config

type AllowKey struct {
	Key    string `yaml:"key,omitempty"`     // base64 raw P-256 public key (optional)
	UserID string `yaml:"user_id,omitempty"` // relay user ID
	Email  string `yaml:"email,omitempty"`   // auto-set from relay, for display
}

type Config struct {
	Dir               string            `yaml:"-"`
	DefaultAgent      string            `yaml:"default_agent"`
	DefaultEmbedder   string            `yaml:"default_embedder"`
	WingID            string            `yaml:"wing_id"`
	Hostname          string            `yaml:"-"` // os.Hostname(), not persisted
	PollInterval      string            `yaml:"poll_interval"`
	DefaultMaxRetries int               `yaml:"max_retries"`
	RoostURL          string            `yaml:"roost_url"`
	Vars              map[string]string `yaml:"vars"`
	// contains filtered or unexported fields
}

type ContextConfig struct {
	URL        string   `yaml:"url"`
	ClientID   string   `yaml:"client_id"`
	SecretFile string   `yaml:"secret_file"`
	Scopes     []string `yaml:"scopes,omitempty"`
}

type DirectMCPConfig struct {
	Disabled         bool     `yaml:"disabled,omitempty"`
	AllowGrants      []string `yaml:"allow_grants,omitempty"`
	DenyGrants       []string `yaml:"deny_grants,omitempty"`
	MaxSessions      int      `yaml:"max_sessions,omitempty"`
	MaxSpawnsPerHour int      `yaml:"max_spawns_per_hour,omitempty"`
}

type ExportTarget struct {
	Name    string   `yaml:"name" json:"name"`
	Path    string   `yaml:"path" json:"-"`
	Members []string `yaml:"members,omitempty" json:"-"`
}

type ICEServer struct {
	URLs       []string `yaml:"urls" json:"urls"`
	Username   string   `yaml:"username,omitempty" json:"username,omitempty"`
	Credential string   `yaml:"credential,omitempty" json:"credential,omitempty"`
}

type LocalOwner struct {
	ID       string              `yaml:"id"`
	Bindings []RelayOwnerBinding `yaml:"relay_bindings,omitempty"`
}

type MCPConfig struct {
	Enabled         bool                      `yaml:"enabled"`
	DefaultAllowAll bool                      `yaml:"default_allow_all"`
	Roles           map[string]*MCPRoleConfig `yaml:"roles"`
}

type MCPRoleConfig struct {
	Enabled bool     `yaml:"enabled"`
	Allow   []string `yaml:"allow,omitempty"`
	Deny    []string `yaml:"deny,omitempty"`
	Members []string `yaml:"members,omitempty"`
}

type PathEntry struct {
	Path    string   `yaml:"path" json:"path"`
	Members []string `yaml:"members,omitempty" json:"members,omitempty"`
}

type PathList []PathEntry

type RelayOwnerBinding struct {
	RelayURL string `yaml:"relay_url"`
	UserID   string `yaml:"user_id"`
}

type Remote struct {
	SSHTarget      string `yaml:"ssh_target" json:"ssh_target"`
	WTBinary       string `yaml:"wt_binary,omitempty" json:"wt_binary,omitempty"`
	WingthingDir   string `yaml:"wingthing_dir,omitempty" json:"wingthing_dir,omitempty"`
	WingID         string `yaml:"wing_id,omitempty" json:"wing_id,omitempty"`
	ControlSocket  string `yaml:"control_socket,omitempty" json:"control_socket,omitempty"`
	ControlVersion string `yaml:"control_version,omitempty" json:"control_version,omitempty"`
}

type ToolConfig struct {
	Name          string            `yaml:"name"`
	Description   string            `yaml:"description,omitempty"`
	Params        []ToolParam       `yaml:"params,omitempty"`
	Run           string            `yaml:"run,omitempty"`
	Context       string            `yaml:"context,omitempty"`
	Env           map[string]string `yaml:"env,omitempty"`
	Timeout       string            `yaml:"timeout,omitempty"`
	MaxConcurrent int               `yaml:"max_concurrent,omitempty"`
}

type ToolParam struct {
	Name        string   `yaml:"name" json:"name"`
	Description string   `yaml:"description,omitempty" json:"description,omitempty"`
	Type        string   `yaml:"type,omitempty" json:"type,omitempty"`
	Required    bool     `yaml:"required,omitempty" json:"required,omitempty"`
	Enum        []string `yaml:"enum,omitempty" json:"enum,omitempty"`
	Examples    []any    `yaml:"examples,omitempty" json:"examples,omitempty"`
}

type WingConfig struct {
	WingID           string         `yaml:"wing_id"`
	Label            string         `yaml:"label,omitempty"` // display name shown in the web UI
	Roost            string         `yaml:"roost,omitempty"`
	Org              string         `yaml:"org,omitempty"`
	Paths            PathList       `yaml:"paths,omitempty"`
	Root             string         `yaml:"root,omitempty"` // compat: folded into Paths on load
	Labels           []string       `yaml:"labels,omitempty"`
	EggConfig        string         `yaml:"egg_config,omitempty"`
	Conv             string         `yaml:"conv,omitempty"`
	Audit            bool           `yaml:"audit,omitempty"`
	Debug            bool           `yaml:"debug,omitempty"`
	AllowUnsandboxed bool           `yaml:"allow_unsandboxed,omitempty"` // personal local MCP may request the outer host boundary
	Locked           bool           `yaml:"locked,omitempty"`            // explicit lock mode toggle
	Spectate         bool           `yaml:"spectate,omitempty"`          // allow spectator (read-only) session viewing
	AuthTTL          string         `yaml:"auth_ttl,omitempty"`          // passkey auth token duration (default "1h")
	AllowKeys        []AllowKey     `yaml:"allow_keys,omitempty"`
	Admins           []string       `yaml:"admins,omitempty"`          // emails with admin role (see all sessions, all paths)
	Exports          []ExportTarget `yaml:"exports,omitempty"`         // explicitly allowed browser export destinations
	IdleTimeout      string         `yaml:"idle_timeout,omitempty"`    // kill sessions idle for this long (e.g. "4h")
	ConnectionMode   string         `yaml:"connection_mode,omitempty"` // "relay" (default), "p2p", "p2p_only", "direct"
	HostedRelay      string         `yaml:"hosted_relay,omitempty"`    // "allow" (default) or "deny"
	Conversations    string         `yaml:"conversations,omitempty"`   // opt-in stable host mailbox: "enabled" or "disabled" (default)

	// P2P / Direct mode settings
	ICEServers []ICEServer `yaml:"ice_servers,omitempty"` // STUN/TURN servers for WebRTC
	DirectPort int         `yaml:"direct_port,omitempty"` // port for direct WebSocket connections
	DirectTLS  bool        `yaml:"direct_tls,omitempty"`  // enable TLS for direct mode

	// JWT signing key for roost mode (base64-DER P-256 private key).
	// Auto-generated on first roost start. Server mode uses WT_JWT_KEY env instead.
	JWTKey string `yaml:"jwt_key,omitempty"`

	// ToolsDir is the directory containing privileged tool YAML configs.
	// Defaults to ~/.wingthing/tools/ if empty.
	ToolsDir string         `yaml:"tools_dir,omitempty"`
	Context  *ContextConfig `yaml:"context,omitempty"`

	// MCP is the optional OAuth-gated remote surface over privileged tools.
	MCP       *MCPConfig       `yaml:"mcp,omitempty"`
	DirectMCP *DirectMCPConfig `yaml:"direct_mcp,omitempty"`
}