config

type AutoupdateConfig struct {
	CacheTTL    int          `yaml:"cache_ttl"`    // Cache TTL in seconds (default: 3600)
	HTTPTimeout int          `yaml:"http_timeout"` // Per-request HTTP timeout in seconds (default: 30)
	LLM         LLMConfig    `yaml:"llm"`          // LLM provider configuration
	Search      SearchConfig `yaml:"search"`       // Search provider configuration
	// Distdir is the directory `pkgdev manifest` is given as --distdir on the
	// autoupdate path — the same name and the same meaning the `overlay
	// manifest` command's --distdir already has. Unset (the
	// default) means the host's own DISTDIR is used, which is what
	// `portageq distdir` reports.
	Distdir string `yaml:"distdir,omitempty"`
	// DistfilesCache is the read-only distfiles cache consulted before a
	// download, again under the name `overlay manifest` already uses.
	// Unset means the built-in default (/var/cache/distfiles).
	// The cache is only ever read from: files are symlinked into the working
	// distdir, never written back.
	DistfilesCache string `yaml:"distfiles_cache,omitempty"`
	// Validate is the staged-bump validation policy. It is nested
	// here rather than at the top level because everything it governs happens
	// during an autoupdate.
	Validate ValidateConfig `yaml:"validate,omitempty"`
	// Review is the budget one `overlay compare` divergence review runs
	// under. It is nested here rather than in a top-level `compare:`
	// block — where the name would fit better — because a top-level block has
	// to be mirrored into probeConfig by hand and a nested one inherits that
	// mirror for free. ReviewConfig carries the whole of that reasoning.
	Review ReviewConfig `yaml:"review,omitempty"`
}

type Config struct {
	Overlay      OverlayConfig          `yaml:"overlay"`
	Git          GitConfig              `yaml:"git"`
	Autoupdate   AutoupdateConfig       `yaml:"autoupdate,omitempty"`
	Repositories map[string]*RepoConfig `yaml:"repositories,omitempty"`
	// UI is the global rendering policy. It sits at the top level
	// rather than under `autoupdate` because it governs every command that
	// reports progress — `autoupdate` and `overlay manifest` today — and a key
	// that has to be repeated per command is a key that ends up set in one
	// place and forgotten in the other.
	UI UIConfig `yaml:"ui,omitempty"`
	// Notice configures `bentoo notice`.
	Notice NoticeConfig `yaml:"notice,omitempty"`
	// Tray configures bentoo-tray.
	Tray TrayConfig `yaml:"tray,omitempty"`
}

type GitConfig struct {
	User  string `yaml:"user"`
	Email string `yaml:"email"`
}

type LLMConfig struct {
	Provider     string  `yaml:"provider"`                 // LLM provider name (e.g., "claude")
	APIKeyEnv    string  `yaml:"api_key_env"`              // Environment variable name for API key
	Model        string  `yaml:"model"`                    // Model name to use
	Bare         string  `yaml:"bare,omitempty"`           // CLI bare-mode selector: "auto" (default), "true", or "false"
	MaxBudgetUSD float64 `yaml:"max_budget_usd,omitempty"` // Optional spend cap passed to the CLI provider via --max-budget-usd
}

type NoticeConfig struct {
	// SitePath is the site repository's root; the notice YAML goes under
	// <site_path>/src/content/notices/. Empty means "print the YAML instead".
	// A leading `~/` is expanded by GetNoticeSitePath.
	SitePath string `yaml:"site_path,omitempty"`
}

type OverlayConfig struct {
	Path   string `yaml:"path"`
	Remote string `yaml:"remote"`
}

type OverlayValidationError struct {
	Path   string
	Errors []string
}

type OverlayValidationResult struct {
	Valid    bool     // True if overlay structure is valid
	Errors   []string // Critical issues that prevent operation
	Warnings []string // Non-critical issues
}

type RepoConfig struct {
	Provider string `yaml:"provider"` // "github", "gitlab", "git", or "local"
	URL      string `yaml:"url"`      // Full URL or org/repo for GitHub/GitLab/git (remote)
	Path     string `yaml:"path"`     // On-disk tree for provider "local" (read in place, no clone)
	Branch   string `yaml:"branch"`   // Branch to use (default: master/main)
}

type ReviewConfig struct {
	// Timeout bounds one review invocation, in SECONDS — the same unit and
	// shape as cache_ttl, http_timeout and autoupdate.validate.timeout, because
	// YAML has no duration literal and an int of seconds is what this file
	// already speaks. Unset, zero or negative means the default: a budget of
	// zero seconds would kill every review the instant it started, which is
	// the failure this key exists to bound and not a way to configure it.
	Timeout int `yaml:"timeout,omitempty"`
}

type SearchConfig struct {
	Provider  string `yaml:"provider"`    // Search provider name (e.g., "perplexity")
	APIKeyEnv string `yaml:"api_key_env"` // Environment variable name for API key
}

type TrayConfig struct {
	// Interval is a time.ParseDuration string; empty means DefaultTrayInterval.
	Interval string `yaml:"interval,omitempty"`
	// FeedURL is the notices feed; empty means DefaultTrayFeedURL.
	FeedURL string `yaml:"feed_url,omitempty"`
	// Mute lists notice types that are recorded unread but never notified.
	Mute []string `yaml:"mute,omitempty"`
	// DowngradeCritical sends critical notices at normal urgency.
	DowngradeCritical bool `yaml:"downgrade_critical,omitempty"`
	// SkipMetered is a pointer so an explicit false stays distinct from an
	// absent key, whose default is true.
	SkipMetered *bool `yaml:"skip_metered,omitempty"`
}

type UIConfig struct {
	// Mode is the renderer to use: auto, plain, inline or fullscreen — the
	// same four words the --ui flag and the BENTOO_UI environment variable
	// accept, so a value that works in one works in the others.
	//
	// It is neither validated nor defaulted here, by design:
	//   - No validation: internal/common/report.ResolveMode owns the legal set
	//     and names it in its rejection message; a second list here would
	//     drift. The value is stored verbatim, and this package does not
	//     depend on report.
	//   - No default: the empty string means the operator said nothing, which
	//     must stay distinguishable from an explicit `mode: auto` so an
	//     unconfigured run behaves exactly as before this key existed.
	Mode string `yaml:"mode,omitempty"`
}

type ValidateConfig struct {
	// Depths is the per-class depth table, keyed by the bump classes
	// internal/autoupdate/validate.Classify produces. A class left unset
	// answers its documented default, never the empty string.
	Depths ValidateDepths `yaml:"depths,omitempty"`
	// RequireIsolation makes a compile gate SKIP rather than run unisolated,
	// so a pass never claims a fidelity it did not have. It defaults to false
	// because `unshare --net` is denied on ordinary hosts, and a default of
	// true would turn every build gate into a SKIPPED (the --require-isolation
	// default, unchanged now that it has a key).
	RequireIsolation bool `yaml:"require_isolation,omitempty"`
	// RequireProof refuses to publish a bump whose validation could not reach
	// the depth policy asked for. It defaults to false: an ordinary
	// workstation rarely holds every build dependency, so a default of true
	// would refuse most bumps for a reason that says nothing about them.
	// The unreached depth is reported either way.
	RequireProof bool `yaml:"require_proof,omitempty"`
	// Review and FixOnFailure are the two LLM capabilities, and they are
	// TRI-STATE on purpose. The capabilities are enabled by --llm; this
	// configuration can only SUBTRACT from that flag, never add to it.
	// A plain bool cannot express "leave it to the flag" and
	// "switch this one back off" as different things, so an unset key stays
	// nil and only an explicit `review: false` disables. GetReview reports the
	// configured value alone (false unless the file says true); the flag layer
	// combines the two through ReviewDisabled.
	Review *bool `yaml:"review,omitempty"`
	// FixOnFailure is the build fixer, tri-state for the same reason as
	// Review above.
	FixOnFailure *bool `yaml:"fix_on_failure,omitempty"`
	// Timeout bounds a single agent run, in SECONDS — the same unit and shape
	// as cache_ttl and http_timeout above, because YAML has no duration
	// literal and an int of seconds is what this file already speaks. It is
	// read by the reviewer and by the build fixer: an agent with no deadline
	// hangs an unattended sweep. Unset or non-positive means the default.
	Timeout int `yaml:"timeout,omitempty"`
	// Packages holds per-package overrides, keyed by category/name. An
	// override supplies the depth to use and the reason it is used; an
	// override with no reason is reported invalid, naming the package,
	// because an override is the one input that can quietly reduce how much a
	// bump is checked.
	//
	// The packages nobody wants to build from source ship AS ORDINARY ENTRIES
	// in this map (see DefaultPackageOverrides), not as a hardcoded tier list,
	// so the reason rules reach them exactly as they reach anything an
	// operator writes — and so the report that says why a bump was not
	// validated can quote their reason like any other.
	Packages map[string]ValidatePackageOverride `yaml:"packages,omitempty"`
}

type ValidateDepths struct {
	Revision string `yaml:"revision,omitempty"`
	Patch    string `yaml:"patch,omitempty"`
	Series   string `yaml:"series,omitempty"`
	Major    string `yaml:"major,omitempty"`
}

type ValidatePackageOverride struct {
	// Depth is a rung of the validation ladder, spelled exactly as
	// internal/autoupdate/validate.ParseDepth accepts it: none, options,
	// patches, configure, compile, install. It is stored and reported verbatim
	// — this package deliberately neither trims nor case-folds it, because
	// ParseDepth does not either, and a config layer that silently repaired
	// " Compile " would make the name in the file and the name in the report two
	// different strings.
	Depth string `yaml:"depth"`
	// Reason is why this package departs from its class depth. It is required:
	// see OverrideErrors.
	Reason string `yaml:"reason"`
}