config

type AuditConfig struct {
	// Autofix overrides repository.DefaultAutofixPolicy per finding code. Keys
	// are finding codes (BRANCH_BEHIND_BASE, …); a code that is absent keeps its
	// built-in default, so a project states only where it disagrees.
	//
	// There are no tier names to choose from. A name like "aggressive" would
	// have to be decoded into behavior before anyone could trust it, and it
	// would force every code added later into a bucket someone else picked. A
	// per-code boolean is the same information without the indirection.
	//
	// Enabling a code here still cannot make an irreversible remediation
	// automatic: reversibility is checked after policy, so configuration widens
	// what is permitted but never what is safe.
	Autofix map[string]bool `yaml:"autofix,omitempty"`
}

type BranchConfig struct {
	DefaultBranch     BranchList `yaml:"defaultBranch,omitempty"`     // main, develop, master (string or list)
	ProtectedBranches []string   `yaml:"protectedBranches,omitempty"` // Branches to protect

	// IntegrationBranch is the ordered list of integration-branch names.
	// Consumers must read it from the repo-root file (LoadRepoRootTaskPattern),
	// not from the 5-layer merger.
	IntegrationBranch BranchList `yaml:"integrationBranch,omitempty"`

	// TaskPattern is the reclaim allow-list (first-* namespace prefix).
	// Load it only via LoadRepoRootTaskPattern — never findConfigUpward.
	TaskPattern BranchList `yaml:"taskPattern,omitempty"`

	// PrepareProfile selects a closed integration preparation profile. It is
	// preserved on a repository-root project config, but must never be
	// inherited or merged from a parent, profile, or workspace configuration.
	PrepareProfile string `yaml:"prepareProfile,omitempty" json:"prepareProfile,omitempty"`

	// Readiness is a target-owned integration gate. Like TaskPattern, it is
	// preserved here for project-config round trips but must never be inherited
	// or merged from a parent, profile, workspace, or global configuration.
	Readiness *Readiness `yaml:"readiness,omitempty" json:"readiness,omitempty"`

	// MakeTimeout bounds one `make check`/`make lint` probe of the legacy
	// integration gate, declared as a Go duration string ("90m", "1h30m").
	// Like IntegrationBranch and TaskPattern it is read only from the
	// repo-root file (LoadRepoRootTaskPattern) and never inherited or merged
	// from a parent, profile, workspace, or global configuration: a budget
	// declared in a shared layer would silently change every repository's
	// gate. Empty means the built-in default; pkg/config rejects a value it
	// cannot parse or a non-positive one when loading the declaration.
	MakeTimeout string `yaml:"makeTimeout,omitempty" json:"makeTimeout,omitempty"`

	// Naming templates the branch names that `gz-git branch name` builds, so a
	// task branch is spelled the same way on every machine and by every agent.
	Naming *branch.Naming `yaml:"naming,omitempty"`
}

type BranchList []string

type ChildConfigFormat string

type ChildConfigMode string

type CloneDefaults struct {
	Proto         string `yaml:"proto,omitempty"`         // ssh, https
	SSHPort       int    `yaml:"sshPort,omitempty"`       // Custom SSH port
	SSHKeyPath    string `yaml:"sshKeyPath,omitempty"`    // SSH private key file path
	SSHKeyContent string `yaml:"sshKeyContent,omitempty"` // SSH private key content (use ${ENV_VAR})
}

type Config struct {

	// Parent specifies an explicit path to a parent config file.
	// When set, the parent config is loaded and merged (child overrides parent).
	// Supports: absolute paths, home-relative (~), relative paths.
	Parent string `yaml:"parent,omitempty"`

	// Profile specifies which profile to use at this level
	Profile string `yaml:"profile,omitempty"`

	// Profiles defines named profiles inline (no external file needed)
	Profiles map[string]*Profile `yaml:"profiles,omitempty"`

	// Defaults groups all default settings
	Defaults *DefaultsConfig `yaml:"defaults,omitempty"`

	Provider         string `yaml:"provider,omitempty"`         // github, gitlab, gitea
	BaseURL          string `yaml:"baseURL,omitempty"`          // API endpoint
	Token            string `yaml:"token,omitempty"`            // API token (use ${ENV_VAR})
	IncludeSubgroups bool   `yaml:"includeSubgroups,omitempty"` // GitLab subgroups
	SubgroupMode     string `yaml:"subgroupMode,omitempty"`     // flat, nested

	// Default workspace settings
	DefaultWorkspaceType WorkspaceType `yaml:"defaultWorkspaceType,omitempty"` // forge/git/config

	// Self-sync configuration (sync config directory itself)
	SelfSync *SelfSyncConfig `yaml:"selfSync,omitempty"`

	// Command-specific overrides
	Sync   *SyncConfig   `yaml:"sync,omitempty"`
	Branch *BranchConfig `yaml:"branch,omitempty"`
	Fetch  *FetchConfig  `yaml:"fetch,omitempty"`
	Pull   *PullConfig   `yaml:"pull,omitempty"`
	Push   *PushConfig   `yaml:"push,omitempty"`

	// Hooks defines global before/after commands for all workspace syncs
	Hooks *Hooks `yaml:"hooks,omitempty"`

	// Workspaces is a map of named workspace configurations
	Workspaces map[string]*Workspace `yaml:"workspaces,omitempty"`

	// Metadata is optional information about this level
	Metadata *Metadata `yaml:"metadata,omitempty"`

	// Discovery controls how workspaces are discovered
	Discovery *DiscoveryConfig `yaml:"discovery,omitempty"`

	// ChildConfigMode sets the default child config mode for all workspaces.
	// Values: "repositories" (default), "workspaces", "none"
	ChildConfigMode ChildConfigMode `yaml:"childConfigMode,omitempty"`

	ParentConfig *Config `yaml:"-"` // Resolved parent config
	ConfigPath   string  `yaml:"-"` // Absolute path to this config file
}

type ConfigFileInfo struct {
	Path string
	Kind ConfigKind
}

type ConfigKind string

type ConfigLoader struct {
	// contains filtered or unexported fields
}

type ConfigMeta struct {
	// Version is the schema version (currently 1)
	Version int `yaml:"version,omitempty"`

	// Kind specifies the config type: "repositories" or "workspace"
	// If omitted, inferred from content:
	//   - Has "workspaces" or "profiles" key → workspace
	//   - Otherwise → repositories (default)
	Kind ConfigKind `yaml:"kind,omitempty"`

	// Metadata holds optional descriptive information
	Metadata *Metadata `yaml:"metadata,omitempty"`
}

type ConfigSource string

type ControllerConfig struct {
	Path, Digest string
	Workspaces   map[string]*Workspace
}

type DefaultsConfig struct {
	// Clone settings
	Clone *CloneDefaults `yaml:"clone,omitempty"`

	// Sync settings
	Sync *SyncDefaults `yaml:"sync,omitempty"`

	// Scan settings
	Scan *ScanDefaults `yaml:"scan,omitempty"`

	// Output settings
	Output *OutputDefaults `yaml:"output,omitempty"`

	// Filter settings
	Filter *FilterDefaults `yaml:"filter,omitempty"`
}

type DiscoveryConfig struct {
	// Mode controls the discovery behavior
	// Values: "explicit" (use children only), "auto" (scan directories),
	//         "hybrid" (use children if defined, otherwise scan)
	// Default: "hybrid"
	Mode DiscoveryMode `yaml:"mode,omitempty"`
}

type DiscoveryMode string

type EffectiveConfig struct {
	// Forge provider settings
	Provider string
	BaseURL  string
	Token    string

	// Clone settings
	CloneProto    string
	SSHPort       int
	SSHKeyPath    string
	SSHKeyContent string

	// Bulk operation settings
	Parallel         int
	IncludeSubgroups bool
	SubgroupMode     string

	// Identity, already resolved against the environment and hostname, so a
	// caller can use it without knowing where it came from.
	Identity identity.Identity

	// Command-specific settings
	Sync   SyncConfig
	Branch BranchConfig
	Fetch  FetchConfig
	Pull   PullConfig
	Push   PushConfig
	Audit  AuditConfig

	// Metadata for debugging
	Sources map[string]string // key -> source (e.g., "provider" -> "profile:work")
}

type Environment struct {
	GitHubToken string `yaml:"githubToken,omitempty"`
	GitLabToken string `yaml:"gitlabToken,omitempty"`
	GiteaToken  string `yaml:"giteaToken,omitempty"`
}

type Facts = IntegrationBranchFacts

type FetchConfig struct {
	AllRemotes bool `yaml:"allRemotes,omitempty"` // Fetch all remotes
	Prune      bool `yaml:"prune,omitempty"`      // Prune deleted branches
}

type FilterDefaults struct {
	Include []string `yaml:"include,omitempty"` // Include repos matching these patterns
	Exclude []string `yaml:"exclude,omitempty"` // Exclude repos matching these patterns
}

type FlexBranch string

type ForgeSource struct {
	// Provider is the forge type: gitlab, github, gitea
	Provider string `yaml:"provider"`

	// Org is the organization/group to sync from
	Org string `yaml:"org"`

	// BaseURL is the API endpoint (optional, uses default for provider)
	BaseURL string `yaml:"baseURL,omitempty"`

	// Token overrides the profile token (use ${ENV_VAR} for security)
	Token string `yaml:"token,omitempty"`

	// IncludeSubgroups includes subgroups (GitLab only)
	IncludeSubgroups bool `yaml:"includeSubgroups,omitempty"`

	// SubgroupMode controls directory structure: "flat" or "nested"
	SubgroupMode string `yaml:"subgroupMode,omitempty"`
}

type GlobalConfig struct {
	// ActiveProfile is the default profile to use
	ActiveProfile string `yaml:"activeProfile,omitempty"`

	// Defaults apply to all profiles unless overridden
	Defaults map[string]any `yaml:"defaults,omitempty"`

	// Identity names this machine and, if one is driving, the agent on it.
	// It lives here rather than in a project's .gz-git.yaml because that file
	// is committed, and a shared device name names nothing.
	Identity *identity.Identity `yaml:"identity,omitempty"`

	// Environments define named token sets
	Environments map[string]Environment `yaml:"environments,omitempty"`
}

type Hooks struct {
	Before []string `yaml:"before,omitempty"` // Commands to run before sync operation
	After  []string `yaml:"after,omitempty"`  // Commands to run after sync operation
}

type IntegrationBranchFacts struct {
	Config      []string
	Refs        []string
	Remotes     []string
	DefaultName string
}

type IntegrationBranchResolution struct {
	Participates bool
	Name         string
	Source       string
}

type IntegrationControl struct {
	PrepareProfile string `yaml:"prepareProfile,omitempty"`
}

type IntegrationParticipationAction string

type IntegrationParticipationState struct {
	Current string
	Marker  string
	Desired string
}

type KeyringTokenStore struct {
	// contains filtered or unexported fields
}

type Manager struct {
	// contains filtered or unexported fields
}

type MemoryTokenStore struct {
	// contains filtered or unexported fields
}

type Metadata struct {
	Name       string `yaml:"name,omitempty"`       // workstation, mydevbox, project-name
	Type       string `yaml:"type,omitempty"`       // development, production, personal
	Owner      string `yaml:"owner,omitempty"`      // archmagece, team-name
	Team       string `yaml:"team,omitempty"`       // backend, frontend
	Repository string `yaml:"repository,omitempty"` // https://...
}

type OutputDefaults struct {
	Compact bool   `yaml:"compact,omitempty"` // Omit redundant fields in generated configs
	Format  string `yaml:"format,omitempty"`  // Output format (default, compact, json, llm)
}

type Paths struct {
	// ConfigDir is the root config directory (~/.config/gz-git)
	ConfigDir string

	// ProfilesDir is the profiles directory (~/.config/gz-git/profiles)
	ProfilesDir string

	// StateDir is the state directory (~/.config/gz-git/state)
	StateDir string

	// GlobalConfigFile is the global config file path
	GlobalConfigFile string

	// ActiveProfileFile tracks the active profile
	ActiveProfileFile string
}

type Profile struct {
	// Name is the profile identifier (e.g., "work", "personal")
	Name string `yaml:"name"`

	// Forge provider settings
	Provider string `yaml:"provider,omitempty"` // github, gitlab, gitea
	BaseURL  string `yaml:"baseURL,omitempty"`  // API endpoint
	Token    string `yaml:"token,omitempty"`    // API token (use ${ENV_VAR})

	// Clone settings
	CloneProto    string `yaml:"cloneProto,omitempty"`    // ssh, https
	SSHPort       int    `yaml:"sshPort,omitempty"`       // Custom SSH port
	SSHKeyPath    string `yaml:"sshKeyPath,omitempty"`    // SSH private key file path (priority)
	SSHKeyContent string `yaml:"sshKeyContent,omitempty"` // SSH private key content (use ${ENV_VAR})

	// Bulk operation settings
	Parallel         int    `yaml:"parallel,omitempty"`         // Parallel job count
	IncludeSubgroups bool   `yaml:"includeSubgroups,omitempty"` // GitLab subgroups
	SubgroupMode     string `yaml:"subgroupMode,omitempty"`     // flat, nested

	// Identity names the machine and agent recorded on automated commits.
	Identity *identity.Identity `yaml:"identity,omitempty"`

	// Command-specific overrides
	Sync   *SyncConfig   `yaml:"sync,omitempty"`
	Branch *BranchConfig `yaml:"branch,omitempty"`
	Fetch  *FetchConfig  `yaml:"fetch,omitempty"`
	Pull   *PullConfig   `yaml:"pull,omitempty"`
	Push   *PushConfig   `yaml:"push,omitempty"`
	Audit  *AuditConfig  `yaml:"audit,omitempty"`
}

type ProjectConfig struct {
	// Profile specifies which profile to use for this project
	Profile string `yaml:"profile,omitempty"`

	// Command-specific overrides
	Sync   *SyncConfig   `yaml:"sync,omitempty"`
	Branch *BranchConfig `yaml:"branch,omitempty"`
	Fetch  *FetchConfig  `yaml:"fetch,omitempty"`
	Pull   *PullConfig   `yaml:"pull,omitempty"`
	Push   *PushConfig   `yaml:"push,omitempty"`
	Audit  *AuditConfig  `yaml:"audit,omitempty"`

	// Metadata is optional project information
	Metadata *ProjectMetadata `yaml:"metadata,omitempty"`
}

type ProjectMetadata struct {
	Team       string `yaml:"team,omitempty"`
	Repository string `yaml:"repository,omitempty"`
	Owner      string `yaml:"owner,omitempty"`
}

type PullConfig struct {
	Rebase bool `yaml:"rebase,omitempty"` // Use rebase instead of merge
	FFOnly bool `yaml:"ffOnly,omitempty"` // Fast-forward only
}

type PushConfig struct {
	SetUpstream bool `yaml:"setUpstream,omitempty"` // Auto set upstream

	// Policy restricts which branches push may write and how. Unset means no
	// branch is protected and only the built-in lease-only force rule applies.
	Policy *repository.PushPolicy `yaml:"policy,omitempty"`
}

type Readiness struct {
	Version int    `yaml:"version" json:"version"`
	Runner  string `yaml:"runner" json:"runner"`
}

type Resolution = IntegrationBranchResolution

type ScanDefaults struct {
	// Depth is the default scan depth for bulk operations. Zero means omitted,
	// so a child value of zero inherits its parent and a top-level zero keeps the
	// CLI default. Positive values opt into a different depth.
	Depth int `yaml:"depth,omitempty"`

	// Exclude holds regex patterns removed from the *local directory scan*
	// that every bulk command runs. It exists because the only way to keep a
	// repository out of `push`/`commit` used to be remembering `--exclude` on
	// every invocation, and forgetting it failed silently: the repository just
	// appeared as another success row.
	//
	// This is deliberately not `defaults.filter.exclude`. That key filters the
	// repository list a forge API returns to `workspace sync` and has never
	// affected the local scan, so reusing it would have made one name mean two
	// scopes. See GetScanExcludePatterns.
	Exclude []string `yaml:"exclude,omitempty"`
}

type SelfSyncConfig struct {
	// Enabled controls whether the config directory itself should be synced.
	// Default: false (config directory is not synced)
	Enabled bool `yaml:"enabled,omitempty"`

	// Strategy specifies how to sync the config directory.
	// Values: "fetch" (default, safe), "pull" (with dirty check), "skip"
	// Note: "reset" is not allowed for self-sync to prevent data loss.
	Strategy string `yaml:"strategy,omitempty"`
}

type SyncConfig struct {
	Strategy       string `yaml:"strategy,omitempty"`       // pull, reset, rebase, skip, clone
	MaxRetries     int    `yaml:"maxRetries,omitempty"`     // Retry count
	Timeout        string `yaml:"timeout,omitempty"`        // Operation timeout
	Recursive      bool   `yaml:"recursive,omitempty"`      // Auto-sync child workspace repos
	CleanupOrphans bool   `yaml:"cleanupOrphans,omitempty"` // Delete local repos not in forge
}

type SyncDefaults struct {
	Strategy   string `yaml:"strategy,omitempty"`   // reset, pull, rebase, fetch, skip, clone
	Parallel   int    `yaml:"parallel,omitempty"`   // Parallel workers
	MaxRetries int    `yaml:"maxRetries,omitempty"` // Retry count
	Timeout    string `yaml:"timeout,omitempty"`    // Operation timeout
}

type TaskPatternDecl struct {
	Patterns          []string
	IntegrationBranch BranchList
	// MakeTimeout is the declared branch.makeTimeout, already parsed. Zero
	// means the key is absent and the consumer applies its built-in default;
	// a present-but-invalid value never gets here because the load fails.
	MakeTimeout time.Duration
	Source      string
	Facts       []string
}

type TokenStore interface {
	Set(provider, token string) error
	Get(provider string) (string, error)
	Delete(provider string) error
	Available() bool
}

type Validator struct {
	// ExpandEnvVars enables environment variable expansion
	ExpandEnvVars bool
}

type Workspace struct {
	// Path is the target directory for this workspace
	// Supports: absolute (/foo/bar), relative (./foo), home-relative (~/foo)
	Path string `yaml:"path"`

	// ConfigLink specifies a config file to symlink into the workspace as .gz-git.yaml
	// Supports: absolute paths, home-relative (~/), relative (./), relative to parent config dir
	// The symlink is created at {workspace.Path}/.gz-git.yaml → {configLink}
	ConfigLink string `yaml:"configLink,omitempty"`

	// Hooks defines before/after commands for this workspace sync
	// Before hooks run before clone/update, After hooks run after successful sync
	Hooks *Hooks `yaml:"hooks,omitempty"`

	// Type specifies what kind of workspace this is
	// Values: "forge" (sync from forge), "git" (single repo), "config" (has nested config)
	// Default: "forge" if Source is set, "git" otherwise
	Type WorkspaceType `yaml:"type,omitempty"`

	// Profile overrides the parent profile for this workspace
	Profile string `yaml:"profile,omitempty"`

	// Access controls whether this machine may publish changes to the
	// workspace. Read-only workspaces are still cloned and pulled, but bulk
	// push and handoff never write to their remotes.
	Access WorkspaceAccess `yaml:"access,omitempty"`

	// URL is the git clone URL (required for type=git sync)
	// Supports: HTTPS, SSH, git:// protocols
	URL string `yaml:"url,omitempty"`

	// AdditionalRemotes defines extra git remotes to configure after clone
	// Map of remote name to URL (e.g., {"upstream": "https://github.com/original/repo.git"})
	AdditionalRemotes map[string]string `yaml:"additionalRemotes,omitempty"`

	// Source defines the forge to sync from
	Source *ForgeSource `yaml:"source,omitempty"`

	Sync     *SyncConfig `yaml:"sync,omitempty"`
	Parallel int         `yaml:"parallel,omitempty"`

	CloneProto    string        `yaml:"cloneProto,omitempty"`
	SSHPort       int           `yaml:"sshPort,omitempty"`
	SSHKeyPath    string        `yaml:"sshKeyPath,omitempty"`    // SSH private key file path
	SSHKeyContent string        `yaml:"sshKeyContent,omitempty"` // SSH private key content
	Branch        *BranchConfig `yaml:"branch,omitempty"`
	// Integration is an opt-in controller-owned integration policy. It is read
	// only when a caller explicitly selects this workspace config; it is never
	// inherited by a repository project config.
	Integration *IntegrationControl `yaml:"integration,omitempty"`
	Fetch       *FetchConfig        `yaml:"fetch,omitempty"`
	Pull        *PullConfig         `yaml:"pull,omitempty"`
	Push        *PushConfig         `yaml:"push,omitempty"`

	// Filter patterns (override parent patterns)
	IncludePatterns []string `yaml:"includePatterns,omitempty"` // Include repos matching these patterns
	ExcludePatterns []string `yaml:"excludePatterns,omitempty"` // Exclude repos matching these patterns

	// Workspaces allows nested workspace definitions
	Workspaces map[string]*Workspace `yaml:"workspaces,omitempty"`

	Metadata *Metadata `yaml:"metadata,omitempty"`

	// ChildConfigMode controls how child config files are generated during sync.
	// Values: "repositories" (default), "workspaces", "none"
	ChildConfigMode ChildConfigMode `yaml:"childConfigMode,omitempty"`
}

type WorkspaceAccess string

type WorkspaceType string