class oci::vendor_repo (
  Array[Hash] $repositories,
) {

  $current_arch = $facts['os']['architecture']

  include apt

  ensure_resource('file', '/etc/apt/keyrings', {
    'ensure'  => 'directory',
    'mode'    => '0755',
    'owner'   => 'root',
    'group'   => 'root',
  })

  $compatible_repositories = $repositories.filter |$repo| {
    if $repo['supported_arch'] {
      $supported_arch_list_tmp = split($repo['supported_arch'], ',')
      $supported_arch_list = $supported_arch_list_tmp.map |$arch| { strip($arch) }
      $current_arch in $supported_arch_list
    } else {
      # If no supported_arch is specified, assume it's compatible
      true
    }
  }

  # Collect packages ONLY from compatible repositories
  $all_packages = $compatible_repositories
    .map |$repo| {
      if $repo['target_package_list'] {
        $raw_list = split($repo['target_package_list'], ',')
        $raw_list.map |$pkg| { strip($pkg) }
      } else {
        []
      }
    }
    .flatten()
    .unique()

  # Iterate over each repository definition passed from the ENC
  $compatible_repositories.each |Hash $repo| {
    # Extract values
    $repo_name        = $repo['name']
    $sources_content  = $repo['sources']
    $key_base64       = $repo['key_base64']
    $pinning_base64   = $repo['pinning_file_base64']
    $suites_mode      = $repo['suites']

    # Dynamic file paths
    $sources_file_path = "/etc/apt/sources.list.d/oci-vendor-${repo_name}.sources"
    $key_file_path     = "/etc/apt/keyrings/oci-vendor-${repo_name}.asc"
    $pref_file_path    = "/etc/apt/preferences.d/oci-vendor-${repo_name}.pref"

    # 1. Prepare the sources content
    if $suites_mode == 'osversion' {
      if $facts['os']['lsb'] != undef{
        $mycodename = $facts['os']['lsb']['distcodename']
      }else{
        $mycodename = $facts['os']['distro']['codename']
      }
      if $sources_content =~ /%%OS_VERSION%%/ {
        $final_sources_content = regsubst($sources_content, '%%OS_VERSION%%', $mycodename, 'G')
      }else{
        $final_sources_content = regsubst($sources_content, '^Suites:\s*\S+', "Suites: ${mycodename}", 'G')
      }
    }else{
      $final_sources_content = $sources_content
    }

    # 2. Manage the .sources file
    file { $sources_file_path:
      ensure  => file,
      content => $final_sources_content,
      owner   => 'root',
      group   => 'root',
      mode    => '0644',
      notify  => Class['apt::update'],
    }

    # 3. Manage the GPG Key
    if $key_base64 {
      $key_content = base64('decode', $key_base64)
      
      file { $key_file_path:
        ensure  => file,
        content => $key_content,
        owner   => 'root',
        group   => 'root',
        mode    => '0644',
        require => File[$sources_file_path],
        notify  => Class['apt::update'],
      }
    }

    # 4. Manage APT Pinning (Optional)
    if $pinning_base64 {
      $pref_content = base64('decode', $pinning_base64)

      file { $pref_file_path:
        ensure  => file,
        content => $pref_content,
        owner   => 'root',
        group   => 'root',
        mode    => '0644',
        require => File[$sources_file_path],
        notify  => Class['apt::update'],
      }
    }
  }

  # 6. Deduplicate and Declare Packages ONCE
  # unique() removes duplicates from the array
  $unique_packages = unique($all_packages)

  if length($unique_packages) > 0 {
    package { $unique_packages:
      ensure => installed,
      # We require the apt update class generally, or specific files if needed
      # Since packages might come from different repos, requiring a specific file is tricky.
      # Relying on 'apt::update' notification chain is usually safer for repos.
      require => Class['apt::update'],
    }
  }
}
