config

type AllowKey struct {
	Key    string `yaml:"key,omitempty"`     // base64 raw P-256 public key (optional)
	UserID string `yaml:"user_id,omitempty"` // relay user ID
	Email  string `yaml:"email,omitempty"`   // auto-set from relay, for display
}

type Config struct {
	Dir               string            `yaml:"-"`
	DefaultAgent      string            `yaml:"default_agent"`
	DefaultEmbedder   string            `yaml:"default_embedder"`
	WingID            string            `yaml:"wing_id"`
	Hostname          string            `yaml:"-"` // os.Hostname(), not persisted
	PollInterval      string            `yaml:"poll_interval"`
	DefaultMaxRetries int               `yaml:"max_retries"`
	RoostURL          string            `yaml:"roost_url"`
	Vars              map[string]string `yaml:"vars"`
}

type ICEServer struct {
	URLs       []string `yaml:"urls" json:"urls"`
	Username   string   `yaml:"username,omitempty" json:"username,omitempty"`
	Credential string   `yaml:"credential,omitempty" json:"credential,omitempty"`
}

type MCPConfig struct {
	Enabled         bool                      `yaml:"enabled"`
	DefaultAllowAll bool                      `yaml:"default_allow_all"`
	Roles           map[string]*MCPRoleConfig `yaml:"roles"`
}

type MCPRoleConfig struct {
	Enabled bool     `yaml:"enabled"`
	Allow   []string `yaml:"allow,omitempty"`
	Deny    []string `yaml:"deny,omitempty"`
	Members []string `yaml:"members,omitempty"`
}

type PathEntry struct {
	Path    string   `yaml:"path" json:"path"`
	Members []string `yaml:"members,omitempty" json:"members,omitempty"`
}

type PathList []PathEntry

type ToolConfig struct {
	Name          string            `yaml:"name"`
	Description   string            `yaml:"description,omitempty"`
	Params        []ToolParam       `yaml:"params,omitempty"`
	Run           string            `yaml:"run"`
	Env           map[string]string `yaml:"env,omitempty"`
	Timeout       string            `yaml:"timeout,omitempty"`
	MaxConcurrent int               `yaml:"max_concurrent,omitempty"`
}

type ToolParam struct {
	Name        string   `yaml:"name" json:"name"`
	Description string   `yaml:"description,omitempty" json:"description,omitempty"`
	Type        string   `yaml:"type,omitempty" json:"type,omitempty"`
	Required    bool     `yaml:"required,omitempty" json:"required,omitempty"`
	Enum        []string `yaml:"enum,omitempty" json:"enum,omitempty"`
	Examples    []any    `yaml:"examples,omitempty" json:"examples,omitempty"`
}

type WingConfig struct {
	WingID         string     `yaml:"wing_id"`
	Label          string     `yaml:"label,omitempty"` // display name shown in the web UI
	Roost          string     `yaml:"roost,omitempty"`
	Org            string     `yaml:"org,omitempty"`
	Paths          PathList   `yaml:"paths,omitempty"`
	Root           string     `yaml:"root,omitempty"` // compat: folded into Paths on load
	Labels         []string   `yaml:"labels,omitempty"`
	EggConfig      string     `yaml:"egg_config,omitempty"`
	Conv           string     `yaml:"conv,omitempty"`
	Audit          bool       `yaml:"audit,omitempty"`
	Debug          bool       `yaml:"debug,omitempty"`
	Locked         bool       `yaml:"locked,omitempty"`   // explicit lock mode toggle
	Spectate       bool       `yaml:"spectate,omitempty"` // allow spectator (read-only) session viewing
	AuthTTL        string     `yaml:"auth_ttl,omitempty"` // passkey auth token duration (default "1h")
	AllowKeys      []AllowKey `yaml:"allow_keys,omitempty"`
	Admins         []string   `yaml:"admins,omitempty"`          // emails with admin role (see all sessions, all paths)
	IdleTimeout    string     `yaml:"idle_timeout,omitempty"`    // kill sessions idle for this long (e.g. "4h")
	ConnectionMode string     `yaml:"connection_mode,omitempty"` // "relay" (default), "p2p", "p2p_only", "direct"

	// P2P / Direct mode settings
	ICEServers []ICEServer `yaml:"ice_servers,omitempty"` // STUN/TURN servers for WebRTC
	DirectPort int         `yaml:"direct_port,omitempty"` // port for direct WebSocket connections
	DirectTLS  bool        `yaml:"direct_tls,omitempty"`  // enable TLS for direct mode

	// JWT signing key for roost mode (base64-DER P-256 private key).
	// Auto-generated on first roost start. Server mode uses WT_JWT_KEY env instead.
	JWTKey string `yaml:"jwt_key,omitempty"`

	// ToolsDir is the directory containing privileged tool YAML configs.
	// Defaults to ~/.wingthing/tools/ if empty.
	ToolsDir string `yaml:"tools_dir,omitempty"`

	// MCP is the optional OAuth-gated remote surface over privileged tools.
	MCP *MCPConfig `yaml:"mcp,omitempty"`
}