deps

type DepSpec struct {
	Description string      `yaml:"description,omitempty"`
	Type        InstallType `yaml:"type"`
	Default     string      `yaml:"default,omitempty"`
	Versions    []string    `yaml:"versions,omitempty"`
	Requires    []string    `yaml:"requires,omitempty"`

	// For github-binary type
	Repo  string `yaml:"repo,omitempty"`
	Asset string `yaml:"asset,omitempty"` // Supports {version}, {arch}, {target} placeholders
	Bin   string `yaml:"bin,omitempty"`   // Supports {version}, {arch}, {target} placeholders

	// Targets maps Go architecture names to project-specific target strings.
	// Used for {target} placeholder substitution in Asset/Bin fields.
	// Example: {"amd64": "x86_64-unknown-linux-musl", "arm64": "aarch64-unknown-linux-gnu"}
	// If empty and {arch} is used, standard arch name mapping is applied.
	Targets map[string]string `yaml:"targets,omitempty"`

	// TagPrefix is the prefix used for release tags. Defaults to "v" if empty.
	// Set to "none" for repos that don't use a prefix (e.g., ripgrep uses "14.1.1" not "v14.1.1").
	// Set to a custom value for repos with non-standard prefixes (e.g., "bun-v" for bun).
	TagPrefix string `yaml:"tag-prefix,omitempty"`

	// Command is the name of the installed command if different from the dependency name.
	// For example, ripgrep installs as "rg", not "ripgrep".
	Command string `yaml:"command,omitempty"`

	// Legacy ARM64 support (deprecated, use Targets instead)
	AssetARM64 string `yaml:"asset-arm64,omitempty"`
	BinARM64   string `yaml:"bin-arm64,omitempty"`

	// For apt type
	Package string `yaml:"package,omitempty"`

	// For go-install type
	GoPackage string `yaml:"go-package,omitempty"`

	// For service type
	Service *ServiceDef `yaml:"service,omitempty"`

	// Env specifies environment variables to set after installing this dependency.
	// These are emitted as Dockerfile ENV instructions, making them available
	// to all subsequent build steps and at runtime.
	//
	// Note: currently only honored for github-binary type dependencies.
	Env map[string]string `yaml:"env,omitempty"`

	// UserInstall indicates the dependency should be installed as the container
	// user (moatuser) instead of root. This is needed for tools whose installers
	// write to $HOME (e.g., claude-code's native installer).
	UserInstall bool `yaml:"user-install,omitempty"`
}

type Dependency struct {
	Name            string      // e.g., "node", "eslint"
	Version         string      // e.g., "20" or "" for default
	OriginalVersion string      // Pre-resolution version (e.g., "3.11" before resolving to "3.11.15")
	Type            InstallType // Set for dynamic deps (npm:, pip:, etc.)
	Package         string      // For dynamic deps: the package name/path
	DockerMode      DockerMode  // For docker deps: "host" or "dind"
}

type DockerMode string

type DockerfileResult struct {
	// Dockerfile is the generated Dockerfile content.
	Dockerfile string

	// ContextFiles maps relative file paths to their contents.
	// These files should be written to the build context directory
	// alongside the Dockerfile (e.g., "moat-init.sh" → script content).
	ContextFiles map[string][]byte
}

type HooksConfig struct {
	PostBuild     string
	PostBuildRoot string
	PreRun        string
}

type ImageSpec struct {
	// NeedsSSH indicates SSH grants are present and the image needs
	// openssh-client, socat, and the moat-init entrypoint for agent forwarding.
	NeedsSSH bool

	// SSHHosts lists the hosts for which SSH access is granted (e.g., "github.com").
	// Known host keys will be added to /etc/ssh/ssh_known_hosts for these hosts.
	// Used only by Dockerfile generation.
	SSHHosts []string

	// InitProviders lists agent provider names (e.g., "claude", "codex", "gemini")
	// that need configuration files staged at container startup. Each entry
	// triggers the moat-init entrypoint and contributes to the image tag hash.
	InitProviders []string

	// NeedsFirewall indicates that iptables is needed for strict network
	// policy enforcement.
	NeedsFirewall bool

	// NeedsGitIdentity indicates the host's git identity should be injected
	// into the container. Used only by Dockerfile generation.
	NeedsGitIdentity bool

	// NeedsInitFiles indicates that providers have init files to write at
	// container startup.
	NeedsInitFiles bool

	// NeedsClipboard indicates the image needs Xvfb and xclip for host
	// clipboard bridging. Adds xvfb and xclip apt packages, and starts
	// Xvfb :99 in the moat-init entrypoint.
	NeedsClipboard bool

	// UseBuildKit enables BuildKit-specific features like cache mounts.
	// Used only by Dockerfile generation. Defaults to false if nil.
	UseBuildKit *bool

	// ClaudeMarketplaces are plugin marketplaces to register during image build.
	// Used only by Dockerfile generation.
	ClaudeMarketplaces []claude.MarketplaceConfig

	// ClaudePlugins are plugins to install during image build.
	// Format: "plugin-name@marketplace-name"
	ClaudePlugins []string

	// Hooks contains user-defined lifecycle hook commands.
	Hooks *HooksConfig
}

type InstallCommands struct {
	Commands []string          // Shell commands to run
	EnvVars  map[string]string // Environment variables to set
}

type InstallType string

type ServiceDef struct {
	Image        string            `yaml:"image"`
	Ports        map[string]int    `yaml:"ports"`
	EnvPrefix    string            `yaml:"env_prefix"`
	DefaultUser  string            `yaml:"default_user,omitempty"`
	DefaultDB    string            `yaml:"default_db,omitempty"`
	PasswordEnv  string            `yaml:"password_env,omitempty"`
	ExtraEnv     map[string]string `yaml:"extra_env,omitempty"`
	ExtraCmd     []string          `yaml:"extra_cmd,omitempty"`
	DBEnv        string            `yaml:"db_env,omitempty"`
	ReadinessCmd string            `yaml:"readiness_cmd"`
	URLScheme    string            `yaml:"url_scheme"`
	URLFormat    string            `yaml:"url_format"`

	// CachePath is the container-side path to mount for host-side caching.
	// If set, ~/.moat/cache/<service-name>/ is bind-mounted here.
	// This allows data to persist across runs (e.g., downloaded models).
	CachePath string `yaml:"cache_path,omitempty"`

	// ProvisionsKey names the key in user's services.<name> config that contains
	// a list of items to provision (e.g., "models"). Used with ProvisionCmd.
	ProvisionsKey string `yaml:"provisions_key,omitempty"`

	// ProvisionCmd is a command template executed once per provision item.
	// The placeholder {item} is replaced with each item value.
	// Commands run via sh -c inside the service container after readiness.
	ProvisionCmd string `yaml:"provision_cmd,omitempty"`
}