config

type CIConfig struct {
	None  string   `yaml:"none"`  // green|prompt|block; default green
	Grace Duration `yaml:"grace"` // how long to wait for checks to appear; default 3m
}

type ClusterSecret struct {
	Namespace string `yaml:"namespace,omitempty"`
	Secret    string `yaml:"secret,omitempty"`
}

type Config struct {
	Repos       []RepoConfig      `yaml:"repos,omitempty"`
	Registries  []RegistryConfig  `yaml:"registries,omitempty"`
	Poll        PollConfig        `yaml:"poll"`
	Preferences PreferencesConfig `yaml:"preferences"`

	// File is the path Load read, or looked for. Found reports whether it existed.
	File  string `yaml:"-"`
	Found bool   `yaml:"-"`
}

type Duration time.Duration

type EnvsConfig struct {
	Production []string          `yaml:"production,omitempty"`
	Pairs      map[string]string `yaml:"pairs,omitempty"`    // source env -> target env
	Approval   map[string]string `yaml:"approval,omitempty"` // env -> comment|auto
}

type KubeConfig struct {
	Context string `yaml:"context,omitempty"`
	// ArgoNamespace is the namespace Argo CD Application custom resources live in — the
	// control-plane namespace (conventionally "argocd"), which is a different thing from
	// spec.destination.namespace (the workload's own target env: see gitops.Env's doc
	// comment, and every family's Application wrapper in this repo's own fixtures, which sets
	// metadata.namespace: argocd distinctly from spec.destination.namespace). pkg/argo's
	// invariant 1 requires this be confirmed from config rather than assumed a fixed
	// "argocd" — Normalize fills the "argocd" default so it need not be spelled out in every
	// config file, but the value driving pkg/argo always came from here, never a hardcoded
	// literal in pkg/argo itself.
	ArgoNamespace string `yaml:"argo_namespace,omitempty"`
}

type PollConfig struct {
	CI       Duration `yaml:"ci"`
	Approval Duration `yaml:"approval"`
	Argo     Duration `yaml:"argo"`
	Rollout  Duration `yaml:"rollout"`
	Deadline Duration `yaml:"deadline"`
}

type PreferencesConfig struct {
	// OpenPR controls what pressing o on the flight screen does with a promotion's PR URL
	// (flight.OpenPRMsg, cmd/hoist/wiring.go): "launch" attempts to open it in a browser and
	// stays silent on success (M4's original behavior, for a desktop session with one to
	// open into); "display" only ever shows the URL as text (for a headless/SSH session with
	// no browser to launch into at all — see AGENTS.md's own note on this); "both" attempts
	// the launch AND always shows the URL as text regardless of outcome, so a copy/paste
	// fallback exists even on a desktop session where launching usually just works. Default
	// "both": it never regresses the desktop case (launch is still attempted) and never
	// leaves a headless session with nothing to act on.
	OpenPR string `yaml:"open_pr"`
	// BrowserLaunchTimeout bounds one "launch" attempt (cmd/hoist/wiring.go's runLauncher) —
	// see its own doc comment for why this bounds the LAUNCHER's exit, not the browser
	// window's own lifetime, and is safe to leave short. Default 5s.
	BrowserLaunchTimeout Duration `yaml:"browser_launch_timeout"`
}

type RegistryConfig struct {
	Prefix  string        `yaml:"prefix"`
	Auth    []string      `yaml:"auth"` // order tried; default env, keychain, cluster, op
	Cluster ClusterSecret `yaml:"cluster"`
	Op      string        `yaml:"op,omitempty"` // op://vault/item/field; redacted by Redacted
}

type RepoConfig struct {
	Name          string            `yaml:"name,omitempty"`       // label; defaults to the basename of Path
	Path          string            `yaml:"path,omitempty"`       // checkout, as written (~ allowed); see Dir
	GitHub        string            `yaml:"github,omitempty"`     // owner/name; M3
	AppsRoot      string            `yaml:"apps_root"`            // default cluster/apps
	Promotable    []string          `yaml:"promotable,omitempty"` // image repo prefixes; replaces the CLI placeholder when set
	Envs          EnvsConfig        `yaml:"envs"`
	Approvers     []string          `yaml:"approvers,omitempty"`     // M4
	Collaborators bool              `yaml:"collaborators,omitempty"` // M4: also accept a write-permission collaborator, per Forge.IsAllowedAuthor
	CI            CIConfig          `yaml:"ci"`                      // M4
	Kube          KubeConfig        `yaml:"kube,omitempty"`          // M2
	DigestSources []string          `yaml:"digest_sources"`          // M2; default pods, manifest, registry
	Apps          map[string]string `yaml:"apps,omitempty"`          // image repo -> app git repo; M7
	// Migrations maps an image repo (an Apps key) to the path prefix under which its app repo
	// keeps database migrations, or "none". Filled to DefaultMigrationsPath by Normalize for
	// every Apps key that lacks one; the app repo's own .hoist.yaml overrides either
	// (pkg/migrate.MigrationsPath). M10.
	Migrations map[string]string `yaml:"migrations,omitempty"`

	// Dir is Path with ~ expanded and cleaned; Key is this entry's YAML path (repos[N]).
	// Both are derived by Normalize.
	Dir string `yaml:"-"`
	Key string `yaml:"-"`
}