package main

// ScanContext holds all resolved scan state, built once before any check runs.
// It is read-only to checks.
type ScanContext struct {
	repoRoot              string
	backendDir            string
	orchestratorOnly      bool
	includeCoreTargets    bool
	backendTargets        []backendScanTarget
	pluginTargets         []pluginScanTarget // filtered
	resolvedPluginTargets []pluginScanTarget // pre-filter
	frontendTargets       []frontendScanTarget
	unresolvedPluginRoots []string
	pluginPageDirs        []string
}

// Reporter accumulates the process exit code across checks.
type Reporter struct {
	exitCode int
}

// Fail marks the overall run as failed (exit code 1).
func (r *Reporter) Fail() { r.exitCode = 1 }

// Check is one registered safety check. Run prints its own header and results
// and calls rep.Fail() on violations, exactly as the original inline block did.
type Check struct {
	Seq   int
	ID    string
	Title string
	Run   func(ctx *ScanContext, rep *Reporter)
}

var registry []Check

func register(c Check) { registry = append(registry, c) }