleted
	//	    result.RotatedAt = &now
	//	    result.AuditTrail = r.generateAuditTrail(startTime, now)
	//
	//	    return result, nil
	//	}
	Rotate(ctx context.Context, request RotationRequest) (*RotationResult, error)

	// Verify checks that new secret credentials are working correctly.
	//
	// This method performs validation tests to ensure that newly rotated
	// credentials are functional before completing the rotation process.
	// It's typically called during the Rotate method, but can also be
	// invoked independently for verification.
	//
	// The verification request includes test specifications that define
	// what checks to perform. Common verification tests:
	//   - Connection tests (can we connect with new credentials?)
	//   - Query tests (can we perform required operations?)
	//   - API tests (do API calls succeed with new tokens?)
	//   - Permission tests (do we have required access levels?)
	//
	// Example:
	//
	//	func (r *PostgresRotator) Verify(ctx context.Context, req VerificationRequest) error {
	//	    for _, test := range req.Tests {
	//	        switch test.Type {
	//	        case TestTypeConnection:
	//	            if err := r.testConnection(ctx, req.NewSecretRef); err != nil {
	//	                return fmt.Errorf("connection test failed: %w", err)
	//	            }
	//
	//	        case TestTypeQuery:
	//	            if err := r.testQuery(ctx, req.NewSecretRef, test.Config); err != nil {
	//	                return fmt.Errorf("query test failed: %w", err)
	//	            }
	//	        }
	//	    }
	//	    return nil
	//	}
	Verify(ctx context.Context, request VerificationRequest) error

	// Rollback reverts to the previous secret value if possible.
	//
	// This method attempts to restore service functionality by reverting to
	// a previous secret value when rotation fails or new credentials don't
	// work as expected. Not all services support rollback - some may require
	// manual intervention.
	//
	// Rollback scenarios:
	//   - New credentials fail verification
	//   - Service rejects new credentials after deployment
	//   - Manual rollback requested by operator
	//   - Rotation process encounters fatal error
	//
	// The method should:
	//   - Restore the service to use old credentials
	//   - Update secret storage if necessary
	//   - Generate audit trail for rollback operation
	//   - Return error if rollback is not possible
	//
	// Example:
	//
	//	func (r *PostgresRotator) Rollback(ctx context.Context, req RollbackRequest) error {
	//	    // Get old password from secret reference
	//	    oldPassword, err := r.getSecretValue(ctx, req.OldSecretRef)
	//	    if err != nil {
	//	        return fmt.Errorf("cannot retrieve old password for rollback: %w", err)
	//	    }
	//
	//	    // Restore database user password
	//	    if err := r.updateDatabasePassword(ctx, oldPassword); err != nil {
	//	        return fmt.Errorf("rollback failed: %w", err)
	//	    }
	//
	//	    // Verify rollback worked
	//	    if err := r.verifyConnection(ctx, oldPassword); err != nil {
	//	        return fmt.Errorf("rollback verification failed: %w", err)
	//	    }
	//
	//	    r.logRollback(req.Secret, req.Reason)
	//	    return nil
	//	}
	Rollback(ctx context.Context, request RollbackRequest) error

	// GetStatus returns the current rotation status and metadata for a secret.
	//
	// This method provides information about when a secret was last rotated,
	// when it should next be rotated, and whether rotation is currently possible.
	// Used by status commands and rotation scheduling.
	//
	// The returned status should include:
	//   - Current rotation state
	//   - Last rotation timestamp
	//   - Next scheduled rotation time
	//   - Whether rotation is currently allowed
	//   - Any blocking conditions or reasons
	//
	// Example:
	//
	//	func (r *PostgresRotator) GetStatus(ctx context.Context, secret SecretInfo) (*RotationStatusInfo, error) {
	//	    // Check rotation history
	//	    lastRotation, err := r.getLastRotationTime(ctx, secret)
	//	    if err != nil {
	//	        return nil, err
	//	    }
	//
	//	    // Calculate next rotation time
	//	    nextRotation := lastRotation.Add(r.getRotationInterval(secret))
	//
	//	    // Check if rotation is currently possible
	//	    canRotate, reason := r.canRotateNow(ctx, secret)
	//
	//	    return &RotationStatusInfo{
	//	        Status:          StatusCompleted,
	//	        LastRotated:     &lastRotation,
	//	        NextRotation:    &nextRotation,
	//	        CanRotate:       canRotate,
	//	        Reason:          reason,
	//	    }, nil
	//	}
	GetStatus(ctx context.Context, secret SecretInfo) (*RotationStatusInfo, error)
}

type ServiceInstanceMeta struct {
	Type     string                 `json:"type"`
	ID       string                 `json:"id"`
	Name     string                 `json:"name,omitempty"`
	Endpoint string                 `json:"endpoint"`
	Auth     string                 `json:"auth"`
	Config   map[string]interface{} `json:"config,omitempty"`
}

type StoredRotationResult struct {
	RotationResult
	StoredAt time.Time `json:"stored_at"`
	ID       string    `json:"id"`
}

type StoredRotationStatus struct {
	SecretKey string             `json:"secret_key"`
	Provider  string             `json:"provider"`
	Status    RotationStatusInfo `json:"status"`
	UpdatedAt time.Time          `json:"updated_at"`
}

type StrategyRegistry struct {
	// contains filtered or unexported fields
}

type StrategySelector interface {
	// SelectStrategy chooses the best strategy based on provider capabilities
	SelectStrategy(ctx context.Context, secret SecretInfo, capabilities ProviderCapabilities) (RotationStrategy, error)

	// ValidateStrategy checks if a strategy is compatible with provider
	ValidateStrategy(strategy RotationStrategy, capabilities ProviderCapabilities) error
}

type TestStatus string

type TestType string

type TwoSecretMetadata struct {
	ActiveSecret   SecretReference  `json:"active_secret"`
	InactiveSecret *SecretReference `json:"inactive_secret,omitempty"`
	LastRotated    *time.Time       `json:"last_rotated,omitempty"`
	NextRotation   *time.Time       `json:"next_rotation,omitempty"`
	GracePeriod    time.Duration    `json:"grace_period"`
}

type TwoSecretRotator interface {
	SecretValueRotator

	// CreateSecondarySecret creates the inactive/secondary secret.
	//
	// This method creates a new version of the secret without affecting the
	// current active version. The secondary secret should have the same
	// permissions and access as the primary but with a new value.
	//
	// For databases, this might create a new user with identical permissions.
	// For API services, this might generate a new API key while keeping the old one active.
	// For certificates, this might issue a new certificate with the same subject.
	//
	// The returned SecretReference points to the newly created secondary secret
	// and can be used in subsequent promote/deprecate operations.
	//
	// Example:
	//
	//	req := SecondarySecretRequest{
	//	    Secret: SecretInfo{
	//	        Key:         "api_key",
	//	        Provider:    "stripe",
	//	        SecretType:  SecretTypeAPIKey,
	//	    },
	//	    NewValue: &NewSecretValue{
	//	        Type: ValueTypeGenerated,
	//	    },
	//	}
	//
	//	secondaryRef, err := rotator.CreateSecondarySecret(ctx, req)
	//	if err != nil {
	//	    return fmt.Errorf("failed to create secondary secret: %w", err)
	//	}
	CreateSecondarySecret(ctx context.Context, request SecondarySecretRequest) (*SecretReference, error)

	// PromoteSecondarySecret makes the secondary secret the active/primary secret.
	//
	// This method transitions the system to use the secondary secret as the primary.
	// After promotion, new connections and operations should use the secondary
	// secret, but existing connections using the old primary may continue to work
	// during the grace period.
	//
	// The implementation should:
	//   - Update service configuration to use secondary as primary
	//   - Maintain backward compatibility during grace period
	//   - Verify the promotion was successful
	//   - Roll back if promotion fails
	//
	// If VerifyFirst is true, the method should test the secondary secret
	// before promoting it to avoid promoting non-functional credentials.
	//
	// Example:
	//
	//	req := PromoteRequest{
	//	    Secret:       secretInfo,
	//	    SecondaryRef: secondaryRef,
	//	    GracePeriod:  5 * time.Minute,
	//	    VerifyFirst:  true,
	//	}
	//
	//	if err := rotator.PromoteSecondarySecret(ctx, req); err != nil {
	//	    return fmt.Errorf("failed to promote secondary secret: %w", err)
	//	}
	PromoteSecondarySecret(ctx context.Context, request PromoteRequest) error

	// DeprecatePrimarySecret marks the old primary secret as deprecated.
	//
	// This method is called after successful promotion and grace period to
	// clean up the old primary secret. Depending on the service and HardDelete
	// setting, this may:
	//   - Delete the old secret entirely
	//   - Mark it as inactive but retain for audit/rollback
	//   - Reduce its permissions or scope
	//   - Move it to a "deprecated" state
	//
	// The grace period allows time for:
	//   - Existing connections to naturally close
	//   - All services to pick up the new primary
	//   - Verification that no systems are still using old primary
	//
	// If HardDelete is false, the old secret should be retained in a disabled
	// state for potential rollback scenarios.
	//
	// Example:
	//
	//	req := DeprecateRequest{
	//	    Secret:      secretInfo,
	//	    OldRef:      oldPrimaryRef,
	//	    GracePeriod: 10 * time.Minute,
	//	    HardDelete:  false, // Keep for rollback
	//	}
	//
	//	if err := rotator.DeprecatePrimarySecret(ctx, req); err != nil {
	//	    log.Warnf("Failed to deprecate old primary: %v", err)
	//	    // This may not be fatal - new primary is already active
	//	}
	DeprecatePrimarySecret(ctx context.Context, request DeprecateRequest) error
}

type TwoSecretStrategy struct {
	// contains filtered or unexported fields
}

type ValueType string

type VerificationRequest struct {
	Secret       SecretInfo         `json:"secret"`
	NewSecretRef SecretReference    `json:"new_secret_ref"`
	Tests        []VerificationTest `json:"tests"`
	Timeout      time.Duration      `json:"timeout"`
}

type VerificationResult struct {
	Test     VerificationTest       `json:"test"`
	Status   TestStatus             `json:"status"`
	Duration time.Duration          `json:"duration"`
	Message  string                 `json:"message,omitempty"`
	Error    string                 `json:"error,omitempty"`
	Details  map[string]interface{} `json:"details,omitempty"`
}

type VerificationTest struct {
	Name        string                 `json:"name"`
	Type        TestType               `json:"type"`
	Config      map[string]interface{} `json:"config,omitempty"`
	Timeout     time.Duration          `json:"timeout,omitempty"`
	Required    bool                   `json:"required"`
	Description string                 `json:"description,omitempty"`
}

type WebhookRequest struct {
	Action     string                 `json:"action"`
	SecretInfo SecretInfo             `json:"secret_info"`
	DryRun     bool                   `json:"dry_run"`
	Force      bool                   `json:"force"`
	NewValue   *NewSecretValue        `json:"new_value,omitempty"`
	Config     map[string]interface{} `json:"config,omitempty"`
	Timestamp  time.Time              `json:"timestamp"`
}

type WebhookResponse struct {
	Success      bool                   `json:"success"`
	Message      string                 `json:"message,omitempty"`
	NewSecretRef *SecretReference       `json:"new_secret_ref,omitempty"`
	Error        string                 `json:"error,omitempty"`
	Warnings     []string               `json:"warnings,omitempty"`
	Metadata     map[string]interface{} `json:"metadata,omitempty"`
}

type WebhookRotator struct {
	// contains filtered or unexported fields
}