config

type AuthStatus struct {
	Profile  string `json:"profile"`
	Valid    bool   `json:"valid"`
	Source   string `json:"source"`
	Redacted string `json:"redacted"`
	Error    string `json:"error,omitempty"`
}

type AuthType string

type CleanupFailure struct {
	Profile string
	Err     error
}

type CleanupNote struct {
	Profile string
	Message string
}

type Config struct {
	DefaultProfile string            `koanf:"default_profile" toml:"default_profile"`
	Profiles       []Profile         `koanf:"profiles" toml:"profiles"`
	Theme          Theme             `koanf:"theme" toml:"theme"`
	TUI            TUI               `koanf:"tui" toml:"tui"`
	QueriesPath    string            `koanf:"queries_path" toml:"queries_path"`
	Aliases        map[string]string `koanf:"aliases" toml:"aliases"`
	// Editor is the global default external-editor command for rich-text
	// edits. Per-profile Editor overrides this when set.
	// Resolution chain: $JIRA_EDITOR → profile.editor → config.editor →
	// $EDITOR → $VISUAL → "vi".
	Editor string `koanf:"editor" toml:"editor"`
}

type CredentialError struct {
	// Type is the broad classification (auth or validation).
	Type ErrorType
	// ErrCode is the stable normalized code, the primary branch target.
	ErrCode ErrorCode
	// Message is a display message safe for humans and agents. It never
	// contains a secret.
	Message string
	// HintMsg is a short next-action hint. It never contains a secret and
	// never suggests a mutating command unless the failed command was itself
	// mutating auth state.
	HintMsg string
	// IsRetryable reports whether retrying the same operation could succeed.
	IsRetryable bool
	// Context carries optional, fixed-shape context (flag, config key, etc.).
	Context ErrorContext
	// Upstream carries optional provider metadata when the backend exposes a
	// structured code or status. Nil when none is available.
	Upstream *UpstreamProvider
	// Wrapped is the underlying error, preserved so provider-specific callers
	// can still use errors.As against it.
	Wrapped error
}

type CredentialMigration struct {
	Profile      string
	ProfileIndex int
	Source       CredentialStore
	Destination  CredentialStore
	SourceRef    SecretRef
	DestRef      SecretRef
}

type CredentialStore interface {
	Get(context.Context, SecretRef) (string, error)
	Put(context.Context, SecretRef, string) error
	Delete(context.Context, SecretRef) error
}

type ErrorCode string

type ErrorContext struct {
	// Flag is the CLI flag involved, when the failure is flag-related.
	Flag string
	// ConfigKey is the config key involved, when the failure is config-related.
	ConfigKey string
	// Backend is the credential backend involved (keyring, 1password).
	Backend string
	// CredentialSource is the credential input source involved
	// (stdin, env, prompt, json).
	CredentialSource string
}

type ErrorType string

type FileCredentialStore struct {
	// contains filtered or unexported fields
}

type KeyDesc struct {
	Name        string
	Description string
	// Choices lists the valid values when the key has a closed enum;
	// nil means freeform string/int.
	Choices []string
}

type KeyringStore struct{}

type MemoryCredentialStore struct {
	// contains filtered or unexported fields
}

type MigrationReport struct {
	CleanupFailures []CleanupFailure
	CleanupNotes    []CleanupNote
}

type OnePasswordStore struct {
	// Client, when set, is used directly — tests inject an in-memory fake here.
	Client onePasswordClient
	// NewClient, when set, builds a client per request; it defaults to the
	// real SDK client when neither Client nor NewClient is supplied.
	NewClient onePasswordClientFactory
}

type Option func(*loadOptions)

type Profile struct {
	Name             string   `koanf:"name" toml:"name"`
	BaseURL          string   `koanf:"base_url" toml:"base_url"`
	AuthType         AuthType `koanf:"auth_type" toml:"auth_type"`
	Email            string   `koanf:"email" toml:"email"`
	DefaultProject   string   `koanf:"default_project" toml:"default_project"`
	DefaultIssueType string   `koanf:"default_issue_type" toml:"default_issue_type"`
	// DefaultBoard is the profile-scoped default board NAME. When set and
	// no `--board`/`--board-id` flag is supplied, the consuming command
	// resolves it against the boards cache and applies the resulting
	// scope. NOT validated at set time; the cache may not exist yet.
	// Use-time validation lives in boardscope.FromFlags. An explicit
	// `--board ""` suppresses any configured default.
	DefaultBoard    string        `koanf:"default_board" toml:"default_board"`
	RefreshInterval int           `koanf:"refresh_interval" toml:"refresh_interval"`
	TimeoutSeconds  int           `koanf:"timeout" toml:"timeout"`
	WorkdaySeconds  int           `koanf:"workday_seconds" toml:"workday_seconds"`
	SecretBackend   SecretBackend `koanf:"secret_backend" toml:"secret_backend"`
	// CloudID, when set, marks this profile as using a scoped (granular)
	// Atlassian API token. The auth mechanism is unchanged — HTTP Basic with
	// the account email and token — but REST calls must route through the
	// Atlassian gateway (https://api.atlassian.com/ex/jira/<cloud_id>/...)
	// because the site host rejects scoped tokens. BaseURL is still stored as
	// the site URL for cloudId discovery, display, and browser links; the
	// effective request base URL is derived by ClientBaseURL. Empty means a
	// classic API token addressed directly at the site.
	CloudID            string `koanf:"cloud_id" toml:"cloud_id"`
	OnePasswordAccount string `koanf:"onepassword_account" toml:"onepassword_account"`
	Vault              string `koanf:"vault" toml:"vault"`
	Item               string `koanf:"item" toml:"item"`
	// TeamAccountIDs lists the account IDs of teammates whose issues count
	// as "my team" in TUI filtering. Optional.
	TeamAccountIDs []string `koanf:"team_account_ids" toml:"team_account_ids"`
	// AccountID is the user's own Jira Cloud accountId. Used by `--assignee me`
	// (CLI) and the "A" key (TUI) so assignments target the canonical user
	// identifier. Optional; falls back to email when blank.
	AccountID string `koanf:"account_id" toml:"account_id"`
	// ReadOnly blocks every mutation command for this profile and returns a
	// validation error (exit 3). Useful when handing credentials to an AI
	// agent. The env var JIRA_READ_ONLY (truthy: 1/true/yes/on) layers on
	// top — once set globally, every profile becomes read-only regardless
	// of its own setting.
	ReadOnly bool `koanf:"read_only" toml:"read_only"`
	// Editor is the per-profile external-editor command override.
	// When set, takes precedence over the global Config.Editor.
	// Resolution chain: $JIRA_EDITOR → profile.editor → config.editor →
	// $EDITOR → $VISUAL → "vi".
	Editor string `koanf:"editor" toml:"editor"`
}

type ProfileIncompleteError struct {
	Name string
}

type ProfileNotDefinedError struct {
	Name string
}

type Query struct {
	Name        string
	Description string
	Project     string
	JQL         string
}

type SecretBackend string

type SecretRef struct {
	Profile string
	Backend SecretBackend
	Account string
	Vault   string
	Item    string
	// ItemIsDefault reports whether Item is the jira-cli-derived default name
	// rather than a name the profile pinned itself. It records 1Password item
	// ownership: jira-cli owns and may delete an item it named by default, but
	// must never delete an item the user named.
	ItemIsDefault bool
	// Host is the site host of the profile's Jira base URL (e.g.
	// "company.atlassian.net"). It scopes the credential to the site, so the
	// same profile name pointing at two sites does not share an entry.
	Host string
}

type TUI struct {
	RefreshInterval int      `koanf:"refresh_interval" toml:"refresh_interval"`
	DefaultTab      string   `koanf:"default_tab" toml:"default_tab"`
	Tabs            []string `koanf:"tabs" toml:"tabs"`
	// Preview docks the issue sidebar: right, left, bottom, hidden, or auto
	// (right on wide terminals, bottom on narrow). Applies on hot-reload too.
	Preview string `koanf:"preview" toml:"preview"`
	// Sections are user-defined dashboard tabs: each entry is a
	// saved JQL query that becomes its own tab with its own result count.
	Sections []TUISection `koanf:"sections" toml:"sections"`
	// PreviewSize is the preview pane's share of the split as a percent
	// (20–80; values outside clamp, 0/absent keeps the 50% default).
	PreviewSize int `koanf:"preview_size" toml:"preview_size"`
	// Keys rebinds TUI actions: action name → key list (the first key shows
	// in help). Unknown action names surface as a footer error rather than
	// failing the load. Applies on hot-reload; removing an entry restores
	// the default binding.
	Keys map[string][]string `koanf:"keys" toml:"keys"`
	// Lenses replace the issues tab's built-in quick-filters (Mine/Sprint/
	// Updated/Reported) with custom titled JQL queries. Absent or empty
	// keeps the built-ins.
	Lenses []TUISection `koanf:"lenses" toml:"lenses"`
	// DefaultLens names the lens (by title, case-insensitive) the issues tab
	// lands on. Absent or unmatched falls back to the first lens.
	DefaultLens string `koanf:"default_lens" toml:"default_lens"`
}

type TUISection struct {
	Title string `koanf:"title" toml:"title"`
	JQL   string `koanf:"jql" toml:"jql"`
}

type Theme struct {
	Name string `koanf:"name" toml:"name"`
	Path string `koanf:"path" toml:"path"`
}

type UpstreamProvider struct {
	// Provider names the backend, e.g. "onepassword-sdk".
	Provider string
	// UpstreamCode is a bounded, redacted provider code when one can be parsed
	// safely. Empty when the provider exposes none.
	UpstreamCode string
	// UpstreamStatus is a provider status or process exit code. Zero when the
	// provider exposes none.
	UpstreamStatus int
}