compiler

type NetworkPolicyData struct {
	DenyAll bool
}

type TemplateRuntimeData struct {
	Image          string
	Port           int
	Entrypoint     string // Pre-formatted JSON array string, e.g. ["python", "agent.py"]
	Env            map[string]string
	DepsFile       string
	DepsInstallCmd string
	HealthCheck    string
	User           string
	ModelEnv       map[string]string
}

type TemplateSpecData struct {
	AgentID       string
	Version       string
	Runtime       *TemplateRuntimeData
	Registry      string
	NetworkPolicy *NetworkPolicyData

	// Container packaging extensions
	EgressProfile        string
	EgressMode           string
	ToolInterfaceVersion string
	SkillsCount          int
	HasSkills            bool
	DevBuild             bool
	ProdBuild            bool

	// Skill requirements
	RequiredEnvVars []string
	OptionalEnvVars []string
	RequiredBins    []string

	// Framework
	ForgeFramework bool
	ForgeVersion   string // forge CLI version for GitHub release download (e.g. "v0.9.0")

	// Multi-stage build
	HasBinStage bool // true when a bins stage exists with installed binaries

	// Per-binary plumbing emitted in the application stage. See
	// forge-core/packaging.DockerfileFragments for the full design
	// (issue #149).
	BinCopies          []string // "COPY --from=<stage> /path /path" lines, one per binary.
	RuntimeAptPackages []string // runtime apt packages installed in the application stage (debian).
	RuntimeApkPackages []string // runtime apk packages installed in the application stage (alpine).
	PathExtensions     []string // PATH directories for non-standard binary locations.

	// KeepRuntimeCurl is true when curl is a declared runtime binary (present
	// in RuntimeAptPackages/RuntimeApkPackages). The forge-framework bootstrap
	// borrows curl to fetch the forge binary and then purges it; when a skill
	// legitimately requires curl at runtime, that purge would clobber it, so
	// the Dockerfile template skips the purge in that case.
	KeepRuntimeCurl bool
}