preflight

type AuthSpec struct {
	Mode   string
	Key    string
	KeyEnv string
}

type ChildAuthBootstrap struct {
	EnvKey string
	Value  string
}

type Options struct {
	Upstream                         string
	EgressProxy                      string
	ParentEnv                        []string
	WorkingDirectory                 string
	ChildArgs                        []string
	ModelAliasFile                   string
	ModelAliasPairs                  []string
	AllowProviderModelPassthrough    bool
	AllowAuthPassthroughToThirdParty bool
	UpstreamHeaderFile               string
	UpstreamHeaderPairs              []string
	// Profile is the per-field overlay contributed by a selected
	// provider profile. nil => inherit-env: behavior is exactly
	// the env-only path (byte-identical Result). The launch path
	// (cmd/ccwrap) sets this; the live-swap path reuses ResolveProfile.
	Profile *ProfileInput
	// File-content snapshots for byte-faithful switch resolution. Populated by
	// the launcher at launch (cmd/ccwrap/main.go composeLaunch); the doctor
	// command leaves them nil ⇒ disk-read fallback. When non-empty, the
	// resolver MUST use the content and MUST NOT read disk for that tier input.
	ModelAliasExplicitFileContent     []byte // overrides ModelAliasFile reads
	ModelAliasEnvFileContent          []byte // overrides CCWRAP_MODEL_ALIASES_FILE-path reads
	UpstreamHeaderExplicitFileContent []byte // overrides UpstreamHeaderFile reads
	UpstreamHeaderEnvFileContent      []byte // overrides CCWRAP_UPSTREAM_HEADERS_FILE-path reads
}

type ProfileInput struct {
	Name            string
	Provider        string
	BaseURL         string
	Auth            *AuthSpec
	ModelAliases    map[string]string
	UpstreamHeaders map[string]string
	EgressMode      string // "" | "inherit" | "direct" | "http"
	EgressURL       string
}

type ProfileView struct {
	Name            string              `json:"name,omitempty"`
	ProviderLabel   string              `json:"provider_label,omitempty"`
	BaseURLHost     string              `json:"base_url_host,omitempty"`
	ModelAliasCount int                 `json:"model_alias_count,omitempty"`
	EgressSummary   string              `json:"egress_summary,omitempty"`
	RelaunchClass   model.RelaunchClass `json:"relaunch_class,omitempty"`
	AuthPolicy      model.AuthPolicy    `json:"auth_policy,omitempty"`
}

type Result struct {
	APIBaseURL             *url.URL
	RouteSource            model.RouteSource
	RouteConfigSource      string
	RouteClass             model.RouteClass
	AuthMode               model.AuthMode
	AuthSource             model.AuthSource
	AuthConfigSource       string
	AuthPolicy             model.AuthPolicy
	AuthBootstrap          model.AuthBootstrap
	AuthBootstrapKind      model.AuthBootstrapKind
	AuthBootstrapEnvKey    string
	OverrideAuth           *model.AuthOverride
	ActiveSources          []string
	APIKeyHelperHits       []string
	DangerousShellSettings []settings.EnvConflict
	UnsupportedEnv         []string
	UnsupportedSettings    []settings.EnvConflict
	MalformedSettingsEnv   []settings.MalformedEnvIssue
	OverriddenNetworkEnv   []settings.EnvConflict
	PolicyNetworkEnv       []settings.EnvConflict
	CustomAuthHeaderEnv    []settings.EnvConflict
	ModelOverrideHits      []settings.EnvConflict
	ParsedFlagSettings     *settings.ParsedFlagSettings
	RewrittenChildArgs     []string
	Egress                 model.EgressConfig
	ModelEnv               map[string]string
	ModelConfigSources     []string
	ModelAlias             modelalias.Config
	UpstreamHeaders        upstreamheaders.Config
	Notes                  []string
	// Active provider-profile identity (the switcher and posture
	// timeline read these; empty => inherit-env).
	// Non-secret: name + group label only, never a credential.
	ActiveProfileName     string
	ActiveProfileProvider string
	// MissingAuthEnv names the env var that an active profile's `auth.key_env`
	// pointed at when no value was found in the process env (the profile-overlay
	// path's "key_env named but env missing" branch). It is empty in the
	// broader "no auth source at all" case (third-party-hidden + resolved
	// mode==passthrough), because there is no specific env to name. UI/error
	// surfaces branch on emptiness:
	//   non-empty → "profile X needs $Y"   (concrete recovery target)
	//   empty     → "profile X has no auth source configured"
	// Always paired with AuthBootstrap == AuthBootstrapMissing — the boolean
	// signal; MissingAuthEnv is the detail.
	//
	// Fail-closed is enforced on the forward path (request-time) rather than in
	// preflight (launch-time). When AuthBootstrap==Missing the launch SUCCEEDS
	// so inspect/popover/switch tools are reachable; only an actual request to a
	// host requiring ccwrap-owned auth gets refused.
	MissingAuthEnv string
}