service

type CredentialInfo struct {
	ID        string
	Version   string
	Status    string // "active", "deprecated", "revoked"
	CreatedAt time.Time
	ExpiresAt *time.Time
	LastUsed  *time.Time
	Metadata  map[string]string
}

type CredentialNotFoundError struct {
	ServiceRef ServiceRef
}

type ExecutedStep struct {
	Step        RotationStep
	Status      string // "success", "failed", "skipped"
	StartedAt   time.Time
	CompletedAt time.Time
	Output      string
	Error       string
}

type RotationNotSupportedError struct {
	ServiceRef ServiceRef
	Strategy   string
	Reason     string
}

type RotationPlan struct {
	ServiceRef    ServiceRef
	Strategy      string
	Steps         []RotationStep
	EstimatedTime time.Duration
	Fingerprint   string // Unique identifier for this plan
	CreatedAt     time.Time
	Metadata      map[string]string
}

type RotationRequest struct {
	ServiceRef ServiceRef
	Strategy   string            // Rotation strategy (e.g., "two-key", "immediate")
	Policy     string            // Rotation policy name
	NewValue   []byte            // New credential value (if provided)
	Metadata   map[string]string // Additional metadata
	DryRun     bool              // Plan only, don't execute
}

type RotationResult struct {
	ServiceRef    ServiceRef
	Plan          RotationPlan
	Status        string // "success", "failed", "partial"
	OldCredential CredentialInfo
	NewCredential CredentialInfo
	ExecutedSteps []ExecutedStep
	StartedAt     time.Time
	CompletedAt   time.Time
	Error         string
	Metadata      map[string]string
}

type RotationStatus struct {
	ServiceRef        ServiceRef
	CurrentCredential CredentialInfo
	LastRotation      *RotationResult
	NextRotation      *time.Time
	Status            string // "current", "needs_rotation", "rotation_in_progress"
	Warnings          []string
}

type RotationStep struct {
	Name        string
	Description string
	Action      string // "create", "verify", "promote", "deprecate", "delete"
	Target      string // What is being acted upon
	Options     map[string]string
}

type Service interface {
	// Name returns the service's name
	Name() string

	// Plan creates a rotation plan for the specified credential
	Plan(ctx context.Context, req RotationRequest) (RotationPlan, error)

	// Execute performs the rotation according to the plan (idempotent by fingerprint)
	Execute(ctx context.Context, plan RotationPlan) (RotationResult, error)

	// Verify checks that the rotation was successful and the new credential works
	Verify(ctx context.Context, result RotationResult) error

	// Rollback attempts to undo a rotation if something went wrong
	Rollback(ctx context.Context, result RotationResult) error

	// GetStatus returns the current rotation status for a credential
	GetStatus(ctx context.Context, ref ServiceRef) (RotationStatus, error)

	// Capabilities returns the service's rotation capabilities
	Capabilities() ServiceCapabilities

	// Validate checks if the service is properly configured and reachable
	Validate(ctx context.Context) error
}

type ServiceCapabilities struct {
	SupportedStrategies  []string          // Strategies this service can use
	MaxActiveKeys        int               // Maximum concurrent credentials (0 = unlimited)
	SupportsExpiration   bool              // Can set expiration dates
	SupportsVersioning   bool              // Maintains credential versions
	SupportsRevocation   bool              // Can revoke old credentials
	SupportsVerification bool              // Can verify credential functionality
	MinRotationInterval  time.Duration     // Minimum time between rotations
	Constraints          map[string]string // Format, length, character constraints
}

type ServiceNotFoundError struct {
	ServiceRef ServiceRef
}

type ServiceRef struct {
	Type      string            // Service type (e.g., "github", "postgres", "stripe")
	Instance  string            // Service instance ID (e.g., "acme-org", "prod-db")
	Kind      string            // Credential kind (e.g., "pat", "password", "api-key")
	Principal string            // Identity the credential belongs to (e.g., "ci-bot")
	Options   map[string]string // Additional options for the service
}

type VerificationError struct {
	ServiceRef ServiceRef
	Message    string
}