cfg

type AwsSection struct {
	ReadOnly *bool `toml:"read_only"` // default: false (nil = not set → full access)
}

type BuildSection struct {
	Memory  string `toml:"memory"`   // docker --memory ceiling (e.g. "16g"); "0" = uncapped; env: DEVCELL_BUILD_MEMORY
	CPUs    string `toml:"cpus"`     // docker --cpus quota (e.g. "8"); "0" = no quota; env: DEVCELL_BUILD_CPUS
	MaxJobs int    `toml:"max_jobs"` // nix max-jobs; 0 = derived from ceiling; env: DEVCELL_NIX_MAX_JOBS
	Cores   int    `toml:"cores"`    // nix cores (make -j per job); 0 = derived; env: DEVCELL_NIX_CORES
	Threads int    `toml:"threads"`  // nix download threads (max-substitution-jobs + http-connections); 0 = 128; env: DEVCELL_BUILD_THREADS
}

type CellConfig struct {
	Cell      CellSection
	Docker    DockerSection  `toml:"docker"`
	Build     BuildSection   `toml:"build"`
	Nix       NixSection     `toml:"nix"`
	LLM       LLMSection     `toml:"llm"`
	Git       GitSection     `toml:"git"`
	Ports     PortsSection   `toml:"ports"`
	Op        OpSection      `toml:"op"`
	Secrets   SecretsSection `toml:"secrets"`
	Aws       AwsSection     `toml:"aws"`
	Mcp       McpSection     `toml:"mcp"`
	Stealth   StealthSection `toml:"stealth"`
	GUI       GUISection     `toml:"gui"`
	Theme     ThemeSection   `toml:"theme"`
	Network   NetworkSection `toml:"network"`
	Env       map[string]string
	Mise      map[string]string `toml:"mise"` // [mise] — keys map to MISE_<UPPER_KEY> env vars
	Volumes   []VolumeMount
	Packages  PackagesSection
	Wireguard []WireguardEntry `toml:"wireguard"`

	DeprecatedUses []DeprecatedUse `toml:"-"` // deprecated keys found while loading, in file order
}

type CellSection struct {
	ImageTag         string            `toml:"image_tag"`
	Registry         string            `toml:"registry"`                // container registry; default: DefaultRegistry; env: DEVCELL_REGISTRY
	GUI              *bool             `toml:"gui"`                     // default: true (nil = not set → true)
	Timezone         string            `toml:"timezone"`                // IANA tz (e.g. "Europe/Prague"); default: host $TZ
	Locale           string            `toml:"locale"`                  // POSIX locale (e.g. "en_US.UTF-8"); default: "en_US.UTF-8"
	Stack            string            `toml:"stack"`                   // nix stack name (e.g. "go", "python"); default: "base" (see ResolvedStack)
	Modules          []string          `toml:"modules"`                 // extra nix modules to compose on top of stack
	NixhomePath      string            `toml:"nixhome"`                 // deprecated: use [nix] nixhome instead
	OS               string            `toml:"os"`                      // guest OS: "linux" (default), "macos", "windows" or "winpe"; derives engine when [cell].engine is unset
	Engine           string            `toml:"engine"`                  // execution engine: "docker" (default), "tart" or "winkit"
	VagrantProvider  string            `toml:"vagrant_provider"`        // retired vagrant engine; parsed only so the deprecation warning fires
	VagrantBox       string            `toml:"vagrant_box"`             // retired vagrant engine; parsed only so the deprecation warning fires
	KVM              *bool             `toml:"kvm"`                     // pass the daemon host's /dev/kvm into the container so QEMU gets hardware accel instead of TCG; default: false; env: DEVCELL_KVM
	PerCellImage     *bool             `toml:"per_cell_image"`          // tag user image per cell instead of per stack; default: false
	Hostname         string            `toml:"hostname"`                // override container hostname; default: computed "devcell-<cellname>"; env: DEVCELL_HOSTNAME
	MacAddress       string            `toml:"mac_address"`             // MAC for the container's NIC (XX:XX:XX:XX:XX:XX); pinned across restarts for infra-side identity persistence. Honored on user-defined bridge networks (devcell uses --network devcell-network). Empty → docker auto-assigns a random MAC per launch.
	Thin             *bool             `toml:"thin"`                    // thin image mode; default: true; disable with thin=false or DEVCELL_THIN=0
	StaleWarning     *bool             `toml:"stale_warning"`           // CELL-391 "cell is behind — parallel reality" nudge at start; default: true; env: DEVCELL_STALE_WARN
	Background       *bool             `toml:"background"`              // keep VM/container running after shell exit; default: false; env: DEVCELL_BACKGROUND
	Experimental     StringList        `toml:"experimental"`            // opt-in experimental features, e.g. ["ui-cage", "ui-boot-popup"]; flag: --experimental=a,b; env: DEVCELL_EXPERIMENTAL=a,b; names and the gate live in internal/experiments
	TartSSHPort      int               `toml:"tart_ssh_port"`           // SSH port for tart engine; default: 22; env: DEVCELL_TART_SSH_PORT
	TartSSHHost      string            `toml:"tart_ssh_host"`           // SSH host for tart engine; default: "localhost"; env: DEVCELL_TART_SSH_HOST
	TartSSHUser      string            `toml:"tart_ssh_user"`           // SSH user for tart engine; default: "admin"; env: DEVCELL_TART_SSH_USER
	TartSSHKey       string            `toml:"tart_ssh_key"`            // path to SSH private key for tart; env: DEVCELL_TART_SSH_KEY
	TartOCIImage     string            `toml:"tart_oci_image"`          // OCI base image for tart VMs; default: DefaultTartOCIImage; env: DEVCELL_TART_OCI_IMAGE
	WinkitSSHPort    int               `toml:"winkit_ssh_port"`         // SSH port for winkit engine; default: allocated per cell ID; env: DEVCELL_WINKIT_SSH_PORT
	WinkitWindowsISO string            `toml:"winkit_windows_iso"`      // path to Windows ARM64 ISO for winkit engine; env: DEVCELL_WINKIT_WINDOWS_ISO
	WinkitCPUs       int               `toml:"winkit_cpus"`             // winkit VM vCPUs; default: 4; env: DEVCELL_WINKIT_CPUS
	WinkitMemoryGB   int               `toml:"winkit_memory_gb"`        // winkit VM RAM in GB; default: 4; env: DEVCELL_WINKIT_MEMORY_GB
	QemuSSHPort      int               `toml:"qemu_ssh_port" hm:"-"`    // deprecated spelling of winkit_ssh_port; merged into it by LoadFile
	QemuSSHHost      string            `toml:"qemu_ssh_host"`           // deprecated, no effect; parsed only so the deprecation warning fires
	QemuWindowsISO   string            `toml:"qemu_windows_iso" hm:"-"` // deprecated spelling of winkit_windows_iso; merged into it by LoadFile
	QemuCPUs         int               `toml:"qemu_cpus" hm:"-"`        // deprecated spelling of winkit_cpus; merged into it by LoadFile
	QemuMemoryGB     int               `toml:"qemu_memory_gb" hm:"-"`   // deprecated spelling of winkit_memory_gb; merged into it by LoadFile
	QemuDiskSizeGB   int               `toml:"qemu_disk_size_gb"`       // no effect; parsed only so the deprecation warning fires
	QemuDisplay      string            `toml:"qemu_display"`            // deprecated, no effect; parsed only so the deprecation warning fires
	LibvirtURI       string            `toml:"libvirt_uri"`             // retired libvirt engine; parsed only so the deprecation warning fires
	LibvirtPathMap   map[string]string `toml:"libvirt_path_map"`        // container prefix -> host prefix rewrites for domain XML paths (CELL-375); empty = CLI runs on the host
	QemuProjectSync  string            `toml:"qemu_project_sync"`       // retired with the libvirt engine; parsed only so the deprecation warning fires
	DefaultCommand   string            `toml:"default_command"`         // subcommand to run when `cell` is invoked with no args; env: DEVCELL_DEFAULT_COMMAND
	DockerSocket     *bool             `toml:"docker_socket"`           // mount /var/run/docker.sock into the container; default: true; env: DEVCELL_DOCKER_SOCKET
	Flake            *bool             `toml:"flake"`                   // enable project-level flake.nix install; default: false (opt-in); env: DEVCELL_FLAKE
	Packages         []string          `toml:"packages"`                // nix packages from the stable channel, baked into the image at build time
	Volumes          []string          `toml:"volumes"`                 // shorthand volume list: "/path", "/host:/container", "/host:/container:ro"
	Ports            []string          `toml:"ports"`                   // shorthand port forwards: "3000", "8080:3000" (merged into [ports] forward)
	Mcps             []string          `toml:"mcps"`                    // shorthand MCP servers to enable: ["playwright", "aws-api"] (merged into [mcp] enabled)
}

type DeprecatedUse struct {
	Deprecation
	File string
}

type Deprecation struct {
	Path        []string // old TOML key path, e.g. {"ports", "forward"}
	Name        string   // old key as users write it, e.g. "[ports] forward"
	Replacement string   // new key, e.g. "[cell] ports"
	Message     string   // what the user should do, shown verbatim, e.g. `use [cell] ports = ["3000"] instead`
}

type DockerPolicy interface {
	Policy
	DropAllCaps() bool
	SafeCaps() []string
	DeniedCaps() map[string]bool
	DenyPrivileged() bool
	DenyDockerSock() bool
	DenyUserVolumes() bool
	DeniedMountPaths() []string
	DenyOpRun() bool
	DenyInheritEnv() bool
	DenyWireguard() bool
	DenyKVM() bool
	DenyTUN() bool
}

type DockerSection struct {
	Privileged bool     `toml:"privileged"` // run container with --privileged; default: false
	CapAdd     []string `toml:"cap_add"`    // extra Linux capabilities (e.g. ["SYS_ADMIN"]); default: none
	MemLimit   string   `toml:"mem_limit"`  // docker --memory ceiling (e.g. "4g"); "0" = uncapped; env: DEVCELL_DOCKER_MEM_LIMIT
	CPULimit   string   `toml:"cpu_limit"`  // docker --cpus quota (e.g. "2"); "0" = no quota; env: DEVCELL_DOCKER_CPU_LIMIT
	ShmSize    string   `toml:"shm_size"`   // docker --shm-size (e.g. "1g"); env: DEVCELL_DOCKER_SHM_SIZE
}

type GUISection struct {
	Enabled    *bool  `toml:"enabled"`    // default: true (nil = not set → true)
	WM         string `toml:"wm"`         // "icewm" (default) or "fluxbox"
	Resolution string `toml:"resolution"` // logical resolution; default: "1920x1080x24"
	Scale      int    `toml:"scale"`      // display scale factor (1=96dpi, 2=192dpi HiDPI); default: 1
}

type GitSection struct {
	AuthorName     string `toml:"author_name"`
	AuthorEmail    string `toml:"author_email"`
	CommitterName  string `toml:"committer_name"`
	CommitterEmail string `toml:"committer_email"`
}

type LLMModelsSection struct {
	Default   string                 `toml:"default"`
	Providers map[string]LLMProvider `toml:"providers"`
}

type LLMProvider struct {
	BaseURL string   `toml:"base_url"`
	Models  []string `toml:"models"`
}

type LLMSection struct {
	SystemPrompt           string `toml:"system_prompt"`
	SystemPromptFile       string `toml:"system_prompt_file"`
	AppendSystemPrompt     string `toml:"append_system_prompt"`
	AppendSystemPromptFile string `toml:"append_system_prompt_file"`

	Provider  string                 `toml:"provider"`  // default | ollama | openrouter
	Model     string                 `toml:"model"`     // the provider's own model ID, no prefix
	Providers map[string]LLMProvider `toml:"providers"` // per-provider base_url + models

	// Deprecated keys, migrated into the fields above by migrateLLM.
	UseOllama     bool             `toml:"use_ollama" hm:"-"`
	UseOpenRouter bool             `toml:"use_openrouter" hm:"-"`
	Models        LLMModelsSection `toml:"models" hm:"-"`
}

type McpSection struct {
	Enabled []string `toml:"enabled"` // MCP server names to enable (e.g. ["aws-api", "terraform"])
}

type MigrationChange struct {
	Key    string // the deprecated key as the user wrote it, e.g. "[cell] qemu_ssh_port"
	Action string // what happened to it, e.g. `renamed to [cell] winkit_ssh_port`
}

type MigrationResult struct {
	Before  string
	After   string
	Changes []MigrationChange
}

type MissingEnvError struct {
	// Refs maps each missing host var name to the [env].<key> paths that
	// referenced it (the same var may be referenced from multiple [env] keys).
	Refs map[string][]string
}

type NetworkProxySection struct {
	Enabled          *bool    `toml:"enabled"`
	Mode             string   `toml:"mode"`
	Presets          []string `toml:"presets"`
	Allow            []string `toml:"allow"`
	Block            []string `toml:"block"`
	AllowHostNetwork *bool    `toml:"allow_host_network"`
	Log              *bool    `toml:"log"`
	Image            string   `toml:"image"`
}

type NetworkSection struct {
	Proxy NetworkProxySection `toml:"proxy"`
}

type NixPackages struct {
	Stable   []string `toml:"stable"`
	Unstable []string `toml:"unstable"`
	Edge     []string `toml:"edge"`
}

type NixSection struct {
	Image       string `toml:"image"`   // nix core image for thin builds; default: DefaultNixImage; env: DEVCELL_NIX_IMAGE
	NixhomePath string `toml:"nixhome"` // local nixhome path; overridden by DEVCELL_NIXHOME_PATH env
}

type OnePasswordSecrets struct {
	Documents []string `toml:"documents"` // 1Password document names to resolve via `op item get`
}

type OpSection struct {
	Documents []string `toml:"documents"` // 1Password document names to resolve via `op item get`
	Items     []string `toml:"items"`     // deprecated: use documents (kept for backwards compat)
}

type PackagesSection struct {
	Node   map[string]string `toml:"node"`   // name → npm version or range; "*" = latest
	Python map[string]string `toml:"python"` // name → mise version: "latest", "0.6", "0.6.9"; "*" = latest
	Nix    NixPackages       `toml:"nix"`

	// Deprecated [packages.npm], merged into Node by mergePackagesNode.
	Npm map[string]string `toml:"npm" hm:"-"`
}

type Policy interface {
	Label() string
	ForceProxy() bool
	DenyDirectInternet() bool
	DenyHostAccess() bool
	DenyPorts() bool
	DefaultPresets() []string
}

type PortsSection struct {
	Forward   []string `toml:"forward"`    // port mappings: "3000", "8080:3000"
	PublishIP string   `toml:"publish_ip"` // host interface for `docker run -p`; default "0.0.0.0". Applies to VNC, RDP, and all forward entries.
}

type ReadOnlySymlinkError struct {
	Path   string
	Link   string // the first hop, what `readlink` prints
	Target string // the fully resolved file
}

type SchemaOptions struct {
	Version      string            // published version (release tag); empty means DefaultSchemaVersion
	Descriptions map[string]string // "StructName.FieldName" → text; see FieldComments
	Modules      []string          // module names from the home catalog, offered as completions
	Stacks       []string          // stack names from the home catalog, offered as completions
}

type SecretsSection struct {
	OnePassword OnePasswordSecrets `toml:"onepassword"`
	Op          OnePasswordSecrets `toml:"op" hm:"-"` // alias for [secrets.onepassword]; TOML-only, not a nix option
}

type StealthSection struct {
	Arch     string `toml:"arch"`
	Platform string `toml:"platform"`
}

type StringList []string

type ThemeSection struct {
	Name        string `toml:"name"`         // preset; default: "devcell" (cool tone)
	BarBG       string `toml:"bar_bg"`       // background of the bar between elements
	BarFG       string `toml:"bar_fg"`       // foreground of the bar between elements
	WorkspaceBG string `toml:"workspace_bg"` // workspace name element
	WorkspaceFG string `toml:"workspace_fg"`
	CellBG      string `toml:"cell_bg"` // cell name element (<project>-<cellID>)
	CellFG      string `toml:"cell_fg"`
	StatusBG    string `toml:"status_bg"` // status panel (clocks), right-aligned
	StatusFG    string `toml:"status_fg"`
	Accent      string `toml:"accent"`    // copy-mode selection and messages
	Separator   string `toml:"separator"` // between status panel blocks; default: " | "
}

type VMPolicy interface {
	Policy
	RestrictNetwork() bool
	IsolatedVNet() bool
	PublishProxyPort() bool
}

type VolumeMount struct {
	Mount string `toml:"mount"`
}

type WireguardEntry struct {
	Name    string `toml:"name"`
	Enabled bool   `toml:"enabled"`
	Config  string `toml:"config"`
}