workflows

type AccessOptions struct {
}

type AccessResult struct {
	// ProjectName is the name of the project.
	ProjectName string

	// Users contains information about each user.
	Users []UserAccessInfo

	// Summary contains counts of users by status.
	Summary AccessSummary
}

type AccessSummary struct {
	// Active is the count of users with full access.
	Active int

	// Pending is the count of users awaiting access.
	Pending int

	// Orphan is the count of orphaned entries.
	Orphan int
}

type CIInitOptions struct {
	Verbose bool
	Debug   bool
}

type CIInitResult struct {
	CIUserUUID      string
	CIUserEmail     string
	WorkflowCreated bool
	WorkflowPath    string
	PrivateKeyPEM   []byte
	GitHubRepoURL   string
}

type CheckResult struct {
	Name       string      `json:"name"`
	Status     CheckStatus `json:"status"`
	Message    string      `json:"message"`
	Suggestion string      `json:"suggestion,omitempty"`
}

type CheckStatus int

type CleanOptions struct {
	// DryRun previews what would be removed without making changes.
	DryRun bool

	// Force skips the confirmation prompt (handled by caller).
	Force bool
}

type CleanResult struct {
	// Orphans is the list of orphaned entries found.
	Orphans []OrphanEntry

	// RemovedCount is the number of files removed (0 if dry-run).
	RemovedCount int

	// DryRun indicates whether this was a dry-run.
	DryRun bool
}

type CreateOptions struct {
	// Email is the user's email address for identification.
	Email string

	// DeviceName is a custom device name (auto-generated from hostname if empty).
	DeviceName string

	// Force overwrites existing keys if true.
	Force bool
}

type CreatePreCheckResult struct {
	// NeedsEmail indicates whether an email needs to be provided.
	NeedsEmail bool

	// ExistingEmail is the email from the user config (if any).
	ExistingEmail string
}

type CreateResult struct {
	// Email is the validated email address used.
	Email string

	// DeviceName is the device name (provided or auto-generated).
	DeviceName string

	// UserUUID is the user's unique identifier.
	UserUUID string

	// PublicKeyPath is where the public key was saved in the project.
	PublicKeyPath string

	// KanukaKeyDeleted indicates if an existing .kanuka key was removed.
	KanukaKeyDeleted bool

	// DeletedKanukaKeyPath is the path of the deleted key (if any).
	DeletedKanukaKeyPath string
}

type DecryptOptions struct {
	// FilePatterns specifies files to decrypt. If empty, all .kanuka files are decrypted.
	FilePatterns []string

	// DryRun previews which files would be decrypted without making changes.
	DryRun bool

	// PrivateKeyData contains the private key bytes when reading from stdin.
	// If nil, the private key is loaded from disk.
	PrivateKeyData []byte
}

type DecryptResult struct {
	// DecryptedFiles lists the .env files that were created.
	DecryptedFiles []string

	// SourceFiles lists the .kanuka files that were decrypted.
	SourceFiles []string

	// ProjectPath is the root path of the project.
	ProjectPath string

	// DryRun indicates whether this was a dry-run (no files modified).
	DryRun bool

	// ExistingFiles lists files that already exist and would be overwritten.
	ExistingFiles []string
}

type DoctorOptions struct {
}

type DoctorResult struct {
	Checks      []CheckResult `json:"checks"`
	Summary     DoctorSummary `json:"summary"`
	Suggestions []string      `json:"suggestions,omitempty"`
}

type DoctorSummary struct {
	Passed   int `json:"passed"`
	Warnings int `json:"warnings"`
	Errors   int `json:"errors"`
}

type EncryptOptions struct {
	// FilePatterns specifies files to encrypt. If empty, all .env files are encrypted.
	FilePatterns []string

	// DryRun previews which files would be encrypted without making changes.
	DryRun bool

	// PrivateKeyData contains the private key bytes when reading from stdin.
	// If nil, the private key is loaded from disk.
	PrivateKeyData []byte
}

type EncryptResult struct {
	// EncryptedFiles lists the .kanuka files that were created.
	EncryptedFiles []string

	// SourceFiles lists the .env files that were encrypted.
	SourceFiles []string

	// ProjectPath is the root path of the project.
	ProjectPath string

	// DryRun indicates whether this was a dry-run (no files modified).
	DryRun bool
}

type ExportOptions struct {
	// OutputPath is the path for the output archive.
	// If empty, defaults to kanuka-secrets-YYYY-MM-DD.tar.gz.
	OutputPath string
}

type ExportResult struct {
	// ConfigIncluded indicates whether config.toml was included.
	ConfigIncluded bool

	// PublicKeyCount is the number of public keys included.
	PublicKeyCount int

	// UserKeyCount is the number of user .kanuka files included.
	UserKeyCount int

	// SecretFileCount is the number of encrypted secret files included.
	SecretFileCount int

	// TotalFilesCount is the total number of files in the archive.
	TotalFilesCount int

	// OutputPath is the path to the created archive.
	OutputPath string
}

type FileStatus string

type FileStatusInfo struct {
	// Path is the relative path of the file.
	Path string

	// Status is the encryption status of the file.
	Status FileStatus

	// PlaintextMtime is the modification time of the plaintext file (if any).
	PlaintextMtime string

	// EncryptedMtime is the modification time of the encrypted file (if any).
	EncryptedMtime string
}

type FileToRevoke struct {
	Path string
	Name string
}

type ImportMode int

type ImportOptions struct {
	// ArchivePath is the path to the tar.gz archive.
	ArchivePath string

	// ProjectPath is the path to the project directory.
	// If empty, uses the current working directory.
	ProjectPath string

	// Mode is the import strategy (merge or replace).
	Mode ImportMode

	// DryRun previews the import without making changes.
	DryRun bool
}

type ImportPreCheckResult struct {
	// ArchiveFiles is the list of files in the archive.
	ArchiveFiles []string

	// KanukaExists indicates whether a .kanuka directory already exists.
	KanukaExists bool

	// ProjectPath is the resolved project path.
	ProjectPath string
}

type ImportResult struct {
	// FilesAdded is the count of new files added (merge mode).
	FilesAdded int

	// FilesSkipped is the count of files skipped because they exist (merge mode).
	FilesSkipped int

	// FilesReplaced is the count of files extracted (replace mode).
	FilesReplaced int

	// TotalFiles is the total number of files in the archive.
	TotalFiles int

	// DryRun indicates whether this was a dry-run.
	DryRun bool

	// Mode is the import mode used.
	Mode ImportMode
}

type InitOptions struct {
	// ProjectName is the name for the project. If empty, uses the directory name.
	ProjectName string

	// Verbose enables verbose logging output.
	Verbose bool
}

type InitResult struct {
	// ProjectName is the name of the initialized project.
	ProjectName string

	// ProjectUUID is the unique identifier assigned to the project.
	ProjectUUID string

	// DeviceName is the name assigned to this device for the project.
	DeviceName string

	// ProjectPath is the root path of the project.
	ProjectPath string
}

type LogOptions struct {
	// Limit is the maximum number of entries to return. 0 means no limit.
	Limit int

	// Reverse orders entries from most recent to oldest when true.
	Reverse bool

	// User filters entries by user email.
	User string

	// Operations filters entries by operation types (comma-separated).
	Operations string

	// Since filters entries after this date (YYYY-MM-DD format).
	Since string

	// Until filters entries before this date (YYYY-MM-DD format).
	Until string
}

type LogResult struct {
	// Entries are the filtered audit log entries.
	Entries []audit.Entry

	// TotalEntriesBeforeFilter is the count of entries before filtering.
	TotalEntriesBeforeFilter int
}

type OrphanEntry struct {
	// UUID is the user UUID from the orphaned file.
	UUID string

	// FilePath is the absolute path to the orphaned file.
	FilePath string

	// RelativePath is the path relative to the project root.
	RelativePath string
}

type RegisterMode string

type RegisterOptions struct {
	// Mode specifies how the user is being registered.
	Mode RegisterMode

	// UserEmail is the email of the user to register (required for email and pubkey_text modes).
	UserEmail string

	// PublicKeyText contains the public key content (for pubkey_text mode).
	PublicKeyText string

	// FilePath is the path to the public key file (for file mode).
	FilePath string

	// DryRun previews registration without making changes.
	DryRun bool

	// PrivateKeyData contains the private key bytes when reading from stdin.
	PrivateKeyData []byte

	// Force skips confirmation when updating existing user's access.
	Force bool

	// Verbose enables verbose output.
	Verbose bool

	// Debug enables debug output.
	Debug bool
}

type RegisterResult struct {
	// DisplayName is the user-friendly name of who was registered.
	DisplayName string

	// TargetUserUUID is the UUID of the registered user.
	TargetUserUUID string

	// FilesCreated lists files that were created.
	FilesCreated []RegisteredFile

	// FilesUpdated lists files that were updated.
	FilesUpdated []RegisteredFile

	// DryRun indicates whether this was a dry-run (no changes made).
	DryRun bool

	// UserAlreadyHadAccess indicates if user already had access before this registration.
	UserAlreadyHadAccess bool

	// PubKeyPath is the path where the public key is/would be stored.
	PubKeyPath string

	// KanukaFilePath is the path where the .kanuka key is/would be stored.
	KanukaFilePath string

	// Mode indicates which registration mode was used.
	Mode RegisterMode
}

type RegisteredFile struct {
	Type string // "public_key" or "encrypted_key"
	Path string
}

type RevokeOptions struct {
	// UserEmail is the email of the user whose access is being revoked.
	UserEmail string

	// FilePath is an alternative way to specify revocation by .kanuka file path.
	FilePath string

	// DeviceName specifies a specific device to revoke (requires UserEmail).
	DeviceName string

	// DryRun previews revocation without making changes.
	DryRun bool

	// PrivateKeyData contains the private key bytes when reading from stdin.
	PrivateKeyData []byte

	// Verbose enables verbose output.
	Verbose bool

	// Debug enables debug output.
	Debug bool
}

type RevokeResult struct {
	// DisplayName is the user-friendly name of who was revoked.
	DisplayName string

	// RevokedFiles lists the files that were deleted.
	RevokedFiles []string

	// UUIDsRevoked lists the UUIDs that were removed from config.
	UUIDsRevoked []string

	// RemainingUsers is the count of users still in the project.
	RemainingUsers int

	// SecretsReEncrypted is the count of secrets re-encrypted.
	SecretsReEncrypted int

	// DryRun indicates whether this was a dry-run (no changes made).
	DryRun bool

	// FilesToDelete lists files that would be deleted (for dry-run).
	FilesToDelete []FileToRevoke

	// AllUsers lists all users currently in the project (for dry-run info).
	AllUsers []string

	// KanukaFilesCount is the number of .kanuka secret files (for dry-run info).
	KanukaFilesCount int
}

type RotateOptions struct {
	// Force skips the confirmation prompt (handled by caller).
	// This field is informational; the actual prompting is done in the cmd layer.
	Force bool

	// PrivateKeyData contains the private key bytes when reading from stdin.
	// If nil, the private key is loaded from disk.
	PrivateKeyData []byte
}

type RotateResult struct {
	// UserUUID is the UUID of the user whose keys were rotated.
	UserUUID string

	// ProjectUUID is the UUID of the project.
	ProjectUUID string

	// PrivateKeyPath is where the new private key was saved.
	PrivateKeyPath string

	// PublicKeyPath is where the new public key was saved (user directory).
	PublicKeyPath string

	// ProjectPublicKeyPath is where the new public key was copied (project directory).
	ProjectPublicKeyPath string
}

type StatusOptions struct {
}

type StatusResult struct {
	// ProjectName is the name of the project.
	ProjectName string

	// Files contains the status of each discovered file.
	Files []FileStatusInfo

	// Summary contains counts of files by status.
	Summary StatusSummary
}

type StatusSummary struct {
	// Current is the count of files that are up to date.
	Current int

	// Stale is the count of files where plaintext was modified after encryption.
	Stale int

	// Unencrypted is the count of files that have no encrypted version.
	Unencrypted int

	// EncryptedOnly is the count of files that only have an encrypted version.
	EncryptedOnly int
}

type SyncOptions struct {
	// DryRun previews sync without making changes.
	DryRun bool

	// PrivateKeyData contains the private key bytes when reading from stdin.
	// If nil, the private key is loaded from disk.
	PrivateKeyData []byte
}

type SyncResult struct {
	// SecretsProcessed is the number of secret files re-encrypted.
	SecretsProcessed int

	// UsersProcessed is the number of users who received the new key.
	UsersProcessed int

	// UsersExcluded is the number of users excluded from the new key.
	UsersExcluded int

	// DryRun indicates whether this was a dry-run.
	DryRun bool
}

type UserAccessInfo struct {
	// UUID is the user's unique identifier.
	UUID string

	// Email is the user's email address.
	Email string

	// DeviceName is the user's device name.
	DeviceName string

	// Status is the user's access status.
	Status UserStatus
}

type UserStatus string